I own a small company that specializes in obtaining information from public and proprietary sources.  We then take this information and try to make it easier for the average user to browse and work with.  For this service, subscribers pay a small monthly fee.  Most of the information we work with is is related to Medicare and Medicaid financial data.

We have obtained the information we have requested from most of the U.S. states with very few problems arising.  We try to make it as easy as possible for the state agencies and offload most of the processing and parsing of the data to our developers.  The agencies usually comply within a week or two and send everything we asked for on a CD, or if they are really good they’ll send it through an online file transfer service.  Throughout all of these transactions, the worst thing that’s happened is a confused employee that wasn’t sure if they had the requested data.  That is, until contacting the Alabama Medicaid Agency.

The request for data from Alabama began as they have for all the other states.  As with all the other states, it’s unusually difficult to find the right person to talk to in order to get the data you want.  Usually after 10-15 minutes of referrals or continuous promises to have someone call you back, you finally find the right person.  After finding the right person, you still have to ask for the data the way they are accustomed to referring to it, which of course I don’t know initially. I finally found the person in charge of nursing home auditing, Keith Boswell, who was also in charge of the data I wanted to request.  This of course would be the beginning of a 3-4 month ordeal that is still unresolved and I believe there have been many violations of the Alabama Open Records Act in the Alabama Code throughout this entire period.

I’m going to now provide as much detail as possible about these 3-4 months, from which it should be obvious that there has been a violation of Alabama law as well as plenty of government inefficiency and waste.

Cast

Me – Chase Gray
Carol H. Steckel – Alabama Medicaid Commissioner – 334-242-5600 – Carol.Steckel@medicaid.alabama.gov
Stephanie Mcgee Azar – Deputy General Counsel, Alabama Medicaid Agency – 334-242-5126 – Stephanie.Azar@medicaid.alabama.gov
Mattie Jackson – Executive Assistant – 334-353-4361 – Mattie.Jackson@medicaid.alabama.gov
Keith Boswell – Provider Audit/Reimbursement – 334-242-2311 – Keith.Boswell@medicaid.alabama.gov
Terrell Flowers (only passively involved) – Information Systems – Terrell.Flowers@medicaid.alabama.gov

Org Chart for Alabama Medicaid Agency in order to see where these state employees are in relation to each other.

Initial Interaction

As mentioned earlier, I initially spoke with Keith Boswell in charge of provider audit/reimbursement.  He seemed to know which data I was interested in, but they only provided it through paper copies.  This has been a problem in the past when the person I was speaking with never had to provide anything except the paper copies.   Usually through a little discussion of their system it has been simple to determine what types of electronic files they have in order to make the right request. It is actually much less time-intensive and the agency saves a lot of resources by simply providing a data dump instead of making thousands of copies and tying up a state employee’s time for so long.

Through my discussion with Keith I was able to determine that they did indeed have the data in an electronic form, but they did not have the expertise to export it in any way. The state agency had some software developed for them and so there was no internal knowledge about how it stored its data.  I’ve come across this a lot and it appears to be a bit of a recurring problem.  I don’t remember exactly but to summarize, the conversation went a bit like this:

Me: I’m looking for data from the medicaid reports nursing homes submit to your agency.
Keith: We do provide those in paper form, it will be $30 per report, if you want them all that would be a big task and could cost thousands of dollars.
Me: Do you have the data in any sort of digital or electronic format?
Keith: No sir, we only can provide it in paper form.
Me: How do you view the data?
Keith: On my computer, we have this program…
Me: Then what I am requesting is the database that program is using.
Keith: I’m sorry, but we don’t have access to those, they are inside the program.  Also, there are some social security numbers on one of the reports which we normally manually redact from the paper reports.
Me: I thought as long as you had the data available in a certain form, it was could be requested under the open records act.
Keith: You can speak with our legal counsel, Stephanie Azar….

Of course this is from memory and there was much more drilling down on my part to figure out just what they had available and what the difficulty was in extracting it.

The next step seemed to be to contact Ms. Azar.  I called and left a voicemail, with no reply.  I also then followed up with an email.  I assumed I would get a reply in some sort of reasonable time frame.  This was not true unfortunately, and I set aside Alabama for the time being and moved on to other work.  I wouldn’t get back to it for several months.

Months Later

I finally came back to the missing state data of Alabama a few months later.  This time it was the only state left that we hadn’t made any progress on.  I called up Keith Boswell again to refresh my memory about what I needed to do to put in a request.  From him I learned that they use custom software called Medimax, from a company of the same name.   Since they did not have the ability to export data from their software, I offered my company’s services for free to create a tool that could export this data. He seemed receptive at first to the possibility of this, and I began by taking a look at the Medimax software.

Medimax

I didn’t have too high hopes for the software when I noticed the web site, especially the little animated gif . Simply by installing and running the program, it was apparant that it stored all of the data in a folder called ‘data’ in .ADT files.  I came to learn that .ADT files were created by an embedded Advantage Database Server library in the application.  I even gave the developers a call and tried to talk with them a little about my situation.  It was a long phone call, but I lost hope near the beginning when there were lots of late 90s buzz words and ‘enterprise’ talk.  I almost felt like I was trying to be sold the services of this other software company who had a website with a little animated flame gif.  I had the information I needed though.  These .ADT files contained the information I needed, even though there wasn’t a clear way on how to automate the process of parsing all of it (see my previous post on extracting data from ADT files).  So there was no reason to create a tool to extract the data, when the ‘data’ folder contained everything I was interested in.  It was even separated very cleanly into files by section so the sensitive SSN data could be removed easily.

First Unfair Denial

So I felt confident now knowing exactly what I was requesting and hopeful that it would be easy for me and the agency to simply burn them and send them on a CD.  I called Keith back, I was already beginning to feel like a bother, and explained that I simply wanted to obtain these files.  I said it would be very easy  to get these and remove any sensitive data.  He seemed a bit frustrated now, and seemed to close up with a generic response such as, “We’re not required to provide electronic copies”.  I was asking for files that represented a database of course, not copies of anything that existed before them.  By this time I had spent some time with my attorney friend and went over the Alabama low briefly to make sure that I wasn’t in the wrong by asking for these files. I had a basic understanding of what was required, which I thought would have been sufficient.  At the first mention of any of the Alabama code or previous case law Keith became kind of hostile, in my opinion.  He got very defensive and raised his voice and told me, “You’re going to have to speak to our legal department.”  I tried to explain that I wasn’t trying to cause trouble, but just make a perfectly allowed request.  He responded by telling me, “Please stop calling, you are bothering me and wasting my time.” I was pretty amazed to hear this from a state employee, especially since I wasn’t being aggressive in the slightest.  Obviously I was going to have to go to someone else before getting anywhere.  Back to Stephanie Azar.

To summarize, I called and emailed Azar several times over the next week or two without a single response.  Finally I got a call from someone named Mattie Jackson whom I had been referred to since Stephanie Azar had apparently been receiving all my messages.

I had a very similar conversation with Mattie as I did with Keith.  She was much more formal about it and referred to “policy” that they don’t provide “electronic copies” and only have the paper reports.  I quickly asked for an email so I could send in a detailed request explaining it thoroughly.

Before beginning the email exchange I decided to defer some more general questions to some higher offices. I talked with several people at the governor’s office and the attorney general’s office.  Some of them were very helpful and understood my problem.  One of the attorney’s at the AG office answered my questions by listing off all the circuit courts that I might have to use in order to file a lawsuit.  I think it’s a really messed up system where the only way to question a possibly uninformed state employee’s decision is to file a lawsuit and waste 10s of thousands of dollars in attorney fees that will mostly not be reimbursed. That is a much bigger problem though.  I felt a sliver of hope when someone at the governor’s office informed me that the commissioner of the Alabama Medicaid Agency, Carol Steckel,  might be able to answer my questions and provide assistance.

What follows is the emails that were sent back and forth over a couple months between Mattie Jackson, Myself, Stephanie Azar, Keith Boswell, and Carol Steckel.  There has been no telephone conversation since.

Email Exchange

Feb 19th 2010 : Chase Gray –> Mattie Jackson

Hello,

Thanks for returning my call.

I own a company called Ratchet Software LLC.  We specialize in providing software that analyzes and organizes medicaid and medicare cost report data for vendors and nursing homes.   For example, if a dietary contract provider wanted to determine which county they should focus their next sales effort, they could make a better informed decision if they knew the statistics about dietary spending around the state.

Because we do data processing, printed reports or PDF digital copies of reports are not useful.  This is why we request the database of information because it contains structure and contextual data that is lost when converted to a printed form.  We are interested in this structural data because it allows us to automate the processing of the data.  Because of this, we would argue that the electronic database files and the actual cost reports do not contain the same data.

The Alabama Medicaid Agency uses Medimax software to process submitted cost reports.  This software uses database files ending in a .ADT extension which are not proprietary to Medimax, these are Advantage Database Server files.  These are the files that contain the data as well as the structure that we are interested in.   One problem when requesting the data is that the users of the Medimax software do not know that the data is stored in files inside the Medimax directory.

One issue that arose is that the cost reports contain a schedule that contains sensitive information.  This schedule is contained inside three specific files that correlate with the schedule name.  The schedule is D9 and the files are D-91.ADT, D-92.ADT, and D-93.ADT.

We are making a request for the following:

1. On a computer that has the Medimax software with all of the cost reports from 2008 uploaded to it.  This means that the user can open up the Medimax ALCR viewer and browse the cost report folders for 2008. 
2. On this computer the Medimax software is most likely under this directory, C:\Program Files\MediMax\ALCRV19  since this is the default installation directory.
3. In this directory there is a folder called Data.  This is where all the uploaded data gets stored.  
4. We are requesting any “folders” inside this data directory with the files D-91.ADT, D-92.ADT, and D-93.ADT deleted from each folder as they contain sensitive information.

Those folders each represent the data for a single facility’s submitted cost report.  Each .ADT file is for a schedule or a section of a schedule.

We would like the modified folders to all be burnt to a CD (they should fit fine) or sent over the web if someone knows how to do that there.  They would be too large for email most likely.

Please let me know before incurring any cost over $100.

Thank you,

Chase Gray
Ratchet Software LLC

I received a pretty quick acknowledgment. I would soon learn this would only happen for things they wanted to answer. Otherwise it would take weeks just to provide usually a one sentence answer.

Feb 19th 2010 : Mattie Jackson –> Chase Gray

Thanks, I will get back to you next week.

Mattie M. Jackson  |  Administrator, Office of the Commissioner /Alabama Medicaid Agency/ 501 Dexter Avenue  Montgomery, Alabama 36104 |  P:334.353.4361/ F:242.5097/ C:467.7105/ mattie.jackson@medicaid.alabama.gov

The following Monday I would receive what I consider a pretty ridiculous response. Mattie cites legislature being in session as one of the reasons for declining my request?  There are many reasons they could try to use to decline my simple request, but is this one even legal? There do appear to be legal consequences for declining information requests when they should have legally been fulfilled.  I’m sure they never happen, but I just can’t believe this was the response.  Isn’t legislature in session a significant portion of the year? In Alabama the normal session lasts 105 days according to Wikipedia. This was a total brush off and from this point on it was apparent that I wasn’t going to be taken very seriously.

Feb 22nd 2010 : Mattie Jackson –> Chase Gray

The Alabama Medicaid Agency is very proud of the services we provide to our clients and appreciates your interest in helping us to better serve the needs of our clients.  Unfortunately, with our Legislature in Session and many other initiatives, staff time and resources are limited; therefore, we will not be able to honor this request.

Thanks, Mattie

Feb 22nd 2010 : Chase Gray –> Mattie Jackson

Hello Mattie,

Would you be able to clarify that the information is available/requestable and the only reason the request is denied is due to time current time constraints?

Thanks,

Chase Gray

What’s interesting about the following response is that they declined my request without actually determining whether the data exists or is able to be requested.  From the following reply I get the impression that there was no attempt to fulfill the request at all.

Feb 22nd 2010 : Mattie Jackson –> Chase Gray

No, we did not go as far as to make that determination.

Thanks

Mattie M. Jackson  |  Administrator, Office of the Commissioner /Alabama Medicaid Agency/ 501 Dexter Avenue  Montgomery, Alabama 36104 |  P:334.353.4361/ F:242.5097/ C:467.7105/ mattie.jackson@medicaid.alabama.gov

Of course now I’m very interested in determining for what legal reasons my request is being declined.  I would accept a clear reason citing some case law or something from the Alabama Code.

Feb 22nd 2010 : Chase Gray –> Mattie Jackson

Can you cite where in the Alabama code I can read how my request can be denied completely due to time and not simply delayed a reasonable amount of time?

Feb 22nd 2010 : Chase Gray –> Mattie Jackson

Hello Mattie,

Do you have a fax number that our attorneys or myself can send documents to?

Thanks,

Chase Gray

I never got a response citing any legal reasons why my request was declined.  I did receive the following reply immediately when asking for their fax number.

Feb 22nd 2010 : Mattie Jackson –> Chase Gray

Certainly, 334-242-5097

Mattie M. Jackson  |  Administrator, Office of the Commissioner /Alabama Medicaid Agency/ 501 Dexter Avenue  Montgomery, Alabama 36104 |  P:334.353.4361/ F:242.5097/ C:467.7105/ mattie.jackson@medicaid.alabama.gov

The original supposed reason my request was declined was due to time constraints, so this is all I had to work with.  I felt that copying a folder off of a computer and deleting a few files within them would be much less time consuming than making thousands of copies.  These copies then have to be redacted.

Feb 22nd 2010 : Chase Gray –> Mattie Jackson

Hello Mattie,

Can you specify the difference in time spent from a standard request for paper cost reports, which I was told was a standard request that is fulfilled regularly.

Your initial email implies that the request would take longer than a standard one so it must be denied.  A standard request requires printing every report out and manually redacting information on all of them.

I’m just hoping for clarification on which part of the process was going to consume a large amount of time.

Thanks,

Chase Gray

I don’t know exactly why I was sent the following information if there was never any intention to fulfill my request.  I was given some false hope thinking that things were finally starting to work out like they should.

Feb 22nd 2010 : Mattie Jackson –> Chase Gray

See information extracted from the Agency’s Code regarding data request:  We will be more than happy to provide your requested data at our staff’s convenience if you want to have this data copied or have the data ran by our Statistical Support Unit at the costs specified below:

A request for one to ten copies of one-sided copier imprints shall be provided for a minimum charge of $5.00.  When more than ten copies are requested, the minimum charge of $5.00 shall be assessed for the initial ten copies plus fifty cents for each additional imprint.  This schedule of charges will cover the administrative cost of copying the requested material.

In addition to making the actual copies of printed documents, there is often a considerable amount of staff time involved in research and compiling of information.  A record of the staff time spent on each project will be kept and charged at the rate of $15.00 per hour.

Less than 30 minutes:              no charge

First 30 – 60 minutes:               $15.00

Each additional 30 minutes:     $  7.50

Additionally, there is a $38.00 per hour charge if our Statistical Support Division runs the data.

Please let me know how you’d like for us to proceed, or if you want staff to compute the cost to run the data requested. Also, I am not certain if what you are asking for is available electronically, but will find out tomorrow from the director of this unit and let you know.

Hope this helps, Mattie.

Mattie M. Jackson  |  Administrator, Office of the Commissioner /Alabama Medicaid Agency/ 501 Dexter Avenue  Montgomery, Alabama 36104 |  P:334.353.4361/ F:242.5097/ C:467.7105/ mattie.jackson@medicaid.alabama.gov

Feb 25th 2010 : Chase Gray –> Mattie Jackson

Hello Mattie,

Are you able to provide an estimate on price and time that it will take to obtain the requested data?

Thanks,

Chase Gray

Mar 1st 2010 : Mattie Jackson –> Chase Gray

Staff is reviewing this request.  Hope to have something to you this afternoon or early a.m.

Thanks.

Mattie M. Jackson  |  Administrator, Office of the Commissioner /Alabama Medicaid Agency/ 501 Dexter Avenue  Montgomery, Alabama 36104 |  P:334.353.4361/ F:242.5097/ C:467.7105/ mattie.jackson@medicaid.alabama.gov

Mar 9th 2010 : Chase Gray –> Mattie Jackson

Hi Mattie,

I was wondering what the status is of the information request?  In the previous email you said you would get back to me within a day or so. 
The information doesn’t need to be converted in any way, just files burnt to a CD with the sensitive information removed as detailed in the original email.

Let me know if there are any issues,

Thanks,

Chase Gray

My request is declined again.  This time they inform me that the data is not available in the form I requested.  At this point I could not say 100% that it was there, but I was pretty positive their Medimax software stored all of the data in ADT files.  For some reason programming languages are brought up, which would only be required if they were attempting to automate the process I suppose.  Pointing and clicking on folders and moving them to the burn folder is what I was hoping would be done to fulfill my request, despite this being inefficient.

Mar 9th 2010 : Mattie Jackson –> Chase Gray

I apologize for the delay in responding.  With limited staff due to the statewide budget crisis affecting Medicaid as well as the state of Alabama, there are various staff constraints I am certain you can understand.

You requested the cost report in electronic format.  Since the report contains protected health information, we can only provide a hard copy after redacting the PHI.  There’s a $30 fee for each copy.  To provide the data you are requesting in a hard copy form requires massive copying after removing the PHI.  This information is not available in the form you requested.  Additionally, we do not have neither the expertise nor the time to learn the programming language to get this information in the format you requested.

The information I provided in the email below regarding cost does not relate to cost reports, so disregard.  It only applies to request to run and copy queries.

Thanks, Mattie

Mattie M. Jackson | Medicaid Administrator| Office of Commissioner Steckel |Alabama Medicaid Agency |501 Dexter Avenue |Montgomery, Alabama 36104|  P:334.353.4361| F:242.5097 | C:467.7105| email: mattie.jackson@medicaid.alabama.gov

Mar 9th 2010 : Chase Gray –> Mattie Jackson

Hi again,

I am not interested in digital copies of the cost report.  I do understand that these contain sensitive information.  I am interested in the electronic files that already exist that make up the database.  Like I specified in the original email, each filename refers to a schedule.  The sensitive information that is usually redacted is in schedule D-9.  The files that contain this information are D-91.ADT, D-92.ADT, and D-93.ADT.    I will copy the original request below for convenience.

Because we do data processing, printed reports or PDF digital copies of reports are not useful.  This is why we request the database of information because it contains structure and contextual data that is lost when converted to a printed form.  We are interested in this structural data because it allows us to automate the processing of the data.  Because of this, we would argue that the electronic database files and the actual cost reports do not contain the same data.

 

 

 

 

 

The Alabama Medicaid Agency uses Medimax software to process submitted cost reports.  This software uses database files ending in a .ADT extension which are not proprietary to Medimax, these are Advantage Database Server files.  These are the files that contain the data as well as the structure that we are interested in.   One problem when requesting the data is that the users of the Medimax software do not know that the data is stored in files inside the Medimax directory.

One issue that arose is that the cost reports contain a schedule that contains sensitive information.  This schedule is contained inside three specific files that correlate with the schedule name.  The schedule is D9 and the files are D-91.ADT, D-92.ADT, and D-93.ADT.

We are making a request for the following:

1. On a computer that has the Medimax software with all of the cost reports from 2008 uploaded to it.  This means that the user can open up the Medimax ALCR viewer and browse the cost report folders for 2008. 
2. On this computer the Medimax software is most likely under this directory, C:\Program Files\MediMax\ALCRV19  since this is the default installation directory.
3. In this directory there is a folder called Data.  This is where all the uploaded data gets stored.  
4. We are requesting any “folders” inside this data directory with the files D-91.ADT, D-92.ADT, and D-93.ADT deleted from each folder as they contain sensitive information.

Those folders each represent the data for a single facility’s submitted cost report.  Each .ADT file is for a schedule or a section of a schedule.

We would like the modified folders to all be burnt to a CD (they should fit fine) or sent over the web if someone knows how to do that there.  They would be too large for email most likely.

Please let me know if there are any problems,

Thanks,

Chase Gray

Mar 17th 2010 : Chase Gray –> Mattie Jackson

Hi Mattie,

I was just checking on the status of the information request.

Is there somebody else I should be speaking with that has more direct interaction with the data?  Maybe somebody in data processing or IT?  There is no programming or “languages” involved in my request.

Would it be better for me to start with a request verifying the existence of the files?

Let me know how we can move this along,

Thanks,

Chase Gray

New Direction

I had to give up on the direction things were going.  I decided that I would email the attorney and the commissioner of the medicaid agency.  This is the same attorney, Stephanie Azar, that I had so much trouble reaching in the past.  Luckily I received a reply from her, possibly due to also contacting Carol Steckel, the commissioner.

I thought that things would go smoother now that someone who understood the law was working with me.  So what follows is a set of emails that were CC’ed to everybody listed in the “Cast” section above.  Replies were much more consistent but still a little slow, possibly due to the accountability of everyone getting a copy.

In order to try and solve the problem of the agency lacking the expertise to extract the files from the computer, I thought I’d take an easier approach.  Each nursing facility sends in a diskette with the .adt files on it.  These files must be stored for a number of years by the agency.  I decided to form my request around the data on these diskettes instead.

Mar 23rd 2010 : Chase Gray –> Mattie Jackson, Stephanie Azar

Hi Mattie,

I have not heard from you in over a week or two.  I am just checking in on the status of things.  If I need to take a different approach please let me know.

In your response you stated that you didn’t believe anybody had the expertise to obtain the files.  If there is a problem finding the files on the actual computer, the files are also located on the disks submitted to the agency by each nursing facility.   So if the existence of the files on a computer in your office is in question, they also are on each of the submitted disks that facilities send in.

On each disk there is  a folder called BACKUP1, inside of this there is a zipped folder called Data.  This “Data” folder contains all of the files that I am requesting.

As I mentioned before, due to the sensitive data included in schedule D-9 contains sensitive information.  I don’t need this schedule.
This schedule is contained inside three specific files that correlate with the schedule name.  The schedule is D9 and the files are D-91.ADT, D-92.ADT, and D-93.ADT.  If this must be verified by Medimax before you can release it, then let me know of the costs involved.   I believe it would more time efficient to get the data off of a PC, but the disks work just as well.

If each of these disks data could be included on a single CD, that would be perfect.  As long as the folders are separate it’s not necessary that they are labeled correctly, as we should be able to determine which facility it is based on the data files.  The data shouldn’t take up more than 100-200MB.

One of our partners is actually coming to your office for different reasons related to their other business around April 2nd I believe.  If you would like to speak with her, then please let me know.  She may have some questions of her own relating to this matter, since she hasn’t been involved until recently.

Please let me know if there are any problems or unusually high costs.

Thanks,

Chase Gray

Mar 24th 2010 : Stephanie Azar –> Chase Gray

Mr. Gray,

The Alabama Medicaid Agency (Medicaid) has received your data request.  The data you are specifically requesting does not currently exist in a written public document which can be provided to you for copying and/or electronically sent to you.  To provide such information would require that Medicaid utilize staff time and state resources to extrapolate and create the document that you are requesting.  Under the Alabama Opens Record Act, Ala. Code 36-12-1, et al., an Alabama citizen has a right to inspect and copy any public writing of the State.  Your request is not a request that Medicaid is required to provide under the Opens Record Act because it is not information in a “writing” that currently exists at Medicaid.   There is no requirement that Medicaid create the document that contains the information/data that your are requesting.

Medicaid appreciates your contacting us to see if this information is available for inspection, but since this information does not currently exist in the form you are seeking Medicaid cannot honor your request.   As stated to you previously, Medicaid will make available for your inspection and copying the cost report information.  If you desire to have this information then please contact Keith Boswell at 334-242-2311.   Thank you.

*************************************

Stephanie McGee Azar

General Counsel

Alabama Medicaid Agency

Office of General Counsel

As soon as I felt like I was making progress, it now seemed like we took a step backwards.  I consulted our legal consultant for the company.  We put together a letter addressing every one of their concerns with relevant case law and attorney general opinions.  After putting this letter together I felt confident that there was no legal reason that my request could be declined.  I should give love to the attorney who helped me with this at 4am one night while I purchased us McDonald’s breakfast. Our attorney is Brian Payne of Small Business Law Firm, who is now attempting to move many of his services online so he may be affordable and accessible to those willing to use legal services online. I will embed the letter as a PDF to maintain the formatting.

Mar 25th 2010 : Chase Gray –> Stephanie Azar, Carol Steckel, Mattie Jackson, Keith Boswell

Ratchet – Ltr. to Azar – 3-25-10

This response from Stephanie is one of the most interesting. In it she agrees that the information must be already compiled and organized in a database or electronic form.  The request I am making is for the files created by the Advantage Database Server embedded in their Medimax software.  The .ADT files I’m requesting represent the database.  Basically, there is a single .ADT file for each schedule in the report for each facility. All of the data is already compiled in this format and they are separated in different files for further organizational benefit. I would actually prefer that the agency not do any extra compilation or organization, because the database server has done a great job at it already.  So one of the most interesting questions is raised in this email.  Is burning specific folders from a hard drive onto a CD considered “compiling and organizing” in the way that this case law intended?  I’ll revisit this at the end of the post. The next interesting thing about this reply is that there is finally some sort of verification that the data I am requesting does exist.  She refers to the 218 separate folders, which would be one per facility.  This means that somebody finally did find the folder I was asking about and it was indeed there. She refers to the cost report information available on the web site after April 1st. They will be posting the PDF copies of the reports on their web site.  This is again not helpful at all because information is lost when converted into a PDF from its original database form. Honestly, I felt like this last decline email was really reaching for any possibly reason to issue a denial.  The compilation and organization argument is pretty shaky when put up to any test.  How many files can I request before their limit is reached and its considered compiling and organizing?

Mar 30th 2010 : Stephanie Azar –> Chase Gray

Mr. Gray,

The Alabama Medicaid Agency (Medicaid) has received your request for reconsideration regarding Medicaid not being able to provide you with the information you are requesting due to the information not being available for inspection or copying.    Medicaid appreciates your response and Medicaid is aware of the case law and the additional information you provided in your response.  It is not Medicaid’s position that the information requested must be in a physical written document.  However, it is Medicaid’s position that the information has to be already compiled and organized in a written form, electronic form, or data base.  This is in keeping with the case law that you cited in your response.  As stated previously, your request is not compiled and available for your inspection or copying in any form.

Medicaid appreciates you clarifying your information request but Medicaid understands what you are requesting.  Such a request will require Medicaid to extract the files you are requesting from 218 separate folders and once such information is extracted will have to be compiled and organized into a document.  Since the information is not already compiled and organized, Medicaid is not required to prepare such information for your inspection and copying.   Medicaid appreciates your request for this information but unfortunately is unable to honor your request for the reasons stated above.  However, the cost report information for each Medicaid nursing facility in Alabama will be available on the Medicaid Agency website on April 1^st at www.medicaid.alabama.gov.  Thank you.

 

*************************************

Stephanie McGee Azar

General Counsel

Alabama Medicaid Agency

Office of General Counsel

In my final request I provide them with two commands that will extract the data folders and copy them all to the desktop ready to be burned.  I also provide a single command that will recursively delete the files containing any sensitive information.  It appalls me that this could be considered more time consuming and difficult than printing out all of the thousands of pages and redacting them all.  In the event that this was still declined, I decided to test my previous theory and simply request a single folder.  A single folder should not be subject to “compiling and organizing.”

Mar 31st 2010 : Chase Gray –> Stephanie Azar, Carol Steckel, Mattie Jackson, Terrell Flowers, Keith Boswell

Ms. Azar:

Thank you for reconsidering my request.

The information that is going to be put online is not in a parsable form, meaning that by putting it into PDF the structure and utility of the database is lost.  We are not requesting the cost reports, but the database, which includes the structure that is required.

My request does not require that Medicaid “compile and organize” any of the data.  The data, in the form that it already exists, is sufficient to determine which facility it is for and work with.  Because the data is on a computer, the act of manually compiling and organizing should no longer be a requirement, since automation is one of the most significant advantages of having electronic data.   I explain below in more detail how it is as easy as double clicking a file.

In a standard paper request, the department photocopies all of the reports and manually redacts information on schedule D-9.  This seems to fit the definition of compiling and organizing more than my request.  In the standard request, each report must be printed or found (similar to finding an electronic folder).  Information must be redacted from each report (similar to deleting a file or two).  These reports, that are made up of a significant amount of pages, must be organized and separated based on which facility they are for.  They must all be put into one location for shipping to the requester (similar to burning the redacted folders to a CD).

I understand that I will be charged $15/hour for staff time to accomplish this.  I would like to be informed if the cost is to exceed $150, but otherwise it’s fine.

Below I provide a link a simple batch file which allows you to simply double click it and the result will be a single folder on the desktop called “MedimaxData” that can be burned to a CD.  The resulting folder will have the correctly deleted files and there is no “compiling or organization” required.  If you need to verify that it indeed does this, it should be a straightforward task for anyone who regularly deals with computer issues such as your IT employee, Terrell Flowers.  If the only issue is the labor involved in copying files, then this would make it as simple as clicking on this file.  It consists of two operations, copy all directories, then delete the D-9 schedules.  This is done succinctly in two commands (shown below):

xcopy /I /S “C:\Program Files\MediMax\ALCRV19\Data” “%UserProfile%\Desktop\MedimaxData”

del /s “%UserProfile%\Desktop\MedimaxData\D-9*”

Simply double clicking the batch file will execute these and will result in exactly what I am requesting, fully redacted, on the desktop.  It just must be run on a Medicaid PC that has these “218 folders” for the latest fiscal year.  These two commands are the extent of any compiling of data, and they are automated further by becoming a batch file that can be double clicked.   I don’t see how this is more time and trouble than working with paper documents.

The file can be downloaded here http://dl.dropbox.com/u/112959/ExtractData.bat

If you are still unable to fulfill this request, then I would like to rephrase my request.   I would like to simply request ONE of the folders under the directory “C:\Program Files\MediMax\ALCRV19\Data\”  that does not contain the word “SAMPLE” in the folder name.  Of course, removing the D9 files is still required for redaction purposes.  Because I am only requesting one folder, there is no need to compile or organize any data.  If possible I would appreciate this folder to simply be emailed since it will be around 350KB.  This would save any of the trouble of burning a CD or mailing anything.  I am only requesting this if the previous request is unable to be fulfilled.

Thanks again for reconsidering my revised request,

Chase Gray

I received an interesting reply the following morning. The commissioner, Carol Steckel finally sent a reply to me.  At first I was excited, but then I noticed the email was empty except for the “Sent from my iPhone” signature. It appears that I received this email by mistake from Ms. Steckel while viewing her emails on her iPhone.  I was surprised though to see that someone who can appreciate the advantages that an iPhone brings doesn’t support the advantages that a electronic database can have.  Regardless, this at least shows that my emails were being seen by Ms. Steckel and either read or forwarded or something.

Mar 31st 2010 : Carol Steckel –> Chase Gray

I believe I received this email by mistake, but at least it shows that Carol was seeing my emails and as early as 7:30am apparently.

Finally, to close the deal, Stephanie sent me a reply addressing none of my questions.  She simply stated that there is no requirement they provide this information.  In the case law we provided in our formal letter, we showed that other agencies have been required to provide their databases and files, why are they different?

April 9th 2010 : Stephanie Azar –> Chase Gray

Mr. Gray,

The cost report for each Alabama Medicaid nursing facility is available on the Alabama Medicaid website.  As stated previously, there is no requirement that Medicaid provide you this information in a different format.  Thank you.

Concluding Questions

So this whole ordeal brings up quite a few questions:

1. Is the agency required to keep the electronic information I am requesting?

The answer to this is definitely yes.  The state has an organization that creates a document specifying how long each agency must retain their files.  For the Alabama Medicaid Agency, they certainly must retain even temporary files for at least 3 years if I read it correctly.

2. What information is lost when moving from a database to a paper/PDF form?

There are many ways to answer this question.  It is definitely not a question asking whether information is lost, it obviously is. I’m going to answer it as simple as possible in a technical way. Each specific piece of information is explicitly referenced by two identifiers, the row ID and the column name.  The row ID in this case identifies each facility uniquely, and the column specifies which piece of information it is.  When this information is in a database, we have the ability to request a single piece of information for all facilities (rows).  This request would be time consuming for paper or PDF reports.  We can also make the same request on a single column for facilities in a specific county.  Now there are conditions that have to be checked before including a piece of data, which would add even more time to the manual paper/PDF task.  With the database form, these queries could get as complex as the programmer could handle.  It is obvious that we lose this ability as the queries get more complex with paper and PDF files.  The Alabama court has acknowledged that a database contains utility that is not available without it.

3. Can my request be declined before even looking into the details of it?

Initially my request was declined because they said the agency was busy.  As far as I can tell from the Alabama Code, there is no justification for declining a request because the agency is too busy.  If the request would take an unreasonable amount of time and effort, then it can be declined.  I would think that this would actually apply to requesting thousands of paper  copies, instead of digital files.  The Alabama senate actually even passed a bill stating that an agency has 15 days to comply with a request once it has been made.  It used to be that there was no real time limit in Alabama for information requests.

4. Throughout this ordeal, many of the state employees refer to their policy of not providing electronic copies or files.  Is this policy recorded somewhere?  Are they allowed to have a policy that trumps the Open Records Act?

I don’t have a good answer to this.  I couldn’t find any policy on open records from the Alabama Medicaid Agency.  I would think that the Open Records Act trumps any decisions made locally, otherwise each agency could do what they wanted.  This supposed policy seemed to change as I brought up case law or the Open Records Act.

5. If I cannot request 218 folders because it requires “compiling and organizing into a document” then can I request 1 file?  Could I request 1 folder?  At what point does the number of files require “compiling and organizing?”

This is a really interesting question.  The last request I made I asked for a single folder instead of all of them.  I felt that this required no “compiling and organizing.”  In the original denial, it seemed that the properties of my specific request were squeezed to fit into the only denial reason left which was that they had to “compile and organize the files into a document.”  I don’t know how document is defined here, but the only definition that makes sense to me is CD.  So the folders are the files and they have to copy them to a CD which requires compilation into a document?  I don’t really understand this one at all, and I would really love to hear some  clarification on this topic especially.  I might resubmit my request for a single file since it hasn’t been addressed yet.  This is something I’d like to hear feedback about from the attorneys and lawyers out there.

6. Was their purpose to stall until they could try and fall back on the PDFs they were planning to put online?

As their deadline for putting the reports online in PDF form drew closer, it did appear that the responses were getting further and further apart.  Finally, after that deadline passed, I received the most terse email of all of them stating that they will not comply with my request without addressing any of my questions.  It does appear as though they did stall, but it may just be coincidence.  As stated in item one, these PDFs are nowhere near the same thing as what I am requesting.

Call to Action

Finally, I would like to ask that anybody who reads this and find it just as troubling as I do, please click the Digg or Reddit button below.  The more people that can read about this experience the better.  If you have any news contacts in the Alabama area then please refer this to them or them to me.  If you have a blog relating to FOIA issues, then I would be happy to let you take anything you want from this post.  I’ve thought about legal action, and it may be worth the effort but at this point I am moving on to some other work for a bit.  If you are an attorney with any advice, I’d love to hear it.  If you have a connection to somebody involved with Alabama Government then please bring this to their attention.

• Upvote this article on Digg or Reddit, you can sign in using your Facebook login so you shouldn’t have to register.
• Pass the link along to anybody you know that has experience with these issues or Alabama Government.
• If you know somebody at an Alabama press organization, they might have some interest in this ordeal.
• Email or call the following people
  • Attorney General Troy King – Twitter: @TKtheAG – Facebook: http://www.facebook.com/tktheag – Contact: http://www.ago.state.al.us/contact_online.cfm
  • Governor Bob Riley – Twitter: @governorRiley – Contact: http://www.governor.state.al.us/contact/contact_form.aspx
  • Contacting any of the people in the ‘Cast’ section above, especially the commissioner Carol Steckel

I appreciate all the support I’ve received already,

Feel free to email me if you have questions of feedback, my email is available at the bottom or the right bar.

Chase Gray

Problem 1: How to let Google index my data that requires a login

A prerequisite for this step is to submit sitemaps for your site’s content to Google Webmaster Tools.  Once you have done this, at some point in the future Googlebot will attempt to traverse your page and index its contents (hopefully).

The content on my site requires a user to pay a subscription fee in order to have free reign and browse through whatever they please.  I’m not very concerned about any single piece of information getting leaked, instead I’m protecting the resource the site provides as a whole.  By letting Google index your site, you’re obviously opening up your content to outside viewers that are not logged in.  The extent that you need to protect your content could vary from what my needs are.

What I want is for a user to be able to type their name into Google search engine and find out that they are referenced in the data provided by Myhealthcaresource.com.  So, I need to somehow let Googlebot traverse my site, even through it requires a login by a normal user.

I’m using Restful Authentication and a role requirement system, so this is how I include this exception.

class FacilitiesController < ApplicationController
 require_role :basic, :only => :show, :unless => request.env['HTTP_USER_AGENT'] =~ /.*Googlebot.*/
end

This could vary depending on your authentication system, but the part that will remain the same is the check if the user agent string contains ‘Googlebot’.

That’s all it takes in order to allow Googlebot to traverse my controlelr that previously required a login.  A potential problem that could come up is that users could ‘fake’ their user agent to say ‘Googlebot’ and gain access to the site.  This could be a problem for some sites, and we would keep an eye out for this in our logs or through analytics software.  We provide a free trial to all our users before they decide to pay, so uers get a free look at the data already and there is no reason to try to sneak around the site to see it.  We’re not concerned with this problem, but it could be an issue for others.

Problem 2: How to prevent Google from caching private pages

Once Google starts indexes pages of your site that require a login for a normal user, it will also start caching all the sites that it visits.  If you are worried about your internal content getting cached by Google you will want to prevent Google or any other robots from caching.  This is simple and is accomplished by putting the following in the heading of your main layout file.

<META name="robots" content="index,follow,noarchive" />
<META NAME="googleBOT" CONTENT="noarchive" />

When Googlebot reaches your page and sees this tag, it will not cache it.  I have this on the Myhealthcaresource layout, and by searching myhealthcaresource in google you can see there are no cache links.

Problem 3: Allowing Users Referred From Google View Content Without Logging In

When a user sees a link to myhealthcaresource on a set of Google search results, they are most likely to the detailed facility reports that I submitted in a sitemap.  They probably searched their company name or their own and found that they were referred to by my site’s information.  When someone clicks this link in Google, by default they would get redirected to a page asking them to log in.  This would make almost every user referred from Google resort to their back button immediately.  I noticed this behavior during the period when my site functioned this way.  These users from Google have no idea what kind of information our site offers and they might be a potential customer, so we don’t want them to leave because we present a log in form when they first arrive.

An alternative is to allow users referred to our site through a Google search to view the entire page.  We decided to do just this.  When they click the link in Google’s search results they are not asked to log in and they are shown the same page a logged in user would see.  What happens when they try to browse the rest of the private content?  They are asked to log in, but we already have their interest at this point and they are more likely to stay if they found something that was useful to them on the page they landed on.

So how do we accomplish this?  In a similar way that we allowed Googlebot to traverse our pages, we can allow users that were referred from Google to access our page:

class FacilitiesController < ApplicationController
  require_role :basic, :only => :show, :unless => request.referer =~ /.*google.*/ || request.env['HTTP_USER_AGENT'] =~ /.*Googlebot.*/
end

Of course this code would vary slightly if you are using a different authentication scheme.  The core idea would be the same though.  Now, the potential problem that could come up with this is that a malicious user uses Google to repeatedly access your site by creating clever search queries.  In our case, if a user is this intent on stealing the data, we weren’t likely to win them as a customer in the first place.  We can also monitor this through analytics tools and if it is abused we will look into an alternative solution.  It could be possible to restrict the number of Google referrals a certain IP can have in a time period or something.

I hope that some of this work can be useful to people who are looking for ways to leverage Google for their dynamically generated login-only content.  We see people come from Google searches every day, and now they stay much longer as a result of these changes.

In a future post, I will briefly talk about another method our site uses to send links to users that allow them to browse the site freely without logging in.  After a certain time period these links expire and the users must sign up to browse the site further.

The biggest problem for this week was actually making myself sit down and write something on here.  I don’t think that would be very interesting to readers or my future self so I’ll fore go the discussion of that.

I think the first thing I should do is explain my background.  I am a Ph.D. candidate at the University of South Carolina (USC) working in the ARENA for Research on Emerging Networks and Applications (ARENA) lab.  Here I focus on developing new wireless network protocols in an endless quest to publish papers.  I have been with Dr. Srihari Nelakuditi since about 2004, when he hired me as an undergraduate researcher.  We have presented multiple papers together.  One was presented at MobiCom and can be found in the Mobile Computer Communications Review (MCCR), it is on security in Mobile Ad Hoc NETworks (MANETs).  Another notable paper was presented at the WiMesh workshop 2008 at SECON, it is not yet available online and focused on bit-rate selection in oppotunistic routing.  The second paper was also the focus of my Master’s Thesis.

During my time as a student at USC, I have worked on quite a few side projects.  Some of these were related to school and some could be seen as distractions.  I spent some time doing contract work on a health-care data system for a director of marketing of a contract company for nursing homes.  I have since used my experience in this field to try to create a large scale public web application providing similar information.  The project is being developed in Ruby on Rails, my first large scale project using the framework.  I have been very happy with it for the most part, and I hope that I can provide some useful insight into problems I have faced while programming with it.

During this Summer of 2008, though, I took a break and had a tour at a nameless agency in the Maryland area doing computer science research .   This was very fun, but nonetheless the day to day government work motivated me even further to pursue my goal of having my own business.  I know (and am told very frequently) that this is a pipe dream and every young computer scientist wants to have their own company, but I feel like I have the motivation and drive to bring a reasonable idea to fruition.  If the completion of my plans does not bring any type of success then I will simply move on.  The key point is that I do plan to have an operational business before deciding that it is not successful.  I believe this is the reason most technical start-ups fail.  They don’t realize how much work is involved in creating their envisioned product.

I have also spent some time while at school developing games.  See, this was my first love with computers.  I fully expected to be a video game developer by the time I graduated college.  There are multiple things that changed my mind about this goal.  The first is that I feel like the industry has totally changed.  This might be due to many reasons.  My observations lead me to believe it is a combination of the following

1. The large emerging market of the casual gamer, usually on a console.
2. Companies like EA buying up every company they can and losing all creativity in their games for the sake of optimization.
3. The failing PC market for games, which prevents the small developers from getting a market unless they can get their game on one of the major consoles.

So, I feel like the video game market is no longer somewhere I would like to work, besides a select few companies.  The competition for getting into the industry is enormous.  I feel like I could find a very enjoyable job in normal software development that pays much better, has less stress, and does not require me to do a little dance for the hiring guys culling through hundreds of potential code monkeys.  Regardless, I still took a game development class this past semester.  Despite having a five person team, it ended up giving me much needed experience with slack teammates.  I’ve had slack teammates before, but most of the time it was because they were either incapable of creating decent code, or they just didn’t care about school in general.  This graduate class was different though, in that my teammates were perfectly capable of accomplishing what I tasked them with.  I believe that the problem was that they saw that I was also capable of doing it myself, so any work they didn’t finish was not going to cause them to get a bad grade.  The class ended well, our game turned out OK, but the team was very unsatisfied with themselves for being so uninvolved during the semester.  I’m generalizing about their lack of work, not every team member was horrible, I can think of two that I would have given F’s to though.

If you’ve read this far, you might have noticed something about the way I write and think.  I move very quickly from one topic to the next.  I often find myself talking and something comes up in my head and it seems like it would be more time efficient to talk about that instead so I simply move to that topic without a very smooth transition.  I’m afraid if I simply free write that is how it will turn out.  If I’m writing a technical article, I can rewrite it as many times as I need to.  So there will probably be two different types of writing on this blog.

Thank you for reading.  In my next post I am hoping to go over some problems I have faced in Rails and my current solutions to the problems.  Hopefully I can get some feedback and maybe make some improvements.

-Chase