Department Policy 2.17 Open Records | Colorado Department of Public Health and Environment

Created February 2003
Revised August 2015, August 2017
Approved by Jill Hunsaker Ryan, MPH, Executive Director, July 2024

Summary

The Colorado Department of Public Health and Environment shall provide copies of public records in accordance with the Colorado Open Records Act and Colorado Revised Statutes (C.R.S.) § 24-72-201 et seq., within a reasonable time frame and within the cost guidelines specified by the Act.

The Act requires governmental organizations to provide the public with timely access to public records “made, maintained or kept” by the organization. While defining public records broadly and including in that definition paper and electronic records, the Act allows for withholding or exempting from disclosure certain categories of records, such as medical records and personnel records as defined in the Act. The Act further requires organizations to make records available for inspection within three working days of receiving the request, although an extension of seven working days may be taken for extenuating circumstances.

Purpose

This policy sets forth the requirements for responding to records requests made pursuant to the Act, including:

When responses must be coordinated through the Office of Legal and Regulatory Compliance
When charging costs is appropriate
The format in which documents may be produced

Definitions

Digital format means content stored in a file that can be opened by a computer, such as a text document, spreadsheet, or PDF file. Digital format does not include a database.

Person means and includes any natural person, including any public employee and any elected or appointed public official acting in an official or personal capacity, and any corporation, limited liability company, partnership, firm, or association.

Person in interest means and includes the person who is the subject of a record or any representative designated by said person; except that, if the subject of the record is under legal disability, "person in interest" means and includes their parent or duly appointed legal representative.

Public record means any and all writings made, maintained or kept by the department. Public records include paper records as well as electronic records such as email, Google Docs and Google Drive records, whether maintained on state-operated or personal servers or devices, through a third party vendor, or in the cloud.

Public records do not include:

Criminal justice records.
Work product prepared for elected officials.
The information security plan of a public agency developed pursuant to § 24-37.5-404, C.R.S.
Information security incident reports prepared pursuant to § 24-37.5-404(2)(e) or 24-37.5-404.5(2)(e), C.R.S.
Information security audit and assessment reports prepared pursuant to § 24-37.5-403(2)(d) or 24-37.5-404.5(2)(d), C.R.S.
Records that are excluded from release pursuant to other state statutes.

Work product means all intra- or interagency advisory or deliberative materials assembled for the benefit of elected officials that express an opinion or are deliberative in nature, and are communicated for the purpose of assisting such elected officials in reaching a decision within the scope of their authority. Such materials include but are not limited to the following:

Notes and memoranda that relate to or serve as background information for such decisions.
Preliminary drafts and discussion copies of documents that express a decision by an elected official.
All documents related to the drafting of bills or amendments, pursuant to § 2-3-304(1) or 2-3-505(2)(b), C.R.S.
All documents prepared or assembled by a member of the General Assembly relating to the drafting of bills or amendments.
All documents prepared by or submitted to any legislative staff member in connection with assisting a member of the General Assembly with responding to the correspondence of a constituent when such correspondence is not a public record of an elected official as provided for in Policy 6.3 Interacting With Elected Officials.

Policy

Division records managers

Each division of the department shall designate one or more individuals to be the primary point of contact on behalf of the division for the Office of Legal and Regulatory Compliance (OLRC) for all requests for records pursuant to the Act. All divisions and offices will work with the OLRC to respond to their CORA requests, with the exception of DEHS, HFEMSD, APCD, HMWMD, and WQCD, who have dedicated records managers. Unless the request impacts more than one division or is sensitive in nature, those divisions will respond on behalf of the division to all requests for records pursuant to the Act, and may request assistance from the OLRC as needed.

Production of records

Existing records: The Act does not require creation of, and the department does not create, records to respond to a CORA request. The Act permits the manipulation of data to respond to a request, e.g., creating and pulling a report from a database to fulfill a request. Prior to undertaking the manipulation of data, the responding division shall provide the requester with an estimate of costs as described in the Procedure section of this policy.
Unmodified records: No employee may modify, redact or omit any records he or she is required to provide unless the redaction or withholding of the record occurs pursuant to the “withholding records” section below or to combine multiple responsive documents into a single electronic PDF file in accordance with the “records format” section of this policy.
Withholding records: Some information maintained by the department shall not be released due to its confidential and/or privileged status. Examples of documents that may be withheld include the following:
- Investigatory records may be withheld while the investigation is occurring. The Act requires release of investigatory records if the request is received after the investigation is complete unless the information remains confidential under another statute. The Act allows for names or other personal identifying or financial information of witnesses or targets of such closed investigations to be removed prior to release.
- Medical records.
- Personnel files, but such files shall be available to the “person in interest” upon receipt of proof of identity.
- Electronic mail addresses, telephone numbers, or home addresses provided by a person for the purpose of future electronic communications to the person from the agency.
- Trade secrets; privileged information; and confidential commercial, financial, geological or geophysical data, including social security numbers.
- Specialized details of security arrangements or investigations.
- Deliberative process privileged information.
- Specific state statutes may further limit the information the department may release.

Records format

The Act guarantees that “all public records shall be open for inspection by any person at reasonable times, except as provided in part 2 of article 72, title 24, C.R.S. or as otherwise specifically provided by law,” § 24-72-201, C.R.S.

The Act does not guarantee access to documents in a specific format, except as specified below. When the production of records in a specific format would interfere with the regular discharge of duties of department employees (§ 24-72-203(1)(a), C.R.S.) or levy an undue burden upon the department, the division records manager shall determine the appropriate format.

Records stored in a digital format shall be provided to the requester in a digital format.

Records provided electronically shall be in PDF format, but may be provided in their native format at the department’s discretion or when the division records manager determines the record’s native format is necessary. When the department has multiple documents that are responsive to a request, the documents may be combined into a single PDF.

Records that are converted and distributed in PDF format must be converted to remain searchable (not converted as an image).

Records stored in a digital format that is searchable shall be provided in a searchable format, and records stored in a digital format that is sortable shall be provided in a sortable format, unless any of the following exceptions applies:

Producing the record in the requested format would violate the terms of any copyright or licensing agreement.
Producing the record in the request format would result in the release of a third party’s proprietary information.
After reasonable inquiry it is determined that:
- It is not technologically or practically feasible to permanently remove information that is required or permitted to be withheld.
- It is not technologically or practically feasible to provide a copy of the record in a searchable or sortable format.
- Producing the record in a searchable or sortable format would require the purchase of software, or the creation of additional programming or functionality in existing software, to remove information that is required or permitted to be withheld.

Records not specific to an individual may be distributed via email as an attachment or link to a Google Drive folder, or on a compact disc or USB flash drive. If available, at the records managers’ discretion, a file transfer protocol (FTP) may be used.

To protect confidential information, individual-specific records authorized for release via a notarized release signed by a “person in interest” shall be sent via certified mail, a link to a Google Drive file shared directly with the individual using encrypted email, or at the records managers’ discretion, a secure file transfer protocol (FTP).

The following guidelines must be strictly adhered to when sharing by Google Drive:

Files that are uploaded and shared in Google Drive in response to a CORA request must be properly destroyed after the agreed-upon time the requester has been given to access them, not to exceed one week. Proper destruction of files in Google Drive requires that all the following activities be performed:
- Removal of sharing rights (unsharing the files) with the requester
- Deletion of the files from the Google Drive location where they are saved
- Deletion of the files from the Google Drive trash

Records managers shall refer to OIT guidance for proper procedures for correctly sharing files in Google Drive.

Procedure

Upon receipt of a request for records pursuant to the Act, the division or office with responsive records shall identify the responsive records, review the records to determine which records may be released, and respond in a timely manner to the request for records.

Identification of requesters

A requester shall not be required to produce any form of identification to inspect records, except for records pertaining to a “person in interest”.

Records responsive to a request from “a person in interest” to access their individual information held by the department may be released only to that individual or their legal representative upon receipt of an original, notarized request for such records.

Locating responsive records

Upon receipt of a request for records pursuant to the Act, the responding division shall:

Determine if the division has responsive records. All paper and electronic storage locations shall be searched, including ephemeral apps such as Google Chat, and electronic recycle bins.
Assess whether the request should be forwarded to the Office of Legal and Regulatory Compliance to coordinate the response, in accordance with the “Office of Legal and Regulatory Compliance” section below.
Assess whether the work of collecting and reviewing responsive records will exceed one hour, in which case the responding division or the Office of Legal and Regulatory Compliance, as applicable, shall send an estimate of costs to the requester in accordance with the “Timely response to records requests” section below.

Review of responsive records

Prior to releasing any information pursuant to a request for records, the responding division or office shall review the responsive records to determine if any exemptions or privileges justifying withholding the document apply, and confirm any withholding of responsive records with either the Office of Legal and Regulatory Compliance or an attorney from the Office of the Attorney General prior to responding to the request.

Office of Legal and Regulatory Compliance

Prior to responding to a request, the responding division shall inform the Office of Legal and Regulatory Compliance of any of the following types of record requests:

Records pertaining to current or pending litigation.
Records that must be produced in a modified format to avoid interfering with the regular duties of department employees or creating an undue burden on the agency.
Issues deemed sensitive by the executive management of the agency.
Records pertaining to more than one division.

The Office of Legal and Regulatory Compliance may assist in coordinating the responses to such requests.

Requests from the media

Prior to responding to a records request from the media, the responding division shall inform the Office of Communications of all such public records requests.

Costs associated with record requests

Record production costs: If researching, retrieving, reviewing and producing records consumes more than one hour of staff time, the department shall charge $41.37 an hour for all staff time associated with locating and producing records for a requester.
Attorney General review costs: When review from the Attorney General’s Office is necessary to ensure redaction or withholding is appropriate under the CORA statute, the cost of reviewing documents is limited to $41.37 per hour. Department staff will coordinate with the Attorney General’s Office and include its review time in any estimate or invoice for responding to the record request.
Data manipulation costs: In some instances, the department does not have a responsive record but a division may offer to create a record as a customer service. When creating the record requires staff to manipulate existing databases or data elements to generate the document, or when specialized document production or specialized skills are required to produce records pursuant to a records request (including the use of third-party contractors), the department may charge the actual costs associated with the manipulation of data. Any cost charged to a requester shall not exceed the actual cost of producing the records, in accordance with § 24-72-205(3), C.R.S.
- To effectively communicate with a requester, the response to the CORA request is to inform the requester that the department has no responsive records, notify the requester of the fees for creating the record, and the estimated timeframe for the response. While actual costs may be charged, in instances where the data manipulation is minimal, divisions are encouraged to create the document at no charge as a customer service.
- Altering an existing public record or excising fields of information to remove information that is either required or permitted to be withheld does not constitute data manipulation and/or the creation of a new public record.
Electronic records: Electronically stored information may be transmitted free of charge if using Google Drive as the method for sharing files with the requester. When requested or necessary, files may be copied to a compact disc for a cost of $10 per disc, or copied to a USB flash drive charged to the requester not to exceed the actual cost paid by the department. Portable external drives and portable storage devices supplied by the requester shall not be used. If available, at the records manager’s discretion, a file transfer protocol (FTP) supplied by the requester may be used.
Copying costs: When the department prints a paper copy of the records, and the number of pages produced exceeds 25, the department shall charge $.25 per page for all documents copied, pursuant to the Act.
Remitting payment: The responding division shall provide information for the requester to submit payment via credit card using the Department’s online payment portal. The requester may choose to issue a check or money order payable to the Colorado Department of Public Health and Environment. All checks and monies received for records requests shall be given to the Department’s accounting unit.

Timely response to record requests

Required three-day response: The three working-day response time begins the first working day following receipt of a written records request. A request received after 5 p.m. or any day the office is officially closed will be considered received as of the following working day. Within three working days of a request, the responding division shall either inform the requester of estimated costs associated with responding to the request, inform the requester if extenuating circumstances exist, or provide copies of or access to records.
- Cost estimates: When costs will be assessed as described in the “Costs associated with records requests” section above, the responding division shall provide a cost estimate and inform the requester that records shall not be copied or compiled until the estimated costs are paid. Upon receipt of payment, staff will begin working on copying or compiling the records. An estimate of costs is considered a response to the request as it informs the requester of the process for obtaining responsive records.
- Extenuating circumstances: If extenuating circumstances exist, as defined by § 24-72-203, C.R.S., the responding division may extend the three-day response period up to seven additional working days. Each division that finds the existence of extenuating circumstances shall inform the requester of the extended response timeframe in writing within the original three-day response period.

Content of final response

The responding division shall either provide copies of the responsive records or offer to schedule a review of its public records with the requester upon receipt of payment by the requester (if costs are associated with the request).

If the responding division has public records stored in a digital format that the requester has sought release of in a digital, searchable and/or sortable format, and the responding division has determined that such release will not occur in accordance with the requirements of the Records Format section of this policy, the responding division shall either produce the records in an alternate format or issue a denial of the request. A written declaration attesting to the reasons why the records are not being produced in the requested format shall be provided to the requester. The attestation is completed by the person who determined and understands why the record cannot be produced in the requested format. The attestation is provided with the response and does not need to be notarized or certified.

If the responding division has public records that are withheld from release due to their confidential and/or privileged status, the division shall so inform the requester.

The responding division shall notify the requester if the requested records are not in the custody of the department. If the location of such unavailable requested records is known, the division shall provide the requester with the relevant information, such as location, contact name, address and phone number.

Retention of responsive records

The division shall retain documents that are responsive to record requests for 60 days after they are provided to the requester, regardless of the retention periods set forth in records disposition schedules. This allows time for the requester to review the records and identify any corrupted records that may need to be provided again. It also allows time for the requester to file legal challenges without compromising the records.

For requests that have costs associated with the response, requesters shall be given 14 working days from the date of the response to authorize the fees imposed, and 30 days from the date of the response to submit payment. If authorization and payment are not received by these dates, the request will be closed. Custodians of responsive records should retain the records until the time to submit payment has passed before returning the records to normal records retention.

Challenges to responses to record requests

Each division shall inform the Office of Legal and Regulatory Compliance of any legal challenges that a requester makes to a division’s denial of access to records, including when a requester has provided a written notice of intent to file an application with the district court after 14 days.

If a requester files with the responding division or department a written notice of intent to file an application with the district court after 14 days to seek an order directing the department to produce the records, the responding division shall, within 14 calendar days of receipt of such notice, meet in person or participate on a call with the requester to determine if the dispute can be resolved without filing an application with the district court.

If a requester files with the responding division or department a written notice of intent to file an expedited application with the district court after three days to seek an order directing the department to produce the records, the responding division may, within three calendar days of receipt of such notice, meet in person or participate on a call with the requester to determine if the dispute can be resolved without filing an application with the district court.