The Colorado General Assembly has enacted Senate Bill 25-276 (“SB 25-276” or “Bill”), establishing significant new requirements for healthcare facilities operated by political subdivisions, Public Health-Care Facilities, and their employees and contractors. The Bill regulates how these entities collect, use, and disclose patients’ immigration status and personal identifying information. Notably, Public Health-Care Facility is defined broadly to include any Colorado-licensed facility that receives any amount of state funding, including payments from Medicaid or other state health care programs.[1] The Bill is designed to safeguard the civil rights and privacy of all persons in Colorado, regardless of immigration status, and to limit the role of state and local actors, including healthcare providers, in federal immigration enforcement.
SB 25-276 directly impacts healthcare providers that are healthcare facilities operated by a political subdivision or receive any state funding. The Bill establishes new prohibitions on the collection and disclosure of immigration-related information, mandates new privacy policies and procedures, and creates substantial penalties for violations.
Key provisions affecting healthcare providers receiving state funding
Restrictions on collection of immigration-related information
Effective July 1, 2025, Public Health-Care Facilities (i.e., Colorado licensed facilities that receive any source of state funding) and their employees are prohibited from collecting certain types of information except as required by federal or state law, as necessary to perform their duties, or to verify eligibility for a government-funded program if verification is a necessary condition of funding or participation.[2] Specifically, these facilities and employees may not collect information regarding a person’s place of birth, immigration or citizenship status, or information from passports, permanent resident cards, alien registration cards, or employment authorization documents.[3] However, it is not a violation of the law to release such information if the disclosure is made pursuant to a subpoena, order, or warrant issued by a federal judge or magistrate, or if the patient—or, if applicable, the patient’s parent or guardian—provides consent through a valid release of information.[4]
New Policy Requirements[5]
By September 1, 2025, every Public Health-Care Facility is required to adopt and implement policies for both employees and patients (including their families or guardians) that comply with the new restrictions on information collection and access. At a minimum, these policies must include:
- Procedures for providing personal identifying information about any patient who has sought, received, is seeking, or is receiving services from the facility, as required by state or federal law;
- Procedures for providing personal identifying information about a patient’s parent, guardian, or relative, as required by law;
- Procedures for granting access, or consent to access, to any part of the Public Health-Care Facility’s premises that is not open to the public, as required by law;
- Procedures for properly releasing protected information if federal immigration authorities present a subpoena, court order, or warrant issued by a federal judge or magistrate;
- The designation of a responsible employee to be notified if information or access is requested for federal immigration enforcement;
- Requirements to document and request specific information from federal immigration enforcement personnel, including the name, employer, badge number, and a copy of the legal process authorizing access or information;
- Procedures for communicating to the patient, or their parent, guardian, or relative, as appropriate, about any federal immigration authority’s request for information or access.
- The Public Health-Care Facility must make these policies available through its usual communication methods, such as handbooks, websites, patient portals, or any other standard way it shares information with employees, patients, and families.
If a Public Health-Care Facility intentionally violates these provisions, they may be subject to injunctions and civil penalties of up to $50,000 per violation.[6] Any penalty funds collected for immigration-related violations will be credited to Colorado’s Immigration Legal Defense Fund.[7]
Key provision affecting healthcare providers operating as a political subdivision
In addition to the restrictions described above, effective July 1, 2025, Public Health-Care Facilities operated by political subdivisions[8] and their employees are subject to further limitations.[9] Specifically, these facilities and employees are strictly prohibited from disclosing or making accessible, including through databases or automated networks, any personal identifying information that is not publicly available for the purpose of investigating, participating in, cooperating with, or assisting in federal immigration enforcement, except as required by law or court order.[10] This prohibition also extends to third parties who contract with or manage data on behalf of political subdivisions.[11] However, these restrictions do not apply to information stored in a database or automated system that was established before June 30, 2025.[12]
Practical implications for healthcare providers
Certain parts of SB 25-726 apply broadly to healthcare facilities licensed or certified in Colorado that receive any source of state funding, including payments from Medicaid or other state healthcare programs. Facilities must review and update their data collection, privacy, and release-of-information policies to ensure compliance by September 1, 2025. Employees must be trained on the new restrictions, exceptions, and procedures for handling requests from immigration authorities. Facilities are also required to establish clear procedures for informing patients and their families about any requests for information or access from federal immigration authorities. Noncompliance may result in significant civil penalties, and violations are considered to cause irreparable harm.
Next steps
SB 25-276 is now law in Colorado. Healthcare providers should begin reviewing and updating their policies and procedures regarding the collection and disclosure of immigration-related information, train staff on the new requirements and procedures, and monitor for any further regulatory guidance or clarifications from the state.
Contact us
If you have questions regarding SB 25-276 or require assistance with compliance planning and policy development, Husch Blackwell’s attorneys offer comprehensive counsel and solution-driven services that address healthcare industry pressures. For more information, please contact Nick Healey, Ragini Acharya, or Kristina Abdalla.
[1] “Public Health-Care Facility” means a health-care facility that is licensed or certified pursuant to section 25-1.5-103(1)(a)(I)(A) or article 3 of title 25, or an essential community provider as defined in section 25.5-8-103(6), and that receives money, in any amount, from the state. C.R.S. § 24-74.1-101.5.
[2] C.R.S. § 24-74.1-102.
[3] C.R.S. § 24-74.1-102(1)(a)-(c).
[4] C.R.S. § 24-74.1-102(2) (a)-(e).
[5] C.R.S. § 24-74.1-102(3).
[8] “Political subdivision” does not include a hospital or medical facility created by, and operated under, the Denver Health and Hospital Authority created pursuant to section 25-29-103; the University of Colorado Hospital Authority created pursuant to section 23-21-503; a county hospital established pursuant to section 25-3-301; or a special district hospital pursuant to title 32. C.R.S. § 24-74-102(1.5).
[9] The restrictions applicable to political subdivisions, as discussed in Section II.A, are set forth in C.R.S. § 24-74-103.
[12] C.R.S. § 24-74-104(3)(b).