# Presentation: 130789

## Freedom of Information Act &Privacy Act

## FOIA Request

- A request from any person for access to:
- 	●   Agency program files.
- 	●   Personal records on another individual.
- 	●   Personal records about himself that are **NOT** filed within a Privacy Act system of records.

## 	Allows any person to request copies of agency records. 

	Requester has to follow agency rules and agree to pay fees.

	We must advise requesters on our decision within 20 business days.

- 	Requester has to follow agency rules and agree to pay fees.
- 	We must advise requesters on our decision within 20 business days.

_**FOIA**_

## Who May File a FOIA Request?

_**Who May File a FOIA Request?**_

- Any person.  Two broad classes are excluded from "any person:”
- _federal government entities_                and
- _fugitives from justice_.
- “Any person" covers U.S. and foreign individuals and entities, including:
- ●  Individuals
- ●  Businesses (corporations, sole proprietorships, etc.)
- ●  Governments (foreign, state, or local)
- ●  Universities & Not-for profit organizations
- ●  Any other entity you can think of

## How are Requests to be Filed?  

- Requests must be in writing.
- They may be mailed, or  faxed.

## Congressional FOIA Requests

-    Congressional inquiries made on behalf of a constituent are processed under the provisions of the Privacy Act and Freedom of Information Act.  Exemptions, fees, and appeal rights may be applicable.

## FOIA Fees

- We bill requesters for FOIA services based on who they are.  FOIA Managers determine the requester's fee category and what fees to assess:
- 	--  Commercial users pay for all search, review, & copying.
- 	--  News media and educational requesters pay for copying (but the first 100 pages are provided free).
- 	--  "All Others" pay for all search and all copying (but the first 2 hours of search and the first 100 pages are provided free).

***If the billable cost is nominal, ***
***then we automatically ***
***waive the fee.***

## When is a Request "Properly" Received?

_**When is a Request "Properly" Received?**_

-  1.  _Is the Description Reasonable?_
-  Requester has reasonably described the records he wants.  Description is considered reasonable if a professional agency employee familiar with the subject area can locate the records with a reasonable amount of effort.  NOTE:  Just because a request is overly broad or burdensome, does not mean it is not reasonably described!
- 	2.  _Is there Agreement on the Fee Category?_
-  If requester asks to be placed in a more favorable fee category and you disagree, you may need to ask him to justify the category.  For example, you may decide that a requester should be billed as a commercial requester.  You might base this on the fact that the request came in on company letterhead and the records requested have value primarily to commercial entities.  If the requester has asked to be classed as "all other" or news media, ask him to either justify that request or agree to pay fees appropriate to his class (search, review, and duplication, in this example).

## When is a Request "Properly" Received? (continued)

_**When is a Request "Properly" Received? (continued)**_

- 3.  _Has the Requester Agreed to Pay All Fees for his Requester Category or Set a Dollar Limit?_  If not, ask for that agreement.  For example, the promise "I will pay for all reproduction up to $35" is not satisfactory if you will also be billing for search (or search and review).  NOTE:  The statement "I agree to pay all billable fees" is satisfactory for processing.
- 4.  _Has the Requester Justified Any Full or Partial Fee Waiver Requested?_  If not, ask him to address the Fee Waiver Criteria set forth in the FOIA regulations.
- 5.  _Has the Requester Justified Any Expedited Handling Request?_  If not, provide the criteria.  In some instances, requesters are allowed to ask for “expedited treatment.”  If we grant expedited treatment, you will only be given 10 business days to respond.  Also, delays on the requester’s part in providing a reasonable description or agreeing to pay fees are not part of the 10 or 20 days.

## What Constitutes an Agency Record for FOIA Purposes? 

- "Agency records" are those created or received in the course of conducting agency business, including paper, electronic or other physical forms.  They include reports, letters, photographs, recordings, e-mails, etc.
- .

- A record must exist and be in the possession and
-  control of the agency before it is considered for release.

## The following are NOT considered agency records

- Objects (furniture, wall paintings, etc)
- Nontangibles (an individual's memory or oral communications)
- Personal records of an individual that are:
-   -  Maintained for the convenience of the employee AND
-   -  Not subject to record retention and disposal rules.
- Private material brought into the agency for employee's reference.
- Notes created by supervisors and other employees provided they are:
- 	-  Not filed with official records; _and_
- 	-  Not shared with other employees; _and_
- 	-  Not required by law, regulation or custom to be created; _and_
- 	-  Not used in the decisionmaking process.

## Possession and Control

- A record must be under your possession and control before it may be released.  A record is in your "possession" if you have it in official files.  A record is under your "control" if you created it, had it created under contract, or if the record is considered to be "owned" by IHS by law or regulation.

## Do we give a FOIA requester everything he asks for?

- Sometimes we have to issue full or partial denials.  The FOIA lists nine categories of information that may be withheld from the public.  These nine categories are referred to as “exemptions.”  Whenever something is redacted from a document, we are required to tell the requester why we are withholding the information, which of the exemptions apply, and how to file an appeal.

## Appeals

- Any response deemed “adverse” may be appealed.
- Appeals are to be directed to our appellate authorities (PHS FOIA Officer).
- Once an appeal is received, the PHS FOIA Officer will then ask the IHS to provide the case file and reasons why the information was either withheld, or why it hasn’t been released as of the appeal date.

## A “No Record” Denial

- Although the Oglesby decision (_Oglesby v. Department of the Army_, 920 F. 2d 57 (D.C. Cir 1990)) established the requirement to treat a no record finding as an adverse action, responses do not have to be signed by FOIA Officer, but the requester must be apprised of the right to appeal the adequacy of search.

## Privacy Act Request

- A request from a U.S. citizen or lawfully admitted alien (or requester’s authorized Personal Representive)
- ●  to gain access to his/her records in the IHS, 	Dept-wide, or government-wide "System of 	Records."
- ●  to have information in his/her file 	corrected/amended
- ●  to gain access to an "Accounting of Disclosures"     	– a list of all individuals or agencies who had 	access to his/her file.

## 

	●  Allows U. S. Citizens and lawfully-admitted aliens to have access to their own records that are filed within a "system of records."   
	●  A requester may ask to have incorrect factual data amended.
	●  No charge for the request. 
	●  Agency must respond to access requests within 10 business days and to amendment requests within 60 business days. 

- 	●  Allows U. S. Citizens and lawfully-admitted aliens to have access to their own records that are filed within a "system of records."
- 	●  A requester may ask to have incorrect factual data amended.
- 	●  No charge for the request.
- 	●  Agency must respond to access requests within 10 business days and to amendment requests within 60 business days.

_**Privacy Act**_

## "Privacy Act System of Records" Defined

_**"Privacy Act System of Records" Defined**_

-    A group of any records under the control of IHS from which information:
- 	is retrieved by an individual's name or by some identifying number, symbol, or other identifying particular assigned to an individual

## The following are NOT Privacy Act systems of records – even though they may contain personal information

-  ●  Read files:  These are retrieved by date, not personal identifier.
- ●  Folders or databases containing commercial and financial data pertaining to contracts. Contractors have no expectation of privacyregarding their operations.  They may, however, expect the data to be handled on a proprietary or confidential basis.

## FOIA/Privacy Act Exemptions

**The FOIA Exemptions** allow us to withhold classified and
- "For Official Use Only" data from the public.
**The Privacy Act Exemptions** allow the agency to ignore certain recordkeeping requirements of the Act.  However, the agency must publish its intentions to invoke an exemption beforehand.  This takes the form of an
- "Exemption Rule" that is published in the Federal Register and codified; only a few HHS PASOR contain this but no IHS PASOR are exempted.  It is also published in the Exemption Clause of the governing system notice.  Two requirements that may be ignored through the publication of  an exemption rule are the requirement to process (a) amendment  requests and (b) access requests.

## Invoking Exemptions

_**Invoking Exemptions**_

**Invoking a FOIA Exemption**.  The decision to withhold a document from a FOIA requester is not made until after receipt of the request and after the search has been completed.  At that point, someone must review the stack of requested documents to determine if any of the 9 FOIA exemptions apply.  If so, the exempt material is deleted from the requester's copy. Otherwise, a full release is made.
**Invoking a Privacy Act Exemption**.  The decision to withhold a document from a Privacy Act requester is made _long before_ a request is ever received.  It is made at the time the system or records notice and exemption rule are being developed.  The "Exemptions" paragraph of the notice states exactly which Privacy Act exemptions the agency intends to invoke when a request is received.  If no exemptions have been claimed for the system, a full release must generally be made.

## Privacy Act Exemptions

- The Privacy Act exemptions are found in 3 sections of 5 U.S.C. 552a (d); (j); and (k).
- There are ten (10) exemptions of which IHS never cites but other federal agencies (DOD, CIA, etc.) claim.

## Freedom of Information Act Exemptions

_**Exemption 1, Classified Material (5 U.S.C. 552(b)(1))**_.
- _HARM:_ Injure the interests of national defense.
_**Exemption 2, Internal Matters (5 U.S.C. 552(b)(2))**_**.**
- _HARM_:  Release could allow someone to circumvent, frustrate, or render ineffective laws, statutes, or agency regulations.
_**Exemption 3, Information prohibited from release by Federal statute (5 U.S.C. 552(b)(3))**_**.  **_HARM_:  Release would violate Federal law.  Some laws set both criminal and civil penalties for wrongfully disclosing information to one not entitled to receive it.

## Freedom of Information Act Exemptions (continued)

- 	_**Exemption 4, Trade Secret, Commercial, and Financial Data Submitted in Confidence (5 U.S.C. 552(b)(4))**_**.  ** _HARM_:  Release could result in competitive harm to the submitter or impair government’s ability to obtain necessary information in the future.  The term “submitter” includes a wide range of entities, including businesses, not-for-profit organizations, state, local, and foreign governments, consultants, etc.  In most circumstances, we are required to let the submitters know we plan to publicly disclose their information and provide them with an opportunity to comment on or formally bar disclosure through the courts.
- * A majority of the requests received in the Headquarters East FOIA program office have to deal with contracts, bids for contracts, etc.

## Freedom of Information Act Exemptions (continued)

_**Exemption 5, Government Privileged Information (5 U.S.C. 552(b)(5))**_**.**   Information that would not be disclosable in litigation.  This exemption covers all documents immune from civil discovery, the formal process by which litigants obtain information from each other for use in litigation.  There are multiple discovery privileges; however, the most widely claimed are the deliberative process, attorney-client, attorney work product, and government commercial.
- _HARM_:  Release could stifle open and honest communication within the agency; interfere with adversarial trial processes; or interfere with the procurement process by prematurely disclosing government costs, estimates, etc.

## Freedom of Information Act Exemptions (continued)

_**Exemption 6, Personal Privacy (5 U.S.C. 552(b)(6))**_.
- _HARM_:  Release could invade an individual’s privacy or embarrass him; violate the Privacy Act; or promote threats of terrorism.  There are civil and criminal penalties for violating the Privacy Act.  An individual may be fined up to $5,000 for violating the Act.  Other examples of personal information that would be withheld from records before possible release are home addresses, Social Security Numbers, home telephone numbers, cell phone numbers, etc.).
_**Exemption 7, Records compiled for law enforcement purposes (5 U.S.C. 552(b)(7))**_.  This exemption has 6 separate prongs, as follows:
**    **_**5 U.S.C. 552(b)(7)(A) – Interference**_**.**  _HARM_:  Release could interfere with enforcement proceedings.  So long as the investigation or final agency decision on the investigation is pending, this prong protects the entire investigative file.  This exemption expires when the investigation is complete and the agency's action has been decided.

## Freedom of Information Act Exemptions (continued)

_**5 U.S.C. 552(b)(7)(B) – Fair Trial**_**.**  _HARM_:  Release could create prejudicial pretrial publicity that could deprive a person of a right to a fair trial or impartial adjudication.
_**5 U.S.C. 552(b)(7)(C) – Personal Privacy**_**.**  _HARM_:  Release could constitute an unwarranted invasion of personal privacy.  This exemption is applied to the names and identifying details of investigators, suspects, witnesses, sources, and persons casually mentioned in law enforcement records. There is a strong interest in protecting individuals from being associated with alleged criminal activity.  Despite the similarities in language with FOIA Exemption 6, Exemption (7)(C) is much broader.
_**5 U.S.C. 552(b)(7)(D) – Confidential Sources**_**.**  _HARM_:  Release could disclose the identity of a source, including a State, local or foreign agency who furnished information on a confidential basis.  Source names are protected to prevent retaliation against sources and to ensure that witnesses continue to be willing to talk to investigators.

## Freedom of Information Act Exemptions (continued)

_**5 U.S.C. 552(b)(7)(E) – Investigative Techniques and Procedures**_**.  **_HARM_:  Release would allow people to break the law and go undetected.  Examples of data appropriate for withholding would be the location of hidden cameras, methods by which investigators verify statements, procedures for detecting criminals, etc.
_**5 U.S.C. 552(b)(7)(F) – Physical Safety**_**.**  _HARM_:  This exemption allows the withholding of information necessary to protect the physical safety of a wide range of individuals and is appropriately applied when a requester has threatened individuals in the past.  While this exemption is similar to Exemption (7)(C), it is considerably broader.  So long as there is a reasonable likelihood of disclosure risking physical harm to any individual, the person's name and identifying data may be withheld.

## PA vs. FOIA

_**PA vs. FOIA**_

**Exemptions**:  Both statutes have their own unique exemptions that you may be required to apply.
**Time Limits**: 20 days (FOIA) and 10 days (PA) from date of receipt; 60 days from date of receipt for Privacy Act amendment requests.
**Appeal Rights**:  Both statutes have provisions that allow the requester to appeal any decision you make.  Appeals must be filed within 60 calendar days from the date of your denial letter.

- NOTE:  The PA includes a provision for appealing
- amendment denials only – not access denials.  However, as
- a result of a court decision, we provide appeal rights on any
- adverse decision, including Privacy access denials.

## Privacy Act Exemptions and Parallel FOIA Exemptions 

| When Citing This Privacy Act Exemption | Also Cite this FOIA Exemption |
| --- | --- |
| (k)(1) Classified | (b)(1) |
| (k)(2) Investigatory Records | Any applicable (b) exemption |
| (k)(5) Confidential Sources | (b)(7)(D) |
| (k)(6) Test material | (b)(2) |
| (k)(7) Armed Forces evaluations | (b)(7)(D) |
| (d)(5) Anticipated non-criminal legal proceeding | (b)(5) |

**Denial letters must cite **
**both the Privacy (k) and**
** ****the FOIA (b) exemptions.**

**Do not withhold unless data is exempt from release under both statutes.**

## 
	Full Releases:  Only the FOIA Officer, Division of Regulatory Affairs (DRA), Indian Health Service may sign releases. 

	Full and Partial Denials: Only the FOIA Officer, DRA, Indian Health Service may sign denials. 

- 	_Full Releases_:  Only the FOIA Officer, Division of Regulatory Affairs (DRA), Indian Health Service may sign releases.
- 	_Full and Partial Denials_: Only the FOIA Officer, DRA, Indian Health Service may sign denials.

**If the IHS FOIA Officer is out of the office and cannot sign, another person may sign "for" the FOIA Officer provided that person has been delegated (formally or informally) to act "for“  the person.  In all cases, denial letters must be issued with the signature block of the authorized denial  authority.**

- Who Is Authorized to Sign Responses
- to FOIA?

## Other FOIA Websites

- Department of Health and Human Services _[http://www.hhs.gov/foia/](http://www.hhs.gov/foia/)_
- Department of Justice _[http://www.usdoj.gov/04foia](http://www.usdoj.gov/04foia)_