Colorado Medical Records Retention Laws (2026 Guide)

Colorado hospitals must retain adult medical records for 10 years after the last patient encounter under 6 CCR 1011-1, while individual physicians must keep records for a minimum of 7 years per Colorado Medical Board Policy 40-7. Minor patient records receive extended protection under both rules.

Colorado has detailed rules governing how long hospitals, physicians, and mental health providers must keep patient medical records. These rules come from a combination of state regulations, Colorado Medical Board policies, federal HIPAA requirements, and CMS conditions of participation. Understanding these requirements matters whether you are a healthcare provider managing records or a patient seeking access to your own medical history.

This guide covers every major aspect of Colorado medical records retention law, including the differences between hospital and physician obligations, special rules for minor patients, mental health record requirements, practice closure procedures, and patient access rights.

Colorado Hospital Medical Records Retention Requirements

Colorado regulates hospital medical records retention primarily through the Code of Colorado Regulations, specifically 6 CCR 1011-1, Chapter 04, Part 10 for general hospitals and 6 CCR 1011-1, Chapter 09, Part 10 for other health facilities.

Adult Patient Records

General hospitals in Colorado must preserve medical records for 10 years after the most recent patient care usage of the medical record. This 10-year period begins running from the date of the last encounter, not from the date of the first visit or admission.

The term "patient care usage" includes any clinical encounter where the record was accessed or updated for treatment purposes. If a patient returns for follow-up care years after an initial visit, the 10-year clock resets from that most recent encounter.

Minor Patient Records

For patients who are minors, Colorado hospitals must retain records for the period of minority plus 10 years. In practical terms, this means records must be kept until the patient reaches age 28, or for 10 years after the most recent patient encounter, whichever date is later.

For example, if a child receives treatment at age 5 and never returns to the hospital, the facility must keep those records until the former patient turns 28. If that same patient returns for care at age 16, the hospital must keep the records until either age 28 or 10 years after the age-16 visit (age 26), whichever is later. In that case, the age-28 deadline controls.

Required Record Contents

Colorado regulations require hospital medical records to contain specific documentation, including:

• Admitting diagnosis and medical history
• Physical examination findings
• Consultation results and reports
• Documentation of complications
• Informed consent forms
• Practitioner orders
• Nursing notes and assessments
• Medication administration records
• Laboratory and radiology reports
• Discharge summaries with follow-up care provisions
• Final diagnoses completed within 30 days of the visit

A registered record administrator or trained practitioner must oversee health information management services, and the hospital must maintain adequate staffing to meet operational needs for records management.

Individual Physician Medical Records Retention

Colorado does not have a single statute that mandates a specific retention period for records held by individual physicians in private practice. Instead, physician record-keeping obligations come from the Colorado Medical Board and professional liability considerations.

Colorado Medical Board Policy 40-7

The Colorado Medical Board has issued Policy 40-7, which provides guidelines for the release and retention of medical records. The Board recommends that individual physicians retain all patient records for a minimum of 7 years after the last date of treatment.

For records of minor patients, the Board recommends retention for 7 years after the patient reaches the age of majority (age 18), meaning records should be kept until the former minor turns 25.

Professional Liability Considerations

Colorado's medical malpractice statute of limitations under C.R.S. 13-80-102.5 generally allows patients 2 years from the date they knew or should have known of the injury to file a claim, with an absolute cap of 3 years from the act or omission. Minor patients are not simply tolled to age 18. Under C.R.S. 13-80-102.5(3)(d)(I), a child who was under six years old on the date of the act or omission may bring the action at any time before turning eight, a window that closes earlier than the general rule rather than later. Other minors are treated as persons under a disability under C.R.S. 13-81-101, and their filing window is set by C.R.S. 13-81-103. If no legal representative has been appointed, that provision gives the person the longer of the ordinary limitations period or two years after the disability is removed, which for a minor means roughly age 20.

Because these windows can extend years past the last visit, many Colorado physicians and their malpractice insurers, including COPIC (Colorado Physicians Insurance Company), recommend keeping records for 10 years after the last date of treatment, or 10 years after a minor patient reaches the age of majority. This longer retention period provides protection against late-filed claims and ensures records are available for legal defense if needed.

Best Practice Recommendation

While the Medical Board recommends 7 years and malpractice insurers suggest 10 years, the safest approach for Colorado physicians is to follow the 10-year guideline. This aligns with hospital retention requirements and provides the broadest protection in the event of litigation.

Mental Health Records Retention in Colorado

Mental health professionals in Colorado are subject to separate retention rules under the Department of Regulatory Agencies (DORA) regulations.

Psychologists

Under 3 CCR 721-1.16, licensed psychologists must retain client records for 7 years starting from the date of termination of psychology services or the date of last contact with the client, whichever is later.

For child clients, psychologists must keep records for 7 years starting from either the last date of treatment or when the child reaches age 18, whichever is later. This means records for a child patient treated at age 10 must be kept until at least age 25.

Licensed Professional Counselors and Therapists

Licensed professional counselors (LPCs), licensed marriage and family therapists (LMFTs), and registered psychotherapists follow similar 7-year retention rules under their respective DORA regulations (4 CCR 737-1.16 and 4 CCR 736-1.16). The retention period begins on the date of termination of services or last contact with the client, whichever is later. For LPC records involving a child client, 4 CCR 737-1.16 caps total retention at 12 years from the last date of treatment, even when that comes sooner than the child's 25th birthday. The LMFT rule in 4 CCR 736-1.16 has no such cap.

Record Disposition Plans

All mental health professionals in Colorado must establish written plans for how records will be handled in cases of the practitioner's disability, illness, death, or practice termination. These plans must be in place before any of those events occur.

Client Notification

Mental health professionals are required to give notice to former clients that their records may not be retained after the 7-year period expires. This notification allows clients to request copies of their records before destruction.

How HIPAA Interacts with Colorado Retention Laws

The federal Health Insurance Portability and Accountability Act (HIPAA) does not establish a medical records retention period. According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include requirements for how long medical records must be kept. State laws govern medical records retention, and HIPAA defers to those state requirements.

HIPAA Documentation Requirements

While HIPAA does not govern medical records retention, it does require covered entities to retain HIPAA-related administrative documentation for 6 years. Under 45 CFR 164.530(j), covered entities must keep policies, procedures, notices of privacy practices, disposition of complaints, and other HIPAA compliance documentation for 6 years from the date of creation or the date when the document was last in effect, whichever is later.

Where State Law Prevails

Because Colorado's retention requirements (10 years for hospitals, 7 years minimum for physicians and mental health providers) exceed the HIPAA documentation retention period, Colorado law effectively controls how long medical records must be kept. When state law is more protective of patient information than HIPAA, the state law prevails.

HIPAA Destruction Standards

When medical records are destroyed after the retention period expires, HIPAA requires that the destruction render protected health information (PHI) "unreadable, indecipherable, and otherwise cannot be reconstructed." According to HHS guidance, acceptable methods include:

• Shredding paper records
• Burning or pulping paper documents
• Degaussing or physically destroying electronic media
• Using certified data destruction services for digital records

CMS and Medicare Requirements

Healthcare providers who participate in Medicare and Medicaid must also follow federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

Hospital Requirements Under 42 CFR 482.24

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for a minimum of 5 years. This federal minimum is shorter than Colorado's 10-year requirement, so Colorado hospitals must follow the longer state requirement.

Hospital medical records under CMS rules must be accurately written, promptly completed, properly filed and retained, and accessible. All entries must be legible, complete, dated, timed, and authenticated by the responsible personnel.

Physician Requirements Under Medicare

For physicians and other eligible professionals enrolled in Medicare, CMS requires maintenance of medical records for 7 years from the date of service. Providers who fail to produce medical records upon CMS request may face revocation of their Medicare enrollment.

CMS recognizes that physicians may rely on employers or other entities to maintain records on their behalf, but the physician remains ultimately responsible for ensuring records are available when requested.

Practical Impact

Because Colorado's hospital requirement (10 years) exceeds the CMS minimum (5 years), and Colorado's recommended physician retention (7 to 10 years) meets or exceeds the CMS physician requirement (7 years), Colorado providers who follow state law will automatically satisfy federal CMS requirements.

Patient Access to Medical Records in Colorado

Colorado law guarantees patients the right to inspect and obtain copies of their medical records under C.R.S. 25-1-801 (for health care facilities) and C.R.S. 25-1-802 (for individual health care providers).

Right to Inspect

Patients or their authorized personal representatives may inspect their medical records at reasonable times and with reasonable notice. Health care facilities and individual providers may not charge a fee for in-person inspection of records.

Copies and Fees

Colorado sets two different copy-fee rules depending on who is asking. Under C.R.S. 25-1-801 and C.R.S. 25-1-802, a copy provided to the patient or the patient's personal representative is billed at "the fee a covered entity may impose in accordance with the Health Insurance Portability and Accountability Act of 1996." That is the HIPAA reasonable, cost-based fee under 45 CFR 164.524(c)(4), which may cover only labor for copying, supplies, postage, and any summary the patient agreed to in advance. It is often less than the state schedule below.

The same statutes bill a third person who requests the records with a HIPAA-compliant authorization, a valid subpoena, or a court order at the "reasonable fees" rate. Those are the amounts defined in C.R.S. 25-1-800.3(3)(a):

This schedule is a ceiling for authorized third-party requesters such as attorneys, insurers, and disability representatives. Patients requesting their own records should be charged the HIPAA cost-based fee instead, and providers may not charge anything at all for an in-person inspection.

Electronic Records

If the original medical records are stored in electronic format and are readily producible electronically, the provider must deliver the records in electronic format when the patient requests it. This aligns with HIPAA's right of access provisions.

Response Timeline

Healthcare providers generally have 30 calendar days to respond to a medical records request. If a provider cannot act within that timeframe, they may extend the deadline by an additional 30 days with written notice to the patient.

Protected Information

Providers are not required to release certain sensitive records to parents or guardians without proper authorization. These protected categories include records related to:

• Sexually transmitted infections
• Substance use disorder treatment
• A minor's drug use

These records may only be released to the minor patient or their designee.

Medical Records Destruction in Colorado

Once the applicable retention period has expired, Colorado providers may destroy medical records, but must follow specific procedures.

Pre-Destruction Requirements

Colorado regulations require healthcare facilities to establish procedures for notifying patients whose records are scheduled for destruction before the destruction takes place. This notification gives patients the opportunity to request copies of their records.

Best practices for pre-destruction notification include:

• Sending written notice to the patient's last known address
• Allowing a reasonable response window (typically 60 to 90 days)
• Documenting all notification efforts
• Maintaining a written log of records that are destroyed

Acceptable Destruction Methods

Under both Colorado regulations and HIPAA, acceptable destruction methods for paper records include shredding, burning, pulping, or pulverizing the documents so that protected health information is rendered unreadable and cannot be reconstructed.

For electronic records, acceptable methods include degaussing magnetic media, physically destroying hard drives or storage devices, and using certified data wiping software that meets industry standards.

Certificates of Destruction

Providers who use third-party destruction services should obtain a certificate of destruction from the vendor as proof that records were properly destroyed. This documentation should be retained indefinitely as part of the practice's compliance records.

Practice Closure and Physician Retirement

When a Colorado physician retires, closes a practice, or otherwise stops seeing patients, specific obligations regarding medical records continue.

Colorado Medical Board Policy 40-8

The Colorado Medical Board's Policy 40-8 addresses guidelines for closure of or departure from a medical practice. Key requirements include:

Patient notification: Physicians must provide reasonable advance notice to patients, ideally 60 to 90 days before closing the practice. At minimum, patients seen within the previous two years should receive written notice.

Written notice content: The notification must explain the practice closure, the final date of operations, and the method by which patients can access or obtain their medical records going forward.

Records transfer: Patients should be instructed to submit a written authorization if they want their records transferred to another provider.

Continued retention: Even after closing a practice, the physician must ensure that medical records remain securely stored and accessible for the full retention period (7 to 10 years from the last date of service, or longer for minor patients).

Options for Record Storage After Closure

Colorado physicians closing a practice have several options for meeting their ongoing retention obligations:

• Practice sale: If the practice is sold to another physician or health system, medical records can be transferred as part of the sale. The purchase agreement should include the buyer's obligation to secure the records and provide patient access.
• Records custodian service: Professional medical records custodian companies can store and manage records for a fee, handling patient access requests and eventual destruction.
• Colleague arrangement: Another physician or medical organization can agree to securely store records and provide timely access for patient requests.

Disciplinary Consequences

Under C.R.S. 12-240-142, a physician must inform each patient in writing of the method by which the patient may access or obtain their medical records if the physician dies, retires, or otherwise ceases to practice or provide care. A physician who fails to meet this notice duty may be subject to disciplinary action by the Colorado Medical Board under its general disciplinary authority (C.R.S. 12-240-125), which can include fines, license restrictions, or other sanctions.

Summary of Colorado Medical Records Retention Periods