Shteynshlyuger v. Centers for Medicare and Medicaid Services

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

ALEX SHTEYNLYUGER,

Plaintiff,

v. Civil Action No. 20-2982 (RDM) CENTERS FOR MEDICARE AND MEDICAID SERVICES, et al.,

Defendants.

MEMORANDUM OPINION AND ORDER

Plaintiff Alex Shteynlyuger, a “licensed physician and a specialist in health economics,” Dkt. 1 at 2 (Compl. ¶ 2), submitted eight requests for records to the Centers for Medicare and Medicaid Services (“CMS” or “the agency”) between April 2020 and July 2020. Dkt. 28-3 at 2 (Gilmore Decl. ¶ 5). Unsatisfied with the agency’s responses as of October 16, 2020, Plaintiff filed this suit under the Freedom of Information Act (“FOIA”), 5 U.S.C. § 552(a)(4)(B).

Now before the Court are the parties’ cross-motions for summary judgment. See Dkt. 28, 31. At issue is the adequacy of the search CMS conducted in response to Plaintiff’s FOIA requests, and its decisions to withhold certain records pursuant to FOIA Exemptions 4, 5, and 6. For the reasons that follow, the Court will DENY CMS’s motion for summary judgment and will GRANT in part and DENY in part Plaintiff’s motion for summary judgment.

I. BACKGROUND

A. Factual Background

Plaintiff submitted eight FOIA requests to CMS in 2020. Dkt. 28-3 at 2 (Gilmore Decl. ¶ 5). CMS is a federal agency within the U.S. Department of Health and Human Services that, *2 among many other duties, is responsible for enforcing the “administrative simplification standards from the Health Insurance Portability and Accountability Act of 1996” (“HIPAA”). Id. (Gilmore Decl. ¶ 6). “The Administrative Simplification process aims to save time and money by streamlining communication around billing and insurance related tasks. All HIPAA covered entities (which include health care providers that transmit transactions electronically, health plans, and clearinghouses) must comply with the Administration Simplification process.” Id. at 6–7 (Gilmore Decl. ¶ 20).

Plaintiff’s FOIA requests seek records “pertaining to the enforcement of HIPAA’s administrative simplification requirements . . . including [those pertaining to] electronic transactions, such as . . . [electronic funds transfer (“EFT”)] transactions.” Dkt. 1 at 1 (Compl. ¶ 1). Specifically, the requests seek all records relating to several FAQs discussing EFTs, Dkt. 28-3 at 4 (Gilmore Decl. ¶ 14), complaints involving certain specific HIPAA covered entities, id. at 26 (Gilmore Decl. ¶ 65), “the CMS investigation of covered entities, including health plans, clearinghouses, and business associates charging fees to conduct standard transactions,” id. at 35 (Gilmore Decl. ¶ 85), “[c]ommunications to and from the US Congress . . . related to fees to conduct standard transactions (EFT, ERA), and use of virtual credit cards or payment cards,” id. at 20 (Gilmore Decl. ¶ 48), “standards for healthcare attachment transactions and electronic signatures,” id. at 42 (Gilmore Decl. ¶ 108), and finally, “price setting, cost reimbursement, fee schedule allowable amount setting for Medicare reimbursement, APC code selection, . . . comparative clinical effectiveness research (CER) or analysis, cost-effective[ne]ss analysis, effect on cost of care for BPH; [and] . . . determination of maximum lifetime reimbursement quantity that involve” certain therapies or treatments, id. at 39 (Gilmore Decl. ¶ 97).

In response to these requests, CMS conducted eight searches, which the Court summarizes in some detail due to the nature of the parties’ arguments regarding the adequacy of those searches.

1. April 13, 2020 FOIA request

On April 13, 2020, Plaintiff submitted his first FOIA request to CMS, seeking “all records” from January 1, 2015 to April 10, 2020 regarding “CMS EFT FAQ FAQ22297 (FAQ 22297), CMS FAQ22285 (FAQ 22285), CMS FAQ22281 (FAQ 22281), CMS FAQ22297 (FAQ 22297)” (the “April 13 FOIA request”). Dkt. 28-5 at 1. In that request, Plaintiff stated that the “[O]ffice of the CMS Administrator,” the “Office of Strategic Operations and Regulatory Affairs” (“OSORA”), and the “Office of Information Technology[’s] Program Management and National Standards Group [(“PMNSG”)] may have responsive records,” but noted that “additional offices may have responsive records as well.” Dkt. 28-5 at 1–2. Plaintiff also stated that certain CMS employees he listed “have intimate knowledge of the responsive documents” and thus were likely custodians of responsive records. Id. at 2.

After reviewing Plaintiff’s April 13 FOIA request, CMS “sent . . . [the] request to two different entities:” to OSORA and PMNSG (which due to a reorganization within CMS, became NSG on June 23, 2020). Dkt. 28-3 at 6–7 (Gilmore Decl. ¶¶ 19, 21). OSORA was tasked with conducting an automated search for records because “Plaintiff sought EFT FAQ . . . information . . . as well as correspondence to CMS about these FAQ[s],” and “CMS’s correspondence unit . . . is under OSORA.” Id. at 9 (Gilmore Decl. ¶ 24). OSORA searched its Strategic Work Information Folder Transfer System (“SWIFT”) database, which “contains copies of incoming correspondence to the CMS Administrator and leadership.” Id. (Gilmore Decl. ¶ 25). The search terms used in OSROA’s search of its SWIFT system were “EFT,” *4 “FAQ,” “22297,” “22285,” and “22281.” Id. OSORA also searched the SWIFT system “using the names of the CMS Administrator and leadership because Plaintiff’s April 13 FOIA request provided names of custodians some of whom were in the NSG and OSORA Offices.” Id. at 9– 10 (Gilmore Decl. ¶ 26). Those search terms were “Slavitt,” “Verma,” “Tavenner,” “CIO,” and “CMS Principal Deputy Administrator.” Id.

The April 13 FOIA request was also sent to NSG “because Plaintiff sought information on EFT transactions which are covered by the Administrative Simplification process of HIPAA,” and NSG “is the entity [that] develops regulations and policies to implement and support the Administrative Simplification process,” including “sub-regulatory guidance about EFT transactions.” Id. at 6–7 (Gilmore Decl. ¶ 20). CMS contends that “it was logical to believe that if responsive records existed, the NSG would be the appropriate entity to have records that could be responsive to Plaintiff’s April 13 FOIA [r]equest.” Id. at 8 (Gilmore Decl. ¶ 22).

NSG “initiated an automated search in the ASETT system with the timeframe [of] January 1, 2015 through April 10, 2020.” Id. (Gilmore Decl. ¶ 23). The ASETT system, or Administrative Simplification Enforcement and Testing Tool system, “is a web-based application which enables individuals or organizations to file a complaint against a HIPAA covered entity for potential non-compliance” and it “allows all HIPAA related transactions to be checked consistently for compliance, syntax and business rules.” Id. at 7 (Gilmore Decl. ¶ 21). NSG’s search of the ASETT system used the keywords “EFT,” “FAQ,” “22297,” “22285,” and “22281.” Id. at 8 (Gilmore Decl. ¶ 23).

In addition, because NSG was previously a “subsidiary” of the Office of Information Technology (“OIT”), “OIT also searched records related to its employees, including employees of NSG” that were mentioned in Plaintiff’s FOIA request. Id. at 10 (Gilmore Decl. ¶ 27). The *5 keywords used were, again, “EFT,” “FAQ,” “22297,” “22285,” and “22281,” as were the names of the fourteen CMS employees identified in the FOIA request as individuals with “intimate knowledge of the response records,” Dkt. 28-5 at 2; Dkt. 28-3 at 10 (Gilmore Decl. ¶ 27).

The records identified by these searches consisted of 66 pages, of which 21 pages were redacted pursuant to Exemption 5 and 15 pages were redacted pursuant to Exemption 6. Id. at 10 (Gilmore Decl. ¶ 28). Subject to these redactions, the materials were released to Plaintiff as part of the January 14, 2021 production. Id. at 11 (Gilmore Decl. ¶ 28).

2. May 4, 2020 FOIA request

On May 4, 2020, Plaintiff submitted a request to CMS for “all records” from January 1, 2015 to May 1, 2020 regarding: “Nixon Peabody,” “W. Scott O’Connell,” “Parthenon Capital or ‘Parthenon,’” “Bain Capital or ‘Bain’, Bain Capital Ventures,” “Kirkland & Ellis,” “Akin Gump Strauss Hauer & Feld” and various employees affiliated with that firm, “John Bozeman & Associates,” “GeorgiaLink Public Affairs Group” and various employees affiliated with that firm, “Matthew N. Greller Esq LLC,” and “Lewis, Ron E. of Ron Lewis & Associates” (the “May 4 FOIA request”). Dkt. 28-7 at 1 (capitalization altered). Plaintiff included in his May 4 request “additional search keywords” that included, among other terms, “W. Scott O’Connell,” “O’Connell,” “Oconnell,” “soconnell@nixopeabody.com,” “Nixon Peabody,” and “nixonpeadbody.com.” Id. at 2. And, like the April 13 FOIA request, the May 4 FOIA request suggested that CMS search, among other possible offices, the Office of the CMS Administrator, OSORA, and PMNSG and provided a non-exhaustive list of potential custodians for those records. Id. at 2–3.

Shortly after receiving Plaintiff’s FOIA request, CMS contacted Plaintiff to clarify the subject matter of the records Plaintiff sought. Dkt. 28-9 at 1. Plaintiff responded that he was interested in all records relating to the identified individuals or entities concerning:

(1) HIPAA administrative simplification requirements including but not limited to 45 CFR Parts 160, 162, and 164; (2) fees and costs of electronic transactions including but not limited to ERA (electronic remittance advice), EFT (electronic funds transfer), credit cards, virtual payment cards, prepaid cards and debit cards, checks, (3) electronic transactions including but not limited to ERA, EFT, electronic attachments, 835 transactions, 270/271 eligibility and benefit verification transactions, claim submissions, [and] (4) [a]ny aspects of HIPAA administrative simplification requirements including but not limited standard transactions, fees for standard transactions, enforcement of CMS regulations, guidance, payment methods, telecommunication fees.

Dkt. 28-10 at 1.

Once again, CMS referred Plaintiff’s May 4 FOIA request to OSORA and NSG (formerly PMNSG). Dkt. 28-3 at 13 (Gilmore Decl. ¶ 35). NSG was thought to have responsive records because “Plaintiff’s May 4 FOIA request sought [records regarding] fees for electronic health transactions, HIPAA requirements and standard fees for electronic transactions, which are all matters that the NSG handles.” Id. at 13–14 (Gilmore Decl. ¶ 36). And the May 4 FOIA request was sent to OSORA “because Plaintiff sought records from exterior entities and . . . OSORA handles exterior correspondence to the CMS Administrator.” Id. at 15 (Gilmore Decl. ¶ 38). NSG searched the ASETT system, and OSORA searched the SWIFT correspondence database. Id. at 14–15 (Gilmore Decl. ¶¶ 37, 39). CMS explains that it “limited its search to these two record systems because there were no other records systems that were likely to turn up the information that Plaintiff requested.” Id. at 13 (Gilmore Decl. ¶ 35). NSG’s search of the ASETT system used the keywords “EFT,” “ERA,” “835,” “270/271,” “fees and/or costs,” and “any of the associated persons or entities in Plaintiff’s May 4 FOIA [r]equest.” Id. at *7 14 (Gilmore Decl. ¶ 37). OSORA’s search of the SWIFT correspondence database used the same keywords as NSG’s search. Id. at 15–16 (Gilmore Decl. ¶ 39).

These searches resulted in the identification of 28 pages of responsive records. On August 17, 2020, CMS provided its response, “releasing 28 pages, and withholding nine pages pursuant to Exemptions 5 and 6,” id. at 16 (Gilmore Decl. ¶ 40), for a total of 37 pages. CMS does not explain how 28 pages became 37.

3. May 6, 2020 FOIA request

Plaintiff submitted his third FOIA request on May 6, 2020. That request sought “all records” from January 1, 2015 to May 5, 2020 regarding “[c]ommunications to and from the US Congress (US Senate and US House of Representatives) and its members related to fees to conduct standard transactions (EFT, ERA), and use of virtual credit cards or payment cards.” Dkt. 28-12 at 1. Plaintiff also provided additional search terms “that may help identify responsive materials,” including: “EFT Fee, ERA fee, transaction fee, virtual credit card, payment card, prepaid card,” and the names of numerous health care businesses. Id. Like his previous requests, Plaintiff stated that the Office of the CMS Administrator, OSORA, and PMNSG (which at the time of the request was a subsidiary of OIT, Dkt. 28-3 at 10 (Gilmore Decl. ¶ 27)) might have responsive records and provided a list of CMS employees who Plaintiff believed were custodians of responsive records. Dkt. 28-12 at 1–2.

CMS asked three offices to search for records responsive to this request: the Office of Legislative Affairs, OSORA, and the Office of the CMS Administrator. CMS concluded that the Office of Legislative Affairs might have responsive records because it is the office that “handles correspondence with Congress.” Dkt. 28-3 at 21 (Gilmore Decl. ¶ 51). That office searched its “Legislative correspondence tracker” for “incoming correspondence from Congressional *8 members” using the following search terms: “EFT Fee,” “ERA fee,” “transaction fee,” “virtual credit card,” “payment card,” “prepaid card,” “and the names of any member of the U.S. Congress whose name(s) could aid the search, based on general search terms that could be used across all members of Congress.” Id. at 21–22 (Gilmore Decl. ¶ 52). The Office of Legislative Affairs also used those terms in its search of its “Outlook emails.” Id. at 23 (Gilmore Decl. ¶ 55).

OSORA conducted its own search of incoming correspondence for potentially responsive records using its SWIFT database. Id. at 22–23 (Gilmore Decl. ¶ 54). CMS thought it “logical to believe that if [responsive records] existed, OSORA might have [them],” because “this office has a correspondence group that handles and tracks exterior correspondence for the CMS Administrator in the SWIFT database” and because “incoming correspondence to the CMS Administrator . . . is disseminated by OSORA staff to subject matter experts in CMS to formulate responses.” Id. Finally, the Office of the Administrator was also tasked with searching for responsive records because that office might “have been involved with such Congressional correspondence.” Id. at 22 (Gilmore Decl. ¶ 53). It too searched the SWIFT incoming correspondence database for documents. Id. Both OSORA and the Office of the CMS Administrator used the same keywords in their searches of the SWIFT system: “EFT fee,” “ERA fee,” “transaction fee,” “virtual credit card,” “payment card,” and “prepaid card.” Id. at 23 (Gilmore Decl. ¶ 55).

None of these searches identified any responsive records. CMS notified Plaintiff of this on June 24, 2020. Id. (Gilmore Decl. ¶ 56).

4. May 7, 2020 FOIA request

Plaintiff’s fourth FOIA request was submitted to CMS on May 7, 2020. This request sought “all records” from January 1, 2015 to May 5, 2020 regarding “Zelis or Zelis Healthcare,” “[a]ll communication involving or referring to” several specific Zelis employees, and “[a] log of phone calls between any number at CMS to and from (678) 350-3810, (908) 389-8966, and (908) 268-2229” (the “May 7 FOIA request”). Dkt. 28-15 at 1. Plaintiff again stated that the Office of the CMS Administrator, OSORA, and PMNSG might have responsive records and provided a list of CMS employees who Plaintiff believed were custodians of responsive records. Id. at 1–2.

NSG was tasked with conducting a search for records responsive to this request because “Plaintiff sought communications between Zelis and . . . CMS, and . . . NSG handles Zelis[’s] participation in the Administrative Simplification process.” Dkt. 28-3 at 24–25 (Gilmore Decl. ¶ 61). NSG limited its search to the ASETT record system “because there w[ere] no other records systems that w[ere] likely to turn up the information that Plaintiff requested.” Id. at 25 (Gilmore Decl. ¶ 61). NSG searched for records between January 16, 2015 to May 5, 2020, using the terms “Zelis,” “Albright,” “Fargis,” “Drysdale,” and “Klinger.” Id. (Gilmore Decl. ¶ 62). The records identified by this search were incorporated into CMS’s January 14, 2021 production. Id.

5. May 12, 2020 FOIA request

Plaintiff’s fifth FOIA request, sent to CMS on May 12, 2020, was focused on records relating to Echo Health. Specifically, this request sought “all records” from January 1, 2020 to May 10, 2020 regarding three specific “CMS Complaint[s] . . . involving Echo Health,” “two specific “CMS complaints . . . involving Vpay,” and “[a]ny other CMS complaints involving Echo Health” or “involving Vpay” and “related documents and communications” (the “May 12 *10 FOIA request”). Dkt. 27-17 at 1. Plaintiff proposed the following non-exhaustive list of search terms in his FOIA request: “Echo Health Inc; Echo Health,” “MSroka@ EchoHealthInc.com,” “@EchoHealthInc.com,” “richmans@pepperlaw.com, vpay.com, vpayusa.com, [and] Vpay.” Id. And, as was typical of Plaintiff’s requests, he noted that responsive records were likely to be found with specific CMS employees, the Office of the CMS Administrator, OSORA, and PMNSG. Id. at 2. He also stated that “the materials responsive to this complaint reside at the national CMS office” and “NOT . . . the regional New York office.” Id. at 2.

CMS sent the May 12 FOIA request to OSORA, the NSG, CMS Regional Office 2, CMS Regional Office 5, the Centers for Clinical Standards and Quality (“CCSQ”), and the Center for Consumer Information and Insurance Oversight (“CCIIO”). Dkt. 28-3 at 26–27 (Gilmore Decl. ¶ 67). All six of these offices used the same keywords in their searches, which included the specific complaint numbers referenced in the FOIA request and the terms “Echo Health,” “involving ‘Vpay,’” “MSroka@EchoHealthInc.com,” “@EchoHealthInc.com,” “richmans@pepperlaw.com,” “vpay.com,” “vpayusa.com,” and “Vpay.” Id. at 27–30 (Gilmore Decl. ¶¶ 68–70).

OSORA again searched the SWIFT correspondence database for responsive records because “Plaintiff sought all records, . . . includ[ing] correspondence to agency officials,” which OSORA “handles.” Id. at 27 (Gilmore Decl. ¶ 68). And NSG again searched the ASETT system for records because “NSG handles complaints with the specific identifiers mentioned by Plaintiff” in his FOIA request. Id. at 29 (Gilmore Decl. ¶ 71).

The CMS Regional Offices were tasked with searching for records responsive to this request because “Plaintiff sought information about companies or law firms” CMS understood to be “located in [those] region[s],” although the agency later learned that Plaintiff did not actually *11 seek information on any entity located in Region 5. Id. at 27–28 (Gilmore Decl. ¶¶ 69, 70). Both Regional Offices searched the Automated Survey Processing Environment Network (“ASPEN”), “which contains information on survey and certifications of Medicare providers.” Id. at 28 (Gilmore Decl. ¶ 69).

CCSQ also received Plaintiff’s May 12 request “because Plaintiff sought information about specific companies and given that CCSQ handles laboratories, nursing homes, and other facilities, it was logical to believe that . . . CCSQ might have records that could be responsive.” Id. at 29–30 (Gilmore Decl. ¶ 72). CCSQ also searched the ASPEN database for responsive records. Id. at 30 (Gilmore Decl. ¶ 72). Finally, CCIIO received the FOIA request because the companies on which Plaintiff sought information “may have been insurance carriers” and CCIIO “handles insurance claims.” Id. (Gilmore Decl. ¶ 73). It searched its “Consumer Support Division.” Id.

None of Regional Office 2, Regional Office 5, CCSQ, or CCIIO’s searches identified any responsive records because the entities that Plaintiff sought information about were not entities that these offices regulated. Id. at 31 (Gilmore Decl. ¶ 74). The NSG, however, located 46 pages of responsive records, which were incorporated into CMS’s January 14, 2021 production. Id. (Gilmore Decl. ¶¶ 75–76).

6. May 15, 2020 FOIA request

Plaintiff submitted his sixth FOIA request on May 15, 2020. That request sought “all records from [from January 1, 2015 to May 15, 2020] regarding the CMS investigation of covered entities, including health plans, clearinghouses, and business associates charging fees to conduct standard transactions” (the “May 15 FOIA request”). Dkt. 28-19 at 1. The request explained that “[t]hese investigations are often the results of HIPAA administrative *12 simplification requirements complaints . . . also known as ASETT . . . complaints.” Id. Plaintiff also provided a non-exhaustive list of search terms for this request, including “EFT Fee, ERA fee, standard transaction fee, virtual credit card, payment card, prepaid card,” and the names of numerous health care businesses. Id. And he stated that he believed responsive records might be found in the Office of the CMS Administrator, OSORA, and PMNSG, or in the possession of certain CMS employees. Id. at 1–2.

Like Plaintiff’s previous request, his May 15 FOIA request was sent to NSG “because Plaintiff sought records on investigations [of] covered entities charging fees on standard transactions,” and “NSG handles enforcement of the Administrative Simplification process.” Dkt. 28-3 at 35 (Gilmore Decl. ¶ 87). For the reasons previously described, NSG searched its ASETT system using the search terms “EFT Fee,” “ERA fee,” “standard transaction fee,” “virtual credit card,” “payment card,” “prepaid card,” “Zelis,” “Echo Health,” “PaySpan Health,” “Vpay,” “Consolidated Health Plan,” “Allied Healthcare,” “Paramount,” “Stirling Benefits,” “Magnacare,” “Meritain,” “Delta Health Systems,” “Excellus Health Plan,” “POMCO,” “UMR,” “United Healthcare,” “Paramount,” “HealthFirst,” “Total Health Plan,” “GlobalExcel,” “Magnacare,” “Create Health Plan,” “Olympus,” “GHI, Fidelis,” “Ama Insurance,” and “Healthsmarte.” Id. at 35–36 (Gilmore Decl. ¶ 88).

This search identified 3,335 pages of responsive records, of which 1,971 pages were released in full, 133 pages in part, and 1,231 pages were withheld entirely. Id. at 36 (Gilmore Decl. ¶ 89). CMS released the responsive, non-exempt records to Plaintiff on January 26, 2021. Id.

7. July 22, 2020 FOIA request

Plaintiff’s seventh and penultimate FOIA request was submitted on July 22, 2020. That request sought “all records” from January 1, 2015 to July 1, 2020 “regarding (1) price setting, cost, reimbursement, fee schedule allowable amount setting for Medicare reimbursement, APC code selection[;] (2) comparative clinical effectiveness research (CER) or analysis, cost-effectiveness analysis, effect on cost of care for BPH[;] [and] (3) determination of maximum lifetime reimbursement quantity that involve” “Urolift (prostatic urethral lift, transprostatic implant, prostatic urethral stent),” “Rezum (transurethral water vapor thermal therapy for benign prostatic hyperplasia),” and “AquaBeam Robotic System and Aquablation therapy.” Dkt. 28-22 at 1 (capitalization altered). Plaintiff suggested that responsive records might be found with the Office of the CMS Administrator, OSORA, and the Centers for Medicare. Id. at 2.

CMS referred the request to both the CCSQ and the Centers for Medicare. Dkt. 28-3 at 39 (Gilmore Decl. ¶ 99). CCSQ was thought to have responsive records because “Plaintiff’s July 22 FOIA [r]equest sought costs, reimbursements and fees for certain medical equipment and . . . [CCSQ] handle[s] medical equipment data coding and billing.” Id. at 39–40 (Gilmore Decl. ¶ 100). CCSQ searched its ASPEN system, id. at 40 (Gilmore Decl. ¶ 100), “which contains information on survey and certifications of Medicare providers,” id. at 28 (Gilmore Decl. ¶ 69). The Centers for Medicare was also tasked with searching for responsive records because “these Centers handle Fee for Service billing” and “Plaintiff sought fee schedules.” Id. (Gilmore Decl. ¶ 101). It “initiated an automated search of the[] ‘Fee For Service Division Recovery Audit Program.’” Id. Both CCSQ and the Centers for Medicare used the same keywords in their searches. Those keywords were “durable medical equipment reimbursement,” *14 “Urolift,” “Rezum,” and “Aquabeam.” Id. at 39–41 (Gilmore Decl. ¶¶ 100–101, 104). Neither search identified any responsive records. Id. at 42 (Gilmore Decl. ¶ 106).

Plaintiff’s July 22 request was also sent to the Office of Enterprise Data and Analytics (“OEDA”) because that office “handles” all of the topics that Plaintiff listed in this request. Id. at 40–41 (Gilmore Decl. ¶ 102). CMS does not provide much detail, however, regarding this search. Instead, CMS merely notes that on November 12, 2020, OEDA “responded that the records in Plaintiff’s July 22 FOIA [r]equest were in public Use Files on the CMS website.” Id. at 41 (Gilmore Decl. ¶ 103). CMS let Plaintiff know that the information he sought was publicly available on September 8, 2021. Id. at 42 (Gilmore Decl. ¶ 105).

8. July 27, 2020 FOIA request

Plaintiff submitted the final FOIA request at issue in this suit to CMS on July 27, 2020. It sought “all records” from January 1, 2015 to July 20, 2020 “regarding standards for healthcare attachment transactions and electronic signatures, including but not limited to (1) adoption of these standards, (2) delays with adoption, (3) adoption of 275 transaction, 277 transaction, HL7 Da Vinci project with its leveraging of FHIR API standards for healthcare attachment transactions.” Dkt. 28-25 at 1. Plaintiff added that “[t]hese standards were mandated in 1996 (HIPAA) and ‘re’ mandated in section 1104 of the ACA (2010),” and Plaintiff provided a non-exhaustive list of suggested search terms, including “healthcare attachment transaction, attachment, electronic attachment, electronic signature, healthcare attachment, standard 275 transaction, 277 transaction, HL7 Da Vinci project, FHIR API standards, CAQH Core, X12, . . . WEDI.” Id. The FOIA request also stated that Plaintiff thought responsive records might be found in the Office of the CMS Administrator, OSORA, PMNSG, and the Office of Burden Reduction and Healthcare Informatics. Id. at 1–2.

Plaintiff’s July 29 FOIA request was forwarded to NSG to search for responsive records in its ASETT system because “Plaintiff’s FOIA [r]equest sought records that were related to standards for healthcare attachment transactions and electronic signatures and . . . ASETT handles electronic healthcare transactions.” Dkt. 28-3 at 43 (Gilmore Decl. ¶¶ 110–111). The keywords used in this search were “FHIR API standards,” “HL7 Da Vinci project,” and “standards for healthcare attachment transactions and electronic signatures,” although CMS also states that it “used and did not omit any of the keywords provided by Plaintiff,” some of which returned “hits” and others of which did not. Id. at 44 (Gilmore Decl. ¶¶ 111, 113). The search identified 92 pages of responsive records, which CMS released to Plaintiff as part of the January 14, 2021 production. Id. (Gilmore Decl. ¶ 113). B. Procedural Background

Plaintiff filed this suit on October 16, 2020. Dkt. 1. By that time, CMS had provided responses to two of his eight requests, his May 4 and May 6 requests. Plaintiff administratively appealed both responses, Dkt. 28-3 at 17 (Gilmore Decl. ¶ 41); Dkt. 31-2 at 14, but CMS did not resolve either appeal by the time Plaintiff filed this suit. After Plaintiff filed suit, CMS responded to the remaining six outstanding FOIA requests, releasing responsive materials in two tranches, one on January 14, 2021 and one on January 26, 2021.

Ultimately, CMS identified at least 3,838 pages of records responsive to Plaintiff’s eight FOIA requests. Of those records, CMS released 2,396 pages, in full or in part, and withheld 1,380 pages entirely. Dkt. 28-3 at 16, 36, 45 (Gilmore Decl. ¶¶ 40, 89, 116). The parties now dispute whether CMS has satisfied its obligations under the FOIA to conduct an adequate search for the records Plaintiff requested and whether it permissibly withheld certain records in whole *16 or in part. CMS moved for summary judgment on December 16, 2022, Dkt. 28, and Plaintiff cross-moved for summary judgment on February 10, 2023, Dkt. 31.

II. LEGAL STANDARD

FOIA is “designed ‘to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.’” U.S. Dep’t of State v. Ray, 502 U.S. 164 (1991) (quoting Dep’t of Air Force v. Rose, 425 U.S. 352, 361 (1976)). The Act accordingly “requires federal agencies to disclose records to the public on request unless a record is protected by one of nine statutory exemptions.” Citizens for Resp. & Ethics in Wash. v. U.S. Dep’t of Justice, 58 F.4th 1255, 1261– 62 (D.C. Cir. 2023) (citing 5 U.S.C. § 552(b)). While FOIA’s exemptions are “as much a part of [the Act]’s purposes and policies as the statute’s disclosure requirement,” Food Mktg. Inst. v. Argus Leader Media, 139 S. Ct. 2356, 2366 (2019) (quoting Encino Motorcars, LLC v. Navarro, 138 S. Ct. 1134, 1142 (2018)), FOIA’s exemptions must nevertheless be “narrowly construed,” Milner v. Dep’t of Navy, 562 U.S. 562, 565 (2011) (quoting FBI v. Abramson, 456 U.S. 615, 630 (1982)), and the burden is on the agency to justify any withholdings, 5 U.S.C. § 552(a)(4)(B).

“FOIA cases are typically resolved on motions for summary judgment under Federal Rule of Civil Procedure 56.” Akel v. U.S. Dep't of Justice, 578 F. Supp. 3d 88, 94–95 (D.D.C. 2021). To prevail on a summary judgment motion, the moving party must demonstrate that there are no genuine issues of material fact and that he is entitled to judgment as a matter of law. See Celotex Corp. v. Catrett, 477 U.S. 317, 322–23 (1986). In a FOIA case, an agency can satisfy this burden by submitting “relatively detailed and non-conclusory” affidavits or declarations, SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991), and an index of the information withheld, Vaughn v. Rosen, 484 F.2d 820, 827–28 (D.C. Cir. 1973).

When a party challenges the agency’s decision to withhold a record pursuant a FOIA exemption, the agency must demonstrate “that each document that falls within the class requested either has been produced . . . or is wholly exempt from [FOIA’s] inspection requirements.” Students Against Genocide v. U.S. Dep’t of State, 257 F.3d 828, 833 (D.C. Cir. 2001) (quoting Goland v. CIA, 607 F.2d 339, 352 (D.C. Cir. 1978)). Pursuant to the FOIA Improvement Act, an agency may withhold a record “only if [it] reasonably foresees that disclosure would harm an interest protected by [the] exemption . . . or if disclosure is prohibited by law.” 5 U.S.C. § 552(a)(8)(A).

An agency confronted with a challenge to the adequacy of its search has the burden of showing that “it made a good faith effort to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested.” Oglesby v. Dep’t of the Army, 920 F.2d 57, 68 (D.C. Cir. 1990). To satisfy this burden, the agency must submit affidavits or declarations that “explain in reasonable detail the scope and method of the search [it] conducted,” Morley v. CIA, 508 F.3d 1108, 1121 (D.C. Cir. 2007), in order to permit “a court to determine if the search was adequate,” Nation Magazine v. U.S. Customs Serv., 71 F.3d 885, 890 (D.C. Cir. 1995). Although an agency need not “search every record system,” it must search those systems “that are likely to turn up the information requested.” Oglesby, 920 F.2d at 68. “Summary judgment must be denied ‘if a review of the record raises substantial doubt’” regarding the adequacy of the search. DiBacco v. U.S. Army, 795 F.3d 178, 188 (D.C. Cir. 2015) (quoting Valencia-Lucena v. U.S. Coast Guard, 180 F.3d 321, 326 (D.C. Cir. 1999)).

III. ANALYSIS

A. Exhaustion

Before filing suit under the FOIA, “[e]xhaustion of administrative remedies is generally required . . . so that the agency has an opportunity to exercise its discretion and expertise on the matter and to make a factual record to support its decision.” Oglesby, 920 F.2d at 61. Here, CMS contends that Plaintiff has failed to exhaust his administrative remedies with respect to the FOIA request he submitted on May 15, 2020. See Dkt. 28-1 at 3 n.2. CMS asks the Court, as a result, to dismiss his claim that pertains to that request. Id.; see also Hidalgo v. FBI, 344 F.3d 1256, 1260 (D.C. Cir. 2003) (vacating a grant of summary judgment and remanding to the District Court with directions to dismiss the FOIA claims against the agency because the plaintiff there had failed to exhaust his administrative remedies).

A plaintiff has “two ways . . . to exhaust administrative remedies [under the FOIA]: actual exhaustion and constructive exhaustion.’” Nat’l Sec. Counselors v. CIA, 931 F. Supp. 2d 77, 95 (D.D.C. 2013). “Actual exhaustion, or an administrative ‘appeal to the head of the agency,’ is required when an agency responds to a request.” Hull v. U.S. Att’y, 279 F. Supp. 3d 10, 12 (D.D.C. 2017) (quoting 5 U.S.C. § 552(a)(6)(A)). By contrast, constructive exhaustion “occurs ‘[w]hen an agency fails to respond to a request within twenty working days.’” Id. (quoting Nat’l Sec. Counselors, 931 F.Supp.2d at 95). In that case, “a requester ‘shall be deemed to have exhausted his administrative remedies’ and may seek judicial review” of the agency’s failure to fulfil its obligations under the FOIA. Id. (quoting 5 U.S.C. § 552(a)(6)(C)(i)). Constructive exhaustion, however, is a viable way to exhaust only if the agency has not “cure[d] its failure to respond within the statutory period by responding to the FOIA request before suit is filed.” Oglesby, 920 F.2d at 63.

Plaintiff contends that he constructively exhausted his May 15 claims. He states that when he filed suit on October 16, 2020, CMS had not yet responded to his May 15 request. Dkt. 31-1 at 31–32. And, because October 16, 2020 is more than twenty “working days” after May 15, 2020, he concludes that he exhausted his administrative remedies with respect to that request. Id. In advancing this argument, Plaintiff recognizes that on May 22, 2020, CMS “acknowledged its receipt [of his May 15 FOIA request].” Id. at 32 (citing Dkt. 28-3 at 34 (Gilmore Decl. ¶ 86). But he argues that “[t]he acknowledgement did not make a determination on the request” and, to the contrary, “indicated that CMS had not yet completed its ‘initial analysis.’” Id. (quoting Dkt. 28-20 at 1). The May 22 letter, Plaintiff argues, is therefore insufficient because the agency is required to issue a determination—rather than a mere acknowledgement of receipt—within twenty working days under the FOIA. Id. (citing Citizens for Resp. & Ethics in Wash. v. Fed. Election Comm’n, 711 F.3d 180, 182 (D.C. Cir. 2013)).

Plaintiff is right that an agency must do more than merely acknowledge receipt of a FOIA request to satisfy its statutory obligation to respond to each request within twenty working days (barring “unusual circumstances”). FOIA instructs agencies to “[d]etermine within 20 days (excepting Saturdays, Sundays, and legal public holidays) after the receipt of any such request whether to comply with such request.” 5 U.S.C. § 552(a)(6)(A)(i). As the D.C. Circuit has explained, this means that, after receiving a FOIA request, the agency “must at least indicate within the relevant time period the scope of the documents it will produce and the exemptions it will claim with respect to any withheld documents.” Citizens for Resp. & Ethics in Wash., 711 F.3d at 182–83. CMS does not suggest that its May 22 letter to Plaintiff satisfied those requirements.

CMS describes in May 22 letter as a “formal acknowledgement letter” that “confirmed the agency’s receipt of the request, advised that a search for documents had been initiated, and explained the unusual and exceptional circumstances that would impact the agency’s response time, informed Plaintiff of the control number, the alternatives if voluminous records are located, and fees which may be incurred.” Dkt. 28-3 at 35 (Gilmore Decl. ¶ 86). In other words, the letter explained to Plaintiff how the agency’s process for responding to his request would proceed. See Dkt. 28-20. It did not provide Plaintiff with a determination of any kind; it did not, for example, inform him whether the agency would produce the documents he sought or whether it withhold any documents pursuant to certain exemptions. See Citizens for Res. & Ethics in Wash., 711 F.3d at 186 (“The statute requires that, within the relevant time period, an agency must determine whether to comply with a request—that is, whether a requester will receive all the documents the requester seeks. It is not enough that, within the relevant time period, the agency simply decide to later decide.”). The Court thus concludes that Plaintiff did not receive a “determination” of any kind from CMS with respect to his May 15 FOIA request within 20 workings days, and thus he constructively exhausted that request before he filed suit on October 16, 2020.

CMS does make one final attempt to argue that Plaintiff has not exhausted his May 15 claims. It argues that even if Plaintiff constructively exhausted those claims when he filed suit, the agency remedied its failure to respond to his May 15 FOIA request when it “released 1,971 pages in full, 133 pages in part, and withheld 1,231 pages entirely pursuant to exemptions 4, 5, and 6 of the FOIA” on January 26, 2021, and Plaintiff never appealed that response. Dkt. 28-3 at 36 (Gilmore Decl. ¶ 89). But this argument misunderstands the principle that an agency can “cure” its failure to timely respond to a FOIA request by responding, and thereby foreclose a *21 requester’s ability to constructively exhaust their claim. To be sure, the D.C. Circuit has held that, “if an agency responds to the request after the deadline, but before the requester has filed suit, the requesting party must exhaust administrative remedies before seeking judicial review.” In Def. of Animals v. Nat’l Institutes of Health, 543 F. Supp. 2d 83, 96 (D.D.C. 2008) (emphasis added) (citing Oglesby, 920 F.2d at 63). But the D.C. Circuit has not extended this principle to permit an agency to cure its failure to respond after the requester has filed suit, thereby “unexhausting” a claim that was exhausted at the time the FOIA requester filed suit. An agency’s decision to respond to a plaintiff’s FOIA request after the plaintiff has filed suit may deprive a plaintiff of standing if the remedy sought has been provided. But that is not an issue of exhaustion, see Williams & Connolly v. S.E.C., 662 F.3d 1240, 1243–44 (D.C. Cir. 2011) (“Once the documents are released to the requesting party, there no longer is any case or controversy, [rendering the case] . . . moot with respect to those documents.”), and, in any event, the parties continue dispute the adequacy of CMS’s response to the May 15 FOIA request.

The Court, accordingly, concludes that Plaintiff has exhausted his administrative remedies with respect to his May 15 FOIA request and, thus, rejects CMS’s exhaustion defense. B. Adequacy of the Search

The parties dispute whether the search CMS conducted in response to Plaintiff’s eight FOIA requests was sufficient. CMS contends that it “made a good faith effort to perform search using methods [that] can be reasonably expected to produce the information requested,” Dkt. 28-1 at 11, and submits two declarations from Hugh Gilmore, the Director of the Freedom of Information/Privacy Acts Division of CMS, in an effort to satisfy its burden, Dkt 28-3; Dkt. 41-1. Plaintiff disagrees on multiple grounds.

The adequacy of a search “is generally determined not by [its] fruits . . . , but by the appropriateness of the methods used to carry [it] out.” Iturralde v. Comptroller of Currency, 315 F.3d 311, 315 (D.C. Cir. 2003). Ultimately, the adequacy of the search is “dependent upon the circumstances of the case” and measured by a “standard of reasonableness.” Flete-Garcia v. U.S. Marshals Serv., 613 F. Supp. 3d 425, 432–33 (D.D.C. 2020) (quoting Weisberg v. U.S. Dep’t of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983)). An agency “‘cannot limit its search to only one record system if there are others that are likely to turn up the information requested,’ but, at the same time, it need not ‘search every record system.’” SAI v. Transportation Sec. Admin., 315 F. Supp. 3d 218, 241 (D.D.C. 2018) (quoting Oglesby, 920 F.2d at 68). “Similarly, the agency need not deploy every conceivable search term or permit the FOIA requester to dictate the search terms in the course of litigation, but it must use terms reasonably calculated to locate responsive records.” Id.

“[T]o obtain summary judgment[,] the agency must show that it made a good faith effort to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested.” Oglesby, 920 F.2d at 68 (citations omitted). To meet this burden, “the agency must submit affidavits (or declarations) that ‘denote which files were searched, [and] by whom those files were searched, and [that] reflect a ‘systematic approach to document location.’” SAI, 315 F. Supp. 3d at 241 (quoting Liberation Newspaper v. U.S. Dep’t of State, 80 F. Supp. 3d 137, 144 (D.D.C. 2015)).

Once the agency has proffered “‘relatively detailed and nonconclusory’ declarations describing its search, the burden shifts to the FOIA requester to ‘produce countervailing evidence’ sufficient to establish a genuine dispute of material fact as to the adequacy of the search.” Flete-Garcia, 613 F. Supp. 3d 425, 432–33 (D.D.C. 2020) (quoting Morley, 508 F.3d at *23 1116). That countervailing evidence might include “problems with . . . the specific search terms used or the inadequacy of the particular locations searched.” Heartland Alliance for Human Needs & Human Rights v. U.S. Immigration & Customs Enf’t, 406 F. Supp. 3d 90, 117 (D.D.C. 2019). But because the agency’s affidavits or declarations “are accorded a presumption of good faith, [they] cannot be rebutted by ‘purely speculative claims about the existence and discoverability of other documents.’” SafeCard Servs., 926 F.2d at 1200 (quoting Ground Saucer Watch, Inc. v. CIA, 692 F.2d 770, 771 (D.C. Cir. 1981)). If “a review of the record raises substantial doubt, particularly in view of ‘well defined requests and positive indications of overlooked materials,’ summary judgment is inappropriate.” Valencia-Lucena, 180 F.3d at 326 (citation omitted).

Plaintiff identifies several reasons why “[s]uch doubt exists” on the present record. He contends (1) that “CMS failed to follow up on obvious leads;” (2) that “CMS’s search declaration fails to account for several thousand responsive pages;” (3) and, finally, that CMS did not use “methods which can be reasonably expected to produce the information requested,” Oglesby, 920 F.2d at 68, because “CMS employed deficient search terms” and because “CMS arbitrarily refused to search locations and custodians that would reasonably possess responsive records.” Dkt. 31-1 at 23–24. The Court will consider each argument in turn.

1. Obvious leads

Plaintiff first argues that CMS’s search was inadequate because the agency failed to follow obvious leads that were revealed by the results of its earlier searches. See Campbell v. U.S. Dep’t of Justice, 164 F.3d 20, 28 (D.C. Cir. 1998) (“An agency . . . must revise its assessment of what is [a] ‘reasonable’ [search] in a particular case to account for leads that emerge during its inquiry.”). “To be sure, . . . an agency in certain circumstances must conduct *24 an additional search of its records based on the results of its initial search. That obligation exists in the ‘rare case . . . in which an agency record contains a lead so apparent’—i.e., ‘a lead that is both clear and certain’—that the agency ‘cannot in good faith fail to pursue it.’” Watkins L. & Advoc., PLLC v. U.S. Dep’t of Justice, No. 21-5108, 2023 WL 5313522, at *9 (D.C. Cir. Aug. 18, 2023) (quoting Kowalczyk v. Dep’t of Justice, 73 F.3d 386, 389 (D.C. Cir. 1996)). Here, Plaintiff contends that CMS failed to follow such leads when it did not search its employees’ text messages after one email released to him referenced a “future text message conversation;” when CMS failed to produce certain attachments or other documents referenced in records that were produced; and when CMS failed to search for specific records referenced in the bodies of emails released to Plaintiff. Dkt. 31-1 at 28–29.

Plaintiff is correct that, in certain circumstances, an agency may be obligated to search a particular employee’s text messages in response to a FOIA request. Agencies can be required to search text messages when it is “reasonably likely” that an employee conducted agency business on a pertinent topic via text. See, e.g., Judicial Watch, Inc. v. U.S. Dep’t of Justice, 373 F. Supp. 3d 120, 127 (D.D.C. 2019) (concluding that an Inspector General report documenting the use of text messages by a particular government employee to conduct government business made it sufficiently likely that a search of that’s employee’s text messages would product responsive records). There is no reason to believe that is the case here, however. The single email Plaintiff cites in support of his contention that employees were engaged in conversation over text relevant to his request consists of a discussion in which an “EFT FAQ” is circulated “IN CASE there is any movement on the FAQs.” Dkt. 31-2 at 51 (capitalization in original). One participant in the email exchange provides her phone number because she would not be “easily reachable” the following day, when the “movement on the FAQs” might occur. Id. A natural reading of this *25 email exchange permits the inference that the sender provided her phone number not as an invitation to continue the discussion about the EFT FAQs via text message but, instead, as a mere request that someone contact the sender via that number if “movement” on the EFT FAQ were to occur. 1 Accordingly, this exchange does not constitute “a lead that is both clear and certain” regarding the existence of potentially response text messages.

Turning, then, to the attachments Plaintiff contends are “missing,” see Dkt. 31-1 at 28–29 (citing Dkt. 31-2 at 53–55), CMS acknowledges that it did not provide Plaintiff with all attachments or other documents referenced in the materials it did produce. CMS explains that “Plaintiff is correct that some email attachments . . . were withheld because they were drafts or duplicates of the same drafts,” Dkt. 28-3 at 11 (Gilmore Decl. ¶ 28), or, in other cases, CMS contends that “[a]ny attachments that may have existed were . . . non-responsive, id. at 16 (Gilmore Decl. ¶ 40). In other words, there is no basis to find the CMS failed to search for attachments, thereby rendering its searches inadequate. Plaintiff was, of course, free to challenge the agency’s decision to withhold attachments “because they were drafts or duplicates of the same drafts,” Dkt. 28-3 at 11 (Gilmore Decl. ¶ 28), or because they were ‘non-responsive,” id. at 16 (Gilmore Decl. ¶ 40); see also Brady Center for the Prevention of Gun Violence v. U.S. Dep’t of Justice, 410 F. Supp. 3d 225, 236 (D.D.C. 2019)—but such a challenge goes to the reasonableness of the withholding or the scope of the FOIA request and is distinct from the agency’s obligation to conduct an adequate search. This argument therefore also fails.

1 That same email refers to “[t]he text I was going to use for Brittney and Brittany,” but, in context, it appears the author is using the word “text” to refer to the written word and not a mode of communication. Plaintiff, moreover, seems to agree and relied solely on the reference in the email to “a future text message conversation.” Dkt. 31-1 at 28.

In a similar vein, Plaintiff also points to several records that he says “refer to” and discuss “written correspondence” and “complaints filed” that “would have been responsive” to his requests but were not disclosed to him. Dkt. 31-1 at 28–29 (citing Dkt. 31-2 at 44–50, 56–68). For example, Plaintiff attests that “CMS produced emails referencing complaints 19TRA01238 and 19TRA01239 involving Allegiance, Cerner, and Zelis but no records related to these complaints[,] which would be responsive to [the May 15 FOIA] request and [the May 7 FOIA] request[,] were released.” Dkt. 31-2 at 4 (Shteynshlyuger Decl. ¶ 22a); see Dkt. 31-2 at 46 (“[W]e filed a CMS complaint for Allegiance (19TRA01238) and Cerner (19TRA01239) in August and November of 2019” regarding “HIPAA 835/EFT/ACH free model.”). Plaintiff suggests that it was both “clear and certain” that the documents referenced in these records would have been responsive to his requests and therefore the agency should have searched for them.

The problem the Court encounters in considering this argument, though, is that on the present record it cannot discern which of CMS’s searches revealed these records, and without that information, the Court cannot resolve this aspect of the parties’ dispute. If the search that identified the email referring to these two specific complaints was not a search CMS conducted to respond to Plaintiff’s May 7 or May 15 FOIA requests, for example, the Court could not conclude that it was “clear and certain” that the complaints referenced in the emails would have been responsive to Plaintiff’s FOIA request. After all, an agency, when responding to a FOIA request, is obligated only to follow clear or certain leads that are responsive to the request at issue—not other requests that the same requester may have submitted. Here, Plaintiff has failed to tie the records that contain the leads the he claims CMS failed to pursue to the FOIA requests to which those records were arguably responsive.

This difficulty does not mean that Plaintiff’s evidence that other, responsive records might exist carries no weight; to the contrary, it means only that Plaintiff has failed to show that CMS failed to follow up on “clear and certain” leads in conducting searches in response to specific FOIA requests. But this distinction merely affects the standard under which the Court considers this evidence. The evidence is still relevant to Plaintiff’s overarching challenge to the adequacy of CMS’s searches and, in particular, to the question whether significant omissions in the results of CMS’s searches casts doubt on the adequacy of those searches. Accordingly, the Court considers what weight to give CMS’s failure to identify these specific records in its searches alongside Plaintiff’s similar arguments, which are addressed below. See supra Section IV.B.3.c; see also DaVita Inc. v. U.S. Dep’t of Health & Hum. Servs., No. CV 20-1798, 2021 WL 980895, at *7 (D.D.C. Mar. 16, 2021) (“When a plaintiff identifies documents not found by the agency, the agency must ‘explain those holes in the record,’ such that the Court is “able to ascertain if [the agency] has explained the . . . absence’ of the responsive records from the results of the search.’” (first quoting Ctr. for Biological Diversity v. Bureau of Land Mgmt., No. CV 17-1208, 2021 WL 918204, at *8 (D.D.C. Mar. 9, 2021), then quoting Morley, 508 F.3d at 1121))).

2. Pages identified but neither released nor withheld by CMS

Plaintiff fares better in his challenge to the sufficiency of CMS’s description of the searches it undertook. Plaintiff contends that, at a minimum, the declaration CMS has submitted is insufficient because it fails to account for approximately 3,272 pages that the agency reports to have identified as responsive but has neither withheld nor released. Although this is not a challenge to the sufficiency of the searches, the Court agrees with Plaintiff that the agency’s declarations raise significant, unanswered concerns about what CMS did—and what it did not do—in responding to his FOIA requests. The Gilmore declaration states that CMS “reviewed *28 and processed approximately 7,100 pages of records in response to Plaintiff’s FOIA requests, and made three responses to Plaintiff.” Dkt. 28-3 at 49 (Gilmore Decl. ¶ 122). But CMS’s description of the records withheld or released in each of those three productions only account for 3,828 pages of records. Although Plaintiff squarely raises this concern in his cross-motion for summary judgment, CMS offers no response in its opposition brief.

For the first production, released on April 18, 2020, CMS “identified, and then reviewed and processed approximately twenty-eight pages of records.” Dkt. 28-3 at 16 (Gilmore Decl. ¶ 40). (Although, as noted above, CMS also states that it “release[ed] 28 pages, and with[eld] nine pages” in that same production, suggesting that the agency located 37, not 28, pages of responsive records, id.) For the next production, released on January 14, 2021, “CMS processed approximately 466 pages.” Id. at 45 (Gilmore Decl. ¶ 116). That production contained 120 new pages, 52 pages that were duplicates, 144 pages withheld in part and 149 pages withheld in full. Id. (The Court notes that the pages described total 465 pages, not 466.) The final production, released on January 26, 2021, contained “1,971 pages in full, 133 pages in part, and withheld 1,231 pages entirely,” which totals 3,335 pages. Id. at 36 (Gilmore Decl. ¶ 89).

These three productions describe 3,828 pages (or 3,838 pages if the April 18 production identified 37 pages and if the January 14 production identified 466 pages). That is far short of the 7,100 of pages that the declaration states that CMS “reviewed and processed.” Id. at 49 (Gilmore Decl. ¶ 122). This might simply be an error on CMS’s part or perhaps the declarant only meant that its initial responsiveness review included 7,100 pages. But, if so, CMS could easily have defused the issue in its opposition brief. As things stand, the disparity raises “substantial doubt” as to the completeness of the declaration that CMS provided. Valencia– Lucena, 180 F.3d at 325.

3. Reasonably tailored search

Plaintiff next argues that CMS failed to “ma[k]e a good faith effort,” as it must, “to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested.” Oglesby, 920 F.2d at 68. In support of his contention that the agency failed to do so, Plaintiff challenges both the search terms used and the locations searched. See Dkt. 31-1 at 23. Because the Court agrees that there is “substantial doubt” as to the adequacy of the searches conducted for several of Plaintiff’s requests, Valencia-Lucena, 180 F.3d at 325, the Court denies CMS summary judgment on this issue and will grants summary judgment in Plaintiff’s favor with respect to the adequacy of the searches.

a. Search terms

The Court first considers the reasonableness of the search terms CMS used. Dkt. 31-1 at 24. “There is no bright-line rule requiring agencies to use the search terms proposed” by a plaintiff. Physicians for Hum. Rts. v. U.S. Dep’t of Def., 675 F. Supp. 2d 149, 164 (D.D.C. 2009). Nor is an agency required to “deploy every conceivable search term” when responding to a FOIA request. Canning v. U.S. Dep’t of State, 346 F. Supp. 3d 1, 14 (D.D.C. 2018) (citing Agility Pub. Warehousing Co. K.S.C. v. NSA, 113 F. Supp. 3d 313, 339 (D.D.C. 2015)). Agencies “have discretion in crafting a list of search terms that ‘they believe[] to be reasonably tailored to uncover documents responsive to the FOIA request.’” Liberation Newspaper, 80 F. Supp. 3d at 146 (alteration in original) (quoting Physicians for Hum. Rts., 675 F. Supp. 2d at 164); see also Johnson v. Exec. Off. for U.S. Att’ys, 310 F.3d 771, 776 (D.C. Cir. 2002) (“FOIA, requiring as it does both systemic and case-specific exercises of discretion and administrative judgment and expertise, is hardly an area in which the courts should attempt to micro manage the executive branch.”).

But that discretion has limits—limits that are essential to the faithful implementation of the FOIA. As Judge Cooper has aptly observed, “FOIA requests are not a game of Battleship:” “[t]he requester should not have to score a direct hit on the records sought based on the precise phrasing of his request.” Gov’t Accountability Project v. U.S. Dep’t of Homeland Sec., 335 F. Supp. 3d 7, 12 (D.D.C. 2018). Rather, agencies are required to use “obvious synonyms” that are reasonably likely to lead to responsive documents, or at least, to explain why such obvious synonyms would not be reasonable in that situation. See, e.g., id. at 11–12 (“Searching only for the word ‘cellphone’ is inadequate; variants that may well be used in correspondence—like the two-word version ‘cell phone’ or simply ‘phone’—must also be included.”); Bagwell v. U.S. Dep’t of Justice, 311 F. Supp. 3d 223, 230 (D.D.C. 2018) (“Because it is likely that emails concerning the investigation would use ‘PSU’ or ‘Penn State’ rather than the full name of the University, the Department’s search was not reasonably calculated to find all responsive emails.”).

Here, Plaintiff contends that the search terms CMS used were not reasonably tailored to identify all responsive records because the agency often searched only for abbreviated terms pertaining to Plaintiff’s requests (such as “FAQ,” but not “frequently asked question,” and “EFT,” but not “electronic funds transfer”) and often “mechanical[ly] cop[ied]” phrases from his requests (such as “Julie E. Nolan of AKIN GUMP STRAUSS HAUER & FELD,” but not “Julie Nolan” or “Nolan AND Akin”). Dkt. 31-1 at 24–25. Plaintiff argues that, to the extent CMS merely searched for the exact words or phrases that Plaintiff used in his FOIA requests, without even considering what words or phrases were, in fact, likely to appear in response records, it almost certainly failed to identify responsive records. Id.

CMS responds that if it had used Plaintiff’s proposed keywords, the searches would have “yield[ed] . . . [an] overbroad” swath of potentially responsive records that the agency would have to review. Dkt. 28-3 at 8 (Gilmore Decl. ¶ 23). Taking the “FAQ” search term as an example, CMS explains that “the search term ‘22281’ rather than ‘FAQ 22281’” “is more efficiently tailored” “because the search term ‘FAQ 22281’ would include information on not only all ‘FAQ’ that are related to ‘22281,’ which is what Plaintiff wants, but also all ‘FAQ’ that are not related to ‘22281.’” Id. (Gilmore Decl. ¶ 23). Extending that logic to the “FAQ”-abbreviation issue Plaintiff raises, a search of CMS systems using the keyword “frequently asked questions” would—according to CMS—return all documents relating to the words “frequently,” “asked,” and “questions.” Such a search, CMS suggests, would again produce too many potentially responsive records to be useful or reasonable.

The Court, however, is unconvinced that any limitations on CMS’s search function precluded (or should have precluded) the agency from conducting a more thorough search. A FOIA request for “all records” relating to “CMS EFT FAQ22297,” should have included a search for records containing the terms “EFT” or “electronic funds transfer” and “FAQ” or “frequently asked question,” subject to five-year search limitation. Although CMS suggests that a search for phrases like “frequently asked question” would generate hits for each of the separate terms, it seems implausible that CMS is unable to search for phrases; it appears that CMS has the functionality to search for one term “and” another (i.e., a Boolean search)—within at least its SWIFT and ASETT databases as it used “fees and/or costs” as a viable search term in response to Plaintiff’s May 4, FOIA request. See id. at 14–15 (Gilmore Decl. ¶¶ 37, 39). And, to the extent the agency lacks the ability to search for phrases or conjunctions, that, too, would seem problematic, given the widespread availability of technology that allows for far more *32 sophisticated searches than this. See id. at 8 (Gilmore Decl. ¶ 23). Nor is the Court is persuaded that the agency’s use of the number associated with the FAQs at issue—e.g., “2221” or “22297”—obviated the need to employ other search terms. It seems unlikely that all drafts and correspondence that preceded the issuance of the final FAQs carried one of these designations. 2 The Court, accordingly, concludes that a search as limited as CMS describes was not reasonably calculated to locate the entire universe of responsive records. In any event, it was CMS’s burden to demonstrate that its search was reasonably calculated to do so, see Oglesby, 920 F.2d at 68, and it has failed to carry that burden.

Moreover, this concern with CMS’s search terms applies to more than just the search the agency conducted in response to Plaintiff’s April 13 FOIA request for FAQs. The Court has the same concern with CMS’s reliance on “EFT” as a search term rather than “electronic funds transfer.” CMS, however, fails to take this issue on in any meaningful way, and, instead, merely relies on the argument it makes with respect to the search terms it used for the April 13 FOIA request about “FAQs.” See Dkt. 28-3. But, given the centrality of the phrases “EFT” and “electronic funds transfer” to Plaintiff’s FOIA requests—his April 13, May 4, May 6, and May 15 FOIA requests all explicitly asked for records about CMS’s regulation of EFTs—CMS must do more than it has to justify why it failed to the use of the full phrase that “EFT” abbreviates, “electronic funds transfer” (or even “electronic transfers”), in its searches.

Speculating that the use of this phrase might have resulted in an “overbroad” yield, without testing that hypothesis or offering a far more detailed explanation for why that is the case, will not suffice. In short, an agency may not conduct an underinclusive search based on

2 But, if the Court’s assumption is incorrect, it was CMS’s burden to offer competent evidence that such an unusual practice exists at the agency. It has not done so.

nothing more than the unexplained and conclusory assertion that a broader searcher might have been unduly burdensome. To the contrary, initial FOIA searches often locate a large number of documents, only some of which are ultimately deemed responsive or disclosable. When that happens, agencies typically work their way through the potentially responsive documents; use the responses they obtain to generate more precise searches; or engage in discussions with the FOIA requesters to see if they will agree to refine or narrow their requests in order to obtain the records they seek more expeditiously. Those efforts are, at times, burdensome. But what an agency may not do is unilaterally exclude reasonable search terms that are likely to locate records that might otherwise go undetected simply because a more robust search would take additional time and effort. See, e.g., Kwoka v. Internal Revenue Serv., No. 17-1157, 2018 WL 4681000, at *5 (D.D.C. Sept. 28, 2018) (“[T]he Court will not allow it to withhold the documents wholesale simply because it will (potentially) take 2,200 hours to review them for redactions.”).

The Court, accordingly, concludes that CMS should have utilized the obvious synonyms for the search terms provided, or at the very least explained why it was unnecessary to do so.

b. Locations searched

Plaintiff also challenges the adequacy of CMS’s search on the ground that the agency failed to search certain offices that were likely to have possessed responsive materials. See Dkt. 31-1 at 25. He makes three arguments in this regard: Two arguments pertain to the search CMS conducted for two specific FOIA requests, his May 6 request and his May 7 request. His third argument is broader and posits that because his requests sought “all records” pertaining to the topics he identified, including “correspondence,” it was unreasonable for CMS to have failed to search files in its Outlook email systems. All three arguments are persuasive.

Plaintiff first proposes that CMS should have, in response to his May 6 FOIA request for “[c]ommunications” between CMS and Congress, Dkt. 28-12 at 1, searched OIT, Dkt. 31-1 at 30. In support of this argument, Plaintiff points to records that he received in responses to a different FOIA request, which discuss inquiries OIT staff received from members of Congress about the removal of “FAQ #22281” and whether “billing companies [were] not allowed to charge fees for EFT transmittals.” Dkt. 32-1 at 82. He also points to another email exchange he received pursuant to a different FOIA request in which OIT staff discuss talking points “developed on EFT” that can be used to respond to the “external inquiries [that] have been receiv[ed] from legislators.” Id. at 86.

In response, CMS merely asserts that Plaintiff’s suggestion in his FOIA request that the agency search OIT records using the list of custodians he provided “did not . . . make sense and hence was not used” because “the best way to locate responsive records was to search incoming correspondence from Congressional members which . . . is tracked by the CMS Office of Legislative Affairs.” Dkt. 28-3 at 22 (Gilmore Decl. ¶ 52). But the question is not whether the agency searched the most likely places to maintain responsive records; the question is whether the agency searched all places where records were reasonably likely to be found. See Oglesby, 920 F.2d at 68; see also Am. Immigr. Council v. U.S. Dep’t of Homeland Sec., 21 F. Supp. 3d 60, 71 (D.D.C. 2014) (“[A] search is inadequate if it includes only those records ‘most likely to contain the information which had been requested’ because an ‘agency cannot limit its search to only one record system if there are others that are likely to turn up the information requested.’” (quoting Oglesby, 920 F.2d at 68)).

Next, Plaintiff argues that CMS limited its search to databases “related either to specific complaints (ASETT) or particular types of correspondence (SWIFT, Outlook, ASPEN),” without *35 searching for the “call logs” he specifically requested in his May 7 FOIA request. Dkt. 31-1 at 28; see also Dkt. 28-15 at 1 (May 7, 2020 request for “a log of phone calls between any number at CMS to and from (678) 350-3810, (908) 389-8966, and (908) 268-2229”). CMS provides no explanation for why it did not search for “call logs” or why the ASETT system, which it did search in response to this request, was likely to have such information. See, e.g., Prop. of the People, Inc. v. Off. of Mgmt. & Budget, 330 F. Supp. 3d 373, 378 (D.D.C. 2018) (“[The agency] later informed Plaintiffs that it does not maintain visitor logs or call logs, and thus, it possesses no records responsive to the first two categories of requested documents.”). Accordingly, the Court concludes that CMS’s search in response to this request was insufficient.

Finally, Plaintiff challenges CMS’s failure to search its Outlook email system in response to all but two of his FOIA requests. See Dkt. 28-3 at 14 (Gilmore Decl. ¶ 37) (explaining that in response to his May 4 request, NSG searched its Outlook system); id. at 23 (Gilmore Decl. ¶ 55) (explaining that in response to his May 6 request, the Office of Legislative Affairs searched its Outlook emails); Dkt. 41 at 5 (same). CMS defends this decision by explaining that its SWIFT system and ASETT system should encompass all external-facing communications responsive to his requests. The SWIFT “database contains copies of incoming correspondence to the CMS Administrator and leadership.” Dkt. 41 at 4. And, the ASETT system “used by the NSG to search for responsive records is covered by HITS,” Dkt. 28-3 at 32 (Gilmore Decl. ¶ 78), which contains “[i]nformation on complaint allegations, information gathered during the complaint’s investigation, findings, and results . . . , and correspondence related to the investigation,” Dkt. 41 at 4. But, as Plaintiff emphasizes, his requests were not limited to external communications. Rather, Plaintiff sought “all records” regarding the topics he identified. As he has shown, a search of Outlook might well has revealed records responsive to his request. Dkt. 31-1 at 6. *36 CMS offers no meaningful explanation for why internal discussions between its employees over email would either fall beyond the scope of Plaintiff’s FOIA requests or why those internal discussions would be replicated in the databases it has identified. See Dkt. 28-3; Dkt. 41. Accordingly, the Court agrees with Plaintiff that CMS should have searched the relevant Outlook systems for records responsive to his April 13, May 7, May 12, May 15, July 22, and July 27 FOIA requests.

c. Identification of specific records

The last issue the Court addresses concerning the adequacy of the searches CMS conducted relates to the agency’s identification of (or failure to identify) certain responsive records. Before turning to the substance of the parties’ respective arguments, it bears emphasis that “the adequacy of a FOIA search is generally determined not by the fruits of the search, but by the appropriateness of the methods used to carry out the search,” Iturralde, 315 F.3d at 315, although the “discovery of additional documents” might, at least on occasion, raise questions about the method used, Hodge v. FBI, 703 F.3d 575, 579 (D.C. Cir. 2013) (quoting Goland, 607 F.2d at 370). Here, although not alone sufficient to cast doubt on all the searches CMS conducted, the Court conclude that the weight of the documents CMS failed to identify bolsters Plaintiff’s arguments that the search terms used and the places searched were not reasonably calculated to discover all responsive materials.

With respect to the May 4 FOIA request in particular, CMS emphasizes that it was able to identify—in the locations it searched using its preferred terms—some records that were responsive to Plaintiff’s request. See Dkt. 28-3 at 20 (Gilmore Decl. ¶ 46). It argues that this demonstrates that the searches it conducted were reasonably calculated to find responsive materials. Id. (Gilmore Decl. ¶ 45). Specifically, CMS notes that the search OSORA conducted *37 of the SWIFT correspondence database in response to Plaintiff’s May 4 FOIA request that used the search terms “EFT,” “ERA,” “835,” “270/271,” and “fees and/or costs” located “records [that] contained the words ‘Akin Gump,’” which were records that Plaintiff sought. Id. at 15 (Gilmore Decl. ¶ 39). But, as explained, the results of a search do not dictate whether the search process was adequate. And, even more to the point, the fact that the terms used and databases searched found some responsive records does not absolve the agency’s obligation to conduct a search that was reasonably tailored to reveal all responsive materials. See Oglesby, 920 F.2d at 68. By way of analogy, many works of art can be found in the National Gallery, but that does not mean that a search of the National Gallery is reasonably calculated to locate all works of art.

Plaintiff, moreover, identifies documents that he contends the agency’s searches missed, supporting his contention that the agency’s search terms and search locations were incomplete. Dkt. 31-1 at 30. These include “emails [that] refer to written correspondence that was not produced,” and “records [that] discuss complaints filed against HIPAA-covered entities” that were not produced. Dkt. 31-1 at 29; see, e.g., Dkt. 31-2 at 45 (“[W]e filed a CMS complaint for Allegiance (19TRA01238) and Cerner (19TRA01239) in August and November of 2019” regarding “HIPAA 835/EFT/ACH free model”); id. at 6 (Shteynshlyuger Decl. ¶ 30) (stating that Plaintiff “filed a complaint through ASETT against Sterling Benefits involving Vpay” that CMS did not produce in response to his May 12 FOIA request for records pertaining to Vpay); id. at 77 (containing a letter from the Veterans Administration to Plaintiff responding to a FOIA request he submitted to that department stated that the VA had “submit[ted] complaint notifications to [CMS]” about Zelis). Thus, even if results were the measure of the adequacy of the search, CMS would be on weak footing—footing that is only shakier in light of the other defects Plaintiff has identified in CMS’s searches. See DaVita Inc., 2021 WL 980895, at *7 *38 (“[T]he question is not whether the agency can pinpoint the exact whereabouts of the missing documents, but whether the agency can show that its search is adequate despite its failure to retrieve known records.”).

In sum, Plaintiff has done enough—by identifying issues with the search terms used, the databases searched, and the completeness of the agency’s declarations—to “raise[] substantial doubt” as to the adequacy of the search. Valencia-Lucena, 180 F.3d at 326. CMS, in response, has done little to address those issues. The Court, accordingly, concludes that CMS failed to conduct an adequate search for potentially responsive records for any of Plaintiff’s eight requests. Each of the searches CMS conducted is flawed for one of the reasons Plaintiff has identified. Specifically, the Court concludes that the search terms CMS used to respond to Plaintiff’s April 13, May 4, May 6, and May 15 FOIA requests were not reasonably tailored to find all responsive materials. It also finds that CMS should have searched (or explained why it could not search) Outlook for records responsive to Plaintiff’s April 13, May 7, May 12, May 15, July 22, and July 27 FOIA requests. Finally, the Court concludes that CMS should have searched OIT for records responsive to Plaintiff’s May 6 FOIA request and that CMS should have searched for phone logs responsive to Plaintiff’s May 7 FOIA request. The Court will, accordingly, grant partial summary judgment in Plaintiff’s favor with respect to the adequacy of the searches.

On a separate note, the Court also finds that CMS has failed to address the whereabouts of the approximately 3,200 unaccounted for pages. The Court is hardly in a position to grant summary judgment in favor of CMS in the face of such uncertainty.

• • * *

The Court now turns from the adequacy of the search CMS conducted to the fruits of that search. CMS relies on three of FOIA’s exemptions, Exemptions 4, 5, and 6, to withhold several hundred pages of records from Plaintiff. Plaintiff has challenged CMS’s decision to do so on a number of grounds. The Court begins with the parties’ arguments regarding Exemption 4 and CMS’s decision to withhold three sets of records, in whole or in part, pursuant to that exemption. C. Exemption 4

Exemption 4 permits an agency to withhold “matters that are . . . trade secrets and commercial or financial information obtained from a person and privileged and confidential.” 5 U.S.C. § 552(a)(4). CMS does not argue that the information it has withheld constitutes trade secrets, but instead, submits that the information is “(1) commercial or financial, (2) obtained from a person, and (3) privileged or confidential,” Citizens for Resp. & Ethics in Wash., 58 F.4th at 1262 (quoting Pub. Citizen Health Rsch. Grp. v. FDA, 704 F.2d 1280, 1290 (D.C. Cir. 1983)), and that it is, therefore, subject to protection under Exemption 4. In considering these withholdings, the Court is mindful that “[t]he agency bears the burden to justify nondisclosure under any exemption it asserts” and that “[s]ummary judgment is warranted on the basis of agency affidavits [or declarations only] when the affidavits [or declarations] describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith.” Id. (first quoting U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991); then quoting Larson v. Dep’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009)).

In crafting Exemption 4, “Congress sought to shield from public release intrinsically valuable business information such as ‘business sales statistics, inventories, customer lists, and manufacturing processes.’” Id. at 1263 (quoting S. Rep. No. 89-813, at 9 (1965)). Accordingly, for information to be considered “commercial or financial” for purposes of Exemption 4, it “must be commercial ‘in and of itself’” and must “pertain[] to the exchange of goods or services or the making of a profit.” Id. (citation omitted). It follows that “not every bit of information submitted to the government by a commercial entity qualifies for protection under Exemption 4.” Pub. Citizen Health Rsch. Grp., 704 F.2d at 1290. Rather, “Exemption 4 paradigmatically applies to records that a business owner customarily keeps private because they ‘actually reveal basic commercial operations, such as sales statistics, profits and losses, and inventories, or [that] relate to the income-producing aspects of a business,’” Citizens for Resp. & Ethics in Wash., 58 F.4th at 1262 (alteration in original) (quoting Pub. Citizen Health Rsch. Grp., 704 F.2d at 1290), or to information in which the submitter has a “commercial interest,” id. (quoting Baker & Hostetler LLP v. U.S. Dep’t of Commerce, 473 F.3d 312, 319 (D.C. Cir. 2006)).

“Commercial information” must also be “confidential” to qualify for withholding under Exemption 4. 5 U.S.C. § 552(b)(4). For many years, the D.C. Circuit applied different tests to determine whether information was “confidential,” depending on whether the information was voluntarily or involuntarily disclosed to the agency. See AAR Airlift Grp., Inc. v. U.S. Transp. Command, 161 F. Supp. 3d 37, 42 (D.D.C. 2015) (citing Critical Mass Energy Project v. Nuclear Regulatory Comm’n, 975 F.2d 871, 879 (D.C. Cir. 1992) (en banc) (voluntary standard) and Nat’l Parks & Conservation Ass’n v. Morton, 498 F.2d 765, 770 (D.C. Cir. 1974) (involuntary standard)). But in Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356 (2019), the Supreme Court rejected this distinction and embraced one uniform meaning of *41 “confidential” for the purposes of Exemption 4, id. at 2364–65 (“[N]or . . . can we discern a persuasive reason to afford the same statutory term two such radically different constructions.” (emphasis omitted)).

In Argus Leader, the Court “considered two conditions that might be required for information provided to the government to be confidential within the meaning of Exemption 4: (1) that information is ‘customarily kept private, or at least closely held, by the person imparting it,’ and (2) that ‘the party receiving [the information] provides some assurance that it will remain secret.’” Citizens for Resp. & Ethics in Wash., 58 F.4th at 1269 (quoting Argus Leader, 139 S. Ct. at 2363). “The Court held that at least the first condition must be met, reasoning that ‘it is hard to see how information could be deemed confidential if its owner shares it freely.’” Id. (quoting Argus Leader, 139 S. Ct. at 2363). With those instructions, the D.C. Circuit now recognizes that “[o]rdinarily . . . , to justify Exemption 4 withholding, the government must at least demonstrate that the withheld information itself is ‘customarily and actually treated as private by its owner.’” Id. (quoting Argus Leader, 139 S. Ct. at 2363). Neither the Supreme Court nor the D.C. Circuit, however, has elaborated on what circumstances, if any, might implicate the second condition. See Gandhi v. Ctrs. for Medicare & Medicaid Servs., No. 21-2628, 2023 WL 2707879, at *3 (D.D.C. Mar. 30, 2023) (“As it stands, then, ‘[t]he current law of the D.C. Circuit . . . is that information is confidential under Exemption 4 if it is of a kind that would customarily not be released to the public by the person [or entity] from whom it was obtained.’” (quoting Renewable Fuels Ass’n v. EPA, 519 F. Supp. 3d 1, 12 (D.D.C. 2021))).

The analysis does not end there. Once an agency meets its burden of showing that Exemption 4 applies to the information at hand, it must also satisfy FOIA’s foreseeable-harm requirement. The foreseeable-harm requirement “impose[s] an independent and meaningful *42 burden on agencies.” Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th 350, 369 (D.C. Cir. 2021) (quoting Ctr. for Investigative Reporting v. U.S. Customs & Border Prot., 436 F. Supp. 3d 90, 106 (D.D.C. 2019))). It forecloses the withholding of material under FOIA unless the agency can establish that it is “reasonably foresee[able] that disclosure would harm an interest protected by [the] exemption.” 5 U.S.C. § 552(a)(8)(A)(i)(I).

1. May 12 FOIA request

CMS relied on Exemption 4 (as well as Exemption 6) to withhold seven pages in full that were responsive to Plaintiff’s May 12 FOIA request. Dkt. 28-3 at 31 (Gilmore Decl. ¶ 77). 3 The May 12 FOIA request sought “all records from January 1, 2015 to May 10, 2020” regarding complaints “involving Echo Health” and complaints “involving Vpay.” Id. at 26 (Gilmore Decl. ¶ 65). “Echo Health is an EFT payment processor” and both “Echo Health and Vpay participate in the Administrative Simplification process,” id. at 31 (Gilmore Decl. ¶¶ 74–75), which “streamlin[es] communication around billing and insurance related tasks, id. at 6–7 (Gilmore Decl. ¶ 20). 4 A search of ASETT, the CMS system that parties use to respond to complaints about non-compliance with the Administrative Simplification process, id. at 32 (Gilmore Decl. ¶ 78), located forty-six pages of responsive records, id. at 31 (Gilmore Decl. ¶ 76). CMS describes the records as “consist[ing] of the complaint,” which “deals with electronic funds transfer,” “CMS email exchanges with the complainant, the respondent company’s email to CMS

3 CMS’s briefing to the Court indicates that these pages are the ones described in its Vaughn index. Dkt. 28-4 at 17 (Bates No. CMS20391–397). 4 “The Administrative Simplification process aims to save time and money by streamlining communication around billing and insurance related tasks. All HIPAA covered entities (which include health care providers that transmit transactions electronically, health plans, and clearinghouses) must comply with the Administration Simplification process.” Id. at 6-7 (Gilmore Decl. ¶ 20).

about the complaint and any proposed resolution by the respondent company to CMS.” Id. at 32–33 (Gilmore Decl. ¶ 79). CMS withheld seven of those forty-six pages in full. Id. at 31 (Gilmore Decl. ¶ 77).

CMS contends that the information it withheld was “commercial or financial because the complaint dealt with electronic funds transfer[s] which relate to financial transactions.” Dkt. 28-1 at 17. Plaintiff does not dispute that “this might establish the commercial or financial status of some of the information,” but he does not agree that this statement is sufficient to “establish that status for all the information.” Dkt. 31-1 at 13. The Court agrees with Plaintiff.

To the extent information about electronic funds transfers, or “EFTs,” is analogous to “sales statistics, profits and losses, and inventories, or [other information] related to the income-producing aspects of a business,” that information would qualify as “business or financial information” for these purposes. See Citizens for Resp. & Ethics in Wash., 58 F.4th at 1263. Although CMS has provided the Court with no specific description of what “electronic funds transfers” are in this context, there is reason to believe (and Plaintiff does not argue otherwise) that information about EFTs would “relate to the income-producing aspects” of Echo Health’s business, id. at 1263 (alteration in original) (quoting Pub. Citizen Health Rsch. Grp., 704 F.2d at 1290), because Echo Health is an “EFT payment processor,” Dkt. 28-3 at 31 (Gilmore Decl. ¶ 74). It would thus seem that a “complaint [that] deal[t] with electronic funds transfer[s]” and that pertains to Echo Health’s business, Dkt. 28-3 at 33 (Gilmore Decl. ¶ 79), would contain information that is “commercial ‘in and of itself,’” and “pertain[] to the exchange of goods or services or the making of a profit,” Citizens for Resp. & Ethics in Wash., 58 F.4th at 1263 (quoting Nat’l Ass’n of Home Builders, 309 F.3d at 38). Similarly, other records related to that complaint might also logically contain some discussion of EFTs that might constitute *44 “commercial or financial information” or information in which the owner has a “commercial interest.” Id. at 1262–63 (first quoting 5 U.S.C. § 552 (b)(4); then quoting Baker & Hostetler LLP, 473 F.3d at 319).

But this line of reasoning supports only the conclusion that some portion of the forty-six pages that CMS identified as responsive to Plaintiff’s May 12 FOIA request likely contained commercial or financial information. We do not know if those portions containing such commercial or financial information are what was withheld, because CMS provides no meaningful description of the seven withheld pages. The declaration CMS provides describes the contents of the forty-six pages as a whole—explaining that those records “consist of the complaint,” which “deals with electronic funds transfer,” “CMS email exchanges with the complainant, the respondent company’s email to CMS about the complaint and any proposed resolution by the respondent company to CMS,” Dkt. 28-3 at 32–33 (Gilmore Decl. ¶ 79)—but CMS does not explain which of those records were withheld.

In describing the contents of what it actually withheld, CMS states that it “applied Exemption 4 of the FOIA to information that was supplied by individuals in complaints they had filed on behalf of their employer (which are not the Plaintiff) or to information that related to a respondent company’s exchanges with CMS about that complaint.” Dkt. 28-3 at 32 (Gilmore Decl. ¶ 79). That statement omits any description of the subject matter of the withheld information—let alone any indication whether that information related to EFTs, was for some other reason commercial or financial in nature, or was the type of information in which its owner had a “commercial interest.” See, e.g., Pub. Citizen Health Rsch. Grp., 704 F.2d at 1290 (finding that a firm’s data or reports on its commercial service or its product’s favorable or unfavorable attributes was commercial information).

CMS’s further statement that it “conducted a line-by-line review of the forty-six pages of records . . . and determined that some non-exempt, factual information within them could be segregated for release” does not change the Court’s conclusion. Dkt. 28-3 at 33 (Gilmore Decl. ¶ 80). Although it indicates that the agency conducted the required segregability analysis, the description offers no further description of the seven withheld pages. The Court is left to guess at the contents of the seven pages the agency chose to withhold, only knowing that the seven pages were part of the forty-six pages the agency identified that relate to a complaint that “deal[t] with” EFTs. Id. (Gilmore Decl. ¶ 79). The Court, accordingly, concludes that CMS has failed to satisfy its burden of showing that the information it withheld was commercial or financial in nature, such that Exemption 4 could apply.

CMS fares no better with respect to the confidentiality prong of Exemption 4. “To justify Exemption 4 withholding, the government must at least demonstrate that the withheld information itself is ‘customarily and actually treated as private by its owner.’” Citizens for Resp. & Ethics in Wash., 58 F.4th at 1269 (emphasis added) (quoting Argus Leader, 139 S. Ct. at 2366). CMS, however, says almost nothing about the owners of the information and, instead, attempts to satisfy its burden by showing that it—that is, the government—treats the information as private. That will not do. See, e.g., Occupational Safety & Health L. Project, PLLC v. U.S. Dep’t of Labor, No. 21-2028, 2022 WL 3444935, at *8 (D.D.C. Aug. 17, 2022) (“But the test here is not about general custom in the industry, nor by the government. Rather, the issue is how [the owner of the commercial information] customarily treats the information, not how its peers do.”).

It may be the case that “when CMS receives a complaint regarding an electronic transfer of transactions, CMS places information that is provided in the complaint in a CMS Privacy Act *46 System of Records named the Health Insurance Portability and Accountability Act System (HITS) Privacy Act System of Records” and that “during the investigative process of the complaint, the information is not disclosable pursuant to Section (k)(2) of the Privacy Act.” Dkt. 28-3 at 31–32 (Gilmore Decl. ¶ 78). It may also be the case that to submit a complaint or to respond to one, an entity uses the ASETT system, id. at 7 (Gilmore Decl. ¶ 21), and is “provided a PIN” to do so, id. at 32 (Gilmore Decl. ¶ 78), indicating that the web tool is “secure,” Dkt. 28-1 at 17. And, finally, it may be the case that the “complainant’s information” is “not customarily released to any individual or entity other than the complainant.” Dkt. 28-3 at 32 (Gilmore Decl. ¶ 78). But those facts principally go to whether CMS treated the information submitted as confidential (and perhaps whether CMS provided assurances to the owner of the information that it would remain confidential)—not whether the owner of the information “customarily and actually” treated the information as private. Argus Leader, 139 S. Ct. at 2366. At most, one might speculate that at least some owners of information who submit it to a secure site using a PIN hope to maintain the confidentiality of the information. But such speculation, without more, will not suffice. Indeed, it is equally plausible that the owner of the information contained in any specific complaint would support broad disclosure and used the secure site and PIN only because that is how CMS has designed the process.

More generally, the Court can only guess at how the owners of the withheld information might have treated it because CMS says so little about the owners (or types of owners) of the information, about whether the assertedly confidential information was submitted by an owner or by a third-party, about whether any such third-party owed a duty of confidentiality to the owner, and, most significantly, about the precise nature of the specific information that was withheld. *47 CMS, in short, has also failed to carry its burden of showing that the information it withheld was “confidential,” as required under Exemption 4.

2. May 15 FOIA request

CMS also invokes Exemption 4 to withhold records responsive to Plaintiff’s May 15 FOIA request. See Dkt. 28-3 at 36 (Gilmore Decl. ¶ 89). That request sought records relating to CMS’s “investigation of covered entities, including health plans, clearinghouses, and business associates charging fees to conduct standard transactions,” and, again, identified numerous “search keywords that” might assist CMS in its search, including “EFT Fee, ERA fee, standard transaction fee, virtual credit card, payment care, [and] prepaid card.” Dkt. 28-19 at 1. In response to this request, CMS “released 1,971 pages in full, 133 pages in part, and withheld 1,231 pages entirely pursuant to Exemptions 4, 5, and 6.” Dkt. 28-3 at 36 (Gilmore Decl. ¶ 89). CMS’s summary judgment briefing fails to address the application of Exemptions 4 to these withholdings, see Dkt. 28-1 at 15–17; Dkt. 41 at 6–7, relying instead on the argument (which the Court has rejected) that Plaintiff failed to exhaust his administrative remedies with respect to this request. Nor does CMS’s Vaughn index describe these records. See Dkt. 28-4. Although Plaintiff points to this omission in its motion, CMS offers no response in its briefs. See Dkt. 41 at 6–7. As result, the Court treats the issue as conceded with respect to the factual predicate for the withholding. See Winston & Strawn, LLP v. McLean, 843 F.3d 503, 506–08 (D.C. Cir. 2016). But even relying on the one paragraph in the Gilmore declaration that makes passing reference to the issue, see Dkt. 28-3 at 36–37 (Gilmore Decl. ¶ 90), the Court concludes that CMS has failed to carry its burden.

That single paragraph explains that Exemption 4 was applied “only . . . to information that related to records which had been supplied by complainants or respondents in conjunction *48 with complaints that were stored in the ASETT information system and were not Plaintiff’s complaints.” Id. at 36 (Gilmore Decl. ¶ 90). The declaration then explains that the records at issue “consisted of email exchanges with CMS and respondents, which was investigatory in nature, as well as of proposals[,] if any, that had been made by the business involved in the investigatory complaint to resolve that complaint.” Id. (Gilmore Decl. ¶ 90). Finally, it explains:

The information was commercial or financial because given that it related to information that business entities supply in filing or responding to complaints in the ASETT system, and contains information on financial [e]lectronic funds transfers or proposed corrective actions by the respondent to CMS, it is an investigatory process for which confidentiality is provided to both complainant and respondent. During the complaint process, the respondent is given a PIN access code to enter into the ASETT database to review and supply comments, rebuttal, replies, corrective actions. All of this is under the confidential, investigation process in the ASETT database. The information was obtained from a business entity because it was provided by entities like electronic funds transfer clearinghouses, who are generally known to be business entities. The information was privileged or confidential because during the complaint investigation, all information is exempt from disclosure even to the complainant pursuant to exemption (k)(2) of the Privacy Act. The information was also customarily and actually treated as private by its owners because the business reply is sent to CMS in a PIN protected secure ASETT system which is a Privacy Act System of Records.

Id. (Gilmore Decl. ¶ 90). But this barren (and less than pellucid) description of as many as 1,264 pages of records is insufficient to show that the withheld information was truly commercial or financial in nature or that the owners treated the information as confidential.

The fact that some of the information in the ASETT database “relates to information that business entities supply” tells the Court little about the subject matter of the withheld information or the extent to which some or all of it contains commercial or financial information. Nor has CMS done enough to show that the withheld material was confidential. The agency once again simply relies on its practices of keeping the information stored in the ASETT database confidential, rather than addressing whether the source of the information treated it as *49 confidential. For reasons discussed above, neither the fact that respondents were given PINs and that CMS treats the ASETT system as secure nor systems status under the Privacy Act, without more, is sufficient to show that the information was “customarily and actually” treated as confidential by its owner. Argus Leader, 139 S. Ct. at 2366.

Accordingly, even giving CMS the benefit of the doubt and considering this issue on the merits, it has failed to justify its withholding of these records under Exemption 4 as well.

3. January 14 production

Finally, CMS also invokes Exemption 4 to withhold 142 pages that were responsive to Plaintiff’s April 13, May 7, and July 29 FOIA requests. 5 Dkt. 28-3 at 45 (Gilmore Decl. ¶ 116). CMS explains that “Exemption 4 was applied [to these records] because businesses’ complaints or responses contained in the ASETT system are afforded business confidentiality” by CMS, the information withheld “concerns electronic fund transfers and is financial,” and “[t]he information was obtained from . . . entities like electronic fund clearing houses, who are generally known to be business entities.” 6 Id. at 45–46 (Gilmore Decl. ¶ 117).

For the reasons explained above, this description of the information CMS withheld is insufficient. At no point does the agency describe in reasonable detail the nature or contents of the records it withheld. Some or all of that material might constitute commercial or financial information. Some or all of it might have reflected actual electronic fund transfers. (All that

5 This production also included the seven pages responsive to Plaintiff’s May 12 request that were withheld in their entirety and discussed separately above. 6 CMS provides a limited Vaughn index, which appears to describe 12 of the 142 pages the agency withheld. Dkt. 28-4 at 17–18 (Bates Nos. CMS20401, CMS20427–36). The description the Vaughn index provides is also perfunctory and provides no more information than the declaration does. See e.g., id. (describing CMS20401 and CMS20427-36 as follows: “[T]he subject of the complaint is a business entity to which responses are submitted regarding the complaint” and “[s]uch responses are considered business confidential by the submitter”).

CMS says is that the information “concern[ed]” electronic fund transfers, id. (Gilmore Decl. ¶ 117), but that can be said of almost all of Plaintiff’s requests.) The owner or owners might have treated some or all of it as confidential. But the Court has no way to know. Accordingly, the Court must, once again, conclude that CMS has failed to satisfy its burden.

4. Foreseeable harm

As explained above, CMS has failed to make the required showings with respect to the applicability of Exemption 4 to any of the records it withheld on that ground. But even if it had cleared that hurdle, CMS’s arguments would still fail, because the agency wholly ignores the foreseeable-harm requirement of the FOIA. See 5 U.S.C. § 552(a)(8)(A)(i)(I); Reps. Comm. for Freedom of the Press, 3 F.4th at 369. CMS fails to devote a single sentence in its briefing or declarations to the anticipated consequences of disclosing the information it seeks to keep private pursuant to Exemption 4, see Dkt. 28-1 at 15–17; Dkt. 41 at 6–7—not even after Plaintiff identified that omission, see Dkt. 31-1 at 17, and not even in the supplemental declaration that CMS submitted addressing other omissions, including its failure to address foreseeable harm with respect to the agency’s Exemption 5 withholdings, see Dkt. 40-1.

The Court recognizes that few courts have considered what burden the foreseeable-harm requirement imposes on agencies that seek to withhold records pursuant to Exemption 4. See Seife v. U.S. Food & Drug Admin., 43 F.4th 231, 235 (2d Cir. 2022) (“Neither the Supreme Court nor . . . any of our sister circuits has had occasion to consider the burden imposed by the [foreseeable-harm requirement] in an Exemption 4 case.”). And relatedly, there is an open question as to the scope of the interest Exemption 4 seeks to protect. Compare Ctr. for Investigative Reporting, 436 F. Supp. 3d at 113 (concluding that, for the purposes of Exemption 4, those interests include avoiding causing “’genuine harm to [the submitter’s] *51 economic or business interests’ and thereby dissuading others from submitting similar information to the government”) (quoting Argus Leader, 139 S. Ct. at 2369), with Am. Small Bus. League v. U.S. Dep’t of Defense, 411 F. Supp. 3d 824, 836 (N.D. Cal. 2019) (“[T]he plain and ordinary meaning of Exemption 4 indicates that the relevant protected interest is that of the information’s confidentiality—that is, its private nature. Disclosure would necessarily destroy the private nature of the information, no matter the circumstance.” (emphasis omitted)). The Second Circuit’s decision in Seife v. U.S. Food & Drug Administration, 43 F.4th 231 (2d Cir. 2022), however, offers helpful guidance.

As the Seife decision persuasively explains, application of the foreseeable-harm standard to Exemption 4 requires a showing of “foreseeable commercial or financial harm to the submitter upon release of the contested information.” Id. at 242. To hold otherwise—and to require an agency merely to show that disclosure would be at odds with confidentiality—would render the foreseeable-harm requirement a nullity in all Exemption 4 cases, a result that cannot be squared with the congressional decision to exempt other FOIA exemptions from the requirement, but not Exemption 4. Id. at 239–40; see also Reps. Comm. for Freedom of the Press, 3 F.4th at 369 (“[T]he foreseeable harm requirement impose[s] an independent and meaningful burden on agencies.” (quotation omitted) (second alteration in original)); cf. Reps. Comm. for Freedom of the Press v. U.S. Customs & Border Prot., 567 F. Supp. 3d 97, 124 (D.D.C. 2021) (“True, . . . establishing the attorney-client privilege will go a long way to show the risk of foreseeable harm. But an agency must still provide a non-generalized explanation on the foreseeable harm that *52 would result from disclosure of attorney-client communications. [The agency] has barely provided any explanation at all.”). 7

Here, however, CMS makes no argument whatsoever that it has satisfied the foreseeable-harm requirement. Unless the foreseeable-harm requirement is a nullity as applied to Exemption 4, and as noted above, that contention cannot be squared with the statutory text, that omission is fatal to CMS’s position. D. Exemption 5

CMS also relies on FOIA’s Exemption 5 to withhold records from its three productions. Exemption 5 permits an agency to withhold or redact “inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency,” 5 U.S.C. § 552(b)(5), which courts have interpreted to encompass “the privileges available to [g]overnment [agencies] in civil litigation,” U.S. Fish & Wildlife Serv. v. Sierra Club, Inc., 141 S. Ct. 777, 783 (2021). Those privileges include the attorney-client privilege and the deliberative process privilege, both of which CMS invokes here, although, as explained below, the deliberative process privilege is the agency’s focus. See Coastal States Gas Corp. v. Dept. of Energy, 617 F.2d 854 (D.C. Cir. 1980) (citations omitted).

7 CMS might (generously) be understood to rely on the “very context and purpose of those communications” to meet its burden. Reps. Comm. for Freedom of the Press, 3 F.4th at 372 (“With respect to the [withheld] emails, the record establishes the unique sensitivity of discussions among Director Comey and high-ranking FBI officials about how to respond to an ongoing crisis that threatened existing covert Bureau operational tactics. The very context and purpose of those communications bearing on sensitive undercover operations in the midst of a policy crisis make the foreseeability of harm manifest.”). But even if the Court were to consider the argument, which the agency does not press, CMS would still fail to establish foreseeable harm. To rely on the “context and purpose” of the records to make a finding of harm, the Court would need to know what those communications contain; yet, as explained above, the present record lacks any such description.

The deliberative process privilege applies to “documents reflecting advisory opinions, recommendations and deliberations comprising part of a process by which governmental decisions and policies are formulated.” Dep’t of Interior v. Klamath Water Users Protective Ass’n, 532 U.S. 1, 8 (2001) (quoting N.L.R.B. v. Sears, Roebuck & Co., 421 U.S. 132, 150 (1975)) (internal quotation marks omitted). In order for the deliberative process privilege to apply, the record at issue must be both predecisional and deliberative. “Documents are ‘predecisional’ if they are ‘generated before the adoption of an agency policy,’ and ‘deliberative’ if they ‘reflect[ ] the give-and-take of the consultative process.’” Judicial Watch, Inc. v. U.S. Dep’t of Def., 847 F.3d 735, 739 (D.C. Cir. 2017) (alteration in original) (Public Citizen, Inc. v. Off. of Mgmt. & Budget, 598 F.3d 865, 874 (D.C. Cir. 2010)).

To invoke the privilege, an “agency must establish what deliberative process is involved, and the role played by the documents in issue in the course of that process.” 100Reporters v. U.S. Dep’t of State, 602 F. Supp. 3d 41, 60 (quoting Senate of P.R. ex rel. Judiciary Comm. v. U.S. Dep’t of Justice., 823 F.2d 574, 585–86 (D.C. Cir. 1987)). The agency must also explain “the nature of the decision[-]making authority vested in the office or person issuing the disputed document(s), and the positions in the chain of command of the parties to the documents.” Arthur Andersen & Co. v. IRS, 679 F.2d 254, 258 (D.C. Cir. 1982) (quoting Taxation with Representation Fund v. IRS, 646 F.2d 666, 679, 681 (D.C. Cir. 1981)). In other words, to determine if the agency has met its burden to show that it properly invoked the privilege, a court “asks whether the agency has offered evidence sufficient to establish the ‘who,’ i.e., the roles of the document drafters and recipients and their places in the chain of command; the ‘what,’ i.e., the nature of the withheld content; the ‘where,’ i.e., the stage within the broader deliberative process in which the withheld material operates; and the ‘how,’ i.e., the way in which the *54 withheld material facilitated agency deliberation.” Judicial Watch, Inc. v. Dep’t of Justice, 20 F.4th 49, 56 (D.C. Cir. 2021).

Finally, pursuant to the FOIA Improvement Act, the agency must also satisfy the foreseeable-harm requirement. See 5 U.S.C. § 552(a)(8)(A). This requirement “applies with special force to deliberative process withholdings under Exemption 5,” because “Congress viewed [this use of Exemption 5] as posing particular risks of ‘overuse.’” 100Reporters, 602 F. Supp. 3d at 61 (quoting Ctr. for Investigative Reporting, 436 F. Supp. 3d at 106). To satisfy the foreseeable-harm requirement, an agency must establish that it is reasonably foreseeable that “disclosure would harm an interest protected by the deliberative-process privilege,” Machado Amadis v. U.S. Dep’t of State, 971 F.3d 364, 371 (D.C. Cir. 2020)—that is, when Exemption 5 is invoked, that disclosure would cause “injury to the quality of agency decisions,” Sears, 421 U.S. at 151.

1. May 4 FOIA request

CMS seeks to withhold nine pages that were responsive to Plaintiff’s May 4 FOIA request pursuant to Exemptions 5 and 6. Dkt. 28-3 at 16 (Gilmore Decl. ¶ 40). The Gilmore declaration describes these records as containing “pre-decisional, deliberative communications from CMS personnel to CMS OSORA executive correspondence staff regarding correspondence from the American College of Gastroenterology,” and concerning “actions that were under consideration at CMS which related specifically to hurricane relief.” Id. at 17 (Gilmore Decl. ¶ 42). The declaration also states that the records contain “pre-decisional” “email exchanges between employees . . . address[ing] how to handle and debate the best route to take regarding further supporting email from [a law firm,] Akin Gump” and “[a]n additional email and executive correspondence [that] discussed a meeting with the CMS Administrator from the *55 Otsuka Pharmaceutical Group.” Id. at 18 (Gilmore Decl. ¶ 42). “The purpose of these internal exchanges was to discuss the concerns that CMS had regarding [the] provi[sion of] hurricane relief to [the American College of Gastroenterology].” Dkt. 40-1 at 2 (Suppl. Gilmore Decl. ¶ 5).

The agency argues that these records were deliberative because they “consisted of emails between employees of CMS discussing information that was contained in incoming correspondence from an exterior source, evaluating how the correspondence should be handled, . . . which operating division should be tracking this correspondence, whether that correspondence was a follow-up to a previous correspondence, and whether a single CMS response was warranted.” Dkt. 28-3 at 17–18 (Gilmore Decl. ¶ 42). And, the agency argues that the records to be predecisional because the material withheld “relates to CMS’[s] own internal electronic correspondence regarding the CMS reasons and context” for its decision about whether to provide the hurricane relief that was requested; rather than “the correspondence that CMS had with [the American College of Gastroenterology] regarding [its] request [for] the emergency hurricane relief waiver,” which CMS released to Plaintiff. Dkt. 40-1 at 4 (Suppl. Gilmore Decl. ¶ 8).

CMS has satisfied its burden of showing that these records are deliberative and predecisional. Internal agency communications that discuss and debate the best course of action to take in response to inquiries from the public often fall within the deliberative process privilege. See e.g., Odland v. FERC, 34 F. Supp. 3d 3, 20 (D.D.C. 2014) (approving of the agency’s application of the deliberative process privilege to emails containing “deliberations regarding the appropriate response to public inquiries and public attendance at meetings while the underlying proceeding was pending”). And here, CMS’s description of the records it *56 withheld shows that they were “deliberative in nature, weighing the pros and cons of agency adoption of one viewpoint or another.” Coastal States Gas Corp. v. Dep’t of Energy, 617 F.2d 854, 866 (D.C. Cir. 1980). Finally, CMS has done enough to show that the records were pre-decisional. By explaining that the final communications that CMS had with the American College of Gastroenterology were released, while those internal communications that preceded it were not, CMS has satisfied its burden of showing that the records containing the internal deliberations preceded any final decision. See 100Reporters, 602 F. Supp. 3d at 62 (explaining that to withhold a record under the deliberative process privilege, an agency need not “trace the lineage of each draft or evidently deliberative record to ensure that the agency did not, at some point, adopt the predecisional record,” but instead must “provide the Court with a reasoned and sound basis for concluding that the record at issue was—and remained—predecisional”).

Having concluded that the deliberative process privilege applies to the materials responsive to Plaintiff’s May 4 FOIA request that CMS withheld pursuant to Exemption 5, the Court must consider whether CMS has satisfied the foreseeable-harm requirement. In his original declaration, Gilmore observed that “[r]elease of this information would cause foreseeable harm . . . because it would create a chilling effect o[n] future employees’ discussions and block the free exchange of ideas, including ideas that could improve and streamline the efficient functioning of CMS.” Dkt. 28-3 at 18 (Gilmore Decl. ¶ 42). Standing alone, that articulation of foreseeable harm would be too “perfunctory” and would seem to apply to most, if not all, deliberative exchanges of information, “regardless of category or substance.” Reps. Comm. for Freedom of the Press, 3 F.4th at 370 (quoting Rosenberg v. Dep’t of Def., 342 F. Supp. 3d 62, 79 (D.D.C. 2018)). Presumably recognizing as much, CMS submitted a *57 supplemental declaration, further explaining the foreseeable harm that disclosure would entail. See Dkt. 40-1.

That supplemental declaration poses its own difficulties. To the extent it expresses concern, for example, that disclosure of the deliberations might expose individual employees to external pressure, see id. at 6 (Supp. Gilmore Decl. ¶ 11), CMS could simply redact the names of those employees. The agency comes closer to the mark, however, when it observes that release of the records would reveal the “internal decisional process” that the agency employs to evaluate hurricane relief waivers, such as “the criteria CMS uses to determine hardship, how CMS gathers information on . . . eligible clinicians’ need to benefit from an emergency waiver, . . . [and] how CMS assesses alternative resolutions to emergency relief.” Id. at 4 (Suppl. Gilmore Decl. ¶ 9). This would be harmful, CMS explains, because entities would have “a roadmap” to “know exactly what [they] need[] to do to obtain a hurricane emergency waiver,” which could undermine the ability of the agency to make the right decision when it comes to whether to grant relief. Id. at 4–5 (Suppl. Gilmore Decl. ¶ 9). Although the Gilmore declaration does not explicitly tie this “roadmap” justification to “an interest protected by” Exemption 5, see 5 U.S.C. §552(a)(8)(A), the Court concludes that the supplemental declaration must be read in light of Gilmore’s prior assertion that release of the information would create a chilling effect on internal deliberations by future employees, see Dkt. 28-3 at 18 (Gilmore Decl. ¶ 42). The supplemental declaration introduces its discussion of foreseeable harm, for example, by noting that it is providing additional background “[t]o better understand the foreseeable harm” that would result from the disclosure of these documents. Dkt. 40-1 at 2 (Suppl. Gilmore Decl. ¶6). And, taken together, Gilmore’s declarations are best, albeit not unambiguously, read to say that providing the public with “a roadmap” detailing “exactly” how “to obtain a hurricane emergency waiver” *58 would chill employees from committing similar deliberations to written form in the future. See id. at 5 (Suppl. Gilmore Decl. ¶ 9).

Understood in this light, the agency’s foreseeable harm analysis passes muster. See Reps. Comm. for Freedom of the Press, 3 F.4th at 370. It is a “focused and concrete demonstration of why disclosure of the particular type of material at issue,” namely internal discussions about whether to grant relief to this particular group in light of the hardship it experienced due to a natural disaster, “will, in the specific context of the agency action at issue, actually impede those same agency deliberations going forward.” Id. This showing is sufficient to satisfy the agency’s burden to demonstrate that harm will foreseeably result from the disclosure of these documents. Accordingly, although a closer question than it should be, the Court is persuaded that CMS has satisfied its burden to show that its properly withheld portions of these records pursuant to Exemption 5.

2. May 15 FOIA request and the January 14 production

CMS also invokes the deliberative process privilege to withhold some or all of the 1,508 pages it identified as responsive to Plaintiff’s April 13, May 7, May 12, May 15, and July 29 FOIA requests. Dkt. 28-3 at 36, 45 (Gilmore Decl. ¶¶ 89, 116). These materials “all concern draft information related to sub-regulatory guidance, EFT/FAQs, a draft memo on EFT revision, and drafts of responses to Plaintiff.” Dkt. 40-1 at 8 (Suppl. Gilmore Decl. ¶ 13).

Unfortunately, CMS’s description of the contents of the material withheld includes little detail beyond this vague statement. The agency does describe some of the withheld materials as including “emails that discussed the past EFT/FAQs, modified the current FAQs, discussed whether to discontinue the FAQs or a particular FAQs, discussed wording changes, discussed justifications for the changes, discussed why CMS was not going in a particular direction with *59 the EFT/FAQs, or suggested that something may have been too broadly described, and needed to be more narrowly described.” Dkt. 40-1 at 9–10 (Suppl. Gilmore Decl. ¶ 15). But it does not identify which description applies to which documents, or even how many pages it withheld pursuant to that description. Nor does CMS explain why each of these records was predecisional and deliberative, beyond the high-level assertion that the withheld materials “consisted of edits and comments on draft documents,” Dkt. 28-3 at 38 (Gilmore Decl. ¶ 92), and “opinions and recommendations of CMS staff,” id. at 47 (Gilmore Decl. ¶ 118). That is insufficient.

“An agency must demonstrate that ‘each document that falls within the class requested either has been produced . . . or is wholly [or partially] exempt from the Act’s inspection requirements.’” Citizens For Resp. & Ethics in Wash. v. U.S. Dep’t of Lab., 478 F. Supp. 2d 77, 80 (D.D.C. 2007) (alteration in original) (emphasis added) (quoting Goland v. CIA, 607 F.2d 339, 352 (D.C. Cir. 1978)). Although agencies “have never [been] required [to provide] repetitive, detailed explanations for each piece of withheld information,” and “codes and categories may be sufficiently particularized to carry the agency’s burden of proof,” when an agency seeks to take a more categorical approach, it must “tie[] each individual document to one or more exemptions, and . . . [must provide a] declaration [that] link[s] the substance of each exemption to the documents’ common elements.” Morley, 508 F.3d at 1122 (quoting Judicial Watch, Inc. v. Food & Drug Administration, 449 F.3d 141, 146–47 (D.C. Cir. 2006)). CMS’s submissions fail that test. The Vaughn index it provides is not only perfunctory in its description of the documents, it also entirely fails to account for hundreds of pages that the agency withheld. See Dkt. 28-4. And the declarations CMS provides fail to address specific records (or groups of records) and fail to reference specific entries in the Vaughn index, making it nearly impossible to *60 determine which documents in the Vaughn index are the ones discussed in the agency’s declarations. See Dkt. 28-3; Dkt. 40-1.

The Court, accordingly, concludes that CMS has failed to carry its burden with respect to application of Exemption 5 to these records. As a result, the Court need not consider the separation question of foreseeable harm. For future guidance, however, the Court cautions CMS that it must focus its foreseeable-harm inquiry on whether disclosure of the information at issue would result in harm to the agency’s decision-making process; not whether the individual requester is likely to use the released materials in a way that the agency would rather avoid.

3. Attorney-client privilege

Although not the focus of either party’s briefing, the Court notes that the agency’s Vaughn index states that CMS seeks to withhold some material on the basis of attorney-client privilege. See Dkt. 28-4 at 5, 6, 9, 11–12 (Bates Nos. CMS20064–75, CMS20108–111, CMS20153–154, CMS20170–171, CMS20194–202). To the extent CMS does, in fact, seek to withhold certain material on this basis, the Court notes that the agency’s explanation of why that privilege applies is too cursory for the Court to assess that claim. For example, CMS withholds five pages in full pursuant to Exemption 5, explaining, in part, that “[t]he Office of General Counsel is supplying comments about the draft, clarification about the draft, and comments and recommendations which is attorney-client privilege[d].” Id. at 5 (Bates No. CMS20064–75). This generic description does not allow the Court to determine whether the withheld material constitutes “confidential communications between an attorney and his client relating to a legal matter for which the client has sought professional advice.” Protect Democracy Project, Inc. v. U.S. Dep’t of Health & Hum. Servs., 370 F. Supp. 3d 159, 173 (D.D.C. 2019) (quoting Mead Data Cent., Inc. v. U.S. Dep’t of Air Force, 566 F.2d 242, 252 (D.C. Cir. 1977)). To take just *61 one example, stylistic suggestions (“don’t split your infinitives”), even if offered by a lawyer, are not necessarily privileged.

Therefore, to the extent CMS did in fact rely on the attorney-client privilege to withhold some of the materials at issue, the Court is unpersuaded that the agency has satisfied its burden. E. Exemption 6

The final FOIA exemption CMS invokes is Exemption 6. “Exemption 6 provides that the disclosure requirements of the FOIA do not apply to ‘personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.’” U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 597 n.1 (1982) (quoting 5 U.S.C. § 552(b)(6)). CMS invokes this exemption to withhold individuals’ contact information, including phone numbers and email addresses, Dkt. 28-3 at 18–19 (Gilmore Decl. ¶ 43); see also id. at 38 , 48 (Gilmore Decl. ¶¶ 93, 119), and also applies the exemption to “records [that] were located in the ASETT system[,] which is a Privacy Act [s]ystem of records,” id. at 33 (Gilmore Decl. ¶ 81). Plaintiff does not challenge the agency’s application of the exemption to contact information. But he does maintain that CMS was wrong to apply Exemption 6 to the second category of records. See Dkt. 31-1 at 22. 8

The purpose of Exemption 6 is “to protect individuals from the injury and embarrassment that can result from the unnecessary disclosure of personal information.” Multi Ag Media LLC v.

8 The Gilmore declaration states that its search in response to Plaintiff’s April 13 FOIA request identified “fifteen pages had portions redacted pursuant to Exemption 6 of the FOIA.” Dkt. 28-3 at 10 (Gilmore Decl. ¶ 28). These pages were not immediately released to Plaintiff due to an error on CMS’s part, but were instead released as part of the January 14 production. The Court understands that the description of the records withheld pursuant to Exemption 6 in the January 14 production includes these fifteen pages identified as responsive to Plaintiff’s April 13 request, and that those pages are not challenged by Plaintiff in this litigation because they contained contact information. Id. at 48 (Gilmore Decl. ¶ 119).

Dep’t of Agric., 515 F.3d 1224, 1228 (D.C. Cir. 2008) (emphasis omitted) (quoting Wash. Post Co., 456 U.S. at 599). Accordingly, Exemption 6 is not limited “‘to a narrow class of files containing only a discrete kind of personal information’ (such as tax or medical records),” but, rather, it “cover[s] detailed Government records on an individual which can be identified as applying to that individual.” Scarlett v. Off. of Inspector Gen., No. 21-819, 2023 WL 2682259, at *9–10 (D.D.C. Mar. 29, 2023) (quoting Wash. Post Co., 456 U.S. at 602).

That said, “the mere fact that an agency file or record contains personal, identifying information is not enough to invoke Exemption 6—the information must also be ‘of such a nature that its disclosure would constitute a clearly unwarranted privacy invasion.’” Id. (quoting Nat’l Ass’n of Home Builders, 309 F.3d at 32). To make that determination, “the Court [must] employ[ ] a balancing test, weighing ‘the private interest involved (namely the individual's right of privacy) against the public interest (namely, the basic purpose of [FOIA], which is to open agency action to the light of public scrutiny).’” People for the Am. Way Found. v. Nat’l Park Serv., 503 F. Supp. 2d 284, 304 (D.D.C. 2007) (quoting Judicial Watch, Inc., 449 F.3d at 153). “In undertaking this analysis, the [C]ourt is guided by the instruction that, under Exemption 6, the presumption in favor of disclosure is as strong as can be found anywhere in [FOIA].” Nat’l Ass’n of Home Builders, 309 F.3d at 32 (quoting Wash. Post Co. v. U.S. Dep’t of Health & Hum. Servs., 690 F.2d 252, 261 (D.C. Cir. 1982)).

CMS contends that because the records at issue “were located in the ASETT system[,] which is a Privacy Act [s]ystem of records,” the records are “similar” to “personnel and medical files” and thus fall within the scope of Exemption 6. Dkt. 28-3 at 33–34 (Gilmore Decl. ¶ 81) (quoting 5 U.S.C. §552(b)(6)). As further context, CMS explains that:

when CMS receives a complaint regarding electronic transfer of transactions, CMS places information that is provided in that complaint in a CMS Privacy

Act System of Records named the Health Insurance Portability and Accountability Act System (HITS) Privacy Act System of Records [of which ASETT is a part]. HITS collects and maintains information on complaint allegations, information gathered during the complaint’s investigation, findings, and results of the investigation, and correspondence related to the investigation. The collected information will contain name, address, telephone number, health insurance claim (HIC) number, geographic location, as well as, background information which relate to the Medicare or Medicaid issues of the complainant. HITS represents a single, central, electronic repository of all complaints’ documents and information including related investigative files, correspondence, and administrative records. This information system is known as an exempt system of records because during the investigative process of the complaint, the information is not disclosable pursuant to Section (k)(2) of the Privacy Act.

Id. at 31–32 (Gilmore Decl. ¶ 78). CMS thus seems to argue that because a record is found in ASETT and because ASETT is a Privacy Act system of records, any information contained in ASETT that was obtained from a “business submitter” is per se subject to Exemption 6. See id. at 33 (Gilmore Decl. ¶ 81). That contention is problematic on several fronts.

First, CMS contends that, as a general matter, it would be improper to disclose any complaint (or associated document) from its ASETT system because doing so “would constitute an unwarranted invasion of privacy and violate the business confidentiality of the business submitter, who is the respondent to the complaint.” Id. at 33 (Gilmore Decl. ¶ 81). But Exemption 6 is not concerned with the confidentiality interests of corporations. See FCC v. AT&T Inc., 562 U.S. 397, 408–10 (2011) (suggesting that the scope of Exemption 6 and Exemption 7(C) should be understood to mirror one another, that Exemption 6 “involve[s] an ‘individual’s right of privacy,’” and that it “reject[s] the argument that . . . the phrase ‘personal privacy’ in Exemption 7(C) reaches corporations as well” (quoting Ray, 502 U.S. at 175). And CMS does not indicate whether the “business submitter[s]” it seeks to protect are corporations or individuals. Dkt. 28-3 at 33 (Gilmore Decl. ¶ 81). Indeed, if anything, CMS suggests that the submitters are corporations by emphasizing that much of the information contained in its ASETT *64 system was “obtained from [] business entit[ies], . . . like electronic fund clearing houses.” Id. at 45–46 (Gilmore Decl. ¶ 117).

Even beyond that dispositive difficulty, in applying Exemption 6, the presumption is in favor of disclosure, and, here, CMS had not done enough to shift the balance in the opposite direction. It has failed to identify the privacy interest of the submitters and has failed to explain how disclosure would “constitute a clearly unwarranted” invasion of that unspecified interest. 5 U.S.C. §552(b)(6).

Accordingly, as the record now stands, CMS has failed to justify its withholdings pursuant to Exemption 6. F. Segregability

Although the Court concludes that many of CMS’s withholdings are inadequately supported, as explained above, it is persuaded that CMS has carried its burden of showing that the deliberative process privilege applies to a portion of the withheld material and that foreseeable harm would result from the disclosure of that material. But “[b]efore approving the application of a FOIA exemption, the district court must make specific findings of segregability regarding the documents to be withheld.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1116 (D.C. Cir. 2007) (first citing Summers v. DOJ, 140 F.3d 1077, 1081 (D.C. Cir. 1998); then citing Krikorian v. Dep’t of State, 984 F.2d 461, 467 (D.C. Cir. 1993)); see also Muttitt v. Dep’t of State, 926 F. Supp. 2d 284, 309 (D.D.C. 2013) (“Even when a plaintiff does not challenge the segregability efforts of an agency, the Court has an affirmative duty to consider the segregability issue sua sponte.” (quotation omitted)). Specifically, the Court must determine whether “‘[a]ny reasonably segregable portion of a record shall be provided’ after exempt portions are deleted.” Sussman, 494 F.3dat 1112 (quoting 5 U.S.C. § 552(b)(1)(9)). Here, that requirement precludes *65 the Court from granting summary judgment in favor of CMS even with respect to that portion of the withheld material.

To be sure, CMS attests that it “conducted a line-by-line review of the twenty-eight pages of records returned in the searches [for records responsive to the May 4 FOIA request] and determined that some non-exempt, factual information within them could be segregated for release,” Dkt. 28-3 at 18 (Gilmore Decl. ¶ 42). The problem is that “the Court need not [and ought not] blindly accept an agency’s conclusory assurance that it has taken reasonable steps to segregate information if the record suggests otherwise or the Vaughn index and declarations are not sufficiently detailed to permit the Court to meaningfully assess whether further segregability is possible,” Protect Democracy Project, Inc. v. U.S. Dep’t of Health & Hum. Servs., 569 F. Supp. 3d 25, 36 (D.D.C. 2021). Here, neither the Vaughn index nor the declarations CMS has provided are sufficient to show that the agency has met its segregability burden. Most notably, CMS states that it is withholding “nine pages pursuant to Exemptions 5 and 6” responsive to the May 4 FOIA request, id. at 16 (Gilmore Decl. ¶ 40), but it does not explain which withholdings are subject to which exemption or which of the entries in its Vaughn index corresponds to these records. Without having that basic understanding of what the government has withheld, the Court cannot determine if the records it withheld can be segregated.

As a result, the Court will defer making a final decision with respect to segregability until the record is complete and the universe of potentially responsive records is settled. See, e.g., Zynovieva v. U.S. Dep’t of State, No. 19-3445, 2021 WL 3472628, at *8 (D.D.C. Aug. 5, 2021). G. Disposition

For the reasons explained above, the Court agrees with many, although not all, of the arguments that Plaintiff has raised—both in opposition to CMS’s motion for summary judgment *66 and in support of his cross-motion. Anticipating this result, Plaintiffs asks that the Court to grant summary judgment in his favor (in whole or in part) and to preclude CMS from engaging in the type of iterative summary judgment practice that has become all too common in FOIA litigation. As Plaintiff stresses, Federal Rule of Civil Procedure “56(e) does not require the Court to give the agency another bite at the apple,” Dkt. 44 at 22, and the purposes of FOIA are ill-served by permitting an agency to wait for an opposing party or court to point out all the deficiencies in the agency’s justifications for withholding records and then simply to file a renewed motion with the benefit of the court’s detailed analysis of what is required to satisfy the agency’s burden. “FOIA’s mandate,” after all, is “that agencies ‘shall’ make requested records ‘promptly available.’” Jud. Watch, Inc. v. U.S. Dep’t of Homeland Sec., 895 F.3d 770, 775–76 (D.C. Cir. 2018). Because “[i]nformation is often useful only if it is timely,” the “excessive delay” that multiple rounds of summary judgment briefing can entail “is often tantamount to denial.” Edmonds v. FBI, 417 F.3d 1319, 1324 (D.C. Cir. 2005) (quoting H.R. Rep. No. 93-876, at 6 (1974)).

At the same time, however, the D.C. Circuit and this Court have recognized that the propriety of permitting do-overs must be assessed on a case-by-case basis. The D.C. Circuit touched on this issue in Citizens for Responsibility & Ethics in Washington v. U.S. Department of Justice, 45 F.4th 963, 978–79 (D.C. Cir. 2022) (hereinafter “CREW”), where it declined to “fault the district court for not giving [an agency] another chance” in a FOIA case. In reaching that conclusion, the court identified a number of considerations, including (1) the fact that the agency did not timely request another chance; (2) the case did “not involve ‘extraordinary circumstances’ in which, ‘from pure human error,’ the government ‘will have to release information compromising national security or sensitive, personal, private information, unless *67 the court allows it to make an untimely . . . claim,’” id. at 979 (quoting Maydak v. DOJ, 218 F.3d 760, 767 (D.C. Cir. 2000)); and (3) the case was not one “in which an agency [had] present[ed] a viable legal theory for a claimed exemption but provide[d] declarations that c[a]me up short in tying the requested records to that exemption,” id.. As the court explained with respect to this last consideration, it may (at least on occasion) “be prudent for a district court to permit supplemental declarations” further explaining the applicability of an exemption. Id.

Consistent with these considerations, this Court has at times granted agencies do-overs in FOIA litigation, including by permitting agencies to assert new exemptions after an initial round of summary judgment proceedings, see, e.g., Shapiro v. U.S. Dep’t of Justice, 177 F. Supp. 3d 467 (D.D.C. 2016); Shapiro v. U.S. Dep’t of Justice, 2016 WL 3023980 (D.D.C. May 25, 2016), to make new arguments after losing on summary judgment, see, e.g., Brennan Ctr. for Just. at N.Y.U. Sch. of L. v. U.S. Dep't of Justice, No. 18-1860, 2021 WL 2711765, at * 8 (D.D.C. July 1, 2021), and, most commonly, to refine or further explain their bases for withholding records, see, e.g., Mountgordon v. U.S. Coast Guard, No. 21-1319, 2023 WL 5607454, at *13 (D.D.C. Aug. 30, 2023). But, in each context, the Court has balanced FOIA’s “statutory goals—efficient, prompt, and full disclosure of information,” August v. FBI, 328 F.3d 697, 699 (D.C. Cir. 2003) (emphasis omitted) (quoting Sen. of the Commonwealth of Puerto Rico v. U.S. Dep’t of Justice, 823 F.2d 574, 580 (D.C. Cir. 1987)), against the adverse consequences of requiring disclosure of potentially exempt records based on anything ranging from modest lack of clarity by the agency to a failure by the agency and its counsel to take their responsibilities under FOIA as seriously as they should. In a recent opinion, for example, the Court observed that the agency’s “motion for summary judgment [was] poorly supported and lack[ed] essential detail,” and that the agency had “not taken the time to support its position.” Mountgordon, 2023 WL *68 5607454, at *1. The Court, however, separately considered the proper disposition with respect to each set of records at issue, granting summary judgment in favor the plaintiff as to some, and permitting the agency another chance where (1) it seemed likely that the agency’s position could be sustained with some additional explanation, or (2) “the redactions potentially implicate[d] the interests of third parties, who cannot be blamed for the [agency’s] omission.” Id. at *7–*13.

Rule 56, moreover, provides the Court with the discretion to balance FOIA’s goal of prompt disclosure against the harm that an unwarranted disclosure might cause to the agency or an innocent third party, and, in doing so, to consider the good faith (or lack of diligence) with which the agency has approached the litigation. In particular, Rule 56(e) provides that, “[i]f a party fails to properly support an assertion of fact or fails to properly address another party’s assertion of fact . . . , the court may,” among other things, grant summary judgment against that party, provide that party with a further “opportunity to support or address the fact,” or “issue any other appropriate order.” Fed. R. Civ. P. 56(e). The Court may also grant or deny summary judgment with respect to “part of [a] claim or defense,” Fed. R. Civ. P. 56(a), such as the adequacy or inadequacy of the agency’s search for responsive records, and “may enter an order stating any material fact . . . that is not genuinely in dispute and treating the fact as established in the case,” Fed. R. Civ. P. 56(g).

Applying these principles here, the Court notes that CMS has missed opportunities to address at least some of the flaws and omissions in its filings. After Plaintiff identified significant problems with CMS’s initial declaration, the agency submitted a supplemental declaration that addressed only a few of these problems and that ignored others. To paraphrase the D.C. Circuit’s recent decision in the CREW case, “[t]hose [two] declarations, coupled with the [agency’s] two briefs, gave ample opportunity [for CMS] to identify” the basis for the *69 withholdings. CREW, 45 F.4th at 979. Even so, CMS was not able to meet its burden—and with respect to some withholdings or arguments appeared not even to try. Most notably, despite Plaintiff pointing out that CMS wholly failed to address foreseeable harm with respect to its Exemption 4 withholdings, CMS did not respond at all to that argument in its reply brief or in the supplemental declaration it filed (which did address foreseeable harm with respect to Exemption 5).

On the other side of the scale, however, the interests of third parties are likely implicated by the most glaring of CMS’s omissions. The agency invoked Exemption 6, which is intended “to protect individuals from the injury and embarrassment that can result from the unnecessary disclosure of personal information,” Multi Ag Media LLC, 515 F.3d at 1228 (quoting U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 599 (1982)), and it invoked Exemption 4, which is designed to prevent the disclosure of sensitive commercial information and thus also the interests of third parties. With respect to this latter category of withholdings, Plaintiff argues that “[m]ost agencies . . . have regulations requiring [them] to notify third party submitters when a requester has filed a lawsuit implicating the submitter’s information that might fall under Exemption 4” and that, “[a]bsent contrary evidence,” the Court should assume that CMS provided this notice and that the purportedly interested third parties declined to intervene to protect their interests. Dkt. 44 at 23. The Court is skeptical, however, that CMS notified the interested parties of the litigation, particularly since the agency withheld their information, and, in any event, the Court is not prepared merely to assume that the interested parties were notified and declined to take steps to protect their confidential business information.

CMS’s substantive defenses of its Exemption 5 withholdings are on less shaky ground than its other withholdings, and the Court concludes that it is likely that those withholdings can *70 be sustained, at least in substantial part, with further explication from the agency. Permitting a second bite at the apple with respect to these withholdings is more in line with the type of refinement that this Court often permits in FOIA cases. See, e.g., Kolbusz v. FBI, 2021 WL 1845352, at *27 (D.D.C. Feb. 17, 2021) (“[W]here a court has found an agency failed to justify its claimed FOIA exemptions—courts have denied the defendant’s and plaintiff’s motions for summary judgment without prejudice and given the agency the choice to ‘disclose those documents or file supplemental submissions indicating in sufficient detail why withholding is proper.’” (quoting Shurtleff v. EPA, 991 F. Supp. 2d 1, 20 (D.D.C. 2013))); Muttitt, 926 F. Supp. 2d at 308 (“[T]he Court will deny summary judgment to the [defendant] regarding its Exemption 5 withholding determinations that invoke the deliberative process privilege in the . . . challenged documents. The defendant may either supplement its declaration demonstrating the applicability of the deliberative process privilege to the information contained in these . . . documents or disclose that information to the plaintiff.”); 100Reporters, 248 F. Supp. 3d 115, 165 (D.D.C. 2017) (“[T]he Court must deny summary judgment with regard to DOJ’s withholdings. If DOJ . . . intend to continue to rely on Exemption 7(C), they will have another opportunity to present further affidavits justifying the withholdings. Although DOJ is not necessarily prohibited from relying on categorical arguments, it should, at the least, make a more particularized showing for defined subgroups.” (quotation omitted)).

For these reasons, the Court will deny summary judgment to both parties with respect to the relevant withholdings but will do so without prejudice. The Court cautions CMS, however, that “this is not a process that can continue indefinitely” and that “FOIA does not permit an agency to make a half-hearted effort with the expectation that, if unconvincing, it can simply ‘do it over’—again and again, until the Court is satisfied.” Mountgordon, 2023 WL 5607454, at *1.

Finally, the Court will grant summary judgment in favor of Plaintiff on the issue of exhaustion and with respect to the adequacy of the agency’s searches. For the reasons explained above, Plaintiff did administratively exhaust his May 15 FOIA request before filing suit, and, the searches that CMS conducted were plainly inadequate. Accordingly, there is no reason to delay granting Plaintiff summary judgment on either issue. As noted above, Rule 56(a) permits the Court to enter summary judgment with respect to “the part of [a] claim or defense,” and use of that discretion is warranted here.

CONCLUSION

For the foregoing reasons, CMS’s motion for summary judgment, Dkt. 28, is hereby DENIED, and Plaintiff’s motion for summary judgment, Dkt. 31, is GRANTED in part and DENIED in part. It is hereby ORDERED that the parties shall meet and confer and shall submit a joint status report on or before October 31, 2023 proposing a schedule for further proceedings in this case.

SO ORDERED.

/s/ Randolph D. Moss RANDOLPH D. MOSS United States District Judge

Date: September 30, 2023