The district court in both these appeals granted the government's motion for summary judgment on the ground that compliance with a Justice Department regulation concerning the release of medical records satisfied the Bureau of Prisons' obligations under the Privacy Act. We agree with appellants that the regulation is inconsistent with the Act and therefore reverse both cases.

Appellant Benavides received medical treatment during his incarceration at the Bastrop, Texas Federal Correction Institute in the mid-1980's. In February of 1987, Benavides began efforts to obtain medical records from the Bureau concerning his treatment. The Bureau informed him that while it could send certain documents to him directly, other materials were governed by a special procedure under which the Bureau would give the documents to Benavides' designated doctor, who then enjoyed sole discretion whether to turn them over to Benavides. Benavides complied with that procedure in January 1989 by designating Gualberto Marrero, M.D., to receive his medical records. The Bureau then provided Benavides with 56 pages of medical records, and after another exchange of correspondence, sent those 56 pages as well as additional records to Dr. Marrero. The Bureau also sent Dr. Marrero a letter urging him to use caution in releasing the information in the additional records and asking him to contact the Bureau if he had any questions about providing material to Benavides. Benavides claims that Dr. Marrero ultimately withheld some of his records.

Dissatisfied with his inability to receive all of his medical records, Benavides filed suit pro se, on June 1, 1990, under the Privacy Act and the Freedom of Information Act (FOIA), to compel the Bureau to release whatever materials had not been provided to him. The Bureau moved for summary judgment asserting that it had complied with the Department of Justice's medical records regulation, which authorized the release of the records to a designated doctor with discretion to forward them to the individual. See 28 C.F.R. § 16.43(d) (1992). The Bureau claimed that this compliance satisfied its obligations under both acts. The district court granted the Bureau's motion for summary judgment. See Benavides v. Bureau of Prisons, Civil Action No. 90-1293, Mem. Op. at [301 U.S.App.D.C. 371] 2-3 (D.D.C. Mar. 26, 1991). The district judge assumed, arguendo, that Dr. Marrero had withheld some records from Benavides. The judge noted, however, that the Privacy Act allows agencies to adopt " 'special procedure[s] ... for the disclosure to an individual of medical records, including psychological records, pertaining to him.' " Id. at 1 (quoting 5 U.S.C. § 552a(f)(3)). He then determined that the Bureau had fully complied with the Department's regulation and had therefore "discharged its responsibility under the Privacy Act." Id. at 2. The district court did not, however, specifically discuss whether the documents were available under FOIA.

Appellant Smith is a federal prisoner enrolled in the witness protection program. (We refer to him as John Smith to protect his identity.) He also claims that the Bureau impermissibly has refused to release a portion of his medical records directly to him. Unlike Benavides, Smith has never designated a doctor to receive his records pursuant to the Justice Department's regulation. Smith, instead, asserted his right to receive the records directly and brought suit once it became clear that the Bureau would insist that he follow the special procedure.1 Appellant Smith, like Benavides, claimed a right to the documents under both the Privacy Act and FOIA. The government again filed a motion for summary judgment which the district court granted. See Smith v. Quinlan, Civil Action No. 91-1187, Mem. Op. at 8, 1992 WL 25689 (D.D.C. Jan. 13, 1992). The court held that the Bureau could require Smith to comply with the Justice Department's regulation without violating either the Privacy Act or FOIA.

Both Benavides and Smith appealed. We heard oral argument in Smith's appeal first, but held that case in abeyance so that we could benefit from Benavides' argument as well. We now dispose of the cases together.

The Privacy Act creates a relatively straightforward scheme to provide individuals with access to information that the government has collected about them. The Act permits individuals to make a written request for such agency records. See 5 U.S.C. § 552a(d). Recognizing a variety of important government interests in nondisclosure, however, the Act provides certain exemptions. See 5 U.S.C. §§ 552a(j) & (k). The Act also authorizes government agencies to promulgate rules to regulate the process by which individuals can request records. See 5 U.S.C. § 552a(f). Here, it is important to note, there is no dispute about the adequacy of the individuals' requests, and the government claims none of the exemptions in sections (j) and (k). Instead, this case turns solely on the propriety of the Justice Department's regulation (which governs the Bureau's actions) interpreting a provision of § 552a(f) which governs the manner in which agencies are to disclose medical records.

[E]stablish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedure, if deemed necessary, for the disclosure to an individual of medical records, including psychological records, pertaining to him.

5 U.S.C. § 552a(f)(3) (emphasis added).

The Justice Department's "special procedure" regulation for the release of medical records states:

Medical Records. When an individual requests medical records pertaining to himself which are not otherwise exempt from individual access, the [Justice Department agency] may advise the individual that the records will be provided only to a physician, designated by the individual, who requests the record and establishes his identity in writing. The designated physician shall determine which records [301 U.S.App.D.C. 372] should be provided to the individual and which records should not be disclosed to the individual because of possible harm to the individual or another person.

28 C.F.R. § 16.43(d).

Appellants contend that the Justice Department regulation is not a permissible interpretation of 5 U.S.C. § 552a(f)(3). They maintain that since the regulation envisions that certain documents will never be disclosed to the requesting individual, it cannot be a "special procedure ... for the disclosure to an individual of medical records ... pertaining to him." We agree.2

The statutory provision in question is strictly procedural--it merely authorizes agencies to devise the manner in which they will disclose properly requested non-exempt records. Agencies are to devise "special" methodologies for disclosure of medical records, but those techniques, it would appear, must lead to disclosure of the records to the requesting individual. Cf. Office of Management and Budget Privacy Act Guidelines, 40 Fed.Reg. 28,949, at 28,967 (1975) ("the Act provides that individuals have an unqualified right of access to records pertaining to them (with certain exemptions specified in [the Act], but that the process by which individuals are granted access to medical records may ... be modified to prevent harm to the individual") (emphasis added). Nothing in § 552c(f)(3) or any other provision of the statute suggests that disclosure to a third party satisfies the government's obligation. A regulation that expressly contemplates that the requesting individual may never see certain medical records is simply not a special procedure for disclosure to that person.

The regulation, in effect, creates another substantive exemption out of § 552a(f)(3)'s mandate to promulgate procedural rules--and a super-exemption, at that. In the Bureau's view, once it releases an individual's records to the designated doctor, it has no further responsibility under the Act for the doctor's decision whether to disclose the records to the individual. The individual may or may not have a state law remedy against his doctor to compel disclosure, but since, under the government's view, the doctor would not be acting as its agent, that individual would not have his normal right to review under the Privacy Act or the APA. We cannot imagine that Congress would have intended to permit the government, through this sort of neat legal maneuver, to insulate a decision not to disclose documents to a requesting individual from federal judicial review (particularly in light of 5 U.S.C. § 552a(g)(2), which provides de novo review in federal court of an agency's refusal to disclose a record).

The Bureau argues, nevertheless, that the Justice Department regulation accurately reflects Congress' intent. It points to the Privacy Act's legislative history, specifically the House Report, which states:

If, in the judgment of the agency, the transmission of medical information directly to a requesting individual could have an adverse effect upon such individual, the rules which the agency promulgates should provide means whereby an individual who would be adversely affected by receipt of such data may be apprised of it in a manner which would not cause such adverse effects. An example of a rule serving such purpose would be transmission to a doctor named by the requesting individual.

H.R.REP. NO. 1416, 93d Cong., 2d Sess. 16-17 (1974) (emphasis added). We have no doubt that Congress was concerned with the harm that could result from individuals receiving their medical records in the same manner as other records. This explains both the modifier "special" in § 552a(f)(3) and this passage in the House Report. Contrary to the Bureau's contention, however, the Report does not contemplate circumstances whereby the requesting individual would never obtain his records. It identifies transmission to a doctor as an example of a special procedure under the statute but does not suggest that [301 U.S.App.D.C. 373] the doctor could withhold the records permanently from the individual. The passage assumes the contrary by indicating that where direct transmission could have an adverse effect the agency should devise procedures for disclosure by which the individual can be, "apprised of [the records] in a manner which would not cause such adverse effects." Id. We therefore read the Report as visualizing as an example of a "special procedure" one whereby medical records are provided initially to a personal physician who can then review the documents with the requesting individual, explain the records' meaning, and offer counseling designed to temper any adverse reaction.

Appellants, on the other hand, would have us go further and hold that, notwithstanding the House Report, the statute actually requires direct disclosure to the requesting individual without a doctor's presence. They suggest that the statutory phrase, "disclosure to an individual," and the broader purposes underlying the Privacy Act do not permit the government to insist that the requesting individual share his medical records--even temporarily--with a third party. But just as the statutory language does not support the government's efforts to read in words authorizing disclosure to a doctor, and not necessarily to the individual, neither does the language permit appellants to add the word "direct" before disclosure. Their interpretation, moreover, does not account for the provision's recognition of the legitimacy of "special procedures." They do not offer any special procedures that make any sense if the requesting individual is entitled to undiluted direct access. As long as agencies guarantee the ultimate disclosure of the medical records to the requesting individual, we think that they should have freedom to craft special procedures to limit the potential harm that could result from unfettered access to medical and psychological records.

* * *

Both appellants asked the district court to order the Bureau to produce their records, without further ado. Although we hold that the Bureau's regulation is ultra vires, and therefore appellants are entitled to the records, it does not follow that the appropriate remedy is to direct the Bureau to turn them over to appellants immediately. The Bureau is still entitled to fashion "special procedures" that are consistent with our interpretation of the statute. Mindful, however, that at least one of the appellants, Benavides, has been seeking his medical records for more than six years, we do not think appellants should be obliged to wait until the agency completes the sometimes lengthy process of promulgating a new rule. Instead, there is no reason why the Bureau could not, under the district court's supervision, provide appellants their records in accordance with whatever procedure the Department contemplates incorporating in the revised regulations.

We think it also necessary to caution the government that it is not free on remand to claim that Benavides' medical records fall within the statutory exemptions of the Privacy Act. The Bureau has contended throughout the administrative and litigation proceedings that none of his medical records were exempt. And the government has already released all of his records under the Privacy Act (albeit not directly to him). As we have noted in the context of FOIA litigation, the government is not entitled to raise defenses to requests for information seriatim until it finds a theory that the court will accept, but must bring all its defenses at once before the district court. See Ryan v. Department of Justice, 617 F.2d 781, 792 (D.C.Cir.1980).3

Our disposition of appellants' Privacy Act claim makes it unnecessary for us to decide whether FOIA provides individuals with independent access to their medical records. We reverse the district court's decisions granting summary judgment in favor of the Bureau and remand for further proceedings consistent with this opinion.

So ordered.