Exhibit A.11 HIM-HIP-016 v1.1- Retention of Protected Health Information (1).pdf

I. PURPOSE

The purpose of this policy is to establish guidelines for the retention, storage, and appropriate destruction of medical records to ensure their availability for continued client care, legal requirements, research, education, and internal auditing purposes. This policy ensures compliance with federal and state regulations governing the management of protected health information (PHI) and supports the secure and ethical handling of all client records across

Forensic Services Division (FSDV) programs.

II. DEFINITIONS

FSDV Staff: All employees, contractors, or interns working under the Forensic

Services Division, including personnel assigned to any FSDV program, unit or facility. This term encompasses clinical, administrative, operational and support staff providing or supporting professional services within FSDV.

Health Insurance Portability and Accountability Act (HIPAA): A federal law that establishes national standards for protecting sensitive patient health information from being disclosed without consent or knowledge of the individual.

High Profile Cases: These include any records for individuals who have offenses as defined by C.R.S. § 16-8-106, which includes Class 1 or Class 2 felonies or a

TITLE: Retention of Protected Health

Information Policy

POLICY ID: HIM-HIP-016 v1.1

POLICY OWNER: HIPAA Liaison

EFFECTIVE DATE: March 13, 2026

APPROVED BY:

Forensic Services Division Director felony sex offenses charge described in C.R.S. § 18-3-402, 18-3-404, 18-3-4-5, or 18-3-405.5.

Media Cases: Refers to a legal case that attracts significant media attention and public interest, often requiring courts to implement special considerations or procedural adjustments to maintain confidentiality, security, or fairness in the legal process.

Psychotherapy Notes: Refers to recorded notes by a licensed mental health professional documenting or analyzing the contents of a private psychotherapy session. These notes often reflect the provider’s personal impressions and may include information that is not appropriate for inclusion in the official medical record. Psychotherapy notes are maintained separately from the individual’s designated medical record. Because they are distinct from the medical record, they are not subject to routine access, use, or disclosure.

Retention: The period of time during which medical records must be maintained in a secure and accessible media, in accordance with applicable federal and state laws, regulations, and internal policies. Retention begins at the date of the last treatment, discharge, or final entry, once the professional relationship has ended.

Test Data: Raw and scaled scores, including client responses to test questions or stimuli, and psychologists’ notes and recordings concerning client statements and behavior during an examination (American Psychological

Association, 2017).

Test Materials: Manuals, instruments, protocols, and test questions or stimuli and does not include test data (American Psychological Association, 2017).

III. POLICY

It is the policy of FSDV to retain, store, and dispose of protected health information (PHI) in accordance with 45 CFR § 164.530 and 6 CCR 1011-1

Chapter 4, Part 10, unless specified as exempt by FSDV procedure. Individuals responsible for implementing this policy include all FSDV staff.

IV. RESPONSIBILITIES

A. Program Directors: Ensure adherence to retention and destruction procedures.

B. HIPAA Liaison and Medical Records Technician: Manage destruction documentation and coordinate with CDHS records Manager.

C. Quality Assurance Team: Collaborate with the HIPAA Liaison and Medical

Records Technician to conduct annual compliance audits.

D. FSDV Staff: Handle PHI in compliance with HIPAA and FSDV procedures.

V. PROCEDURES

A. Retention and Storage

1. Notification of Rights: Upon admission to an FSDV program, clients shall be informed of their right to request and obtain copies of their records prior to the permanent destruction of those records.

2. Record Maintenance: All FSDV records must be maintained and stored in a secure and accessible format consistent with FSDV and program-specific procedures. Each program within FSDV is responsible for ensuring compliance with this policy.

3. Retention Periods: Client medical records are retained for a minimum of 10 years after inactivity, meaning no ongoing professional relationship or services have occurred for 10 years.

Records for minors must be retained until the individual reaches age 28 or 10 years after the last date of service, whichever is longer.

4. Special Categories of Records:

a) Initial Collateral Information for Evaluations: Court Services administrative staff are responsible for uploading all initial collateral materials to Ancillary Web and the Completed

Packets folder. This includes offense reports, video or audio recordings, and other documentation from the District

Attorney’s office, as well as initial jail or medical records required for forensic evaluations.

b) Subsequent Collateral Records for Evaluations: Court

Services administrative staff are responsible for uploading all additional records obtained during the course of an evaluation (e.g., outside medical/school records, etc.) to

Ancillary Web, regardless of whether the evaluator or the administrative staff originally obtained the documents. If an evaluator obtains records directly, they must provide them to the administrative staff for processing and upload.

This process must be completed within thirty (30) days of the report’s submission; once digitized, original paper copies must be destroyed via a cross-cut shredder or placed in a secure disposal bin

c) Evaluator Records and Data Retention: All interview notes, collateral contact documentation (including emails), and test data must be scanned and uploaded into the evaluator assigned folders in the Medical Records Drive within thirty

(30) days of report completion. To maintain test security and protect proprietary materials, any raw data embedded within a test protocol must be extracted into a separate document or the proprietary test questions/stimuli must be redacted, leaving the raw data visible. Prior to uploading the files, the evaluator shall perform a quality review of the digital copies. These records are to be retained permanently.

d) Jail-Based Restoration (JBR): Records from the JBR program are stored in the Y drive in JBR-specific folders, not in the

Outside Information database.

e) Psychotherapy Notes: If psychotherapy notes are maintained by an FSDV program they must be reviewed at the end of the required retention period and purged according to the destruction protocols. These notes will be stored separate from the programs designated record set in a secure google drive with limited access and files should use the standardized naming convention

LASTNAME_FIRSTNAME_MRN.

B. Thinning and Destruction

1. Eligibility Verification: Before destruction, the responsible party shall confirm that:

a) The client has not received services from another Office of

Civil and Forensic Mental Health (OCFMH) agency (CMHHIP, CMHHFL, MHTL) within the past ten (10) years; and

b) The case is not designated as a high-profile case or as a media-sensitive case.

c) If any of these two conditions apply, FSDV Executive

Leadership will convene to determine whether destruction may proceed.

(1)Any case designated as high-profile or media-sensitive in which destruction or thinning was deferred after the initial ten-year period shall be re-reviewed by Executive Leadership every 10 years thereafter to re-assess if destruction may proceed.

2. Record Review and Purging

a) After the required retention period, records eligible for destruction must be systematically reviewed and purged by the managing program.

b) Forensic evaluation reports and other essential records relevant for future forensic evaluations, such as raw testing data and essential collateral information (e.g., school records) are excluded and retained permanently.

c) All programs must maintain a standardized Records

Retention Tracker to monitor retention timelines and document reviews.

d) Program directors must establish routine review cycles with the Quality Assurance (QA) team to ensure timely destruction and maintain audit readiness. Results must include the last date of service, case closure, or last known case activity.

3. Destruction Documentation

a) Once records are identified for destruction, the program shall notify the Medical Records Technician, who assists with verification (e.g., litigation holds, CORA requests, active audits) and ensures compliance with secure disposal methods.

b) A Destruction Log and Certificate of Records Disposal must be completed and submitted to the FSDV Medical Records

Technician, who will obtain final approval from the CDHS

Records Manager.

c) The Medical Records Technician will permanently retain all destruction documents, including: the certificate of destruction (date, method, signature of supervising staff), description of disposed records with inclusive dates, documentation of required approvals, and a copy of a published notice with notarized affidavit of publication.

4. Destruction and Damaged Records: In cases of a natural disaster, flood, fire, mold, or other damage:

a) Conduct an assessment confirming records are unsalvageable.

b) Notify the CDHS Records Manager, Chief Legal Counsel, and

FSDV Director and Deputy Director.

c) Obtain program director authorization before destruction.

d) Document the incident and actions taken.

VI. REFERENCES

A. American Psychological Association, 2017

VII. DOCUMENT GOVERNANCE

This policy will be reviewed annually during designated review cycles. All revisions are tracked and archived to ensure procedural integrity and operational accuracy. Version history and compliance metrics are synthesized and reported quarterly within FSDV’s internal quality documentation. In alignment with FSDV’s commitment to innovation and transparency, Google

Gemini was utilized in the development and maintenance of this policy. AI assistance was applied to technical writing, content synthesis, iterative ideation, and gap analysis support. All AI-generated outputs underwent rigorous human review and validation to ensure accuracy, alignment with organizational standards, and regulatory compliance. The final content and its implementation remain the sole responsibility of the Policy Owner and the

FSDV Director.