43 CFR §2.301

1. (a)This subpart describes how DOI, including all its bureaus and offices, handles the use and protection of individuals' SSNs in documents that are mailed. SSNs may only be included in documents that are mailed when authorized and necessary, and where appropriate safeguards are employed to protect individual privacy in accordance with the Act.
2. (b)This subpart includes the circumstances under which inclusion of an individual's SSN on a document is authorized to be mailed;
3. (c)This subpart requires SSNs to be safeguarded when mailed by:
   1. (1)Requiring the partial redaction of SSNs where feasible; and
   2. (2)Prohibiting the display of SSNs on the outside of any package or mailing envelope sent by mail or through the window of an envelope or package.