← Colorado medical records custodian and retention laws

Colorado — Medical Records Checklist

For a practice that is closing, being sold, relocating or whose physician is retiring. Prepared 21 September 2026.

How long records must be kept

Adult patients: The Colorado Medical Board RECOMMENDS a minimum of 7 years. It is guidance, not a requirement - but see the written-plan duty below, which is statutory.
Patients who were minors: 7 years after the patient reaches age 18, if that is later than 7 years from the last treatment.
Clock starts: The last date of treatment, or the patient's 18th birthday - whichever gives the later date.
Also: In litigation or a Board investigation, records must be kept until the matter is resolved, or for those same seven-year periods, whichever is later.
Also: X-rays, fetal monitor strips and electrocardiograms count as part of the record even when they are not physically filed with it.
Also: Copies of all images should be provided with a records request unless the patient specifically consents not to receive them.

Colorado's binding duty is not the retention period - it is the written plan required by C.R.S. 12-240-142, which every licensee attests to at each licence renewal.

Before you close — what this state requires

C.R.S. 12-240-142, VIA POLICY 40-07 PART I(A) - THE DUTY THAT IS NOT OPTIONAL: 'each licensed physician and physician assistant must develop a WRITTEN PLAN to ensure the security of patient records', and 'A licensee shall ATTEST AT THE TIME OF LICENSE RENEWAL that he or she has developed a plan in compliance with section 12-240-142, C.R.S.' Colorado therefore joins Utah and North Dakota: the arrangement has to exist BEFORE anything happens, and it is certified to the state on a recurring basis.
40-07 part I(B): 'A licensee shall provide WRITTEN NOTICE TO EACH PATIENT detailing the method by which the patient may access or obtain his or her medical records IN THE EVENT THE LICENSEE DIES, RETIRES, OR OTHERWISE CEASES TO PROVIDE MEDICAL CARE TO PATIENTS.' Not a notice given at closure - a notice given in advance, to every patient.
40-07 part I(D)(1): at the time of discontinuation of practice, patients should be notified and instructed to submit a written authorisation or release if they wish their records transferred to another provider; records should be retained after discontinuation using the same guidelines.
40-07 part I(D)(2): on disability or death the Board expects associations, specialty societies, malpractice carriers and Colorado practitioners to assist in distributing records IN ACCORDANCE WITH THE WRITTEN PLAN - and then states the limit plainly: 'UNDER NO CIRCUMSTANCES will the Board take possession of the records or assume responsibility for record security or distribution.' Colorado explicitly refuses to be the backstop, which is precisely why the written plan has to name someone real.
POLICY 40-08, 'Guidelines for Departure from a Medical Practice', issued 10 August 2000, last revised 21 November 2019: patients must be notified of changes in the practice - best done by letter to patients currently or recently under care - explaining the changes and THE FINAL DATE OF PRACTICE.
40-08, and it ties the two policies together: 'In accordance with the requirements of Section 12-240-142, C.R.S, patients are ADVISED AS TO WHERE THEIR MEDICAL RECORDS WILL BE STORED, AND HOW THEY MAY ACCESS THOSE RECORDS.' Patients must also be told how to reach the providers remaining in the practice, and that the choice of provider is theirs.
40-08: providers continue to have obligations toward patients during and after departure, and may not abandon a patient or abruptly withdraw.

What you may charge for copies

A reasonable copying fee may be charged, and payment may be requested in advance.
The Board treats the CDPHE facility copy-cost rules as reasonable guidelines for physicians.
It is customary to send records to another provider free of charge when a patient transfers care.
Where a patient cannot or chooses not to pay, the provider must at minimum make the records available for inspection or otherwise provide access.
Turnaround: except where medical urgency requires faster, 30 days is reasonable notice for a records request.

Where this comes from

Colorado Medical Board Policy 40-07, Guidelines Pertaining to the Retention and Release of Medical Records (issued 10 Feb 2000, last revised 21 Nov 2019)
https://dpo.colorado.gov/Medical
Colorado Medical Board Policy 40-08, Guidelines for Departure from a Medical Practice (last revised 21 Nov 2019)
https://dpo.colorado.gov/Medical
C.R.S. 12-240-142 (written plan to ensure the security of patient records)
https://leg.colorado.gov/

Read this before you act on it. Every statement above was taken from the state's own published rule or statute and is quoted or closely paraphrased from it. It is a working checklist, not legal advice, and it is a snapshot: retention periods change, and several states adjust their copying fees every year. Confirm the current text with the source listed above, or with your attorney, before you rely on a date or a dollar figure.

Figures stated as of: Board policies as revised 21 November 2019. Verified September 2026

Prepared by Morgan Records Management for Colorado. Checklist built 21 September 2026.