Can I collect health information from participants in Colorado? What are the requirements?

Health Information Collection Requirements in Colorado

If you are collecting health information from participants in Colorado, you must comply with the HIPAA Privacy Rule, the Colorado Medical Privacy Act, and other applicable laws and regulations.

The HIPAA Privacy Rule establishes national standards for the protection of individuals’ medical records and other personal health information. Covered entities, including healthcare providers, health plans, and healthcare clearinghouses, must comply with the Privacy Rule’s requirements when collecting, using, and disclosing health information [1].

The Colorado Medical Privacy Act requires healthcare providers to obtain written consent from patients before disclosing their medical information to third parties, except in certain circumstances [2].

The Colorado Consumer Data Privacy Act (CDPA), which goes into effect on July 1, 2023, requires businesses that collect, process, or store personal data of Colorado residents to comply with certain requirements, including providing notice to individuals about the collection and use of their data and obtaining their consent for certain types of data processing [3].

Other state and federal laws may also apply to the collection of health information, depending on the circumstances.

In addition, the Colorado Department of Public Health and Environment has established minimum standards for the operation of behavioral health entities within the state, which includes requirements for consumer assessment, care coordination, patient rights, and consumer notice requirements, administrative and operational standards for governance, consumer records and record retention, personnel, admission, and discharge criteria, policies and procedures, and quality management [4].

Conclusion

To collect health information from participants in Colorado, you must comply with the HIPAA Privacy Rule, the Colorado Medical Privacy Act, the Colorado Consumer Data Privacy Act, and other applicable laws and regulations. It is important to consult with legal counsel to ensure that your data collection practices are in compliance with these requirements.

[1] [2.1] [2] [1.2] [3] [1.3] [4] [2.2]

Jurisdiction

Colorado

• Privacy