Department of Health and Human Services 
OFFICE OF 
 
  INSPECTOR GENERAL 
 
 
 
 
 
HH S H M P
  AS  ADE  ROGRESS IN 
 
P C
ROPERLY  LASSIFYING 
 
D ; H ,
  OCUMENTS   OWEVER  
 
N I S B
  EW  SSUES  HOULD  E 
 
A  
  DDRESSED
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Suzanne Murrin 
 
Deputy Inspector General  
 
    for Evaluation and Inspections 
   
September 2016 
OEI-07-16-00080  Report in Brief   
   
September 2016   
OEI-07-16-00080   
 
Why This Review Matters  HHS Has Made Progress in Properly Classifying Documents; 
Classification is an important tool  However, New Issues Should Be Addressed 
that allows the Federal 
What We Found 
government to protect 
In May 2013, the Department of Health and Human Services (HHS) Office of Inspector 
information that might damage 
General (OIG) published two reports on the Departments classification program.  The 
national security; however, over-
classification may pose risks to  reports contained four recommendations.  Three of the recommendations were 
national security, too.  Over-  implemented prior to the current review; the fourth recommendation was 
classification may prevent Federal  implemented as a result of the current review.  The graphic below describes the four 
agencies from sharing  recommendations.   
information internally and with 
In our current review we found 
other agencies, potentially 
that until August 2016, HHS 
hindering efforts to identify 
had not taken appropriate 
possible risks to national security.  
action to address required 
The use of portion markings may 
portion markings for all of the 
reduce over-classification by 
previously reviewed 
permitting access to those 
portions of a classified document  documents, as OIG had 
that are less sensitive than the  recommended in May 2013.  
overall document classification.   Our review of a newly selected 
The Reducing Over-Classification  sample of classified documents 
Act of 2010 requires Federal  found that the one document 
agencies to decrease over- originally classified in FY 2015 
  
classification. did not include the reason for 
classification or the position of 
How We Did This Review 
the individual who classified 
We assessed HHSs progress in  the document.  Additionally, 
implementing the remaining open  28 percent of the derivatively 
recommendation from OIGs May 
classified documents from a 
2013 reports.  To do this, we 
newly selected sample did not 
reviewed two sets of documents:  
include the position of the 
the seven documents OIG 
person who classified the 
identified in our previous report 
documents. 
that did not include the required 
portion markings, and a newly  What We Recommend 
selected sample of 51 classified  To address the issues OIG identified in this current review, we recommend that the 
documents we assessed to  Office of Security and Strategic Information (OSSI), working on behalf of the Office of 
determine whether they were  the Secretary, (1) apply the reason for classification and classifier position to the 
classified in accordance with  reviewed originally classified document, and (2) reiterate training on required classifier 
requirements.  identification to individuals who classify information.  OSSI concurred with the first 
recommendation and stated that prior training fully covered the second 
recommendation.   
 
   
   
TABLE OF CONTENTS 
Objectives ....................................................................................................1 
Background ..................................................................................................1 
Methodology ................................................................................................6 
Findings........................................................................................................7 
OSSI took appropriate action to address required portion  
markings 3 years after OIGs original recommendation ..................7 
HHSs one originally classified document in FY 2015 did not 
include the reason for classification or classifiers position ............7 
Twenty-eight percent of the derivatively classified documents 
reviewed did not include the position of the person who  
classified the information .................................................................8 
Conclusion and Recommendations ............................................................10 
Agency Comments and Office of Inspector General Response ..... 11 
Appendixes ................................................................................................12 
A:  Reducing Over-Classification Act of 2010 ..............................12 
B:  Additional Information Regarding Classification ....................14 
C:  Definition of Each Classification Level ...................................17 
D:  Portion Marking Example ........................................................18 
E:  Detailed Methodology ..............................................................19 
F:  Agency Comments ....................................................................20 
Acknowledgments......................................................................................21 
   
   
OBJECTIVES 
1.  To assess whether the Department of Health and Human Services 
(HHS) addressed the unimplemented recommendation from the 
Office of Inspector Generals (OIG) previous reports regarding 
the proper use of portion markings in classified documents. 
2.  To assess whether HHS classified documents in accordance with 
Federal requirements. 
BACKGROUND  
Classification is an important tool that allows the Federal 
government to protect information that might damage national 
security; however, over-classification reduces government 
transparency and may pose risks to our national security.  In addition 
to making government less transparent to the public, 
over-classification may prevent Federal agencies from sharing 
information internally, with other agencies, and with State and local 
law enforcement, potentially complicating efforts to identify risks to 
national security.  For example, the 9/11 Commission found that 
over-classification and inadequate information sharing contributed to 
the Governments failure to prevent the terror attacks on September 
11, 2001.1   
Federal Requirements 
The Reducing Over-Classification Act of 2010 (the Act), Executive 
Order No. 13526, and its implementing Directive2 have directed all 
Federal agencies to reduce unnecessary classification of information 
as well as classification of information at a higher and more 
restrictive level than necessary.3  These directives intend to promote 
information sharing across agencies; with State, local, and tribal 
governments; and with the public.4  The Act also aims to promote 
greater government transparency, and Executive Order No. 13526 
states that the countrys democratic principles require that the public 
be informed of the activities of their government.   
______________________________________________________ 
1  National Commission on Terrorist Attacks Upon the United States: Hearing 
before the Subcommittee on National Security, Emerging Threats and 
International Relations Committee on Government Reform, U.S. House of 
Representatives, 109th Cong. (2005) (Testimony of Richard Ben-Veniste). 
2 32 CFR pt. 2001. 
3 P.L. 111-258. 
4 S. Rept. No. 111-200, at 1-2 (2010). 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1                         
     
   
The Act requires Inspectors General to conduct two evaluations; an 
initial evaluation to assess their respective agencys classification 
policies and practices and a second evaluation to assess progress 
made pursuant to the results of the first evaluation.5  Appendix A 
includes an excerpt from the Act regarding the required evaluations. 
Original Classification 
Original classification is defined as an initial determination, in the 
interest of national security, that information requires protection 
from unauthorized disclosure.6  Information may be originally 
classified if all of the following conditions are met: 
  an original classification authority (OCA) is classifying the 
information;7 
  the information is owned by, produced by or for, or is under 
the control of the Federal Government; 
  the information falls within one or more specific 
classification categories listed in Appendix B, and 
  the OCA determines that unauthorized disclosure could 
reasonably be expected to cause identifiable or describable 
damage to national security.8  
If the information meets all of these conditions, the OCA then must 
determine the level at which the information should be classified.  
Information may be classified at one of three levels:  (1) Top 
Secret, (2) Secret, or (3) Confidential.9  See Appendix C for a 
definition of each classification level.
 
Identification and Markings.  Standard markings must be applied to 
classified information at the time of original classification.10  The 
identification markings must include (1) the name and position, or 
personal identifier, of the OCA; (2) the agency and office of origin, 
if not otherwise evident; (3) the reason(s) for the classification (see 
Appendix B); and (4) declassification instructions.  Markings must 
be uniformly and conspicuously applied to leave no doubt about the 
______________________________________________________ 
5 P.L. 111-258,  6. 
6 Executive Order No. 13526  6.1(ff). 
7 Original classification authority is an individual authorized in writing, by the 
President, the Vice President, agency heads (such as the Secretary), or other 
officials designated by the President, to classify information in the first instance.  
Executive Order No. 13526  6.1(gg). 
8 Executive Order No. 13526  1.1(a). 
9 Executive Order No. 13526  1.2(a). 
10 Executive Order No. 13526  1.6; 32 CFR  2001.21. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          2                         
     
   
classified status of the information, the level of protection required, 
and the duration of classification.11  These markings are included in 
what is referred to as the classification authority block.  
Portion Markings.  The use of portion markings may reduce over-
classification by permitting access to those portions of a classified 
document that are less sensitive than the overall document 
classification.  The agency originally classifying the document must 
apply portion markings to each portion of the document.12  Portion 
markings include paragraphs, subjects, titles, graphics, tables, charts, 
bullet statements, classified signature blocks, bullets and other 
portions within slide presentations, and shall be marked to indicate 
which portions are classified and which portions are not classified by 
placing a parenthetical symbol immediately preceding the portion to 
which it applies.   
Derivative Classification   
Derivative classification refers to the incorporating, paraphrasing, 
restating, or generating information that already is classified and 
marking the material consistent with the classifications applied to the 
original information.13  Individuals who apply derivative 
classification markings need not have original classification 
authority, but must be identified by name and position, or by 
personal identifier, in a manner that is immediately apparent for each 
derivative classification action.  Individuals who apply derivative 
classification markings must observe and respect original 
classification decisions and carry forward the pertinent classification 
markings, including the portion markings.14  Appendix B provides 
further requirements related to classification.  Appendix D provides 
an example of identification and portion markings on a classified 
document. 
HHSs Classified Information Program 
The Secretary of HHS (Secretary) serves as the OCA for HHS and 
may classify documents up to the Secret classification level.15  The 
Secretary has delegated to the Deputy Secretary, the Deputy 
Assistant Secretary of the Office of Security and Strategic 
Information (OSSI), and the Associate Deputy Assistant Secretary of 
______________________________________________________ 
11 32 CFR  2001.20. 
12 Executive Order No. 13526  1.6(5)(c).  See also 32 CFR  2001.21(c).   
13 Executive Order No. 13526  6.1(o). 
14 Executive Order No. 13526  2.1(b).  See also 32 CFR  2001.22. 
15 Executive Order No. 13526. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          3                         
     
   
OSSI the authority to originally classify and declassify information.16 
OSSI manages and operates HHSs security classification program. 
Previous OIG Reports and Recommendations Status 
In May 2013, OIG published two reports to fulfill the Acts initial 
mandate to assess HHSs classification policies and practices.  One 
report assessed whether HHS had adopted, effectively administered, 
and followed policies regarding classified information.  OIG found 
that HHS adopted policies for classified information that were 
consistent with Federal requirements.17  However, not all individuals 
who have access to and/or classify information received guidance 
and/or training regarding HHSs classification program.  The second 
report determined whether information was classified in accordance 
with Federal requirements and identified practices that may have 
contributed to misclassification of information.18  OIG found that 
7 of the 43 classified documents it reviewed lacked the required 
portion markings.  These OIG reports included four 
recommendations, with which OSSI, working on behalf of the Office 
of the Secretary, concurred.  Three of the recommendations were 
implemented prior to the current review, and the fourth 
recommendation was implemented as a result of the current review.  
Chart 1 provides information about the status of each 
recommendation.  
   
______________________________________________________ 
16 OSSI, User Reference for Classified National Security Information, 
October 16, 2015. 
17 OIG, HHS Has Adopted, Administered, and Generally Followed Classified 
Information Policies (OEI-07-12-00400), May 2013. 
18 OIG, Originally and Derivatively Classified Documents Met Most Federal 
Requirements (OEI-07-12-00401), May 2013. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          4                         
     
   
Chart 1:  OSSIs Actions to Implement OIG Recommendations 
Recommendation  Status  OSSI Actions to Implement OIG Recommendations 
 
Clarify who is 
responsible for 
ensuring that 
Classification Security  In March 2014, HHS's Classified National Security 
Officers receive  Handbook was revised to specify that the head of each 
training.  These  operating or staff division is responsible for ensuring 
individuals are  that its respective Classification Security Officer is 
responsible for    trained.  The handbook was reissued to all 
providing their division    Classification Security Officers.  In May 2014, OSSI 
with guidance and  Implemented  provided the revised handbook as documentation to 
oversight on the  consider this recommendation fully implemented. 
handling and 
safeguarding of 
classified information. 
Ensure that all  In fiscal year (FY) 2015, OSSI provided National 
Classification Security  Security Information training for all Department 
Officers receive  employees with a security clearance, including 
guidance and training  Classification Security Officers.  In May 2015, OSSI 
 
regarding classified    provided the training given to Classification Security 
National Security  Implemented  Officers as documentation for considering this 
Information.  recommendation fully implemented. 
In FY 2015, all four OCAs received training regarding 
their responsibilities.  OSSI provided copies of this 
Ensure that OCAs and  training as support for considering this portion of the 
individuals who  recommendation implemented.  OSSI also provided 
derivatively classify  training to individuals who derivatively classify 
information receive  information.  This training included information about 
 
guidance and training    required portion markings.  In April 2016, OSSI 
regarding required  Implemented  provided copies of this training and training logs as 
portion markings.  support for considering this portion of the 
recommendation implemented.  As of April 2016, OIG 
considered this recommendation fully implemented. 
In May 2014 and July 2016, OSSI officials stated that 
they had reviewed and applied the missing portion 
Take appropriate action  markings to classified documents that did not include 
to apply the required  the required markings.  However, during our onsite 
portion markings to  reviews in May and early August 2016, OIG did not find 
reviewed classified    evidence that OSSI took appropriate action.  During a 
documents.    subsequent August 2016 onsite review, OIG worked 
Implemented  with OSSI to address the portion markings for the three 
documents.  OIG considers this recommendation fully 
implemented. 
Source:  OIG review of OSSI's actions to implement recommendations, 2016. 
   
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          5                         
     
   
METHODOLOGY 
Scope 
The Act requires a second evaluation, which must be completed by 
September 30, 2016, to review progress made pursuant to the results 
of the first evaluation.19  This report reviews the one remaining 
unimplemented recommendation OIG made in 2013.  Specifically, 
this report provides information about whether HHS took 
appropriate action to address required portion markings for 
previously reviewed documents lacking such markings.  
In this report, we also assess whether classified documents in a 
newly selected sample were classified in accordance with Federal 
requirements.   
Data Sources 
We based this study on (1) a review of the seven previously 
evaluated documents that did not include the required portion 
markings, (2) a review of a newly selected sample of classified 
documents that included the most recent 50 derivatively classified 
products that OSSI had developed as of April 2016, and the only 
originally classified product that OSSI developed in FY 2015, and 
(3) an interview with OSSI officials. 
In FY 2015, HHS originally classified one document and 
derivatively classified 3,578 documents.  
 
Appendix E provides a detailed description of our methodology. 
Limitations 
Because OIG reviewed the 50 most recently derivatively classified 
products that OSSI developed, it is possible that the sample of 
reviewed documents does not represent the other non-selected 
documents.  Because of this sampling approach, we have not 
projected the results of our review.  However, we believe that our 
results provide a general indication of whether documents were 
classified in accordance with Federal requirements. 
Standards 
This study was conducted in accordance with the Quality Standards 
for Inspection and Evaluation issued by the Council of the 
Inspectors General on Integrity and Efficiency.   
______________________________________________________ 
19 P.L. 111-258,  6. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          6                         
     
   
FINDINGS 
OSSI took appropriate action to address required 
portion markings 3 years after OIGs original 
recommendation 
In May 2013, OIG recommended that OSSI apply the required 
portion markings to the seven classified documents that were 
identified as missing such markings.  Federal regulations require 
portion markings to be applied to all classified documents.  Portion 
markings indicate which portions are classified and which are not 
classified within the same document.  These different portions are 
marked separately in order to avoid over-classification. 
OIG considers this recommendation implemented, after several 
engagements with OSSI.  In May 2014, OSSI informed OIG in 
writing that it applied the necessary portion markings to the 
previously reviewed classified documents.  In May 2016, OIG 
conducted a follow-up onsite review and found that three of the 
seven documents had not been corrected.  In July 2016, OSSI 
informed OIG in writing that it applied the necessary portion 
markings to the identified documents.  However, when OIG 
conducted another follow-up onsite review, we found that OSSI still 
had not taken appropriate action.  Subsequent to that review, OIG 
worked with OSSI to address the portion markings for the three 
documents. 
HHSs one originally classified document in 
FY 2015 did not include the reason for 
classification or classifiers position 
HHS originally classified only one document in FY 2015, and it did 
not include certain requirements.  Specifically, the document did not 
include the reason for classification, nor did it include the position of 
the OCA in the Classified by line.   
Classified information must fall within one or more of the 
classification categories (e.g., military plans, weapons systems, or 
operations).  Appendix B lists the classification categories.  
Moreover, the OCA is required to indicate at least one of these 
categories as the reason for classification.  If the OCA does not 
provide the reason for classification, OIG may not be able to 
determine whether the document was classified correctly or should 
be classified at all. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          7                         
     
   
Moreover, only an OCA may originally classify information.  
Providing the position of the individual who classified the 
information in the Classified by line helps ensure that the 
individual originally classifying the information is an OCA. 
Twenty-eight percent of the derivatively classified 
documents reviewed did not include the position 
of the person who classified the information 
Fourteen of the fifty derivatively classified documents that OIG 
reviewed did not contain position of the individual who derivatively 
classified the information, as Federal regulation requires.  Moreover, 
one of these 50 documents also lacked the required portion 
markings.   
Individuals who derivatively classify information must be 
identifiable and possess the appropriate security clearance.  Federal 
regulations require that the name and position of the individual who 
derivatively classified the information be included on the document.  
Providing the name and position allows for identification of the 
individual who either derivatively or originally classified the 
information.  This may be needed in the event that there are 
questions related to the document (e.g., reasons for classification, 
declassification, or background).  See Table 2 for information on 
documents that did not meet requirements. 
Table 2:  Derivatively Classified Documents That Did Not Meet Federal 
Requirements 
Number of Documents that Did 
Requirement 
Not Meet the Requirement (n=50) 
Information was related to the reproduction, extraction, or summation of 
0 
information that was already classified 
Information was marked consistently with the classification markings 
0 
applied to the original information 
Person who applied the derivative classification was identified on the 
14 
document by name and position or personal identifier 
Portion markings were present  1 
Overall classification level was present  0 
Declassification instructions were present  0 
Total That Did Not Meet All Requirements  15 
 
Source:  OIG analysis of derivatively classified documents, 2016. 
We further found that 21 of the 50 derivatively classified documents 
reviewed did not contain the full name of the individual who 
derivatively classified the information.  The documents contained the 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          8                         
     
   
initials of the individual.  Although Federal regulations do not 
require the agency to provide the full name of the individual who 
derivatively classify documents, one of HHS training slides stated, 
in a highlighted note, that HHS employees shall use their full name 
and not their initials in the Classified by line.20  During our 
August 11, 2016 meeting with OSSI, OSSI stated that they recently 
had revised the training to remove the requirement that HHS 
employees use their full name and planned to include the revision in 
the FY 2017 training. 
   
______________________________________________________ 
20 HHS FY 2016 Derivative Classification Training Module.  
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          9                         
     
   
CONCLUSION AND RECOMMENDATIONS 
As mandated by the Act, we conducted a follow-up evaluation to 
assess HHSs progress in implementing the recommendations from 
OIGs previous reports.  Prior to this review, OIG had determined 
that HHS fully implemented three of the four recommendations from 
the previous reports.  The fourth recommendation was implemented 
as a result of this review. 
A review of a new sample of classified documents also found that 
HHS had not classified all documents in accordance with all of the 
Executive Order and Federal requirements.  Specifically, the one 
originally classified document did not include the reason for 
classification or the position of the OCA who classified the 
document.  Further, 28 percent of the derivatively classified 
documents reviewed did not include the position of the person who 
derivatively classified the document.  To address the issues 
identified in this report, we recommend that OSSI, working on 
behalf of the Office of the Secretary: 
Apply the reason for classification and classifier position 
to the reviewed originally classified document  
For the one originally classified document classified in FY 2015, 
OSSI should create a new document with the necessary information 
or apply the reason for classification as well as the position of the 
OCA who classified the information.  OSSI should notify OIG when 
corrective actions have been finalized.  OIG will then have an OIG 
representative with the proper security clearance review this 
document.   
Reiterate training on required classifier identification for 
individuals who classify information  
Per Federal regulation, individuals who apply classification 
markings need to use a (1) personal identifier or (2) his or her name 
and position.  If OSSI does not create a personal identifier for its 
classifiers, it should provide training to classifiers to ensure that the 
position of the individuals who classify information is included, 
along with his or her name, on all future originally and derivatively 
classified documents.  Further, OSSI should disseminate corrected 
guidance (i.e., removal of the inaccurate note on one slide) in its 
FY 2017 training regarding the removal of the requirement that HHS 
employees use their full name, as it had planned.   
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  0                       
     
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR 
GENERAL RESPONSE 
OSSI concurred with the first recommendation and stated that prior 
training fully covered the second recommendation.   
With respect to the first recommendation, OSSI stated that it has 
applied both the reason for classification and position title of the 
individual who applied the classification to the document that was 
originally classified in FY 2015.  OIG will make arrangements with 
OSSI to re-review this document to close out this recommendation. 
With respect to the second recommendation, OSSI stated that in 
FY 2015 it initiated training that fully covers this recommendation.  
Based on the FY 2015 training, OIG closed a training 
recommendation in a prior report, as noted in the Background 
section of this report.  OIGs current recommendation is that in 
future trainings, OSSI reiterate the requirements for classifier 
identification for individuals who classify information.  OSSIs 
planned FY 2017 training will provide an opportunity to remind staff 
of the need to apply the classifiers position title when derivatively 
classifying documents. 
OSSIs comments are provided in Appendix F. 
 
 
   
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  1                       
     
   
APPENDIX A 
Reducing Over-Classification Act of 2010 
The Reducing Over-Classification Act of 2010 requires that the 
Inspector General of each Federal department or agency with an 
individual authorized to make original classification decisions 
conduct two evaluations.21  Below is an excerpt from this Act which 
describes the mandated evaluations. 
  (b) INSPECTOR GENERAL EVALUATIONS. 
(1) REQUIREMENT FOR EVALUATIONS.Not 
later than September 30, 2016, the inspector general of each 
department or agency of the United States with an officer or 
employee who is authorized to make original classifications, 
in consultation with the Information Security Oversight 
Office, shall carry out no less than two evaluations of that 
department or agency or a component of the department or 
agency 
(A) to assess whether applicable classification 
policies, procedures, rules, and regulations 
have been adopted, followed, and effectively 
administered within such department, agency, 
or component; and 
(B) to identify policies, procedures, rules, 
regulations, or management practices that may 
be contributing to persistent misclassification 
of material within such department, agency or 
component. 
(2) DEADLINES FOR EVALUATIONS. 
(A) INITIAL EVALUATIONS.Each first 
evaluation required by paragraph (1) shall be 
completed no later than September 30, 2013.  
(B) SECOND EVALUATIONS.Each 
second evaluation required by paragraph (1) 
shall review progress made pursuant to the 
results of the first evaluation and shall be 
completed no later than September 30, 2016. 
   
______________________________________________________ 
21 P.L. 111-258,  6. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  2                       
     
   
 (3) REPORTS. 
(A) REQUIREMENT.Each inspector 
general who is required to carry out an 
evaluation under paragraph (1) shall submit to 
the appropriate entities a report on each such 
evaluation.  
(B) CONTENT.Each report submitted 
under subparagraph (A) shall include a 
description of 
(i) the policies, procedures, rules, 
regulations, or management practices, if 
any, identified by the inspector general 
under paragraph (l)(B); and  
(ii) the recommendations, if any, of the 
inspector general to address any such 
identified policies, procedures, rules, 
regulations, or management practices. 22  
   
______________________________________________________ 
22 Ibid. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  3                       
     
   
APPENDIX B 
Additional Information Regarding Classification 
Requirements for originally classified documents.  Federal 
regulations require that originally classified documents provide that: 
1.  an OCA classified the information; 
2.  the information was owned by, produced by or for, or was 
under the control of the U.S. government; 
3.  the information fell within one or more of the specified 
classification categories (See table below); 
4.  when asked, the OCA could describe the expected damage to 
national security in the event of the informations 
unauthorized disclosure;23 
5.  the information was not classified, continued to be 
maintained as classified, or failed to be declassified in order 
to (1) conceal violations of law, inefficiency, or 
administrative error; (2) prevent embarrassment to a person, 
organization, or agency; (3) restrain competition; or (4) 
prevent or delay the release of information that does not 
require protection in the interest of the national security.24 
6.  the OCA established a specific date or event for 
declassification; and 
7.  the following identification and markings were included:  
(1) portion marking(s), (2) overall classification, (3) the name 
and position, or personal identifier, of the original 
classification authority; (4) the agency and office of origin; 
(5) the reason(s) for the classification (i.e., reference 
Section 1.4 of 32 CFR 2001.21(a)(3) and then add the 
following letter(s), a  h, as appropriate); and 
(6) declassification instructions (e.g., the declassification 
date). 
______________________________________________________ 
23 OCAs are not required to provide in writing a description of the damage to 
national security that could be expected in the event of the informations 
unauthorized disclosure.  To determine whether this requirement was met, we 
asked the OCA who classified the information to describe the damage to national 
security that could be expected in the event of the informations unauthorized 
disclosure. 
24 Executive Order No. 13526  1.7. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  4                       
     
   
Requirements for derivatively classified documents.  Federal 
regulations require that derivatively classified documents provide 
that: 
1.  the information was related to the reproduction, extraction, or 
summation of information that was already classified; 
2.  the person who applied the derivative classification was 
identified on the document by name and position or personal 
identifier; 
3.  the information was marked consistently with the 
classification markings applied to the original information 
(i.e., the derivative classification included the pertinent 
classification markings on the original classified document); 
and 
4.  the following identification and markings were included:   
(1) portion marking(s), (2) overall classification, (3) the name 
and position, or personal identifier, of the person applying the 
derivative classification; and (4) declassification instructions 
(e.g., the declassification date). 
Reasons for classification for originally classified documents.  The 
table below lists the reasons for classification plus the letters that 
correspond to those classification categories.   
Reasons for Classification 
(A) Military plans, weapons systems, or operations 
(B) Foreign government information 
(C) Intelligence activities (including covert action), intelligence sources or methods, or 
cryptology 
(D) Foreign relations or foreign activities of the United States, including confidential sources 
(E) Scientific, technological, or economic matters relating to the national security 
(F) U.S. Government programs for safeguarding nuclear materials or facilities 
(G) Vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or 
protection services relating to the national security 
(H) Development, production, or use of weapons of mass destruction 
         Source:  Executive Order No. 13526  1.4 and 32 CFR  2001.21. 
Duration of Classification.  At the time of original classification, the 
OCA must assign a date or event upon which classified information 
will be declassified.  Generally, this date or event should be less than 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  5                       
     
   
10 years from the date of original classification.25  Upon the stated 
date or event, the information must be automatically declassified.26 
Classification Challenges.  Authorized holders of information who, 
in good faith, believe that the informations classification status is 
improper are encouraged and expected to challenge the classification 
status in accordance with agency procedures.  Agencies must 
establish procedures to ensure that (1) individuals are not subject to 
retribution for challenging classification status, (2) an opportunity 
for review by an impartial official or panel is provided, and 
(3) individuals are advised of their right to appeal agency decisions 
to the Interagency Security Classification Appeals Panel established 
under Executive Order No. 13526.27 
Security Education and Training.  Each agency must establish 
security education and training programs that ensure that all 
employees who create, process, or handle classified information 
possess satisfactory knowledge regarding the classification, 
safeguarding, and declassification policies and procedures.28   
Establishing and Maintaining Ongoing Self-Inspections.  Each 
agency must establish and maintain ongoing agency self-inspection 
programs, which include reviews of representative samples of the 
agencys original and derivative classification actions.29  The 
self-inspections should evaluate whether the agency has adhered to 
the pertinent Federal requirements.30  OSSI reinstituted its annual 
self-inspections after February 2016, which include a review of all 
aspects of the markings on a document. 
 
   
______________________________________________________ 
25 Executive Order No. 13526  1.5; 32 CFR  2001.12.  If the OCA is unable to 
assign a 10-year declassification date, he or she must assign a declassification date 
not to exceed 25 years from the date of the original classification decision.  
However, if the information relates to a confidential informant or weapons of mass 
destruction, the OCA may assign a declassification date up to 75 years from the 
date of the original classification. 
26 Ibid. 
27 Executive Order No. 13526  1.8; 32 CFR  2001.14. 
28 32 C.F.R.  2001.70; Executive Order No. 13526  4.1(b). 
29 Executive Order No. 13526 Part 5; 32 C.F.R.  2001.60. 
30 32 C.F.R.  2001.60(c). 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  6                       
     
   
APPENDIX C 
Definition of Each Classification Level 
Information may be classified at one of three levels:  Top Secret, 
Secret, and Confidential.  Below is a definition of each 
classification level.31 
Top Secret (TS) is applied to information, the unauthorized 
disclosure of which reasonably could be expected to cause 
exceptionally grave damage to the national security that the original 
classification authority is able to identify or describe. 
Secret (S) is applied to information, the unauthorized disclosure of 
which reasonably could be expected to cause serious damage to the 
national security that the original classification authority is able to 
identify or describe. 
Confidential (C) is applied to information, the unauthorized 
disclosure of which reasonably could be expected to cause damage 
to the national security that the original classification authority is 
able to identify or describe. 
   
______________________________________________________ 
31 Executive Order No. 13526  1.2. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  7                       
     
   
APPENDIX D 
Portion Markings Example 
 
SECRET 
 
(For Illustration Purposes Only) 
   
    Date 
 
TO:   
 
FROM: 
 
SUBJECT:  (C) Request for Data Concerning HHS Declassification Efforts 
 
(C)  PURPOSE:  This is an example of the portion marking for a main 
paragraph. 
 
(C)  COORDINATION:  None 
 
(S)  BACKGROUND:   
 
  (S)  This is the portion marking for a classified primary bullet 
statement. 
o  (S)  This demonstrated that sub-bullets must also contain 
portion markings. 
  (C)  This is the portion marking for a classified primary bullet 
statement. 
(S)  RECOMMENDATION:  Sign the Memorandum at right. 
 
 
                                                Signature Block 
 
Classified By:    John Smith, OSSI, Program Analyst 
Classification 
Derived From:    DHS Memorandum, 
authority 
       Dtd 20110205, same subject 
block 
Declassify On:    20210205 
 
(For Illustration Purposes Only) 
SECRET 
 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  8                       
     
   
APPENDIX E 
Detailed Methodology 
Review of Classified Documents 
Previously reviewed documents lacking required portion markings.  
For the first evaluation, we reviewed a sample of 43 classified 
documents to determine whether they were classified in accordance 
with Federal requirements.  We conducted this review in 
August 2012.  At that time, HHS had 13 originally classified 
documents and approximately 700 derivatively classified documents, 
for a total population of 713 classified documents.  We reviewed all 
13 originally classified documents and a purposive sample of 
30 derivatively classified documents developed from 2002 through 
2012. 
Of the 43 classified documents reviewed, 36 met all Federal 
requirements regarding classified information; however, 7 of the 
reviewed documents lacked the required portion markings.  As a 
result, OIG recommended that OSSI take appropriate action to apply 
the required portion markings to reviewed classified documents. 
For this evaluation, we reviewed the seven documents that did not 
include the required portion markings to ensure that the markings 
had been applied as recommended. 
Review of newly selected sample of classified documents.  For this 
second review, we worked with OSSI to select a sample of classified 
documents that included the most recent 50 derivatively classified 
products that OSSI had developed as of April 2016, and the only 
originally classified product that OSSI developed in FY 2015. 
In FY 2015, HHS originally classified one document and 
derivatively classified 3,578 documents.  
 
For each sampled document, we completed a structured review 
instrument to determine whether the classification of original and 
derivative information complied with Federal requirements as 
described in Appendix B.
 
We did not project the results of our review of the sampled 
documents to the population of derivatively classified documents. 
Interview with OSSI Officials 
We interviewed OSSI officials to learn whether any additional 
changes related to the proper classification of documents were 
implemented subsequent to OIG reports published in May 2013. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          1  9                       
     
   
APPENDIX F 
Agency Comments 
 
   
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          2  0                       
     
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Brian T. Whitley, 
Regional Inspector General for Evaluation and Inspections in the 
Kansas City regional office, and Jennifer King, Deputy Regional 
Inspector General. 
Rae Hutchison served as the lead analyst for this study.  Other Office 
of Evaluation and Inspections staff who conducted the study include 
Cody Johnson and Abbi Warmker.  Central office staff who provided 
support include Althea Hosein, Jay Mazumdar, Joanne Legomsky, 
and Melicia Seay. 
HHS Has Made Progress in Classifying Documents; New Issues Should Be Addressed (OEI-07-16-00080)          2  1                       
     
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS) programs, as  well  as the health  and welfare of individuals served by those programs.  
This statutory mission is carried  out through a nationwide network of audits, investigations,  
and inspections conducted by the following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of fraud and misconduct  related to HHS programs, operations, and individuals.  With  
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and  abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.