(1) Any person who, without proper authorization, knowingly obtains a medical record or medical information with the intent to appropriate the medical record or medical information to his own use or to the use of another, who steals or discloses to an unauthorized person a medical record or medical information, or who, without authority, makes or causes to be made a copy of a medical record or medical information commits theft of a medical record or medical information.

(2) As used in this section:

(a) "Medical record" means the written or graphic documentation, sound recording, or computer record pertaining to medical, mental health, and health care services, including medical marijuana services, performed at the direction of a physician or other licensed health care provider on behalf of a patient by physicians, dentists, nurses, service providers, emergency medical service providers, mental health professionals, prehospital providers, or other health care personnel. "Medical record" includes such diagnostic documentation as X rays, electrocardiograms, electroencephalograms, and other test results. "Medical record" includes data entered into the prescription drug monitoring program under section 12-42.5-403, C.R.S.

(b) "Medical information" means any information contained in the medical record or any information pertaining to the medical, mental health, and health care services performed at the direction of a physician or other licensed health care provider which is protected by the physician-patient privilege established by section 13-90-107 (1)(d), C.R.S.

(c) "Proper authorization" means:

(I) A written authorization signed by the patient or his or her duly designated representative; or

(II) An appropriate order of court; or

(III) Authorized possession pursuant to law or regulation for claims processing, possession for medical audit or quality assurance purposes, possession by a consulting physician to the patient, or possession by hospital personnel for record-keeping and billing purposes; or

(IV) Authorized possession pursuant to section 18-3-415, 18-3-415.5, 25-1-122, or 30-10-606 (6), C.R.S.; or

(V) Authorized possession by a law enforcement officer or agency, acting in official capacity and pursuant to an official investigation.

(d) "Copy" means any facsimile, replica, photograph, sound recording, magnetic or electronic recording, or other reproduction of a medical record and any note, drawing, or sketch made of or from a medical record.

(3) Theft of a medical record or medical information is a class 6 felony.

(4) The obtaining, accessing, use, or disclosure of relevant medical records or medical information pursuant to 18 U.S.C. sec. 922 (t) and sections 24-33.5-424, 13-5-142, and 13-9-123, C.R.S., by the Colorado bureau of investigation, the clerk of the court of any judicial district in the state, the clerk of the probate court of the city and county of Denver, or by any of their employees and accessing such records and information through the NICS system shall not constitute theft of a medical record or medical information under this section.

(5) This section shall not apply to covered entities, their business associates, or health oversight agencies as each is defined in the federal "Health Insurance Portability and Accountability Act of 1996" as amended by the federal "Health Information Technology for Economic and Clinical Health Act" and the respective implementing regulations.