14 FOIA and Privacy Act Tracking

Important:

The FOIA/PA component in Oracle URM is an example of usage and should not be used as is. It shows the types of decision points, workflow branches, and forms used in a typical FOIA/PA process. The process in use at your site may vary signficantly from that shown here.

Oracle URM contains the functionality needed to comply with the Freedom of Information Act (FOIA) and the Privacy Act (PA) to track requests for information. The process is similar for both types of information requests. The main difference lies in the type of forms used in the information processing.

This functionality is available only if the FOIA/PA component is enabled during configuration. See the Oracle Fusion Middleware Setup Guide for Universal Records Management for details about choosing options.

When enabled, new links appear on the Setup Checklist page. Make sure to click Install Data Resource Files (Schema, etc.) to enable the necessary services to use this component. In addition, import the necessary archive by clicking Import FOIA Privacy Act Archive. This imports the workflow and other items needed for the component. Note that the workflow must be modified before enabling it for use.

When the FOIA/PA component is enabled, default users are added to populate different default alias groups.Because of the complexity of the FOIA/Privacy Act specification, the users are left in place to make it easier to match the FOIA configuration with the specification.

A FOIA profile is also installed making the necessary metadata fields available. If the FOIA component is later disabled, the FOIA profile and metadata fields remain. They should be removed if the component is disabled. See the Oracle Fusion Middleware User's Guide for Universal Records Management for information about profiles. See the Oracle Fusion Middleware Application Administrator's Guide for Content Server for information about managing metadata fields.

This chapter provides an overview of the process of tracking, fulfilling, or denying information requests using Oracle URM. This type of information processing is accomplished by using workflows. This chapter provides an overview of workflow usage but does not discuss the details of setting up or maintaining workflow. For complete details about using workflows including how to customize a workflow, see the Oracle Fusion Middleware Application Administrator's Guide for Content Server.

The forms used with the functionality can be edited as needed. The forms are checked in as content items. To alter the forms, search for the form name then check out the form and edit the .hcsw or .hcsf files using an ASCII editor.

Concepts

• "FOIA and DB2 Databases"

• "About Workflows"

• "The FOIA/Privacy Act Workflow"

Tasks

• "Initial Required Setup"

• "Begin Request Processing"

• "First Decision Point: Expedited or Non-Expedited"

• "Second Decision Point: Service or Denial"

• "Fourth Decision Point: Appeal and Decision"

• "Final Actions"

14.1 FOIA and DB2 Databases

The FOIA/PA functionality contains an archive that is imported. This archive contains a table, FOIAPAMETA, that is used to store auxiliary metadata. This table contains 99 fields, 21 of which are memo fields. Memo fields are normally 2000 characters in length.

However, DB2 has a smaller row size limit than Oracle or SQL Server. With 21 memo fields, the FOIAPAMETA table would fail to import on a DB2 database because of this limit. Normally, when a memo field is created on a DB2 system, Configuration Manager uses a special DB2 data type called "long varchar". But that doesn't apply when Archiver is importing a table.

To accomodate this, the memo fields in the FOIAPAMETA table have been manually changed so the size is set to 1000. This may not match the memo field size on the server where this component is installed if DB2 is used. There are two solutions for this problem:

• Change the memo field size setting for the instance to 1000 to match what was imported with this table.

• Change the length of the 21 fields in the FOIAPAMETA table to match what is expected on the server where the instance resides.

The second method is the recommended method for implementation.

14.2 About Workflows

Workflows are used to route content for review, approval, and eventual release. In this case, the content that is routed are the forms required for the FOIA/PA process.

Effective workflow design is an iterative process, continually refined as the process is implemented. Three types of workflows can be created:

• Criteria workflows are used for content that enters the workflow process automatically based on content metadata that matches predefined criteria. Criteria workflows are used for FOIA and PA approvals.

• Basic workflows are used for specific content items (for example, a particular document to be reviewed) and must be initiated manually.

• Sub-workflows can also be used to split complex workflows into manageable parts and can be used with either a criteria or a basic workflow.

Workflows are composed of steps in which content is reviewed, approved or denied. Multiple reviewers can be assigned to approve or reject the content at each step. A set of users and the step type must be defined for each step in the workflow. Users assigned to a step can only perform the tasks allowed for that step type.

Workflows can be customized in several ways. Tokens can be used to designate unknown users. Aliases can be used to include a group of people in a workflow step. Jumps enable the creation of conditional statements to branch content through different paths in the same workflow or to route content to a different workflow. Exit conditions can prevent content from moving to the next step unless essential conditions are met. Custom metadata fields can be created and used to trigger different workflows.

For details about these customization tips and for examples of workflows, see the Oracle Fusion Middleware Application Administrator's Guide for Content Server.

14.3 The FOIA/Privacy Act Workflow

The FOIA/PA workflow provided with Oracle URM should be considered a starting point for the process to be used. It must be customized with users added as reviewers, specific rules added to reflect the process in place at different organizations, and additional steps added as needed. In addition, this version of the workflow reflects draft requirements specified by the Joint Interoperability Task Force (JITC). It should be expected that these requirements will change in the future and the procedures outlined here may then be outdated.

Only those request forms requiring approval go through a workflow process. Other necessary supporting forms must be filled out and filed in the requestor's folder. Those forms are linked to the main request using the Related Content functionality.

There is no set time frame for filing of those forms, but they must be completed before the workflow is completed when the request is either denied or serviced. Those forms are not discussed in this chapter.

This section discusses the current default workflows provided with the software. It is divided into task groupings, most of which are based on the decision points in the workflow. The finished, customized workflow at your site may have different decision points and tasks than those discussed here.

14.3.1 Processing Details

When a workflow is started to process an information request, the stages of the workflow are automatic and may branch depending on the choices made during the process (for example, a denial of the information request, or the servicing of a request). It is important to know the stage where a request is currently in process because that will determine which workflow must be used for action.

The Active Workflows Screen shows all types of workflows available with the system. When a user accesses a request being processed, the appropriate stage of the workflow must be chosen. The stage of the workflow is shown on the Workflow Content Page in the Step column.

Time limits are set according to the specification guidelines for each stage of processing. These limits are set within the workflow and be changed if needed. See the Oracle Fusion Middleware Application Administrator's Guide for Content Server for details about editing workflows.

To view current workflow assignments, click My Content Server then My Workflow Assignments from the Main menu or click the My Workflow Assignments link on the Active Workflows Screen.

14.3.2 Initial Required Setup

As mentioned earlier, the default workflow must be customized to add the appropriate users, steps, and decision points for your working environment. This must be done before using this functionality.

Forms are submitted from within a record folder, so make sure to set up the category structure beforehand. Categories should be created where FOIA and PA requests will be stored (for example, "Open FOIA Requests" and "Open PA Requests"). As information requests are received, a new folder must be created for each request within the appropriate category. This folder will house all of the paperwork associated with the request.Therefore, any people involved in the workflow process should be those users who have the necessary rights and roles to allow them to create and move folders. Depending on how the system is set up, users will receive notification email with links to actions that can be performed depending on the user's rights and roles.

Categories must be created to store the finished requests. The naming and disposition rules for those categories is an organizational decision. Categories could be created based on final outcome (Granted in Full, Refused, and so on) or by date (for example, "December 2009 requests") or some other filing method.

In addition to creating folders, plan to track expenses associated with the request process. Information such as the fees collected, the staff allocated to the request, the time and money spent servicing the request, and the final result of the request should all be tracked independently in order for final reports to be produced. As noted previously, the workflow and reports documented here are based on the draft specification which may change in the future.

14.3.3 Begin Request Processing

The initial stage of the request process involves creating a folder for the request and filling out the appropriate form for the request.

14.3.3.1 Create a Request Folder

When a request for information is received, a new folder for the request must be created. All information associated with the request will be stored in that folder. For complete details about creating folders, see the Oracle Fusion Middleware Setup Guide for Universal Records Management.

1. Click Browse Content then Retention Schedule from the main menu. Click the category name for use.

2. The Exploring Category Page is displayed. Click Create then Create Records Folder from the Page menu. The Create Record Folder Page is displayed.

3. Enter the appropriate metadata information and click Submit when finished.

14.3.3.2 Create a Request

After the folder is created, initiate a form for the request from within the folder.

1. Click Create then the type of request from the Action menu of the folder or select these options from the Page menu of the Folder Information Page. The same menus are available for FOIA Requests or Privacy Act Requests but different default data is filled in on the forms depending on the type of request. Request types include:

   • Access Request Form: used to request access to records under the Freedom of Information Act or the Privacy Act (depending on which menu option is chosen).

   • Amendment Record Form: used to request a change or amendment to a record.

   • Disclosure Record Form: used to initiate the process to make records available for disclosure.

   • Other: forms used to track information for the request. The form used will vary depending on the type of request and how it progresses through the workflow.

     • Access Record Form

     • Accounting Record Form

     • Appeal Request Form

     • Denial Record Form

     • Disclosure Record Form

     • Dispute Record Form

     • Exemption Record Form

     • Matching Program Records Form

     • Privacy Act File

     • System of Records Form

2. If adding supplementary information to a previously file request, choose one of the forms from the Other category. The appropriate form is displayed. Fill out the form and click Submit when done. The form is filed in the folder with other documentation for the request.

   If beginning the request process, click one of the request types. The chosen form is displayed: the Access Request Form, the Amendment Record Form, or Disclosure Request Form.

3. Fill in the appropriate information for the request and click Submit when done.

4. A submission confirmation is displayed.

14.3.4 First Decision Point: Expedited or Non-Expedited

When a request is submitted for information, the first decision point revolves around if the request will be expedited or not. The request form contains a field which specifies if the requester wants expedited processing, but that is not what determines this decision. This decision should be made by the FOIA/PA processors.

An expedited request is immediately serviced without further information needed. A non-expedited request requires review and may be denied after review.

14.3.4.1 Review Request Form and Route

The first decision point in the workflow will be to route the request to the proper workflow by choosing the type of request.

1. Click Content Management from the main menu. Click Active Workflows. A list of current workflows is displayed.

2. Click FOIA Requests. A Workflow Content Page is displayed listing items in workflows and the steps where the workflow is currently processing. Click the Workflow Review icon for the item to review (the document icon next to the Actions menu icon).

3. The submitted request is displayed within a Workflow Review Page.

4. Click Expedited or Non-Expedited in the Review Workflow pane (on the left side of the screen) to route the request. The Workflow Review Page is displayed, showing that appropriate sub-workflow is started in the Step column.

5. Click the Workflow Review icon to continue workflow processing.

14.3.4.2 Send Acknowledgements

An acknowledgement of the request must be sent regardless of the request type (expedited or non-expedited).

1. If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Requests to display all requests currently in the initial stage of processing (this is applicable for FOIA requests and Privacy Act Requests). The Workflow Review Page is displayed.

   If still in the workflow process, click the Workflow Review icon for the request to process. The Workflow Review Page is displayed. Note that the action options in the Workflow Review Pane have changed to match the current workflow step.

2. Click Acknowledged. A search screen is displayed. Use this screen to search for items that were used to acknowledge the request.

3. Enter metadata for the search fields. Click Search when done.

4. A list of content items matching the criteria is displayed. Click the checkbox of the item to use and click OK. The Workflow Review Page is displayed again with the new workflow step indicated in the Step column.

14.3.5 Second Decision Point: Service or Denial

If this is an expedited request, the next step will be to service the request by providing the requested information. If a request is denied, fill out the appropriate forms to indicate why the request is denied and what steps the requestor can take to appeal the denial.

Figure 14-1 Expedited Sub workflow

Description of "Figure 14-1 Expedited Sub workflow"

If this is a non-expedited request, the request will be evaluated and perhaps serviced or denied.

Figure 14-2 Non-expedited sub workflow

Description of "Figure 14-2 Non-expedited sub workflow"

14.3.5.1 Servicing a Request

The Oracle URM system is not used to fulfill the request but is used to track the process of fulfilling the request. Therefore, after the information has been released to the requestor, it must be indicated in the workflow that the request has been serviced.

1. If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click Expedited Subs if this was an expedited request that will be immediately serviced. The Workflow Content Page is displayed, showing all requests in that sub-workflow. Click the Workflow Review icon for the request to be serviced.

   If still in the workflow process, click the Workflow Review icon for the request to be serviced on the Workflow Content Page.

2. The Workflow Review Page is displayed. Note that the action options in the Review Workflow pane have changed to match the current workflow step. Click Serviced on the Workflow Review Pane.

3. A search screen is displayed. Enter metadata to search for items that will fulfill the request. Click Search when done.

4. A search results page is displayed. Click the checkbox for those items used to fulfill the request. Click OK when done.

5. The Final Result Dialog is displayed. Enter the information to be included on the final reports, including the final result, fees collected, number of people involved in servicing the request and total cost of servicing. Click OK when done.

14.3.5.2 Denying a Request

A request may be denied for a variety of reasons. If the request is denied, a Denial Request Form must be filled out before proceeding.

Note that at this stage of the workflow process, it is possible you are not creating a new denial but are reviewing a denial created outside of the workflow (a direct denial) to make a decision about its outcome. Choose the appropriate Denial Form depending on the type of denial in process.

1. If still in the workflow process, click the Workflow Review icon for the request.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Non-Expedited Sub (a request cannot be denied that was initially chosen as expedited). See "Review Request Form and Route" for details. Click the Workflow Review icon of the request to process.

2. The Workflow Review Page is displayed. Note that the action options in the Review Workflow Pane have changed to match the current workflow step.

3. Click Recommend Denial - New or Recommend Denial - Existing from the Review Workflow pane. The Denial Record Form is displayed.

4. If this is a new denial, enter the necessary data for the denial and click OK. If this is a previous denial, a search dialog is displayed. Select the submitted denial form. This links the two forms together. Click OK when done.

5. A submission confirmation screen is displayed. Click OK.

6. The Workflow Content Page is displayed. The request is listed and the Step column is changed to DenialDecision.

The denial form is filed into the request folder and the workflow process moves to the next step. The denial is forwarded to the appropriate reviewers for a decision.

14.3.6 Third Decision Point: Denial Processing

A denial of request can have one of two different outcomes:

• The denial can be disapproved. This means the denial will be returned to the reviewer who denied it and it must be serviced (see "Refusing a Denial" and "Servicing a Request".

• The denial can be approved. If a denial of service is approved, the requestor is notified of the denial and can appeal that decision within a sixty-day time frame. See "Fourth Decision Point: Appeal and Decision" for more details about the appeal process.

  If a request is denied and an appeal is not received within the sixty day time frame, the FOIA/PA workflow is concluded. See "Final Actions" for details about the final processing of the workflow.

Figure 14-3 Denial processing sub workflow

Description of "Figure 14-3 Denial processing sub workflow"

14.3.6.1 Refusing a Denial

1. If still in the workflow process, click the Workflow Review icon for the request.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Denial Sub.

   The Workflow Content Page is displayed listing all items in this stage of processing. The Step column for a denied request is "DenialDecision." Click the Workflow Review icon of the request to process.

2. The Workflow Review Page is displayed. In the Review Workflow pane, click Disapprove Denial to refuse the denial and have the request serviced.

3. The Workflow Content Page is re-displayed with the item listed. The Step column indicates the request has moved back to the "Serviced" stage. Click the Workflow Review icon.

4. The Workflow Review Page is displayed. In the Review Workflow pane, click Serviced to route the request for servicing.

14.3.6.2 Approve Denial

1. If still in the workflow process, click the Workflow Review icon for the request.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Denial Sub.

   The Workflow Content Page is displayed listing all items in this stage of processing. The Step column for a denied request is "DenialDecision." Click the Workflow Review icon of the request to process.

2. The Workflow Review Page is displayed. In the Review Workflow pane, click Approve Denial to approve the denial and refuse to fill the request.

3. The Workflow Content Page is re-displayed with the item listed. The Step column indicates the request has moved to the "AwaitAppeal" stage.

14.3.7 Fourth Decision Point: Appeal and Decision

If a request has been denied, the requestor has sixty days to file an appeal of that denial. If an appeal is not filed, the workflow for that request concludes.

When notification is received that an appeal has been filed, access the folder housing the original request and file an Appeal Request form. An acknowledgement that the appeal was received and is being reviewed must also be sent. All paperwork for the appeal is filed using the same identification as the original denial and the original Access Request Form, thus linking the records together.

It may be possible that you are not creating a new appeal form but are reviewing an appeal created outside the workflow process to make a decision about its outcome. Choose the appropriate Appeal Form depending on the type of appeal being processed (a similar action can occur when processing denials).

Figure 14-4 Appeal process sub workflow

Description of "Figure 14-4 Appeal process sub workflow"

14.3.7.1 Initiating an Appeal

1. If still in the workflow process, click the Workflow Review icon for the request on the Workflow Content Page.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Denial Sub. A list of all requests in this stage is displayed. Click the Workflow Review icon for the request being processed.

2. The Workflow Review Page is displayed. Note that the action options in the Review Workflow Pane have changed to match the current workflow step. Click Appeal Received - New Form or Appeal Received - Existing Record.

3. If this is a new appeal, a search screen is displayed. Use this screen to search for the original request item. That item will be linked to this denial form and the denial stored in the appropriate folder.

   If this is an existing appeal, a search screen is displayed. Use this screen to search for the appeal already submitted.

4. The Workflow Content Page is displayed. The request is listed and the Step column is changed to Acknowledge.

14.3.7.2 Acknowledging an Appeal

1. If still in the workflow process, click the Review Workflow icon for the request on the Workflow Content Page.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Appeal Sub. A list of all requests in this stage is displayed. Click the Workflow Review icon for the request being processed.

2. The Workflow Review Page is displayed. Note that the action options in the Workflow Review Pane have changed to match the current workflow step.

3. Click Acknowledged. A search screen is displayed. Use this screen to search for items used to acknowledge the request.

4. Enter metadata for the search fields. Click Search when done.

5. A list of content items matching the criteria is displayed. Click the checkbox of the item to use and click OK. The Workflow Content Page is displayed again with the new workflow step ("AppealDecision") indicated in the Step column.

14.3.7.3 Reviewing the Appeal

1. If still in the workflow process, click the Review Workflow icon for the request on the Workflow Content Page.

   If the workflow process was exited, click Content Management then Active Workflows to display all available workflows. Click FOIA Appeal Sub. A list of all requests in this stage is displayed. Click the Workflow Review icon for the request being processed.

2. The Workflow Review Page is displayed with the original access request. Note that the action options in the Workflow Review Pane have changed to match the current workflow step.

   Click Approve Appeal to approve the appeal and route the request for servicing. See "Servicing a Request" for details.

   Click Disapprove Appeal to end the workflow process. The Final Result Dialog is displayed. Enter the information to be included on the final reports, including the final result, fees collected, number of people involved in servicing the request and total cost of servicing. Click OK when done.

14.3.8 Final Actions

When processing is finished for a request, move the folder to the appropriate category that was previously created (see "Initial Required Setup").

Follow these instructions to move a folder to a new location:

1. Navigate to the folder to be moved. Click Edit then Move from the Page menu.

2. The Select Category or Folder Page is displayed. If necessary, click the plus sign icon to expand the view of the items.

3. Click the category name where the folder should be moved then click OK.

4. The Exploring Retention Category Page is displayed listing all folders in that category.