Colorado medical records laws

How Colorado differs from federal HIPAA

• Inspection of records must be free.
• Patient copy fees track HIPAA's cost-based rule; the statute's dollar schedule applies to third-party requests.
• Hospitals must keep records 10 years after the most recent discharge; minors until at least age 28.
• No state day-count deadline — HIPAA's 30 days applies.

How long a provider has to respond

Colorado requires access 'at reasonable times and upon reasonable notice' but sets no day count, so HIPAA applies: 30 days, with one 30-day extension if the provider tells you in writing.(C.R.S. § 25-1-801, C.R.S. § 25-1-802, 45 CFR § 164.524)

Under 45 CFR § 164.524, a provider may take one 30-day extension only if it tells you in writing, within the first 30 days, why and when you will get the records.

What a provider can charge

Colorado facilities and providers must give patients copies upon payment of the fee HIPAA allows (a reasonable cost-based fee), and may not charge for inspecting records. The statute's dollar schedule ($18.53 for the first 10 pages, $0.85/page for the next 30, $0.57/page after, $1.50/page microfilm, $10 certification) applies to 'reasonable fees' for third-party requests, not to patients' own requests.(C.R.S. § 25-1-801, C.R.S. § 25-1-802, 45 CFR § 164.524)

Paper copies

Patients pay the HIPAA cost-based fee; no state per-page amount for patients

Electronic copies

Must be provided electronically on request if originals are electronic and readily producible; only actual electronic media costs

When copies are free

Inspection is always free. One free copy to an entity acting under the Laura Hershey Disability Support Act for a benefit application, appeal or reapplication.

A provider cannot refuse to give you your records because you owe money for treatment. Compare every state on the medical records fees by state page.

How long records must be kept

• General hospitals: Adults: 10 years after the most recent discharge/patient usage. Minors: the period of minority plus 10 years (until age 28) or 10 years after most recent usage, whichever is later.(6 CCR 1011-1, Chapter 4, Part 10 (§ 10.6))

Minors and sensitive records

• Minors: Colorado providers are not required to release records about a minor's sexually transmitted infection, substance use disorder, or drug-use treatment to a parent or guardian; the minor or the minor's designated representative is not limited. Hospital records of minors are kept until at least age 28.(C.R.S. § 25-1-801, C.R.S. § 25-1-802, 6 CCR 1011-1, Chapter 4, Part 10 (§ 10.6))
• mental health: A summary of mental health records may be provided to the patient or personal representative after treatment ends, on written request with a signed, dated authorization.(C.R.S. § 25-1-801, C.R.S. § 25-1-802)
• substance use: Records of substance use disorder treatment (and STI records) of minors need not be released to parents or guardians.(C.R.S. § 25-1-801, C.R.S. § 25-1-802)

If a provider doesn't comply

Complaints about licensed health professionals go to DORA's Division of Professions and Occupations.(Colorado DORA Division of Professions and Occupations — File a Complaint)

• Colorado DORA, Division of Professions and Occupations (incl. Colorado Medical Board)

  licensed health professionals · 303-894-7800

• HHS Office for Civil Rights

  HIPAA violations by any covered entity, within 180 days

How to request your records in Colorado

1. Ask the provider's medical records (health information) department for its request form, or write your own request with your name, date of birth, dates of care, the records you want, and the format (paper or electronic).
2. Keep a copy and note the date — the 30 days (HIPAA) clock runs from when the provider receives it.
3. If the deadline passes or the bill exceeds the rules above, use the complaint routes on this page.

Templates and step-by-step help are on the records-access hub. Find a Colorado hospital's records office, or browse hospitals in Colorado.

Common questions about Colorado medical records