Department of Health and Human Services 
 
 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
O
  RIGINALLY AND 
 
D C
ERIVATIVELY  LASSIFIED 
 
 
D M M
OCUMENTS  ET  OST 
 
 
F R
EDERAL  EQUIREMENTS 
 
 
 
Daniel R. Levinson   
Inspector General  
 
May 2013 
OEI-07-12-00401   
   
EXECUTIVE SUMMARY:  ORIGINALLY  AND DERIVATIVELY CLASSIFIED 
DOCUMENTS MET MOST FEDERAL REQUIREMENTS 
OEI-07-12-00401 
 
 
WHY WE DID THIS STUDY 
 
The Reducing Over-Classification Act of 2010 mandates that the Inspector General of 
each agency of the United States with an officer or employee who is authorized to make 
original classification decisions assess whether applicable classification policies have 
been adopted, followed, and effectively administered; identify practices that may 
contribute to misclassification of material; and review progress made pursuant to these 
assessments.  In addition, the Information Security Oversight Office (ISOO) requested  
that Inspectors General review their agencies classified documents to determine whether 
the information within them was classified in accordance with Federal requirements.  
This report addresses ISOOs request and identifies practices that may contribute to the 
misclassification of material. 
 
HOW WE DID THIS STUDY  
 
We reviewed all documents the Department of Health and Human Services (HHS) had 
originally classified as of August 2012 and a purposive sample of derivatively classified 
documents to determine whether the information within them was classified in 
accordance with Federal requirements. 
 
WHAT WE FOUND 
 
Of the 43 classified documents reviewed, 36 met all Federal requirements regarding 
classified National Security Information (NSI).  Seven of the reviewed documents (four 
of the originally and three of the derivatively classified documents) lacked the required 
markings. 
 
WHAT WE RECOMMEND 
 
We recommend that the Office of Security and Strategic Information (OSSI), working on 
behalf of the Office of the Secretary, ensure that original classification authorities and 
individuals who derivatively classify NSI receive guidance and training pertaining to the 
required portion markings.  We also recommend that OSSI take appropriate action to 
apply the required portion markings to reviewed classified documents.  OSSI concurred 
with both recommendations and described actions to address them. 
   
   
TABLE OF CONTENTS 
 
Objective......................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................7 

Finding .......................................................................................................11 
 
Most documents reviewed adhered to all Federal requirements 

regarding classified NSI; four originally classified documents and 

three derivatively classified documents failed to meet Federal 

requirements regarding portion markings ......................................11 
 
Conclusion and Recommendations ............................................................14 

Agency Comments and Office of Inspector General Response .....14 

Appendixes ................................................................................................15 

A: Determination of the Duration of Classification ......................15 

B: Exceptions to Automatic Declassification ...............................16 

C: Definition of Each Classification Level ...................................17 

D: Sample Selection for Derivatively Classified Documents .......18 

E: Agency Comments  ...................................................................20 

Acknowledgments......................................................................................22
 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)  
     
   
OBJECTIVE 
To assess the extent to which the Department of Health and Human Services 
(HHS) maintains classified information in accordance with applicable Federal 
requirements regarding classified national security information (NSI).  
BACKGROUND 
Classified NSI is information that requires protection against unauthorized 
disclosure and is marked to indicate its classified status.1 The Reducing 
Over-Classification Act of 2010 (the Act) mandates that the Inspector General of 
each agency of the United States with an officer or employee who is authorized to 
make original classification decisions conduct two evaluations.  One evaluation is 
intended to (1) assess whether applicable classification policies, procedures, rules, 
and regulations (policies) have been adopted, effectively administered, and 
followed; and (2) identify policies, procedures, rules, regulations, or management 
practices (practices) that may contribute to misclassification of material.2  This 
evaluation must be completed by September 30, 2013.  A second evaluation must 
be completed by September 30, 2016, and must review progress made pursuant to 
the results of the first evaluation.3 The report entitled HHS Has Adopted, 
Administered, and Generally Followed Classified Information Policies  
(OEI-07-12-00400) assessed whether polices have been adopted, effectively 
administered, and followed.  This report identifies practices that may contribute to 
misclassification of information.4  
In addition, the Information Security Oversight Office (ISOO) of the National 
Archives and Records Administration requested that Inspectors General review 
their agencies classified documents to determine whether the information within 
them was classified in accordance with Federal requirements.5 This report also 
addresses ISOOs request.   
Federal Requirements 
Executive Order No. 13526, its implementing Directive,6  and the Act have all 
directed Federal agencies to reduce unnecessary information classification or 
information classification at a higher and more restrictive level than necessary.  
This initiative is intended to promote information sharing across agencies; with 
State, local, and tribal governments; and with the public.7  
 
1  Executive Order No. 13526, published  at 75 Fed. Reg. 707 (Jan. 5, 2010). 

2  P.L. 111-258,  6. 
 
3 Ibid. 

4 Both reports are being published concurrently. 

5 ISOO is responsible to the President for policy and oversight of the Governmentwide security 

classification system and the  National Industrial Security Program.  ISOO receives policy and 

program guidance from the National Security Council. 
 
6  32  CFR pt. 2001, promulgated  at 75  Fed.  Reg. 37254 (June 28, 2010). 

7 S. Rept. No. 111-200, at 1-2 (2010). 

Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   1   
   
Executive Order No. 13526. In 2009, the President issued Executive Order 
No. 13526, entitled Classified National Security Information.8    This Executive 
Order sets forth a uniform system for classifying, safeguarding, and declassifying 
NSI and outlines the method of implementation. 
Implementing Directive:  Classified National Security Information. Pursuant to 
Executive Order No. 13526, ISOO issued a Directive9, 10 to provide guidance to 
agencies regarding the classification system set forth in the Order, including 
guidance on: 
   original classification,  
   derivative classification, and 
   declassification and downgrading.11,  12  
Original Classification  
Original classification is defined as an initial determination, in the interest of  
national security, that information requires protection from unauthorized 
disclosure.13  The Directive provides guidance to agencies for the following: 
   classification standards,  
   classification levels,  
   classification authority,  
   classification categories,   
   duration of classification, 
   identification and markings,  
   classification prohibitions and limitations, and  
   classification challenges.  
 
 
 
 
8  Executive Order No. 13526, published  at 75 Fed. Reg. 707 (Jan. 5, 2010). 
9  Executive Order No. 13526 requires ISOO  to  issue directives as necessary to implement the 

uniform system for classifying, safeguarding, and declassifying NSI. 
 
10 32 CFR pt. 2001, published at 75 Fed. Reg.  37254 (June 28, 2010). 

11 Ibid. at 3727437275. 

12  The  Directive also provides guidance regarding the (1) safeguarding of classified NSI, 

(2) standards for establishing  and maintaining an  ongoing agency  self-inspection program, and 
(3) standards for agency security education and training programs. 
13  Executive Order No. 13526  6.1(ff).  
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   2   
   
Classification Standards.  Information may be originally classified if all of the 
following conditions are met: 
an original classification authority (OCA) (i.e., an individual authorized to 
classify information in the first instance) is classifying the information;14  
 	  the information is owned by, produced by or for, or is under the control of 
the Federal Government; 
 	  the information falls within one or more of the classification categories 
noted in Table 1; and 
 	  the OCA determines that unauthorized disclosure could reasonably be 
expected to cause identifiable or describable damage to national security.15  
Classification Levels. If the information meets all of the conditions above, then 
the OCA must determine the level at which the information should be classified.  
Information may be classified at one of three levels:  (1) Top Secret,  
(2) Secret, or (3) Confidential.16  
Classification Authority. The authority to originally classify information may be 
carried out by (1) the President and the Vice President, (2) agency heads and other 
officials designated by the President, and (3) Government officials delegated the 
authority to classify information.17  Officials authorized to classify information at 
a specified classification level are also authorized to classify information at a 
lower level.18  
Classification Categories.  Information may be originally classified if, in addition 
to meeting the classification standards, it falls within one or more of the 
categories in  Table 1. 
   
 
14 Original classification authority means an individual authorized in writing, by  the President, 

the Vice President, agency heads (such as the Secretary), or other officials designated by the 

President, to classify information in the first instance.  Executive Order No. 13526    6.1(gg). 

15  32  CFR  2001.10; Executive Order No. 13526  1.1(a). 
 
16  Executive Order No. 13526  1.2(a). 

17 Executive Order  No. 13526  1.3(a).  Agency heads are responsible for ensuring that 

subordinate officials delegated  responsibility have a demonstrable and continuing need to carry 

out this original classification  authority. 

18  Executive Order No. 13526  1.3(b).   

Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   3   
   
Table 1: Codes and Categories for Classification  
Code   Category  
A  Military plans, weapons systems, or operations 
B  Foreign government information  
C  Intelligence activities (including covert action), intelligence sources or methods, or cryptology  
D  Foreign relations or foreign activities of the United States, including confidential sources 
E  Scientific, technological, or economic matters relating to the national security 
F  U.S. Government programs for safeguarding nuclear materials or facilities  
Vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection 
G 
services relating to the national security  
H  Development, production, or use of weapons of mass destruction 
           Source:  Executive Order No. 13526  1.4 and 32  CFR  2001.21. 
Duration of Classification. Mandatory automatic declassification19 standards 
apply to all agencies that have original classification authority, previously had 
original classification authority, or maintain NSI.20   At the time of original 
classification, the OCA must establish a date or event for declassification based 
on the duration of the national security sensitivity of the classified information.  
Upon reaching the stated date or event, the information must be declassified 
automatically.21  See Appendix A for a summary regarding the determination of 
the duration of classification. 
Identification and Markings. Standard markings or other indicia must be applied 
to classified information at the time of original classification.22   The identification 
and markings must include (1) the name and position, or personal identifier, of the 
OCA; (2) the agency and office of origin; (3) the reason(s) for the classification;  
and (4) declassification instructions (e.g., the declassification date).  The OCA  
must identify the reason(s) for the decision to classify as well as the 
corresponding code indicating the classification category as listed in Table 1. 
Markings must be uniformly and conspicuously applied so as to leave no doubt 
about the classified status of the information, the level of protection required, and 
the duration of classification.  The agency originating the classified document 
 
19 Automatic declassification means the declassification of information solely on the basis of the  
occurrence of a specific date or event as determined by the OCA,  or the expiration of a  maximum  
timeframe for  duration of classification established under the Executive Order.   Executive Order  
No. 13526  6.1(e).   
20  32  CFR   2001.30; Executive Order No. 13526  3.3.  
21  Executive Order No. 13526  1.5; 32  CFR  2001.12.  
22 Executive Order No. 13526  1.6; 32  CFR  2001.21.  
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   4   
   
must indicate which portions (e.g., paragraphs) of the document are classified.23  
Specifically: 
Each portion of a document, ordinarily a paragraph, but including 
subjects, titles, graphics, tables, charts, bullet statements, sub-paragraphs, 
classified signature blocks, bullets and other portions within slide 
presentations, and the like, shall be marked to indicate which portions are 
classified and which portions are unclassified by placing a parenthetical 
symbol immediately preceding the portion to which it applies.24  
Classification Prohibitions and Limitations.  Information may not be classified or 
continue to be maintained as classified for the purpose of: 
 	  concealing violations of law, inefficiency, or administrative error; 
 	  preventing embarrassment to a person, organization, or agency; 
 	  restraining competition; or 
 	  preventing or delaying the release of information that does not require 
protection in the interest of the national security.25  
After information is declassified and properly released to the public, the 
information may not be reclassified unless certain exceptions are met.26   
Conversely, information that has not previously been disclosed to the public under 
proper authority may be classified or reclassified after an agency has received a 
request for it under the Freedom of Information Act, the Presidential Records Act, 
the Privacy Act of 1974, or the mandatory review provisions of Executive Order 
No. 13526.27  
Classification Challenges. Authorized holders of information who, in good faith, 
believe that the informations classification status is improper are encouraged and 
expected to challenge the classification status in accordance with agency 
procedures. Agencies must establish procedures to ensure that (1) individuals are 
not subject to retribution for challenging classification status, (2) an opportunity is 
provided for review by an impartial official or panel, and (3) individuals are 
advised of their right to appeal agency decisions to the Interagency Security 
Classification Appeals Panel established under Executive Order No. 13526.28  
 
23  Executive Order No. 13526  1.6(5)(c).  

24 32 CFR   2001.21(c).   

25  Executive Order No. 13526  1.7.  

26 Executive Order No. 13526  1.7(c).  When reclassifying information, the OCA must include  

the following:  (1) level of classification; (2) identity, by name and position or  by personal 

identifier, of the OCA; (3) declassification instructions; (4) a concise reason for classification, 

including reference to the applicable classification category; and (5) date the reclassification action 

was taken.  32  CFR   2001.24(l). 

27  Executive Order No. 13526  1.7(d). 

28  Executive Order No. 13526  1.8; 32  CFR  2001.14.  

Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   5   
   
Derivative Classification 
Derivative classification  is defined as incorporating, paraphrasing, restating, or 
generating information that is already classified and marking the material 
consistent with the classifications that apply to the original information.29   
Individuals who apply derivative classification markings need not have original 
classification authority, but must indicate their identity in a manner that is  
immediately apparent for each derivative classification action.  Individuals who 
apply derivative classification markings must transfer the pertinent classification 
markings to any newly created documents.30  
Declassification and Downgrading 
OCAs must attempt to assign a date or event upon which classified information 
will be declassified.  Generally, the duration is not to exceed 25 years, except 
when the information relates to a confidential informant or weapons of mass 
destruction.31 See Appendix A for a summary regarding the determination of the 
duration of classification.  When information no longer meets the standards for 
classification, it must be declassified or downgraded by the official who 
authorized the original classification, the original classifiers current successor, a 
supervisory official, or an official delegated as a declassification authority.32   
Information that continues to meet the classification requirements requires  
continued protection. However, in exceptional cases in which agencies determine 
that the need to protect classified information is outweighed by the public interest 
in disclosure, the information should be declassified.  Questions concerning these 
exceptional cases must be referred to the agency head or senior agency officials.33  
Automatic Declassification. Regardless of whether they have been reviewed, all 
classified records that (1) are more than 25 years old and (2) have been 
determined to have permanent historical value must be automatically 
declassified.34  Documents may be exempted from automatic declassification if  
the ultimate release of the information would clearly and demonstrably be 
expected to seriously impair national security at the end of the 25-year 
classification period.35  See Appendix B for a summary regarding the exceptions 
to automatic declassification.  
 
29  Executive Order No. 13526  6.1(o). 

30 Executive Order  No. 13526  2.1(b); 32 CFR   2001.22.  

31  Executive Order No. 13526  1.5; 32  CFR  2001.12(a).  

32  Executive Order No. 13526  3.1.  

33  Executive Order No. 13526  3.1(d). 

34 Executive Order  No. 13526  3.3; see also  32 CFR   2001.30, which states, All departments 

and agencies that have original classification authority or previously had original classification 
 
authority, or maintain records determined to be  permanently valuable that contain classified 
 
national security information,  shall comply with the automatic declassification  provisions  of the 

Order. 
 
35  Executive Order No. 13526  3.3; 32  CFR  2001.26.  
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   6   
   
HHSs Classified NSI Program 
The Secretary of HHS (Secretary) serves as OCA for HHS and may classify  
documents up to the Secret classification level.36,  37   The Secretary has delegated 
to the Deputy Secretary, the Director of HHSs Office of Security and Strategic 
Information (OSSI), and the Associate Director of OSSI the authority to originally 
classify and declassify information.38, 39   The Director of OSSI is responsible for 
departmentwide policy development, management, and oversight of the classified 
NSI program.40  
HHSs Maintenance of Classified Documents 
Originally and derivatively classified documents may be either retained in 
hardcopy or stored electronically. HHSs electronic documents are accessed on 
either of two classified information technology (IT) systems owned by the 
Department of Homeland Security (DHS) or the Department of Defense (DOD).  
All originally classified documents are retained in hardcopy format.  Although 
some derivatively classified documents are retained in hardcopy format 
(e.g., briefing slides, Daily Intelligence Readbook),41 the majority are stored  
electronically on the IT systems owned by DHS or DOD.  
METHODOLOGY 
We reviewed all documents HHS had originally classified as of August 2012 and 
a purposive sample of derivatively classified documents to determine whether the 
information within them was classified in accordance with Federal requirements. 
   
 
36 Executive Order  13526  6.1(gg).  

37 See Appendix C for a description of each classification level. 

38  The Director of OSSI is also  known as and  has the official title of  Deputy Assistant Secretary 

for Security within  HHS and is the Senior  Intelligence Officer. 

39 OSSI, HHS National Security Handbook, February 17, 2012. 

40 OSSI, Classified National Security Information  Policy, January 9,  2012. 

41 OSSI officials indicated that HHS produces three types  of derivatively classified documents; 

each type of document is stored  differently.  These three types are:  (1) briefing slides, (2) Daily 

Intelligence Readbook documents (Readbook), and (3) emails.  Briefing  slides are generally 

produced for  the Deputy Secretary of HHS and other HHS leadership; these documents may be 

maintained in hardcopy  format.  The Readbook is produced to brief OSSI leadership; these 

documents are maintained  in hardcopy format.  Derivatively classified emails are produced as  

responses to  original classification decisions made by other Federal agencies.  These emails are 

stored electronically on the IT systems owned by DHS and DOD. 
  
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   7   
   
Population and Sample Selection 
At the time of our review, the population of classified documents included 
13 originally classified documents42 and approximately 700 derivatively classified 
documents.  We reviewed all 13 originally classified documents and a purposive 
sample of 30 derivatively classified documents.  See Table 2 for an illustration of  
the population and sample sizes. 
Table 2: Originally and Derivatively  Classified Documents  
Document Type   Population   Sample Size  
Originally Classified  13  13 
Derivatively Classified   700  30 
     Total  713  43 
                                        Source: Office of  Inspector General (OIG) analysis of HHSs originally and derivatively classified documents, 2012. 
With the assistance of OSSI, we chose a purposive sample that would enable us to 
determine whether the information within these documents was classified in 
accordance with Federal requirements.43  In selecting this sample, we did not 
intend to project the results of our review of derivatively classified documents.  
Rather, we intended for our review to provide a general representation of whether 
derivatively classified documents were classified in accordance with Federal 
requirements.  The derivatively classified documents included 12 hardcopy 
documents (8 briefing slides and 4 Readbook documents) and 18 printed emails.44   
See Appendix D for a description of the sample selection. 
Document Review  
For each sampled document, we completed a structured review instrument to 
determine whether the classification of original and derivative information 
complied with Federal requirements. 
Originally classified documents were determined to have been classified in 
accordance with Federal regulations if all of the requirements listed below were 
met: 
 
42 During preinspection discussions, OSSI indicated that there were 15 originally classified 
documents for review.  Once we began our review, we learned that  2 of the 15  documents had 
been declassified in May 2011.  As a result, only 13 of the originally classified  documents were  
pertinent to our review. 
43 The majority of derivatively  classified documents are stored  on IT systems owned by  DHS and 
DOD and cannot be accessed by individuals who have not been granted access by the owners of 
the systems.  OSSI officials have access to these IT systems and assisted  us in selecting the 
sample.  
44 OSSI officials selected 22 derivatively classified emails for review.  Four of these emails were 
directly related to  four Readbook  documents selected for review.  As a result, these four emails 
were combined with their respective Readbook documents to make a single derivatively classified 
document.  Thus, the sample of derivatively  classified documents consisted of 12  hardcopy  
documents and 18  printed emails. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   8   
   
 	  the decision to classify the information was exercised by an individual 
possessing original classification authority; 
 	  the information was owned by, produced by or for, or under the control of 
the Federal Government; 
 	  the information fell within one or more of the classification categories 
noted in Table 1; 
 	  when asked, the OCA described damage to national security that could be  
expected in the event of the informations unauthorized disclosure;45  
	   the information was not prohibited or limited from receiving classification 
(e.g., the information was not classified to conceal violations of the law,  
inefficiency, or administrative error); 
	   the OCA established a specific date or event for declassification; and  
	   the following identification and markings were included:  portion 
marking; overall classification; the name and position, or personal 
identifier, of the original classification authority; the agency and office of 
origin; the reason(s) for the classification; and declassification instructions 
(e.g., the declassification date). 
Derivatively classified documents were determined to have been classified in 
accordance with Federal regulations if all of the requirements listed below were 
met: 
	   the information was related to the reproduction, extraction, or summation 
of information that was already classified; 
	   the person who applied the derivative classification was identified on the 
document by name and position or personal identifier; 
	   the information was marked consistently with the classification markings 
that apply to the original information (i.e., the derivative classification 
includes the pertinent classification markings that were included on the 
originally classified document); 
	   the information was owned by, produced by or for, or under the control of 
the Federal Government; 
	   the information fell within one or more of the classification categories 
noted in Table 1; 
 
45 OCAs are not  required to provide in  writing  a description  of the damage to  national security that 
could be expected in the event of the informations unauthorized disclosure.  To  determine 
whether this requirement was met, we asked the OCA who classified the information to describe  
the damage to national security that could be expected in the event of the informations 
unauthorized disclosure.  
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   9   
   
 	  the information was not prohibited or limited from receiving classification  
(e.g., the information was not classified to conceal violations of the law,  
inefficiency, or administrative error); and 
 	  the following identification and markings were included:  portion 

marking; overall classification; the name and position, or personal 

identifier, of the person applying the derivative classification; and 

declassification instructions (e.g., the declassification date). 

Standards 
This study was conducted in accordance with the Quality Standards for Inspection 
and Evaluation issued by the Council of the Inspectors General on Integrity and 
Efficiency.  
   
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   10   
   
FINDING 
Most classified documents reviewed adhered to all Federal 
requirements regarding classified NSI; four originally 
classified documents and three derivatively classified 
documents failed to meet Federal requirements regarding 
portion markings 
Of the 43 HHS classified documents reviewed, 36 met all Federal requirements 
regarding classified NSI (see Table 3). 
Table 3: Classified Documents That Met Federal Requirements 
Number That Met All Federal 
Type  Sample Size  
Requirements  
Originally Classified  13  9 
Derivatively Classified   30  27 
     Total   43  36 
Source:  OIG analysis of HHSs  classified documents, 2012. 
OCAs must originally classify NSI in accordance with Federal requirements.  
Nine of the originally classified documents met all Federal requirements;  
however, four lacked portion markings on various pages and paragraphs.   
Specifically, two documents were missing the required paragraph markings, one 
was missing the required page markings, and one was missing both.  Portion 
markings indicate which portions are classified and which are unclassified within 
the same document.  These different portions are marked separately in order to 
avoid overclassification. See Table 4 for the number of originally classified 
documents that met each Federal requirement. 
   
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   11   
   
Table 4: Originally Classified Documents That Met Federal Requirements  
Documents  
Requirement  
(n=13)  
Decision to classify the information was exercised by  
13 
an OCA  
Information was owned by, produced by or for, or  
13 
under the control of the Federal Government  
Information fell within one or more of the classification 
13 
categories 
The OCA described damage to national security that 
could be expected in the event of the informations  13 
unauthorized disclosure 
Classification of the information was not prohibited or 
13 
limited  
The OCA established a specific date or event for 
13 
declassification  
Portion markings were present   9 
Overall classification level was present  13 
Classified by line was present   13 
Reason for classification was present  13 
Declassify on line was present   13 
Total That Met All Requirements   9 
Source:  OIG analysis of originally classified documents, 2012. 
Individuals who derivatively classify NSI must do so in accordance with Federal 
requirements.  Twenty-seven of the thirty derivatively classified documents 
sampled for review met all of these requirements.  Three derivatively classified 
documents lacked the required portion markings, but met all other Federal 
requirements.  Specifically, all three documents were missing required paragraph 
markings.  See Table 5 for the number of sampled derivatively classified 
documents that met the Federal requirements. 
   
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   12   
   
Table 5: Derivatively Classified Documents That Met Federal Requirements 
Documents  
Requirement  
(n=30)  
Information was related to the reproduction, extraction, 
30 
or summation of information that was already classified 
Person who applied the derivative classification was  
identified on the document by  name and position or  30 
personal identifier 
Information was marked consistently with the 
classification markings that apply to the original  30 
information 
Information was owned by, produced by or for, or  
30 
under the control of the Federal Government  
Information fell within one or more of the classification 
30 
categories 
Classification of the information was not prohibited or 
30 
limited  
Portion markings were present   27 
Overall classification level was present  30 
Classified by line was present   30 
Declassify on line was present   30 
Total That Met All Requirements   27 
       
Source:  OIG analysis of derivatively classified documents, 2012. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   13   
   
CONCLUSION AND RECOMMENDATIONS 
Of the 43 HHS classified documents reviewed, 36 met all Federal requirements 
regarding classified NSI. Seven of the documents (four of the originally and three 
of the derivatively classified documents) lacked the required portion markings.  
Portion markings indicate which portions are classified and which are unclassified 
within the same document.  These different portions are marked separately to 
avoid overclassification. Therefore, we recommend that OSSI, working on behalf 
of the Office of the Secretary:  
Ensure That OCAs and Individuals Who Derivatively Classify NSI 
Receive Guidance and Training Regarding the Required Portion 
Markings 
OSSI should ensure that OCAs and individuals who derivatively classify 
information are aware of their responsibility to include required portion markings 
on all classified documents.  OSSI should also provide guidance and training on 
the required portion markings to avoid overclassification of information. 
Take Appropriate Action To  Apply the Required Portion Markings to 
Reviewed Classified Documents  
We will provide information regarding the classified documents that did not 
include the required portion markings.  OSSI should apply the required 
portion markings to these documents. 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
OSSI concurred with both recommendations.  In response to the first 
recommendation, OSSI stated that it ensures that all individuals who handle 
classified information have attended initial mandatory training and, when 
appropriate, annual refresher training in marking classified NSI.  OSSI also stated 
that it ensures that OCA training is provided to the HHS Secretary and Deputy 
Secretary.  Further, OSSI stated that it conducted derivative marking training for 
Classification Security Officers and personnel. 
In response to the second recommendation, OSSI indicated that it would review 
and correct the errors found by OIG during its review of the originally and 
derivatively classified documents. 
We did not make any changes to the report based on OSSIs comments. 
   
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   14   
   
APPENDIX A 
Determination of the Duration of Classification 
Pursuant to Executive Order No. 13526, the Information Security Oversight 
Office (ISOO) issued a Directive.46, 47  According to this Directive, the original 
classification authority (OCA) is required to attempt to determine a date or event 
that is less than 10 years from the date of original classification and that coincides 
with the lapse of the informations national security sensitivity and to assign such 
date or event as the declassification instruction.  If the OCA is unable to 
determine a date less than 10 years after the original classification, he or she must 
assign a declassification date of exactly 10 years.  If the OCA is unable to assign a 
10-year declassification date, he or she must assign a declassification date not to 
exceed 25 years from the date of the original classification decision.48  
Exceptions to this timeline apply to special categories of information, such as 
information that should clearly and demonstrably be expected to reveal the 
identity of a confidential source of intelligence or key design concepts of weapons 
of mass destruction.  These special categories may be assigned a declassification 
date up to 75 years from the date of the original classification.49  
   
 
46  Executive Order No. 13526 requires ISOO  to  issue directives as necessary to implement the 

uniform system for classifying, safeguarding, and declassifying national security information.  

47  32  CFR pt. 2001; 75  Fed.  Reg. 37254 (June 28, 2010). 

48 32 CFR   2001.12(a)(1).  

49 32 CFR   2001.12(a)(2).  

Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   15   
   
APPENDIX B 
Exceptions to Automatic Declassification50  
An agency head may exempt information from automatic declassification if the 
release of the information is clearly and demonstrably expected to: 
(1)  reveal the identity of a confidential human source, a human intelligence  
source, a relationship with an intelligence or security service of a foreign 
government or international organization, or a nonhuman intelligence source; 
or impair the effectiveness of an intelligence method currently in use, 
available for use, or under development; 
(2)  reveal information that would assist in the development, production, or use of 
weapons of mass destruction; 
(3)  reveal information that would impair U.S. cryptologic systems or activities; 
(4)  reveal information that would impair the application of state-of-the art 
technology within a U.S. weapon system; 
(5)  reveal formally named or numbered U.S. military war plans that remain in 
effect, or reveal operational or tactical elements of prior plans that are 
contained in such active plans; 
(6)  reveal information, including foreign government information, that would 
cause serious harm to relations between the United States and a foreign 
government, or to ongoing diplomatic activities of the United States; 
(7)  reveal information that would impair the current ability of U.S. Government 
officials to protect the President, Vice President, and other protectees for 
whom protection services, in the interest of the national security, are 
authorized; 
(8)  reveal information that would seriously impair current national security 
emergency preparedness plans or reveal current vulnerabilities of systems, 
installations, or infrastructures relating to the national security; or  
(9)  violate a statute, treaty, or international agreement that does not permit the  
automatic or unilateral declassification of information at 25 years. 
   
 
50 This information is taken  directly from Executive Order No. 13526    3.3(b); 32 CFR  2001.26. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   16   
   
APPENDIX C 
Definition of Each Classification Level 
Information may be classified at one of three levels:  Top Secret, Secret, and 
Confidential. Below is a definition of each classification level.  
Top Secret is applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause exceptionally grave damage to the national 
security that the original  classification authority is able to identify or describe.51  
Secret is applied to information, the unauthorized disclosure of which reasonably 
could be expected to cause serious damage to the national security that the  
original classification authority is able to identify or describe.52  
Confidential is applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause damage to the national security that the 
original classification authority is able to identify or describe.53  
   
 
51  Executive Order No. 13526  1.2.  

52 Ibid. 

53 Ibid. 

Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   17   
   
APPENDIX D 
Sample Selection for Derivatively Classified Documents 
The Office of Security and Strategic Information (OSSI) assisted us in selecting a 
purposive sample of 30 derivatively classified documents for review.54  Below is a 
description of the process that OSSI used to select the purposive sample. 
Hardcopy derivatively classified documents. According to the Associate Director  
for the Strategic Intelligence Division  of OSSI, few derivatively classified 
documents are retained in hardcopy format.  He indicated that the hardcopy 
documents chosen for review were not randomly selected.  Rather, he made 
copies of the hardcopy derivatively classified documents that he possessed and 
provided them for our review.  This resulted in a total of 12 hardcopy 
documents8 briefing slides and 4 Readbook documents. 
Electronic derivatively classified documents. The majority of derivatively 
classified documents were stored electronically as email responses to original 
classification decisions made by other Federal agencies.  These emails were 
stored electronically on information technology (IT) systems owned by the 
Department of Homeland Security and the Department of Defense.  Below is a 
description of OSSIs process for selecting the derivatively classified emails 
included in our review. 
(1)  The Associate Director for the Strategic Intelligence Division of OSSI 
numbered pieces of paper 1 through 30. 
(2)  Four OSSI employees were instructed to select five of the numbered pieces of 
paper each. 
(3)  The four employees were then instructed to access their sent folders in their 
email accounts and choose the emails that corresponded to the first number 
that they had randomly selected (e.g., if the number selected was 25, the 
employee scrolled down his/her sent folder to the 25th email).55  
(4)  The email was printed for review. 
 
54 OSSI officials indicated that HHS produces three types  of derivatively classified documents; 
each type is stored differently.  These three types are:  (1) briefing slides, (2) Daily Intelligence  
Readbook documents (Readbook), and (3) emails.  Briefing slides are generally produced  for the 
Deputy Secretary of  HHS and other  HHS leadership; these documents may be maintained in 
hardcopy  format.  The Readbook is produced to brief OSSI leadership; these documents are 
maintained in hardcopy  format.  Derivatively classified emails are produced as responses to 
original classification decisions made by  other Federal agencies.  These emails are stored  
electronically on the IT systems owned by the Department of Homeland Security and the 
Department of Defense.  
55  If a selected number corresponded to an email that was unclassified, the employee was  
instructed to move to the next email in succession. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   18   
   
(5)  Steps 3 and 4 were repeated until each of the four employees had selected 

5 emails, for a total of 20. 

Two additional emails were selected by the Associate Director for the Strategic 
Intelligence Division using the same process, resulting in a total of 22 derivatively 
classified emails selected for review.  However, 4 of the 22 emails were directly 
related to four Readbook documents selected for review.  As a result, these four 
emails were combined with their respective Readbook documents to create a 
single, derivatively classified document.   Thus, the sample of derivatively 
classified documents consisted of 12 hardcopy documents and 18 printed emails.  
See Table D-1 for the types of derivatively classified documents included in our 
review and sample sizes. 
Table D-1: Derivatively Classified Documents Selected for Review  
Type of Document   Number of Documents Selected   Sample Size  
Briefing slide   8  8 
Readbook document  4  4 
Email  22*  18 
     Total  34  30 
                     
*Four of the  twenty-two emails were directly related  to the four Readbook documents selected  for review.  These 4 emails were 
attached to the  respective  Readbook documents to make up a single derivatively classified Readbook document, resulting in 
18 emails. 
   
Source:  Office of  Inspector General analysis of derivatively classified documents, 2012. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   19  APPENDIX E 
Agency Comments 
,
,

........
If_

A 	
 	 Jf't"  DOEfPfAiRTcMeB~ITaOnfd'  SHbE1JAIBLgIHic  l&n fHorUmMaAtioNu S ERVtCES
~~ -------------------------------------------------------------------
February 22. 2012 
To:  Daniel R , Levinson 
Inspector Genet'al for Evaluation and Inspections 
Department of Health & Human Setvlc:es 
From:  Of. Joy Miller 
Deputy Asslstant Secte\ary for Secunty 
Ofl1ce of Security and Strategic Information (OSSI) 
Secte1ary's Senior lnte!Jigence Official 
Subject: OSSI Response to Draft Firlal OIG Reports, dated 29 January 2013 
References: 
Q!G Report OEI-0712-00400 (Dra11) HHS Adopted, Admintsteted, and Generally Followed 
~lnfor'm8tion Policies, (OEI.07-12..()()400) 
OIG Report OEI.07-12.()().401 (Otaf'l) Originally and Derivatively Classified Documents Met 
Most Federal Reql.irements, (0EI.07-12-00401) 
1. Purpose. To proylde responses to OlG recommendations as noted In the reference repons. 
2 . Background.  The Reduci'tg Over-Ciassific:ation Ad of 2010 manclated that the Inspector 
General for each federal goyemment ~Of' depat1ment Who haYe employees authorized to 
make otiginal ~decisions conduct two evakJations. One evaluation is inrended to 
assess whether appk.able da.salloc:ation polides haYe been ~.effec:tively adminiAered, and 
~:andthe OCher to Identity ~tNit may CMtribute to~of rnatelial. 
These evaluations wll be completed by 30 ~bef.2013. Then, a second evaluation, to be 
completed by 30 ~.2016 must review progress made pursuant to the results of the first 
evaluation. The HHS Special Security Officer (SSO) serves as lead fof c:oordlnating Department 
wide implementation of the HHS Classified National Security lnformaotion (NSI) Policy. 
3  OIG Report OEI-07-12..()0400 (Otaf'l). This OIG report 8ddres$ed the first required eY1IIuation 
and assessed whether HHS had adopted, effect~aclmlnlstered. and followed poiklele regarding 
Classified NSI. 
A. 	 Q!G Recommenc:!ltic!. Clarify who is responsible for ensuring that Classification 
Security Offic:era (CSO) receive traltllng. 
8 	 OSS! Response. Concur. QSSI is In the process of revising the HHS ClaSsified 
NatlonGI Security lnfonnation Handbook, dated 17 February 2012 to ensure 
OPISTAFF OIV CSOs are aware of their responsibility to prOYide their dMsions wdh 
guidance and ovet"'ight on the handling and safeguarding of classified NSI. 
Adcfitionally, OSSI retasued the Cllmifiecl NSI Polley and Handbook to all OP/STAFF 
OtV CSOa in mid-Oec:ember 2012, to ensure each had their own copy of the 
handbook, regardless of whether their ciMsions deve4op Of' maintain clasaified 
infcm\atlon. 
C. 	 OIG Recommendttk!n. Ensure that all Classification Security Officers receive 
guiclan<:e and tnalnlng regarding Classified National Security Information. 
1 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)  20   
   
Note: The Office of Security and Strategic Information did not include any  editorial or technical comments in the attachments 
 
referenced in its response. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)  21   
   
 
ACKNOWLEDGMENTS 
This report was prepared under the direction of Brian T. Pattison, Regional 
Inspector General for Evaluation and Inspections in the Kansas City regional 
office, and Brian T.  Whitley, Deputy Regional Inspector General. 
Rae Hutchison served as the project leader for this study.  Other Office of 
Evaluation and Inspections staff from the Kansas City regional office who 
conducted the study include Michael J. Brown and Jordan R. Clementi.  Central 
office staff who provided support include  Althea Hosein, Debra Roush, and 
Talisha Searcy.  Office of Investigations staff who provided support include Asher 
Shapiro. 
Originally and Derivatively Classified Documents Met Most Federal Requirements (OEI-07-12-00401)   22   
Office  of Inspector General 
 
http://oig.hhs.gov  
 
The mission  of  the Office of Inspector General  (OIG), as mandated by  Public Law  95-452,  as  
amended, is  to protect the integrity of the Department of  Health and  Human Services  
(HHS)  programs, as well as the  health and welfare  of  beneficiaries served by those 
programs.  This  statutory mission is carried out through a nationwide  network of  audits,  
investigations, and inspections conducted  by the  following  operating components:  
Office of Audit Services  
The Office of  Audit Services (OAS) provides auditing services  for  HHS, either by conducting  
audits with its own audit  resources or  by overseeing audit work done by  others.  Audits  
examine the performance of  HHS programs  and/or  its grantees and contractors in carrying  
out their respective responsibilities and are intended to provide independent assessments of  
HHS programs  and operations.  These assessments help reduce waste,  abuse, and  
mismanagement and promote economy  and efficiency throughout  HHS.  
Office  of Evaluation and  Inspections  
The Office  of Evaluation and  Inspections (OEI)  conducts national evaluations to  provide  
HHS, Congress, and  the  public with  timely,  useful, and reliable information on  significant  
issues.  These evaluations focus  on preventing fraud, waste, or abuse and promoting  
economy,  efficiency, and effectiveness of departmental programs.  To promote impact,  OEI  
reports  also present practical recommendations for  improving program operations.   
Office of Investigations  
The Office of  Investigations  (OI) conducts criminal, civil, and  administrative investigations  
of fraud  and  misconduct related  to HHS programs,  operations, and beneficiaries.   With  
investigators working in  all 50  States and  the District of Columbia, OI utilizes its resources  
by actively coordinating  with  the Department  of  Justice and other Federal,  State,  and local  
law enforcement authorities.  The investigative efforts  of  OI often lead  to criminal  
convictions, administrative sanctions, and/or civil  monetary penalties.  
Office of  Counsel to the Inspector General  
The Office  of Counsel to the Inspector General (OCIG)  provides  general  legal  services to 
OIG, rendering advice  and opinions on  HHS programs and operations  and providing all  
legal support  for  OIGs internal operations.  OCIG  represents OIG in  all civil and  
administrative  fraud and  abuse cases involving  HHS programs, including False Claims Act,  
program exclusion, and civil monetary penalty cases.  In connection  with  these cases,  OCIG  
also negotiates and monitors corporate integrity agreements.  OCIG renders  advisory  
opinions, issues compliance program guidance, publishes fraud  alerts,  and provides other  
guidance  to  the health care industry concerning  the anti-kickback  statute and other OIG  
enforcement authorities.