California Health and Human Services

Statewide Health Information Policy Manual (SHIPM) Documents

CalOHII developed the Statewide Health Information Policy Manual (SHIPM) to provide State Departments with a resource that:

  • Provides guidance on how to protect patient privacy while promoting coordinated care,
  • Promotes uniform interpretation and application of health information laws including those relating to security, patients’ rights, and transactions and code sets, and
  • Helps state entities avoid fines and sanctions resulting from unauthorized disclosures of health information.

The SHIPM is a living document and is updated annually with changes to state or federal law.  The most recent version of SHIPM is available on our website. Contact CalOHII for previous versions of SHIPM.

Update December 2019: During the 2019 Legislative session several bills were signed that impact state entities covered by HIPAA beginning January 1, 2020.  CalOHII will make updates to SHIPM in the next revision published in June 2020.  The following provides a summary of the impacts:

  • AB175 (Foster care: rights) – This bill expands, clarifies, and revises various rights of foster youth, found under the Foster Youth Bill of Rights.  Specifically, Welfare and Institutions Code §16001.9(a)(22)(B) was added to allow foster youth the right to review and receive copies of their medical records at no cost until they are 26 years of age.  SHIPM Policy 5.4.1 – Patient’s (Individual’s) Right to Access Health Information will be updated.
  • AB398 (Protection and advocacy agency) – Updates were made to Welfare and Institutions Code§4900 – 4903 regarding the release of medical records to Disability Rights California to ensure compliance with current federal laws and regulations.  Current SHIPM policies do not provide details about what information is released, CalOHII advises state entities to consult with their legal counsel.
  • AB728 (Homeless multidisciplinary personnel teams) – This bill allows the counties of Los Angeles, Orange, Riverside, San Bernardino, San Diego, Santa Clara, and Ventura to provide multidisciplinary personnel team (MDT) staff access to medical/mental health records of homeless adult and families without authorization which is counter to HIPAA, Part 2 and Health and Safety Code § 11845.5.  MDT staff include both medical and non-medical participants – disclosure of health information to non-medical staff can be done with a proper authorization.  Regarding Substance Use Disorder treatment information covered by 42 CFR Part 2 and Health and Safety Code § 11845.5 – state entities should not change their uses and disclosures policies and procedures for this bill.
  • AB1130 (Personal information: data breaches) – A change was made to Civil Code §1798.29(d)(1)(D) to update the breach notification template to include the internet website of the organization in the contact information.  SHIPM Policy 2.4.1 Breach and Breach Notification will be updated.

Update November 2019: – HHS Issues Final Rule to Rescind the Adoption of the Standard Unique Health Plan Identifier and Other Entity Identifier – Effective December 7, 2019, the Health Plan Identifier (HPID), Other Entity Identifier (OEID) are rescinded along with two definitions for Controlling Health Plan and Subhealth Plan. SHIPM will be updated in June (specifically policy 4.3.1 – Transactions and Code Sets) to reflect these changes. The official text of the final rule can be found on the Government Publication website.

  • SHIPM – revision 6/2019
  • SHIPM – revision 6/2018 
  • SHIPM – revision 6/2017
  • SHIPM – revision 9/2016
  • SHIPM – revision 6/2016
  • SHIPM – initial version 6/2015

Questions or comments about the SHIPM can be sent

Scroll to top button