Colorado gives practices 30 days to notify affected residents of a breach and requires attorney general notice for larger breaches, even when you are also notifying under HIPAA. Colorado also has new rules for biometric data such as fingerprint time clocks.
AT A GLANCE
| Laws | C.R.S. § 6-1-716 (breach notification); Colorado Privacy Act, including biometric rules added by HB24-1130 (effective July 1, 2025) |
|---|---|
| Data covered | Includes medical information about mental or physical treatment or diagnosis, and health insurance ID numbers |
| Notice to individuals | No later than 30 days after determining a breach occurred |
| Attorney general | Required for 500 or more Colorado residents, within the same 30 days |
| Credit bureaus | Required if more than 1,000 residents are notified |
| HIPAA entities | Following your federal regulator's breach procedures counts as compliance if it meets Colorado's timing, but you must still notify the attorney general |
| Enforcement | Attorney general. No private right of action |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Notify affected Colorado residents no later than 30 days after determining a breach occurred, and the attorney general within the same window if 500 or more residents are affected.
Following your federal regulator's procedures can satisfy Colorado's resident notice if it meets the 30-day timing, but you still need to notify the attorney general.
Sources: Davis Wright Tremaine: Colorado · Constangy: Colorado summary · Venable: Colorado biometric amendment. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to an analyst.
