UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
CHILDREN’S HEALTH DEFENSE, Plaintiff,
v. Civil Action No. 23-1016 (TJK)
NATIONAL INSTITUTES OF HEALTH, Defendant.
MEMORANDUM OPINION AND ORDER Children’s Health Defense, or CHD, sought records from the National Institutes of Health about reports of adverse symptoms from COVID-19 vaccinations. The agency produced some records in full and both withheld and redacted others under FOIA Exemption 6. NIH now moves for summary judgment, arguing that its search was adequate and its withholdings proper. CHD cross-moves for summary judgment, asserting that the agency conducted an inadequate search with respect to two parts of its request and improperly withheld too much of what it found. The Court agrees that NIH adequately searched for records responsive to the first part of CHD’s re- quest, but not the third. Moreover, with respect to the documents it located in response to the third part of the request, NIH has not shown that the Exemption 6 withholdings challenged by CHD were proper.
Thus, the Court will grant NIH’s motion with respect to its search relating to the first part of CHD’s request, deny CHD’s cross-motion on the same, and otherwise deny the motions without prejudice. The Court will then allow NIH another opportunity to conduct an adequate search (or try to justify the search it already conducted) with respect to the third part of CHD’s request and permit it to take another shot at justifying its withholdings challenged by CHD.
I. Background CHD is a nonprofit organization that “works to end health epidemics” by “eliminating harmful exposures, holding those responsible accountable, seeking justice for those injured, and establishing safeguards to prevent further harm.” ECF No. 2 (“Compl.”) ¶ 4. Its areas of concern include the U.S. government’s “ongoing efforts to promote COVID-19 injections,” including, by CHD’s account, “spending billions of dollars on injections[,] funding broad-based distribution ef- forts throughout the United States[,] imposing nationwide vaccine mandates[,] paying billions of dollars to media sources to promote the injections[,] and working with social media companies to ensure positive coverage of the injections and to censor other viewpoints.” Id. ¶ 8 (footnotes omit- ted). It alleges that, in early 2021, NIH researchers “began to hear from individuals . . . experienc- ing severe, lasting health problems after COVID-19 injection, including neurological, cardiovas- cular, muscular, and other disorders.” Id. ¶ 12.
On November 10, 2022, CHD sought records from the NIH under the Freedom of Infor-
mation Act (“FOIA”), 5 U.S.C. § 552, including communications researchers had with (and about) individuals reporting symptoms after COVID vaccination.1 Compl. ¶ 1, 15. The request included three parts: (1) “all emails sent to and received from an affected individual”; (2) “[a]ll NIH call logs documenting communications with affected individuals”; and (3) “[a]ll internal communica- tions between [the] NIH researchers regarding an affected individual, whether the communication is via email, Teams or other internal communications system.” Id. ¶ 17. CHD defined an “affected individual” as “any member of the public who experienced a health problem after COVID-19 vac- cination, and who contacted NIH to report the problem, or to seek medical assistance or
1 Those researchers are Anthony Fauci, Alkis Togias, Avindra Nath, Farinaz Safavi, Lindsey Gustafson, Brian Walitt, Tanya Lehky, Amanda Wiebold, Angelique Gavin, and Yair Mina. ECF No. 2-1 at 3.
3
information in connection with the problem, or to inquire about or participate in research about COVID-19 vaccine reactions.” Id. ¶ 16.
Eight days later, NIH responded that CHD’s request was overly broad and advised that it would close the request “unless CHD clarified [it].” Compl. ¶ 19. On December 15, 2022, CHD narrowed its request with respect to the first and third parts, requesting records containing any of 10 terms: (1) “vaccin!”; (2) “adverse”; (3) “neurol!”; (4) “autoimmun!”; (5) “clot!”; (6) “suici!”; (7) “vertigo”; (8) “heart”; (9) “paresthesia”; (10) “lymph!” Id. ¶ 21.2 NIH confirmed receipt of CHD’s narrowed request the next day, but, by April 10, 2023, had neither produced any documents nor responded to two of CHD’s emails “inquir[ing] about the request status.” Id. ¶¶ 22–25. So on April 12, 2023, CHD filed this suit to compel NIH to search for and produce responsive, non- exempt records in compliance with its obligations under FOIA. See generally Compl.
NIH moved to dismiss, but later withdrew its motion and, on August 4, 2023, answered the complaint. The agency then conducted a search for documents responsive to CHD’s three-part request. ECF No. 14. It determined that there were no records responsive to the second part of the request, which sought call logs with affected individuals, and that, with respect to the first and third parts, all potentially responsive records were exempt from disclosure because they contained “sensitive personal information,” including “medical test results, diagnoses and treatments” whose release would cause an “unwarranted invasion of personal privacy.” Id. ¶¶ 7–8. The agency none- theless offered to re-review the records to determine whether any non-exempt information could be segregated and released. Id. ¶¶ 8–9.
2 As CHD explained, “the exclamation point (!) following some of the terms indicates that what [it] provided [was] a root, and [it] s[ought] all variants of the root.” Compl. ¶ 21.
4
Over the next year, NIH made 11 document productions to CHD. ECF No. 24 ¶ 9. Of that production, “[a] total of 405 pages were released unredacted, the bulk of which were blank protocol consent forms and publicly available journal articles[,] 812 pages were withheld in full[,] and 2,010 pages were partially withheld pursuant to [FOIA] Exemption 6.” ECF No. 29-2 ¶ 35. Exemption 6 allows agencies to withhold “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6). CHD “disagree[d] with certain redactions,” and asserted “that [NIH’s] search was not adequate to un- cover all relevant documents.” ECF No. 26 ¶ 10. Unable to resolve these disputes, the parties cross-moved for summary judgment. ECF Nos. 29, 30.
NIH argues that its search was adequate and its redactions proper under Exemption 6. In support of its motion, it submits two declarations of its FOIA Officer, Karen Lampe, describing its search process and the basis for its Exemption 6 withholdings. See ECF Nos. 29-3 (“Lampe Decl.”), 34-2 (“Supp. Lampe. Decl.”). It also submits a limited Vaughn index describing “infor- mation withheld . . . in a random 5% sample of its production to the plaintiff.” ECF No. 34-5 (“Vaughn Index”).3 CHD responds that NIH’s search was deficient because it failed to follow patently obvious leads, ignored CHD’s requested search terms, and unreasonably narrowed CHD’s request. ECF No. 30-1 at 24–28. It further argues that the agency improperly redacted “references to [affected individuals’] treatments, tests, and symptoms.” Id. at 31. Thus, it asks the Court to order NIH “to conduct an adequate search for records and to lift redactions not justified under . . . Exemption 6.” Id. at 32.
3 Because FOIA “places the burden on the agency to establish its right to withhold information ,” and because there is always an “asymmetrical distribution of knowledge” in FOIA cases, agencies often “produc[e] a Vaughn index, which is an affidavit that indexes and specifically describes withheld or redacted documents and explains why each withheld record is exempt from disclosure.” Schoenman v. FBI, 604 F. Supp. 2d 174, 196 (D.D.C. 2009) (quotations omitted).
5
II. Legal Standard “FOIA cases typically and appropriately are decided on motions for summary judgment.”
Am. Immigr. Council v. DHS, 30 F. Supp. 3d 67, 72 (D.D.C. 2014) (citations omitted). “Summary judgment is appropriately granted when, viewing the evidence in the light most favorable to the non-movants and drawing all reasonable inferences accordingly, no reasonable jury could reach a verdict in their favor.” Lopez v. Council on Am.-Islamic Rels. Action Network, Inc., 826 F.3d 492, 496 (D.C. Cir. 2016) (citation omitted). “The evidence presented must show ‘that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.’” Id. (quoting Fed. R. Civ. P. 56(a)). “In the FOIA context, a district court reviewing a motion for summary judgment conducts a de novo review of the record, and the responding federal agency bears the burden of proving that it has complied with its obligations under the FOIA.” MacLeod v. DHS, 15-cv-1792, 2017 WL 4220398, at *6 (D.D.C. Sept. 21, 2017) (Jackson, J.) (citing 5 U.S.C. § 552(a)(4)(B)); see also DOJ v. Reps. Comm. for Freedom of Press, 489 U.S. 749, 755 (1989) (“Unlike the review of other agency action that must be upheld if supported by substantial evidence and not arbitrary or capricious, the FOIA expressly places the burden on the agency to sustain its action.”) (citation modified). III. Analysis A. Adequacy of NIH’s Search CHD challenges the adequacy of NIH’s search with respect to the first and third parts of its request, which respectively sought “all emails sent to and received [by any of ten, named NIH researchers] from an affected individual” and “all internal communications between NIH research- ers about an affected individual.” Compl. ¶ 17; see ECF No. 30-1 at 18–22, 23–24. As explained below, the Court finds that the NIH’s declarations show an adequate search for records responsive
6
to the first part, which seeks agency communications with affected individuals, but not the third part, which seeks internal agency communications about affected individuals.4
1. NIH’s Declarations Reflect an Adequate Search for Communications Between NIH Researchers and Affected Individuals
As narrowed, the first part of CHD’s request seeks emails of the ten, named NIH research-
ers containing any of 10 terms: “vaccin!”; “adverse”; “neurol!”; “autoimmun!”; “clot!”; “suici!”; “vertigo”; “heart”; “paresthesia”; “lymph!” Compl. ¶ 21. NIH submits affidavits from its “FOIA Officer” describing its search for emails responsive to the request. Lampe Decl. ¶ 1. Lampe avers that the NIH had trouble “determining the proper scope of the search” because CHD’s definition of “affected individual” was “ill-defined” and too “broad.” Lampe Decl. ¶ 13 (internal quotations omitted). The agency also determined that CHD’s search terms “were not helpful in narrowing the search because they would likely have pulled in hundreds of thousands of pages nonresponsive to Plaintiff’s request.” Lampe Decl. ¶ 22. For example, Lampe avers that searching for every root of “neurology,” as CHD requested, would have “pulled in most, if not all,” of one researcher’s records, since “the word ‘neurological’ is in [his] signature block.” Id.
Thus, the agency says that it consulted each named researcher to generate search terms likely to yield records responsive to CHD’s request. Lampe Decl. ¶ 15. In so doing, it “determined that it would need primary assistance from Dr. [Alkis] Togias,” a Branch Chief in NIH’s Institute of Allergy and Infectious Disease, because Togias had been “quoted in a news article . . . about allergic reactions to the Pfizer COVID vaccine” and had compiled emails “to/from individuals who had contacted him” “with complaints about various [COVID vaccine] reactions” or “to par- ticipate in NIH’s study of allergic reactions to” those vaccines. Id. ¶ 18. From Togias’ emails,
4 CHD does not challenge the adequacy of NIH’s search with respect to the second part of its request, which seeks call logs. ECF No. 30-1 at 24–30.
7
NIH generated “search terms that could be used to perform a wider search,” including “vaccin!”— one of CHD’s requested terms. Id. ¶¶ 19, 23. From those terms, the agency developed a Boolean string to search for responsive records: “(react* near (15) (vaccin* or shot or Pfizer or moderna)) or (parathesia near vaccin*) or (receive and (vaccin* or shot) and myocarditis).” Id. ¶ 26.
Using that string, NIH conducted “centralized, automated searches of NIH email and com-
munication systems,” in order to “eliminate potential bias . . . introduced . . . by having each cus- todian conduct their own search manually.” Lampe Decl. ¶ 25. For each custodian, NIH “limited the ‘From:’ portion to not ‘@nih.gov’ in order to identify individuals contacting NIH,” from out- side the organization and “searched the subject lines and body of the emails . . . us[ing] the search string” it created. Id. ¶ 26–28. Ultimately, that search yielded 3,227 pages of documents respon- sive to the first part of CHD’s request. Id. ¶ 29.
Lampe’s declaration shows an adequate search for records responsive to the first part of CHD’s request. When an agency searches for documents requested under the FOIA, it must “show beyond material doubt that it has conducted a search reasonably calculated to uncover all relevant documents,” Morley v. CIA, 508 F.3d 1108, 1114 (D.C. Cir. 2007) (cleaned up). The agency “meet[s] [this] burden by providing a reasonably detailed affidavit, setting forth the search terms and the type of search performed, and averring that all files likely to contain responsive materials [] were searched.” Iturralde v. Comptroller of the Currency, 315 F.3d 311, 313–14 (D.C. Cir. 2003) (cleaned up). If the agency does so, the burden then shifts to the requester to point to “coun- tervailing evidence” raising “substantial doubt” “as to the adequacy of the agency’s search[,] . . . particularly in view of well-defined requests and positive indications of overlooked materials.” Id. (cleaned up). As explained below, Lampe’s declarations amply satisfy NIH’s burden with respect to its search for records responsive to the first part of the request, and CHD points to nothing in
8
the record raising “substantial doubt as to [the search’s] sufficiency.” Beltranena v. Clinton, 770 F. Supp. 2d 175, 183 (D.D.C. 2011) (citation omitted).
To begin, NIH’s declarations identify the terms the agency used in conducting its search and describe how it generated those terms: from a sampling of Dr. Togias’ emails with affected individuals. Lampe Decl. ¶ 19. They also describe the agency’s search process in detail—explain- ing that the agency’s Center for Information Technology used the search string to query the agency’s email and communications systems with respect to the ten custodians at issue, yielding “email addresses and names of potentially affected individuals with whom [the] custodians com- municated with regarding perceived [COVID vaccine] reactions.” Id. ¶¶ 26–30. The agency, as the declarations explain, then “searched for any communications between the . . . individuals’ email addresses or names and the . . . custodians within the relevant timeframe.” Id. ¶ 28. Ac- cordingly, NIH’s declarations provide “detailed descriptions of [its] . . . databases, the kinds of information that those databases store, the search terms used[,] and the specific files searched.” Flete-Garcia v. United States Marshals Serv., 613 F. Supp. 3d 425, 432 (D.D.C. 2020) (citation modified). Thus, the Court finds that NIH has met its burden to “proffer relatively detailed and nonconclusory declarations describing its search” for records responsive to the first part of CHD’s request. Id. (cleaned up).
CHD argues that NIH’s search for records responsive to the first part of its request was deficient for three reasons: the agency (1) failed to follow “patently obvious” leads; (2) ignored most of CHD’s preferred search terms; and (3) unreasonably narrowed CHD’s search. See ECF No. 30-1 at 26–28. Each comes up short.
First, CHD argues that the NIH failed to follow “patently obvious leads” during its search.
ECF No. 30-1 at 24–26. To be sure, an agency must “revise its assessment of what is reasonable
9
in a particular case to account for leads that emerge during its inquiry,” Campbell v. DOJ, 164 F.3d 20, 28 (D.C. Cir. 1998) (cleaned up), and must follow any “clear and certain” leads, Kow- alczyk v. DOJ, 73 F.3d 386, 389 (D.C. Cir. 1996). But CHD points the Court to no clear and certain lead that NIH uncovered, much less one that it ignored. Rather, CHD reasons that, because NIH’s researchers “possess[] detailed information about the affected individuals with whom they were communicating,” the agency’s consultations with those researchers about search terms must have turned up leads. See ECF No. 30-1 at 24–25. And because NIH has identified no such leads, CHD concludes that NIH must have ignored “the many leads that would undoubtedly have been provided by the custodians.” See id. CHS’s reasoning is circular, purely speculative, and fails to identify any convincing lead that the NIH failed to follow. And CHD’s “speculation that [NIH] failed to exhaust all possible leads does not raise a materially factual dispute to preclude a judg- ment in [NIH’s] favor on [its] demonstrably adequate search.” Taylor v. Exec. Off. for United States Att’ys, No. 18-cv-2513 (ABJ), 2024 WL 4253160, at *3 (D.D.C. Sept. 20, 2024); see also SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1201 (D.C. Cir. 1991) (“Mere speculation that as yet uncovered documents may exist does not undermine the finding that the agency conducted a rea- sonable search for them.”).
Second, CHD argues that NIH’s search was inadequate because it improperly disregarded most of CHD’s desired search terms. ECF Nos. 30-1 at 26–27; 36 at 2–6. In general, “there is no bright-line rule requiring agencies to use the search terms proposed in a FOIA request.” Physicians for Hum. Rts. v. U.S. Dep’t of Def., 675 F. Supp. 2d 149, 164 (D.D.C. 2009). Rather, “[f]ederal agencies have discretion in crafting a list of search terms that they believe[] to be reasonably tai- lored to uncover documents responsive to [a] FOIA request.” Agility Pub. Warehousing Co. K.S.C. v. NSA, 113 F. Supp. 3d 313, 339 (D.D.C. 2015) (citation modified). That said, though “a FOIA
10
petitioner cannot dictate the [agency’s] search terms,” courts have held that “the agency must still provide an explanation as to why the search term was not used.” Am. Oversight v. OMB, 613 F. Supp. 3d 219, 227–28 (D.D.C. 2020) (citation modified). NIH does just that, explaining that CHD’s “search terms . . . were not helpful in narrowing the search because they would likely have pulled in hundreds of thousands of pages nonresponsive to [the] request,” and noting, for example, that querying all roots of “neurological,” as CHD requested, would have pulled in “most, if not all, of [one] custodian’s records.” Lampe Decl. ¶ 22. As a result, the agency represents that it sought input from one of its researchers, Dr. Togias—who compiled his own emails with affected indi- viduals and had been quoted in a in a news article about vaccine reactions—to develop search terms. Id. ¶¶ 17–18. So, “[b]ased on the [NIH]’s representations, the Court concludes that the [agency’s] decision not to use [CHD’s] term[s],” but to use instead the terms it developed from Dr. Togias’ emails, “was reasonably calculated to find responsive materials.” Coffey v. Bureau of Land Mgmt., 277 F. Supp. 3d 1, 9 (D.D.C. 2017). “Accordingly, because [NIH’s] search terms [were] reasonable, the Court will not second guess the [agency] regarding whether other search terms,” including CHD’s, “might have been superior,” nor does it see any basis to “find[] that the [NIH’s] failure to utilize certain search terms proposed by the plaintiff . . . render[s] the [agency’s] search . . . inadequate.” Heffernan v. Azar, 417 F. Supp. 3d 1, 11 (D.D.C. 2019) (citation modi- fied).
Third, CHD says that NIH unreasonably narrowed CHD’s request by only searching for emails with individuals who were either enrolled in a long COVID study or not enrolled in any NIH study. ECF No. 30-1 at 27–28. To be sure, and by the agency’s own admission, the first Lampe Declaration is less than clear on this point. But NIH submits Lampe’s Supplemental Dec- laration clarifying that the agency’s search included “[r]ecords from individuals who contacted
11
NIH about health problems after receiving the COVID vaccine” whether or not they were enrolled in any study, as well as those “from individuals who did not reach out about health problems[,] . . . but who were enrolled in the Long COVID study.” Supp. Lampe Decl. ¶¶ 21–22. In other words, NIH has now represented that individuals enrolled in studies other than the long COVID study were not “excluded” from its search, as CHD asserted. ECF No. 30-1 at 28. So this argument too fails to raise substantial doubt as to the adequacy of CHD’s search.
For these reasons, the Court concludes that NIH’s declarations sufficiently show that it conducted an adequate search reasonably calculated to discover records responsive to the first part of CHD’s request.
2. NIH’s Declarations Do Not Demonstrate an Adequate Search for Internal Agency Communications About Affected Individuals
The third part of CHD’s request seeks “[a]ll internal communications between NIH re-
searchers regarding an affected individual, whether the communication is via email, Teams, or other internal communication system.” Compl. ¶ 17. NIH says that, in searching for responsive records, it determined that the relevant custodians “had no hard copy files for internal communi- cations,” and that it was “unlikely that there were records of written internal communications re- garding the potentially affected individuals because,” according to “at least one custodian[,] . . . internal medical case discussion took place primarily in meetings, as opposed to over email or written communication.” Lampe Decl. ¶ 30. Accordingly, the agency says, it determined that any further “search [for] internal written communications” would be “unreasonable.” Supp. Lampe Decl. ¶ 10.
In support of this assertion, NIH submits the declaration of one custodian, Dr. Avindra Nath, director of an NIH infectious disease studies. See generally ECF No. 34-4 (“Nath. Decl.”). Dr. Nath avers that “[d]iscussions about patients typically don’t happen over email, slack,
12
messenger, or other forms of insecure communication.” Nath Decl. ¶ 3. Rather, his team’s “[s]tandard practice is to discuss patients during Patient Care meetings” in an “active dialogue.” Nath Decl. ¶¶ 4–5. All this, NIH says, justifies its failure to search for internal communications about affected individuals, because FOIA “does not demand a search that would be futile.” ECF No. 34 at 10 (quoting Leopold v. Dep’t of Def., 752 F. Supp. 3d 66, 89 (D.D.C. 2024)). CHD argues that the declarations by Lampe and Nath are insufficient to show futility, and the Court agrees.
In general, FOIA requires an agency to “show that it made a good faith effort to conduct a search” of files and systems “likely to contain responsive materials,” “using methods which can be reasonably expected to produce the information requested.” Taylor, 2024 WL 4253160, at *2 (citations omitted). That said, because “an agency cannot improperly withhold records that it does not maintain,” in some cases a search for records would be futile. MacLeod, 2017 WL 4220398, at *11. In those cases, “the reasonable search required by FOIA may be no search at all.” Earle v. DOJ, 217 F. Supp. 3d 117, 123 (D.D.C. 2016) (quotation omitted). But to justify a failure to search on futility grounds, an agency must produce “relatively detailed, nonconclusory” affidavits “submitted in good faith” which, when “judged . . . in light of the entirety of [their] contents,” “sufficient[ly] . . . explain why a search would be futile and is unnecessary.” Id. at 123–24 (quo- tations omitted). NIH’s declarations fall well short of the mark.
Lampe avers that the agency determined, based on input from “at least one custodian,” that it was “unlikely” the agency had “written internal communications regarding potentially affected individuals.” Lampe Decl. ¶ 30 (emphasis added). But it is not at all clear what Lampe means by “written communications”—i.e., whether this assertion applies only to hard-copy documents or includes electronic media. This distinction is important, of course, because CHD requested not
13
only hard copy documents, but “[a]ll internal communications” about “affected individual[s], whether the communication is via email, Teams or other internal communications system.” Compl. ¶ 17 (emphasis added). Thus, even if its custodians disclaimed keeping any hard-copy documents about affected individuals, that alone would not excuse NIH’s failure to search for responsive records in electronic format. Indeed, “to restrict its search to certain types of records, [an agency] must provide adequate justification.” Am. Oversight v. OMB, 613 F. Supp. 3d at 229. But NIH has not explained why a lack of hard-copy documents would render a search for elec- tronic communications futile.
To be sure, Dr. Nath’s declaration is clearer on this point, asserting that his team’s com-
munications about affected individuals “typically don’t happen over email, slack, messenger, or other forms of insecure communication.” Nath Decl. ¶ 3. But, for a few reasons, Dr. Nath’s dec- laration does not establish that further search for internal electronic communications about affected individuals would have been futile. For one, Dr. Nath does not say that his team never discusses affected individuals in written electronic communications, only that they typically do not do so. And NIH based its conclusion that further search for internal communications would be futile—at least in large part—on Dr. Nath’s “expla[nation] that internal medical case discussions took place primarily in meetings.” Lampe Decl. ¶ 30; see also Supp. Lampe Decl. ¶¶ 7–10. But “typically,” like “primarily,” does not mean always—or even almost always.
Indeed, this equivocating language distinguishes NIH’s affidavits from those found suffi-
cient to justify Immigration and Customs Enforcement’s refusal to search for demographic data in American-Arab Anti-Discrimination Committee v. U.S. Department of Homeland Security. See 516 F. Supp. 2d 83 (D.D.C. 2007). In that case, the court upheld ICE’s refusal to search for “data on [detainee’s] race, ethnicity, religion, and gender” in light of an agency official’s representation,
14
“based on information with which he [was] personally familiar as well as his conversations with ICE Counsel and . . . ICE [agents],” “that ‘ICE does not maintain information relating to [ ] eth- nicity[ ] and religion.’” Id. at 86 (emphasis added). The court held that the affiant’s “explanation that ICE neither maintains data on arrestees’ ethnicity or religion nor uniformly collects such in- formation on race is sufficient . . . to explain why a search would be futile and is unnecessary.” Id. at 88.
Here, by contrast, NIH says only that it is “unlikely” the sought-after records exist because one custodian’s team “typically” or “primarily” does not exchange written communications about affected individuals. Those qualified statements hardly establish that a search for internal com- munications about affected individuals would be futile. See Marshall v. ATF, No. 10-cv-21424, 2011 WL 13268863, at *6 & n.6 (S.D. Fla. Aug. 23, 2011) (agency’s averment that surveillance video is “generally recorded over . . . after a period of 30 days” did not demonstrate futility of search for such footage because “generally’ . . . indicates that not all video is recorded over after a period of 30 days) (emphasis in original).
Moreover, and just as importantly, even if it was “standard practice” on Dr. Nath’s team not to exchange written communications about patients, neither Lampe nor Dr. Nath aver that every other custodian named in CHD’s request adopted the same practice. Indeed, as CHD argues, “even if NIH researchers’ communications about patients in the study described by Dr. Nath were never memorialized in writing, the declaration as no bearing on communications among research- ers outside of the limited context” of that study. ECF No. 36 at 8. The Court agrees. Even if a further search for internal, written communications in Dr. Nath’s records would have been futile— and NIH’s affidavits by no means show that it would—that alone would not establish the same for every other custodian. Cf. Oglesby v. U.S. Dep’t of Army, 920 F.2d 57, 68 (D.C. Cir. 1990) (“[An]
15
agency cannot limit its search to only one record system if there are others that are likely to turn up the information requested.”).
For all these reasons, the Court does not find that NIH’s affidavits, “in light of the entirety of [their] contents,” “sufficient[ly] . . . explain why” a further search for internal communications, including those kept in electronic format, “would be futile and is unnecessary.” Earle, 217 F. Supp. 3d at 123–24. Thus, on this record, the Court concludes that NIH has not shown that its search with respect to the third part of CHS’s request was adequate.5 B. NIH’s Exemption 6 Withholdings Of the 3,227 pages of documents responsive to CHD’s request, NIH produced 405 pages unredacted, 2,010 pages with partial redactions, and withheld 812 pages in full. ECF No. 30-1 at 30; Lampe Decl. ¶ 34. NIH invokes FOIA Exemption 6 as the basis for its withholdings.
FOIA Exemption 6 allows agencies to withhold “personnel and medical files and similar files” if their disclosure “would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). When an agency withholds responsive documents pursuant to a FOIA exemp- tion, a court may grant summary judgment if the agency’s “affidavit[s] describe[] the justifications for withholding the information with specific detail, demonstrate[] that the information withheld logically falls within the claimed exemption, and is not contradicted by contrary evidence in the record or by evidence of the agency’s bad faith.” ACLU v. Dep’t of Def., 628 F.3d 612, 619 (D.C. Cir. 2011).
5 CHD further urges the Court to deny summary judgment to NIH in light of “positive indications of overlooked materials”—i.e., purported emails between NIH researchers about affected individuals. See ECF No. 36 at 10 (quoting Valencia-Lucena, 180 F.3d 321, 326 (D.C. Cir. 1999)). Because the Court concludes that NIH’s affidavits do not demonstrate an adequate search for internal agency communications, it need not reach this argument.
16
CHD argues that NIH has not “provided the detailed justifications” to support its withhold-
ings of de-identified records. ECF No. 30-1 at 30. While CHD consents to NIH’s “redaction of information that points to particular individuals,” it “seek[s] only to lift redactions of de-identified mentions of treatments, test, and symptoms in email communications between affected individuals and NIH researchers,” ECF No. 36 at 10, 12, arguing that the release of this “de-identified” infor- mation constitutes, at most, a “de minimis invasion of privacy,” id. at 11 (quoting Pub. Citizen Health Rsrch. Grp. v. Acosta, 363 F. Supp. 3d 1, 15 (D.D.C. 2018)). The Court agrees that the agency has not met its burden to show that it may withhold de-identified records in full or in part under Exemption 6.
1. The Withheld Information is a Medical or Similar File “When confronted with a challenge to a withholding of agency records on the basis of this exemption, courts must make a two-step determination de novo, see 5 U.S.C. § 552(a)(4)(B) (1976): whether the information sought is to be found in personnel, medical or similar files, and if so, whether its release would constitute a ‘clearly unwarranted invasion of personal privacy.’” Arieff v. U.S. Dep’t of Navy, 712 F.2d 1462, 1466 (D.C. Cir. 1983).
At step one, the Supreme Court has taken a “broad, rather than a narrow” view of the phrase “similar files,” holding that “all government records containing information that applies to or iden- tifies a particular individual satisfy the threshold test of Exemption 6.” Wash. Post. Co. v. HHS, 690 F.2d 252, 275 (1982) (emphasis added). Here, NIH represents that the material at issue in- cludes “the names, ages, and family history of the individuals who requested help with alleged vaccine reactions, detailed medical histories, medications used to treat conditions, and results of lab tests.” Lampe Decl. ¶ 36. The Court finds that this information constitutes “similar files”
17
within the meaning of Exemption 6. CHD does not meaningfully argue otherwise, as it focuses on the second step.
2. NIH Has Not Shown More than a Mere Possibility that Release of the Withheld Information Risks Reidentification of any Particular Individual
Step two asks whether the release of the redacted information would constitute a “clearly unwarranted invasion of personal privacy,” Arieff, 712 F.2d at 1466. At this stage, the Court must determine “whether disclosure” of the withheld information “would compromise a substantial, as opposed to a de minimis, privacy interest.” Hum. Rts. Def. Ctr. v. U.S. Park Police, 126 F.4th 708, 713 (D.C. Cir. 2025) (quoting Niskanen Ctr. v. Fed. Energy Regul. Comm’n, 20 F.4th 787, 791 (D.C. Cir. 2021)). If—and only if—the Court finds that disclosure would invade a substantial privacy interest, then it must balance the harm to that interest “against the public interest in the release of the requested information” to determine whether invocation of the exemption is proper. Acosta, 363 F. Supp. 3d at 14.
The general rule governing de-identified information under Exemption 6 is that “disclosure of . . . personal information constitutes only a de minimis invasion of privacy when the identities of [particular individuals] are unknown.” U.S. Dep’t. of State v. Ray, 502 U.S. 164, 176 (1991); see also Dep’t of Air Force v. Rose, 425 U.S. 352, 375 (1976) (“[D]eletion of names and identify- ing characteristics of individuals would in some cases serve the underlying purpose of exemption 6.”) (quoting 120 Cong. Rec. (1974)). And “[a]n item of exempt information [because it is per- sonally identifiable] does not insulate from disclosure the entire file in which it is contained, or even the entire page on which it appears.” Arieff, 712 F.2d at 1466. “[E]ven with names” and other personally identifiable information redacted, courts have recognized that “subjects . . . can often be identified through other, disclosed information,” Reps. Comm. I, 489 U.S. at 769, particularly where “sufficiently motivated members of the public might be able to link the information to
18
specific individuals,” Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 877 (D.C. Cir. 1989)—a process NIH calls “re-identification,” Supp. Lampe Decl. ¶ 20.
Thus, courts have held that agencies may withhold parts of a record which, if disclosed, would on their own or in combination with other public information, identify a particular individ- ual in a manner that implicates a significant personal privacy interest. Rose, 426 U.S. at 381; Reps. Comm. I, 489 U.S. at 769. But “an agency withholding records on [this] ground . . . must . . . establish more than a ‘mere possibility’ that the [withheld] information . . . can be linked to a particular individual.” Acosta, 363 F. Supp. 3d at 17 (quoting Arieff, 712 F.2d at 1469); see also Citizens for Env’t Quality, Inc. v. U.S. Dep’t of Agric. (“CEQ”), 602 F. Supp. 534, 538 (D.D.C. 1984) (“To establish the existence and extent of any invasion of privacy created by disclosure,” the agency defendant “must first show that the public would be able to link the disclosures re- quested by plaintiff with [a particular individual],” and “the likelihood of such identification must be more palpable than [a] mere possibility.”) (cleaned up) (emphasis added).
Here, NIH argues that the risk of re-identification from disclosure of the withheld, de-
identified information is high because “the individuals communicating with NIH had very specific and unique ways of describing their medical information,” and so “[e]ven if individual portions of someone’s medical history do not reveal who the individual is, the combination of all the medical information the individuals submitted to NIH[] could reveal the identities of the individuals and medical information that they would not want revealed to the public at large.” Lampe Decl. ¶ 42. Although “the Court does not disagree with this proposition in the abstract,” Acosta, 363 F. Supp. 3d at 16, it does not find that NIH’s affidavits and sample Vaughn index adequately demonstrate a risk of reidentification with respect to any particular individual. Indeed, as explains below, most
19
of NIH’s asserted bases for withholding the de-identified records at issue are conclusory, specula- tive, or assert no reidentification risk at all.
To begin, the agency asserts that the withheld, de-identified information at issue poses a reidentification risk because “the individuals communicating with NIH had very specific and unique ways of describing their medical information,” and so “[e]ven if individual portions of someone’s medical history do not reveal who the individual is, the combination of all the medical information the individuals submitted to NIH[] could reveal the identities of the individuals.” Lampe Decl. ¶ 42. But this sweeping characterization of the withheld information will not suffice. Affidavits supporting redaction under a FOIA exemption must “contain reasonable specificity of detail,” Hum. Rts. Def. Ctr., 126 F.4th at 713 (emphasis added) (citation omitted), and “conclusory and generalized allegations of exemptions are unacceptable,” Morley, 508 F.3d at 1114–15 (cleaned up); see also CEQ, 602 F. Supp. at 539 (holding agencies cannot justify withholding under Exemption 6 with “conclusory allegations unsupported by factual data”) (quoting Exxon Corp. v. FTC, 663 F.2d 120, 126–27 (D.C. Cir. 1980)). Indeed, “[u]nder FOIA, [the] defendant has the burden of showing affirmatively the applicability of any exemption it seeks to assert, with . . . exemption 6 [imposing] as heavy a burden as can be found anywhere in the Act.” CEQ, 602 F. Supp. at 539. Merely representing that affected individuals generally described their medical information in “unique” and “specific” ways does not meet this heavy burden—for it says nothing about the risk of reidentification as to any “particular individual.” Acosta, 363 F. Supp. 3d at 16.
NIH’s sample Vaughn index fares no better. There, several of the agency’s asserted justi-
fications are conclusory or speculative as to the purported risk of reidentification; other justifica- tions fail to even assert any risk of reidentification. For instance, several entries in the index assert, as a basis for redacting medical information, some variation of: “[the] information . . . would
20
constitute an unwarranted invasion of personal privacy and harm to the individual if re-identified.” Vaughn Index at 8, 10, 16-18, 20, 22-24 (emphasis added). But an assertion that harm would result from re-identification is no substitute for establishing more than a mere possibility that re-identi- fication will occur. Several other entries assert, in one way or another, that the redacted content “could be combined with other information in this and related email threads to re-identify the affected individuals.” E.g., id. at 3. But it is not sufficient for an agency to “only speculate[] that disclosure of such information . . . could amount to an invasion of privacy” of specific individuals. Cuban v. SEC, 744 F. Supp. 2d 60, 85 (D.D.C. 2010) (cleaned up), on reconsideration in part, 795 F. Supp. 2d 43 (D.D.C. 2011). Rather, “the defendant, who carries the burden, must do more than that to demonstrate a clearly unwarranted invasion of personal privacy.” Id.
Still more entries seek to withhold discussions of medical advice and test results due to “the [potential that] medical advice intended for a specific individual [could] be misunderstood by or misrepresented to the public as medical advice.” E.g., Vaughn Index at 2. This justification, while perhaps a legitimate concern, has nothing to do with the legal standard at issue. Exemption 6 “was designed to protect individuals from public disclosure of intimate details of their lives,” and this explanation does not help the agency “explain how th[is] information trammels on [any affected individual’s] personal privacy.” Humane Soc’y of U.S. v. Animal & Plant Health Inspec- tion Serv., 386 F. Supp. 3d 34, 43 (D.D.C. 2019).
To be sure, the Court does find that some of NIH’s explanations inch closer to providing the specific detail necessary to demonstrate more than a mere possibility of reidentification. For instance, in support of one redaction, the agency explains that the “individual provided information on their medical history, medical test results, disability status, age, employment information and geographic information. . . . These factors, particularly when combined, could be used to re-
21
identify the individual.” Supp. Lampe Dec. ¶ 19. In another, NIH explains that “[t]he [affected individual’s] symptom time frame could be used in conjunction with other information in this and related email threads to help re-identify the individual. The affected individual states that they have contacted several other government officials whose emails are also subject to FOIA, increas- ing the potential to reveal additional information leading to the re-identification of this affected individual.” Vaughn Index at 5. But, on the whole, NIH’s affidavits and sample Vaughn index do not show, with reasonable specificity, more than a mere possibility that the disclosure of the with- held information in de-identified records could be linked to any particular individual.
For these reasons, NIH’s current affidavits are “legally insufficient for [the Court] to con-
clude either that defendants have met their obligations under the FOIA or that plaintiff is entitled to a judgment in its favor.” Defs. of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 93 (D.D.C. 2009). Accordingly, the Court will permit the agency to renew its motion with additional decla- rations and other supporting materials, including any submission it may seek to provide under seal and ex parte, to support its withholding of the de-identified information that CHD argues should be disclosed.6
6 NIH further asserts that its withholdings are proper because “many of the potentially affected individuals [who contacted NIH] were screened for or enrolled in one of [three COVID-19] studies,’ which ‘provided certain privacy guarantees’ . . . limiting the release and/or use of their data and information.’” ECF No. 29 at 16 (quoting Lampe Decl. ¶ 37). “While such a pledge is clearly not dispositive on the question of whether disclosure would create an invasion of privacy, and, if so, the extent of that invasion, the court recognizes that a good faith pledge of confidentiality should generally be given weight on the privacy side of the scale in accord with its effect on expectations of privacy.” CEQ, 602 F. Supp. at 538 (citation omitted). But the Court need only to weigh the public interest in disclosure against privacy interests if the “defendant [can] first show that the public would be able to link the disclosures requested by plaintiff” to a particular individual . Id. Because, as the Court has explained, NIH has not adequately done so here, “it is not necessary,” at this stage, “for the court to resolve the balance between any invasion of privacy and the public’s interest in disclosure.” Id.
22
IV. Conclusion and Order For all the above reasons, it is hereby ORDERED that NIH’s Motion for Summary Judg-
ment, ECF No. 29, is GRANTED IN PART and DENIED WITHOUT PREJUDICE IN PART, and CHD’s cross-motion, ECF No. 30, is DENIED IN PART and DENIED WITHOUT PREJ- UDICE IN PART. It is further ORDERED that the parties shall file a joint status report by September 25, 2026, informing the Court how they propose to proceed concerning the remaining issues in this case.
/s/ Timothy J. Kelly
TIMOTHY J. KELLY
United States District Judge Date: August 25, 2026