Colorado HIPAA Laws: Rights, Breach Notification, and Penalties

Colorado HIPAA laws combine the federal HIPAA rules every provider in the country must follow with several Colorado statutes that go further in specific areas. The most consequential difference is timing: Colorado requires notice to affected residents within 30 days of discovering a data breach, half the window federal law allows in some circumstances.¹ A single incident can draw enforcement from the HHS Office for Civil Rights and the Colorado Attorney General at the same time, with separate penalties on each track.

How Federal and Colorado Rules Fit Together

HIPAA sets a national floor for protecting health information. It applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates. Colorado adds state statutes on top of that floor, and when the two set different standards for the same obligation, the stricter rule controls.

Three Colorado laws do most of the extra work for healthcare organizations:

C.R.S. § 6-1-716, the breach notification statute, which requires notice to affected residents and sometimes the Attorney General within 30 days.²
C.R.S. § 6-1-713, the data disposal statute, which requires a written policy for destroying records containing personal information.³
The Colorado Privacy Act (C.R.S. § 6-1-1303 et seq.), a broader consumer privacy law enforced exclusively by the Attorney General.⁴

Because federal and state regulators enforce their own statutes separately, a Colorado healthcare organization can face federal fines from OCR and state penalties from the Attorney General for the same breach.

Colorado’s 30-Day Breach Notification Deadline

Under C.R.S. § 6-1-716, any entity holding computerized personal information about a Colorado resident must investigate suspected breaches promptly. If misuse is likely, the entity must notify affected individuals within 30 days of determining a breach occurred.² HIPAA permits up to 60 days in some situations, so the Colorado clock governs.¹

When a breach is reasonably believed to have affected 500 or more Colorado residents, the entity must also notify the Colorado Attorney General within that same 30-day window.² If the breach affects more than 1,000 residents, the entity must additionally notify all nationwide consumer reporting agencies with the anticipated notification date and the approximate number of people affected.

The Attorney General can bring an enforcement action for breach-notification failures, and the penalty exposure flows from Colorado’s general consumer protection framework. Under C.R.S. § 6-1-113, civil penalties can reach up to $20,000 per violation, and each affected consumer counts as a separate violation. When the victim is an elderly person, that cap rises to $50,000 per violation.⁵ These state penalties sit on top of any federal HIPAA fines for the same incident.

Patient Rights in Colorado

HIPAA gives you a core set of rights over your health information, and Colorado reinforces several of them. The practical rights you can actually use are access, amendment, accounting, and the right to request restrictions.

Access to Your Medical Records

You have the right to inspect and get copies of your protected health information from a provider’s designated record set. Under federal rules, the provider must act on your request within 30 days and can take only one 30-day extension, which requires a written explanation and a new expected response date.⁶

Colorado adds its own layer. C.R.S. § 25-1-802 prohibits providers from charging you anything just to inspect your records in person, and any fee for copies must comply with what HIPAA permits.⁷ HIPAA allows a reasonable cost-based fee for copies. Providers who prefer a simple option can charge a flat fee of up to $6.50 for electronic copies of electronically maintained records rather than calculating actual costs. That $6.50 figure is a convenience option, not a ceiling; providers who can justify higher actual costs may charge more.⁸ If you ask for records in electronic form and the provider maintains them electronically, Colorado law requires electronic delivery.

OCR actively enforces this right through its HIPAA Right of Access Initiative, which has produced settlements against providers who overcharge, delay, or refuse to hand over records, including small practices.⁹

Correcting Records

If you believe your records contain errors or omissions, you can ask the provider to amend them. The provider has 60 days to respond and can take one 30-day extension with a written explanation.¹⁰ A denial has to be in writing and has to explain why. You then have the right to submit a statement of disagreement that becomes part of the record.

Accounting of Disclosures and Restrictions

You can request an accounting of disclosures, a log of when and to whom your provider shared your health information outside routine treatment, payment, and operations. This surfaces disclosures to researchers, public health agencies, or law enforcement.

You can also ask a provider to restrict how your information is used or disclosed. Providers do not always have to agree. One case is mandatory: if you pay for a service entirely out of pocket and ask the provider not to share those records with your health plan, the provider must honor that restriction.

Penalties for Violations

Enforcement runs on three tracks that can all touch the same incident.

Federal Civil Penalties

HHS adjusts HIPAA civil penalties annually for inflation. The current tiers, based on level of fault, are:¹¹

No knowledge: $145 to $73,011 per violation, with an annual cap of $2,190,294 for identical violations.
Reasonable cause (not willful neglect): $1,461 to $73,011 per violation, same annual cap.
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, same annual cap.

The jump from the third tier to the fourth is where the real exposure lives: knowing about a problem and failing to fix it starts the minimum penalty at five times the ceiling of the lower tiers.

Federal Criminal Penalties

Individuals who knowingly obtain or disclose protected health information in violation of HIPAA face escalating criminal exposure:¹²

Basic knowing violation: up to $50,000 and one year in prison.
Under false pretenses: up to $100,000 and five years.
With intent to sell, transfer, or use the data for commercial advantage, personal gain, or malicious harm: up to $250,000 and ten years.

These cases typically involve employees snooping through records of acquaintances, selling patient data, or using stolen health information for identity theft. Prosecutions target individuals, not just organizations.

Colorado State Penalties

The Colorado Attorney General can bring civil actions for violations of the breach notification law and the data disposal law independent of any federal action. Penalties under Colorado’s consumer protection statutes reach $20,000 per violation per consumer, or $50,000 when the violation targets an elderly person.⁵ Because each affected consumer counts separately, a breach involving thousands of residents can produce substantial aggregate liability at the state level before federal fines are added. Both OCR and the Attorney General can also require corrective action plans: mandatory security upgrades, audits, and ongoing monitoring.

Business Associate Agreements

Any vendor, contractor, or subcontractor that creates, receives, maintains, or transmits protected health information on a covered entity’s behalf is a business associate and must sign a Business Associate Agreement before touching patient data. Under the HIPAA Omnibus Rule, business associates are directly liable for HIPAA violations and face civil and criminal penalties on their own.¹³

A compliant BAA has to spell out what the business associate can and cannot do with the data, require appropriate safeguards (including Security Rule compliance for electronic data), require reporting of any unauthorized use or disclosure, bind any subcontractor to the same restrictions, allow HHS access to internal practices and records for compliance reviews, and require return or destruction of all protected health information when the contract ends. The covered entity must also have the right to terminate for a material breach.

The subcontractor flow-down catches many organizations off guard. A billing company that hires a cloud storage provider, or a transcription service that uses freelance workers, has to ensure those downstream parties sign their own BAAs with the same protections. Contracts between business associates and their subcontractors are subject to the same requirements as the original agreement.¹³

Notice of Privacy Practices

Every covered healthcare provider with a direct treatment relationship must give patients a Notice of Privacy Practices no later than the first time services are delivered. In emergencies, the provider must hand it over as soon as reasonably possible afterward and make a good faith effort to get a written acknowledgment that the patient received it.¹⁴

A provider with a physical office must post the notice in a prominent location and make take-away copies available. A provider that maintains a website describing patient services must post the notice prominently there as well. Patients can agree to receive it by email, but if the provider learns the email delivery failed, it must send a paper copy. The notice itself must use plain language and include a specific header statement, examples of uses for treatment, payment, and operations, descriptions of disclosures that do not require authorization, descriptions of disclosures that do, and a plain statement of the patient’s rights to access, amend, and receive an accounting of disclosures.¹⁴

Risk Analysis, Training, and Data Disposal

Three ongoing obligations generate a large share of enforcement findings. The HIPAA Security Rule requires every covered entity and business associate to conduct an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of all electronic protected health information it handles.¹⁵ The analysis has to be updated when the environment changes meaningfully: new systems, new facilities, significant staff changes. Failure to maintain a current risk analysis is one of the most common findings in HHS enforcement actions.

Workforce training is a separate ongoing obligation. The Privacy Rule requires training on policies and procedures tailored to each person’s job function, with new employees trained within a reasonable period of joining and existing staff retrained whenever policies materially change. The Security Rule adds an ongoing security awareness program covering practical issues like suspicious emails, password hygiene, and signs of unauthorized access. Both covered entities and business associates have to meet the security training obligation.

Colorado’s data disposal statute, C.R.S. § 6-1-713, requires every entity holding paper or electronic documents containing personal identifying information to have a written destruction policy and to shred, erase, or otherwise render records unreadable when they are no longer needed.³ The written-policy requirement is what trips up smaller practices; occasional shredding is not enough. Improper disposal can produce penalties under both Colorado’s consumer protection statutes and HIPAA’s Privacy Rule.

Substance Use Disorder Records Are Different

If you treat or are treated for substance use disorder in Colorado, standard HIPAA is not the whole story. Records from SUD treatment programs carry an extra layer of protection under 42 CFR Part 2. A final rule aligning Part 2 more closely with HIPAA has a compliance deadline of February 16, 2026, but important differences remain.¹⁶

The most important: SUD treatment records cannot be used in any civil, criminal, administrative, or legislative proceeding against the patient without either specific written consent from the patient or a court order. A broad consent for treatment, payment, and healthcare operations does not authorize use in legal proceedings; consent for that purpose has to be obtained separately and cannot be bundled with any other consent.¹⁶ SUD counseling notes carry even tighter controls and require their own specific consent for any use or disclosure.

How to File a Complaint

If you believe a healthcare provider or other entity has violated your HIPAA rights, you can file complaints at both the federal and state level, and the two investigations proceed independently.

The HHS Office for Civil Rights handles federal HIPAA complaints. You can file online through the OCR Complaint Portal or submit by mail, fax, or email. The complaint has to identify the entity, describe what happened, and be filed within 180 days of when you learned about the violation. OCR can extend that deadline for good cause.¹⁷

For violations of Colorado’s breach notification or data disposal laws, you can file with the Attorney General’s office online or by calling 800-222-4444.¹⁸ Filing at both levels is often worth doing when a single incident involves both federal HIPAA failures and failures under Colorado’s privacy or breach statutes.

1
Colorado Attorney General. Colorado’s Consumer Data Protection Laws: FAQ’s for Businesses and Government Agencies
2
Justia Law. Colorado Code 6-1-716 – Notification of Security Breach
3
Justia Law. Colorado Code 6-1-713 – Disposal of Personal Identifying Information
4
Colorado Attorney General. Colorado’s Privacy Act (CPA)
5
Colorado General Assembly. Session Law Amending Civil Penalties Under Article 1
6
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
7
Justia Law. Colorado Code 25-1-802 – Patient Records
8
HHS.gov. $6.50 Flat Rate Option is Not a Cap on Fees
9
HHS.gov. OCR Settles Nineteenth Investigation in HIPAA Right of Access Initiative
10
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
12
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
13
HHS.gov. Sample Business Associate Agreement Provisions
14
eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information
15
HHS.gov. Guidance on Risk Analysis
16
HHS.gov. Fact Sheet 42 CFR Part 2 Final Rule
17
HHS.gov. How to File a Health Information Privacy or Security Complaint
18
Colorado Attorney General. Colorado’s Consumer Data Protection Laws: FAQ’s for Consumers