Theft of Medical Records – Colorado Law – CRS 18-4-412

In Colorado, possession of another individual’s medical records without authorization is a criminal offense. This includes stealing, disclosing, or making a copy of someone else’s medical records without authority.

Theft of medical records is usually a class 1 misdemeanor, carrying 364 days in jail and/or a fine of up to $1,000. Stealing or disclosing the medical record or information to an unauthorized person is a class 5 felony carrying 1 to 3 years in prison and/or $1,000 to $100,000.

In this article, our Colorado criminal defense lawyers will address:

• 1. What is the theft of medical records in Colorado?
• 2. What medical records are included?
• 3. Do you have authorization to obtain medical records?
• 4. What are the penalties for theft of medical records?
• 5. Related Offenses

1. What is theft of medical records in Colorado?

Theft of medical records in Colorado involves obtaining medical records or medical information of another individual without authorization. This includes stealing or disclosing to an unauthorized person another person’s medical records or medical information or making a copy of medical records.¹

Medical records contain very private information about a person that they have an interest in keeping from the public or even from people they know. This includes medications, health outlook, medical history, history of drug or alcohol abuse, sexual history, family medical history, and personal contact information.

There may be a number of reasons why someone would want to see another person’s medical records. Someone may want to know whether someone has a sexually transmitted disease or other communicable disease. An individual may want to use this information to blackmail someone for money or use this information for his or her own use.

Medical records may also be stolen through hacking a hospital’s computer systems. Medical records contain a substantial amount of personal and financial information, including billing addresses and Social Security Numbers. This information may be valuable to commit medical fraud by billing insurance companies or buying medical equipment or drugs.

2. What medical records are included?

Medical records and medical information include paper and electronic documents associated with medical, mental health, and health care services. In Colorado, medical information may also include medical marijuana services. Medical records include services performed at the direction of a physician or other licensed health care provider on behalf of a patient by:

• Physicians
• Dentists
• Nurses
• Emergency medical service providers
• Mental health professionals
• Prehospital providers
• Or other health care personnel

This includes diagnostic records, including X-rays, EKGs, drug tests, pregnancy tests, blood tests, biopsies, genetic testing, and other test results.²

3. Do you have authorization to obtain medical records?

There may be legitimate reasons why a person would have another individual’s medical records. A patient may be ill and want a family member to take medical records to a doctor or hospital. It is only a criminal offense to obtain medical information “without proper authorization.” Proper authorization includes:

1. A written authorization signed by the patient or the patient’s designated representative;
2. An appropriate order from a court;
3. Authorized possession under law or regulations for claims processing, medical audits, quality assurance purposes, possession by a consulting physician, or possession by hospital personnel for record-keeping and billing purposes;
4. Testing for sexually transmitted diseases for persons charged with sexual offense crimes; or
5. Authorized possession by a law enforcement agency while acting in their official capacity during an official investigation.³

4. What are the penalties for theft of medical records?

Theft of medical records is usually a class 1 misdemeanor, carrying

• 364 days in jail and/or
• a fine of up to $1,000.

Stealing or disclosing the medical record or information to an unauthorized person is a class 5 felony, carrying

• 1 to 3 years in prison and/or
• $1,000 to $100,000.⁴

5. Related Offenses

Computer Crimes C.R.S. 18-5.5-102

Computer crimes cover a variety of criminal offenses that involve the use of a computer or the internet. This includes unlawful access of a computer system, theft using a computer, or use of a computer to cause damage. Computer crime may be a misdemeanor or a felony, depending on the type of crime involved and the amount of damage caused.

Theft C.R.S. 18-5-902

In Colorado, the penalties for theft or fraud depend on the value of theft and the victim. Theft of property valued at less than $300 is a petty offense. Theft of property valued at $300 to less than $2,000 is a misdemeanor. However, theft or fraud of $2,000 or more is a felony offense. Penalties for theft can include jail time, fines, and a mandatory parole period.

Identity Theft C.R.S. 18-5-902

In Colorado, it is a criminal offense to use another person’s personal or financial identifying information to obtain anything of value. This includes using another person’s identity to file a claim for workers’ comp benefits. Identity theft can be a felony or a misdemeanor.

---

Legal References