Below are California's policies and information memoranda issued by the California Office of HIPAA Implementation (CalOHI).

The policies reflect laws at the time the policies were written and do not reflect changes due to HITECH, other federal law, or other state law changes.  Policies will be updated as needed. 

 

Quick Page Reference

CalOHI Policy Memoranda

CalOHI Information Memoranda

 

 

CalOHI Policy Memoranda Quick Links

• PM 2010-89: HIPAA 5010 Companion Guides
• PM2010-88: HIPAA Privacy, Security, Enforcement NPRM
• PM2010-87:  HIPAA-2 Implementation Plans
• PM2010-86:  Request for Information-HIPAA Privacy Rule Modifications for Accounting of Disclosures
• PM2009-84:  HIPAA-2 Statewide Awareness
• PM2009-83:  Implementation Guidelines for the federal interim final rule for Breach Notification Requirements for Unsecured Protected Health Information (PHI)
• PM 2009-82:  Interim Final Rule: Breach Notification for Unsecured Protected Health Information
• PM 2008-81: Modifications to Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards
• PM-2008-80: National Provider Identifier Contingency Period Ending
• 2006-77-Revised: Revised Security Incident Reporting
• PM 2006-79: NPI 101
• PM 2006-78: System for Interactive Reporting Changes
• PM 2006-77: Security Incident Reporting
• PM 2006-76: Notification Requirements for Health Plans
• PM 2005-75: Security Integrity
• PM 2005-74: Requirements for Group Health Plans
• PM 2005-73: Security Audit Controls
• PM 2005-72: System for Interactive Reporting
• PM 2005-71: Encryption
• PM 2005-70: Evaluation
• PM 2005-69: Workforce Security
• PM 2005-68: Access Administration
• PM 2005-67: Access Controls
• PM 2005-66: Workstation Use & Security
• PM 2005-65: Information Access Management
• PM 2005-64: Security Incident Procedures
• PM 2005-63: Facility Access Controls
• PM 2005-62: Contingency Planning
• PM 2005-61: Security Management Training
• PM 2005-60: Device and Media Controls
• PM 2005-59: Assigning Security Responsibility
• PM 2005-58: Security Sanction Policy
• PM 2005-57: Security Training
• PM 2005-56-S: Security Management Process Tools – Supplement
• PM 2005-56: Security Management Process
• PM 2005-55: Security Implementation Project Assessment
• PM 2005-54: Security Rule Organizational Requirements
• PM 2004-53: HIPAA Glossary - Transactions & Code Sets
• PM 2004-52: Unique Employer Identifier Number
• PM 2004-51: Administrative Simplification - Entity Status – Impacted Entities
• PM 2004-50: HIPAA Research Review Process
• PM 2004-49: Administrative Simplification - Entity Status - Covered Entity Arrangements
• PM 2004-48: Administrative Simplification - Entity Status - Health Plans & Clearinghouses
• PM 2004-47: Administrative Simplification - Entity Status - Business Associates
• PM 2004-46: HIPAA Glossary - Privacy
• PM 2004-45: Administrative Simplification - Entity Status - Health Care Providers
• PM 2004-44: Use & Disclosure - Research
• PM 2004-43: Security Rule Implementation
• PM 2004-42: Identification & Analysis of State Law – Unique Health Identifier Number
• PM 2004-41: Transactions & Code Sets Road Map
• PM 2004-40: Implementation Schedule for EIN, Security and NPI
• PM 2004-39: State Department Process to Coordinate Budgets, Contracts, and Freeze Exemptions
• PM 2004-38: IV&V, Oversight & Complaint Reporting
• PM 2004-37: Transactions & Code Sets Summary and Mapping Tools
• PM 2003-36: Administration of HIPAA - Privacy Policies, Procedures and Notices of Privacy Practices
• PM 2003-35: Use & Disclosure - Required by Law, Law Enforcement, Health & Safety, Minimum Necessary
• PM 2003-34: Privacy Staffing and Use & Disclosure - Government Functions and Underwriting
• PM 2003-33: Trading Partner Agreement Guide and Template
• PM 2003-32: Administration of HIPAA - Documentation, and Use & Disclosure - Verification of Identities, Judicial & Administrative Proceedings, Cadaveric Organ, Eye, and Tissue Donations, Fundraising, and Incidental Disclosures
• PM 2003-31: HIPAA Code Sets Road Map
• PM 2003-30: Identification & Analysis of State Law for Preemption of HIPAA Security and Electronic Transaction Standard
• PM 2003-29: Use & Disclosure - Required Disclosures, Opportunity to Agree or Object, Public Health Activities, Decedent-Coroners-Funeral Directors, Victims, Employers and HIPAA
• PM 2003-28: Use & Disclosure - Treatment, Payment & Health Care Operations, Health Oversight Activities, Research, Restricted Use & Disclosure, Accounting of Disclosures
• PM 2003-27: Use & Disclosure - Overview, Authorization, Psychotherapy Notes, Marketing
• PM 2003-26: CalOHI Legislation Review and Approval Process
• PM 2003-25: State Agency Requests for Preemption Determinations
• PM 2003-24: Preemption Analysis of the Patient Access to Health Records Act (PAHRA)
• PM 2003-23: Privacy Training Process
• PM 2003-22: Privacy Access Process
• PM 2003-21: Transactions & Code Sets Compliance Testing
• PM 2003-20: Communication Plan Tool
• PM 2003-19: Adoption of HIPAA-related Regulations
• PM 2003-18: Privacy Complaint Process
• PM 2002-17: Enactment of SB 1914 & CalOHI Implementation Plans & Procedures for Covered Entity State Departments
• PM 2002-16: Preemption Analysis of the Confidentiality of the Lanterman, Petris, Short Act (LPS)
• PM 2002-15: Business Associates
• PM 2002-14: Fiscal Quarterly Reporting
• PM 2002-13: Privacy Implementation
• PM 2002-12: Preemption Analysis of the Confidentiality of Medical Information Act (CMIA)
• PM 2002-11: HIPAA Implementation Plan
• PM 2002-10-R: Revised HIPAA Contract Procedure
• PM 2002-10: HIPAA Contract Procedure
• PM 2002-09: Communication Policy
• PM 2002-08: HIPAA Implementation Schedule
• PM 2002-07: Notice of Proposed Funding - For State Departments Only
• PM 2002-06: Preemption Analysis of the Information Practices Act and the California Public Records Act
• PM 2002-05: Potential Impacts of 2003/04 HIPAA Budget Reduction
• PM 2002-04: Extension Compliance Plan
• PM 2002-04: Addendum #1 - Extension Compliance Plan
• PM 2002-03: HIPAA Privacy Notice of Proposed Rulemaking (NPRM)
• PM 2002-02: Identification & HIPAA Preemption Analysis of State Law Relating to the Confidentiality and/or Privacy of Individually Identifiable Health Information
• PM 2002-01: Workgroup Product Approval Process

 

CalOHI Information Memoranda Quick Links

• IM 2010-17:  Federal Regulations Impact on HIPAA
• IM 2010-85:  HITECH Act impact to HIPAA Privacy and Security
• IM 2007-16: Glossary - Security & EIN
• IM 2007-15: NPI & Provider Taxonomy Codes
• IM 2006-14: NPI & Atypical Providers
• IM 2006-13: NPI & Subparts
• IM 2006-12: Business Associates
• IM 2005-11: HIPAA Code Set Standard
• IM 2004-10: HIPAA Reviews
• IM 2004-09: NPI Rule Summary and TCS Goals
• IM 2003-08: CalOHI Review for HIPAA Privacy Rule for State Departments
• IM 2003-07: Privacy Training
• IM 2002-06: Transaction Roadmap
• IM 2002-05: HIPAA Assessment Status - Report to the Legislature
• IM 2002-04: HIPAA Privacy State Law Baseline
• IM 2002-03: Courtesy Copies of CalOHI Requests for Identification and HIPAA Preemption Analysis of State Law Relating to the Confidentiality and/or Privacy of Individually Identifiable Health Information
• IM 2002-02: County Issues Sub-Workgroup Function & State Departments' Responsibilities
• IM 2002-01: Federal Extension of HIPAA TCS Regulations

 

 

CalOHI Policy Memoranda

PM2010-87 (Issue Date: 5/20/10)

PM 2010-89 (Issued Date:  12/20/10)

• 5010 Companion Guides

PM2010-88 (Issue Date: 7/30/10)

• HIPAA Privacy, Security, Enforcement NPRM
• Attachment 1:    HIPAA Privacy, Security, Enforcement NPRM - Summary/Comment Table

 

• HIPAA-2 Implementation Plans
• Attachment 1

 

PM2010-86 (Issue Date 5/6/10)

• Request for Information:  HIPAA Privacy Rule Modifications for Accounting of Disclosures
• Attachment - Accounting of Disclosures RFI

PM2009-84 (Issue Date:  12-3-09)

• HIPAA-2 Statewide Awareness

 

PM 2009-83 (Issue Date: 10/22/09)

• Implementation Guidelines for the federal interim final rule for Breach Notification Requirements for Unsecured Protected Health Information (PHI)
• White Paper:  2009-83: Implementation of federal interim final rule for Breach Notification Requirements for Unsecured PHI

  

PM 2009-82 (Issue Date:  9/1/09)

•  Interim Final Rule: Breach Notification for Unsecured Protected Health Information

 

2008-81 (Issue Date: 8-25-08)

• Modifications to Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards (105K-DOC)

PM 2008-80 (Issue Date: 5-21-08)

• National Provider Identifier Contingency Period Ending (DOC-102K)

PM 2006-77-Revised (Issue Date: 12-7-06)

• Revised Security Incident Reporting (DOC-114K)
• Exhibit 1 - Incident Reporting Form (DOC-254K)

PM 2006-79 (Issue Date: 5-19-06)

• NPI 101 (DOC-103K)
• Exhibit 1: NPI 101 (DOC-312K)
• Exhibit 2: NPI Provider Guide (PPT-645K)
• Exhibit 3: Background Document (DOC-105K)

2006-78 (Issue Date: 4-11-06)

• System for Interactive Reporting Changes(DOC-132KB)
• Attachment 1: SIR Changes (DOC-820KB)
• Exhibit 1: SIRs Instructions update (DOC-820KB)
• Exhibit 2: SIRs General update (DOC-437KB)
• Exhibit 3: SIRs Fiscal and IP update (DOC-1.3MB)
• Exhibit 4: SIRs Privacy update (DOC-462KB)
• Exhibit 5: SIRs TCS update (DOC-8MB)
• Exhibit 6: Unique Identifiers update (DOC-122KB)
• Exhibit 7: Security Request Access form (DOC-132KB)

2006-77 (Issue Date: 4-3-06)

• Security Incident Reporting (DOC-108K)
• HIPAA Supplemental Security Incident Report Form (DOC-250K)
• Background Document (DOC-199K)

2006-76 (Issue Date: 3-28-06)

• Notification Requirements for Health Plans (DOC-106K)

2005-75 (Issue Date: 10-28-05)

• Integrity (DOC- 135K)
• Download all 2005-75 Documents (ZIP - 2M)
• Exhibit 1: Chapter 16, Integrity (DOC - 2M)
• Exhibit 2: Factors for Selecting Integrity Safeguards (DOC - 125K)
• Exhibit 3: Electronic Protected Health Information Integrity Controls (DOC - 73K)
• Exhibit 4: Integrity Scope Checklist (DOC - 71K)
• Exhibit 5: Integrity Controls (DOC - 1M)
• Exhibit 6: Background Documents (DOC - 162K)

2005-74 (Issue Date: 7-22-05)

• Requirements for Group Health Plans (136K - DOC)
• Exhibit 1: Chapter 22, Requirements for Group Health Plans (342K - DOC)
• Exhibit 2: Requirement for Group Health Plans Background Document (130K - DOC)

2005-73 (Issue Date: 7-19-05)

• Audit Controls (137K - DOC)
• Exhibit 1: Chapter 15, Audit Controls (700K - DOC)
• Exhibit 2: Electronic Protected Health Information Audit Controls Checklist (80K - DOC)
• Exhibit 3: Audit Controls Background Documents (128K - DOC)

2005-72 (Issue Date: 7-12-05)

• System of Interactive Reporting (SIR) (125K - DOC)
• Exhibit 1: SIR Instructions (726K - DOC)
• Exhibit 2: General Input Screen Instructions (183K -DOC)
• Exhibit 3: Fiscal and Information Technology Input Screen Instructions (205K - DOC)
• Exhibit 4: Privacy Input Screen Instructions (184K -DOC)
• Exhibit 5: Transactions and Code Sets Input Screen Instructions (181K -DOC)
• Exhibit 6: Unique Identifiers: Employer Identifier Number Input Screen Instructions (89K- DOC)
• Exhibit 7: Security Access Request Form (105K- DOC)

2005-71 (Issue Date: 7-12-05)

• Encryption (168K - DOC)
• Download All 2005-71 Documents (1.2M - ZIP)
• Exhibit 1, Chapter 20, Encryption (1.5M - DOC)
• Exhibit 2, Encryption and Decryption Definitions (145K - DOC)
• Exhibit 3, Electronic Protected Health Information Encryption Survey Form (149K - DOC)
• Exhibit 4, Sample Encryption Policy (68K - DOC)
• Exhibit 5, Encryption Decision Tool (74K - DOC)
• Exhibit 6, Background Document (122K - DOC)

2005-70 (Issue Date: 6-21-05)

• Evaluation (205K - DOC)
• Exhibit 1, Chapters 19: Evaluation (369K - DOC)
• Exhibit 2, HIPAA Security Evaluation (192K - DOC)
• Exhibit 3, Evaluation Background Document (111K - DOC)

2005-69 (Issue Date: 6-13-05)

• Workforce Security (133K - DOC)
• Exhibit 1: Chapter 5, Workforce Security (746K - DOC)
• Exhibit 2: Sample Nondisclosure Agreement (62K - DOC)
• Exhibit 3: Sample Workforce Clearance Procedure (92K - DOC)
• Exhibit 4: Workforce Security Background Document (124K - DOC)

2005-68 (Issue Date: 6-13-05)

• Access Administration (137K - DOC)
• Exhibit 1: Chapter 17, Access Administration (985K - DOC)
• Exhibit 2: Staff Authorization and/or Supervision Tool (61K - DOC)
• Exhibit 3: Access Administration Background Document (130K - DOC)

2005-67 (Issue Date: 6-13-05)

• Access Controls (166K - DOC)
• Exhibit 1: Chapter 14, Access Controls (533K - DOC)
• Exhibit 2: Request for Information System Access (79K - DOC)
• Exhibit 3: Access Controls Background Document (85K - DOC)

2005-66 (Issue Date: 5-12-05)

• Workstation Use & Workstation Security (191K - DOC)
• Exhibit 1: Chapter 6, Workstation Use, and Chapter 7, Workstation Security (608K - DOC)
• Exhibit 2: Workstation Inventory (62K - DOC)
• Exhibit 3: Access Authorization Form (62K - DOC)
• Exhibit 4: Workstation Use & Security Background Document (106K - DOC)

2005-65 (Issue Date: 4-22-05)

• HIPAA Security Rule - Information Access Management (114K - DOC)
• Exhibit 1: Chapter 8, Information Access Management (504K - DOC)
• Exhibit 2: Master Access Record (65K - DOC)
• Exhibit 3: Chapter 8, Information Access Management Background Document (131K - DOC)
  

2005-64 (Issue Date:  4-14-05)

• HIPAA Security Rule - Security Incident Procedures (132K - DOC)
• Exhibit 1: Chapter 9, Security Incident Procedures (430K - DOC)
• Exhibit 2: Security Incident Report Form (97K - DOC)
• Exhibit 3: Chapter 9, Security Incident Procedures Background Document (211K - DOC)
  

2005-63 (Issue Date: 4-14-05)

• Facility Access Controls (137K - DOC)
• Exhibit 1: Chapter 12, Facility Access Controls (719K - DOC)
• Exhibit 2: Visitors Log (68K - DOC)
• Exhibit 3: Facility Maintenance Record (94K - DOC)
• Exhibit 4: Facility Access Controls Background Document (139K - DOC)

2005-62 (Issue Date: 4-13-05)

• HIPAA Security Rule - Contingency Plan (193K - DOC)
• Download All 2005-62 Documents (1.5M - ZIP)
• Exhibit 1: Chapter 11, Contingency Plan (1M - DOC)
• Exhibit 2: Appendix to Chapter 11, Contingency Plan (500K - DOC)
• Exhibit 3: Chapter 11, Contingency Plan Glossary (345K - DOC)
• Exhibit 4: Responsibilities of the Operations Recovery Management Teams (250K - DOC)
• Exhibit 5: Recovery Team Leaders and Alternates Roster (120K - DOC)
• Exhibit 6: Recovery Team Members Rosters (67K - DOC)
• Exhibit 7: Vendor Contact Form (121K - DOC)
• Exhibit 8: Operation Recovery Management Checklist (77K - DOC)
• Exhibit 9: Damage Assessment Checklist (149K - DOC)
• Exhibit 10: Physical Security Checklist (110K - DOC)
• Exhibit 11: Communications Checklist (66K - DOC)
• Exhibit 12: Hardware Installation Checklist (119K - DOC)
• Exhibit 13: IT Operations Team Checklist (85K - DOC)
• Exhibit 14: IT Technical Team Checklist (64K - DOC)
• Exhibit 15: Administration Checklist (72K - DOC)
• Exhibit 16: Disaster Procedures Form (73K - DOC)
• Exhibit 17: Alternate Site Cost Considerations Template (70K - DOC)
• Exhibit 18: Contingency Planning Tools (61K - DOC)
• Exhibit 19: Chapter 11, Contingency Plan Background Documents(354K - DOC)

2005-61 (Issue Date: 3-24-05)

• Security Management Training (109K - DOC)
• Download all 2005-61 Documents (3.1m - ZIP)
• Exhibit 1: Security Management Presentation (2M - PPT)
• Exhibit 2: Presentation Agenda (328K - DOC)
• Exhibit 3: Risk Analysis Team, Exercise #1 (645K - DOC)
• Exhibit 4: Risk Analysis Business Scenario, Exercise #2 (263K - DOC)
• Exhibit 5: Risk Management Team, Exercise #3 (658K - DOC)
• Exhibit 6: Risk Management Business Scenario, Exercise #4 (311K - DOC)
• Exhibit 7: Business Scenario Impact/Cost Sheet for Exercise #4 (101K - DOC)
• Exhibit 8: Facilitator's Guide (437K - DOC)
• Exhibit 9: Resources and Links (52K - DOC)

2005-60 (Issue Date 3-4-05)

• Device and Media Controls (103K - DOC)
• Exhibit 1: Chapter 13 - Device and Media Controls (336K - DOC)
• Exhibit 2: Inventory and Tracking Sheet (97K - DOC)
• Exhibit 3: Device Media Tracking Sheet (89K - DOC)
• Exhibit 4: Background Document (119K - DOC)

2005-59 (Issue Date: 2-25-05)

• Assigning Security Responsibility (108K - DOC)
• Exhibit 1: Chapter 3 - Assigning Security Responsibility (669K - DOC)
• Exhibit 2: HIPAA Security Official Roles and Responsibilities (62K - DOC)
• Exhibit 3: Background Document (108K - DOC)

2005-58 (Issue Date: 2-14-05)

• HIPAA Security Sanction Policy (169K - DOC)
• Exhibit 1: Chapter 23, Sanction Policy (421K - DOC)
• Exhibit 2: Sample Security and Confidentiality Acknowledgement Form (53K - DOC)
• Exhibit 3: Background Document (123K - DOC)

2005-57 (Issue Date: 2-11-05)

• HIPAA Security Training (134K - DOC)
• Download all 2005-57 Documents (2.1m - ZIP)
• Exhibit 1: Chapter 18 - Security Awareness and Training (445K - DOC)
• Exhibit 2: Sample Security and Confidentiality Acknowledgement (55K - DOC)
• Exhibit 3: Security Awareness Training PowerPoint Presentation (2M - PPT)
• Exhibit 4: NIST-Based HIPAA Security Training Matrix (89K - XLS)
• Exhibit 5: Security Awareness and Training Program User's Guide (455K - DOC)
• Exhibit 6: Security Awareness Brochure (42K - DOC)
• Exhibit 7: Background Document (106K - DOC)

2005-56-S(Issue Date: 2-18-05)

• Security Management Process Tools - Supplement (118K - DOC)
• Exhibit 14: Risk Determination Matrix (77K - DOC)
• Exhibit 15: Security Control Evaluation FOrm (DOC - 61K)
• Exhibit 16: Cost/Benefit Analysis Form (69K - XLS)
• Exhibit 17: Cost Implementation Plan Tracking (60K - DOC)
• Exhibit 18: Address Residual Risk Form (60K - DOC)

2005-56 (Issue Date: 2-10-05)

• HIPAA Security Rule - Security Management Process (154K - DOC)
• Download all 2005-56 Documents (2M - ZIP)
• Exhibit 1: Chapter 4 - Security Management Process (1M - DOC)
• Exhibit 2: Chapter 4 Appendix - Security Controls and Control Review Tools (665K - DOC)
• Exhibit 3: Sample Risk Analysis Summary Tool (135K - DOC)
• Exhibit 4: System Characterization (94K - DOC)
• Exhibit 5: Threat Identification (88K - DOC)
• Exhibit 6: Vulnerability Identification (90K - DOC)
• Exhibit 7: Security Control Gap Analysis (106K - DOC)
• Exhibit 8: Sample Completed Risk Analysis Tool (134K - DOC)
• Exhibit 9: Sample Risk Management Summary Tool (58K - DOC)
• Exhibit 10: Control Rating Form (94K - DOC)
• Exhibit 11: Control Review Tracking Form (78K - DOC)
• Exhibit 12: Security Management Process Terms and Definitions (94K - DOC)
• Exhibit 13: Background Document (305K - DOC)
• Exhibit 14: Risk Determination Matrix (77K - DOC)
• Exhibit 15: Security Control Evaluation FOrm (61K - DOC)
• Exhibit 16: Cost/Benefit Analysis Form (69K - XLS)
• Exhibit 17: Cost Implementation Plan Tracking (60K - DOC)
• Exhibit 18: Address Residual Risk Form (60K - DOC)

2005-55 (Issue Date: 1-7-05)

• HIPAA Security Implementation Project Assessment (141K - DOC)
• Exhibit 1- Instructions - Security Implementation Assessment (222K - DOC)
• Exhibits 2-5 - Possible Assignments, HIPAA Crosswalk to ISO Resources, HIPAA Crosswalk to NIST Resources (272K - XLS)

2005-54 (Issue Date: 1-4-04)

• HIPAA Security Rule Organizational Requirements (146K - DOC)
• Exhibit 1 - HIPAA Security Rule Work Plan (112K - DOC)
• Exhibit 2 - Chapter 21, Organizational Requirements - Policies and Procedures, and Documentation (282K - DOC)
• Exhibit 3 - Matrix of Standards and Implementation Specification Solutions List (104K - XLS)
• Exhibit 4 - Policies and Procedures, and Documentation Background Document (194K - DOC)

2004-53 (Issue Date: 11-23-04)

• HIPAA Glossary (110K - DOC)
• Transactions and Code Sets (TCS) Terms and Definitions (666K - DOC)

2004-52 (Issue Date: 11-18-04)

• Unique Employer Identifier Number (EIN) (108K - DOC)
• Exhibit 1 - Summary of the EIN (139K - DOC)
• Exhibit 2 - EIN Background Document (340K - DOC)

2004-51 (Issue Date: 10-18-04)

• HIPAA Administrative Simplification, Entity Status, Chapter 6, HIPAA Impacted Entities (277K - DOC)
• Exhibit - Entity Status, Chapter 6, HIPAA Impacted Entities (1M - DOC)

2004-50 (Issue Date: 9-28-04)

• HIPAA Research Review Process (111K - DOC)
• Commercial IRBs (52K - DOC)

2004-49 (Issue Date: 9-7-04)

• HIPAA Administrative Simplification, Entity Status, Chapter 5, Covered Entity Arrangements (106K - DOC)
• Download all 2004-49 Documents (1.3M - ZIP)
• Exhibit 1 - Entity Status, Chapter 5, Covered Entity Arrangements (1.5M - DOC)
• Exhibit 2 - Affiliated Entity Background Document (100K - DOC)
• Exhibit 3 - Hybrid Organizations Background Document (130K - DOC)
• Exhibit 4 - Multiple Covered Function Entity Background Document (59K - DOC)
• Exhibit 5 - Organized Health Care Arrangement Background Document (77K - DOC)

2004-48 (Issue Date: 7-13-04)

• HIPAA Administrative Simplification, Entity Status-Chapter 2, Health Plans and Chapter 3, Health Care Clearinghouses (116K - DOC)
• Exhibit 1: Entity Status, Chapter 2, Health Plans (835K - DOC)
• Exhibit 2: Health Plan Background Document (669K - DOC)
• Exhibit 3: Entity Status, Chapter 3, Health Care Clearinghouses (514K - DOC)
• Exhibit 4: Health Care Clearinghouses Background Document (215K - DOC)

2004-47 (Issue Date: 7-6-04)

• HIPAA Administrative Simplification, Entity Status-Chapter 4, Business Associates (102K - DOC)
• Exhibit 1: Business Associate (2.2M - DOC)
• Exhibit 2: Business Associate Background Document (701K - DOC)

2004-46 (Issue Date: 6-29-04)

• HIPAA Glossary (104K - DOC)
• Exhibit 1: General Glossary (603K - DOC)
• Exhibit 2: Privacy Terms (968K - DOC)

2004-45 (Issue Date: 5-26-04)

• HIPAA Administrative Simplification - Entity Status, Health Care Providers (103K - DOC)
• Exhibit 1: Entity Status Chapter 1, Health Care Providers (588K - DOC)
• Exhibit 2: Provider Entity Status Background Documents (374K - DOC)

2004-44 (Issue Date: 5-7-04)

• HIPAA Privacy - Use and Disclosure of Protected Health Information (PHI) - Research Training Tool (99K - DOC)
• Exhibit 1: Health Care Research Under HIPAA Rules (314K - PPT)

2004-43 (Issue Date: 5-7-04)

• HIPAA Security Rule Implementation (141K - DOC)
• Download all 2004-43 Documents (588K - ZIP)
• Exhibit 1: Security Implementation Workplan (101K - DOC)
• Exhibit 2: Summary of the Final Rule (116K - DOC)
• Exhibit 3: Guidelines for Security Tools/Templates Use - Mapping the Flow of EPHI and Gap Analysis of Business Practices (91K - DOC)
• Exhibit 3A: HIPAA Security Questionnaire (120K - DOC)
• Exhibit 3B: Data Flow Questionnaire on EPHI (96K - DOC)
• Exhibit 3C: Overview of EPHI Flow Within An Organization (57K - XLS)
• Exhibit 3D: Gap Analysis of HIPAA Security Business Practices
  
• Exhibit 3E: Business Associate Agreement Gap Analysis (107K - XLS)
• Exhibit 4: Baseline Security Requirements (119K - DOC)

2004-42 (Issue Date: 3-24-04)

• Identification and Analysis of State Law for Preemption by HIPAA: Unique Health Identifier for Health Care Providers Standards (103K - DOC)

2004-41 (Issue Date: 3-24-04)

• California HIPAA Transactions and Code Sets (TCS) Change Request Road Map (109K - DOC)
• Exhibit: HIPAA Transactions & Code Sets Change Request Road Map (181K - DOC)

2004-40 (Issue Date: 3-22-04)

• HIPAA Implementation Schedules for the Employer Identifier Number (EIN), Security, and National Provider Identifier (NPI) Rules (113K - DOC)
• Exhibit 1: HIPAA Employer Identifier Number (EIN) Implementation Schedule (62K - XLS)
• Exhibit 2: HIPAA Security Implementation Schedule (71K - XLS)
• Exhibit 3: HIPAA National Provider Identifier (NPI) Implementation Schedule (63K - XLS)

2004-39 (Issue Date: 2-27-04)

• Process for State Departments to Coordinate Budgets, Contracts, and Freeze Exemptions with CalOHI (128K - DOC)

2004-38 (Issue Date: 1-15-04)

• IV&V, Oversight, and Complaint Reporting (98K - DOC)

2004-37 (Issue Date: 01-07-04)

• TCS Summary & Mapping Tools (120K - DOC)
• Download all 2004-37 Documents (983K - ZIP)
• Exhibit 1: TCS Overview (162K - DOC)
• Exhibit A: Overview Background (197K - DOC)
• Exhibit 2 A-B: Mapping Tools #270, #271 (934K - XLS)
• Exhibit C-D: Mapping Tools #276, #277 (247K - XLS)
• Exhibit E-F: Mapping Tool #278, Request-Response (306K - XLS)
• Exhibit G: Mapping Tool #820 (101K - XLS)
• Exhibit H: Mapping Tool #834 (148K - XLS)
• Exhibit I: Mapping Tool #835 (134K - XLS)
• Exhibit J-L: Mapping Tool #837 (487K - XLS)

2003-36 (Issue Date: 12-19-03)

• HIPAA Privacy - Administration of HIPAA - Chapter 3, Privacy Policies and Procedures and Chapter 4, Notices of Privacy Practices (118K - DOC)
• Download all 2003-36 Documents (2.1M - ZIP)
• Exhibit 1: Chapter 3 - Privacy Policies and Procedures (1.8M - DOC)
• Exhibit A: Decision Points for Privacy Policies and Procedures (315K - DOC)
• Exhibit B: Policies and Procedures Background Documents (100K - DOC)
• Exhibit 2: Chapter 4 - Notices of Privacy Practices (971K - DOC)
• Exhibit A: Notice of Privacy Practices Clauses (201K - DOC)
• Exhibit B: Notice of Privacy Practices Background Documents (297K - DOC)

2003-35 (Issue Date: 12-12-03)

• HIPAA Privacy - Use and Disclosure of Protected Health Information (PHI) - Chapters 10, 14, 18 and 26 (117K - DOC)
• Download all 2003-35 Documents (2.3M - ZIP)
• Exhibit 1: Chapter 10 - Required by Law (529K - DOC)
• Exhibit A: Required by Law Background (93K - DOC)
• Exhibit 2: Chapter 14 - Law Enforcement (1.1M - DOC)
• Exhibit A: Law Enforcement Background (286K - DOC)
• Exhibit 3: Chapter 18 - Health and Safety (381K - DOC)
• Exhibit A: Health & Saftey Background (149K - DOC)
• Exhibit 4: Chapter 26 - Minimum Necessary (1.4M - DOC)
• Exhibit A: Verification of Authority, Purpose, and Minimum Necessary Chart (156K - DOC)
• Exhibit B: Mandatory Requirements for Compliance (29K - DOC)
• Exhibit C: Minimum Necessary Background (169K - DOC)

2003-34 (Issue Date: 11-26-03)

• HIPAA Privacy - Use and Disclosure of Protected Health Information (PHI) - Chapters 19, 22, and 27 and Administration of HIPAA, Chapter 2, Staffing (118K - DOC)
• Download all 2003-34 Documents (1.5M - ZIP)
• Exhibit 1: Chapter 19 - Government Functions (1.1M - DOC)
• Exhibit A: Government Functions Background.doc (336K - DOC)
• Exhibit 2: Chapter 22 - Underwriting (385K - DOC)
• Exhibit A: Safeguards Background (150K - DOC)
• Exhibit 4: Chapter 2 - Staffing (415K - DOC)
• Exhibit A: Privacy Officer Roles and Responsibilities (28K - DOC)
• Exhibit B: Complaint Official Roles and Responsibilities (26K - DOC)
• Exhibit C: Reviewing Professional Roles and Responsibilities (31K - DOC)
• Exhibit D: Access Official Roles and Responsibilities (29K - DOC)
• Exhibit E: Use and Disclosure Contract Roles and Responsibilities (26K - DOC)
• Exhibit F: Staffing Background (97K - DOC)

2003-33 (Issue Date: 11-6-03)

• HIPAA Transactions & Code Sets Trading Partner Agreement Guide and Template (110K - DOC)
• Exhibit 1: Trading Partner Agreement Guide (147K - DOC)
• Exhibit 2: Trading Partner Agreement Sample Template (128K - DOC)
• Exhibit 3: Code of Federal Regulations Citations for Trading Partner Requirements (190K - DOC)

2003-32 (Issue Date: 11-3-03)

• HIPAA Privacy - Use and Disclosure of Protected Health Information (PHI) - Chapters 2, 6, 13, 16, 20, 25, and Administration of HIPAA Chapter 1 (118K - DOC)
• Download all 2003-32 Documents (3.5M - ZIP)
• Exhibit 1: Chapter 2 - Glossary (1.1M - DOC)
• Exhibit A: Glossary Background Documents (727K - DOC)
• Exhibit 2: Chapter 6 - Verification of Identity (1.3M - DOC)
• Exhibit A: Verification of Identity Background Documents (56K - DOC)
• Exhibit B: Verification of Identity, Authority, Purpose and Minimum Necessary Chart (134K - DOC)
• Exhibit 3: Chapter 13 - Judicial and Administrative Proceedings (710K - DOC)
• Exhibit A: Judicial and Administrative Proceedings Background Documents (187K - DOC)
• Exhibit 4: Chapter 16 - Cadaveric Organ, Eye, and Tissue Donations (197K - DOC)
• Exhibit A: Organ, Eye, and Tissue Donations Background Documents (55K - DOC)
• Exhibit 5: Chapter 20 - Fundraising (227K - DOC)
• Exhibit A: Fundraising Background Documents (66K - DOC)
• Exhibit 6: Chapter 25 - Incidental Disclosures (422K - DOC)
• Exhibit A: Incidental Disclosures Background Documents (123K - DOC)

ADMINISTRATION of HIPAA

• Exhibit 7: Chapter 1 - Documentation (871K - DOC)
• Exhibit A: Documentation Background Documents (264K - DOC)

2003-31 (Issue Date: 11-3-03)

• HIPAA Code Sets Road Map (103K - DOC)
• Exhibit 1: Code Sets Road Map (223K - DOC)

2003-30 (Issue Date: 10-1-03)

• Identification and Analysis of State Law for Preemption of HIPAA Security and Electronic Transaction Standards (102K - DOC)

2003-29 (Issue Date: 10-7-03)

• Use and Disclosure Chapters 8, 9, 11, 15, 21 & 23 (114K - DOC)
• Download all 2003-29 Documents (2.5M - ZIP)
• Exhibit 1: Chapter 8 - Required Disclosures (466K - DOC)
• Exhibit 1A - Background Document 93K - DOC)
• Exhibit 2: Chapter 9 - Opportunity to Agree or Object (622K - DOC)
• Exhibit 2A - Opportunity to Agree or Object Background (102K - DOC)
• Exhibit 3: Chapter 11 - Public Health Activities (491K - DOC)
• Exhibit 3A - Public Health Activities (154K - DOC)
• Exhibit 4: Chapter 15 - Decedent-Coroners-Funeral Directors (399K - DOC)
• Exhibit 4A - Decedent Background (85K - DOC)
• Exhibit 5: Chapter 21 - Victims (626K - DOC)
• Exhibit 5A - Victims Background (248K - DOC)
• Exhibit 6: Chapter 23 - Employers and HIPAA (1.1M - DOC)
• Exhibit 6A - Plan Sponsor Certification of Compliance (31K - DOC)
• Exhibit 6B - Employers Background (91K - DOC)
• Exhibit 6C - Group Health Plan Background (178K - DOC)
• Exhibit 6D - Plan Sponsor Background (164K - DOC)
• Exhibit 6E - Workers Compensation Background (152K - DOC)

2003-28 (Issue Date: 8-12-03)

• Use and Disclosure Chapters 7, 12, 17, 24 and 28 (110K - DOC)
• Download all 2003-28 Documents (3.5M - ZIP)
• Exhibit 1: Request for Disclosure of PHI Form (108K - DOC)
• Exhibit 2: Chapter 7 - Treatment, Payment and Health Care Operations (TPO) (1M - DOC)
• Exhibit 2A - Citations for Treatment, Payment and Health Care Operations (56K - DOC)
• Exhibit 2B - Documents Relied on for Treatment Activities (364K - DOC)
• Exhibit 2C - Documents Relied on for Payment Activities (346K - DOC)
• Exhibit 2D - Documents Relied on for Health Care Operations Activities (261K - DOC)
• Exhibit 3: Chapter 12 - Health Oversight Activities (513K - DOC)
• Exhibit 3A - Documents Relied on for Health Care Oversight Agencies and Activities (230K - DOC)
• Exhibit 4: Chapter 17 - Research (1M - DOC)
• Exhibit 4A - Data Use Agreement for Limited Data Sets (99K - DOC)
• Exhibit 4B - Requirements for IRB/Privacy Board (64K - DOC)
• Exhibit 4C - Sample Side-by-Side Checklists for IRBs/Privacy Boards (68K - DOC)
• Exhibit 4D - Documents Relied on for Research (397K - DOC)
• Exhibit 5: Chapter 24 - Restricted Use and Disclsoure (455K - DOC)
• Exhibit 5A - Request for Restrictions Form (88K - DOC)
• Exhibit 5B - Background Documents for Restricted Use and Disclosure of PHI (158K - DOC)
• Exhibit 6: Chapter 28 - Accounting of Disclosures (578K - DOC)
• Exhibit 6A - Accounting of Disclosures of PHI Form (107K - DOC)
• Exhibit 6B - Request for Accounting of Disclosures Form (100K - DOC)
• Exhibit 6C - Request for Suspension of Accounting of Disclosures (88K - DOC)
• Exhibit 6D - Documents Relied on for Accounting of Disclosures of PHI (198K - DOC)

2003-27 (Issue Date: 5-14-03)

• Use and Disclosure (103K - DOC)
• Chapter 1 - Exhibit 1: Use and Disclosure Overview (367K - DOC)
• Chapter 1 - Exhibit 1: Overview Citations (85K - DOC)
• Chapter 3 - Exhibit 2: Authorization Process (724K - DOC)
• Chapter 3 - Exhibit 2A: Authorization Citations (47K - DOC)
• Chapter 3 - Exhibit 2B: Authorization Release Form (97K - DOC)
• Chapter 3 - Exhibit 2C: Notice of Privacy Practices Language (76K - DOC)
• Chapter 4 - Exhibit 3: Psychotherapy Notes (371K - DOC)
• Chapter 4 - Exhibit 3: Psychotherapy Citations (26K - DOC)
• Chapter 5 - Exhibit 4: Marketing (324K - DOC)
• Chapter 5 - Exhibit 4: Citations-Marketing (26K - DOC)

2003-26 (Issue Date: 4-25-03)

• CalOHI Legislation Review and Approval Process (124K - DOC)

2003-25 (Issue Date: 3-25-03)

• State Agency Requests for Preemption Determinations (126K - DOC)

2003-24 (Issue Date: 3-7-03)

• Preemption Analyses of the Patient Access to Health Records Act (PAHRA) (105K - DOC)

2003-23 (Issue Date: 3-5-03)

• Privacy Training Process (122K - DOC)
• Exhibit 1: Training Overview (94K - DOC)
• Exhibit 2: Training Process (587K - PDF)
• Exhibit 3: Sanctions Process (257K - DOC)
• Exhibit 4: Basic HIPAA Privacy Training (19M - PPT)
• Exhibit 5: Instructions and Conversion Tool (715K - DOC)
• Exhibit 6: Glossary (86K - XLS)
• Exhibit 7: Acknowledgement (86K - DOC)
• Exhibit 8: Certificate of Attendance (79K - DOC)
• Exhibit 9: Tracking Attendance Form (123K - DOC)
• Exhibit 10: Law Citations (143K - DOC)

2003-22 (Issue Date: 2-24-03)

• HIPAA Privacy Access Process (109K - DOC)
• Exhibit 1: Access Overview (91K - DOC)
• Exhibit 2: Access Process (813K - DOC)
• Exhibit 3: Sample Decision Tool (104K - DOC)
• Exhibit 4a: Access Process Request Form.doc (149K - DOC)
• Exhibit 4b: Access Process Log (17K - XLS)
• Exhibit 5: Access Denial Form Letter (38K - DOC)
• Exhibit 6a: Amendment Request (120K - DOC)
• Exhibit 6b: Amendment Process Log (73K - XLS)
• Exhibit 7: Amendment Denial Form Letter (39K - DOC)
• Exhibit 8: Access Officer Responsibilities (88K - DOC)
• Exhibit 9: Access Notice of Privacy Practices (85K - DOC)
• Exhibit 10: Access Code of Federal Regulations (CFR) Citations (150K - DOC)

2003-21 (Issue Date: 2-7-03)

• HIPAA Transactions and Code Set Compliance Testing (123K - DOC)

2003-20 (Issue Date: 1-30-03)

• Communication Plan Tools (103K - DOC)
• Policy Memo, Communication Plan Tools (164K - DOC)

2003-19 (Issue Date: 1-30-03)

• Adoption of HIPAA-Related Regulations (103K - DOC)

2003-18, (Issue Date: 1-14-03)

• HIPAA Privacy Complaint Process Templates (109K - DOC)
• Exhibit 1: HIPAA Privacy Complaint Process Templates Overview (68K - DOC)
• Exhibit 2: HIPAA Privacy Complaint Process (375K - DOC)
• Exhibit 3: HIPAA Privacy Complaints - Allowable Uses/Disclosures of PHI (80K - DOC)
• Exhibit 4: Health and Medical Information, HIPAA Privacy Complaint Filing Form and Organization Tracking Form (111K - DOC)
• Exhibit 5: HIPAA Privacy Complaint Status Log (89K - DOC)
• Exhibit 6: Roles and Responsibilities - HIPAA Privacy Complaint Official (67K - DOC)
• Exhibit 7: Notice of Privacy Practices.HIPAA Privacy Complaint Paragraphs (67K - DOC)
• Exhibit 8: Code of Federal Regulations and State Law, Citations for HIPAA Privacy Complaints (68K - DOC)

2002-17 (Issue Date: 12-26-02)

• Enactment of S.B. 1914 (Health & Safety Code Section 130311.5) and CalOHI Implementation Plans and Procedures for Covered Entity Departments (134K - DOC)
• Attachment 1 (24K - DOC)
• Attachment 2 (81K - XLS)

2002-16 (Issue Date: 12-20-02)

• Preemption Analysis of the Confidentiality of the Lanterman, Petris, Short Act (LPS) (105K - DOC)

2002-15 (Issue Date: 12-9-02)

This policy memorandum is currently under review due to changes as a result of the HITECH Act.  Check back for updates.

• Business Associate Templates (108K - DOC)
• Exhibit 1: Business Associate Tool Overview (22K - DOC)
• Exhibit 2: Business Associate Decision Tree (59K - DOC)
• Exhibit 3: Contract Timeline (18K - XLS)
• Exhibit 4: Business Associate Agreement Annotated Adendum Items (46K - DOC)
• Exhibit 5: Regulation Citations for Business Associate Requirements (47K - DOC)

2002-14 (Issue Date: 12-6-02)

• Fiscal Quarterly Report (130K - DOC)
• Fiscal Quarterly Report Template (101K - DOC)

2002-13 (Issue Date: 11-19-2002)

• Privacy Implementation (121K - DOC)
• Exhibit 1: Privacy Tools Workplan (62K - XLS)
• Exhibit 2: HIPAA Privacy Map & Gap Instructions (86K - DOC)
• Exhibit 3: Organizational Questionnaire (96K - DOC)
• Exhibit 4: Data Flow Questionnaire (115K - DOC)
• Exhibit 5: Overview of PHI Flow (57K - XLS)
• Exhibits 6-8: Gap Analysis Templates (127K - XLS)
• Exhibits 9-10: Samples (133K - XLS)

2002-12 (Issue Date: 11-7-2002)

• Preemption Analyses of the Confidentiality of Medical Information Act (CMIA) (133K - PDF)

2002-11 (Issue Date: 10-25-02)

• HIPAA Implementation Plan (160K - PDF)

2002-10 (Issue Date: 11-15-02)

• Revised HIPAA Contract Procedures Policy Memorandum (179K - PDF)

2002-10 (Issue Date: 10-18-02)

• HIPAA Contract Procedures Policy Memorandum (167K - PDF)

2002-09 (Issue Date: 10-2-02)

• Communication Policy Memorandum (135K - PDF)
• Policy Memo (68K - DOC)

2002-08 (Issue Date: 9-25-02)

• HIPAA Implementation Schedule (167K - PDF)
• Policy Memo, General Implementation Schedule (63K - XLS)
• Policy Memo, Privacy Implementation Schedule (77K - XLS)
• Policy Memo, Transaction and Code Sets Implementation Schedule (68K - XLS)
• Policy Memo, Department Liaison Assignments (88K - PDF)

2002-07 (Issue Date:9-6-02)

• Notice of Proposed Funding (162K - PDF) - For State Departments Only
• Policy Memo, Application for HIPAA Assessment Funds (26K - DOC) - For State Departments Only

2002-06 (Issue Date: 9-13-02)

• Preemption Analyses of the Information Practices Act and the California Public Records Act (148K - PDF)

2002-05 (Issue Date: 9-5-02)

• Potential Impact of 2003-04 HIPAA Budget Reduction (157K - PDF)

2002-04 (Issue Date: 4-19-02)

• Extension Compliance Plan for Electronic and Code Sets Standards (133K - PDF)

2002-04 (Issue Date: 8-23-02)

• Addendum #1: Extension Compliance Plan for Electronic and Code Sets Standards (151K - PDF)

2002-03 (Issue Date: 4-3-02)

• Health Insurance Portability and Accountability Act (HIPAA) Privacy Notice of Proposed Rulemaking (NPRM) (132K - PDF)

2002-02 (Issue Date: 1-23-02)

• Identification and HIPAA Preemption Analysis of State Law Relating to the Confidentiality and/or Privacy of Individually Identifiable Health Information (113K - PDF)

2002-01 (Issue Date: 1-23-02)

• Workgroup Product Approval Process (146K - PDF)

 

CalOHI Information Memoranda

2010-17 (Issue Date: 6/9/10)

• Federal Regulations Impact on HIPAA
• Attachment 1: Diagram of Legislative/Regulatory Initatives

 

2010-85 Issue Date (2/22/10)

• HITECH Act impact to HIPAA Privacy and Security (PDF)
• Background Document (PDF)

IM 2007-16 (Issue Date: 7/9/07)

• HIPAA Glossary (DOC-110K)
• Exhibit 1: Security Glossary (DOC-2M)
• Exhibit 2: EIN Glossary (110K)

IM 2007-15 (Issue Date: 6/20/07)

• NPI and Provider Taxonomy Codes (DOC-74K)
• Exhibit 1: NPI and Provider Taxonomy Codes (DOC-476K)
• Exhibit 2: Background Document (DOC-72K)

IM 2006-14 (Issue Date: 12-7-06)

• NPI and Atypical Providers (DOC-99K)
• Exhibit 1 - NPI Atypical Providers (DOC-482K)
• Exhibit 2 - Background Document (DOC-73K)

2006-13 (Issue Date: 8-30-06)

• NPI and Subparts (DOC-104K)
• Exhibit 1: NPI Subparts (DOC-2M)
• Exhibit 2: Subparts Background Document (DOC-112K)

2006-12 (Issue Date: 7-21-06)

• Exhibit 1: Business Associate White Paper (158K - DOC)
• Exhibit 2: Questions to External Entities (367K - DOC)
• Exhibit 3: Background Document (100K - DOC)

2005-11 (Issue Date: 3-24-05)

• HIPAA Code Set Standards (99K - DOC)
• Code Set Standards Attachment (64K - DOC)

2004-10 (Issue Date: 12-29-04)

• HIPAA Reviews (128KB - DOC)

2004-09 (Issue Date: 3-10-04)

• National Provider Identifier (NPI) Rule Summary and TCS Goals (104K - DOC)
• Summary of the Final HIPAA National Provider Identifier (NPI) Rule (92K - DOC)
• CalOHI Transactions and Code Sets (TCS) Goals (84K - DOC)

2003-08 (Issue Date: 3-3-03)

• CalOHI Program Review for the HIPAA Privacy Rule for State Departments (154K - DOC)

2003-07 (Issue Date: 2-7-03)

• HIPAA Privacy Training (95K - DOC)
• Train the Trainer - Basic HIPAA Privacy Training Announcement (66K - PDF)

2002-06 (Issue Date: 12-6-02)

• Transaction Roadmap (102K - DOC)
• Attachment (148K - DOC)

2002-05 (Issue Date: 10-18-02)

• HIPAA Assessment Status - Report to the Legislature (117K - PDF)

2002-04 (Issue Date: 8-16-02)

• HIPAA Privacy State Law Baseline (179K - PDF)
• Information Memo, HIPAA Privacy State Law Baseline Worksheet (234K - XLS)

2002-03 (Issue Date: 1-28-02)

• Courtesy Copies of CalOHI Requests for Identification and HIPAA Preemption Analysis of State Law Relating to the Confidentiality and/or Privacy of Individually Identifiable Health Information (84K - PDF)

2002-02 (Issue Date: 3-8-02)

• County Issues Sub-Workgroup Function and State Departments' Responsibilities (119K - PDF)

2002-01 (Issue Date: 1-23-02)

• Federal Extension of HIPAA Transactions and Code Sets Regulations (100K - PDF)