UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
CHILDREN’S HEALTH DEFENSE,
Plaintiff,
v. Civil Action No. 23-1016 (TJK)
NATIONAL INSTITUTES OF HEALTH,
Defendant.
MEMORANDUM OPINION AND ORDER
Children’s Health Defense, or CHD, sought records from the National Institutes of Health
about reports of adverse symptoms from COVID-19 vaccinations. The agency produced some
records in full and both withheld and redacted others under FOIA Exemption 6. NIH now moves
for summary judgment, arguing that its search was adequate and its withholdings proper. CHD
cross-moves for summary judgment, asserting that the agency conducted an inadequate search
with respect to two parts of its request and improperly withheld too much of what it found. The
Court agrees that NIH adequately searched for records responsive to the first part of CHD’s request, but not the third. Moreover, with respect to the documents it located in response to the third
part of the request, NIH has not shown that the Exemption 6 withholdings challenged by CHD
were proper.
Thus, the Court will grant NIH’s motion with respect to its search relating to the first part
of CHD’s request, deny CHD’s cross-motion on the same, and otherwise deny the motions without
prejudice. The Court will then allow NIH another opportunity to conduct an adequate search (or
try to justify the search it already conducted) with respect to the third part of CHD’s request and
permit it to take another shot at justifying its withholdings challenged by CHD. I. Background
CHD is a nonprofit organization that “works to end health epidemics” by “eliminating
harmful exposures, holding those responsible accountable, seeking justice for those injured, and
establishing safeguards to prevent further harm.” ECF No. 2 (“Compl.”) ¶ 4. Its areas of concern
include the U.S. government’s “ongoing efforts to promote COVID-19 injections,” including, by
CHD’s account, “spending billions of dollars on injections[,] funding broad-based distribution efforts throughout the United States[,] imposing nationwide vaccine mandates[,] paying billions of
dollars to media sources to promote the injections[,] and working with social media companies to
ensure positive coverage of the injections and to censor other viewpoints.” Id. ¶ 8 (footnotes omitted). It alleges that, in early 2021, NIH researchers “began to hear from individuals . . . experiencing severe, lasting health problems after COVID-19 injection, including neurological, cardiovascular, muscular, and other disorders.” Id. ¶ 12.
On November 10, 2022, CHD sought records from the NIH under the Freedom of Information Act (“FOIA”), 5 U.S.C. § 552, including communications researchers had with (and about)
individuals reporting symptoms after COVID vaccination.1 Compl. ¶ 1, 15. The request included
three parts: (1) “all emails sent to and received from an affected individual”; (2) “[a]ll NIH call
logs documenting communications with affected individuals”; and (3) “[a]ll internal communications between [the] NIH researchers regarding an affected individual, whether the communication
is via email, Teams or other internal communications system.” Id. ¶ 17. CHD defined an “affected
individual” as “any member of the public who experienced a health problem after COVID-19 vaccination, and who contacted NIH to report the problem, or to seek medical assistance or
1
Those researchers are Anthony Fauci, Alkis Togias, Avindra Nath, Farinaz Safavi, Lindsey Gustafson, Brian Walitt, Tanya Lehky, Amanda Wiebold, Angelique Gavin, and Yair Mina. ECF No. 2-1 at 3.
2
information in connection with the problem, or to inquire about or participate in research about
COVID-19 vaccine reactions.” Id. ¶ 16.
Eight days later, NIH responded that CHD’s request was overly broad and advised that it
would close the request “unless CHD clarified [it].” Compl. ¶ 19. On December 15, 2022, CHD
narrowed its request with respect to the first and third parts, requesting records containing any of
10 terms: (1) “vaccin!”; (2) “adverse”; (3) “neurol!”; (4) “autoimmun!”; (5) “clot!”; (6) “suici!”;
(7) “vertigo”; (8) “heart”; (9) “paresthesia”; (10) “lymph!” Id. ¶ 21.2 NIH confirmed receipt of
CHD’s narrowed request the next day, but, by April 10, 2023, had neither produced any documents
nor responded to two of CHD’s emails “inquir[ing] about the request status.” Id. ¶¶ 22–25. So on
April 12, 2023, CHD filed this suit to compel NIH to search for and produce responsive, nonexempt records in compliance with its obligations under FOIA. See generally Compl.
NIH moved to dismiss, but later withdrew its motion and, on August 4, 2023, answered the
complaint. The agency then conducted a search for documents responsive to CHD’s three-part
request. ECF No. 14. It determined that there were no records responsive to the second part of
the request, which sought call logs with affected individuals, and that, with respect to the first and
third parts, all potentially responsive records were exempt from disclosure because they contained
“sensitive personal information,” including “medical test results, diagnoses and treatments” whose
release would cause an “unwarranted invasion of personal privacy.” Id. ¶¶ 7–8. The agency nonetheless offered to re-review the records to determine whether any non-exempt information could
be segregated and released. Id. ¶¶ 8–9.
2
As CHD explained, “the exclamation point (!) following some of the terms indicates that what [it] provided [was] a root, and [it] s[ought] all variants of the root.” Compl. ¶ 21.
3
Over the next year, NIH made 11 document productions to CHD. ECF No. 24 ¶ 9. Of that
production, “[a] total of 405 pages were released unredacted, the bulk of which were blank protocol
consent forms and publicly available journal articles[,] 812 pages were withheld in full[,] and 2,010
pages were partially withheld pursuant to [FOIA] Exemption 6.” ECF No. 29-2 ¶ 35. Exemption
6 allows agencies to withhold “personnel and medical files and similar files the disclosure of which
would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6). CHD
“disagree[d] with certain redactions,” and asserted “that [NIH’s] search was not adequate to uncover all relevant documents.” ECF No. 26 ¶ 10. Unable to resolve these disputes, the parties
cross-moved for summary judgment. ECF Nos. 29, 30.
NIH argues that its search was adequate and its redactions proper under Exemption 6. In
support of its motion, it submits two declarations of its FOIA Officer, Karen Lampe, describing
its search process and the basis for its Exemption 6 withholdings. See ECF Nos. 29-3 (“Lampe
Decl.”), 34-2 (“Supp. Lampe. Decl.”). It also submits a limited Vaughn index describing “information withheld . . . in a random 5% sample of its production to the plaintiff.” ECF No. 34-5
(“Vaughn Index”).3 CHD responds that NIH’s search was deficient because it failed to follow
patently obvious leads, ignored CHD’s requested search terms, and unreasonably narrowed CHD’s
request. ECF No. 30-1 at 24–28. It further argues that the agency improperly redacted “references
to [affected individuals’] treatments, tests, and symptoms.” Id. at 31. Thus, it asks the Court to
order NIH “to conduct an adequate search for records and to lift redactions not justified under . . .
Exemption 6.” Id. at 32.
3
Because FOIA “places the burden on the agency to establish its right to withhold information,” and because there is always an “asymmetrical distribution of knowledge” in FOIA cases, agencies often “produc[e] a Vaughn index, which is an affidavit that indexes and specifically describes withheld or redacted documents and explains why each withheld record is exempt from disclosure.” Schoenman v. FBI, 604 F. Supp. 2d 174, 196 (D.D.C. 2009) (quotations omitted).
4
II. Legal Standard
“FOIA cases typically and appropriately are decided on motions for summary judgment.”
Am. Immigr. Council v. DHS, 30 F. Supp. 3d 67, 72 (D.D.C. 2014) (citations omitted). “Summary
judgment is appropriately granted when, viewing the evidence in the light most favorable to the
non-movants and drawing all reasonable inferences accordingly, no reasonable jury could reach a
verdict in their favor.” Lopez v. Council on Am.-Islamic Rels. Action Network, Inc., 826 F.3d 492,
496 (D.C. Cir. 2016) (citation omitted). “The evidence presented must show ‘that there is no
genuine dispute as to any material fact and the movant is entitled to judgment as a matter of
law.’” Id. (quoting Fed. R. Civ. P. 56(a)). “In the FOIA context, a district court reviewing a motion
for summary judgment conducts a de novo review of the record, and the responding federal agency
bears the burden of proving that it has complied with its obligations under the FOIA.” MacLeod v.
DHS, 15-cv-1792, 2017 WL 4220398, at *6 (D.D.C. Sept. 21, 2017) (Jackson, J.) (citing 5 U.S.C.
§ 552(a)(4)(B)); see also DOJ v. Reps. Comm. for Freedom of Press, 489 U.S. 749, 755
(1989) (“Unlike the review of other agency action that must be upheld if supported by substantial
evidence and not arbitrary or capricious, the FOIA expressly places the burden on the agency to
sustain its action.”) (citation modified).
III. Analysis
A. Adequacy of NIH’s Search
CHD challenges the adequacy of NIH’s search with respect to the first and third parts of
its request, which respectively sought “all emails sent to and received [by any of ten, named NIH
researchers] from an affected individual” and “all internal communications between NIH researchers about an affected individual.” Compl. ¶ 17; see ECF No. 30-1 at 18–22, 23–24. As explained
below, the Court finds that the NIH’s declarations show an adequate search for records responsive
5
to the first part, which seeks agency communications with affected individuals, but not the third
part, which seeks internal agency communications about affected individuals.4
1. NIH’s Declarations Reflect an Adequate Search for Communications
Between NIH Researchers and Affected Individuals
As narrowed, the first part of CHD’s request seeks emails of the ten, named NIH researchers containing any of 10 terms: “vaccin!”; “adverse”; “neurol!”; “autoimmun!”; “clot!”; “suici!”;
“vertigo”; “heart”; “paresthesia”; “lymph!” Compl. ¶ 21. NIH submits affidavits from its “FOIA
Officer” describing its search for emails responsive to the request. Lampe Decl. ¶ 1. Lampe avers
that the NIH had trouble “determining the proper scope of the search” because CHD’s definition
of “affected individual” was “ill-defined” and too “broad.” Lampe Decl. ¶ 13 (internal quotations
omitted). The agency also determined that CHD’s search terms “were not helpful in narrowing
the search because they would likely have pulled in hundreds of thousands of pages nonresponsive
to Plaintiff’s request.” Lampe Decl. ¶ 22. For example, Lampe avers that searching for every root
of “neurology,” as CHD requested, would have “pulled in most, if not all,” of one researcher’s
records, since “the word ‘neurological’ is in [his] signature block.” Id.
Thus, the agency says that it consulted each named researcher to generate search terms
likely to yield records responsive to CHD’s request. Lampe Decl. ¶ 15. In so doing, it “determined
that it would need primary assistance from Dr. [Alkis] Togias,” a Branch Chief in NIH’s Institute
of Allergy and Infectious Disease, because Togias had been “quoted in a news article . . . about
allergic reactions to the Pfizer COVID vaccine” and had compiled emails “to/from individuals
who had contacted him” “with complaints about various [COVID vaccine] reactions” or “to participate in NIH’s study of allergic reactions to” those vaccines. Id. ¶ 18. From Togias’ emails,
4
CHD does not challenge the adequacy of NIH’s search with respect to the second part of its request, which seeks call logs. ECF No. 30-1 at 24–30.
6
NIH generated “search terms that could be used to perform a wider search,” including “vaccin!”—
one of CHD’s requested terms. Id. ¶¶ 19, 23. From those terms, the agency developed a Boolean
string to search for responsive records: “(react* near (15) (vaccin* or shot or Pfizer or moderna))
or (parathesia near vaccin*) or (receive and (vaccin* or shot) and myocarditis).” Id. ¶ 26.
Using that string, NIH conducted “centralized, automated searches of NIH email and communication systems,” in order to “eliminate potential bias . . . introduced . . . by having each custodian conduct their own search manually.” Lampe Decl. ¶ 25. For each custodian, NIH “limited
the ‘From:’ portion to not ‘@nih.gov’ in order to identify individuals contacting NIH,” from outside the organization and “searched the subject lines and body of the emails . . . us[ing] the search
string” it created. Id. ¶ 26–28. Ultimately, that search yielded 3,227 pages of documents responsive to the first part of CHD’s request. Id. ¶ 29.
Lampe’s declaration shows an adequate search for records responsive to the first part of
CHD’s request. When an agency searches for documents requested under the FOIA, it must “show
beyond material doubt that it has conducted a search reasonably calculated to uncover all relevant
documents,” Morley v. CIA, 508 F.3d 1108, 1114 (D.C. Cir. 2007) (cleaned up). The agency
“meet[s] [this] burden by providing a reasonably detailed affidavit, setting forth the search terms
and the type of search performed, and averring that all files likely to contain responsive materials
[] were searched.” Iturralde v. Comptroller of the Currency, 315 F.3d 311, 313–14 (D.C. Cir.
2003) (cleaned up). If the agency does so, the burden then shifts to the requester to point to “countervailing evidence” raising “substantial doubt” “as to the adequacy of the agency’s search[,] . . .
particularly in view of well-defined requests and positive indications of overlooked materials.” Id.
(cleaned up). As explained below, Lampe’s declarations amply satisfy NIH’s burden with respect
to its search for records responsive to the first part of the request, and CHD points to nothing in
7
the record raising “substantial doubt as to [the search’s] sufficiency.” Beltranena v. Clinton, 770
F. Supp. 2d 175, 183 (D.D.C. 2011) (citation omitted).
To begin, NIH’s declarations identify the terms the agency used in conducting its search
and describe how it generated those terms: from a sampling of Dr. Togias’ emails with affected
individuals. Lampe Decl. ¶ 19. They also describe the agency’s search process in detail—explaining that the agency’s Center for Information Technology used the search string to query the
agency’s email and communications systems with respect to the ten custodians at issue, yielding
“email addresses and names of potentially affected individuals with whom [the] custodians communicated with regarding perceived [COVID vaccine] reactions.” Id. ¶¶ 26–30. The agency, as
the declarations explain, then “searched for any communications between the . . . individuals’
email addresses or names and the . . . custodians within the relevant timeframe.” Id. ¶ 28. Accordingly, NIH’s declarations provide “detailed descriptions of [its] . . . databases, the kinds of
information that those databases store, the search terms used[,] and the specific files searched.”
Flete-Garcia v. United States Marshals Serv., 613 F. Supp. 3d 425, 432 (D.D.C. 2020) (citation
modified). Thus, the Court finds that NIH has met its burden to “proffer relatively detailed and
nonconclusory declarations describing its search” for records responsive to the first part of CHD’s
request. Id. (cleaned up).
CHD argues that NIH’s search for records responsive to the first part of its request was
deficient for three reasons: the agency (1) failed to follow “patently obvious” leads; (2) ignored
most of CHD’s preferred search terms; and (3) unreasonably narrowed CHD’s search. See ECF
No. 30-1 at 26–28. Each comes up short.
First, CHD argues that the NIH failed to follow “patently obvious leads” during its search.
ECF No. 30-1 at 24–26. To be sure, an agency must “revise its assessment of what is reasonable
8
in a particular case to account for leads that emerge during its inquiry,” Campbell v. DOJ, 164
F.3d 20, 28 (D.C. Cir. 1998) (cleaned up), and must follow any “clear and certain” leads, Kowalczyk v. DOJ, 73 F.3d 386, 389 (D.C. Cir. 1996). But CHD points the Court to no clear and
certain lead that NIH uncovered, much less one that it ignored. Rather, CHD reasons that, because
NIH’s researchers “possess[] detailed information about the affected individuals with whom they
were communicating,” the agency’s consultations with those researchers about search terms must
have turned up leads. See ECF No. 30-1 at 24–25. And because NIH has identified no such leads,
CHD concludes that NIH must have ignored “the many leads that would undoubtedly have been
provided by the custodians.” See id. CHS’s reasoning is circular, purely speculative, and fails to
identify any convincing lead that the NIH failed to follow. And CHD’s “speculation that [NIH]
failed to exhaust all possible leads does not raise a materially factual dispute to preclude a judgment in [NIH’s] favor on [its] demonstrably adequate search.” Taylor v. Exec. Off. for United
States Att’ys, No. 18-cv-2513 (ABJ), 2024 WL 4253160, at *3 (D.D.C. Sept. 20, 2024); see also
SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1201 (D.C. Cir. 1991) (“Mere speculation that as yet
uncovered documents may exist does not undermine the finding that the agency conducted a reasonable search for them.”).
Second, CHD argues that NIH’s search was inadequate because it improperly disregarded
most of CHD’s desired search terms. ECF Nos. 30-1 at 26–27; 36 at 2–6. In general, “there is no
bright-line rule requiring agencies to use the search terms proposed in a FOIA request.” Physicians
for Hum. Rts. v. U.S. Dep’t of Def., 675 F. Supp. 2d 149, 164 (D.D.C. 2009). Rather, “[f]ederal
agencies have discretion in crafting a list of search terms that they believe[] to be reasonably tailored to uncover documents responsive to [a] FOIA request.” Agility Pub. Warehousing Co. K.S.C.
v. NSA, 113 F. Supp. 3d 313, 339 (D.D.C. 2015) (citation modified). That said, though “a FOIA
9
petitioner cannot dictate the [agency’s] search terms,” courts have held that “the agency must still
provide an explanation as to why the search term was not used.” Am. Oversight v. OMB, 613 F.
Supp. 3d 219, 227–28 (D.D.C. 2020) (citation modified). NIH does just that, explaining that
CHD’s “search terms . . . were not helpful in narrowing the search because they would likely have
pulled in hundreds of thousands of pages nonresponsive to [the] request,” and noting, for example,
that querying all roots of “neurological,” as CHD requested, would have pulled in “most, if not all,
of [one] custodian’s records.” Lampe Decl. ¶ 22. As a result, the agency represents that it sought
input from one of its researchers, Dr. Togias—who compiled his own emails with affected individuals and had been quoted in a in a news article about vaccine reactions—to develop search
terms. Id. ¶¶ 17–18. So, “[b]ased on the [NIH]’s representations, the Court concludes that the
[agency’s] decision not to use [CHD’s] term[s],” but to use instead the terms it developed from
Dr. Togias’ emails, “was reasonably calculated to find responsive materials.” Coffey v. Bureau of
Land Mgmt., 277 F. Supp. 3d 1, 9 (D.D.C. 2017). “Accordingly, because [NIH’s] search terms
[were] reasonable, the Court will not second guess the [agency] regarding whether other search
terms,” including CHD’s, “might have been superior,” nor does it see any basis to “find[] that the
[NIH’s] failure to utilize certain search terms proposed by the plaintiff . . . render[s] the [agency’s]
search . . . inadequate.” Heffernan v. Azar, 417 F. Supp. 3d 1, 11 (D.D.C. 2019) (citation modified).
Third, CHD says that NIH unreasonably narrowed CHD’s request by only searching for
emails with individuals who were either enrolled in a long COVID study or not enrolled in any
NIH study. ECF No. 30-1 at 27–28. To be sure, and by the agency’s own admission, the first
Lampe Declaration is less than clear on this point. But NIH submits Lampe’s Supplemental Declaration clarifying that the agency’s search included “[r]ecords from individuals who contacted
10
NIH about health problems after receiving the COVID vaccine” whether or not they were enrolled
in any study, as well as those “from individuals who did not reach out about health problems[,] . . .
but who were enrolled in the Long COVID study.” Supp. Lampe Decl. ¶¶ 21–22. In other words,
NIH has now represented that individuals enrolled in studies other than the long COVID study
were not “excluded” from its search, as CHD asserted. ECF No. 30-1 at 28. So this argument too
fails to raise substantial doubt as to the adequacy of CHD’s search.
For these reasons, the Court concludes that NIH’s declarations sufficiently show that it
conducted an adequate search reasonably calculated to discover records responsive to the first part
of CHD’s request.
2. NIH’s Declarations Do Not Demonstrate an Adequate Search for Internal Agency Communications About Affected Individuals
The third part of CHD’s request seeks “[a]ll internal communications between NIH researchers regarding an affected individual, whether the communication is via email, Teams, or
other internal communication system.” Compl. ¶ 17. NIH says that, in searching for responsive
records, it determined that the relevant custodians “had no hard copy files for internal communications,” and that it was “unlikely that there were records of written internal communications regarding the potentially affected individuals because,” according to “at least one custodian[,] . . .
internal medical case discussion took place primarily in meetings, as opposed to over email or
written communication.” Lampe Decl. ¶ 30. Accordingly, the agency says, it determined that any
further “search [for] internal written communications” would be “unreasonable.” Supp. Lampe
Decl. ¶ 10.
In support of this assertion, NIH submits the declaration of one custodian, Dr. Avindra
Nath, director of an NIH infectious disease studies. See generally ECF No. 34-4 (“Nath. Decl.”).
Dr. Nath avers that “[d]iscussions about patients typically don’t happen over email, slack,
11
messenger, or other forms of insecure communication.” Nath Decl. ¶ 3. Rather, his team’s
“[s]tandard practice is to discuss patients during Patient Care meetings” in an “active dialogue.”
Nath Decl. ¶¶ 4–5. All this, NIH says, justifies its failure to search for internal communications
about affected individuals, because FOIA “does not demand a search that would be futile.” ECF
No. 34 at 10 (quoting Leopold v. Dep’t of Def., 752 F. Supp. 3d 66, 89 (D.D.C. 2024)). CHD
argues that the declarations by Lampe and Nath are insufficient to show futility, and the Court
agrees.
In general, FOIA requires an agency to “show that it made a good faith effort to conduct a
search” of files and systems “likely to contain responsive materials,” “using methods which can
be reasonably expected to produce the information requested.” Taylor, 2024 WL 4253160, at *2
(citations omitted). That said, because “an agency cannot improperly withhold records that it does
not maintain,” in some cases a search for records would be futile. MacLeod, 2017 WL 4220398,
at *11. In those cases, “the reasonable search required by FOIA may be no search at all.” Earle
v. DOJ, 217 F. Supp. 3d 117, 123 (D.D.C. 2016) (quotation omitted). But to justify a failure to
search on futility grounds, an agency must produce “relatively detailed, nonconclusory” affidavits
“submitted in good faith” which, when “judged . . . in light of the entirety of [their] contents,”
“sufficient[ly] . . . explain why a search would be futile and is unnecessary.” Id. at 123–24 (quotations omitted). NIH’s declarations fall well short of the mark.
Lampe avers that the agency determined, based on input from “at least one custodian,” that
it was “unlikely” the agency had “written internal communications regarding potentially affected
individuals.” Lampe Decl. ¶ 30 (emphasis added). But it is not at all clear what Lampe means by
“written communications”—i.e., whether this assertion applies only to hard-copy documents or
includes electronic media. This distinction is important, of course, because CHD requested not
12
only hard copy documents, but “[a]ll internal communications” about “affected individual[s],
whether the communication is via email, Teams or other internal communications system.”
Compl. ¶ 17 (emphasis added). Thus, even if its custodians disclaimed keeping any hard-copy
documents about affected individuals, that alone would not excuse NIH’s failure to search for
responsive records in electronic format. Indeed, “to restrict its search to certain types of records,
[an agency] must provide adequate justification.” Am. Oversight v. OMB, 613 F. Supp. 3d at 229.
But NIH has not explained why a lack of hard-copy documents would render a search for electronic communications futile.
To be sure, Dr. Nath’s declaration is clearer on this point, asserting that his team’s communications about affected individuals “typically don’t happen over email, slack, messenger, or
other forms of insecure communication.” Nath Decl. ¶ 3. But, for a few reasons, Dr. Nath’s declaration does not establish that further search for internal electronic communications about affected
individuals would have been futile. For one, Dr. Nath does not say that his team never discusses
affected individuals in written electronic communications, only that they typically do not do so.
And NIH based its conclusion that further search for internal communications would be futile—at
least in large part—on Dr. Nath’s “expla[nation] that internal medical case discussions took place
primarily in meetings.” Lampe Decl. ¶ 30; see also Supp. Lampe Decl. ¶¶ 7–10. But “typically,”
like “primarily,” does not mean always—or even almost always.
Indeed, this equivocating language distinguishes NIH’s affidavits from those found sufficient to justify Immigration and Customs Enforcement’s refusal to search for demographic data in
American-Arab Anti-Discrimination Committee v. U.S. Department of Homeland Security. See
516 F. Supp. 2d 83 (D.D.C. 2007). In that case, the court upheld ICE’s refusal to search for “data
on [detainee’s] race, ethnicity, religion, and gender” in light of an agency official’s representation,
13
“based on information with which he [was] personally familiar as well as his conversations with
ICE Counsel and . . . ICE [agents],” “that ‘ICE does not maintain information relating to [ ] ethnicity[ ] and religion.’” Id. at 86 (emphasis added). The court held that the affiant’s “explanation
that ICE neither maintains data on arrestees’ ethnicity or religion nor uniformly collects such information on race is sufficient . . . to explain why a search would be futile and is unnecessary.”
Id. at 88.
Here, by contrast, NIH says only that it is “unlikely” the sought-after records exist because
one custodian’s team “typically” or “primarily” does not exchange written communications about
affected individuals. Those qualified statements hardly establish that a search for internal communications about affected individuals would be futile. See Marshall v. ATF, No. 10-cv-21424,
2011 WL 13268863, at *6 & n.6 (S.D. Fla. Aug. 23, 2011) (agency’s averment that surveillance
video is “generally recorded over . . . after a period of 30 days” did not demonstrate futility of
search for such footage because “generally’ . . . indicates that not all video is recorded over after
a period of 30 days) (emphasis in original).
Moreover, and just as importantly, even if it was “standard practice” on Dr. Nath’s team
not to exchange written communications about patients, neither Lampe nor Dr. Nath aver that
every other custodian named in CHD’s request adopted the same practice. Indeed, as CHD argues,
“even if NIH researchers’ communications about patients in the study described by Dr. Nath were
never memorialized in writing, the declaration as no bearing on communications among researchers outside of the limited context” of that study. ECF No. 36 at 8. The Court agrees. Even if a
further search for internal, written communications in Dr. Nath’s records would have been futile—
and NIH’s affidavits by no means show that it would—that alone would not establish the same for
every other custodian. Cf. Oglesby v. U.S. Dep’t of Army, 920 F.2d 57, 68 (D.C. Cir. 1990) (“[An]
14
agency cannot limit its search to only one record system if there are others that are likely to turn
up the information requested.”).
For all these reasons, the Court does not find that NIH’s affidavits, “in light of the entirety
of [their] contents,” “sufficient[ly] . . . explain why” a further search for internal communications,
including those kept in electronic format, “would be futile and is unnecessary.” Earle, 217 F.
Supp. 3d at 123–24. Thus, on this record, the Court concludes that NIH has not shown that its
search with respect to the third part of CHS’s request was adequate.5
B. NIH’s Exemption 6 Withholdings
Of the 3,227 pages of documents responsive to CHD’s request, NIH produced 405 pages
unredacted, 2,010 pages with partial redactions, and withheld 812 pages in full. ECF No. 30-1 at
30; Lampe Decl. ¶ 34. NIH invokes FOIA Exemption 6 as the basis for its withholdings.
FOIA Exemption 6 allows agencies to withhold “personnel and medical files and similar
files” if their disclosure “would constitute a clearly unwarranted invasion of personal privacy.” 5
U.S.C. § 552(b)(6). When an agency withholds responsive documents pursuant to a FOIA exemption, a court may grant summary judgment if the agency’s “affidavit[s] describe[] the justifications
for withholding the information with specific detail, demonstrate[] that the information withheld
logically falls within the claimed exemption, and is not contradicted by contrary evidence in the
record or by evidence of the agency’s bad faith.” ACLU v. Dep’t of Def., 628 F.3d 612, 619 (D.C.
Cir. 2011).
5
CHD further urges the Court to deny summary judgment to NIH in light of “positive indications of overlooked materials”—i.e., purported emails between NIH researchers about affected individuals. See ECF No. 36 at 10 (quoting Valencia-Lucena, 180 F.3d 321, 326 (D.C. Cir. 1999)). Because the Court concludes that NIH’s affidavits do not demonstrate an adequate search for internal agency communications, it need not reach this argument.
15
CHD argues that NIH has not “provided the detailed justifications” to support its withholdings of de-identified records. ECF No. 30-1 at 30. While CHD consents to NIH’s “redaction of
information that points to particular individuals,” it “seek[s] only to lift redactions of de-identified
mentions of treatments, test, and symptoms in email communications between affected individuals
and NIH researchers,” ECF No. 36 at 10, 12, arguing that the release of this “de-identified” information constitutes, at most, a “de minimis invasion of privacy,” id. at 11 (quoting Pub. Citizen
Health Rsrch. Grp. v. Acosta, 363 F. Supp. 3d 1, 15 (D.D.C. 2018)). The Court agrees that the
agency has not met its burden to show that it may withhold de-identified records in full or in part
under Exemption 6.
1. The Withheld Information is a Medical or Similar File
“When confronted with a challenge to a withholding of agency records on the basis of this
exemption, courts must make a two-step determination de novo, see 5 U.S.C. § 552(a)(4)(B)
(1976): whether the information sought is to be found in personnel, medical or similar files, and if
so, whether its release would constitute a ‘clearly unwarranted invasion of personal privacy.’”
Arieff v. U.S. Dep’t of Navy, 712 F.2d 1462, 1466 (D.C. Cir. 1983).
At step one, the Supreme Court has taken a “broad, rather than a narrow” view of the phrase
“similar files,” holding that “all government records containing information that applies to or identifies a particular individual satisfy the threshold test of Exemption 6.” Wash. Post. Co. v. HHS,
690 F.2d 252, 275 (1982) (emphasis added). Here, NIH represents that the material at issue includes “the names, ages, and family history of the individuals who requested help with alleged
vaccine reactions, detailed medical histories, medications used to treat conditions, and results of
lab tests.” Lampe Decl. ¶ 36. The Court finds that this information constitutes “similar files”
16
within the meaning of Exemption 6. CHD does not meaningfully argue otherwise, as it focuses
on the second step.
2. NIH Has Not Shown More than a Mere Possibility that Release of the
Withheld Information Risks Reidentification of any Particular Individual
Step two asks whether the release of the redacted information would constitute a “clearly
unwarranted invasion of personal privacy,” Arieff, 712 F.2d at 1466. At this stage, the Court must
determine “whether disclosure” of the withheld information “would compromise a substantial, as
opposed to a de minimis, privacy interest.” Hum. Rts. Def. Ctr. v. U.S. Park Police, 126 F.4th 708,
713 (D.C. Cir. 2025) (quoting Niskanen Ctr. v. Fed. Energy Regul. Comm’n, 20 F.4th 787, 791
(D.C. Cir. 2021)). If—and only if—the Court finds that disclosure would invade a substantial
privacy interest, then it must balance the harm to that interest “against the public interest in the
release of the requested information” to determine whether invocation of the exemption is proper.
Acosta, 363 F. Supp. 3d at 14.
The general rule governing de-identified information under Exemption 6 is that “disclosure
of . . . personal information constitutes only a de minimis invasion of privacy when the identities
of [particular individuals] are unknown.” U.S. Dep’t. of State v. Ray, 502 U.S. 164, 176 (1991);
see also Dep’t of Air Force v. Rose, 425 U.S. 352, 375 (1976) (“[D]eletion of names and identifying characteristics of individuals would in some cases serve the underlying purpose of exemption
6.”) (quoting 120 Cong. Rec. (1974)). And “[a]n item of exempt information [because it is personally identifiable] does not insulate from disclosure the entire file in which it is contained, or
even the entire page on which it appears.” Arieff, 712 F.2d at 1466. “[E]ven with names” and other
personally identifiable information redacted, courts have recognized that “subjects . . . can often
be identified through other, disclosed information,” Reps. Comm. I, 489 U.S. at 769, particularly
where “sufficiently motivated members of the public might be able to link the information to
17
specific individuals,” Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 877 (D.C. Cir.
1989)—a process NIH calls “re-identification,” Supp. Lampe Decl. ¶ 20.
Thus, courts have held that agencies may withhold parts of a record which, if disclosed,
would on their own or in combination with other public information, identify a particular individual in a manner that implicates a significant personal privacy interest. Rose, 426 U.S. at 381; Reps.
Comm. I, 489 U.S. at 769. But “an agency withholding records on [this] ground . . . must . . .
establish more than a ‘mere possibility’ that the [withheld] information . . . can be linked to a
particular individual.” Acosta, 363 F. Supp. 3d at 17 (quoting Arieff, 712 F.2d at 1469); see also
Citizens for Env’t Quality, Inc. v. U.S. Dep’t of Agric. (“CEQ”), 602 F. Supp. 534, 538 (D.D.C.
1984) (“To establish the existence and extent of any invasion of privacy created by disclosure,”
the agency defendant “must first show that the public would be able to link the disclosures requested by plaintiff with [a particular individual],” and “the likelihood of such identification must
be more palpable than [a] mere possibility.”) (cleaned up) (emphasis added).
Here, NIH argues that the risk of re-identification from disclosure of the withheld, deidentified information is high because “the individuals communicating with NIH had very specific
and unique ways of describing their medical information,” and so “[e]ven if individual portions of
someone’s medical history do not reveal who the individual is, the combination of all the medical
information the individuals submitted to NIH[] could reveal the identities of the individuals and
medical information that they would not want revealed to the public at large.” Lampe Decl. ¶ 42.
Although “the Court does not disagree with this proposition in the abstract,” Acosta, 363 F. Supp.
3d at 16, it does not find that NIH’s affidavits and sample Vaughn index adequately demonstrate
a risk of reidentification with respect to any particular individual. Indeed, as explains below, most
18
of NIH’s asserted bases for withholding the de-identified records at issue are conclusory, speculative, or assert no reidentification risk at all.
To begin, the agency asserts that the withheld, de-identified information at issue poses a
reidentification risk because “the individuals communicating with NIH had very specific and
unique ways of describing their medical information,” and so “[e]ven if individual portions of
someone’s medical history do not reveal who the individual is, the combination of all the medical
information the individuals submitted to NIH[] could reveal the identities of the individuals.”
Lampe Decl. ¶ 42. But this sweeping characterization of the withheld information will not suffice.
Affidavits supporting redaction under a FOIA exemption must “contain reasonable specificity of
detail,” Hum. Rts. Def. Ctr., 126 F.4th at 713 (emphasis added) (citation omitted), and “conclusory
and generalized allegations of exemptions are unacceptable,” Morley, 508 F.3d at 1114–15
(cleaned up); see also CEQ, 602 F. Supp. at 539 (holding agencies cannot justify withholding
under Exemption 6 with “conclusory allegations unsupported by factual data”) (quoting Exxon
Corp. v. FTC, 663 F.2d 120, 126–27 (D.C. Cir. 1980)). Indeed, “[u]nder FOIA, [the] defendant
has the burden of showing affirmatively the applicability of any exemption it seeks to assert, with
. . . exemption 6 [imposing] as heavy a burden as can be found anywhere in the Act.” CEQ, 602
F. Supp. at 539. Merely representing that affected individuals generally described their medical
information in “unique” and “specific” ways does not meet this heavy burden—for it says nothing
about the risk of reidentification as to any “particular individual.” Acosta, 363 F. Supp. 3d at 16.
NIH’s sample Vaughn index fares no better. There, several of the agency’s asserted justifications are conclusory or speculative as to the purported risk of reidentification; other justifications fail to even assert any risk of reidentification. For instance, several entries in the index assert,
as a basis for redacting medical information, some variation of: “[the] information . . . would
19
constitute an unwarranted invasion of personal privacy and harm to the individual if re-identified.”
Vaughn Index at 8, 10, 16-18, 20, 22-24 (emphasis added). But an assertion that harm would result
from re-identification is no substitute for establishing more than a mere possibility that re-identification will occur. Several other entries assert, in one way or another, that the redacted content
“could be combined with other information in this and related email threads to re-identify the
affected individuals.” E.g., id. at 3. But it is not sufficient for an agency to “only speculate[] that
disclosure of such information . . . could amount to an invasion of privacy” of specific individuals.
Cuban v. SEC, 744 F. Supp. 2d 60, 85 (D.D.C. 2010) (cleaned up), on reconsideration in part, 795
F. Supp. 2d 43 (D.D.C. 2011). Rather, “the defendant, who carries the burden, must do more than
that to demonstrate a clearly unwarranted invasion of personal privacy.” Id.
Still more entries seek to withhold discussions of medical advice and test results due to
“the [potential that] medical advice intended for a specific individual [could] be misunderstood by
or misrepresented to the public as medical advice.” E.g., Vaughn Index at 2. This justification,
while perhaps a legitimate concern, has nothing to do with the legal standard at issue. Exemption
6 “was designed to protect individuals from public disclosure of intimate details of their lives,”
and this explanation does not help the agency “explain how th[is] information trammels on [any
affected individual’s] personal privacy.” Humane Soc’y of U.S. v. Animal & Plant Health Inspection Serv., 386 F. Supp. 3d 34, 43 (D.D.C. 2019).
To be sure, the Court does find that some of NIH’s explanations inch closer to providing
the specific detail necessary to demonstrate more than a mere possibility of reidentification. For
instance, in support of one redaction, the agency explains that the “individual provided information
on their medical history, medical test results, disability status, age, employment information and
geographic information. . . . These factors, particularly when combined, could be used to re20
identify the individual.” Supp. Lampe Dec. ¶ 19. In another, NIH explains that “[t]he [affected
individual’s] symptom time frame could be used in conjunction with other information in this and
related email threads to help re-identify the individual. The affected individual states that they
have contacted several other government officials whose emails are also subject to FOIA, increasing the potential to reveal additional information leading to the re-identification of this affected
individual.” Vaughn Index at 5. But, on the whole, NIH’s affidavits and sample Vaughn index do
not show, with reasonable specificity, more than a mere possibility that the disclosure of the withheld information in de-identified records could be linked to any particular individual.
For these reasons, NIH’s current affidavits are “legally insufficient for [the Court] to conclude either that defendants have met their obligations under the FOIA or that plaintiff is entitled
to a judgment in its favor.” Defs. of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 93 (D.D.C.
2009). Accordingly, the Court will permit the agency to renew its motion with additional declarations and other supporting materials, including any submission it may seek to provide under seal
and ex parte, to support its withholding of the de-identified information that CHD argues should
be disclosed.6
6
NIH further asserts that its withholdings are proper because “many of the potentially affected individuals [who contacted NIH] were screened for or enrolled in one of [three COVID-19] studies,’ which ‘provided certain privacy guarantees’ . . . limiting the release and/or use of their data and information.’” ECF No. 29 at 16 (quoting Lampe Decl. ¶ 37). “While such a pledge is clearly not dispositive on the question of whether disclosure would create an invasion of privacy, and, if so, the extent of that invasion, the court recognizes that a good faith pledge of confidentiality should generally be given weight on the privacy side of the scale in accord with its effect on expectations of privacy.” CEQ, 602 F. Supp. at 538 (citation omitted). But the Court need only to weigh the public interest in disclosure against privacy interests if the “defendant [can] first show that the public would be able to link the disclosures requested by plaintiff” to a particular individual. Id. Because, as the Court has explained, NIH has not adequately done so here, “it is not necessary,” at this stage, “for the court to resolve the balance between any invasion of privacy and the public’s interest in disclosure.” Id.
21
IV. Conclusion and Order
For all the above reasons, it is hereby ORDERED that NIH’s Motion for Summary Judgment, ECF No. 29, is GRANTED IN PART and DENIED WITHOUT PREJUDICE IN PART,
and CHD’s cross-motion, ECF No. 30, is DENIED IN PART and DENIED WITHOUT PREJUDICE IN PART. It is further ORDERED that the parties shall file a joint status report by
September 25, 2026, informing the Court how they propose to proceed concerning the remaining
issues in this case.
/s/ Timothy J. Kelly
TIMOTHY J. KELLY
United States District Judge
Date: August 25, 2026
22