Department Policy 2.17 Open Records

Created February 2003
Revised August 2017
Approved by Dr. Larry Wolk, Executive Director and Chief Medical Officer, August 2017

Summary

The Colorado Department of Public Health and Environment shall provide copies of public records in accordance with the Colorado Open Records Act and Colorado Revised Statutes (C.R.S.) § 24-72-201 et seq., within a reasonable time frame and within the cost guidelines specified by the act.

The act requires governmental organizations to provide the public with timely access to public records “made, maintained or kept” by the organization. While defining public records broadly and including in that definition paper and electronic records, the act allows for withholding or exempting from disclosure certain categories of records, such as medical records and personnel records as defined in the act. The act further requires organizations to make records available for inspection within three working days of receiving the request, although an extension of seven working days may be taken for extenuating circumstances.

Purpose

This policy sets forth the requirements for responding to records requests made pursuant to the act, including:

  • When responses must be coordinated through the Office of Legal and Regulatory Compliance.
  • When charging costs is appropriate.
  • The format in which documents may be produced.

Definitions

Digital format means content stored in a file that can be opened by a computer, such as a Word document or an Excel spreadsheet. Digital format does not include a database.

Public record means any and all writings made, maintained or kept by the department. Public records include paper records as well as electronic records such as email, Google Docs and Google Drive records, whether maintained on state-operated or personal servers or devices, through a third party vendor, or in the cloud.

Public records do not include:

  • Criminal justice records.
  • Work product prepared for elected officials.
  • The information security plan of a public agency developed pursuant to § 24-37.5-404, C.R.S.
  • Information security incident reports prepared pursuant to § 24-37.5-404(2)(e) or 24-37.5-404.5(2)(e), C.R.S.
  • Information security audit and assessment reports prepared pursuant to § 24-37.5-403(2)(d) or 24-37.5-404.5(2)(d), C.R.S.

Work product means all intra- or interagency advisory or deliberative materials assembled for the benefit of elected officials that express an opinion or are deliberative in nature and are communicated for the purpose of assisting such elected officials in reaching a decision within the scope of their authority. Such materials include but are not limited to the following:

  • Notes and memoranda that relate to or serve as background information for such decisions.
  • Preliminary drafts and discussion copies of documents that express a decision by an elected official.
  • All documents related to the drafting of bills or amendments, pursuant to § 2-3-304(1) or 2-3-505(2)(b), C.R.S.
  • All documents prepared or assembled by a member of the General Assembly relating to the drafting of bills or amendments.
  • All documents prepared by or submitted to any legislative staff member in connection with assisting a member of the General Assembly with responding to the correspondence of a constituent when such correspondence is not a public record of an elected official as provided for in Policy 6.3 Interacting With Elected Officials.

Policy

Division records managers

Each division of the department shall designate one or more individuals to respond on behalf of the division to all requests for records pursuant to the act. Each division is responsible for responding to requests for records within the division, and may request assistance from the Office of Legal and Regulatory Compliance as needed.

Production of records

  • Existing records: The act does not require creation of, and the department does not create, records to respond to a CORA request. The act permits the manipulation of data to respond to a request, e.g., creating and pulling a report from a database to fulfill a request. Prior to undertaking the manipulation of data, the responding division shall provide the requester with an estimate of costs as described in the Procedure section of this policy.
  • Unmodified records: No employee may modify, redact or omit any records he or she is required to provide unless the redaction or withholding of the record occurs pursuant to item C below. However, when the department has multiple documents that are responsive to a request, the documents may be combined into a single electronic file (PDF).
  • Withholding records: Some information maintained by the department shall not be released due to its confidential and/or privileged status. Examples of documents that may be withheld include the following:
    • Investigatory records may be withheld while the investigation is occurring. The act requires release of investigatory records if the request is received after the investigation is complete unless the information remains confidential under another statute. The act allows for names or other personal identifying or financial information of witnesses or targets of such closed investigations to be removed prior to release.
    • Medical records.
    • Records responsive to a request from “a person in interest” to access his/her information held by the department may be released only to that individual upon receipt of an original, notarized request for such records.
    • Personnel files, but such files shall be available to the “person in interest” upon receipt of proof of identity.
    • Trade secrets; privileged information; and confidential commercial, financial, geological or geophysical data, including social security numbers.
    • Specialized details of security arrangements or investigations.
    • Deliberative process privileged information.
    • Specific state statutes may further limit the information the department may release.

Records format

The act guarantees that “all public records shall be open for inspection by any person at reasonable times, except as provided in part 2 of article 72, title 24, C.R.S. or as otherwise specifically provided by law,” § 24-72-201, C.R.S.

The act does not guarantee access to documents in a specific format, except as specified below. When the production of records in a specific format would interfere with the regular discharge of duties of department employees (§ 24-72-203(1)(a), C.R.S.) or levy an undue burden upon the department, the division records manager shall determine the appropriate format.

Records maintained electronically, at the department’s discretion, may be provided in their native format. Records stored in a digital format shall be provided in a digital format.

Records stored in a digital format that is searchable shall be provided in a searchable format, and records stored in a digital format that is sortable shall be provided in a sortable format, unless any of the following exceptions applies:

  • Producing the record in the requested format would violate the terms of any copyright or licensing agreement.
  • Producing the record in the request format would result in the release of a third party’s proprietary information.
  • After reasonable inquiry it is determined that:
    • It is not technologically or practically feasible to permanently remove information that is required or permitted to be withheld.
    • It is not technologically or practically feasible to provide a copy of the record in a searchable or sortable format.
    • Producing the record in a searchable or sortable format would require the purchase of software, or the creation of additional programming or functionality in existing software, to remove information that is required or permitted to be withheld.

Records distributed electronically shall be in PDF format, unless the division records manager determines the record’s native format is necessary.

When the department has multiple documents that are responsive to a request, the documents may be combined into a single PDF.

Nonclient-specific records may be distributed via email or on a compact disc. If available, at the records managers’ discretion, file transfer protocol (FTP) may be used.

Client-specific records authorized via a release or to a “person in interest” shall be sent via certified mail to protect confidential client information.

Procedure

Upon receipt of a request for records pursuant to the act, the responding division shall identify responsive records, review the records to determine which records may be released, work with the Office of Legal and Regulatory Compliance as appropriate, and respond in a timely manner to the request for records.

Identification of responsive records

Upon receipt of a request for records pursuant to the act, the responding division shall:

  • Determine if the division has responsive records.
  • Assess whether the request should be forwarded to the Office of Legal and Regulatory Compliance to coordinate the response, in accord with section 3 below.
  • Assess whether the work of collecting and reviewing responsive records will exceed one hour, in which case the responding division or the Office of Legal and Regulatory Compliance, if applicable, shall send an estimate of costs to the requester in accord with the “Timely response to records requests” section below.

Review of responsive records

Prior to releasing any information pursuant to a request for records, the responding division shall review the records requested to determine if any exemptions or privileges justifying withholding the document apply, confirming any withholding of responsive records with either the Office of Legal and Regulatory Compliance or an attorney from the Office of the Attorney General.

Office of Legal and Regulatory Compliance

Prior to responding, the responding division shall inform the Office of Legal and Regulatory Compliance of any of the following types of record requests:

  • Records pertaining to current or pending litigation.
  • Records that must be produced in a modified format to avoid interfering with the regular duties of department employees or creating an undue burden on the agency.
  • Issues deemed sensitive by the executive management of the agency.
  • Records pertaining to more than one division.

The Office of Legal and Regulatory Compliance may assist in coordinating the responses to such requests.

Costs associated with record requests

  • Copying costs: When the number of pages produced pursuant to the act exceeds 25, the department shall charge $.25 per page for all documents copied.
  • Record production costs: If researching, retrieving, reviewing and producing records consumes more than one hour of staff time, the department shall charge $30 an hour for all staff time associated with locating and producing records for a requester. The department also may charge the actual per-box retrieval fees for retrieving responsive records that are stored offsite by a vendor. Large document requests may be sent to the state’s contracted vendor, who will provide a cost estimate to the requester.
  • Attorney General review costs: When review from the Attorney General’s Office is necessary to ensure redaction or withholding is appropriate under the CORA statute, the cost of reviewing documents is limited to $30 per hour. Department staff will coordinate with the Attorney General’s Office and include its review time in any estimate and any invoice for responding to the record request.
  • Data manipulation costs: In some instances, the department does not have a responsive record but a division may offer to create a record as a customer service. Note that altering an existing public record or excising fields of information to remove information that is either required or permitted to be withheld does not constitute data manipulation and/or the creation of a new public record.  When creating the record requires staff to manipulate existing databases or data elements to generate the document, or when specialized document production or specialized skills are required to produce records pursuant to a records request (including the use of third-party contractors), the department may charge the actual costs associated with the manipulation of data. Any cost charged to a requester shall not exceed the actual cost of producing the records, in accordance with § 24-72-205(3), C.R.S. While actual costs can be charged, in instances where the data manipulation is minimal, divisions are encouraged to create the document at no charge as a customer service. To effectively communicate with a requester, the response to the CORA request is to inform the requester that the department has no responsive records and notify the requester of the process for submitting a request for data manipulation, the fees for creating the record and the estimated timeframe for the response.
  • Electronic records: Electronically stored information may be transmitted free of charge if the file size is under the department’s current maximum file size limitation. Files exceeding the department’s electronic file size limit may be copied to a compact disc for a cost of $10 per disc, or copied to a USB flash drive charged to the requestor at the actual cost paid by the department. Portable external drives and portable storage devices supplied by the requester shall not be used. If available, at the records manager’s discretion, file transfer protocol (FTP) may be used. At the records manager’s discretion, Google Drive may be used as a method for sharing files with the requester; however, the following guidelines must be strictly adhered to:
    • Confidential or client-specific records shall not be uploaded or shared in Google Drive; instead, these files shall be sent via certified mail.
    • Files that are uploaded and shared in Google Drive in response to a CORA request must be properly destroyed after the agreed-upon time the requester has been given to access them, not to exceed one week. Proper destruction of files in Google Drive requires that all the following activities be performed:
      • Removal of sharing rights (unsharing the files) with the requester.
      • Deletion of the files from the location where they are saved (i.e., My Drive or other folders).
      • Deletion of the files from the Google Drive trash.
  • Remitting payment: The responding division shall instruct the requester to issue a check or money order payable to the Colorado Department of Public Health and Environment. All checks and monies received shall be given to the Fiscal Unit in Administration. Upon request, the responding division also may provide the requester with the contact information for the Accounts Receivable Unit in Accounting to make a credit card payment.

Timely response to record requests

  • Required three-day response. The three working-day response time begins the first working day following receipt of a written records request. A request received after 5 p.m. or any day the office is officially closed will be considered received as of the following working day. Within three working days of a request, the responding division shall either inform the requester of estimated costs associated with responding to the request, inform the requester if extenuating circumstances exist, or provide copies of or access to records.
    • Cost estimates: When costs will be assessed as described in the “Costs associated with records requests” section above, the responding division shall provide a cost estimate and inform the requester that records shall not be copied or compiled until the estimated costs are paid. Upon receipt of payment, staff will begin working on copying or compiling the records. An estimate of costs is considered a response to the request as it informs the requestor of the process for obtaining responsive records.
    • Extenuating circumstances: If extenuating circumstances exist, as defined by § 24-72-203, C.R.S., the responding division may extend the three-day response period up to seven additional working days. Each division that finds the existence of extenuating circumstances shall inform the requester of the extended response timeframe in writing within the original three-day response period.
    • Requests from the media: Prior to responding to a records request from the media, the responding division shall inform the Office of Communications of all such public records requests.

Content of response

The responding division shall offer to either schedule a review of its public records with the requester, or provide copies in either electronic or paper format of the responsive records upon receipt of payment by the requester.

If the responding division has public records stored in a digital format that the requester has sought release of in a digital, searchable and/or sortable format, and the responding division has determined that such release will not occur in accord with the requirements of the Records Format section of this policy, the responding division shall either produce the records in an alternate format or issue a denial of the request, and provide a written declaration attesting to the reasons why the records are not being produced in the requested format. The attestation is completed by the person who determined and understands why the record cannot be produced in the requested format. The attestation is provided with the response. The attestation does not need to be notarized or certified.

If the responding division has public records that are withheld from release due to their confidential and/or privileged status, the division shall so inform the requester.

The responding division shall notify the requester if the requested records are not in the custody of the department. If the location of such unavailable requested records is known, the division shall provide the requester with the relevant information, such as location, contact name, address and phone number.

Challenges to responses to record requests

Each division shall inform the Office of Legal and Regulatory Compliance of any legal challenges that a requester makes to a division’s denial of access to records.

If a requester files with the responding division or department a written notice of intent to file an application with the district court after 14 days to seek an order directing the department to produce the records, the responding division shall, within 14 calendar days of receipt of such notice, meet in person or participate on a call with the requester to determine if the dispute can be resolved without filing an application with the district court. 

If a requester files with the responding division or department a written notice of intent to file an expedited application with the district court after three days to seek an order directing the department to produce the records, the responding division may, within three calendar days of receipt of such notice, meet in person or participate on a call with the requester to determine if the dispute can be resolved without filing an application with the district court.