Colorado records retention requirements start with a three-year default under CRS 6-17-104, but that floor gives way whenever a more specific state statute, agency regulation, or federal law applies. Healthcare records run at least ten years. Real estate transaction files run four. Payroll records run three under federal law, OSHA logs run five, and certain tax records can run indefinitely. The right retention period depends on what the record is, who created it, and which regulator has jurisdiction.
The Three-Year Default Rule
When a Colorado state or local law requires you to create or keep a record but says nothing about how long, CRS 6-17-104 fills the gap: three years from the date the record was created, after which destruction is permitted.1Colorado Public Law. Colorado Revised Statutes 6-17-104 – Records Retention Period This is a catch-all. Any record category with its own statutory or regulatory schedule follows that specific rule instead. Treat three years as the floor for unregulated records and always check whether a longer period applies before destroying anything.
Retention Periods by Record Type
Federal Tax Records
Every Colorado business also answers to the IRS, whose recordkeeping rules operate independently of state law. The general rule is three years from the filing date, but several situations extend it.2Internal Revenue Service. How Long Should I Keep Records?
- Standard returns: three years from the filing date.
- Underreported income exceeding 25% of gross income: six years from the filing date.
- Bad debt deductions or worthless securities: seven years from the filing date.
- Employment tax records: at least four years after the tax becomes due or is paid, whichever is later.
- Unfiled or fraudulent returns: keep records indefinitely. No statute of limitations applies.
For business property like equipment or real estate, keep records supporting your cost basis, depreciation, and improvements for as long as you own the asset, plus at least three years after you report its sale. Seven years after disposition is a comfortable margin against the longer audit windows.3Internal Revenue Service. Topic No. 305, Recordkeeping
Employment and Workplace Records
Federal equal employment rules require personnel and employment records to be kept for at least one year. Involuntarily terminated employees’ records must be kept for one year from the termination date. If an EEOC charge is filed, related investigation records must be preserved until final disposition, including any resulting lawsuit.4U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
The Fair Labor Standards Act requires payroll records, collective bargaining agreements, and sales and purchase records to be preserved for at least three years.5U.S. Department of Labor. Fact Sheet #21: Recordkeeping Requirements Under the Fair Labor Standards Act (FLSA) OSHA runs on its own clock. The 300 Log, annual summary, and 301 Incident Report forms must be saved for five years after the end of the calendar year they cover, and employers must update stored logs during that window to reflect newly discovered injuries or reclassifications.6Occupational Safety and Health Administration. Retention and Updating
Healthcare Records
Colorado Department of Public Health and Environment regulations require healthcare facilities to preserve medical records for at least ten years after the most recent patient care usage. For minors, the period is the period of minority plus ten years. A record for a five-year-old patient must be kept until that patient turns 28.7Legal Information Institute. 6 CCR 1011-1-20-7 – Health Information Management Records can be maintained in original form or on any technologically appropriate medium the department accepts. Dental providers work under a different regulation (3 CCR 709-1) with a seven-year retention period for adult patient records, which sometimes creates confusion about the general healthcare rule.
Financial Institution Records
Banks and credit unions operating in Colorado follow federal Bank Secrecy Act recordkeeping requirements. The BSA generally requires most covered records to be retained for at least five years, including records of credit extensions over $10,000 not secured by real property, and records of international transactions above that threshold.8FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements
Real Estate Transaction Files
Colorado real estate brokers and brokerage firms must retain transaction files for four years, measured from the closing date of the transaction or the expiration date of any listing contract that didn’t close. Files can be hard copy or electronic as long as they can be produced for inspection during the four-year window.9Division of Real Estate. Transaction File Requirements and Retention The required contents for sales files and property management files are set out in the Commission’s Transaction File Checklist.10Colorado Division of Real Estate. Transaction File Checklist Failure to maintain files for the full four years violates CRS 12-10-217 and can trigger discipline by the Colorado Real Estate Commission, up to and including license suspension or revocation.11Justia. Colorado Code 12-10-217 – Investigation
Electronic Records and Secure Disposal
Colorado’s Uniform Electronic Transactions Act gives electronic records the same legal weight as paper. Under CRS 24-71.3-112, an electronic record satisfies any legal requirement to retain a record so long as it accurately reflects the original information and remains accessible for later reference.12Justia. Colorado Code Title 24 Article 71.3 – Uniform Electronic Transactions Act The test is functional. You can pull it up and it matches the original. The statute doesn’t dictate encryption, backups, or storage format, though individual agencies can impose stricter technical requirements for records under their jurisdiction.
Disposal is regulated separately. CRS 6-1-713 requires any business or government entity that maintains documents containing personal identifying information to develop a written policy for destroying those documents when no longer needed, and the destruction must render the personal information unreadable.13Justia. Colorado Code 6-1-713 – Disposal of Personal Identifying Information – Policy – Definitions The obligation covers both paper and electronic records. Shredding, secure erasure, or physical destruction of storage media all satisfy the standard, provided the method actually makes the data indecipherable.
Litigation Holds Override Normal Schedules
Every retention schedule in this article pauses the moment your organization reasonably anticipates litigation. When a party knows or should have known that evidence is relevant to future or current litigation, routine document destruction has to stop and a litigation hold has to go into effect. The trigger doesn’t require a filed lawsuit. A threatening letter, an internal harassment complaint, or a regulatory investigation can all create the duty.
A hold means directing everyone in the organization who might have relevant material to stop deleting files, emails, and messages from any system. Destroying records after the duty attaches can bring court sanctions, adverse inference instructions telling the jury to assume the destroyed evidence would have hurt you, or dispositive rulings on the merits. Retention mistakes are most expensive here, because the consequences play out inside active litigation.
Government Records Under CORA
Public agencies operate under an additional layer. The Colorado Open Records Act requires most public records held by state and local government to be available for inspection.14Colorado Secretary of State. Colorado Open Records Act CORA itself doesn’t set a single retention timeline. Instead, the Colorado State Archives issues general retention and disposition schedules identifying which records have permanent value and setting timetables for disposing of the rest.15Colorado State Archives. State Agency Records Management
Schedule 40 covers general municipal administrative records, including charters, meeting minutes, and supporting documentation.16Colorado State Archives. Colorado Municipal Records Retention Schedule Schedule No. 7 sets minimum retention periods for accounting documents, budget files, and related financial records across state agencies.17Colorado State Archives. Colorado Records Management Manual Schedule No. 7 Financial Records Records not covered by an archivist’s schedule fall to each agency to schedule internally.
Penalties for Getting It Wrong
Consequences scale with the regulator. CORA violations sit on the lighter end: a willful and knowing violation is a misdemeanor punishable by a fine up to $100, up to 90 days in jail, or both, plus attorney fee awards to anyone who successfully challenges a records denial in court.18Colorado Secretary of State. Colorado Open Records Act Nineteen Frequently Asked Questions19Justia. Colorado Code 24-72-204
Consumer protection violations are considerably steeper. The Attorney General can pursue civil penalties up to $20,000 per violation under the Colorado Consumer Protection Act, with each affected consumer or transaction counted separately. Violations involving elderly consumers carry a maximum of $50,000 per violation.20Justia. Colorado Code 6-1-112 – Civil Penalties A disposal failure affecting a large customer database can multiply quickly.
Federal Bank Secrecy Act violations reach further still. Negligent violations draw a $500 civil penalty per incident, with a pattern of negligence raising that to $50,000. Willful civil penalties run to the greater of $25,000 or the transaction amount, capped at $100,000.21Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Criminal penalties for willful violations reach $250,000 and five years’ imprisonment, and if the violation is part of a pattern involving more than $100,000 in a 12-month period, the maximums jump to $500,000 and ten years.22Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties Industry regulators layer their own consequences on top, from CDPHE action against healthcare facilities to real estate license discipline for missing transaction files.