California Office of Health Information Integrity Logo     SHIPM


Statewide Health Information Policy Manual (SHIPM) Documents

CalOHII developed the Statewide Health Information Policy Manual (SHIPM) to provide State Departments with a resource that:  

  • Provides guidance on how to protect patient privacy while promoting coordinated care,
  • Promotes uniform interpretation and application of health information laws including those relating to security, patients' rights, and transactions and code sets, and
  • Helps state entities avoid fines and sanctions resulting from unauthorized disclosures of health information.


 The SHIPM is a living document and will be updated with changes to state or federal law.

Effective February 2, 2018:  Due to the "Confidentiality of Substance Use Disorder Patient Records" (42 CFR Part 2) final rule published January 3, 2018,  the required language documented in SHIPM 2.3.4 Substance Abuse Treatment Section III.B.3 must be updated.  Each disclosure made with the patient's written consent must be accompanied with ONE of the following written statements:


"This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65"

- or -  


"42 CFR part 2 prohibits unauthorized disclosure of these records."


[Source: 42 CFR Part 2 Final Rule SAMHSA-4162-20, RIN 0930-ZA07 – "Confidentiality of Substance Use Disorder Patient Records"] 

SHIPM policy 2.3.4 Substance Abuse Treatment will be updated and published with the next revision (scheduled for June 2018).


November 1, 2017, a new tool has been created by CalOHII – Oversight of BAs – Gidance and Checklist -  to assist Departments with the oversight of their Business Associates.  This document provides an analysis of applicable Federal and State laws/regulations as well as items to consider for developing an oversight program.  SHIPM policy 4.4.2 Oversight of Business Associates will be updated to include this document as an attachment and published with the next revision to be published in June 2018.

How to Navigate the SHIPM Document in Adobe Acrobat or Free Adobe Reader (DOC)


Questions or comments about the SHIPM can be sent to