How to Fill Out and Submit a Colorado HIPAA Medical Release Form

A Colorado HIPAA release form is a written authorization that lets a healthcare provider share your protected health information with a person or organization you name. You fill it out, sign it, and deliver it to the provider that holds your records. Colorado Revised Statutes section 25-1-801 guarantees your right to inspect and copy your own medical records, and federal rules at 45 CFR 164.508 spell out exactly what a valid authorization must contain.¹ Most Colorado providers hand you their own version of the form, and the Colorado Department of Health Care Policy and Financing publishes downloadable authorization forms for Medicaid-related records.²

What the Form Must Contain

Federal law sets a floor for every HIPAA authorization, and Colorado providers follow it. Under 45 CFR 164.508, your form is valid only if it contains all six core elements below.¹

A description of the information to be released. Checking a box for “entire medical record” works, but you can also narrow the release to lab results, imaging, or visit notes from certain dates.
The name of the provider or facility releasing the records.
The name of the person, office, or organization receiving them, with an address or fax number.
The purpose of the disclosure. If you just want a copy for yourself, “at the request of the individual” is enough.
An expiration date or event. Without an endpoint, the form is invalid. A calendar date works, and so does a triggering event like “upon completion of my disability claim.”
Your signature and the date. If someone else signs for you, the form must describe that person’s legal authority to do so.

The form must also carry three notices: your right to revoke the authorization in writing, whether the provider can refuse treatment if you decline to sign, and a warning that the recipient may re-disclose the information and that HIPAA may no longer protect it once they do.¹ Preprinted forms from Colorado hospitals and clinics usually contain this language already. If you draft your own, a missing element voids the whole authorization.

Sensitive Records That Need a Different Form

A standard release does not automatically cover every kind of record. Certain categories carry heightened protections, and a blanket authorization will not reach them.

Psychotherapy Notes

Psychotherapy notes are the personal notes a therapist writes during or after a session and keeps separate from the rest of your chart. They get the strongest protection under HIPAA. A provider must obtain a standalone authorization specifically for psychotherapy notes, and it cannot be combined with an authorization for any other record.¹ If you want both your general medical file and your therapist’s session notes, expect to sign two forms.

Substance Use Disorder Records

Records from federally assisted substance use disorder treatment programs fall under 42 CFR Part 2, which imposes stricter consent requirements than HIPAA. A valid Part 2 consent must include the patient’s name, the specific information being disclosed, the name of each recipient, the purpose, an expiration date or event, notice of the right to revoke, and, where the recipient is a HIPAA-covered entity receiving records for treatment, payment, or healthcare operations, a statement that the information may be redisclosed under HIPAA but cannot be used in civil, criminal, administrative, or legislative proceedings against the patient.³ Many Colorado treatment programs use their own Part 2 consent form rather than a generic HIPAA release. Ask the program directly for the right document.

Mental Health and HIV Records

Colorado Revised Statutes section 25-1-801 addresses mental health records directly: a summary of records related to a patient’s mental health treatment may be made available to the patient or their personal representative, with a signed and dated written authorization, only after the treatment program has ended.⁴ Colorado also maintains confidentiality protections for HIV test results under its public health statutes. When filling out a release, look for separate checkboxes covering HIV/AIDS records, mental health treatment records, and genetic testing. Forms from providers like Kaiser Permanente and Children’s Hospital Colorado include these as opt-in selections because a general authorization does not automatically cover them.⁵

Who Can Sign for Someone Else

The patient is the default signer. Several situations allow another person to sign instead.

Personal Representatives and Power of Attorney

Under HIPAA, a personal representative is anyone who has authority under applicable law to make healthcare decisions for the patient, and that person gets the same right of access as the patient. If you hold a healthcare power of attorney that is currently in effect, you qualify and can sign the release.⁶ Some powers of attorney take effect immediately; others activate only when the patient loses capacity and go dormant again if capacity returns. Expect the provider to ask for a copy of the POA document.

Minors

For patients under 18, a parent or legal guardian normally signs. Colorado law carves out exceptions. Minors who are at least 15, living apart from their parents, and managing their own finances can consent to their own care and authorize the release of those records. Minors of any age can independently consent to care related to pregnancy, contraception, sexually transmitted infections, substance use disorder treatment, and mental health services, so records from those encounters may sit outside a parent’s control.

Deceased Patients

After a patient’s death, the personal representative of the estate, typically the executor or administrator, can sign. Someone who held a healthcare power of attorney before the patient died, or who received other written authorization from the patient, also qualifies. Anyone outside those categories will generally need a court order.

Submitting the Form and Getting Your Records

Deliver the signed authorization to the provider that holds the records. Most Colorado facilities accept it in person, by mail, by fax, or through a secure patient portal. In person and portal submissions tend to move fastest because the provider can verify your identity on the spot.

How Long the Provider Has to Respond

Federal law gives the provider up to 30 days after receiving your request to act on it, either by producing the records or by issuing a written denial that explains why. If the provider cannot meet that deadline, it may take a single 30-day extension, but only by sending you a written explanation and a new completion date before the original 30 days run out.⁷ No second extension is allowed. Delay beyond those limits is a potential HIPAA violation.

What the Provider Can Charge

Colorado Revised Statutes section 25-1-801 allows providers to charge the fees a covered entity may impose under HIPAA.⁴ Under the federal standard, those fees must be reasonable and cost-based and can cover only the labor to copy the records, supplies like paper or a CD, and postage if you asked for the records to be mailed. The provider cannot bill you for the time staff spent searching for and retrieving your file.⁷ If the records are electronic and you request an electronic copy, the fee is limited to labor for fulfilling the request. Ask for a cost estimate before copying begins.

Paper or Electronic

You can request paper or electronic records. If the provider maintains electronic health records, you have a right to receive an electronic copy in a readable format, and you can direct the provider to transmit the records electronically to a third party you choose. Electronic delivery is usually cheaper and faster.

Canceling an Authorization

You can revoke a signed authorization at any time, but the revocation has to be in writing. A phone call does not count. Deliver the written revocation to the same provider that received the original authorization. Once the provider receives it, no further disclosures may be made under the form. The cancellation does not reach backward. Anything the provider disclosed before receiving your revocation was lawful and cannot be recalled.⁸

When No Authorization Is Required

A signed release is not always necessary. The broadest exception covers treatment, payment, and healthcare operations. Your doctor can send records to a specialist treating you, share billing information with your insurer, or use your data internally for quality reviews without a signed authorization.⁹ Other no-authorization situations include reports required by law such as gunshot wounds and certain infectious diseases, disclosures to public health authorities, releases related to organ donation or workers’ compensation claims, and disclosures to law enforcement in response to a court order, warrant, or grand jury subpoena. These exceptions define the outer edge of what your authorization actually controls.

If a Provider Won’t Comply

If a Colorado provider ignores your authorization, misses the deadline, or discloses your information without proper authorization, you have two routes. File a written complaint with the provider’s privacy officer, which every HIPAA-covered entity is required to have. You can also file directly with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces HIPAA at the federal level and has settled enforcement actions against providers that stonewalled patient record requests.¹⁰ For Medicaid records held by the Colorado Department of Health Care Policy and Financing, HCPF publishes a complaint form specifically for privacy violations.²

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
Department of Health Care Policy and Financing. Health Insurance Portability and Accountability Act Privacy Forms
3
eCFR. 42 CFR 2.31 – Consent Requirements
4
Justia Law. Colorado Code 25-1-801 – Patient Records in Custody of Health-Care Facility – Definitions
5
Kaiser Permanente. Authorization for Use or Disclosure of Health Information
6
U.S. Department of Health and Human Services. Does Having a Health Care Power of Attorney Allow Access to the Patient’s Medical and Mental Health Records Under HIPAA
7
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
8
U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization
9
U.S. Department of Health and Human Services. The HIPAA Privacy Rule
10
U.S. Department of Health and Human Services. Resolution Agreements