Compliance and Policy/Policy Privacy Unit
Compliance and Policy/Policy Privacy Unit
Statewide Health Information Policy Manual (SHIPM) for State Departments
The Statewide Health Information Policy Manual (SHIPM) was developed in 2015 to guide agencies on protecting patient privacy while promoting coordinated care.
- It provides guidance on how to protect patient privacy while promoting coordinated care
- It promotes uniform interpretation and application of health information laws including those relating to security, patients’ rights, and transactions and code sets
- It helps state entities avoid fines and sanctions resulting from unauthorized disclosures of health information
This SHIPM manual is updated annually to reflect the latest changes in state or federal law. The latest version can be accessed using the following link- SHIPM – revision 6/2025.
Questions or comments about the SHIPM can be sent to CDIIPolicy@chhs.ca.gov.
Statewide Health Information Guidance (SHIG)
The State Health Information Guidance (SHIG) is a collaboration of the Center for Data Insights and Innovation with various organizations to develop specific materials to help clarify federal and state laws that affect disclosure and sharing of health information. The The SHIG efforts are composed of comprehensive research, drawing from a broad group of stakeholders that reflect cross-industry insights and experience, to get a clear understanding of the problems different groups were facing in the field.
Currently, there are five volumes of SHIG. Utilize the following links for additional information:
Sharing Behavioral Health Information in California (Volume 1.3 published January 2025)
Sharing Health Information to Address Food and Nutrition Insecurity in California (Volume 2.2 published January 2025)
Sharing HIV/AIDS Information in California (Volume 3.2 published January 2025)
Sharing Health Information of People Living with Intellectual and/or Developmental Disabilities in California (Volume 4.2 published January 2025)
Sharing Minors and Foster Youth Health Information in California (Volume 5.2 published January 2025)
For general information about the SHIG, refer to the SHIG Fact Sheet.
We strongly encourage all users of the SHIG to read it in its entirety and consult with your legal counsel if you have any questions.
For information about the SHIG, email shiginformation@chhs.ca.gov
Download SHIG Volume 5: State Health Information Guidance (SHIG) 5.2 (revised January 2025)
Compliance Review Program
The Center for Data Insights and Innovation (CDII) has statutory responsibility to evaluate, monitor, and report on state departments’ HIPAA compliance. The goals of CDII’s Compliance Oversight Program are to:
- Create a collaborative culture of compliance for state departments
- Keep Californians’ health information safe
- Provide technical assistance and leadership on California’s HIPAA compliance
The Compliance Oversight Program includes conducting ongoing compliance reviews on state departments subject to HIPAA. The focus during the compliance review is to work with the state department to identify any gaps in HIPAA compliance (based on the Statewide Health Information Policy Manual) and monitor the resolution of all identified compliance gaps.
The Compliance Oversight Program conducts ongoing compliance reviews on state departments subject to HIPAA. The focus during the compliance review is to work with the state department to identify any gaps in HIPAA compliance (based on the Statewide Health Information Policy Manual) and monitor the resolution of all identified compliance gaps.
State departments assessed to be covered entities and/or business associates are subject to compliance reviews. For a list of the state departments subject to HIPAA and/or more information about the most recent assessment, refer to the 2022 Health Information Entity Status Assessment page.
State departments are notified several weeks before they are scheduled for a compliance review – the Compliance Review Schedule is under review at this time.
The compliance review process is comprised of the following activities:
- The compliance review begins with the department providing CDII with artifacts/documents and answering questions within a specified time frame.
- CDII reviews all materials collected from the department to document initial observations.
- CDII may schedule an onsite review with the department. During the onsite visit, the CDII team conducts follow-up meetings to clarify information received from the department (and may tour selected operational areas of the department).
- CDII documents all observations and findings along with recommendations for addressing gaps. The draft document is provided to the department for review and comments before CDII finalizes the report.
- Once the report is finalized, the review moves into the Corrective Action Plan phase. During this time, CDII works with the department to track and monitor the resolution of all gaps identified.
Tools and templates used during the compliance review are available by contacting the CDII Privacy Office at CDIIPolicy@chhs.ca.gov. We encourage CA state departments to review and use these tools, templates, and checklists in your own compliance program efforts and for preparing for a CDII compliance review. By reviewing these tools and templates now, you will have a good understanding of what is expected to be HIPAA compliant.
If you have any questions, contact the CDII Policy Office at CDIIPrivacyOffice@chhs.ca.gov.
The most recent health entity assessment can be found here- 2022 Health Information Entity Status Assessment
Resources
CDII provides the following resources to assist state departments as well as California patients, physicians, and health care providers with general questions and issues related to HIPAA.
State Departments
Breach Notification- refer to the following resources for the specific actions to be taken:
- SHIPM policy 2.1.4 – Breach and Breach Notification
- HHS OCR – Submitting Notice of a Breach to the Secretary
- California Department of Technology – Office of Information Security – SIMM 5340-A: Incident Reporting and Response Instructions
- California Attorney General – Data Security Breach Reporting
Annual Breach Reporting
At the beginning of each calendar year, state entities that are covered entities or business associates must report ALL breaches to CDII and HHS OCR. Refer to the following resources for the specific actions to be taken:
- SHIPM policy 2.1.4 – Breach and Breach Notification and attachment SHIPM 2.4.1 CDII Annual Breach Reporting Form (DOC)