Indiana’s public records law just changed: HEA 1360, explained.
Effective July 1, 2026, the Access to Public Records Act authorizes screening portals, adds denial grounds for data scraping and phishing, lets agencies prioritize Indiana residents, creates an out-of-state fee, and puts new reporting duties to the Public Access Counselor on every agency. Here is what a records office actually has to do differently.
- Effective date
- July 1, 2026. HEA 1360, enacted as P.L.97-2026, signed March 4, 2026
- Request portals
- CAPTCHA, address verification, and residency screening now authorized (IC 5-14-3-3.3(a))
- New denial grounds
- Suspected data scraping, phishing, or electronic-system security risk (IC 5-14-3-3.3(b)), with mandatory PAC notice within 7 days of receipt (IC 5-14-3-3.3(c))
- Resident priority
- Agencies may prioritize Indiana residents and civic, journalistic, academic, or personal-use requests (IC 5-14-3-8.1(a))
- Out-of-state fee
- Supplemental, cost-related, capped at $0.25/page plus $25/hour of staff time, waivable in the public interest (IC 5-14-3-8(n) and (o))
- Suspect-request reporting
- Mandatory reports to the Public Access Counselor via a standardized mechanism (IC 5-14-3-11); first annual reports due June 11, 2027 per PAC guidance
What HEA 1360 is, and why it exists
On March 4, 2026, Indiana enacted HEA 1360 as P.L.97-2026, and its amendments to the Access to Public Records Act took effect July 1, 2026. APRA (IC 5-14-3) is Indiana’s FOIA equivalent: the statute that gives any person the right to inspect and copy the records of state and local government. The Office of the Public Access Counselor (PAC) has published an official overview of the changes, and that document is worth keeping next to the statute; it is the state’s own guidance on how the new provisions are meant to work.
The through-line of the amendments is the bot era. Agencies across the country have been receiving high volumes of automated requests: scripts that scrape record portals, phishing attempts dressed up as records requests, and bulk submissions from out-of-state operations. HEA 1360 gives Indiana agencies specific tools for that problem: screening portals, narrow new denial grounds, permission to put Hoosiers first in the queue, a cost-recovery fee for out-of-state requesters, and, in exchange, new transparency duties owed to the PAC. Each tool comes with its own conditions, and a small office that starts using them without the paperwork to match is trading one compliance problem for another.
Request portals with CAPTCHA and residency screening
Agencies may now establish an electronic portal for records requests that incorporates a CAPTCHA or equivalent human check, requires verification of the requester’s physical address, indicates whether the requester is an Indiana resident, and automatically tracks and reports submissions suspected to be automated or to come from known sources of phishing or data scraping (IC 5-14-3-3.3(a)).
Two practical points. First, this is an authorization, not a mandate: an office that takes requests by mail and email today does not have to build anything. Second, a portal does not change the response clock. A request submitted through a section 3.3 portal rides the same rule as a mailed or faxed request: a denial of disclosure does not occur until 7 days have elapsed from the date the agency receives it (IC 5-14-3-9(c)). How APRA’s clocks work, and how they differ from most other states, is covered in our Indiana APRA deadlines guide.
The new denial grounds, and the 7-day notice that comes with them
An agency may now decline to respond to a request when it suspects the request is data scraping or phishing activity, or when it suspects that responding electronically could expose its electronic systems or data to unauthorized access or alteration, or otherwise jeopardize their security (IC 5-14-3-3.3(b)). The statute defines both terms: data scraping is the use of an automated system to extract data from websites and other Internet-accessible sources (IC 5-14-3-2(d)), and phishing is obtaining information through fraud, where the sender intentionally misrepresents their identity to induce the recipient to divulge information or grant access to it (IC 5-14-3-2(p)).
The condition attached is easy to miss and easy to blow: when an agency declines a request on these grounds, it must notify the Public Access Counselor of the request and the reason not later than 7 days after receiving the request (IC 5-14-3-3.3(c)). The clock runs from receipt, not from the decision to deny. An office that sits on a suspect request for a week and then declines it has already consumed the entire notice window.
The PAC’s overview adds a caution every office should internalize: an agency may not deny a request solely because it appears automated. Only suspicion of scraping, phishing, or a cybersecurity risk supports a denial under 3.3(b). A request that merely looks machine-generated is a reporting matter, covered below, and at most a candidate for deprioritization.
Separately, HEA 1360 added a discretionary ground unrelated to bots: an agency may deny a request made by a party to pending or ongoing litigation when the request duplicates a discovery request that party made in the litigation (IC 5-14-3-4(e)). As with any written denial, the response must state the specific exemption relied on and name the person responsible for the denial (IC 5-14-3-9(d)).
Residents first: prioritization and the out-of-state fee
For the first time, APRA says out loud what many offices quietly wished for: an agency may give priority in fulfilling requests to Indiana residents and to requests submitted for civic, journalistic, academic, or personal use (IC 5-14-3-8.1(a)). Requests identified as originating from out-of-state entities or automated systems may be delayed as necessary to prevent disruption of core agency functions, and may be subject to the new supplemental fee (IC 5-14-3-8.1(b)).
That fee is its own provision. An agency may collect a supplemental fee for processing requests submitted by non-Indiana residents or out-of-state entities. It must be reasonably related to the cost of fulfilling the request and is capped at $0.25 per page plus $25 per hour of staff time spent processing the request (IC 5-14-3-8(n)). The agency may waive it when the request serves the public interest (IC 5-14-3-8(o)).
For a city, town, or township office, the operational step matters as much as the authority. Local copying and certification fees are established by the fiscal body under IC 5-14-3-8(d), so the sound path for the new supplemental fee is the same one: put it on the council or board agenda, adopt it into the fee schedule, and only then start charging it. An office collecting a fee its fiscal body never adopted is the kind of finding nobody wants in an audit. The full fee landscape, including what APRA forbids charging for, is in our Indiana APRA fee guide.
The reporting duties: every suspect request goes to the PAC
The trade for all this new discretion is visibility. Beyond the 7-day denial notice, an agency must report to the Public Access Counselor any request it suspects of being automated, data scraping, or phishing activity, through a standardized mechanism the PAC prescribes (IC 5-14-3-11). Note the scope: this reporting duty covers suspected automated requests too, including ones the agency answers normally. Reporting and denying are separate tracks.
On the receiving end, the PAC’s duties were expanded to match: coordinating with agencies to track the volume and nature of records requests and to identify patterns or sources of excessive, automated, phishing-related, or scraping-based requests (IC 5-14-4-10(8)). Per the PAC’s overview guidance, agencies’ first annual reports are due June 11, 2027. The practical translation for a small office: the request log you keep this year is the raw material for a report you owe next year, so it needs fields the old log probably lacked, such as intake channel, requester residency, a suspected-automation flag, denial grounds, and PAC notice dates.
Dekree runs this workflow for Michigan local governments today: request intake, deadline tracking, drafted responses, and reporting in one place. We are bringing the platform to Indiana next. If you want it in your office, email contact@dekree.ai with the subject line Indiana and we will add your office to the Indiana rollout list.
What to change in your office, starting now
A short working list. Decide whether you will use the new tools at all; every one of them is permissive. If you want the out-of-state fee, draft the fee schedule update and get it adopted by your fiscal body before the first invoice (IC 5-14-3-8(d), 8(n)). Update your request log so each request records intake channel, requester residency, and a suspected-automation flag, because those fields feed the PAC reporting duty (IC 5-14-3-11) and the annual report cycle that begins June 11, 2027. Write the 7-day PAC notice into your denial procedure so that any 3.3(b) denial triggers the notice automatically, counted from the date the request arrived, not the date you decided (IC 5-14-3-3.3(c)). And train whoever opens the mail on the one line that keeps an office out of trouble: looking automated is a reason to report and maybe to deprioritize, never by itself a reason to deny. The response clocks themselves did not change; if those are shaky, start with the deadlines guide and build from there.
Common questions
What is HEA 1360 and when did it take effect?
HEA 1360, enacted as P.L.97-2026, was signed March 4, 2026 and took effect July 1, 2026. It amends the Access to Public Records Act (IC 5-14-3), Indiana’s FOIA equivalent: it authorizes request portals with CAPTCHA and residency screening (IC 5-14-3-3.3(a)), adds denial grounds for suspected data scraping, phishing, and electronic-system security risk (IC 5-14-3-3.3(b)), permits prioritizing Indiana residents (IC 5-14-3-8.1), creates a supplemental out-of-state fee (IC 5-14-3-8(n)), and requires reporting suspect requests to the Public Access Counselor (IC 5-14-3-11). The Office of the Public Access Counselor has published an official overview of the changes.
Can an Indiana agency deny a request just because it looks automated?
No. The denial grounds in IC 5-14-3-3.3(b) are suspected data scraping or phishing activity, or a suspicion that responding electronically could expose or jeopardize the security of the agency’s electronic systems or data. The Public Access Counselor’s overview of HEA 1360 cautions that an appearance of automation alone does not support a denial. A request suspected of being automated is a reporting matter under IC 5-14-3-11, not by itself a reason to refuse. Agencies may deprioritize requests from automated systems under IC 5-14-3-8.1(b), which is a matter of order and timing, not refusal.
What is the new out-of-state fee under Indiana APRA and how should an office adopt it?
IC 5-14-3-8(n) lets a public agency collect a supplemental fee for processing requests submitted by non-Indiana residents or out-of-state entities. The fee must be reasonably related to the cost of fulfilling the request and may not exceed $0.25 per page plus $25 per hour of staff time spent processing the request. It may be waived when the request serves the public interest (IC 5-14-3-8(o)). Because local copying and certification fees are set by the fiscal body under IC 5-14-3-8(d), the sound path is to have the fiscal body adopt the supplemental fee into the fee schedule before anyone is charged it.
What must an Indiana agency now report to the Public Access Counselor?
Two things. First, if the agency declines to respond to a request under IC 5-14-3-3.3(b), it must notify the Public Access Counselor of the request and the reason within 7 days of receiving the request (IC 5-14-3-3.3(c)). Second, under IC 5-14-3-11 the agency must report any request it suspects of being automated, data scraping, or phishing activity, through a standardized mechanism the PAC prescribes. The PAC also now coordinates with agencies to track request volume and identify patterns (IC 5-14-4-10(8)); per the PAC’s overview guidance, agencies’ first annual reports are due June 11, 2027.
Can an agency deny an APRA request that duplicates discovery in a lawsuit?
It may, at its discretion. Under IC 5-14-3-4(e), a public agency may deny a request that is made by a person who is a party to pending or ongoing litigation and that is duplicative of a discovery request the person made in that litigation. This is permissive, not mandatory, and the usual written-denial formalities still apply: a written denial must state the specific exemption relied on and name the person responsible for the denial (IC 5-14-3-9(d)).
This article is educational information for Indiana public agencies, current as of the publication date. It is not legal advice, and statutes and court decisions change. Confirm specifics with your agency attorney. Statute text: iga.in.gov.