Hey FDA, How about some real “Radical Transparency” or just Transparency

I mailed this letter to Secretary Kennedy and Commissioner Makary.

Full letter: https://www.marlerblog.com/files/2025/06/Draft-FOIA-Exemption-4-Letter-6.17.25-FINAL.pdf

Re:      2024 Multistate E. coli O157:H7 Outbreak Linked to Romaine Lettuce

Dear Secretary Kennedy and Commissioner Makary:

On behalf of my injured clients and in the public’s interests in radical transparency, I am writing for your help.  We ask the FDA to disclose the names of the grower, processor, broker, distributors, and points of service identified in its investigation of this E. coli O157:H7 outbreak.

My firm represents ten individuals who were seriously sickened in the 2024 multistate E. coli O157:H7 outbreak linked to romaine lettuce. Each of them—Austin Carnaghi, Tina Graham, Alaina Mujkanovic, Sawyer Swearingen, Kimberly Everding, Colton George, Lilly Hasenour, Cynthia Hefling, Alec Schielke, and Brenda Lippert—suffered severe illness after consuming contaminated romaine lettuce served at schools, restaurants, catered events, or purchased at retail. 

These illnesses were not minor. They were severe, prolonged, and in many cases, life-threatening, requiring lengthy hospitalizations, intensive medical interventions, and ongoing recovery. Multiple individuals developed hemolytic uremic syndrome (HUS), a serious and potentially fatal complication that can result in kidney failure, neurological injury, and death.

Austin Carnaghi, a 15-year-old boy from St. Louis, Missouri, became ill after eating a salad served at a school event on November 6, 2024. The meal had been prepared and catered by Andre’s Banquets & Catering. Shortly after eating the salad, Austin experienced severe abdominal cramping, persistent vomiting, and continuous diarrhea, which progressed to bloody diarrhea. He sought medical attention at an urgent care facility, where a stool sample tested positive for E. coli O157:H7. 

Lilly Hasenour, a 15-year-old girl from Greenwood, Indiana, also became seriously ill after consuming romaine lettuce served at her school in late October 2024. Her condition rapidly deteriorated, and she was hospitalized for 26 days—from November 11, 2024, to December 7, 2024—and diagnosed with HUS. During her hospitalization, Lilly endured 17 days of hemodialysis and received nine blood transfusions. She also developed pancreatitis and neurological complications as a result of her illness. 

Tina Graham, like Austin Carnaghi, became ill after consuming food, including salad, catered by Andre’s Banquets on November 7, 2024. Four days later, on November 11, she began experiencing excruciating abdominal pain, vomiting, and frequent episodes of bloody diarrhea. Her symptoms were so intense that she was unable to sleep and required a bedside commode every 10 to 15 minutes during her hospitalization. A stool sample collected at the hospital subsequently tested positive for E. coli O157:H7.  

Alaina Mujkanovic, a 16-year-old girl, became ill after eating food served by Andre’s Banquets at her high school on November 8, 2024. Within two days later, she developed intense abdominal cramping, dizziness, malaise and severe diarrhea that progressed to bloody diarrhea. She sought emergency medical care, where testing confirmed an infection with E. coli O157:H7.

Sawyer Swearingen, also 16 years old, fell ill after eating food catered by Andre’s Banquets on November 7, 2024. His symptoms mirrored those of others: persistent vomiting, diarrhea, and abdominal pain. He was hospitalized for five days due to dehydration and decreased fluid intake exacerbated by the vomiting and diarrhea and was later confirmed to have E. coli O157:H7.

Kimberly Everding attended a funeral reception at Andre’s South Banquets & Catering in St. Louis on November 8, 2024, where she ate salad. Three days later, on November 11, she developed severe symptoms consistent with E. coliinfection. Her condition deteriorated rapidly, requiring hospitalization for nine days.

Colton George, just nine years old at the time, became seriously ill after eating romaine lettuce purchased by his parents at Kroger’s. His symptoms escalated quickly, and he was hospitalized for 18 days—from November 17, 2024, to December 5, 2024. He was diagnosed with HUS and confirmed to be a whole genome sequence (WGS) match to the outbreak strain. During his hospitalization, Colton underwent nine days of continuous renal replacement therapy (hemodialysis) followed by five more days of intermittent hemodialysis. He also received five blood transfusions. He spent his 10^th birthday in the hospital.

Cynthia Hefling also consumed romaine lettuce in November 2024 and developed nausea, vomiting, diarrhea, bloody diarrhea, stomach cramps, muscle aches, fatigue, headache, and a urinary tract infection. She was hospitalized for 25 days. As her condition worsened, she was transferred to an Intensive Care Unit (ICU) on November 29 for hemodialysis, where she remained until December 7. She underwent nine days of hemodialysis, received one blood transfusion, and was diagnosed with life-threatening HUS. She also developed acute encephalopathy in the ICU, requiring medication.

Alec Schielke, like Alaina Mujkanovic and Sawyer Swearingen, is 16 years of age. He became ill after consuming romaine lettuce purchased at Kroger’s in November 2024. He was hospitalized for 21 days with symptoms that were later confirmed to be caused by an E. coli infection. Alec endured a prolonged gastrointestinal illness, requiring extensive medical care.

Brenda Lippert, a 70-year-old woman from Franklin, Indiana, became ill after eating a side salad with her lunch at Jockamo’s Pizza. The following day, she developed diarrhea, vomiting, and overall weakness. As her condition worsened, she required hospitalization for five days. 

Given the severity of this outbreak, we respectfully urge the FDA to disclose the identities of all entities involved—including the lettuce grower and processor identified as the source of contamination through its internal investigation. This information does not constitute “commercial or financial” data “obtained from a person” under FOIA Exemption 4 and therefore does not qualify as confidential. 

The public interest in “radical transparency” is overwhelming and far outweighs any claimed interest in nondisclosure. This outbreak sickened the ten individuals described above, along with 79 others across 15 states. Seven developed hemolytic uremic syndrome (HUS), and one tragically died. Moreover, this outbreak has been linked to six prior historical clusters, strongly suggesting the presence of a persistent, resident strain of E. coli at or near the source.

Continued withholding of this information impedes accountability, undermines consumer protection, and obstructs vital public health efforts aimed at preventing future outbreaks. The public has a right to know which entities were responsible for these illnesses so that appropriate safeguards can be implemented, monitored, and enforced.

An(other) Outbreak of E. coli O157:H7 Linked to Romaine Lettuce

As detailed in the FDA’s CORE Report, on November 25, 2024, PulseNet coded an outbreak of E. coli O157:H7 2411MOEXH-2. At the time of closing, this investigation included 89 cases across 15 states: AR (2), CO (1), IL (7), IN (8), KS (1), KY (1), MO (50), MT (1), ND (2), NE (3), OH (8), PA (1), SD (1), TN (1), WI (2), all related within 0-4 alleles by cgMLST. 

Isolation dates ranged from November 7, 2024, to December 1, 2024. Reported onset dates (n=83) ranged from November 4, 2024, to November 30, 2024. Ages ranged from 4 to 90 years with a median age of 24. Sixty of 88 cases (68%) female. Outcome information was available for 74 cases, of which 36 (49%) were hospitalized. There were 7 reported cases of HUS, and 1 death attributed to this outbreak.

A case in this investigation was defined as infection with E. coli O157:H7 with an isolate related to the outbreak strain within 0-4 alleles by cgMLST and isolation date ranging from November 7 to December 1, 2024. This outbreak was related to six historical investigations: 2302MLEXH-1, 2210MLEXH-3, 2210MLEXH-2, 2209MLEXH-1, 2112MLEXH-1, and 2106CAEXH-1. The only vehicle identified was for 2112MLEXH-1, which was closed with a confirmed vehicle of organic power greens. The NCBI tree (pictured below) for this strain included numerous nonclinical beef isolates.

NCBI tree

This outbreak was coded following notification from FDA colleagues in Missouri after they identified and investigated multiple illnesses linked to events catered by the same Missouri-based caterer. These events occurred between November 6 and November 8. All events included the same menu items with a few modifications. Missouri colleagues conducted a retrospective cohort study at two of the events and found that salads were the only statistically significant menu item across both events. Salads contained an iceberg/romaine lettuce blend, carrots, purple cabbage, onions, canned pimento, canned artichokes, parmesan cheese, and a house made salad dressing.

In total, 7 subclusters were identified across the multistate outbreak. These included 3 Missouri catered events, an Ohio secondary school, an Indiana restaurant, an Illinois restaurant, and an Illinois event catered by a different Missouri-based caterer. Salads were the common link across all 7 subclusters, and cases in all subclusters ate an iceberg/romaine lettuce blend. CDC deployed a focused questionnaire on November 26, 2024; 27 questionnaires were returned. Epi information was available for 65 cases, of which 60 (95%) reported consuming any type of leafy green prior to illness. Of 57 cases who could remember the exact type of leafy green consumed, 50 (88%) consumed romaine lettuce. This is statistically significantly higher than the background rate of 49% from the FoodNet Population survey. A traceback investigation was initiated in response to an E. coli O157 outbreak with leafy greens as the suspected vehicle. 

The investigation consisted of three traceback legs representing twenty-eight cases and five points of service (POS). The three traceback legs identified four distribution centers, one broker, two processors, one grower, and one ranch. The traceback investigation determined that a sole processer sourced romaine lettuce from a single grower that would have been available at all points of service during the timeframe of interest. Additionally, romaine lettuce supplied to four of the five POS were traced back to a common ranch and lot. Through analysis of records, four lots of romaine lettuce were implicated, resulting in confirmation of romaine lettuce as the vehicle. Epidemiologic and traceback data supported the conclusion that romaine lettuce was the source of illnesses in this outbreak. 

On February 11, 2025, the FDA published its findings in a Coordinated Outbreak Response & Evaluation (CORE) report titled “E. coli O157:H7/Romaine Lettuce/Nov 2024 Executive Incident Summary CARA #1280.”^[1] The report includes a redacted traceback diagram (pictured below) that identifies five POS, four distributors, one broker, one processor, and one grower that the FDA linked to the outbreak through its internal investigation. But FDA officials never issued public communications following the investigation, nor did it disclose the identities of the entities that grew, processed, brokered, distributed, or served the contaminated lettuce. Agency officials claimed that this information is protected under Exemption 4 of the Freedom of Information Act (“FOIA”), which shields confidential commercial information from public release. In fact, such information is not protected under Exemption 4, as it does not meet the legal standard for confidential treatment and directly concerns public health and safety.

FDA’s redacted traceback diagram

The Identities Withheld by the FDA Are Not Protected Under FOIA Exemption 4

            The FDA’s decision to withhold the names of the grower, processor, broker, distributors and points of service linked to the 2024 E. coli O157:H7 outbreak involving romaine lettuce is legally unsound and contrary to the core principles of transparency embedded in the Freedom of Information Act (FOIA). Under Exemption 4 of FOIA, an agency must demonstrate that the withheld information is: (1) “commercial or financial” in nature; (2) “obtained from a person”; and (3) “privileged or confidential”. 5 U.S.C. § 552 (b)(4). None of these conditions are satisfied here. 

• The Withheld Information Is Not “Commercial or Financial” in and of Itself

To qualify for withholding under FOIA Exemption 4, the information must be commercial or financial “in and of itself”—meaning it must serve a commercial function or be of a commercial nature. Citizens for Resp. & Ethics in Wash. v. United States DOJ, 58 F.4th 1255, 1263 (D.C. Cir. 2023). The D.C. Circuit has made clear that Exemption 4 protects only information that private entities typically keep confidential because it reveals “basic commercial operations, such as sales statistics, profits and losses, and inventories, or relate[s] to the income-producing aspects of a business.” Id. (quoting Pub. Citizen Rsch. Grp. v. FDA, 704 F.2d 1280, 1290, 227 U.S. App. D.C. 151 (D.C. Cir. 1983)). 

The names of the grower, processor, distributors, brokers, and retail or food service outlets linked to this outbreak do not qualify as “commercial or financial” information under any reasonable reading of the statute. They do not reveal confidential business strategies, proprietary processes, financial data, or any other competitively sensitive material. Rather, they are factual identifiers of entities involved in the supply chain of a contaminated food product that caused a deadly public health outbreak. 

The D.C. Circuit directly addressed this issue in Citizens for Resp. & Ethics in Wash. v. United States DOJ, rejecting the argument that a contractor’s names could be withheld merely because disclosure might result in reputational damages or economic consequences. The Court explained:

The Bureau does not explain in any detail how a contractors’ name is commercial “in and of itself”—that is, how the name “serves a ‘commercial function’ or is of a ‘commercial nature.’” Instead, the Bureau rests its claim of exemption exclusively on the potential commercial consequences of disclosure, asserting that the contractors could face public hostility and resulting economic harm if their names were disclosed. […] But the commercial consequences of disclosure are not on their own sufficient to bring confidential information within the protection of Exemption 4 as “commercial.”

58 F.4th 1255, 1267-1268 (internal citations omitted).

            The Court warned that allowing government agencies to withhold information based solely on the prospect of public scrutiny would invert FOIA’s purpose: 

Under the Bureau’s approach, whenever public scrutiny might have reputational repercussions with potential knock-on commercial effects, the government and a contractor could shield information from public view simply by agreeing to keep it secret. That is not what Congress had in mind when it protected “citizens’ right to be informed about ‘what their government is up to.’” 

Id. at 1267-1268.

The same logic applies here. Merely identifying the entities involved in the distribution of contaminated food does not transform their names into “commercial” information. Exemption 4 does not—and cannot—stretch that far, particularly given that FOIA exemptions “must be narrowly construed.” Id. at. 1261.

• The Withheld Information Was Not “Obtained from a Person”

Exemption 4 applies only to information “obtained from a person.” 5 U.S.C. § 552 (b)(4).  FOIA broadly defines “person” to include “an individual, partnership, corporation, association, or public or private organization other than an agency.” 5 U.S.C. § 551(2). Courts have consistently held that information is “obtained from a person” only if it originates outside the federal government. Ctr. for Biological Diversity v. United States Forest Serv., 2025 U.S. Dist. LEXIS 59288 at *19 (D.D.C. 2025); see also Elec. Priv. Info. Ctr. v. DHS, 117 F. Supp. 3d 46, 63 (D.D.C. 2015) (“Information is considered ‘obtained from a person’ … so long as the information did not originate within the federal government.”) 

Although this standard can encompass agency documents that directly summarize or restate third-party data, it does not extend to information that has been independently generated or substantively reformulated by the government. “[W]hen an agency analyzes, rather than just summarizes, third-party information, such information will not be considered ‘obtained from a person.’” 2025 U.S. Dist. LEXIS 59288 at *19 (quoting Philadelphia Newspapers, Inc. v. HHS, 69 F. Supp. 2d 63, 66-67 (D.D.C. 1999).

That distinction is dispositive here. The identities of the grower, processor, distributors, broker, and retail or food service outlets were not supplied to the FDA by any external party. Rather, the FDA independently uncovered these entities through its own traceback investigation, conducted in coordination with other federal agencies. The agency did not merely compile or summarize date submitted by third party—it generated new information through its investigative efforts. Accordingly, the redacted identities reflect the FDA’s own analysis and do not qualify as information “obtained from a person” under Exemption 4. 

• The Withheld Information Is Not “Privileged or Confidential”

To qualify as “confidential” under Exemption 4, information must meet at least one of the two conditions described by the Supreme Court in Food Mktg. Inst. v. Argus Leader Media, 588 U.S. 427, 434, 139 S. Ct. 2356, 204 L. Ed. 2d 742 (2019). First, the information must be “customarily kept private, or at least closely held, by the person imparting it.” Id. Second, the government must provide “some assurance that it will remain secret.” Id. Neither condition is satisfied here. 

First, the identities of growers, processors, brokers, distributors, and retail or food service outlets involved in this outbreak are not the type of information that is customarily kept private. These entities operate in public-facing, highly regulated sectors—agriculture, food distribution, and retail sales—where their roles in the supply chain are widely known or readily discoverable through public sources. Farms, processors, and distributors routinely disclose their customers, partners, and supply chains for marketing, compliance, and logistics purposes. Unlike trade secrets, pricing models, or proprietary formulas, the basic fact of who grew or sold a food product is not “known only to a limited few” or “intended to be held in confidence or kept secret.” Id. at 434. Indeed, many of these entities advertise their participation in national supply chains and their relationships with retailers or food service companies. Moreover, as detailed above, the FDA did not receive this information from any external party; it uncovered and synthesized it through its own independent investigation. This further undercuts any claim that the information was “imparted” by a “person” in confidence, as required under Food Mktg. Inst. v. Argus.

Second, there is no indication that the FDA gave any assurance—formal or informal—that the identities of these entities would be kept confidential. On the contrary, disclosure is standard practice in many foodborne illness outbreaks, where identifying implicated parties is critical for public health response and consumer protection. The FDA’s own policies emphasize transparency, particularly in matters involving acute risk to human health. Without any assurance of confidentiality and no consistent, established practice of secrecy by the entities themselves, the withheld information simply does not meet the definition of “confidential” under Exemption 4.

• The Public Interest Demands Disclosure

FOIA exists “to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.” Citizens, 58 F.4th at 1261 (internal citations omitted). Disclosure—not secrecy—is the dominant objective of the Act. Id.Accordingly, the exemptions to FOIA must be “narrowly construed,” and the burden of justifying any withholding rests with the agency. Id. at 1261-1262.

            Exemption 4 does not—and cannot—shield information from public scrutiny simply because its release may cause discomfort to private entities or government agencies. The statute protects confidential commercial information, not reputational interests or the government’s desire to avoid controversy. Id. at 1268. 

            Here, the public interest in disclosure is overwhelming. The FDA has withheld the identities of entities linked to a deadly E. coli O157:H7 outbreak that sickened at least 89 people across 15 states, caused seven cases of hemolytic uremic syndrome (HUS), and led to one death. Traceback analysis revealed that the outbreak strain matched six prior E. coliclusters—strong evidence of a persistent, resident strain at or near the source. Disclosure is essential to public accountability and future prevention. 

            Even though the outbreak investigation is closed, the health risks remain. Without transparency about where the contamination occurred and who was responsible, the public, regulators, and industry cannot take informed steps to prevent recurrence. This is precisely the kind of secrecy FOIA was enacted to prevent: where withholding information compromises public health and conceals systemic failures from the scrutiny necessary to correct them. 

            Accordingly, we respectfully request that the FDA disclose the names of the grower, processor, broker, distributors, and points of service identified in its investigation. The law does not support secrecy here—and neither does public interest.

Very truly yours, 

William D. Marler

---

^[1] https://www.marlerblog.com/files/2025/04/2411MOEXH-2-Romaine-E.-coli-FDA-Records.pdf

Republished with permission from Bill Marler and Marler Clark. Copyright (c) Marler Clark LLP, PS. All rights reserved.

Source: https://www.marlerblog.com/case-news/hey-fda-how-about-some-real-radical-transparency-or-just-transparency/