Shteynlyuger v. Ctrs. for Medicare & Medicaid Servs., No. 20-2982, 2023 WL 6389139 (D.D.C. Sept. 30, 2023) (Moss, J.)

Shteynlyuger v. Ctrs. for Medicare & Medicaid Servs., No. 20-2982, 2023 WL 6389139 (D.D.C. Sept. 30, 2023) (Moss, J.)

Re:  Requests for records concerning enforcement of HIPAA’s Administrative Simplification Requirements

Disposition:  Denying defendant’s motion for summary judgment; granting in part and denying in part defendant’s motion for summary judgment

• Litigation Considerations, Exhaustion of Administrative Remedies:  “The Court . . . concludes that Plaintiff has exhausted his administrative remedies with respect to his May 15 FOIA request and, thus, rejects [defendant’s] exhaustion defense.”  “[The Centers for Medicare and Medicaid Services (“CMS”)] describes [the] May 22 letter as a ‘formal acknowledgement letter’ that ‘confirmed the agency’s receipt of the request, advised that a search for documents had been initiated, and explained the unusual and exceptional circumstances that would impact the agency’s response time, informed Plaintiff of the control number, the alternatives if voluminous records are located, and fees which may be incurred.’”  “In other words, the letter explained to Plaintiff how the agency’s process for responding to his request would proceed.”  “It did not provide Plaintiff with a determination of any kind; it did not, for example, inform him whether the agency would produce the documents he sought or whether it withhold any documents pursuant to certain exemptions.”  “The Court thus concludes that Plaintiff did not receive a ‘determination’ of any kind from CMS with respect to his May 15 FOIA request within 20 working[] days, and thus he constructively exhausted that request before he filed suit on October 16, 2020.”  “CMS does make one final attempt to argue that Plaintiff has not exhausted his May 15 claims.”  “It argues that even if Plaintiff constructively exhausted those claims when he filed suit, the agency remedied its failure to respond to his May 15 FOIA request when it ‘released 1,971 pages in full, 133 pages in part, and withheld 1,231 pages entirely pursuant to exemptions 4, 5, and 6 of the FOIA’ on January 26, 2021, and Plaintiff never appealed that response.”  “But this argument misunderstands the principle that an agency can ‘cure’ its failure to timely respond to a FOIA request by responding, and thereby foreclose a requester’s ability to constructively exhaust their claim.”  “To be sure, the D.C. Circuit has held that, ‘if an agency responds to the request after the deadline, but before the requester has filed suit, the requesting party must exhaust administrative remedies before seeking judicial review.’”  “But the D.C. Circuit has not extended this principle to permit an agency to cure its failure to respond after the requester has filed suit, thereby ‘un-exhausting’ a claim that was exhausted at the time the FOIA requester filed suit.”  “An agency’s decision to respond to a plaintiff’s FOIA request after the plaintiff has filed suit may deprive a plaintiff of standing if the remedy sought has been provided. But that is not an issue of exhaustion.”

• Procedural Requirements, Searching for Responsive Records & Litigation Considerations, Adequacy of Search:  First, the court relates that “Plaintiff . . . argues that CMS’s search was inadequate because the agency failed to follow obvious leads that were revealed by the results of its earlier searches.”  “Here, Plaintiff contends that CMS failed to follow such leads when it did not search its employees’ text messages after one email released to him referenced a ‘future text message conversation;’ when CMS failed to produce certain attachments or other documents referenced in records that were produced; and when CMS failed to search for specific records referenced in the bodies of emails released to Plaintiff.”  The court finds that “Plaintiff is correct that, in certain circumstances, an agency may be obligated to search a particular employee’s text messages in response to a FOIA request.”  “Agencies can be required to search text messages when it is ‘reasonably likely’ that an employee conducted agency business on a pertinent topic via text.”  “There is no reason to believe that is the case here, however.”  “The single email Plaintiff cites in support of his contention that employees were engaged in conversation over text relevant to his request consists of a discussion in which an ‘[Electronic Funds Transfer (“EFT”)] FAQ’ is circulated ‘IN CASE there is any movement on the FAQs.’”  “One participant in the email exchange provides her phone number because she would not be ‘easily reachable’ the following day, when the ‘movement on the FAQs’ might occur.”  “A natural reading of this email exchange permits the inference that the sender provided her phone number not as an invitation to continue the discussion about the EFT FAQs via text message but, instead, as a mere request that someone contact the sender via that number if ‘movement’ on the EFT FAQ were to occur.”  “Accordingly, this exchange does not constitute ‘a lead that is both clear and certain’ regarding the existence of potentially response text messages.”
  
  “Turning, then, to the attachments Plaintiff contends are ‘missing,’ . . . CMS acknowledges that it did not provide Plaintiff with all attachments or other documents referenced in the materials it did produce.”  “CMS explains that ‘Plaintiff is correct that some email attachments . . . were withheld because they were drafts or duplicates of the same drafts,’ . . . or, in other cases, CMS contends that ‘[a]ny attachments that may have existed were . . . non-responsive . . . .”  “In other words, there is no basis to find the CMS failed to search for attachments, thereby rendering its searches inadequate.”  “Plaintiff was, of course, free to challenge the agency’s decision to withhold attachments ‘because they were drafts or duplicates of the same drafts,’ . . . or because they were ‘non-responsive,’ . . . but such a challenge goes to the reasonableness of the withholding or the scope of the FOIA request and is distinct from the agency’s obligation to conduct an adequate search.”
  
  “In a similar vein, Plaintiff also points to several records that he says ‘refer to’ and discuss ‘written correspondence’ and ‘complaints filed’ that ‘would have been responsive’ to his requests but were not disclosed to him.”  “The problem the Court encounters in considering this argument, though, is that on the present record it cannot discern which of CMS’s searches revealed these records, and without that information, the Court cannot resolve this aspect of the parties’ dispute.”  “Plaintiff has failed to tie the records that contain the leads th[at] he claims CMS failed to pursue to the FOIA requests to which those records were arguably responsive.”  “This difficulty does not mean that Plaintiff’s evidence that other, responsive records might exist carries no weight; to the contrary, it means only that Plaintiff has failed to show that CMS failed to follow up on ‘clear and certain’ leads in conducting searches in response to specific FOIA requests.”  “But this distinction merely affects the standard under which the Court considers this evidence.”  “The evidence is still relevant to Plaintiff’s overarching challenge to the adequacy of CMS’s searches and, in particular, to the question whether significant omissions in the results of CMS’s searches casts doubt on the adequacy of those searches.”  “Accordingly, the Court considers what weight to give CMS’s failure to identify these specific records in its searches alongside Plaintiff’s similar arguments . . . .” 
  
  “Plaintiff fares better in his challenge to the sufficiency of CMS’s description of the searches it undertook.”  “[Defendant’s] declaration states that CMS ‘reviewed and processed approximately 7,100 pages of records in response to Plaintiff’s FOIA requests, and made three responses to Plaintiff.’”  “But CMS’s description of the records withheld or released in each of those three productions only account for 3,828 pages of records.”  “This might simply be an error on CMS’s part or perhaps the declarant only meant that its initial responsiveness review included 7,100 pages.”  “But, if so, CMS could easily have defused the issue in its opposition brief.”  “As things stand, the disparity raises ‘substantial doubt’ as to the completeness of the declaration that CMS provided.”
  
  “Plaintiff next argues that CMS failed to ‘ma[k]e a good faith effort,’ as it must, ‘to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested.’”  “Because the Court agrees that there is ‘substantial doubt’ as to the adequacy of the searches conducted for several of Plaintiff’s requests, . . . the Court denies CMS summary judgment on this issue and will grant[] summary judgment in Plaintiff’s favor with respect to the adequacy of the searches.”  “Here, Plaintiff contends that the search terms CMS used were not reasonably tailored to identify all responsive records because the agency often searched only for abbreviated terms pertaining to Plaintiff’s requests (such as ‘FAQ,’ but not ‘frequently asked question,’ and ‘EFT,’ but not ‘electronic funds transfer’) and often ‘mechanical[ly] cop[ied]’ phrases from his requests.”  “CMS responds that if it had used Plaintiff’s proposed keywords, the searches would have ‘yield[ed] . . . [an] overbroad’ swath of potentially responsive records that the agency would have to review.”  “The Court, however, is unconvinced that any limitations on CMS’s search function precluded (or should have precluded) the agency from conducting a more thorough search.”  “A FOIA request for ‘all records’ relating to ‘CMS EFT FAQ22297,’ should have included a search for records containing the terms ‘EFT’ or ‘electronic funds transfer’ and ‘FAQ’ or ‘frequently asked question,’ subject to five-year search limitation.”  “Although CMS suggests that a search for phrases like ‘frequently asked question’ would generate hits for each of the separate terms, it seems implausible that CMS is unable to search for phrases; it appears that CMS has the functionality to search for one term ‘and’ another (i.e., a Boolean search) – within at least its . . . databases as it used ‘fees and/or costs’ as a viable search term in response to Plaintiff’s May 4, FOIA request.”  “And, to the extent the agency lacks the ability to search for phrases or conjunctions, that, too, would seem problematic, given the widespread availability of technology that allows for far more sophisticated searches than this.”  “The Court, accordingly, concludes that a search as limited as CMS describes was not reasonably calculated to locate the entire universe of responsive records.”  “In any event, it was CMS’s burden to demonstrate that its search was reasonably calculated to do so . . . and it has failed to carry that burden.”  “The Court, accordingly, concludes that CMS should have utilized the obvious synonyms for the search terms provided, or at the very least explained why it was unnecessary to do so.”
  
  Regarding the locations searched, the court relates that “Plaintiff first proposes that CMS should have, in response to his May 6 FOIA request for ‘[c]ommunications’ between CMS and Congress . . . searched OIT . . . .”  “In support of this argument, Plaintiff points to records that he received in responses to a different FOIA request, which discuss inquiries [Office of Information Technology (“OIT”)] staff received from members of Congress . . . .”  “He also points to another email exchange he received pursuant to a different FOIA request in which OIT staff discuss talking points ‘developed on EFT’ that can be used to respond to the ‘external inquiries [that] have been receiv[ed] from legislators.’”  “In response, CMS merely asserts that Plaintiff’s suggestion in his FOIA request that the agency search OIT records using the list of custodians he provided ‘did not . . . make sense and hence was not used’ because ‘the best way to locate responsive records was to search incoming correspondence from Congressional members which . . . is tracked by the CMS Office of Legislative Affairs.’”  “But [the court finds that] the question is not whether the agency searched the most likely places to maintain responsive records; the question is whether the agency searched all places where records were reasonably likely to be found.”  “Next, Plaintiff argues that CMS limited its search to databases ‘related either to specific complaints . . . or particular types of correspondence . . .’ without searching for the ‘call logs’ he specifically requested in his May 7 FOIA request.”  “CMS provides no explanation for why it did not search for ‘call logs’ or why the . . . system[] which it did search in response to this request[] was likely to have such information.”  “Accordingly, the Court concludes that CMS’s search in response to this request was insufficient.”  “Finally, Plaintiff challenges CMS’s failure to search its Outlook email system in response to all but two of his FOIA requests.”  “CMS defends this decision by explaining that its [systems searched] should encompass all external-facing communications responsive to his requests.”  “But, as Plaintiff emphasizes, his requests were not limited to external communications.”  “Rather, Plaintiff sought ‘all records’ regarding the topics he identified.”  “As he has shown, a search of Outlook might well ha[ve] revealed records responsive to his request.”  “CMS offers no meaningful explanation for why internal discussions between its employees over email would either fall beyond the scope of Plaintiff’s FOIA requests or why those internal discussions would be replicated in the databases it has identified.”
  
  Finally, “although not alone sufficient to cast doubt on all the searches CMS conducted, the Court conclude[s] that the weight of the documents CMS failed to identify bolsters Plaintiff’s arguments that the search terms used and the places searched were not reasonably calculated to discover all responsive materials.”  “With respect to the May 4 FOIA request in particular, CMS emphasizes that it was able to identify – in the locations it searched using its preferred terms – some records that were responsive to Plaintiff’s request.”  “It argues that this demonstrates that the searches it conducted were reasonably calculated to find responsive materials.”  “But, as explained, the results of a search do not dictate whether the search process was adequate.”  “And, even more to the point, the fact that the terms used and databases searched found some responsive records does not absolve the agency’s obligation to conduct a search that was reasonably tailored to reveal all responsive materials.”  “Plaintiff, moreover, identifies documents that he contends the agency’s searches missed, supporting his contention that the agency’s search terms and search locations were incomplete.” 
  
  “In sum, Plaintiff has done enough – by identifying issues with the search terms used, the databases searched, and the completeness of the agency’s declarations – to ‘raise[ ] substantial doubt’ as to the adequacy of the search.”  “On a separate note, the Court also finds that CMS has failed to address the whereabouts of the approximately 3,200 unaccounted for pages.”  “The Court is hardly in a position to grant summary judgment in favor of CMS in the face of such uncertainty.”
   
• Exemption 4:  The court relates that “CMS relied on Exemption 4 (as well as Exemption 6) to withhold seven pages in full that were responsive to Plaintiff’s May 12 FOIA request.”  “The May 12 FOIA request sought ‘all records from January 1, 2015 to May 10, 2020’ regarding complaints ‘involving [an EFT payment processor]’ and complaints ‘involving [a digital claim payment processing service].’”  “CMS describes the records as ‘consist[ing] of the complaint,’ which ‘deals with electronic funds transfer,’ ‘CMS email exchanges with the complainant, the respondent company’s email to CMS about the complaint and any proposed resolution by the respondent company to CMS.’”  “CMS contends that the information it withheld was ‘commercial or financial because the complaint dealt with electronic funds transfer[s] which relate to financial transactions.’”  “Plaintiff does not dispute that ‘this might establish the commercial or financial status of some of the information,’ but he does not agree that this statement is sufficient to ‘establish that status for all the information.’”  “The Court agrees with Plaintiff.”  “To the extent information about electronic funds transfers, or ‘EFTs,’ is analogous to ‘sales statistics, profits and losses, and inventories, or [other information] related to the income-producing aspects of a business,’ that information would qualify as ‘business or financial information’ for these purposes.”  “Although CMS has provided the Court with no specific description of what ‘electronic funds transfers’ are in this context, there is reason to believe (and Plaintiff does not argue otherwise) that information about EFTs would ‘relate to the income-producing aspects’ of [the EFT payment processor’s] business . . . because [the EFT payment processor] is an ‘EFT payment processor,’ . . . .”  “It would thus seem that a ‘complaint [that] deal[t] with electronic funds transfer[s]’ and that pertains to [the EFT payment processor’s] business . . . would contain information that is ‘commercial “in and of itself,”’ and ‘pertain[s] to the exchange of goods or services or the making of a profit,’ . . . .”  “Similarly, other records related to that complaint might also logically contain some discussion of EFTs that might constitute ‘commercial or financial information’ or information in which the owner has a ‘commercial interest.’”  “But this line of reasoning supports only the conclusion that some portion of the forty-six pages that CMS identified as responsive to Plaintiff’s May 12 FOIA request likely contained commercial or financial information.”  “[The court does] not know if those portions containing such commercial or financial information are what was withheld, because CMS provides no meaningful description of the seven withheld pages.”  “The declaration CMS provides describes the contents of the forty-six pages as a whole . . . but CMS does not explain which of those records were withheld.”  “CMS’s further statement that it ‘conducted a line-by-line review of the forty-six pages of records . . . and determined that some non-exempt, factual information within them could be segregated for release’ does not change the Court’s conclusion.”  “Although it indicates that the agency conducted the required segregability analysis, the description offers no further description of the seven withheld pages.”  “The Court is left to guess at the contents of the seven pages the agency chose to withhold, only knowing that the seven pages were part of the forty-six pages the agency identified that relate to a complaint that ‘deal[t] with’ EFTs.”  “The Court, accordingly, concludes that CMS has failed to satisfy its burden of showing that the information it withheld was commercial or financial in nature, such that Exemption 4 could apply.”
  
  “CMS fares no better with respect to the confidentiality prong of Exemption 4.”  “CMS . . . says almost nothing about the owners of the information and, instead, attempts to satisfy its burden by showing that it – that is, the government – treats the information as private.”  “That will not do.”  “[T]hose facts principally go to whether CMS treated the information submitted as confidential (and perhaps whether CMS provided assurances to the owner of the information that it would remain confidential) – not whether the owner of the information ‘customarily and actually’ treated the information as private.”  “More generally, the Court can only guess at how the owners of the withheld information might have treated it because CMS says so little about the owners (or types of owners) of the information, about whether the assertedly confidential information was submitted by an owner or by a third-party, about whether any such third-party owed a duty of confidentiality to the owner, and, most significantly, about the precise nature of the specific information that was withheld.”  “CMS, in short, has also failed to carry its burden of showing that the information it withheld was ‘confidential,’ as required under Exemption 4.”
  
  “CMS also invokes Exemption 4 to withhold records responsive to Plaintiff’s May 15 FOIA request.”  “That request sought records relating to CMS’s ‘investigation of covered entities, including health plans, clearinghouses, and business associates charging fees to conduct standard transactions’ . . . .”  “CMS’s summary judgment briefing fails to address the application of Exemptions 4 to [the] withholdings [at issue here] . . . relying instead on the argument (which the Court has rejected) that Plaintiff failed to exhaust his administrative remedies with respect to this request.”  “Nor does CMS’s Vaughn index describe these records.”  “Although Plaintiff points to this omission in its motion, CMS offers no response in its briefs.”  “As result, the Court treats the issue as conceded with respect to the factual predicate for the withholding.”  “But even relying on the one paragraph in [defendant’s] declaration that makes passing reference to the issue, . . . the Court concludes that CMS has failed to carry its burden.”  “That single paragraph explains that Exemption 4 was applied ‘only . . . to information that related to records which had been supplied by complainants or respondents in conjunction with complaints that were stored in the [Administrative Simplification Enforcement and Testing Tool system (“ASETT”)] information system and were not Plaintiff’s complaints.’”  “The fact that some of the information in the ASETT database ‘relates to information that business entities supply’ tells the Court little about the subject matter of the withheld information or the extent to which some or all of it contains commercial or financial information.”  “Nor has CMS done enough to show that the withheld material was confidential.”  “The agency once again simply relies on its practices of keeping the information stored in the ASETT database confidential, rather than addressing whether the source of the information treated it as confidential.”  “For reasons discussed above, neither the fact that respondents were given PINs and that CMS treats the ASETT system as secure nor systems status under the Privacy Act, without more, is sufficient to show that the information was ‘customarily and actually’ treated as confidential by its owner.”  “Accordingly, even giving CMS the benefit of the doubt and considering this issue on the merits, it has failed to justify its withholding of these records under Exemption 4 as well.”
  
  “Finally, CMS also invokes Exemption 4 to withhold 142 pages that were responsive to Plaintiff’s April 13, May 7, and July 29 FOIA requests.”  “CMS explains that ‘Exemption 4 was applied [to these records] because businesses’ complaints or responses contained in the ASETT system are afforded business confidentiality’ by CMS, the information withheld ‘concerns electronic fund transfers and is financial,’ and ‘[t]he information was obtained from . . . entities like electronic fund clearing houses, who are generally known to be business entities.’”  “For the reasons explained above, this description of the information CMS withheld is insufficient.”  “At no point does the agency describe in reasonable detail the nature or contents of the records it withheld.”  “Some or all of that material might constitute commercial or financial information.”  “Some or all of it might have reflected actual electronic fund transfers. (All that CMS says is that the information ‘concern[ed]’ electronic fund transfers, . . . but that can be said of almost all of Plaintiff’s requests.)”  “The owner or owners might have treated some or all of it as confidential.”  “But the Court has no way to know.”  “Accordingly, the Court must, once again, conclude that CMS has failed to satisfy its burden.”
  
  Finally, the court finds that, “[a]s explained above, CMS has failed to make the required showings with respect to the applicability of Exemption 4 to any of the records it withheld on that ground.”  “But even if it had cleared that hurdle, CMS’s arguments would still fail, because the agency wholly ignores the foreseeable-harm requirement of the FOIA.”  “CMS fails to devote a single sentence in its briefing or declarations to the anticipated consequences of disclosing the information it seeks to keep private pursuant to Exemption 4, . . . not even after Plaintiff identified that omission, . . . and not even in the supplemental declaration that CMS submitted addressing other omissions, including its failure to address foreseeable harm with respect to the agency’s Exemption 5 withholdings . . . .”  “The Court recognizes that few courts have considered what burden the foreseeable-harm requirement imposes on agencies that seek to withhold records pursuant to Exemption 4.”  “And relatedly, there is an open question as to the scope of the interest Exemption 4 seeks to protect.”  “As [the Second Circuit Court of Appeals] persuasively explains, application of the foreseeable-harm standard to Exemption 4 requires a showing of ‘foreseeable commercial or financial harm to the submitter upon release of the contested information.’”  “To hold otherwise – and to require an agency merely to show that disclosure would be at odds with confidentiality – would render the foreseeable-harm requirement a nullity in all Exemption 4 cases, a result that cannot be squared with the congressional decision to exempt other FOIA exemptions from the requirement, but not Exemption 4.”  “Here, however, CMS makes no argument whatsoever that it has satisfied the foreseeable-harm requirement.”  “Unless the foreseeable-harm requirement is a nullity as applied to Exemption 4, and as noted above, that contention cannot be squared with the statutory text, that omission is fatal to CMS’s position.”
• Exemption 5, Deliberative Process Privilege & Foreseeable Harm and Other Considerations:  The court relates that “CMS seeks to withhold nine pages that were responsive to Plaintiff’s May 4 FOIA request pursuant to Exemptions 5 and 6.”  “[Defendant’s] declaration describes these records as containing ‘pre-decisional, deliberative communications from CMS personnel to CMS [Office of Strategic Operations and Regulatory Affairs] executive correspondence staff regarding correspondence from the American College of Gastroenterology,’ and concerning ‘actions that were under consideration at CMS which related specifically to hurricane relief.’”  “CMS has satisfied its burden of showing that these records are deliberative and predecisional.”  “Internal agency communications that discuss and debate the best course of action to take in response to inquiries from the public often fall within the deliberative process privilege.”  “And here, CMS’s description of the records it withheld shows that they were ‘deliberative in nature, weighing the pros and cons of agency adoption of one viewpoint or another.’”  “Finally, CMS has done enough to show that the records were pre-decisional.”  “By explaining that the final communications that CMS had with the American College of Gastroenterology were released, while those internal communications that preceded it were not, CMS has satisfied its burden of showing that the records containing the internal deliberations preceded any final decision.”
  
  “Having concluded that the deliberative process privilege applies to the materials responsive to Plaintiff’s May 4 FOIA request that CMS withheld pursuant to Exemption 5, the Court must consider whether CMS has satisfied the foreseeable-harm requirement.”  “In his original declaration, [defendant] observed that ‘[r]elease of this information would cause foreseeable harm . . . because it would create a chilling effect o[n] future employees’ discussions and block the free exchange of ideas, including ideas that could improve and streamline the efficient functioning of CMS.’”  “Standing alone, that articulation of foreseeable harm would be too ‘perfunctory’ and would seem to apply to most, if not all, deliberative exchanges of information, ‘regardless of category or substance.’”  “Presumably recognizing as much, CMS submitted a supplemental declaration, further explaining the foreseeable harm that disclosure would entail.”  “That supplemental declaration poses its own difficulties.”  “To the extent it expresses concern, for example, that disclosure of the deliberations might expose individual employees to external pressure, . . . CMS could simply redact the names of those employees.”  “The agency comes closer to the mark, however, when it observes that release of the records would reveal the ‘internal decisional process’ that the agency employs to evaluate hurricane relief waivers, such as ‘the criteria CMS uses to determine hardship, how CMS gathers information on . . . eligible clinicians’ need to benefit from an emergency waiver, . . . [and] how CMS assesses alternative resolutions to emergency relief.’”  “This would be harmful, CMS explains, because entities would have ‘a roadmap’ to ‘know exactly what [they] need[] to do to obtain a hurricane emergency waiver,’ which could undermine the ability of the agency to make the right decision when it comes to whether to grant relief.”  “Although [defendant’s] declaration does not explicitly tie this ‘roadmap’ justification to ‘an interest protected by’ Exemption 5, . . . the Court concludes that the supplemental declaration must be read in light of [defendant’s] prior assertion that release of the information would create a chilling effect on internal deliberations by future employees.”  “Understood in this light, the agency’s foreseeable harm analysis passes muster.”  “It is a ‘focused and concrete demonstration of why disclosure of the particular type of material at issue,’ namely internal discussions about whether to grant relief to this particular group in light of the hardship it experienced due to a natural disaster, ‘will, in the specific context of the agency action at issue, actually impede those same agency deliberations going forward.’”  “This showing is sufficient to satisfy the agency’s burden to demonstrate that harm will foreseeably result from the disclosure of these documents.”
  
  “CMS also invokes the deliberative process privilege to withhold some or all of the 1,508 pages it identified as responsive to Plaintiff’s April 13, May 7, May 12, May 15, and July 29 FOIA requests.”  “These materials ‘all concern draft information related to sub-regulatory guidance, EFT/FAQs, a draft memo on EFT revision, and drafts of responses to Plaintiff.’”  “Unfortunately, CMS’s description of the contents of the material withheld includes little detail beyond this vague statement.”  “The agency does describe some of the withheld materials as including ‘emails that discussed the past EFT/FAQs, modified the current FAQs, discussed whether to discontinue the FAQs or a particular FAQs, discussed wording changes, discussed justifications for the changes, discussed why CMS was not going in a particular direction with the EFT/FAQs, or suggested that something may have been too broadly described, and needed to be more narrowly described.’”  “But it does not identify which description applies to which documents, or even how many pages it withheld pursuant to that description.”  “Nor does CMS explain why each of these records was predecisional and deliberative, beyond the high-level assertion that the withheld materials ‘consisted of edits and comments on draft documents’ . . . .”  “That is insufficient.”  “The Court, accordingly, concludes that CMS has failed to carry its burden with respect to application of Exemption 5 to these records.”  “As a result, the Court need not consider the separat[e] question of foreseeable harm.”
   
• Exemption 5, Attorney-Client Privilege:  “Although not the focus of either party's briefing, the Court notes that the agency’s Vaughn index states that CMS seeks to withhold some material on the basis of attorney-client privilege.”  “To the extent CMS does, in fact, seek to withhold certain material on this basis, the Court notes that the agency’s explanation of why that privilege applies is too cursory for the Court to assess that claim.”  “[The] generic description[s] [do] not allow the Court to determine whether the withheld material constitutes ‘confidential communications between an attorney and his client relating to a legal matter for which the client has sought professional advice.’”  “Therefore, to the extent CMS did in fact rely on the attorney-client privilege to withhold some of the materials at issue, the Court is unpersuaded that the agency has satisfied its burden.”
   
• Exemption 6:  The court relates that “CMS invokes this exemption to withhold individuals’ contact information, including phone numbers and email addresses . . . and also applies the exemption to ‘records [that] were located in the ASETT system[,] which is a Privacy Act [s]ystem of records,’ . . . .”  “Plaintiff does not challenge the agency’s application of the exemption to contact information.”  “But he does maintain that CMS was wrong to apply Exemption 6 to the second category of records.”  “CMS contends that because the records at issue ‘were located in the ASETT system[,] which is a Privacy Act [s]ystem of records,’ the records are ‘similar’ to ‘personnel and medical files’ and thus fall within the scope of Exemption 6.”  “CMS thus seems to argue that because a record is found in ASETT and because ASETT is a Privacy Act system of records, any information contained in ASETT that was obtained from a ‘business submitter’ is per se subject to Exemption 6.”  “That contention is problematic on several fronts.”  “First, CMS contends that, as a general matter, it would be improper to disclose any complaint (or associated document) from its ASETT system because doing so ‘would constitute an unwarranted invasion of privacy and violate the business confidentiality of the business submitter, who is the respondent to the complaint.’”  “But Exemption 6 is not concerned with the confidentiality interests of corporations.”  “And CMS does not indicate whether the ‘business submitter[s]’ it seeks to protect are corporations or individuals.”  “Indeed, if anything, CMS suggests that the submitters are corporations by emphasizing that much of the information contained in its ASETT system was ‘obtained from [] business entit[ies], . . . like electronic fund clearing houses.’”  “Even beyond that dispositive difficulty, in applying Exemption 6, the presumption is in favor of disclosure, and, here, CMS had not done enough to shift the balance in the opposite direction.”  “It has failed to identify the privacy interest of the submitters and has failed to explain how disclosure would ‘constitute a clearly unwarranted’ invasion of that unspecified interest.”  “Accordingly, as the record now stands, CMS has failed to justify its withholdings pursuant to Exemption 6.”

• Litigation Considerations, “Reasonable Segregable” Requirements:  “Here, neither the Vaughn index nor the declarations CMS has provided are sufficient to show that the agency has met its segregability burden.”  “Most notably, CMS states that it is withholding ‘nine pages pursuant to Exemptions 5 and 6’ responsive to the May 4 FOIA request, . . . but it does not explain which withholdings are subject to which exemption or which of the entries in its Vaughn index corresponds to these records.”  “Without having that basic understanding of what the government has withheld, the Court cannot determine if the records it withheld can be segregated.”  “As a result, the Court will defer making a final decision with respect to segregability until the record is complete and the universe of potentially responsive records is settled.”

• Litigation Considerations, Relief:  “For the reasons explained above, the Court agrees with many, although not all, of the arguments that Plaintiff has raised – both in opposition to CMS’s motion for summary judgment and in support of his cross-motion.”  “Anticipating this result, Plaintiffs asks that the Court to grant summary judgment in his favor (in whole or in part) and to preclude CMS from engaging in the type of iterative summary judgment practice that has become all too common in FOIA litigation.”  “As Plaintiff stresses, Federal Rule of Civil Procedure ‘56(e) does not require the Court to give the agency another bite at the apple,’ . . . and the purposes of FOIA are ill-served by permitting an agency to wait for an opposing party or court to point out all the deficiencies in the agency’s justifications for withholding records and then simply to file a renewed motion with the benefit of the court’s detailed analysis of what is required to satisfy the agency’s burden.”  “‘FOIA’s mandate,’ after all, is ‘that agencies “shall” make requested records “promptly available.”’”  “Because ‘[i]nformation is often useful only if it is timely,’ the ‘excessive delay’ that multiple rounds of summary judgment briefing can entail ‘is often tantamount to denial.’”  “At the same time, however, the D.C. Circuit and this Court have recognized that the propriety of permitting do-overs must be assessed on a case-by-case basis.”  “[T]he court identified a number of considerations, including (1) the fact that the agency did not timely request another chance; (2) the case did ‘not involve “extraordinary circumstances” in which, “from pure human error,” the government “will have to release information compromising national security or sensitive, personal, private information, unless the court allows it to make an untimely . . . claim,”’. . . .; and (3) the case was not one ‘in which an agency [had] present[ed] a viable legal theory for a claimed exemption but provide[d] declarations that c[a]me up short in tying the requested records to that exemption,’ . . . .”  “As the court explained with respect to this last consideration, it may (at least on occasion) ‘be prudent for a district court to permit supplemental declarations’ further explaining the applicability of an exemption.”  “Consistent with these considerations, this Court has at times granted agencies do-overs in FOIA litigation, including by permitting agencies to assert new exemptions after an initial round of summary judgment proceedings, . . . to make new arguments after losing on summary judgment, . . . and, most commonly, to refine or further explain their bases for withholding records, . . . .”  “But, in each context, the Court has balanced FOIA’s ‘statutory goals – efficient, prompt, and full disclosure of information,’ . . . against the adverse consequences of requiring disclosure of potentially exempt records based on anything ranging from modest lack of clarity by the agency to a failure by the agency and its counsel to take their responsibilities under FOIA as seriously as they should.”
  
  “Rule 56, moreover, provides the Court with the discretion to balance FOIA’s goal of prompt disclosure against the harm that an unwarranted disclosure might cause to the agency or an innocent third party, and, in doing so, to consider the good faith (or lack of diligence) with which the agency has approached the litigation.”  “In particular, Rule 56(e) provides that, ‘[i]f a party fails to properly support an assertion of fact or fails to properly address another party's assertion of fact . . . , the court may,’ among other things, grant summary judgment against that party, provide that party with a further ‘opportunity to support or address the fact,’ or ‘issue any other appropriate order.’”  “Applying these principles here, the Court notes that CMS has missed opportunities to address at least some of the flaws and omissions in its filings.”  “After Plaintiff identified significant problems with CMS’s initial declaration, the agency submitted a supplemental declaration that addressed only a few of these problems and that ignored others.”  “To paraphrase [the D.C. Circuit] . . . , ‘[t]hose [two] declarations, coupled with the [agency’s] two briefs, gave ample opportunity [for CMS] to identify’ the basis for the withholdings.”  “Even so, CMS was not able to meet its burden – and with respect to some withholdings or arguments appeared not even to try.”  “Most notably, despite Plaintiff pointing out that CMS wholly failed to address foreseeable harm with respect to its Exemption 4 withholdings, CMS did not respond at all to that argument in its reply brief or in the supplemental declaration it filed (which did address foreseeable harm with respect to Exemption 5).”
  
  “On the other side of the scale, however, the interests of third parties are likely implicated by the most glaring of CMS’s omissions.”  “The agency invoked Exemption 6, which is intended ‘to protect individuals from the injury and embarrassment that can result from the unnecessary disclosure of personal information,’ . . . and it invoked Exemption 4, which is designed to prevent the disclosure of sensitive commercial information and thus also the interests of third parties.”  “With respect to this latter category of withholdings, Plaintiff argues that ‘[m]ost agencies . . . have regulations requiring [them] to notify third party submitters when a requester has filed a lawsuit implicating the submitter's information that might fall under Exemption 4’ and that, ‘[a]bsent contrary evidence,’ the Court should assume that CMS provided this notice and that the purportedly interested third parties declined to intervene to protect their interests.”  “The Court is skeptical, however, that CMS notified the interested parties of the litigation, particularly since the agency withheld their information, and, in any event, the Court is not prepared merely to assume that the interested parties were notified and declined to take steps to protect their confidential business information.”  “CMS’s substantive defenses of its Exemption 5 withholdings are on less shaky ground than its other withholdings, and the Court concludes that it is likely that those withholdings can be sustained, at least in substantial part, with further explication from the agency.”  “Permitting a second bite at the apple with respect to these withholdings is more in line with the type of refinement that this Court often permits in FOIA cases.”  “For these reasons, the Court will deny summary judgment to both parties with respect to the relevant withholdings but will do so without prejudice.”  “The Court cautions CMS, however, that ‘this is not a process that can continue indefinitely’ and that ‘FOIA does not permit an agency to make a half-hearted effort with the expectation that, if unconvincing, it can simply “do it over” – again and again, until the Court is satisfied.’”  “Finally, the Court will grant summary judgment in favor of Plaintiff on the issue of exhaustion and with respect to the adequacy of the agency’s searches.”  “For the reasons explained above, Plaintiff did administratively exhaust his May 15 FOIA request before filing suit, and, the searches that CMS conducted were plainly inadequate.”  “Accordingly, there is no reason to delay granting Plaintiff summary judgment on either issue.”