The state of Hawaii Office of the Auditor released a report Friday critical of the Hawaii State Department of Education’s policies and procedures for handling positive COVID-19 test results in staff, teachers, and students.

“Although DOE has communication policies and procedures in place to address COVID-19 cases, we question whether the department is following its own guidance. DOE generally has not provided information about COVID-19 cases on school campuses and the limited information that it does share has been inconsistent and incomplete,” the report said.

“For instance, DOE had not been publicizing positive cases until pressed by HSTA. Then, citing privacy laws, DOE only provided information by large complex areas, prompting the teachers’ union to begin identifying specific schools,” the auditor’s report added.

On Aug. 11, the HSTA held a news conference calling out the HIDOE for failing to disclose campus COVID-19 cases publicly. Four days later, the department began weekly disclosures of positive cases by complex area, which still failed to provide timely and specific information to the public.

The timing of communication to co-workers, teachers, and the public appears to be of particular concern, the report found.

“Disclosing the summer school cases apparently well after-the-fact, disclosing cases by a large complex area instead of by individual school, and lack of timely notification about updated policies have all been noted in media reports and in our discussions with the teachers’ union. DOE’s communication has been delayed, inconsistent, and with limited specificity. We question the department’s reference to FERPA (U.S. Family Educational Rights and Privacy Act) and HIPAA (U.S. Health Insurance Portability and Accountability Act) in justifying limiting the information about positive cases, when guidance issued by the federal agencies that oversee those laws specific to COVID-19 seems to reflect neither FERPA nor HIPAA prohibit public dissemination of nonpersonally identifiable information,” the report said.

“The department’s Communications Plan seems to delegate school-level communication decisions to the principals, including informing their respective school communities about positive cases. While we are aware, anecdotally, about some school principals sending letters about positive cases to teachers and staff, we were unable to determine whether principals have notified students, families, and others who are part of the 'impacted school community’ about all of the positive cases on their respective school campuses,” according to the auditor’s report. 

The report also said, “We received no cooperation from DOE. The department did not provide any of the documents we requested, limiting our review to policies and procedures that are publicly available on DOE’s website and elsewhere online. We had hoped to interview DOE to clarify how these plans have been implemented and followed, among other things. However, notwithstanding repeated requests, DOE declined to schedule meetings with us before the issuance of this report.”

“As many of our questions echo those being asked by the public and public officials, it is unreasonable for DOE to refuse our requests about their safety and health guidelines. This is especially critical since teachers and some students have already returned to campus,” the auditor said.

The report makes the following recommendations: 

1. DOE must update its policies and procedures, as needed, to be consistent with current state and county policies, including the governor’s proclamations and amendments thereto and the orders issued by the county mayors. While we recognize the situation continues to evolve and is fluid, if the Pandemic Plan and the handbooks are intended to be DOE’s policies and procedures relating to the current COVID-19 situation, those documents need to be continually and immediately updated as the State of Hawai‘i, the various counties, and the department’s policies and procedures change. We noted a number of policies and procedures that appear to be inconsistent with the department’s actual approach to positive cases on its school campuses. 

2. DOE must obtain legal guidance from the Department of the Attorney General about the application of HIPAA, FERPA, and other privacy laws to reporting of COVID-19 confirmed positive cases on school campuses. Specifically, the Department of Attorney General should advise as to whether, among other things: 

  1. HIPAA bars the department from disclosing that an unnamed DOE employee has tested positive at a specific public school; 
  2. HIPAA bars the department from disclosing that an unnamed student has tested positive at a specific public school; 
  3. HIPAA bars the department from disclosing that an unnamed individual who was on a specific public school campus has tested positive; 
  4. FERPA bars the department from disclosing that an unnamed DOE employee has tested positive at a specific public school; 
  5. FERPA bars the department from disclosing that an unnamed student has tested positive at a specific public school; and 
  6. FERPA bars the department from disclosing that an unnamed individual who was on a specific public school campus has tested positive. 

To the extent HIPAA, FERPA, and other laws do not prohibit DOE from reporting information about positive cases, the department should do so no later than 24 hours after it is informed of a positive case. That disclosure should state, among other things:

  1. the date of the positive test result; 
  2. whether the positive case is a teacher, an administrator, support staff, or a student; 
  3. the specific school where the department employee works or the student attends; 
  4. the times the infected person was on the school campus in the two days immediately prior to positive test results; and 
  5. the dates and times the infected person was on campus after the positive test results. Information should include details about the cleaning and disinfecting of affected spaces, including the closure of school campuses or school facilities.

3. DOE should report, separately, the number of school personnel and students who are self- isolating and self-quarantining by school and update those numbers within 24 hours of changes to the number of school personnel and students who are directed to self-isolate and self-quarantine. 

4. DOE must provide complete and timely information to the public about changes to its policies and procedures relating to the department’s COVID-19 response, generally, and not limited to DOE’s protocols for when there is a positive case on a school campus. For instance, the department must provide the criteria or other considerations it is using to formulate decisions regarding, for instance, when students will be allowed to return to school campuses for in-person instruction.