(1) Any person who, without proper authorization, knowingly obtains a medical record or medical information with the intent to appropriate the medical record or medical information to his own use or to the use of another, who steals or discloses to an unauthorized person a medical record or medical information, or who, without authority, makes or causes to be made a copy of a medical record or medical information commits theft of a medical record or medical information.
(2) As used in this section:
(a) Medical record means the written or graphic documentation, sound
recording, or computer record pertaining to medical, mental health, and health-care
services, including medical marijuana services, performed at the direction of a
physician or other licensed health-care provider on behalf of a patient by
physicians, dentists, nurses, service providers, emergency medical service
providers, mental health professionals, prehospital providers, or other health-care
personnel. Medical record includes such diagnostic documentation as X rays,
electrocardiograms, electroencephalograms, and other test results. Medical
record includes data entered into the prescription drug monitoring program under
section 12-280-403.
(b) Medical information means any information contained in the medical
record or any information pertaining to the medical, mental health, and health-care
services performed at the direction of a physician or other licensed health-care
provider which is protected by the physician-patient privilege established by
section 13-90-107 (1)(d), C.R.S.
(c) Proper authorization means:
(I) A written authorization signed by the patient or his or her duly designated
representative; or
(II) An appropriate order of court; or
(III) Authorized possession pursuant to law or regulation for claims
processing, possession for medical audit or quality assurance purposes, possession
by a consulting physician to the patient, or possession by hospital personnel for
record-keeping and billing purposes; or
(IV) Authorized possession pursuant to section 18-3-415, 18-3-415.5, 25-1-122, or 30-10-606 (6), C.R.S.; or
(V) Authorized possession by a law enforcement officer or agency, acting in
official capacity and pursuant to an official investigation.
(d) Copy means any facsimile, replica, photograph, sound recording,
magnetic or electronic recording, or other reproduction of a medical record and any
note, drawing, or sketch made of or from a medical record.
(3) Theft of a medical record or medical information is a class 1
misdemeanor; except that if the person steals or discloses the medical record or
information to an unauthorized person, it is a class 5 felony.
(4) The obtaining, accessing, use, or disclosure of relevant medical records
or medical information pursuant to 18 U.S.C. sec. 922 (t) and sections 24-33.5-424,
13-5-142, and 13-9-123, C.R.S., by the Colorado bureau of investigation, the clerk of
the court of any judicial district in the state, the clerk of the probate court of the
city and county of Denver, or by any of their employees and accessing such records
and information through the NICS system shall not constitute theft of a medical
record or medical information under this section.
(5) This section shall not apply to covered entities, their business associates,
or health oversight agencies as each is defined in the federal Health Insurance
Portability and Accountability Act of 1996 as amended by the federal Health
Information Technology for Economic and Clinical Health Act and the respective
implementing regulations.
(2) For the Health Insurance Portability and Accountability Act of 1996, see
Pub.L. 104-191, codified at 42 U.S.C. sec. 201 et seq. For the Health Information
Technology for Economic and Clinical Health Act, see Pub.L.111-5.
L. 79: Entire section added, p. 727, § 6, effective July 1. L. 89: (3) amended, p. 834, § 47, effective July 1. L. 99: (2)(c) amended, p. 1003, § 11, effective May 29. L. 2000: (4) added, p. 12, § 4, effective March 7; (2)(a) amended, p. 545, § 22, effective July 1. L. 2001: (2)(c)(IV) amended, p. 736, § 6, effective July 1. L. 2002: (4) amended, p. 756, § 3, effective January 1, 2003. L. 2003: (2)(c)(IV) amended, p. 1021, § 2, effective April 17; (5) added, p. 1785, § 20, effective July 1. L. 2007: (2)(a) and (2)(b) amended, p. 1689, § 9, effective July 1. L. 2010: (2)(c)(V) added and (5) amended, (SB 10-167), ch. 296, p. 1399, §§ 15, 16, effective May 26. L. 2011: (2)(a) amended, (SB 11-192), ch. 230, p. 987, § 12, effective July 1; (2)(a) amended, (HB 11-1043), ch. 266, p. 1214, § 27, effective July 1. L. 2012: (2)(a) amended, (HB 12-1059), ch. 271, p. 1436, § 15, effective July 1; (2)(a) amended, (HB 12-1311), ch. 281, p. 1619, § 44, effective July 1. L. 2016: (2)(c)(IV) amended, (SB 16-146), ch. 230, p. 918, § 11, effective July 1. L. 2019: (2)(a) amended, (HB 19-1172), ch. 136, p. 1675, § 94, effective October 1. L. 2023: (3) amended, (HB 23-1293), ch. 298, p. 1785, § 13, effective October 1.
Amendments to subsection (2)(a) by House Bill 11-1043 and Senate Bill 11-192 were harmonized. Amendments to subsection (2)(a) by House Bill 12-1059 and House Bill 12-1311 were harmonized.
(1) For the legislative declaration contained in the 2000 act enacting subsection (4), see section 1 of chapter 5, Session Laws of Colorado 2000. For the legislative declaration in the 2010 act adding subsection (2)(c)(V) and amending subsection (5), see section 1 of chapter 296, Session Laws of Colorado 2010.
