Public Records Request Guide

You can use your state’s Freedom of Information Act (FOIA, colloquially pronounced “foy-yah”) process—sometimes known as sunshine laws or public records laws—to help find out why the state decided to implement a benefits technology system, how they implemented it, and how they are using it. When the system involves automated decision-making systems (ADS), you may also be able to get the algorithm itself or design documents. But overly broad FOIA requests can take a long time to review and can produce significant amounts of unhelpful documents. This guide will help you think through your FOIA request to get the information you want while avoiding some common pitfalls.

You may choose to do FOIA requests in stages, getting some initial information to help you know what other topics, keywords, and documents to use in future requests. Before you submit a FOIA request you should find out what relevant information is already publicly available on the agency website, in media reports, through the state legislature (especially committee hearings), or from other sources who were involved in litigation or have made public records requests. Many people share their public records requests on Muckrock.

Review the FOIA law. There generally aren’t strict requirements about the scope and frequency of FOIA requests, but you can end up wasting time by making too many requests or requests that are too broad. Also, because the state agency is only required to produce existing documents (the agency often does not need to create new documents in response to a request), it can be difficult to get documents that directly answer your basic questions. There are also exemptions in the laws that keep the state from having to produce certain kinds of documents (e.g., personnel files, trade secrets, criminal investigation records, and personally identifiable information). Check your state’s FOIA law before drafting your request in case there are specific request requirements, timelines, or fees. Here is a useful repository of state FOIA laws: https://www.nfoic.org/state-freedom-of-information-laws/. You will likely make state public records requests, but if there are any federal agency records you are trying to access, you can find more information about federal FOIA law here: https://www.foia.gov/faq.html.

Research your topic. To orient yourself, try to determine where the state agency is in the benefits technology system’s development process. Take a look at our Lifecycle Framework to learn more. You can review public information like contracting documents (e.g., Requests for Proposals) and media stories to get a better sense of what documents are likely to exist and what terms the agency uses—which will make your FOIA request more specific and effective.

Think about what specific information you need. There may be in-depth technical specifics, high-level designs, policies, background, and other layers of the issue. You may want to prioritize some information depending on your goals and capacity. Think about what you don’t need to know so you can avoid unnecessarily broad requests. Here are some general topics to investigate when considering making a FOIA request. Our Key Questions Guide lists some specific questions relevant to these general topics.:

The benefits technology system design: the purpose and functionality of the system (e.g., a flowchart, diagrams, design specifications, etc.)

The automated decision-making system: information on any decision-making algorithm and how it operates, including the agency’s documents explaining the workings of the ADS (e.g., input data, decision trees, scoring rubrics/logic, etc.) as well as how it was developed (e.g., training data, design specifications, etc.). Getting information about the data and analysis they used to develop the tool (e.g., an eligibility scoring algorithm) will allow you to flag areas where the agency and vendors made inappropriate discretionary decisions, and can help you identify potential disparate impact based on race, geography, disability, or other factors.

How agency staff use the system: how the system is used in practice, what connection the system has to different outcomes, the amount of human discretion involved, and what reports or monitoring the staff must complete. Here, there may be user manuals, agency policies, or training materials (including presentations) about the system. (Note: When it comes to ADSs, more sophisticated agencies will couch ADSs as just one factor of a larger analytical process (i.e., it just supports human decision-making), so it’s important to understand what parts of the decision are automated and where humans intervene.)

The adoption of the system: the procurement process, how this system was chosen, the problem or need the agency purports the system to address, the people involved in the selection of the system, and who the competing bidders or vendors were

The development of the system: the identity and nature of the consultants/contractors, points of friction or conflict (sometimes between agency staff and consultants or within an agency itself), concerns about the system’s functioning or its impact on affected communities, studies about possible impact or budgetary savings, possible allies in the agency, involvement of or input from the affected community and other stakeholders (if any), draft proposals, and information about what data was used

The implementation of the system: the information that the agency provided to the affected individuals and wider public, the statistics the agency is keeping on the impact of the system, how frequently appeals are made, any complaints the agency has received from affected individuals or elected officials, how the agency is reacting to media reports or lawsuits, any changes the agency is asking the vendor to make, training and monitoring of staff implementing the system, and other quality assurance mechanisms

Greater organizational context: the key decision-makers, lines of authority, written policies (if any), and how other agency matters might have influenced the system

Some benefits technology systems are built, maintained, and used by multiple agencies, intra-agency divisions, or private contractors (Note: private contractors are generally not subject to FOIA laws; check your state’s law to see if FOIA applies to contractors’ government work). Try to determine who has the information you’re seeking so that you can make the request to the right agency. Find that agency’s contact for FOIA requests—most agencies have someone responsible for this.

Generally, FOIA laws are written to enable non-lawyers to have easy access to public records and do not require specific formats. However, the more technical clarity you can offer up front, the fewer opportunities the agency will have to deny a request or ask for extensions of time to produce. At a minimum, you should specify the preferred formats for delivery of documents (electronic or paper, file types, etc.), provide up-to-date contact information for all requesters, and address any issues around fees.

Costs. State FOIA laws vary on fees that may be charged for fulfilling a FOIA request and whether there are exemptions for certain types of requesters, such as public interest or news organizations (see our Model FOIA Request below for language about fee exemptions). You may need to include information about what type of requester you are in your FOIA request in order to avoid being charged fees or having to assert your exemption later. Costs charged by states may be based on pages produced, hours spent on research, or other factors, so check the potential charges before requesting. If the fee seems unreasonably high, it could indicate your request was too broad (or the agency is acting adversarially).

In your request, you can ask for notification of any fees in advance of the agency completing your request. This may also give you an opportunity to narrow the request if the agency’s response seems too broad or costly. Similarly, if requesting an exemption for costs, you can consider asking that you be able to appeal any denial of such an exemption before the fees are assessed.

Note: If you later must sue in response to an incomplete production, the person who submits the FOIA may need to be a fact witness. Similarly, you may need a witness on your team to testify about what the agency produced. Accordingly, it is best to have multiple people on your team review and submit the FOIA request, and to instruct the agency to respond to everyone listed.

See our Model FOIA Request section below.

In practical terms, the agency often identifies responsive documents by using software that searches for key words. Sometimes, Boolean searches are used (a Boolean search is a formula for searching that lets you specify combinations and exclusions of phrases, e.g., “this” and “that” but not “those”). The agency FOIA official will tell the relevant agency staff what your FOIA is asking for, and then ask them to search their records for responsive documents. Agency staff may do so via email searches. It’s useful to construct your search terms the same way the agency will, so there’s no confusion about what they decide to look for.

There are various strategies for precisely describing the information you need, roughly termed here as Topic, Person and Term, or Document References. At the end of this section, there is some additional language to ensure that your request (a) encompasses all e-mails and attachments in a conversation and (b) avoids seeking confidential information (which will incur delays).

Note: Specifically including or excluding emails is a strategic choice. Emails can include important information but may also slow a request down because of the time it takes the agency to sort through them. Depending on timing, you can consider an initial request that excludes emails to discover the most relevant search terms to include in future requests that do include emails.

Topic: Directly name the subject you want information about. You may consider using date limitations to make the information manageable. Examples from previous requests to Arkansas on its ArPath tool and RUGs case mix system:

• All public records created on or after January 10, 2017 pertaining to the ArPath assessment tool or the Resource Utilization Group (“RUG”) case mix system used in the operation of the ARChoices Medicaid program.
• All public records created on or after June 23, 2017 pertaining to the “MnCHOICES” assessment tool, including, but not limited to, all associated instruments, surveys, case-mix systems or indices, tier categories, criteria for tier placement, algorithms, data, review, projections, and studies.
• All algorithms and/or tiering logic used to determine eligibility for the ARChoices and/or Independent Choices programs.
• The ARIA assessment tool used in the ARChoices and/or Independent Choices programs.
• All public records relating to projections, forecasts, studies, data, or research involving the Task and Hour Standards that will be used in the ARChoices and/or Independent Choices programs.
• This request includes, but is not limited to, business processes, algorithms, decision trees, change requests to vendors, requests for proposals, modification requests to vendors, training documents provided to any DHS employee or third-party contractor, and statistical reports.

Person and Keyword: You can use your FOIA request to determine who the key players are. This approach can also be useful in limiting a request that would otherwise be unwieldy (e.g., looking only at what management thought about something and excluding the day-to-day communications that reference a key term). Examples from Arkansas:

• All public records created by, originating from, or sent to Chuck Cloud, Susanna Blocker, Diane Hicks, Candice Gillespie, John Hill, Marco Harlan, Vanessa Evans, Doug Smith, Kris Linck, Jeff Tiner, Bobby Nye, or Carlos Layson on or after September 26, 2017 that include at least one of the following phrases or words (in singular or plural form): “ARChoices,” “algorithm,” “tier,” “case mix,” “index,” “level of care,” “flowchart,” “tool,” “scoring system,” “attendant care,” “care hours,” “acuity,” “instrument,” “allocate,” “allocated,” “allocation,” “MnChoices,” “ARIA,” “patch,” “Individual Services Budget,” “ISB,” “ArPath,” “Resource Utilization Group,” “RUG,” “Fries,” “University of Michigan,” “Center for Information Management,” or “CIM.”

Document References: This is a good way to identify types of documents that have a standard name (e.g., request for proposal, change request) or specific documents you know exist or should exist.

Federal agencies that administer Medicaid (the Center for Medicare and Medicaid Services or CMS), SNAP (Food and Nutrition Services or FNS), and Unemployment (Department of Labor or DOL) often require state agencies to file reports on a regular basis about how a program is working. State legislation may also require certain reports. The names of these reports will be in state or federal laws or regulations that apply to the state agency. Federal agencies may also require states to submit documents like “state plans” or “waiver applications” to enact certain programs. These documents may describe how an ADS works or what kinds of reports are supposed to be produced as part of the program.

Asking for these state plans, waiver applications, and any required reports you can identify is always helpful. And, if the state doesn’t have the document, you have confirmed that the state isn’t doing something it should be.

Examples from Arkansas:

• All public records created on or after June 23, 2017 that include any draft of any change to the section of the Arkansas Medicaid Provider Manual called “ARChoices in Home Care Home and Community-Based 2176 Waiver” (also known as the “ARChoices Medicaid Program Manual”).
• All public records created on or after January 1, 2016 pertaining to the review by Division of Aging and Adult Services RN supervisory staff described as follows in Appendix D-1-g of the “Application for Section 1915(c) Home and Community-Based Services Waiver” for the ARChoices in Homecare program (version with 1/1/16 effective date):
  • “A statistically valid random sample of service plans is determined, using the Raosoft software calculations program, for review by the DAAS RN supervisory staff. Records are reviewed to assess the appropriateness of the service plan, to validate service provision, to ensure that services are meeting the waiver participant’s needs and that necessary safeguards have been taken to protect the health and welfare of the participant and profile provider billing practices. In the event the service plan is deemed inappropriate or service provision is lacking, the DAAS RN addresses any needed corrective action.”
• All public records created on or after January 1, 2016 that have been provided to CMS in accordance with Heading Five (5), Item H of the “Application for Section 1915(c) Home and Community-Based Services Waiver” for the ARChoices in Homecare program (version with 1/1/16 effective date), which states:
  • “Reporting: The State assures that annually it will provide CMS with information concerning the impact of the waiver on the type, amount and cost of services provided under the Medicaid State plan and on the health and welfare of waiver participants. This information will be consistent with a data collection plan designed by CMS.”

Helpful Additional Language: This is standard language that helps avoid problematic agency practices (whether innocent oversight or conscious obstruction) in responding to requests.

• To the extent that the responsive public records are e-mails, please include the full string of e-mails in which the responsive public record occurs and all attachments sent within the string.
• Please note that this request does NOT include any ARChoices program participant’s person-centered service plan, comprehensive assessment report, or notice of action.

You should skim the production right away to get a general sense of responsiveness. If you think something might not be right, you should follow up immediately with the agency FOIA officer. Ask whether the agency is asserting an exemption (e.g., trade secret, competitive advantage, pre-decisional). It can also be useful to ask for the Boolean search formula to ensure that it was constructed properly.

It is worthwhile to engage with the FOIA officer and ask nicely for more information about what related records are available and in what format, so that you can tailor your request. Some officers will work with you to figure out how to answer your questions with the documents they have.

You should start indexing in some way as you go through the documents to minimize overall time spent reviewing. Make sure to keep track of key attachments to documents, including whether you are missing any attachments.

A spreadsheet is generally the most helpful way to track requests, responses, and your general impressions. It is also easy to update as you review. But, if you want to copy and paste lots of text from the documents the agency gives you, you may want to create a text document to accompany the spreadsheet. If you are a lawyer, discovery management practices can be duplicated when reviewing a FOIA production.

In your spreadsheet, you’ll want to distinguish between the subject matter contained in the productions (e.g., 1/25/20 email between Person A and Person B stating concerns with RUGs) and your impressions of the value of that document (e.g., GOLD!! Shows Person B knew of problems no later than 1/25/20).

A few notes:

• Turning the documents into searchable PDFs is helpful, but do not rely on keyword searches as the primary method of review. You will miss important information, as image-to-text conversion doesn’t always work well.
• Be careful about designating documents as “not useful” as you review and index them. If you are looking for something specific in a tight period of time, it’s okay. But, those documents that are “not useful” now may contain information that will prove useful later, and it’s best to have a general sense of what they say to minimize time spent in later review.
• You may want to have your own naming practices in your tracking sheet, but, whatever you do, make sure to keep the original file name so that you have a common frame of reference with the agency.
• Based on your situation, identify key topics that you can use to easily tag documents (e.g., software problems, client complaints, data problems, agency knowledge). For example, if using a spreadsheet, you can make each of these tags a column. Then, you can simply indicate that the topic is discussed (yes or no) or use a scoring system (like 1 to 5) to indicate the depth or relevance of the document on that topic. You won’t necessarily know what your documents contain before you begin, though, so it may take some iteration to decide on helpful tags.

You’ll want to build a running list of thoughts and questions as you review the FOIA. Try to piece together a story from what you’re learning (and identify what you don’t know) and figure out where the next advocacy steps are. Those may include making another FOIA request, asking someone with technical expertise to review the ADS or underlying data, filling in information in a complaint, sharing information with allied organizations or media contacts, building public education materials, or communicating with the people you’re working with.

Note: You will want to keep track of not only everything you know, but also how you know it. It can be helpful to have an internal document where you cite the specific file you got a fact from. Or, you might make a copy of the original file and put the copy in a specific folder.

Note: Assume that you will keep learning more. Again, be careful about “not useful” designations, as later-obtained information may make earlier-obtained information valuable in a way that it wasn’t at first.

Generally, the agency should tell you if it is withholding documents on the basis of protected client information or one of the limited exemptions from disclosure. Similarly, the agency may provide redacted documents or attachments and identify the basis for redactions. However, in many cases, you may not know if the agency is withholding documents and, if so, whether that is by design or accidental. It is particularly difficult if you are not intimately familiar with the agency’s internal workings. You can ask the FOIA officer. You can send a second FOIA request to ask for the search terms the agency used to respond to your first one. You can send a FOIA to ask for any documents responsive to your FOIA that the agency has withheld. You can write the agency’s lawyer to ask for the basis for any withholding. You can also do another FOIA designed to directly get at the documents you suspect are being withheld.

If you have asked nicely and are unable to resolve an incomplete production, promptly consider suing. Consult a local attorney who understands your state’s FOIA law.

Note: As mentioned above, make sure you have multiple people on your team who can serve as witnesses to establish the request, the production, and any back-and-forth regarding production timelines, search terms, etc.

Finally, the fact that an agency is withholding information can be an issue apart from whatever the ADS is actually doing: it may look like the agency has something to hide. Consider whether the agency’s withholding of documents can be used to focus public attention on the underlying issue, engage other affected people, or attract media interest.

July XX, 20XX

Attn: Freedom of Information Act Officer Department of Human Services P.O. Box 1437, Slot S-260 Little Rock, AR 72203

SENT VIA EMAIL to DHS.FOIA@dhs.arkansas.gov

To Whom It May Concern: Please accept this as a request under Arkansas’s Freedom of Information law. See Ark. Code Ann. § 25-19-101 et seq. Legal Aid of Arkansas seeks the following:

(1) All public records created by, originating from, or sent to Chuck Cloud, Susanna Blocker, Diane Hicks, Candice Gillespie, John Hill, Marco Harlan, Vanessa Evans, Doug Smith, Kris Linck, Jeff Tiner, Bobby Nye, or Carlos Layson on or after September 26, 2017 that include at least one of the following phrases or words (in singular or plural form): “ARChoices,” “algorithm,” “tier,” “case mix,” “index,” “level of care,” “flowchart,” “tool,” “scoring system,” “attendant care,” “care hours,” “acuity,” “instrument,” “allocate,” “allocated,” “allocation,” “MnChoices,” “ARIA,” “patch,” “Individual Services Budget,” “ISB,” “ArPath,” “Resource Utilization Group,” “RUG,” “Fries,” “University of Michigan,” “Center for Information Management,” or “CIM.” Please note that this request does NOT include any ARChoices program participant’s person-centered service plan, comprehensive assessment report, or notice of action.

(2) All public records created on or after June 23, 2017 that include any draft of any part of a Center for Medicare and Medicaid Services (“CMS”) “Application for Section 1915(c) Home and Community-Based Services Waiver” involving persons aged 21 to 64 years of age with a physical disability or 65 and older who require an intermediate level of care in a nursing facility.

(3) All algorithms and/or tiering logic that will be used to assign a beneficiary a Needs Intensity Score for each task/activity in the Task and Hour Standards as related to the ARChoices and/or Independent Choices programs.

(4) All public records relating to projections, forecasts, studies, data, or research involving the Task and Hour Standards that will be used in the ARChoices and/or Independent Choices programs.

Please note: To the extent that the public records responsive to any of the above requests are e-mails, please include the full string of e-mails in which the responsive public record occurs and all attachments sent within the string. Also, the above requests do NOT include any ARChoices program participant’s person-centered service plan, comprehensive assessment report, or notice of action.

Legal Aid of Arkansas asks that DHS response be provided in electronic format, either via email or via a CD or DVD with the files copied thereon. Because this request is made for noncommercial purposes and is in the public interest, we request that any fee imposed for the actual costs of reproduction be waived. See Ark. Code Ann. § 25-19-105(d)(3)(A)(iv).

If DHS denies the request for information, we ask that it specify the statutory grounds for doing so. If DHS is unable to fulfill the request within the timeframes allowed by law, please contact us immediately at (870) 987-6543 or at the email addresses below to explain the delay and anticipated production date.

Sincerely,

Name 1, email Name 2, email Name 3, email