Every Individual at Every Level Including DHA Civilians Military Personnel as Well as Contractors Providing Support to the DHA Pursuant to Contractual Requirements Is Authorized to Identify and Mark Information as CUI: The Authorization Rule, Its Limits, and How Marking Actually Works

The statement is an authorization rule, and it's broader than many people assume: under the Department of Defense's Controlled Unclassified Information program, every individual at every level — DHA civilians, military personnel, and contractors supporting DHA under contractual requirements — is authorized to identify and mark information as CUI. Authority to designate CUI lives in the DHA's official CUI Registry entry, while the contractual CUI clause binds contractors to the same marking standards as federal staff.

Important scope note: This article is general educational information, not legal advice or an official DHA determination. CUI policy is set by the National Archives (32 CFR Part 2002), the DoD CUI Program Office, and DHA implementing issuances; consult your command's trained CUI authority or the DHA CUI office before making designation decisions, and treat the current DoD CUI Registry as controlling when any detail here appears to conflict.

What the Authorization Actually Says and Who Set It

The sentence in the main keyword mirrors the authorization language the Defense Health Agency publishes in its entry in the DoD CUI Registry. That entry lists DHA as a CUI Senior Official component and describes who within the Agency may identify and mark information as CUI. The scope named there covers civilians, military members, and contractor personnel performing under DHA contracts.

The governing framework sits above DHA. Executive Order 13556 created the CUI program in 2010, and the National Archives issued the implementing regulation at 32 CFR Part 2002 in 2016. DoD Instruction 5200.48, issued March 6, 2020, carries the program into the military departments and defense agencies, including DHA.

Authorization is not the same as obligation. Being permitted to mark information as CUI does not mean every employee should mark freely. Designation follows the categories in the DoD CUI Registry, and DHA's own guidance instructs personnel to apply markings consistent with the governing category and the agency's CUI policy rather than personal preference.

The phrase "at every level" removes a common misconception. Historically, classification authority was delegated to specific positions. CUI authority is different: it is distributed, and a GS-7 medical records technician and a contract security officer sit inside the same authorization as a senior civilian executive when the information fits a legitimate category.

Contractors and the Clause That Pulls Them Into the Program

Contractors supporting DHA come under CUI requirements through the contract itself, most commonly via the clause at DFARS 252.204-7012 or the CUI-specific marking obligations written into the performance work statement. That clause requires safeguarding covered defense information and reporting cyber incidents to DoD within 72 hours of discovery.

The 72-hour reporting window is a concrete number contractors often miss. A subcontractor at any tier who experiences an incident affecting covered defense information must flow the report up so the prime can meet the DoD deadline. Missing it is a contractual failure, not a paperwork slip.

DFARS 252.204-7012 also incorporates the security requirements of NIST SP 800-171, which specifies 110 security requirements across 14 control families for protecting CUI on contractor systems. The count matters for planning: a contractor's system security plan must address each requirement or document a compensating rationale in the Plan of Action and Milestones.

Contractor marking authority depends on the contract's scope. A contractor employee is authorized to mark DHA information as CUI when the contract assigns that work, the employee has completed required training, and the information falls within a Registry category. Outside that scope, the employee should route the material to the government contracting officer's representative rather than invent a marking.

Legally Prohibited Designations: The Categories You Can't Just Claim

The CUI program prohibits certain designations outright, and these limits apply inside DHA regardless of how broad the marking authorization is. Under 32 CFR Part 2002, information may not be designated CUI simply to conceal embarrassment, inefficiency, or error; to prevent competition; or to restrain criticism.

The regulation also bars designating information as CUI to delay release in response to a Freedom of Information Act request or to prevent or delay public oversight. These prohibitions exist because CUI is not a secrecy tool. It protects information whose uncontrolled release would harm a specific interest the Registry category names.

A practical failure case: a clinic administrator marks a routine staffing complaint as CUI to keep it out of an internal review. That designation fails the prohibition test, and the marking itself becomes a compliance problem. Removing an improper CUI marking follows the agency's challenge process rather than unilateral action.

DHA's CUI guidance points personnel to the Registry's category descriptions, which state the basis for each designation. If the information does not fit a category, it is not CUI, and the honest answer is to leave it unmarked and handle it under the applicable records and privacy rules.

The Registry Categories DHA Personnel Encounter Most

DHA's Registry entry identifies the categories the Agency uses, including health information protected under laws such as the Privacy Act and HIPAA, personnel and payroll records, and procurement-sensitive material. Each category carries a prescribed marking, and the category abbreviation appears in the marking banner.

Health information is the most common CUI DHA staff handle. A patient's protected health information falls under a Registry category and receives the CUI marking when it is maintained in a system subject to the program's controls. The marking is not a substitute for HIPAA safeguards; both regimes apply simultaneously.

Contractor personnel encounter procurement-sensitive categories when they support acquisition, source selection, or budget development. These markings carry distribution statements that limit release to specific audiences, and the marking block tells the holder exactly what those limits are.

The DoD CUI Registry is the controlling list, and categories get added or renamed over time. Personnel who marked information last year should confirm the current category abbreviation before reusing an old template, because a retired category produces a nonconforming marking.

How to Mark CUI Correctly in DHA Documents: Six Steps

Marking follows a prescribed format, and the format is what makes the authorization usable. DoD Instruction 5200.48 sets the marking requirements, and DHA personnel apply them to documents, emails, and systems. The steps below follow the sequence a document typically passes through.

1: Confirm the category. Match the information to a current DoD CUI Registry category. If no category fits, stop and consult the command CUI authority before applying any marking. 2: Apply the banner marking. Place the CUI banner at the top and bottom of each page of a document, and in the subject line for email, using the format "CUI" followed by the category abbreviation when the category requires it, such as "CUI//SP-PRIV" for privacy-protected material. 3: Complete the designation indicator. Name the designating agency — DHA — and, where required, the office and point of contact in a designation indicator block so the source of the marking is traceable. 4: Add handling instructions. Include the distribution limitation and any dissemination controls the category requires in the marking block, not in the body text where scrolling can drop them. 5: Mark portions when needed. For documents that mix CUI and non-CUI content, apply portion markings to the CUI paragraphs so a reader knows exactly what the banner covers. 6: Log and transmit. Record the designation in the system of record when the information enters a repository, and send it through an approved channel so the marking survives email gateways and print handling.

If a step fails — the category is wrong, the banner is missing, or the distribution block is incomplete — do not transmit the material. Correct the marking or route it to the DHA CUI office for review, because a nonconforming marking undermines the protection the category was designed to give and can trigger a compliance finding.

Marking Comparison: CUI Versus the Labels It Gets Confused With

Personnel regularly confuse CUI with classification markings and with the older "For Official Use Only" (FOUO) label. The table below isolates the differences that matter for DHA staff and contractors, and it reflects the point that FOUO is a legacy label the CUI program replaced within DoD.

The comparison produces a practical rule: if you're reaching for "FOUO," stop. Within DoD, the CUI marking has replaced it, and a document still bearing FOUO should be corrected when it is reviewed or reissued.

Training, Tracking, and the Consequences of Getting It Wrong

DHA personnel complete CUI training through the DoD and DHA training portals before designating information. The training covers the categories, marking formats, safeguarding requirements, and the challenge process, and refresher requirements apply on the cycle the DoD CUI Program Office sets.

Contractors complete equivalent training under their contract's CUI obligations and often document it in their system security plan. A contractor employee without current training should not mark DHA information as CUI, even though the authorization in the Registry entry is stated broadly, because the contract's training prerequisite gates the authorization in practice.

Consequences run along two tracks. An improper marking is corrected through the agency's challenge process, and a repeated failure to mark properly can produce an inspection finding under DoD's CUI compliance reviews. A contractor's failure to safeguard CUI or report an incident within 72 hours can produce contractual remedies, including withholding of payments or termination for cause under the applicable clause.

The internal tracking mechanism matters. DHA maintains records of CUI designations through its systems of record, and personnel should follow the agency's reporting path when information they marked is lost, mishandled, or transmitted over an unapproved channel. A quick report beats a quiet fix.

The Marking Challenge: What to Do When You Think a Designation Is Wrong

Every authorized individual can also challenge a designation. If a reviewer believes information is improperly marked as CUI, the regulation provides a challenge process, and the agency must respond. This is the counterpart to broad marking authority: the same distributed workforce that designates also flags over-marking.

The challenge process is not a way to unilaterally strip markings. The holder of a challenged document should keep handling it as marked until the agency rules, per the regulation's requirement that challenged information remain protected during review. Removing a banner on your own initiative risks a spill.

Over-marking is a real compliance issue, not a harmless habit. When routine material carries a CUI banner, distribution slows, storage requirements multiply, and the marking loses credibility. DHA's CUI guidance asks personnel to designate only what a Registry category covers.

The most common over-marking failure is template carryover: an old document inherits a banner from a prior version after its content changes. A careful review before release catches it, and the challenge process exists for the cases a reviewer can't resolve locally.

FAQ

Does the CUI authorization apply to a contractor working at a DHA clinic under a staffing contract?

Yes, when the contract includes the CUI obligations and the employee has current training. The authorization sentence the Agency publishes extends to contractors providing support to DHA pursuant to contractual requirements. A staffing contract that touches patient records or procurement data typically carries those obligations through DFARS 252.204-7012 or the performance work statement. Confirm the exact scope with the contracting officer's representative before marking.

What's the difference between CUI and FOUO, and is FOUO still valid in DoD?

FOUO is a legacy label that the CUI program replaced within the Department of Defense, so a current DoD document should carry the CUI marking instead. 32 CFR Part 2002 established the single CUI framework, and DoD Instruction 5200.48 implemented it. Existing documents bearing FOUO should be corrected when reviewed or reissued. If you receive new material labeled FOUO from a DoD source, treat it as CUI and flag the marking for correction.

How fast must a contractor report a cyber incident involving CUI?

Within 72 hours of discovery, under DFARS 252.204-7012. The clock matters because subcontractors at any tier must flow the report up so the prime can meet the DoD deadline. The report goes to the DoD cyber crime center through the channel the clause specifies, and it must include the information the clause lists. A late report is a contractual failure independent of whether data was actually lost.

Can I mark a document as CUI just to keep it out of a FOIA release?

No. The CUI regulation prohibits designating information to delay release under FOIA or to prevent public oversight. A proper designation requires a Registry category whose uncontrolled release would harm a specific named interest, such as privacy or procurement integrity. If a FOIA concern is the only reason for the marking, the designation is improper and may be challenged. Route the question to the agency's FOIA and CUI offices instead.

How many security requirements does a contractor's CUI system need to meet?

110 requirements across 14 control families, per NIST SP 800-171 as incorporated by DFARS 252.204-7012. A contractor's system security plan must address each requirement or document a compensating rationale in its Plan of Action and Milestones. The count is fixed in the current revision of the special publication, and confirm the revision your contract cites before building the plan.

What happens to a CUI designation if the Registry category changes?

The marking should be updated to the current category at the next review or reissue, because the DoD CUI Registry controls which categories and abbreviations are valid. A retired category produces a nonconforming marking, and reusing a stale template propagates the error. Personnel should confirm the current abbreviation before applying a marking, not rely on last year's document.

Can I remove a CUI banner myself if I think the marking is wrong?

No. Challenged information stays protected as marked until the agency resolves the challenge through its CUI challenge process. Removing a banner on your own initiative risks a spill and a compliance finding. Submit the challenge, keep handling the material under the existing marking, and document what you sent and when.

Does CUI marking replace HIPAA or Privacy Act obligations for patient information?

No. CUI marking sits alongside those regimes rather than replacing them. Patient information subject to HIPAA and the Privacy Act receives its CUI marking under the applicable Registry category, and the underlying statutes' use, disclosure, and safeguard rules continue to apply. Handle the record under all applicable authorities, and consult the DHA privacy office when the regimes seem to point in different directions.

Scope reminder: This article is general educational information about the DoD CUI program and DHA implementation, not legal advice or an official agency determination. Policy, Registry categories, and contract clauses change, so confirm current requirements with the DHA CUI office, your contracting officer, or a qualified professional before acting.