Trotter v. Ctr. for Medicare & Medicaid Servs., No. 19-2008, 2021 WL 430912 (D.D.C. Feb. 8, 2021) (Lamberth, J.)

Trotter v. Ctr. for Medicare & Medicaid Servs., No. 19-2008, 2021 WL 430912 (D.D.C. Feb. 8, 2021) (Lamberth, J.)

Re:  Request for domain portion of email address associated with millions of healthcare providers registered with Center for Medicare and Medicaid Services ("CMS"), along with provider's national provider identification number

Disposition:  Granting in part and denying in part defendant's motion for summary judgment; granting in part and denying in part plaintiff's motion for summary judgment

• Exemption 6:  The court first finds that "the email address domain names – does indeed convey information about a particular individual."  "That is so because the email address domains all belong to a person."  "And those domains convey information about the person to which they belong because the domains identify entities with whom the contact persons have a commercial relationship or, in some cases, the providers' own websites."  Second, regarding the privacy interests in particular, the court finds that "[p]roviders who participate in heath-information exchange no longer have an interest in maintaining the privacy of their domains because CMS has disclosed this information publicly. But providers who do not participate in heath-information exchange still maintain their interest in the privacy of their domains."  Third, the court finds that "[plaintiff], fails, however, to show a nexus between the information he seeks and how CMS addresses waste, fraud, and abuse."  "Mere speculation does not satisfy this nexus requirement."  The court finds that "while the government has demonstrated privacy interests in shielding the domains of providers who do not participate in heath-information exchange, [plaintiff] has identified no public interest in disclosing them."  "The privacy interest thus outweighs the public interest in disclosure."  "Therefore, the domains of providers who do not participate in heath-information exchange are exempt from disclosure."  "The domains of providers who participate in heath-information exchange, however, must be disclosed because exempting them from disclosure serves no privacy interests."