Colorado HIPAA Laws: Rights, Breach Notice, and Penalties

Health privacy in Colorado runs on two tracks at once: federal HIPAA sets a national floor, and Colorado law adds several statutes that go further in specific areas. The most visible difference is the breach notification window. Colorado HIPAA laws, taken together with the state’s consumer data protection statutes, require notice to affected residents within 30 days of discovering a breach, half the time HIPAA alone allows.¹ For providers, that means a single incident can draw enforcement from both HHS and the Colorado Attorney General. For patients, it means two sets of rights and two places to complain.

How Federal HIPAA and Colorado Law Fit Together

HIPAA applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates. It sets minimum standards for privacy, security, and breach notification. When Colorado law imposes a stricter obligation on the same subject, the stricter rule controls.

Colorado does not have a single omnibus health privacy act. The state’s requirements sit in several places:

C.R.S. § 6-1-716, the breach notification statute, which requires notice to affected residents and, in larger breaches, the Attorney General within 30 days.²
C.R.S. § 6-1-713, the data disposal statute, which requires written destruction policies for records containing personal information.³
The Colorado Privacy Act (C.R.S. § 6-1-1303 et seq.), a broader consumer data privacy law enforced exclusively by the Attorney General.⁴
C.R.S. § 25-1-802, which governs patient access to medical records.⁵

A Colorado provider that mishandles patient data can face parallel investigations by the HHS Office for Civil Rights and the Colorado Attorney General, with penalties from each running independently.

Colorado’s 30-Day Breach Notification Rule

This is where Colorado most clearly tightens the federal standard. Any entity that maintains computerized data containing personal information about a Colorado resident must investigate suspected breaches promptly, and if misuse of the information is likely, must notify affected individuals within 30 days of determining a breach occurred.² HIPAA allows up to 60 days in some circumstances; the shorter Colorado window controls.¹

When a breach is reasonably believed to have affected 500 or more Colorado residents, the entity must also notify the Colorado Attorney General within that same 30 days. If the breach affects more than 1,000 residents, the entity must additionally notify the nationwide consumer reporting agencies with the anticipated notification date and the approximate number of affected people.²

Failure to notify on time is itself a violation the Attorney General can pursue under the state’s consumer protection framework. Civil penalties under C.R.S. § 6-1-113 can reach $20,000 per violation, and each affected consumer counts as a separate violation. When the affected person is elderly, the cap rises to $50,000 per violation.⁶ These state penalties are separate from any HIPAA fines HHS may impose for the same incident.

Your Rights as a Patient

Getting Copies of Your Records

You have the right to inspect and obtain copies of your protected health information from any provider that holds it in a designated record set. Under federal rules, the provider must act on your request within 30 days and can take one 30-day extension only after giving you a written explanation of the delay and when to expect a response.⁷

Colorado adds that a provider cannot charge you anything to inspect records in person. For copies, the fee must comply with what HIPAA allows.⁵ HIPAA permits a reasonable, cost-based fee. Providers who want a simple option can charge a flat $6.50 for electronic copies of electronically maintained records rather than calculating actual costs. That figure is a convenience shortcut, not a ceiling; a provider who can document higher actual costs may charge more.⁸ If you request records in electronic format and the provider maintains them electronically, Colorado law requires electronic delivery.

OCR has been enforcing this right aggressively through its HIPAA Right of Access Initiative, settling investigations against providers who overcharge, delay, or refuse requests, sometimes involving small practices.⁹

Correcting Errors

If your records contain errors or omissions, you can ask the provider to amend them. The provider must respond within 60 days and can take one 30-day extension with a written explanation.¹⁰ A denial must be in writing and must explain the reasoning. You can then file a statement of disagreement that becomes part of your record.

Tracking and Restricting Disclosures

You can request an accounting of disclosures, showing when and to whom your provider shared your information outside of routine treatment, payment, and healthcare operations. You can also ask a provider to restrict how your information is used or shared. Providers generally are not required to agree, but there’s one situation where they must: if you pay for a service entirely out of pocket and ask that the record of that service not be shared with your health plan, the provider has to honor that request.

Penalties When the Rules Are Broken

Federal HIPAA penalties come in two flavors. Civil penalties are administered by HHS on a four-tier structure that turns on the entity’s level of culpability, from no knowledge of the violation at one end to willful neglect left uncorrected at the other. HHS adjusts the dollar amounts each year for inflation, and the tier for willful neglect that goes uncorrected within 30 days carries the highest per-violation minimum by a wide margin.¹¹

Criminal penalties are separate and target individuals as well as organizations. Knowingly obtaining or disclosing protected health information can bring up to $50,000 in fines and a year in prison; doing so under false pretenses raises the ceiling to $100,000 and five years; doing it to sell, transfer, or use the data for commercial gain or malicious harm raises it again to $250,000 and ten years.¹² These prosecutions typically involve employees who snoop, sell records, or use stolen data for identity theft.

Colorado penalties stack on top. The Attorney General can bring civil actions for violations of the breach notification and data disposal statutes, with per-violation caps of $20,000 (or $50,000 where an elderly person is involved) and each affected consumer treated as a separate violation.⁶ A breach affecting thousands of Coloradans can generate significant state liability before any federal penalty is calculated. Both HHS and the Attorney General can also require corrective action plans, security upgrades, audits, and ongoing monitoring.

Business Associate Agreements

Any vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a business associate and must sign a Business Associate Agreement (BAA) before touching that data. Since the HIPAA Omnibus Rule, business associates carry direct liability for HIPAA violations and can be fined or prosecuted on their own.¹³

A compliant BAA has to spell out several things: exactly what the business associate can and cannot do with the data; the safeguards it will implement, including compliance with the Security Rule for electronic data; a duty to report unauthorized uses and breaches of unsecured health information to the covered entity; the same protections flowing down to any subcontractor the business associate uses; HHS’s right of access to internal records for compliance reviews; and the return or destruction of all protected health information when the contract ends. The covered entity must have the right to terminate the agreement if the business associate materially violates it.

The subcontractor flow-down is where organizations often slip. A billing company that uses cloud storage, or a transcription service that farms work out to freelancers, has to get BAAs with those downstream parties on the same terms.¹³

Notice of Privacy Practices

Every covered provider with a direct treatment relationship must give patients a Notice of Privacy Practices no later than the first service delivery, or as soon as reasonably possible after an emergency. The provider must make a good faith effort to obtain a written acknowledgment of receipt.¹⁴

If the provider has a physical office, the notice has to be posted where patients can see it and available to take home. If the provider has a website that describes its services, the notice has to appear prominently there too. Patients can agree to email delivery, but if a delivery fails, a paper copy has to follow.

The notice itself has to be in plain language and describe, with examples, how the provider uses health information for treatment, payment, and healthcare operations; when it can share without authorization (such as public health reporting); which disclosures require written authorization; the patient’s right to revoke that authorization; and the patient’s rights to access, amend, and receive an accounting of disclosures.¹⁴

When Providers Can Share Without Your Authorization

The Minimum Necessary Rule

When a provider shares health information for purposes other than direct treatment, HIPAA generally requires disclosing only the minimum amount necessary. The rule applies to payment, healthcare operations, and most third-party requests. It does not apply to disclosures for treatment, on the recognition that clinicians often need a fuller picture, and it does not apply to disclosures required by law.¹⁵

Mandatory Reporting

Colorado requires reporting in situations including child abuse, certain infectious diseases, and other public health threats. Providers responding to a lawful reporting duty can disclose without patient authorization, and the minimum necessary standard doesn’t limit those disclosures.¹⁵

Research

Protected health information can be used for research with the patient’s written authorization, or under a waiver granted by an Institutional Review Board or Privacy Board that finds the research couldn’t practicably be done otherwise and that privacy risks are minimal.¹⁶ De-identified data, stripped of the 18 HIPAA identifiers, can be used for research without either.

Substance Use Disorder Records Are Stricter

Records from substance use disorder treatment programs get an extra layer of protection under 42 CFR Part 2. A final rule aligning Part 2 more closely with HIPAA carries a compliance deadline of February 16, 2026, but core differences remain.¹⁷

The most important one: SUD records cannot be used in any civil, criminal, administrative, or legislative proceeding against the patient without specific written consent from the patient or a court order. A broad treatment-payment-operations consent does not cover legal proceedings; that consent has to be separate and cannot be bundled with any other purpose.¹⁷ SUD counseling notes carry even tighter controls and require their own consent for any use or disclosure.

Data Disposal, Risk Analysis, and Training

Colorado’s disposal statute, C.R.S. § 6-1-713, requires every entity that maintains paper or electronic documents containing personal identifying information to have a written destruction policy and, when documents are no longer needed, to shred, erase, or otherwise render them unreadable.³ The written policy requirement catches smaller practices out. Occasional shredding is not enough. You need a documented policy, staff training on it, and a process ensuring third-party destruction vendors meet the same standard. Improper disposal can draw penalties from both the Attorney General under state law and HHS under HIPAA’s Privacy Rule.

The HIPAA Security Rule requires an accurate and thorough risk analysis covering all electronic protected health information the organization creates, receives, maintains, or transmits.¹⁸ It has to be updated whenever the environment changes significantly, including new systems, new facilities, or staff changes that alter access. A stale risk analysis is one of the most common findings in HHS enforcement actions.

Workforce training runs on parallel tracks. The Privacy Rule requires training all workforce members on protected health information policies, tailored to their job function, within a reasonable period of joining and again whenever policies materially change. The Security Rule adds an ongoing security awareness program covering things like suspicious emails, password protection, and detecting unauthorized access. Business associates carry the security training obligation too.

How to File a Complaint

You can complain at the federal level, the state level, or both. Federal complaints go to the HHS Office for Civil Rights through the OCR Complaint Portal, or by mail, fax, or email. The complaint must identify the entity, describe what happened, and be filed within 180 days of when you learned about the violation. OCR can extend that deadline for good cause.¹⁹

State complaints about Colorado’s breach notification or data disposal rules go to the Attorney General’s office online or by calling 800-222-4444.²⁰ The two investigations proceed independently, and filing at both levels is often worthwhile when one incident involves both federal and state failures.

1
Colorado Attorney General. Colorado’s Consumer Data Protection Laws: FAQ’s for Businesses and Government Agencies
2
Justia Law. Colorado Code 6-1-716 – Notification of Security Breach
3
Justia Law. Colorado Code 6-1-713 – Disposal of Personal Identifying Information
4
Colorado Attorney General. Colorado’s Privacy Act (CPA)
5
Justia Law. Colorado Code 25-1-802 – Patient Records
6
Colorado General Assembly. Session Law Amending Civil Penalties Under Article 1
7
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
8
HHS.gov. $6.50 Flat Rate Option is Not a Cap on Fees
9
HHS.gov. OCR Settles Nineteenth Investigation in HIPAA Right of Access Initiative
10
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
12
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
13
HHS.gov. Sample Business Associate Agreement Provisions
14
eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information
15
HHS.gov. Minimum Necessary Requirement
16
HHS.gov. Research
17
HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule
18
HHS.gov. Guidance on Risk Analysis
19
HHS.gov. How to File a Health Information Privacy or Security Complaint
20
Colorado Attorney General. Colorado’s Consumer Data Protection Laws: FAQ’s for Consumers