Custodian Of Medical Records Laws in Colorado

Colorado

Medical Records Custodian & Retention Laws

Are you planning to close your medical practice or retire?
Morgan Records Management (MRM) is the top choice for managing medical records in the US, and we’re here to help! Our team will guide you through every step of the process to ensure a smooth transition.

Morgan Records Management:

Has over 25 years of experience with Providers in ALL 50 States!
Handles 3,000-4,000 Patient Record Requests a month
Manages over 1,500 Physician Practices Nationwide
Assists in Notifying Patients of the Practice Closing - Via Email and Closing Practice Letters
Offers Secure Physical and or Digital Storage of Records
Is Fully HIPAA Compliant
Is Responsible for over 15 million Patient Records
Assumes Custody of Physician’s Website and Handles all Patient Communications

Colorado Medical Record Retention Law:
Colorado Medical Board Policy 40-07, Guidelines Pertaining to the Retention and Release of Medical Records (issued 10 Feb 2000, last revised 21 Nov 2019)

Adult patients: The Colorado Medical Board RECOMMENDS a minimum of 7 years. It is guidance, not a requirement - but see the written-plan duty below, which is statutory.
Patients who were minors: 7 years after the patient reaches age 18, if that is later than 7 years from the last treatment.
The retention period runs from: The last date of treatment, or the patient's 18th birthday - whichever gives the later date.
In litigation or a Board investigation, records must be kept until the matter is resolved, or for those same seven-year periods, whichever is later.
X-rays, fetal monitor strips and electrocardiograms count as part of the record even when they are not physically filed with it.
Copies of all images should be provided with a records request unless the patient specifically consents not to receive them.

Colorado's binding duty is not the retention period - it is the written plan required by C.R.S. 12-240-142, which every licensee attests to at each licence renewal.

If you are closing, selling or relocating your practice
Colorado sets out what has to happen to patient records. The points below are taken from the source above.

C.R.S. 12-240-142, VIA POLICY 40-07 PART I(A) - THE DUTY THAT IS NOT OPTIONAL: 'each licensed physician and physician assistant must develop a WRITTEN PLAN to ensure the security of patient records', and 'A licensee shall ATTEST AT THE TIME OF LICENSE RENEWAL that he or she has developed a plan in compliance with section 12-240-142, C.R.S.' Colorado therefore joins Utah and North Dakota: the arrangement has to exist BEFORE anything happens, and it is certified to the state on a recurring basis.
40-07 part I(B): 'A licensee shall provide WRITTEN NOTICE TO EACH PATIENT detailing the method by which the patient may access or obtain his or her medical records IN THE EVENT THE LICENSEE DIES, RETIRES, OR OTHERWISE CEASES TO PROVIDE MEDICAL CARE TO PATIENTS.' Not a notice given at closure - a notice given in advance, to every patient.
40-07 part I(D)(1): at the time of discontinuation of practice, patients should be notified and instructed to submit a written authorisation or release if they wish their records transferred to another provider; records should be retained after discontinuation using the same guidelines.
40-07 part I(D)(2): on disability or death the Board expects associations, specialty societies, malpractice carriers and Colorado practitioners to assist in distributing records IN ACCORDANCE WITH THE WRITTEN PLAN - and then states the limit plainly: 'UNDER NO CIRCUMSTANCES will the Board take possession of the records or assume responsibility for record security or distribution.' Colorado explicitly refuses to be the backstop, which is precisely why the written plan has to name someone real.
POLICY 40-08, 'Guidelines for Departure from a Medical Practice', issued 10 August 2000, last revised 21 November 2019: patients must be notified of changes in the practice - best done by letter to patients currently or recently under care - explaining the changes and THE FINAL DATE OF PRACTICE.
40-08, and it ties the two policies together: 'In accordance with the requirements of Section 12-240-142, C.R.S, patients are ADVISED AS TO WHERE THEIR MEDICAL RECORDS WILL BE STORED, AND HOW THEY MAY ACCESS THOSE RECORDS.' Patients must also be told how to reach the providers remaining in the practice, and that the choice of provider is theirs.
40-08: providers continue to have obligations toward patients during and after departure, and may not abandon a patient or abruptly withdraw.

Colorado closing-practice checklist
The same requirements as a checklist you can print and work through, with the retention periods, the notice each rule requires and what you may charge for copies.
Open the Colorado checklist →

Cost

A reasonable copying fee may be charged, and payment may be requested in advance.
The Board treats the CDPHE facility copy-cost rules as reasonable guidelines for physicians.
It is customary to send records to another provider free of charge when a patient transfers care.
Where a patient cannot or chooses not to pay, the provider must at minimum make the records available for inspection or otherwise provide access.
Turnaround: except where medical urgency requires faster, 30 days is reasonable notice for a records request.

Board policies as revised 21 November 2019. Verified September 2026

Also referred to above
Colorado Medical Board Policy 40-08, Guidelines for Departure from a Medical Practice (last revised 21 Nov 2019)
C.R.S. 12-240-142 (written plan to ensure the security of patient records)

This page summarises the source above and is not legal advice. Retention periods change and several states adjust their copying fees every year, so confirm the current text before you rely on a date or a figure.