Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
HHS  A , A , 
  DOPTED   DMINISTERED  
 
G F
AND    ENERALLY  OLLOWED 
 
C I
L  ASSIFIED  NFORMATION 
 
P  
  OLICIES 
 
 
 
Daniel R. Levinson   
Inspector General  
 
May 2013 
OEI-07-12-00400   
   
EXECUTIVE SUMMARY:  HHS ADOPTED, ADMINISTERED, AND 
GENERALLY FOLLOWED CLASSIFIED INFORMATION POLICIES 
OEI-07-12-00400 
 
 
WHY WE DID THIS STUDY 
 
The Reducing Over-Classification Act of 2010 mandates that the Inspector General of 
each agency of the United States with an officer or employee who is authorized to make 
original classification decisions conduct two evaluations.  One evaluation is intended to 
(1) assess whether applicable classification policies have been adopted, effectively 
administered, and followed; and (2) identify practices that may contribute to 
misclassification of material.  This evaluation must be completed by September 30, 2013.  
A second evaluation must be completed by September 30, 2016, and must review 
progress made pursuant to the results of the first.  This report pertains to the first required 
evaluation and assesses whether the Department of Health and Human Services (HHS) 
has adopted, effectively administered, and followed polices regarding classified national 
security information (NSI).  The second objective is addressed in the report entitled 
Originally and Derivatively Classified Documents Met Most Federal Requirements  
(OEI-07-12-00401). 
 
HOW WE DID THIS STUDY  
 
We identified and reviewed all of HHSs classified NSI guidance documents to determine 
their scope and content. We compared HHSs National Security Information Handbook  
(Handbook) to an Executive Order and its implementing Directive to determine whether 
it was consistent with Federal requirements.  We interviewed officials responsible for 
ensuring that HHSs classified NSI policies are effectively administered and followed.  
Finally, we surveyed Classification Security Officers responsible for providing guidance 
and oversight to their operating or staff divisions. 
 
WHAT WE FOUND 
 
HHS has adopted policies for classified NSI that are consistent with Federal 
requirements.  HHS used annual status reports and self-inspections to ensure that its 
classified NSI policies are effectively administered.  Finally, HHS provided guidance and 
training to individuals who access classified NSI to ensure that classified NSI policies are 
followed; however, not all Classification Security Officers received guidance or training. 
 
WHAT WE RECOMMEND 
 
We recommend that the  Office of Security and Strategic Information (OSSI), working on 
behalf of the Office of the Secretary, clarify who is responsible for ensuring that 
Classification Security Officers receive training and ensure that all Classification Security 
Officers receive guidance and training regarding classified NSI.  OSSI concurred with 
both recommendations and described actions taken to address them. 
     
   
TABLE OF CONTENTS 
 
Objective......................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................4 

Findings........................................................................................................6 

HHS has adopted policies for classified NSI that are consistent 
with Federal requirements ................................................................6 

HHS used annual status reports and self-inspections to ensure    

that its classified NSI policies are effectively administered ............7 

HHS provided guidance and training to individuals who access 

classified NSI to ensure that its classified NSI policies are 

followed; however, not all Classification Security Officers  

received guidance and/or training....................................................8 

Conclusion and Recommendation .............................................................11 
 
Agency Comments and Office of Inspector General Response .....12 

Appendix....................................................................................................13 

A: Definition of Each Classification Level ...................................13 

B: Agency Comments  ...................................................................14 

Acknowledgments......................................................................................16
 
 
     
   
OBJECTIVE 
To assess the extent to which the Department of Health and Human Services 
(HHS) has adopted, effectively administered, and followed applicable policies, 
procedures, rules, and regulations regarding classified national security 
information (NSI).  
BACKGROUND 
Classified NSI is information that requires protection against unauthorized 
disclosure and is marked to indicate its classified status.1   The Reducing 
Over-Classification Act of 2010 (the Act) mandates that the Inspector General of 
each agency of the United States with an officer or employee who is authorized to 
make original classification decisions conduct two evaluations.  One evaluation is 
intended to (1) assess whether applicable classification policies, procedures, rules, 
and regulations (policies) have been adopted, effectively administered, and 
followed; and (2) identify policies, procedures, rules, and regulations, or 
management practices (practices) that may contribute to misclassification of 
material.2  This evaluation must be completed by September 30, 2013.  A second 
evaluation must be completed by September 30, 2016, and must review progress 
made pursuant to the results of the first evaluation.  This report assesses whether 
policies have been adopted, effectively administered, and followed.  A companion 
report, entitled Originally and Derivatively Classified Documents Met Most 
Federal Requirements (OEI-07-12-00401), identifies practices that may 
contribute to misclassification of information.  Both reports are being published 
concurrently. 
In addition, the Information Security Oversight Office (ISOO) of the National 
Archives and Records Administration requested that Inspectors General review 
their agencies classified documents to determine whether the information within 
them was classified in accordance with Federal requirements.3 For information 
regarding ISOOs request, see Originally and Derivatively Classified Documents 
Met Most Federal Requirements (OEI-07-12-00401). 
Federal Requirements 
Executive Order No. 13526, its implementing Directive,4 and the Act have all 
directed Federal agencies to reduce unnecessary information classification or 
information classification at a higher and more restrictive level than necessary.  
 
1  Executive Order No. 13526, published at 75 Fed. Reg. 707 (Jan. 5, 2010). 

2 P.L. 111-258,   6. 

3 ISOO is responsible to the President for policy  and oversight of the Governmentwide security  classification  

system and the National Industrial Security Program.  ISOO receives policy  and program guidance from the 

National Security Council. 

4 32 CFR pt. 2001. 

HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   1 
   
   
These initiatives are intended to promote information sharing across agencies; 
with State, local, and tribal governments; and with the public.5  
Executive Order No. 13526. In 2009, the President issued Executive Order 
No. 13526, entitled Classified National Security Information.6    This Executive 
Order sets forth a uniform system for classifying, safeguarding, and declassifying 
NSI and outlines the method of implementation. 
Implementing Directive:  Classified National Security Information. Pursuant to 
Executive Order No. 13526, ISOO issued a Directive7, 8 to provide guidance to 
agencies regarding the classification system set forth in the order, including 
guidance on: 
	   original classification,9  
 	  derivative classification,10  
 	  declassification and downgrading,11  
 	  the safeguarding of classified NSI, 
 	  standards for establishing and maintaining an ongoing agency 

self-inspection program, and 

 	  standards for agency security education and training programs.12  
Agency Self-Inspections. Each agency must establish and maintain ongoing 
self-inspection programs that include reviews of representative samples of the 
agencys original and derivative classification actions.13,  14   The self-inspections 
should determine whether the agency has adhered to the requirements for original 
classification, derivative classification, declassification, safeguarding, security 
violations, security education and training, and management and oversight of the 
 
5 S. Rept. No. 111-200, at 1-2 (2010). 

6 Executive Order No. 13526, published at 75 Fed. Reg. 707 (Jan. 5, 2010). 

7  The Executive Order requires ISOO to issue directives as necessary to implement the uniform system for 

classifying, safeguarding, and declassifying NSI. 

8 32 CFR pt. 2001, published at 75  Fed. Reg. 37254 (June 28, 2010). 

9 Original classification is defined as an initial determination, in  the interest of national security, that 

information requires protection from unauthorized disclosure.  Executive Order No. 13526  6.1(ff). 

10  Derivative classification is defined as incorporating, paraphrasing, restating,  or generating information 

that is already classified and marking the material consistent with the classifications that apply to the original 
 
information. Individuals who apply  derivative classification markings need not have original classification 

authority, but must indicate their identity in a manner that is immediately apparent for each derivative 

classification action.  Executive Order No. 13526  6.1(o). 

11 When information no longer meets the standards for classification, it must be declassified or downgraded 

by the official who authorized the original classification, the original classifiers current successor, a 

supervisory official, or an official delegated declassification authority.   Executive Order No. 13526  3.1. 

12 75 Fed. Reg. 3725437275 (June 28, 2010). 

13 The ongoing agency self-inspections are separate from the mandated evaluations required to be conducted 
 
by Inspectors General. 

14 32 CFR  2001.60; Executive Order No. 13526  5.4.  
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   2 
   
   
Executive Order and the Directive.15  Each year, the agency must report the 
findings of its self-inspection program to the Director of ISOO.16  
Agency Security Education and Training. Each agency must establish security 
education and training programs that ensure that all employees who create, 
process, or handle classified information understand the classification, 
safeguarding, and declassification policies and procedures.17  These employees 
include Classification Security Officers and other individuals who have access to 
classified NSI and the appropriate security clearance.  Although these employees 
need not have original classification authority, they may derivatively classify 
information.18  Guidance and training provided to these employees is intended to 
reduce instances of overclassification and ensure that practices regarding  
classification, safeguarding, and declassification are followed. 
HHSs Classified NSI Program 
On January 9, 2012, the Office of Security and Strategic Information (OSSI) 
released HHSs Classified National Security Information Policy.  The purpose of 
the policy is to ensure that all HHS agencies are aware of and compliant with 
Federal requirements related to the sharing, handling, and safeguarding of  
classified NSI.19   This policy clarifies the responsibilities of HHS and division 
officials tasked with implementing HHSs NSI program as set forth in Executive 
Order No. 13526 and Federal regulations. Specifically, this policy indicates that 
the Secretary of HHS (Secretary) serves as the original classification authority 
(OCA)20 for HHS and may classify documents up to the Secret classification 
level.21,  22   This policy also charges the OSSI director with developing 
departmentwide policy and managing and overseeing the classified NSI 
program.23  In addition, the policy requires that each HHS operating division and 
staff division designate a Classification Security Officer.  The Classification 
Security Officer is responsible for providing his or her division with guidance and 
oversight on the handling and safeguarding of classified NSI.  The Classification 
Security Officer is also responsible for conducting an initial review of his or her 
divisions classified documents and coordinating this review with OSSI.24   
 
15 32 CFR  2001.60(c). 

16 32 CFR  2001.60(f). 

17 32 CFR Part 2001, Subpart G; Executive Order No. 13526  4.1(a). 

18 Executive Order No. 13526  6.1(o). 

19 Ibid., p. 3. 

20 An OCA is an individual authorized in writing,  by the  President, the Vice President, agency heads (such as 

the Secretary), or other officials  designated by  the President, to classify information in the first instance.  

Executive Order No. 13526  6.1(gg). 

21 OSSI, Classified National Security  Information Policy, January  9, 2012. 

22 Information may be classified at one of three levels:  (1) Top Secret, (2) Secret, or (3) Confidential.
   
See Appendix A for a description  of each classification level. 

23 OSSI, Classified National Security  Information Policy, January  9, 2012. 

24 Ibid.,  6.4. 

HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   3 
   
   
HHS has implemented the requirements of Executive Order No. 13526 and its 
Directive in greater detail in its National Security Handbook (Handbook), which 
was released on February 17, 2012. It provides procedural guidance to HHS 
employees and contractors who have access to classified NSI and describes 
responsibilities for the handling and safeguarding of NSI.  The Handbook  
indicates that the Secretary has delegated to the Deputy Secretary, the Director of 
OSSI, and the Associate Director of OSSI the authority to originally classify and 
declassify information. 
Related Reports 
In 2011, the Environmental Protection Agency (EPA) Office of Inspector General 
(OIG) was the first to issue its mandated evaluation.25   Although other OIGs are 
reportedly undertaking evaluations, they had not issued reports as of May 2013. 
METHODOLOGY 
We identified and reviewed all of HHSs classified NSI guidance documents to 
determine their scope and content, including HHSs policy and Handbook.2 6   We  
compared the Handbook to Executive Order No. 13526 and the Directive to 
determine whether it was consistent with Federal requirements.  We conducted 
structured interviews with OSSI officials responsible for ensuring that HHSs  
classified NSI policies are effectively administered and followed.  We also 
surveyed Classification Security Officers responsible for providing guidance and 
oversight regarding classified NSI to their divisions. 
We verified that OCAs and Classification Security Officers who have access to 
classified NSI and who derivatively classified information received the required 
guidance and training. However, we did not determine whether other individuals 
who have access to classified NSI and derivatively classify information received 
guidance and training.27   We determined which methods (e.g., self-inspections, 
training) HHS uses to ensure that its classified NSI policies are effectively 
administered and followed.  We did not assess the implementation of those 
methods. 
Data Collection and Analysis 
Identification of NSI Policies. We asked OSSI to provide all of HHSs classified 
NSI guidance, including the current policy and Handbook. Once we identified all 
of HHSs classified NSI guidance, we reviewed each document to determine its 
scope and content. Specifically, we reviewed the Handbook to ensure that  
 
25 EPA OIG,  EPA Should Prepare and Distribute Security Classification Guides, Report No. 11-P-0722, 
September 2011. 
26 In this report we collectively refer to HHSs policy and  Handbook as policies. 
 
27 We chose to limit our review to those individuals responsible for providing the Department and divisions 

with guidance and oversight on the handling and safeguarding of classified NSI.  These individuals  included 

the OCAs and the Classification  Security Officers. 

HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   4 
   
   
guidance regarding the following information was included:  (1) original  
classification, (2) derivative classification, (3) declassification and downgrading, 
(4) safeguarding of classified NSI, (5) standards for establishing and maintaining 
an ongoing agency self-inspection program, and (6) standards for agency security 
education and training programs.  
Interviews With OSSI Officials.   We conducted structured interviews with the 
Director and Associate Director of OSSI to gather information about how OSSI 
ensures that HHSs adopted policies are effectively administered.  Specifically, we 
asked about (1) administration of HHSs self-inspection program and 
(2) procedures for reviewing the Departments classification actions.  Lastly, we 
asked about OSSIs processes and procedures for annually reporting the findings 
regarding the Departments self-inspection program to ISOO. 
We also gathered information from these officials regarding how OSSI ensures 
that the Departments adopted policies are followed.  Specifically, we asked 
questions regarding the (1) dissemination of classified NSI guidance to employees 
who create, process, or handle classified information; (2) identification of staff  
who are required to complete training; (3) training content; and (4) frequency with 
which the training is provided. After conducting the interviews, we analyzed the 
responses of each official.  We compared the responses to identify patterns across 
the various interviews. 
Interviews With Classification Security Officers.   We requested from OSSI the 
names and contact information of all of the designated Classification Security 
Officers at the time of our review.  OSSI provided a roster of 16 primary 
Classification Security Officers for each division required to have such an officer.   
We asked each to confirm his or her status as a Classification Security Officer and 
to complete a survey regarding guidance and training that the Classification 
Security Officer may have received and/or provided regarding classified 
information.  We received and analyzed responses from all 16 Classification 
Security Officers and compared the responses to identify patterns across the 
various surveys. 
Standards 
This study was conducted in accordance with the Quality Standards for Inspection 
and Evaluation issued by the Council of the Inspectors General on Integrity and 
Efficiency.  
   
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   5 
   
   
FINDINGS 
HHS has adopted policies for classified NSI that are 
consistent with Federal requirements  
HHS has adopted policies regarding classified NSI and developed additional 
guidance related to specific division programs and interagency information 
sharing. HHSs policies regarding classified NSI follow Federal requirements 
outlined in Executive Order No. 13526 and its Directive.  Certain HHS divisions 
have developed guidance that further defines policies regarding classified NSI for 
specific programs.  HHS has also developed a draft policy on interagency 
information sharing across Federal agencies within the national security 
community. 
Adopted policies follow Federal requirements  
HHS has adopted a policy entitled Classified National Security Information 
Policy which references Federal requirements on classified NSI and outlines the 
purpose, applicability, and scope of the policy.  It also defines the responsibilities 
of individuals charged with handling and safeguarding classified NSI.  HHS has 
also issued the Handbook, which provides specific instructions for implementing 
Executive Order No. 13526 and its Directive.  The Handbook contains guidance 
on the following topics, which were included in the Executive Order:  (1) original 
classification, (2) derivative classification, (3) declassification and downgrading, 
(4) safeguarding of classified NSI, (5) standards for establishing and maintaining 
an ongoing agency self-inspection program, and (6) standards for agency security 
education and training programs.  HHSs Handbook provides information that 
would assist an individual in completing each of these actions in accordance with 
Federal requirements. 
Additional guidance has been developed for specific programs and 
interagency information sharing 
According to HHSs policy, divisions should establish additional written 
procedures, when necessary, to implement the Departments classified NSI policy.   
As a result, certain divisions have established division-specific policies regarding 
classified NSI.  For example, OSSI and the Food and Drug Administration (FDA) 
have developed a classification guide for FDAs Center for Food Safety and 
Applied Nutrition.28   This guide outlines standard operating procedures regarding 
classified NSI.  The Centers for Disease Control and Prevention (CDC) has also 
developed guidance regarding classified NSI.  For example, CDC issued guidance 
 
28 FDA, Center for Food Safety  and Applied Nutrition Standard Operating Procedures:  National Security  
Classification of Vulnerability Assessments, April 2007.  
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   6 
   
   
to its staff specifically addressing classification and marking of classified NSI.29   
HHS has also developed a policy for interagency information sharing entitled 
HHS Policy for Engagement With the National Security Community via the 
Information Sharing Environment.  This policy designates OSSI, which reports 
directly to the Deputy Secretary on intelligence and counterintelligence issues, as 
the Departments lead on sharing and safeguarding national security information.  
The policy establishes the responsibilities of HHS employees, contractors, and 
divisions related to sharing and safeguarding homeland security information, 
terrorism-related information, law enforcement information related to terrorism,  
or intelligence-related information.30  
HHS used annual status reports and self-inspections to 
ensure that its classified NSI policies are effectively 
administered 
HHS has adopted methods to ensure that its classified NSI policies are effectively 
administered through various methods.  For example, Classification Security 
Officers are required to complete annual status reports that document how their 
divisions handle and safeguard classified NSI.31  OSSI officials also conduct 
periodic self-inspections to determine whether derivatively classified documents 
were classified in accordance with Federal requirements.  Finally, the findings 
from the Classification Security Officers annual status reports and OSSIs  
self-inspections are used to complete required reporting forms and develop HHSs  
annual self-inspection report, which is provided to the Director of ISOO. 
Classification Security Officers completed required annual status 
reports 
To ensure that HHSs policies related to classified NSI are effectively 
administered, OSSI officials reported that each Classification Security Officer 
completed the required Annual Status Report on Classified Information (annual 
status report).32  The report is a self-assessment tool that Classification Security 
Officers complete to report how classified documents are being handled and 
safeguarded throughout HHS. The annual status report requires Classification 
Security Officers to provide specific information about their divisions 
 
29 CDC, National Security  Information Classification & Control Markings, 2012; CDC, Document Marking 
Briefing, 2012. 
30  OSSI, Policy for Engagement With the National Security Community via the Information Sharing  
Environment (ISE), November 29, 2012. 
31 Classification Security Officers are required to conduct security  inspections  of  all offices in their  divisions 
that store or handle classified information to ensure that individuals responsible for classified information 
comply with classified NSI policies.  Further,  these officers are required to audit their divisions classified 
documents.  The results of the security  inspections and the audits  are reported on the HHS Annual Status  
Report on Classified Information forms, also referred to as annual status reports. 
32 Classification Security Officers  serving in divisions that did not develop  and/or  maintain classified NSI did  
not complete the annual status report. 
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   7 
   
   
classification management programs.  This information includes the location, 
number, and classification level of the classified documents; and the number of 
derivative classification decisions.  OSSI officials reported that they use these 
annual status reports to determine which divisions may need additional training. 
OSSI conducted annual self-inspections 
OSSI officials also reported that they conducted annual self-inspections to ensure 
that HHSs classified NSI policies were effectively administered.  The 
self-inspections included reviewing a sample of derivatively classified documents 
and conducting informal site visits to determine whether documents are classified 
in accordance with Executive Order No. 13526.  One OCA stated that, during a 
self-inspection, she would review the [derivative] classification decision with the 
individual making the classification and talk about any issues.  OSSI officials 
reported that they conducted periodic informal site visits to the divisions to ensure 
that classified documents were being handled and safeguarded in accordance with 
HHS policy and Federal requirements. 
Findings from the Classification Security Officers annual status 
reports and the self-inspections were reported to ISOO 
HHSs self-inspection report included descriptions of the Departments  
self-inspection program and findings, which included information from the 
Classification Security Officers annual status reports.  HHSs self-inspection 
report addressed all topics required by Executive Order No. 13526 (original 
classification, derivative classification, declassification, safeguarding, security 
violations, security education and training, and management and oversight).  
OSSI officials reported that they are required to complete both the Agency 
Security Classification Management Program Data form, also referred to as 
Standard Form 311, and the self-inspection report annually and submit them to 
the Director of ISOO by November.  The Associate Director of OSSI provided 
copies of both Standard Form 311 and the self-inspection report for 2011; both of 
these documents were submitted to ISOO by the November 2011 deadline. 
HHS provided guidance and training to individuals who 
access classified NSI to ensure that its classified NSI 
policies are followed; however, not all Classification 
Security Officers received guidance and/or training 
HHS adopted various methods to ensure that its policies regarding classified NSI 
are followed.  For example, guidance and training regarding HHSs classified NSI 
policy and Handbook are disseminated to individuals who develop and access 
classified information.  These individuals include the four OCAs (the Secretary,  
Deputy Secretary, Director of OSSI, and Associate Director of OSSI), 
Classification Security Officers, and individuals who possess security clearances. 
   
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   8 
   
   
Guidance regarding HHSs policy and Handbook was reportedly 
disseminated to administrative leads, Classification Security 
Officers, and other individuals who access classified NSI; however, 
not all Classification Security Officers received guidance 
To ensure that HHSs policies related to classified NSI are followed, OSSI 
officials reported that they disseminated guidance to lead administrators, OCAs, 
Classification Security Officers, and other individuals who access classified NSI.  
OSSI officials reported that HHSs Classified National Security Information 
Policy was disseminated directly to the lead administrators of the divisions.  OSSI 
officials reported that the Handbook was also disseminated directly to the 
Classification Security Officers, who are responsible for ensuring that their 
divisions adhere to policies for handling classified NSI.  OSSI officials further 
reported that the classified NSI policy and Handbook were disseminated to the 
four OCAs.33  Policies related to classified NSI and the Handbook are updated 
each time a relevant Executive Order is issued.  
Of the 16 Classification Security Officers surveyed, 13 indicated that they had 
received guidance regarding HHSs policies for handling and classifying 
information since becoming Classification Security Officers.  Four specifically 
reported receiving HHSs Handbook. Of the nine Classification Security Officers 
who did not report receiving the Handbook, eight reported receiving HHSs 
policy or general guidance from OSSI concerning classified information; one 
reported receiving information but could not recall the content.  Of the three 
Classification Security Officers who indicated that they did not receive guidance, 
two reported that their divisions did not develop or maintain classified 
information.  The third reported that he had not received guidance since joining 
HHS in 2010. However, he reported receiving training related to classified NSI 
from his former Federal employer. 
Training was reportedly provided to OCAs, Classification Security 
Officers, and other individuals who accessed classified NSI; 
however, not all Classification Security Officers received training 
OSSI officials reported that HHS has established required training for individuals 
who develop and access classified NSI (OCAs, Classification Security Officers, 
and individuals with security clearances).  The four OCAs are required to 
complete annual training on making original classification decisions.  The OCAs 
are also required to complete annual refresher training.  OSSI officials reported 
that all four OCAs had completed their annual training for 2012. 
OSSI officials indicated that Classification Security Officers are also required to 
receive training. Of the 16 Classification Security Officers surveyed, 14 indicated 
that they had received some type of training since becoming Classification 
 
33 OSSI officials confirmed that all four OCAs received HHSs policy and  Handbook. 
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   9 
   
   
Security Officers for their divisions.  These 14 Classification Security Officers 
reported receiving training on a number of topics, including handling and 
safeguarding classified information, transmitting classified information, original 
classification, derivative classification, downgrading and declassification, 
marking of classified materials, and storage of classified information.  The two 
who did not receive training reported that their divisions do not develop or 
maintain classified information. 
In addition to OCAs and Classification Security Officers, other individuals with 
access to classified NSI are required to receive training.  OSSI officials reported 
that these individuals received training on topics such as handling, safeguarding, 
identifying, and marking classified NSI. 
   
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   10 
   
   
CONCLUSION AND RECOMMENDATION 
As mandated by the Reducing Over-Classification Act, we assessed whether HHS 
has adopted, followed, and effectively administered policies regarding classified 
NSI. HHSs policies for classified NSI are consistent with Federal requirements  
outlined in Executive Order No. 13526 and its implementing Directive.  Some  
HHS divisions have established additional procedures to implement the 
Departments classified NSI policy, such as FDAs classification guide for the 
Center for Food Safety and Applied Nutrition, CDCs guidance on classification 
and marking of classified NSI, and a draft policy on interagency information 
sharing across Federal agencies.  Additionally, to ensure that its classified NSI 
policies are effectively administered, HHS requires annual status reports and 
self-inspections. HHS uses the findings from the annual status reports and 
self-inspections to provide ISOO with information regarding HHSs classified 
NSI program. Finally, HHS provides guidance and training to individuals who 
access classified NSI to ensure that its policies are followed.  However, not all of 
the Classification Security Officers received the guidance or training.  
We conclude that HHS has adopted policies regarding classified NSI and methods 
to ensure that the adopted policies are effectively administered and followed.  
However, the methods that HHS uses to ensure that Classification Security 
Officers receive appropriate guidance and training may not be effective.  
Therefore, we recommend OSSI, working on behalf of the Office of the 
Secretary: 
Clarify Who Is Responsible for Ensuring That Classification Security  
Officers Receive Training 
HHSs Classified National Security Information Policy does not specify who is 
responsible for ensuring that Classification Security Officers receive training.  
OSSI should revise this policy to clarify who is responsible for ensuring that 
designated Classification Security Officers receive training regarding the handling 
and safeguarding of classified information. 
Ensure That All Classification Security Officers Receive Guidance 
and Training Regarding Classified NSI 
OSSI should ensure that all Classification Security Officers are aware of their 
responsibility to provide their divisions with guidance and oversight on the 
handling and safeguarding of classified NSI.  OSSI should also ensure that all 
Classification Security Officers receive guidance concerning HHSs classified 
NSI program, including HHSs Handbook. 
Although some divisions may not develop or maintain classified information, 
their Classification Security Officers have access to and may receive classified 
information.  Therefore, OSSI should ensure that all Classification Security 
Officers receive training concerning HHSs classified NSI program.  Further, 
OSSI should inform HHS divisions that, regardless of whether the divisions 
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   11 
   
   
develop or maintain classified information, division heads and Classification 
Security Officers are responsible for ensuring that divisions follow HHS policies 
regarding classified NSI. 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE  
OSSI concurred with both recommendations.  In response to the first 
recommendation, OSSI indicated that it is revising the HHS Handbook to ensure 
that HHS division heads are aware of their responsibility to provide their divisions 
with guidance and oversight on the handling and safeguarding of classified NSI.  
OSSI also stated that it reissued the classified NSI policy and Handbook to all 
Classification Security Officers in mid-December 2012, to ensure that they all had 
their own copies, regardless of whether their divisions develop or maintain 
classified information. 
In response to the second recommendation, OSSI said that it communicated with 
all Classification Security Officers to ensure that they are properly trained and 
have received appropriate guidance. Further, OSSI stated that it would start 
providing semiannual training for all Classification Security Officers in the spring 
of 2013 to ensure that established standards are acknowledged and maintained. 
We did not make any changes to the report based on OSSIs comments. 
   
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   12 
   
   
APPENDIX A 
Definition of Each Classification Level 
Information may be classified at one of three levels:  Top Secret, Secret, and 
Confidential. Below is a definition of each classification level.  
Top Secret is applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause exceptionally grave damage to the national 
security that the original  classification authority is able to identify or describe.34  
Secret is applied to information, the unauthorized disclosure of which reasonably 
could be expected to cause serious damage to the national security that the  
original classification authority is able to identify or describe.35  
Confidential is applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause damage to the national security that the 
original classification authority is able to identify or describe.36  
   
 
34 Executive Order No. 13526  1.2. 

35 Ibid. 

36 Ibid. 

HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   13 
  APPENDIX 8 
Agency Comments 
........ 

/ 
._# 
f 
tEPAR'T'MEtolr OF HEAl."TH & HUUAN SERVICES 
_.___ 
~~~----------------------O-f-t-ea-~-  s_b_~_~_ _,__mo_~ -~----------=~~-------
a_n_d_   
Februel'y 22. 2012 
To:  Daniel R. LevinsOn 
Inspector General for EvaJuation and Inspections 
Depattment of Health & Human Services 
From: 	 Dr. Joy Miller 
Deputy Assistant Sectelaty for Security 
Office of Security and Strategic Information (OSSI) 
Secretary's Senklr lnteillgenoe Official 
Subject: OSSI Response to Draft Final OIG Reports, dated 29 January 2013. 
References: 
OIG Report OEI..07~12...()()400 (Draft) HHS Adopee<l, Administered, and Generalty Followed 
aassified htfonnation Policies, (OEI-0712-00400) 
OIG Report OE1..07-12...()()401 (Draft) Originally and DerivaliYely Classified Documents Met 
Most Federal Requirementa, (OEI-07-12...()0401) 
1. Purpose. To~ruponses toOIG recommendations as noted In the refefenoe reportS. 
2.  Background.  The Reducing Over-Ciaslification Act of 2010 mandated that the ll'l$peCtef 
Gene1111 for each te0eta1 government agency or dep81tr'nent who have ernpk)yees authorized to 
make original classlfic:lltio decisions conduct two evaluations  One evaluation is intended to 
assess whefhef applicable classllcation pofldes have been adopted, erfedively administered. and 
followed: and the OCher to Identity prac:tlc:u that may ettribule to milclasalficatl of ~l 
These evaluatioos wil be~by 30 September, 2013. Then. a second evaluation, to be 
~by 30 Sepeember, 2016 must review progress made punuant to the results of tt1e first 
evaluation. The HHS Special Security Officer (SSO) serves as lead for coordinating Department 
wide implementation of the HHS Classified National Security Information (NSI) Policy 
3.  OIG Report OEI-07-12...()0400 (Draft). This OIG report addressed the first requited evaluation 
and assessed whether HHS had adOpted, effectiYely admintstered. and folloWed polloes regarding 
Classified NSI. 
A. 	 O!G RICiO!I!!!lt!1da. Clarify who is responsl;ble for ensuring that Classification 
Security Officers {CSO) receive ttaining. 
B 	 OSSJ Baponu. Concur. OSSI is In the process of revising the HHS Cla$sifled 
Natlonat Security Information Handboot<, dated 17 February 2012 to ensure 
OPISTAFF OIV CSOs arot aware of their responsibility to provide their dMsions with 
guidance and oversight on the hand"ng ancl58feguardlng of classified NSI. 
Additionally, OSSI reissued the Classified NSI Polley and Handbook to all OPISTAFF 
OtV CSOs in mid-tlocember 2012, to ensure each had !heir own <:OPY of the 
handbook. regardlesa of whether their divisions deve4op or maintain ctasslfied 
nfotmation. 
C . 	 OIG Reeommenditlon. Ens\lre that all Claslftcation Security Ofl'icers receive 
guidance and training regarding Classified National Security Information 
1 
HHS Adopted, Administered , and Generally Followed Classified Information Policies (OEI-07-12-00400)  14   
   
Note: The Office of Security and Strategic Information did not include any  editorial or technical comments in the attachments 
 
referenced in its response. 
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)  15 
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Brian T. Pattison, Regional 
Inspector General for Evaluation and Inspections in the Kansas City regional 
office, and Brian T.  Whitley, Deputy Regional Inspector General. 
Rae Hutchison served as the project leader for this study.  Other Office of 
Evaluation and Inspections staff from the Kansas City regional office who 
conducted the study include Michael J. Brown and Jordan R. Clementi.  Central 
office staff who provided support include  Althea Hosein, Debra Roush, and 
Talisha Searcy. 
HHS Adopted, Administered, and Generally Followed Classified Information Policies (OEI-07-12-00400)   16 
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS)  programs, as well as the health and welfare of beneficiaries  served by those 
programs.  This statutory mission  is  carried  out through  a nationwide network  of  audits, 
investigations, and inspections conducted by the  following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of  fraud and misconduct  related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and abuse cases involving HHS programs,  including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.