California Office of Health Information Integrity Logo     SHIPM


Statewide Health Information Policy Manual (SHIPM) Documents

CalOHII developed the Statewide Health Information Policy Manual (SHIPM) to provide State Departments with a resource that:  

  • Provides guidance on how to protect patient privacy while promoting coordinated care,
  • Promotes uniform interpretation and application of health information laws including those relating to security, patients' rights, and transactions and code sets, and
  • Helps state entities avoid fines and sanctions resulting from unauthorized disclosures of health information.


 The SHIPM is a living document and will be updated with changes to state or federal law.

Effective January 1, 2017, the scope of a breach was expanded to include encrypted data as well as unencrypted or unsecured health information.  [source: AB2828 – Personal Information Privacy: Breach (Chapter 337)SHIPM policy 2.4.1 Breach and Breach Notification will be updated and published with the next revision to be published in June 2017.

Effective March 21, 2017, the required language documented in SHIPM 2.3.4 Substance Abuse Treatment Section III.B.3 must be updated with the following language: 

 “This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65."

[Source: Federal Register Final Rule 42 CFR part 2 – “Confidentiality of Substance Use Disorder Patient Records”]  SHIPM policy 2.3.4 Substance Abuse Treatment will be updated and published with the next revision (scheduled for June 2017).


How to Navigate the SHIPM Document in Adobe Acrobat or Free Adobe Reader (DOC)


Questions or comments about the SHIPM can be sent to