Health record rights in Colorado: what state law adds
In Colorado, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and two of the three rules we look for on AI in care are in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Do you get a copy faster or free in some cases?In one way: a free copy in at least one case. Also signed, not yet in force: Laura Hershey Disability Support Act, sunset review, repeal of part (July 1, 2027). Same answer in 24 of the 50 states, counting this one.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Are there rules for AI used in your care?Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone. Also signed, not yet in force: Use of AI systems in utilization review, clinician approval of denials (January 1, 2027); Colorado AI Act as repealed and reenacted by SB 26-189, human review and reconsideration (January 1, 2027). Same answer in 6 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Colorado Privacy Act requires opt-in consent to process or sell sensitive data, which includes a mental or physical health condition or diagnosis. No dedicated consumer health data law found in title 6. Thresholds apply.
A controller shall not process or sell a consumer's sensitive data without first obtaining the consumer's consent
Who it binds, in our words: Satisfies one or both of the following thresholds: controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more
Colorado Privacy Act, applicability of part. C.R.S. 6-1-1304(1)
controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more
Who it binds, in our words: Controllers that conduct business in Colorado or target Colorado residents and meet the thresholds; any amount of biometric data also brings a controller in (6-1-1304(1)(a)(II)).
In force · effective · read October 3, 2026 · source(leg.colorado.gov, reached from leg.colorado.gov)
A controller shall not process OR SELL a consumer's sensitive data without first obtaining the consumer's consent
Who it binds, in our words: Same controllers as 6-1-1304.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for disability benefit claims and free copy when a record is late go beyond HIPAA and 45 CFR 171. Deadline is 30 days, not shorter. The disability act it cites is repealed 2027-07-01.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: One free copy to a third-party entity performing duties under the Laura Hershey Disability Support Act, for a disability benefit application, appeal or reapplication (25-1-800.3(3)(b)(I)).
Free copy: A record not provided within 30 days, or without written notice of a 30-day extension, must be provided at no cost (25-1-801(1)(f)(IV); same rule in 25-1-802).
Fee rule: Patient or personal representative: copies on payment of 'the fee a covered entity may impose in accordance with' HIPAA (25-1-801(1)(b)(I)(A)).
Fee rule: Third-party reasonable fees cap: $18.53 for the first ten pages, $0.85 per page for the next thirty, $0.57 per page after; microfilm $1.50 per page; certification $10; actual postage and media costs (25-1-800.3(3)(a)).
Fee rule: Attorney requests over 664 pages: total fees must not exceed $400, inflation-adjusted from 2028 (25-1-801(1)(b)(III), (IV)).
Fee rule: No fee for inspection of records (25-1-801(2)).
If a patient record is requested by a third-party entity that is performing duties under the "Laura Hershey Disability Support Act", part 2 of article 88 of title 8, the third party may obtain one free copy of the record for the application process
Who it binds, in our words: Applies throughout part 8 of article 1 of title 25 (health-care facilities under 25-1-801 and individual providers under 25-1-802).
Patient records in custody of health-care facility, late records at no cost. C.R.S. 25-1-801(1)(f)(IV)
A record not provided within thirty days or without written notification of a thirty-day extension must be provided to the requestor at no cost
Who it binds, in our words: Health facilities licensed under 25-1.5-103(1) or article 3 of title 25 and title 10 entities providing health-care services; the same sentence appears in 25-1-802 for individual providers.
Patient records in custody of health-care facility, copy fee rule. C.R.S. 25-1-801(1)(b)(I)(A)
must provide copies of a patient's medical records, including X rays, to the patient or the patient's personal representative upon request and payment of the fee a covered entity may impose in accordance with the
Who it binds, in our words: Health facilities licensed or certified under 25-1.5-103(1) or article 3 of title 25, and title 10 entities providing health-care services.
Laura Hershey Disability Support Act, sunset review, repeal of part. C.R.S. 8-88-207 (as amended by HB 26-1382)
Who it binds, in our words: Repeals the act that the free-copy rule in 25-1-800.3(3)(b)(I) cross-references. The amended section took effect 2026-06-02; the repeal takes effect 2027-07-01.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Colorado statute on HIE consent found in titles 6 or 25 of the 2026 CRS. The OeHI page names Contexture as the one state-designated HIE. Its published policy is opt-out. Substance use data needs written consent.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Contexture.
Some sensitive records need your consent even where routine records do not.
Contexture HIE Opt-In and Opt-Out Information. Contexture patient opt-in / opt-out policy page
In force · effective · read October 3, 2026 · source(contexture.org, reached from oehi.colorado.gov)
opting out, your health information will not be accessible through Contexture’s HIE unless the sharing is required by law
Who it binds, in our words: Patients of providers participating in Contexture's HIE in Colorado and Arizona; opt out by signing a form at the provider's office.
Contexture FAQ for Patients, sensitive health information. Contexture patient FAQ
In force · effective · read October 3, 2026 · source(contexture.org, reached from oehi.colorado.gov)
Yes, certain types of health information, including substance use information, are subject to additional legal protections.
Who it binds, in our words: Same FAQ states substance use information is available only with the patient's written consent or in a bona fide medical emergency.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
SB 23-188 bars Colorado subpoenas for out-of-state proceedings about legally protected health-care activity and limits sharing procedure information with other states for abortion-law enforcement.
Prohibition on issuing subpoena in connection with proceeding in another state. C.R.S. 13-1-140
provided that information relating to a medical procedure performed on an individual is not shared with an agency or individual from another state for the purpose of enforcing another state's abortion law.
Who it binds, in our words: Courts, judicial officers, court employees and attorneys issuing subpoenas for out-of-state proceedings about legally protected health-care activity; 13-1-140.1 adds a subpoena affirmation.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Records of services under article 65 are confidential and privileged and may be disclosed only in listed cases. SB 26-149 added subsections (7) to (12), effective 2026-05-21.
Care and treatment of persons with mental health disorders, records. C.R.S. 27-65-123(1)
all information obtained and records prepared in the course of providing any services to any person pursuant to any provision of this article 65 are confidential and privileged matter.
Who it binds, in our words: Services under article 65 of title 27 (mental health holds, evaluation and treatment). Disclosure is allowed only in listed cases.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
STI reports and resulting records, which include HIV, are confidential information and may be released only as the section lists. 25-4-406(3) treats STI diagnosis and treatment records as medical information.
Sexually transmitted infections, reports, confidentiality. C.R.S. 25-4-406(1); definition at 25-4-402(10)
any records resulting from compliance with that section held by the state department and county and district public health agencies, or any health-care provider, facility, third-party payer, physician, clinic, laboratory, blood bank, health records database, or other agency, are confidential information.
Who it binds, in our words: "Sexually transmitted infection" refers to chlamydia, syphilis, gonorrhea, HIV, and relevant types of hepatitis (25-4-402(10)).
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Genetic testing information is confidential and privileged. Release for purposes other than diagnosis, treatment or therapy needs the person's specific written consent.
Genetic testing, limitations on disclosure of information. C.R.S. 10-3-1104.7(3)(a)
Information derived from genetic testing shall be confidential and privileged. Any release, for purposes other than diagnosis, treatment, or therapy, of genetic testing information that identifies the person tested with the test results released requires specific written consent by the person tested.
Who it binds, in our words: Information derived from genetic testing, as defined in 10-3-1104.7(2).
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
A person may sue only for genetic testing violations under 10-3-1104.7. The Colorado Privacy Act bars a private right of action. The breach statute names the attorney general as enforcer.
Damages a court may award: Genetic testing (10-3-1104.7(12)): greater of actual damages or $10,000 per violation, plus equitable relief; prevailing party may recover costs and reasonable attorney fees (10-3-1104.7(13)).
The attorney general may bring an action in law or equity to address violations of this section, section 6-1-713, or section 6-1-713.5
Who it binds, in our words: Covered entities under the breach statute.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Personal information includes medical information and health insurance identification number. Notice within 30 days. Attorney general notice at 500 or more residents. Entities following their regulator's breach rules are deemed compliant but still notify the attorney general.
Deadline to tell people: Most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that a security breach occurred.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Notification of security breach, definition of personal information. C.R.S. 6-1-716(1)(g)(I)(A)
Social security number; student, military, or passport identification number; driver's license number or identification card number; medical information; health insurance identification number; or biometric data;
Who it binds, in our words: Covered entities that maintain, own or license computerized personal information of Colorado residents.
Notification of security breach, notice to attorney general. C.R.S. 6-1-716(2)(f)(I)
Colorado attorney general in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, if the security breach is reasonably believed to have affected five hundred Colorado residents or more
Who it binds, in our words: Breaches reasonably believed to affect 500 or more Colorado residents.
Notification of security breach, procedures deemed in compliance. C.R.S. 6-1-716(3)(b)
maintains procedures for a security breach pursuant to the laws, rules, regulations, guidances, or guidelines established by its state or federal regulator is in compliance with this section; except that notice to the attorney general is still required
Who it binds, in our words: Entities regulated by state or federal law, such as HIPAA entities; if notice periods conflict, the shortest one controls.
In force · effective · read October 3, 2026 · source(content.leg.colorado.gov)
INFORMATION; HEALTH INSURANCE IDENTIFICATION NUMBER; OR BIOMETRIC DATA;
Who it binds, in our words: Enacting text of the current definition; HB 26-1426 later amended only (1)(a), (1)(b) and (2)(a.3).
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
Two of the three rules are in force. You must be told when AI is used in your care. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
In force: AI Act notice and human-review appeal for health-care decisions, and psychotherapist review of AI treatment plans. Pending 2027-01-01: SB 26-189 replaces the AI Act; HB 26-1139 requires clinician approval of AI coverage denials.
You must be told when AI is used in your care: in force.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): C.R.S. 6-1-1705.2(1)(b), in force, effective August 12, 2026: "Represents that the artificial intelligence system provides psychotherapy services; or"
Related limit on AI (recorded, not counted in the answer): C.R.S. 12-245-224.5(5)(a), in force, effective August 12, 2026: "Interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the licensee, registrant, certificate holder, or other individual lawfully permitted to provide psychotherapy services in the state, the artificial intelligence system, and the client; or"
Related limit on AI (recorded, not counted in the answer): C.R.S. 10-16-112.7(6)(a), signed, not yet in force, effective January 1, 2027: "shall not provide coverage for services that constitute psychotherapy services, as defined in section 12-245-202 (14), that are provided directly to an individual and that are conducted by an artificial intelligence system."
Colorado AI Act, deployer notice to consumer. C.R.S. 6-1-1703(4)(a)(I)
Blocked by a court order · effective · court order not yet pulled from the court record · read October 3, 2026 · source(olls.info, reached from content.leg.colorado.gov)
Court order of April 27, 2026: the copy we found (on troutmanprivacy.com, not a court site).
Notify the consumer that the deployer has deployed a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision before the decision is made;
Who it binds, in our words: "Consequential decision" means a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of: (6-1-1701(3)), listing (e) Health-care services. Duty runs on and after June 30, 2026.
Colorado AI Act, appeal with human review. C.R.S. 6-1-1703(4)(b)(III)
Blocked by a court order · effective · court order not yet pulled from the court record · read October 3, 2026 · source(olls.info, reached from content.leg.colorado.gov)
Court order of April 27, 2026: the copy we found (on troutmanprivacy.com, not a court site).
An opportunity to appeal an adverse consequential decision concerning the consumer arising from the deployment of a high-risk artificial intelligence system, which appeal must, if technically feasible, allow for human review
Who it binds, in our words: Deployers of high-risk AI systems for consequential decisions including health-care services. Version effective until January 1, 2027. 6-1-1705 exempts some HIPAA covered entity recommendations that are not high risk.
Use of AI systems for psychotherapy services, review of treatment plans. C.R.S. 12-245-224.5(5)(b)
Generate therapeutic recommendations or treatment plans without review and approval by the licensee, registrant, certificate holder, or other individual lawfully permitted to provide psychotherapy services in the state.
Who it binds, in our words: Licensees, registrants, certificate holders and others lawfully permitted to provide psychotherapy services in Colorado.
Use of AI systems for psychotherapy services, written notice and consent to record or transcribe. C.R.S. 12-245-224.5(4)(a)
The client or the client's legally authorized representative is informed in advance in writing of the following:
Who it binds, in our words: Psychotherapy providers using AI to record or transcribe a therapeutic session; notice covers that AI will be used and its specific purpose, plus written consent.
Use of AI systems in utilization review, clinician approval of denials. C.R.S. 10-16-112.7(5)(b) (HB 26-1139)
A carrier's denial of coverage based in whole or in part on medical necessity shall not be issued solely on the output of an artificial intelligence system without human review and approval of the denial by a licensed clinician
Who it binds, in our words: Carriers, PBMs and private utilization review organizations working for carriers, and behavioral health ASOs or managed care entities using AI for utilization review.
Colorado AI Act as repealed and reenacted by SB 26-189, human review and reconsideration. C.R.S. 6-1-1705(1)(a)(II) (SB 26-189)
An opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable.
Who it binds, in our words: Deployers whose covered ADMT materially influences a consequential decision; SB 26-189 replaces part 17 on January 1, 2027.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
9.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
96.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
91.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$87,598 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.8%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
16.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
10.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
