Colorado Medical Records Retention Laws (2026 Guide)

Colorado has detailed rules governing how long hospitals, physicians, and mental health providers must keep patient medical records. These rules come from a combination of state regulations, Colorado Medical Board policies, federal HIPAA requirements, and CMS conditions of participation. Understanding these requirements matters whether you are a healthcare provider managing records or a patient seeking access to your own medical history.

This guide covers every major aspect of Colorado medical records retention law, including the differences between hospital and physician obligations, special rules for minor patients, mental health record requirements, practice closure procedures, and patient access rights.

Colorado Hospital Medical Records Retention Requirements

Colorado regulates hospital medical records retention primarily through the Code of Colorado Regulations, specifically 6 CCR 1011-1, Chapter 04, Part 10 for general hospitals and 6 CCR 1011-1, Chapter 09, Part 10 for other health facilities.

Adult Patient Records

General hospitals in Colorado must preserve medical records for 10 years after the most recent patient care usage of the medical record. This 10-year period begins running from the date of the last encounter, not from the date of the first visit or admission.

The term "patient care usage" includes any clinical encounter where the record was accessed or updated for treatment purposes. If a patient returns for follow-up care years after an initial visit, the 10-year clock resets from that most recent encounter.

Minor Patient Records

For patients who are minors, Colorado hospitals must retain records for the period of minority plus 10 years. In practical terms, this means records must be kept until the patient reaches age 28, or for 10 years after the most recent patient encounter, whichever date is later.

For example, if a child receives treatment at age 5 and never returns to the hospital, the facility must keep those records until the former patient turns 28. If that same patient returns for care at age 16, the hospital must keep the records until either age 28 or 10 years after the age-16 visit (age 26), whichever is later. In that case, the age-28 deadline controls.

Required Record Contents

Colorado regulations require hospital medical records to contain specific documentation, including:

• Admitting diagnosis and medical history
• Physical examination findings
• Consultation results and reports
• Documentation of complications
• Informed consent forms
• Practitioner orders
• Nursing notes and assessments
• Medication administration records
• Laboratory and radiology reports
• Discharge summaries with follow-up care provisions
• Final diagnoses completed within 30 days of the visit

A registered record administrator or trained practitioner must oversee health information management services, and the hospital must maintain adequate staffing to meet operational needs for records management.

Individual Physician Medical Records Retention

Colorado does not have a single statute that mandates a specific retention period for records held by individual physicians in private practice. Instead, physician record-keeping obligations come from the Colorado Medical Board and professional liability considerations.

Colorado Medical Board Policy 40-7

The Colorado Medical Board has issued Policy 40-7, which provides guidelines for the release and retention of medical records. The Board recommends that individual physicians retain all patient records for a minimum of 7 years after the last date of treatment.

For records of minor patients, the Board recommends retention for 7 years after the patient reaches the age of majority (age 18), meaning records should be kept until the former minor turns 25.

Professional Liability Considerations

Colorado's medical malpractice statute of limitations under C.R.S. 13-80-102.5 generally allows patients 2 years from the date they knew or should have known of the injury to file a claim, with an absolute cap of 3 years from the act or omission. However, for minors, the statute of limitations may be tolled (paused) until the child reaches age 18.

Because of these timelines, many Colorado physicians and their malpractice insurers, including COPIC (Colorado Physicians Insurance Company), recommend keeping records for 10 years after the last date of treatment, or 10 years after a minor patient reaches the age of majority. This longer retention period provides protection against late-filed claims and ensures records are available for legal defense if needed.

Best Practice Recommendation

While the Medical Board recommends 7 years and malpractice insurers suggest 10 years, the safest approach for Colorado physicians is to follow the 10-year guideline. This aligns with hospital retention requirements and provides the broadest protection in the event of litigation.

Mental Health Records Retention in Colorado

Mental health professionals in Colorado are subject to separate retention rules under the Department of Regulatory Agencies (DORA) regulations.

Psychologists

Under 3 CCR 721-1.16, licensed psychologists must retain client records for 7 years starting from the date of termination of psychology services or the date of last contact with the client, whichever is later.

For child clients, psychologists must keep records for 7 years starting from either the last date of treatment or when the child reaches age 18, whichever is later. This means records for a child patient treated at age 10 must be kept until at least age 25.

Licensed Professional Counselors and Therapists

Licensed professional counselors (LPCs), licensed marriage and family therapists (LMFTs), and registered psychotherapists follow similar 7-year retention rules under their respective DORA regulations (4 CCR 737-1.16 and 4 CCR 736-1.16). The retention period begins on the date of termination of services or last contact with the client, whichever is later.

Record Disposition Plans

All mental health professionals in Colorado must establish written plans for how records will be handled in cases of the practitioner's disability, illness, death, or practice termination. These plans must be in place before any of those events occur.

Client Notification

Mental health professionals are required to give notice to former clients that their records may not be retained after the 7-year period expires. This notification allows clients to request copies of their records before destruction.

How HIPAA Interacts with Colorado Retention Laws

The federal Health Insurance Portability and Accountability Act (HIPAA) does not establish a medical records retention period. According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include requirements for how long medical records must be kept. State laws govern medical records retention, and HIPAA defers to those state requirements.

HIPAA Documentation Requirements

While HIPAA does not govern medical records retention, it does require covered entities to retain HIPAA-related administrative documentation for 6 years. Under 45 CFR 164.530(j), covered entities must keep policies, procedures, notices of privacy practices, disposition of complaints, and other HIPAA compliance documentation for 6 years from the date of creation or the date when the document was last in effect, whichever is later.

Where State Law Prevails

Because Colorado's retention requirements (10 years for hospitals, 7 years minimum for physicians and mental health providers) exceed the HIPAA documentation retention period, Colorado law effectively controls how long medical records must be kept. When state law is more protective of patient information than HIPAA, the state law prevails.

HIPAA Destruction Standards

When medical records are destroyed after the retention period expires, HIPAA requires that the destruction render protected health information (PHI) "unreadable, indecipherable, and otherwise cannot be reconstructed." According to HHS guidance, acceptable methods include:

• Shredding paper records
• Burning or pulping paper documents
• Degaussing or physically destroying electronic media
• Using certified data destruction services for digital records

CMS and Medicare Requirements

Healthcare providers who participate in Medicare and Medicaid must also follow federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

Hospital Requirements Under 42 CFR 482.24

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for a minimum of 5 years. This federal minimum is shorter than Colorado's 10-year requirement, so Colorado hospitals must follow the longer state requirement.

Hospital medical records under CMS rules must be accurately written, promptly completed, properly filed and retained, and accessible. All entries must be legible, complete, dated, timed, and authenticated by the responsible personnel.

Physician Requirements Under Medicare

For physicians and other eligible professionals enrolled in Medicare, CMS requires maintenance of medical records for 7 years from the date of service. Providers who fail to produce medical records upon CMS request may face revocation of their Medicare enrollment.

CMS recognizes that physicians may rely on employers or other entities to maintain records on their behalf, but the physician remains ultimately responsible for ensuring records are available when requested.

Practical Impact

Because Colorado's hospital requirement (10 years) exceeds the CMS minimum (5 years), and Colorado's recommended physician retention (7 to 10 years) meets or exceeds the CMS physician requirement (7 years), Colorado providers who follow state law will automatically satisfy federal CMS requirements.

Patient Access to Medical Records in Colorado

Colorado law guarantees patients the right to inspect and obtain copies of their medical records under C.R.S. 25-1-801 (for health care facilities) and C.R.S. 25-1-802 (for individual health care providers).

Right to Inspect

Patients or their authorized personal representatives may inspect their medical records at reasonable times and with reasonable notice. Health care facilities and individual providers may not charge a fee for in-person inspection of records.

Copies and Fees

When patients request copies of their medical records, Colorado law allows providers to charge the following fees:

Fee Category	Amount
First 10 pages	$18.53 total
Pages 11 through 40	$0.85 per page
Pages 41 and beyond	$0.57 per page
Microfilm copies	$1.50 per page
Certification fee (if requested)	$10.00
Postage and electronic media	Actual cost
Radiographic materials (X-rays, CT, MRI)	Actual reproduction cost

Electronic Records

If the original medical records are stored in electronic format and are readily producible electronically, the provider must deliver the records in electronic format when the patient requests it. This aligns with HIPAA's right of access provisions.

Response Timeline

Healthcare providers generally have 30 calendar days to respond to a medical records request. If a provider cannot act within that timeframe, they may extend the deadline by an additional 30 days with written notice to the patient.

Protected Information

Providers are not required to release certain sensitive records to parents or guardians without proper authorization. These protected categories include records related to:

• Sexually transmitted infections
• Substance use disorder treatment
• A minor's drug use

These records may only be released to the minor patient or their designee.

Medical Records Destruction in Colorado

Once the applicable retention period has expired, Colorado providers may destroy medical records, but must follow specific procedures.

Pre-Destruction Requirements

Colorado regulations require healthcare facilities to establish procedures for notifying patients whose records are scheduled for destruction before the destruction takes place. This notification gives patients the opportunity to request copies of their records.

Best practices for pre-destruction notification include:

• Sending written notice to the patient's last known address
• Allowing a reasonable response window (typically 60 to 90 days)
• Documenting all notification efforts
• Maintaining a written log of records that are destroyed

Acceptable Destruction Methods

Under both Colorado regulations and HIPAA, acceptable destruction methods for paper records include shredding, burning, pulping, or pulverizing the documents so that protected health information is rendered unreadable and cannot be reconstructed.

For electronic records, acceptable methods include degaussing magnetic media, physically destroying hard drives or storage devices, and using certified data wiping software that meets industry standards.

Certificates of Destruction

Providers who use third-party destruction services should obtain a certificate of destruction from the vendor as proof that records were properly destroyed. This documentation should be retained indefinitely as part of the practice's compliance records.

Practice Closure and Physician Retirement

When a Colorado physician retires, closes a practice, or otherwise stops seeing patients, specific obligations regarding medical records continue.

Colorado Medical Board Policy 40-8

The Colorado Medical Board's Policy 40-8 addresses guidelines for closure of or departure from a medical practice. Key requirements include:

Patient notification: Physicians must provide reasonable advance notice to patients, ideally 60 to 90 days before closing the practice. At minimum, patients seen within the previous two years should receive written notice.

Written notice content: The notification must explain the practice closure, the final date of operations, and the method by which patients can access or obtain their medical records going forward.

Records transfer: Patients should be instructed to submit a written authorization if they want their records transferred to another provider.

Continued retention: Even after closing a practice, the physician must ensure that medical records remain securely stored and accessible for the full retention period (7 to 10 years from the last date of service, or longer for minor patients).

Options for Record Storage After Closure

Colorado physicians closing a practice have several options for meeting their ongoing retention obligations:

• Practice sale: If the practice is sold to another physician or health system, medical records can be transferred as part of the sale. The purchase agreement should include the buyer's obligation to secure the records and provide patient access.
• Records custodian service: Professional medical records custodian companies can store and manage records for a fee, handling patient access requests and eventual destruction.
• Colleague arrangement: Another physician or medical organization can agree to securely store records and provide timely access for patient requests.

Disciplinary Consequences

Under C.R.S. 12-240-125, a physician who fails to inform patients about how to access their records upon practice closure may be subject to disciplinary action by the Colorado Medical Board. This can include fines, license restrictions, or other sanctions.

Summary of Colorado Medical Records Retention Periods

Provider Type	Adult Records	Minor Records	Governing Authority
General hospitals	10 years after last encounter	Until age 28 or 10 years after last encounter (whichever is later)	6 CCR 1011-1, Ch. 04, Part 10
Individual physicians	7 years minimum (10 years recommended)	7 years after age 18 (age 25) per Board; 10 years after age 18 (age 28) per insurers	Medical Board Policy 40-7
Psychologists	7 years after last contact	7 years after age 18 (age 25)	3 CCR 721-1.16
Licensed counselors/therapists	7 years after last contact	7 years after age 18 (age 25)	4 CCR 737-1.16, 4 CCR 736-1.16
Medicare-participating hospitals	5 years minimum (federal floor)	Not separately specified	42 CFR 482.24
Medicare-participating physicians	7 years from date of service	Not separately specified	CMS MLN guidelines
HIPAA compliance documentation	6 years from creation or last effective date	Same	45 CFR 164.530(j)

Sources and References

• 6 CCR 1011-1, Chapter 04, Part 10 - Health Information Management (General Hospitals) - Colorado Department of Public Health and Environment
• 6 CCR 1011-1, Chapter 09, Part 10 - Health Information Management (Health Facilities) - Colorado Department of Public Health and Environment
• Colorado Medical Board Laws, Rules, and Policies (Policies 40-7 and 40-8) - Colorado Division of Professions and Occupations
• 3 CCR 721-1.16 - Psychologist Records Retention - Colorado State Board of Psychologist Examiners
• 4 CCR 737-1.16 - Licensed Professional Counselor Records Retention - Colorado Department of Regulatory Agencies
• C.R.S. 25-1-801 - Patient Records in Custody of Health-Care Facility - Colorado Revised Statutes
• C.R.S. 25-1-802 - Patient Records in Custody of Individual Health-Care Providers - Colorado Revised Statutes
• 42 CFR 482.24 - Condition of Participation: Medical Record Services - Code of Federal Regulations
• 45 CFR 164.530 - HIPAA Administrative Requirements - Code of Federal Regulations
• HHS FAQ: Does HIPAA Require Record Retention? - U.S. Department of Health and Human Services
• CMS Medical Record Maintenance and Access Requirements - Centers for Medicare and Medicaid Services