18-4-412. Theft of medical records or medical information - penalty - definitions.

Statute text

(1) Any person who, without proper authorization, knowingly obtains a medical record or medical information with the intent to appropriate the medical record or medical information to his own use or to the use of another, who steals or discloses to an unauthorized person a medical record or medical information, or who, without authority, makes or causes to be made a copy of a medical record or medical information commits theft of a medical record or medical information.

(2) As used in this section:

(a) "Medical record" means the written or graphic documentation, sound recording, or computer record pertaining to medical, mental health, and health-care services, including medical marijuana services, performed at the direction of a physician or other licensed health-care provider on behalf of a patient by physicians, dentists, nurses, service providers, emergency medical service providers, mental health professionals, prehospital providers, or other health-care personnel. "Medical record" includes such diagnostic documentation as X rays, electrocardiograms, electroencephalograms, and other test results. "Medical record" includes data entered into the prescription drug monitoring program under section 12-280-403.

(b) "Medical information" means any information contained in the medical record or any information pertaining to the medical, mental health, and health-care services performed at the direction of a physician or other licensed health-care provider which is protected by the physician-patient privilege established by section 13-90-107 (1)(d), C.R.S.

(c) "Proper authorization" means:

(I) A written authorization signed by the patient or his or her duly designated representative; or

(II) An appropriate order of court; or

(III) Authorized possession pursuant to law or regulation for claims processing, possession for medical audit or quality assurance purposes, possession by a consulting physician to the patient, or possession by hospital personnel for record-keeping and billing purposes; or

(IV) Authorized possession pursuant to section 18-3-415, 18-3-415.5, 25-1-122, or 30-10-606 (6), C.R.S.; or

(V) Authorized possession by a law enforcement officer or agency, acting in official capacity and pursuant to an official investigation.

(d) "Copy" means any facsimile, replica, photograph, sound recording, magnetic or electronic recording, or other reproduction of a medical record and any note, drawing, or sketch made of or from a medical record.

(3) Theft of a medical record or medical information is a class 1 misdemeanor; except that if the person steals or discloses the medical record or information to an unauthorized person, it is a class 5 felony.

(4) The obtaining, accessing, use, or disclosure of relevant medical records or medical information pursuant to 18 U.S.C. sec. 922 (t) and sections 24-33.5-424, 13-5-142, and 13-9-123, C.R.S., by the Colorado bureau of investigation, the clerk of the court of any judicial district in the state, the clerk of the probate court of the city and county of Denver, or by any of their employees and accessing such records and information through the NICS system shall not constitute theft of a medical record or medical information under this section.

(5) This section shall not apply to covered entities, their business associates, or health oversight agencies as each is defined in the federal "Health Insurance Portability and Accountability Act of 1996" as amended by the federal "Health Information Technology for Economic and Clinical Health Act" and the respective implementing regulations.

History

Source: L. 79: Entire section added, p. 727, 6, effective July 1. L. 89: (3) amended, p. 834, 47, effective July 1. L. 99: (2)(c) amended, p. 1003, 11, effective May 29. L. 2000: (4) added, p. 12, 4, effective March 7; (2)(a) amended, p. 545, 22, effective July 1. L. 2001: (2)(c)(IV) amended, p. 736, 6, effective July 1. L. 2002: (4) amended, p. 756, 3, effective January 1, 2003. L. 2003: (2)(c)(IV) amended, p. 1021, 2, effective April 17; (5) added, p. 1785, 20, effective July 1. L. 2007: (2)(a) and (2)(b) amended, p. 1689, 9, effective July 1. L. 2010: (2)(c)(V) added and (5) amended, (SB 10-167), ch. 296, p. 1399, 15, 16, effective May 26. L. 2011: (2)(a) amended, (SB 11-192), ch. 230, p. 987, 12, effective July 1; (2)(a) amended, (HB 11-1043), ch. 266, p. 1214, 27, effective July 1. L. 2012: (2)(a) amended, (HB 12-1059), ch. 271, p. 1436, 15, effective July 1; (2)(a) amended, (HB 12-1311), ch. 281, p. 1619, 44, effective July 1. L. 2016: (2)(c)(IV) amended, (SB 16-146), ch. 230, p. 918, 11, effective July 1. L. 2019: (2)(a) amended, (HB 19-1172), ch. 136, p. 1675, 94, effective October 1. L. 2023: (3) amended, (HB 23-1293), ch. 298, p. 1785, 13, effective October 1.

Annotations

Editor's note: (1) Amendments to subsection (2)(a) by House Bill 11-1043 and Senate Bill 11-192 were harmonized. Amendments to subsection (2)(a) by House Bill 12-1059 and House Bill 12-1311 were harmonized.

(2) Section 77 of chapter 298 (HB 23-1293), Session Laws of Colorado 2023, provides that the act changing subsection (3) applies to offenses committed on or after October 1, 2023.

Annotations

Cross references: (1) For the legislative declaration contained in the 2000 act enacting subsection (4), see section 1 of chapter 5, Session Laws of Colorado 2000. For the legislative declaration in the 2010 act adding subsection (2)(c)(V) and amending subsection (5), see section 1 of chapter 296, Session Laws of Colorado 2010.

(2) For the "Health Insurance Portability and Accountability Act of 1996", see Pub.L. 104-191, codified at 42 U.S.C. sec. 201 et seq. For the "Health Information Technology for Economic and Clinical Health Act", see Pub.L.111-5.

Annotations

 

ANNOTATION

Annotations

Law reviews. For article, "The Authorization to Release Medical Information Form: Its Genesis and Usage", see 11 Colo. Law. 1179 (1982). For article, "The Legal Risks of AIDS: Moving Beyond Discrimination", see 18 Colo. Law. 606 (1989).

The term "theft" in 18-4-405 refers to "theft" within the meaning of 18-4-401 and does not encompass the theft of medical records or medical information under subsection (1) of this section. Winninger v. Kirchner, 2021 CO 47, 488 P.3d 1091.

Employment-required drug tests and physical ability tests do not fall under the definition of either medical record or medical information as defined in subsection (2), thus, the defense failed to establish a prima facie case of theft of the defendant's medical records. People v. Palomo, 31 P.3d 879 (Colo. 2001).