Consumers' Checkbook, Center for the Study of Services v. United States Department of Health & Human Services

554 F.3d 1046, 384 U.S. App. D.C. 306, 2009 U.S. App. LEXIS 1642, 2009 WL 211822

• Court: Court of Appeals for the D.C. Circuit
• Decided: January 30, 2009
• Docket: 07-5343
• Status: Published

Opinions

Opinion for the court filed by Circuit Judge HENDERSON.

Separate opinion filed by Circuit Judge ROGERS, concurring in part and dissenting in part.

KAREN LECRAFT HENDERSON, Circuit Judge.

Consumers’ Checkbook, Center for the Study of Services (CSS) filed this action under the Freedom of Information Act (FOIA), 5 U.S.C. § 552 et seq., seeking from the United States Department of Health and Human Services (HHS) records for all Medicare claims submitted to HHS by physicians in several localities during 2004. The district court granted summary judgment in CSS’s favor, concluding that the records are not exempt from disclosure under FOIA Exemption 6, id. § 552(b)(6). See Consumers’ Checkbook, Ctr. for Study of Servs. v. U.S. Dep’t of Health & Human Servs., 502 F.Supp.2d 79, 83-86 (D.D.C.2007) (Memorandum Opinion). For the reasons set forth below, we reverse the judgment of the district court.

I.

On March 27, 2006, CSS submitted a FOIA request to the Centers for Medicare and Medicaid Services (CMS), a division within HHS, seeking a subset of data elements from all Medicare claims submitted by certain physicians in 2004. The data elements include the diagnosis, the type and place of service and the Unique Physician Identifying Number (UPIN) of the physician who performed the services. CSS limited its request to physicians in the District of Columbia, Illinois, Maryland, Washington and Virginia. It did not request data that identifies Medicare beneficiaries. At the time of the request, every physician was assigned a UPIN when he enrolled in Medicare.¹ A physician’s name, office zip code, medical or surgical specialty and UPIN are publicly available on the internet. The fees a physician receives from Medicare for performing a specific service or procedure are also publicly available on the internet. Combined with the publicly available fee schedule, the data requested by CSS can be used to calculate the total payments Medicare made to any individually identified physician for claims submitted in 2004.

CMS denied the FOIA request and CSS appealed to the CMS Deputy Administrator. On December 26, 2006, CSS filed a complaint in district court under FOIA seeking injunctive relief. Both parties moved for summary judgment. HHS argued that the requested records are exempt from disclosure under FOIA Exemption 6. Alternatively, it argued that a twenty-nine-year-old permanent injunction issued by the United States District Court for the Middle District of Florida bars disclosure of the requested data from physicians who are American Medical Association (AMA) members. See Fla. Med. Ass’n v. Dep’t of Health, Educ. & Welfare, 479 F.Supp. 1291 (M.D.Fla.1979). In an opinion and order filed August 22, 2007, the district court granted summary judgment in CSS’s favor and this appeal followed.² Memorandum Opinion at 81, 89.

II.

HHS appeals the district court’s grant of summary judgment as to the requested Medicare records the court held were not exempt from disclosure under FOIA Exemption 6.³ We review the district court’s grant of summary judgment de novo. Judicial Watch, Inc. v. FDA, 449 F.3d 141, 145 (D.C.Cir.2006). FOIA provides that an agency must disclose all records upon request by “any person,” 5 U.S.C. § 552(a)(3), unless a statutory exemption applies. Id. § 552(b). FOIA Exemption 6 provides that FOIA “does not apply to matters that are ... personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” Id. § 552(b)(6). It is undisputed that the requested Medicare records are personnel, medical, or “similar files.” See Memorandum Opinion at 83. Accordingly, we must determine whether “disclosure would compromise a substantial, as opposed to a de minimis, privacy interest.” Nat’l Ass’n of Retired Fed. Employees v. Horner, 879 F.2d 873, 874 (D.C.Cir.1989). If a substantial privacy interest is at stake, then we must balance the privacy interest in non-disclosure against the public interest. Id. (citing Ripskis v. HUD, 746 F.2d 1, 3 (D.C.Cir.1984)). Disclosure is not required if it “would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). The agency bears the burden to persuade the court that the exemption applies. Ripskis, 746 F.2d at 3.

A.

We have consistently held that an individual has a substantial privacy interest under FOIA in his financial information, including income. In Multi AG Media v. Department of Agriculture, 515 F.3d 1224 (D.C.Cir.2008), we found that the disclosure of information on “irrigation practices, farm acreage, and the number and width of rows of tobacco and cotton” implicated substantial privacy interests because it would “in some cases allow for an inference to be drawn about the financial situation of an individual farmer” receiving federal subsidies. 515 F.3d at 1226, 1230. In Painting and Drywall Work Preservation Fund, Inc. v. HUD, 936 F.2d 1300 (D.C.Cir.1991), we found that contractors on federal construction projects had a substantial privacy interest in their names, addresses, hourly pay, hours worked and wages. 936 F.2d at 1301-02; see also Sheet Metal Workers Int’l Ass’n, Local No. 9 v. U.S. Air Force, 63 F.3d 994, 995, 998 (10th Cir.1995) (government contractors on federal construction projects have substantial privacy interest in payroll records); Painting Indus. of Haw. Market Recovery Fund v. U.S. Dep’t of Air Force, 26 F.3d 1479, 1484 (9th Cir.1994) (same); Hopkins v. HUD, 929 F.2d 81, 86-87 (2d Cir.1991) (same). The Congress has also recognized the privacy interest an individual taxpayer has in his tax return information, including the “nature, source, or amount of his income,” 26 U.S.C. § 6103(b)(2)(A), and has prohibited the disclosure of tax return information with limited exceptions. Id. § 6103(a).

The information requested by CSS would reveal the total Medicare payments received by a physician for covered services. CSS notes that the information would not reveal a physician’s gross revenue because it would not include income from non-Medicare sources. Nor would it reveal a physician’s net income because it would not include business operating expenses. But the requested information need not reveal completely an individual’s personal finances to implicate substantial privacy concerns. See Multi AG Media, 515 F.3d at 1228-29 (substantial privacy interests implicated because requested information “would necessarily reveal at least a portion of the owner’s personal finances”) (quoting Nat’l Parks & Conservation Ass’n v. Kleppe, 547 F.2d 673, 685 (D.C.Cir.1976)). CSS also argues that a physician does not have a privacy interest in Medicare payments because the payments relate to business activities and not personal finances. We have, however, recognized substantial privacy interests in business-related financial information for individually owned or closely held businesses because the “financial makeup of the businesses mirrors the financial situation of the individual family members.” Multi AG Media, 515 F.3d at 1229 (internal quotations omitted); cf. Wash. Post Co. v. U.S. Dep’t of Justice, 863 F.2d 96, 100 (D.C.Cir.1988) (information related to employees’ business decisions in developing and marketing medication does not implicate privacy interests under FOIA Exemption 7); Wash. Post Co. v. U.S. Dep’t of Health & Human Servs., 690 F.2d 252, 261-62 (D.C.Cir.1982) (no substantial privacy interest in list of organizations in which scientific consultants have financial holdings related to their consulting duties, but not dollar amounts of holdings). Accordingly, we conclude that physicians have a substantial privacy interest in the total payments they receive from Medicare for covered services.

B.

We next examine the public interest in disclosure. The only relevant public interest in disclosure “is the extent to which disclosure would serve the ‘core purpose of the FOIA,’ which is ‘contributing] significantly to public understanding of the operations or activities of the government.’ ” U.S. Dep’t of Def. v. FLRA 510 U.S. 487, 495, 114 S.Ct. 1006, 127 L.Ed.2d 325 (1994) (quoting U.S. Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 775, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989)). The requested information must “shed[ ] light on an agency’s performance of its statutory duties.” Reporters Comm. for Freedom of Press, 489 U.S. at 773, 109 S.Ct. 1468. “[I]nformation about private citizens ... that reveals little or nothing about an agency’s own conduct” does not serve a relevant public interest under FOIA. Id. The requesting party’s intended use for the information is irrelevant to our analysis. See id. at 771, 109 S.Ct. 1468 (“[T]he identity of the requesting party has no bearing on the merits of his or her FOIA request.”).

CSS claims that disclosure of the requested records will serve the public interest by revealing information about “(i) HHS’s performance in maintaining and enhancing the quality and efficiency of services provided under the Medicare program, (ii) the agency’s ability to root out Medicare fraud and waste; and (iii) the agency’s compliance with various transparency initiatives.” Appellee’s Br. 21. We examine each contention in turn.

1.

The Congress has charged HHS with “promoting the effective, efficient, and economical delivery of health care services, and of promoting the quality of services of the type for which payment may be made” by contracting with peer review organizations.⁴ 42 U.S.C. § 1395y(g). In 2003, the Congress directed HHS to establish a demonstration program to “examine health delivery factors that encourage the delivery of improved quality in patient care.” Id. § 1395cc-3(b). While CMS has certain responsibilities to promote quality healthcare for Medicare beneficiaries, it is not authorized to “exercise any supervision or control over the practice of medicine or the manner in which medical services are provided, or over the selection, tenure, or compensation of any officer or employee of any institution, agency, or person providing health services.” Id. § 1395.

CMS is also responsible for enrolling health care providers and suppliers, including physicians, in the Medicare program. A “provider” or “supplier” must be enrolled in the Medicare program to receive payment for covered services. 42 C.F.R. §§ 424.505, 424.510. The term “supplier” refers to “a physician or other practitioner, or an entity other than a provider, that furnishes health care services under Medicare.” Id. § 400.202. The term “physician” includes “a doctor of medicine or osteopathy legally authorized to practice medicine and surgery by the State in which he performs such function or action.” 42 U.S.C. § 1395x(r). CMS may exclude from participation in any Federal health care program, including Medicare, “[a]ny individual or entity ... whose license to provide health care has been revoked or suspended by any State licensing authority ... for reasons bearing on the individual’s or entity’s professional competence [or] professional performance.” Id. § 1320a-7(b)(4). CMS may also exclude an individual or entity that “has furnished or caused to be furnished items or services to patients ... substantially in excess of the needs of such patients or of a quality which fails to meet professionally recognized standards of health care.” Id. § 1320a-7(b)(6)(B).

CSS makes three arguments regarding how the requested data will shed light on HHS’s performance of its mission to promote quality healthcare for Medicare beneficiaries. First, it claims that the requested data will indicate the quality of care Medicare patients are receiving. The claim rests on the assumption that the frequency with which a physician performs a medical procedure indicates the quality of the procedure. The medical community has not reached a consensus on whether the number of procedures performed by a physician correlates to the quality of those procedures. Compare John D. Birkmeyer et al., Surgeon Volume and Operative Mortality in the United States, 349 New Eng. J. Med. 2117, 2117 (2003) (“Patients can often improve their chances of survival substantially, even at high-volume hospitals, by selecting surgeons who perform the operations frequently.”), with Ethan A. Halm et al., Is Volume Related to Outcome in Health Care? A Systematic Review and Methodologic Critique of the Literature, 137 Annals Internal Med. 511, 517 (2002) (“Twenty years of research have established that, for some procedures and conditions, higher volume among hospitals and physicians is associated with better outcomes. However, the magnitude of the relationship varies greatly among individual procedures and conditions.... Even when a significant association exists, volume does not predict outcome well for individual hospitals or physicians.”). Even assuming a strong correlation between volume and quality, the data CSS requests will not indicate total volume because it does not include procedures performed by physicians for non-Medicare patients.

Second, CSS claims that the requested data will enable the public to determine if Medicare is paying physicians with insufficient certifications, disciplinary histories or poor evaluations for a large quantity, or any number, of procedures. The public can determine through publicly available information whether physicians with insufficient certifications, disciplinary histories or poor evaluations are enrolled in the Medicare program. See U.S. Dep’t of Def. Dep’t of Military Affairs v. FLRA 964 F.2d 26, 29-30 (D.C.Cir.1992) (recognizing that “alternative sources of information available that could serve the public interest in disclosure” diminish public interest value of disclosure). One can infer without the requested data that an enrolled physician is performing at least some procedures. See 42 C.F.R. § 424.540(a)(1) (CMS may deactivate physician’s Medicare billing privileges if no claims submitted for 12 consecutive months). Currently available information does not enable an individual to know whether a physician with an insufficient certification is performing a large number of (or any) specific procedure, but this added knowledge does not shed any additional light on whether CMS is following its enrollment procedures contained in 42 C.F.R. § 424.510. Cf. Multi AG Media, 515 F.3d at 1231 (requested data indicated entity’s eligibility vel non to participate in federal benefits program).

Third, CSS claims the “requested records can also be analyzed in conjunction with other treatment records to determine whether individual Medicare doctors are providing all services required to reach standards of recommended care.” Appellee’s Br. 24. CSS does not explain how the requested data can be used to perform this analysis. Rather, it cites articles noting that the quality of care delivered to Medicare beneficiaries has room for improvement and greater access to information is necessary for improvement. See Stephen F. Jencks et al., Change in the Quality of Care Delivered to Medicare Beneficiaries, 1998-1999 to 2000-2001, 289 JAMA 305, 305 (2003); Elizabeth A. McGlynn et al., The Quality of Health Care Delivered to Adults in the United States, 348 New Eng. J. Med. 2635, 2643-44 (2003).

Even if the requested data could be used to measure the quality of care provided by Medicare-enrolled physicians, it would not shed light on the “agency’s performance of its statutory duties.” Reporters Comm. for Freedom of Press, 489 U.S. at 773, 109 S.Ct. 1468. CSS argues that the requested data will indicate the quality of care being provided by Medicare-enrolled physicians and thereby permit the public to assess how well CMS is fulfilling its statutory duty to promote quality. But we fail to see how the requested data will allow the public to evaluate the performance of any specific quality-promoting programs CMS has a statutory duty to undertake. The data will not reveal how well the peer review organizations with which HHS contracts to promote quality healthcare are performing their duties, see 42 U.S.C. § 1395y(g), or how well the demonstration program “examinefd] health delivery factors that encourage the delivery of improved quality in patient care.” Id. § 1395cc-3(b). The data will not assist the public in determining whether Medicare is enrolling physicians who do not meet the enrollment requirements. Nor will it enable the public to determine whether CMS is properly excluding physicians who “fail[] to meet professionally recognized standards of health care,” id. § 1320a7(b)(6)(B), because nothing indicates that a physician who performs a procedure less often fails to meet recognized standards of health care.

2.

CSS next contends that disclosure of the requested data will serve the public interest by revealing fraudulent Medicare claims made by physicians. For example, CSS notes that physicians who submit claims for procedures outside their specialties or who submit unusually high numbers of claims in general or for specific procedures may be committing fraud. But CSS has not provided any evidence of alleged fraud the requested data would reveal. In United States Department of State v. Ray, 502 U.S. 164, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991), the Supreme Court rejected the respondents’ “asserted [public] interest [under FOIA Exemption 6] in ascertaining the veracity of the interview reports” prepared by the State Department based on interviews with Haitian nationals involuntarily returned to Haiti. 502 U.S. at 179, 112 S.Ct. 541. The respondents had not presented “a scintilla of evidence ... that tends to impugn the integrity of the reports.” Id. The Court noted: “If a totally unsupported suggestion that the interest in finding out whether Government agents have been telling the truth justified disclosure of private materials, Government agencies would have no defense against requests for production of private information.” Id. Similarly, if an unsupported suggestion that an agency may be distributing federal funds to a fraudulent claimant justifies disclosure of private information, the agency would have no defense against FOIA requests for release of private information.

CSS points to a Government Accountability Office (GAO) report as general evidence that Medicare is especially susceptible to fraud. In 1990, the GAO “designated the Medicare program as high risk for fraud, waste, abuse, and mismanagement, in part because of its sheer size and complexity.” U.S. GAO, GAO 06-813, Medicare Integrity Program: Agency Approach for Allocating Funds Should Be Revised 1 (2006), http://www.gao.gov/new.items/d06813.pdf. In 1997, the Congress established the Medicare Integrity Program, under which CMS contracts with eligible entities to safeguard Medicare payments, including investigating potential fraud cases. Id. at 1, 11-12; 42 U.S.C. § 1395ddd(a), (b)(1). Without more, the GAO’s report does not raise a cognizable public interest under FOIA in verifying that CMS is adequately detecting fraud.⁵ In Multi AG Media, we did find that release of the requested data would serve the public interest by allowing the public to “more easily determine whether [the United States Department of Agriculture] is catching cheaters and lawfully administering its subsidy and benefit programs.” 515 F.3d at 1232. The specific public interest in Multi AG Media, however, was enabling the public “to look at the information the agency had before it when [determining whether a particular farm is eligible to participate in the benefit programs in the first place] so that the public can monitor whether the agency is correctly doing its job.” Id. at 1231. In contrast, the Medicare claims data is irrelevant to whether physicians meet the Medicare enrollment requirements.

3.

Finally, CSS argues that the requested data will shed light on whether HHS is complying with its own transparency initiatives. HHS recently proposed a new system of records “to assist in projects that provide transparency in health care on a broad-scale enabling consumers to compare the quality and price of health care services so that they can make informed choices among individual physicians, practitioners and providers of services.” Privacy Act of 1974; Report of New System of Records, 72 Fed.Reg. 52,-133, 52,133 (Sept. 12, 2007). Since 2001, HHS and CMS have launched quality initiatives “to assure quality health care for all Americans through accountability and public disclosure,” including publicly reporting certain quality measures to aid consumer decision-making. CMS, Quality Initiatives — General Information — Overview, http://www.cms.hhs.gov/Quality InitiativesGenlnfo/ (last visited Jan. 23, 2009).

Contrary to CSS’s assertion, the requested data will not assist the public in determining whether CMS is complying with its transparency initiatives to provide consumers with more information about service providers. First, the public is already familiar with the type of data contained in the Medicare claims database, which includes the diagnosis, the type and place of service and the physician’s UPIN, as evidenced by CSS’s FOIA request. The public does not need the data itself to evaluate whether CMS’s failure to disclose it constitutes a failure to comply with CMS’s transparency initiatives. Nor does the public need the data to evaluate whether the steps already taken by CMS are in fact assisting consumers in making informed decisions. Second, according to CSS’s logic, CMS must disclose any information possibly relevant to consumer health care decision making, regardless of privacy interests, simply because CMS stated its intention to provide more information relevant to consumer health care decisions. CMS has undertaken certain transparency initiatives but at no point has it pledged, or been directed by the Congress, to disclose any information to the public that could possibly assist consumers in health care decisions without regard to any countervailing interest, including the FOIA-recognized privacy interest. See HHS, Value-Driven Health Care Home: Transparency Leads to Change, http:// www.hhs.gov/valuedriven/ (last visited Jan. 23, 2009) (“Transparency is a broad-scale initiative enabling consumers to compare the quality and price of health care services, so they can make informed choices among doctors and hospitals. In cooperation with America’s largest employers and the medical profession, this initiative is laying the foundation for pooling and analyzing information about procedures, hospitals and physician services. When this data foundation is in place, regional health information alliances will turn the raw data into useful information for consumers.”). CSS in fact seeks to use FOIA to compel CMS to comply with its transparency initiatives as CSS views them, not to evaluate whether CMS is fulfilling its duties.⁶

In sum, the requested data does not serve any FOIA-related public interest in disclosure. Accordingly, we need not balance the non-existent public interest against every physician’s substantial privacy interest in the Medicare payments he receives. See Nat’l Ass’n of Retired Fed. Employees v. Horner, 879 F.2d 873, 879 (D.C.Cir.1989) (“We have been shown no public interest in ... disclosure.... We need not linger over the balance; something, even a modest privacy interest, outweighs nothing every time.”). Accordingly, disclosure of the requested data “would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). And even were we to find a FOIA-related public interest in disclosure, it would be negligible at best and insufficient to outweigh the significant privacy interest in non-disclosure. See Painting and Drywall Work Preserv. Fund, Inc. v. HUD, 936 F.2d 1300, 1303 (D.C.Cir.1991) (“attenuated public interest in disclosure does not outweigh the construction workers’ significant privacy interest in the requested information”).

For the foregoing reasons, we conclude that the requested Medicare claims data CSS seeks is exempt from disclosure under FOIA Exemption 6, 5 U.S.C. § 552(b)(6). Accordingly, the judgment of the district court is reversed and the ease remanded for further proceedings consistent with this opinion.

So ordered.

1 . Health service providers and suppliers must enroll in the Medicare program "[t]o receive payment for covered Medicare items or services from either Medicare ... or a Medicare beneficiary.” 42 C.F.R. § 424.505. CMS discontinued the UPIN as of June 2007 and replaced it with the National Provider Identifier (NPI). See CMS, UPIN Directoxy, http:// www.cms.hhs.gov/NonIdentifiableDataFiles/ 08_UniquePhysicianIdentificationDirecto-ry.asp (last visited Jan. 23, 2009). The NPI is a unique identifier used to identify each health care provider or supplier. See CMS, The Who, What, When, Why & How of NPI: Information for Health Care Providers (2006), http ://www. cms .hhs. gov/ MedicareProvider-SupEnrol)/ downloads/EnrollmentSh-eet_WWWWH.pdf. The NPI registry may be searched online at https://nppes.cms.hhs.gov/ NPPES/ NPIRegistryHome.do.

2 . The district court also held that CSS is entitled to the requested information without charge under 5 U.S.C. § 552(a)(4)(A)(iii). Memorandum Opinion at 86-89. HHS does not appeal the fee waiver determination.

3 . HHS also appeals the district court’s determination that the Middle District of Florida’s permanent injunction does not bar disclosure of the requested data from physicians who are AMA members. See Fla. Med. Ass’n, 479 F.Supp. 1291. It argues that under GTE Syl-vania, Inc. v. Consumers Union of United States, Inc., 445 U.S. 375, 100 S.Ct. 1194, 63 L.Ed.2d 467 (1980), a requesting party may not obtain documents under FOIA "when the agency with possession of the documents has been enjoined from disclosing them by a Federal District Court.” 445 U.S. at 384, 100 S.Ct. 1194. As we resolve this appeal on other grounds, we express no opinion as to the merits of the argument under GTE Sylva-nia.

4 . Quality peer review organizations review whether services are reasonable and medically necessary, the quality of services and whether certain services can be performed more effectively and economically on an outpatient basis. 42 U.S.C. § 1320c-3(a)(l).

5 . In Computer Professionals for Social Responsibility v. United States Secret Service, 72 F.3d 897 (D.C.Cir.1996), we found that no public interest would be served by disclosure under FOIA Exemption 7(C), 5 U.S.C. § 552(b)(7)(C), because the requesting party had offered no evidence that the agency was engaged in illegal activity. 72 F.3d at 905. Similarly, in McCutchen v. United States Department of Health and Human Services, 30 F.3d 183, 188 (D.C.Cir.1994), we found no public interest because the "mere desire to review how an agency is doing its job, coupled with allegations that it is not, does not create a public interest sufficient to override the privacy interests protected by Exemption 7(C).” We recognize that the balancing standard for disclosure is different under FOIA Exemption 7(C). See 5 U.S.C. § 552(b)(7)(C) (law enforcement records exempt from disclosure if release "could reasonably be expected to constitute an unwarranted invasion of personal privacy”) (emphasis added). But the rationale of Computer Professionals and McCutchen for requiring more than unsupported allegations that an agency is not doing its job applies under FOIA Exemption 6 as well.

6 . CSS would have us place the public in a position akin to a judge conducting in camera review of documents to determine whether a party must produce information it deems irrelevant. See, e.g., Douglas Oil Co. of Cal. v. Petrol Stops NW., 441 U.S. 211, 236 n. 8, 99 S.Ct. 1667, 60 L.Ed.2d 156 (1979) (Stevens, J., dissenting) (''[Pjetitioners could have requested that the District Judge view the transcripts in camera to test their relevance.”). The problem in the FOIA context is that once the Medicare data was viewed by the public and the public had decided its “relevance” under CSS’s transparency initiatives, the public would have compelled the very action it wished to evaluate and the issue would be moot.