| Code | Display | Comments |
|---|
 SecurityPolicy | security policy | |
| AUTHPOL | authorization policy | |
| ACCESSCONSCHEME | access control scheme | |
| DELEPOL | delegation policy | |
| ObligationPolicy | obligation policy | |
| ANONY | anonymize | |
| AOD | accounting of disclosure | |
| AUDIT | audit | |
| AUDTR | audit trail | |
| CPLYPOL | comply with policy | |
| CPLYCC | comply with confidentiality code | |
| CPLYCD | comply with consent directive | |
| CPLYCUI | comply with controlled unclassified information policy | |
| CPLYJPP | comply with jurisdictional privacy policy | |
| CPLYJSP | comply with jurisdictional security policy | |
| CPLYOPP | comply with organizational privacy policy | |
| CPLYOSP | comply with organizational security policy | |
| DECLASSIFYLABEL | declassify security label | |
| DEID | deidentify | |
| DELAU | delete after use | |
| DOWNGRDLABEL | downgrade security label | |
| DRIVLABEL | derive security label | |
| ENCRYPT | encrypt | |
| ENCRYPTR | encrypt at rest | |
| ENCRYPTT | encrypt in transit | |
| ENCRYPTU | encrypt in use | |
| HUAPRV | human approval | |
| LABEL | assign security label | |
| MASK | mask | |
| MINEC | minimum necessary | |
| PERSISTLABEL | persist security label | |
| PRIVMARK | privacy mark | |
| CUIMark | CUI Mark | |
| PSEUD | pseudonymize | |
| REDACT | redact | |
| UPGRDLABEL | upgrade security label | |
| PROCESSINLINELABEL | process inline security label | |
| PrivacyMark | privacy mark | |
| ControlledUnclassifiedInformation | ControlledUnclassifiedInformation | |
| CONTROLLED | CONTROLLED | |
| CUI | CUI | |
| CUIHLTH | CUI//HLTH | |
| CUIHLTHP | (CUI//HLTH) | |
| CUIP | (CUI) | |
| CUIPRVCY | CUI//PRVCY | |
| CUIPRVCYP | (CUI//PRVCY) | |
| CUISP-HLTH | CUI//SP-HLTH | |
| CUISP-HLTHP | (CUI//SP-HLTH) | |
| CUISP-PRVCY | CUI//SP-PRVCY | |
| CUISP-PRVCYP | (CUI//SP-PRVCY) | |
| UUI | (U) | |
| SecurityLabelMark | Security Label Mark | |
| ConfidentialMark | confidential mark | |
| COPYMark | copy of original mark | |
| DeliverToAddresseeOnlyMark | deliver only to addressee mark | |
| RedisclosureProhibitionMark | prohibition against redisclosure mark | |
| RestrictedConfidentialityMark | restricted confidentiality mark | |
| DRAFTMark | Draft Mark | |
| RefrainPolicy | refrain policy | |
| NOAUTH | no disclosure without subject authorization | |
| NOCOLLECT | no collection | |
| NODSCLCD | no disclosure without consent directive | |
| NODSCLCDS | no disclosure without information subject's consent directive | |
| NOINTEGRATE | no integration | |
| NOLIST | no unlisted entity disclosure | |
| NOMOU | no disclosure without MOU | |
| NOORGPOL | no disclosure without organizational authorization | |
| NOPAT | no disclosure to patient, family or caregivers without attending provider's authorization | |
| NOPERSISTP | no collection beyond purpose of use | |
| NORDSCLCD | no redisclosure without consent directive | |
| NORDSLCD | no redisclosure without consent directive | |
| NORDSCLCDS | no redisclosure without information subject's consent directive | |
| NORDSCLW | no disclosure without jurisdictional authorization | |
| NORELINK | no relinking | |
| NOREUSE | no reuse beyond purpose of use | |
| NOVIP | no unauthorized VIP disclosure | |
| ORCON | no disclosure without originator authorization | |