In March, Indiana enacted HEA 1360 and HEA 1210, which will affect how Indiana political subdivisions and public agencies communicate with the public and manage access to public records requests.
HEA 1360: APRA Requests and Emerging Electronic Risks
HEA 1360 amends I.C. § 5-14-3, also known as Indiana’s Access to Public Records Act (APRA), governing requests for access to public records. Effective July 1, 2026, this law preserves the basic framework of public records access while giving agencies new authority to verify requesters, prioritize certain requests, charge limited supplemental fees to out-of-state requesters, delay some automated or out-of-state requests when necessary to protect agency operations, and decline to respond to requests suspected of being phishing, data scraping, or a cybersecurity risk.
New Tools for Emerging Electronic Risks
HEA 1360 addresses the increasing number of public records requests driven by data scraping and phishing activities. The law defines “data scraping” as the use of an automated system to extract data from websites and other internet-accessible sources. “Phishing” refers to a fraudulent method of obtaining information in which the sender misrepresents the sender’s identity to induce the recipient either to divulge information or to take an action that allows access to information.
A public agency may decline to respond if it suspects that a request is data scraping or phishing activity. The agency may also decline to respond if it suspects that an electronic response could create a cybersecurity risk, including unauthorized access to or alteration of agency systems or data.
Electronic Portals and Requester Verification
The law allows public agencies to use electronic request portals that include identity-verification and anti-automation features, such as CAPTCHA or an equivalent mechanism to confirm that the requester is human. Agencies may also require verification of a requester’s physical address and may use the portal to determine whether the requester is an Indiana resident. Requests submitted through an electronic portal are also incorporated into APRA’s response-timing rules.
Indiana Public Access Counselor’s Expanded Role
When an agency declines to respond under the new anti-scraping, anti-phishing, or cybersecurity authority, it must notify the Indiana Public Access Counselor (“PAC”) not later than seven days after receiving the request and state the reason it declined to respond. Separately, agencies must report suspected automated requests, data-scraping activity, and phishing activity through a standardized mechanism prescribed by the PAC.
The PAC will also have new duties to coordinate with public agencies to track the volume and nature of public records requests and to identify patterns or sources of excessive, automated, phishing-related, or data-scraping-based requests.
New Rules for Out-of-State Requesters and Automated Requests, Including Optional Fees
Public agencies may give priority to requests from Indiana residents. Agencies may also prioritize requests submitted for civic, journalistic, academic, or personal use. Conversely, requests identified as originating from out-of-state entities or automated systems may be delayed as necessary to prevent disruption of core agency functions.
The law also authorizes a supplemental fee for public records requests submitted by non-Indiana residents or out-of-state entities. The fee must be reasonably related to the cost of fulfilling the request and may not exceed twenty-five cents per page and twenty-five dollars per hour of staff time spent processing the request. A public agency may waive the supplemental fee if it finds that the request serves the public interest.
Certain Litigation-Related Requests May Be Denied
The law also addresses the overlap between public records requests and litigation discovery. A public agency may deny a public records request if the request is made by a person who is a party to pending or ongoing litigation and the request is duplicative of a discovery requests made by that party in the litigation. This change does not appear to bar all public records requests by litigants, but it gives agencies another basis to deny duplicative requests.
What the New Law Means
If you are a public agency subject to HEA 1360’s new changes, consider the following as you prepare for implementation:
- Evaluate how to adopt or update electronic public records request portals. Consider how to implement human-verification tools, physical-address verification, residency indicators, and automated tracking for suspicious submissions.
- Develop internal procedures for identifying requests that may be automated, phishing-related, data-scraping-based, or likely to create cybersecurity risks. Create a process for documenting the reason for the decision and making timely reports to comply with the law and requirements imposed by the PAC.
- Consider policies for prioritizing requests, assessing supplemental fees for non-Indiana residents and out-of-state entities, and develop consistent guidance on when a fee waiver serves the public interest.
- Contact your attorney to update your agency’s record request procedures and to ensure compliance with the new provisions of the law concerning your agency’s portal, verification, reporting, fees, prioritization, and cybersecurity.
HEA 1210: Public Notice Publication Options
Section 22 of HEA 1210 amends I.C. § 5-3-1-1.5, which governs publication of public notices by political subdivisions. Effective July 1, 2027, when officers of a political subdivision are required to publish a notice, they may satisfy the notice requirement by using any one, or any combination, of the following three methods:
- Newspaper publication — either in a print edition newspaper published in or circulating within the relevant political subdivision, or in an electronic edition published by that same newspaper.
- Locality newspaper publication — either in a print edition locality newspaper circulating within the relevant political subdivision, or in an electronic edition published by that locality newspaper.
- Political subdivision website — publication on the political subdivision’s own website in accordance with I.C. § 5-3-5.
Overrides Medium-Specific Statutory Requirements
Subsection (c) of the law specifies that the change in publication requirements applies “notwithstanding any express statutory requirement of publishing notice in a specific form of media.” In effect, even if another Indiana statute says notice must appear in a newspaper, the amendment allows the political subdivision to use any of the three approved methods instead. This creates a unified rule for the method of publication, but it does not displace other statutory requirements such as deadlines or frequency for publication.
Public Access to Electronic Notices
To ensure that digitizing public notices does not create new barriers to access, the law provides that newspapers and locality newspapers may not charge a fee to view or search their electronic editions for public notices and may not require a person to register on the newspaper’s or locality newspaper’s website to view or search for public notices.
Pricing Parity
The basic charge for publication of a notice in an electronic edition of a newspaper or locality newspaper must be the same as the charge for publication in the print edition. This establishes pricing parity for print and electronic-edition publication.
Repeals Prior Website-Posting Mandate
The law also repeals language that previously required newspapers maintaining a website to post all published notices to their website on the same day as print publication, as well as language that required the State Board of Accounts to develop a standard form for website postings and prohibited newspapers from charging for website postings.
What the New Law Means
For political subdivisions and local government officials: Beginning July 1, 2027, you will have greater discretion in how you publish required notices. Publishing on your own government website could satisfy notice requirements in most cases, potentially reducing costs associated with newspaper advertising, avoiding issues surrounding navigating newspaper publication dates, and meeting varying deadlines for receipt of the notice prior to publication. However, you should confirm that your website-based publication still meets the requirements of I.C. § 5-3-5 and other state law timing and frequency obligations. Contact your attorney to ensure compliance.
Conclusion
Collectively, these changes suggest a broader regulatory trend: Indiana is modernizing public access rules for a digital environment while preserving core transparency obligations.
For public notice, the key compliance takeaway is that political subdivisions will have more flexibility in how they publish required notices, but they must continue to track the same statutory timing, frequency, content, and proof-of-publication requirements that apply to the notice itself.
For public records, the takeaway is more operational. Public agencies should review APRA intake procedures, electronic portal design, requester-verification practices, fee and waiver protocols, documentation standards, PAC reporting processes, and litigation-hold or discovery coordination procedures.
For more information on public notice publication requirements or public records access requests, please contact the author or any attorney with FBT Gibbons’ Government Services practice group.
*Kepler Zhang, a first-year law student at Indiana University Maurer School of Law, contributed to this article while working as a summer associate at FBT Gibbons.