Hand it over
A copy of your health record, electronically or on paper.
HIPAA compliance
Your health information is protected by federal law and by the way we build our systems. This page explains both, without the legal fog.
HIPAA Compliant
256-bit SSL Encrypted
FHA Compliant Letters
ADA Compliant Letters
No Charge If Not Approved
Current as of September 2, 2026. Four questions cover almost everything people want to know about health privacy here. This page answers them, then gives you the mechanisms behind each answer.
Question one: who can see what I tell you?
Four groups, and no others.
| Who | Sees | Why |
|---|---|---|
| The clinician evaluating you | Everything in your record | They cannot reach a clinical judgement without it, and Colorado requires one |
| A small support team | Only what a request of yours requires | To resolve a booking, correction or billing question you raised |
| Contracted vendors | Only their slice | Hosting, scheduling, video; each under a business associate agreement |
| Our payment processor | Billing data only | To take payment. It never receives clinical information |
Not on that list: advertisers, data brokers, your landlord, your HOA, your employer. None of them receives anything from us unless you sign an authorisation telling us exactly what to send.
Question two: where does my information actually live?
On encrypted storage, reachable only over an encrypted connection. Traffic runs over TLS with 256-bit encryption; stored records are encrypted at rest; backups carry the same protection. Access is restricted by role and every access is logged, with logs reviewed for anything unusual.
Colorado clinical records are retained for the period state law and professional standards require, then securely destroyed. Anything we are not obliged to keep can be deleted on request.
Question three: what actually leaves the building?
Your letter, and nothing else. Look at what it deliberately omits: it confirms that a Colorado-licensed clinician evaluated you and that a disability-related need exists. It does not name a diagnosis, quote your notes or describe treatment.
That omission is the point. A Colorado landlord or HOA is entitled to reasonable documentation of the need where the disability is not obvious. They are not entitled to your medical file, and a letter that volunteers one has done you a disservice.
Beyond that, we disclose without your authorisation only where a valid court order or subpoena compels it, a specific law requires reporting, a health oversight authority exercises lawful powers, or there is a serious and imminent threat to someone's safety.
Question four: what can I make you do?
Quite a lot. Email support@coloradoesaletter.org with "Privacy request" in the subject line. We confirm who you are, then act within 30 days.
Fix it
Amend anything you believe is recorded incorrectly.
Account for it
A list of certain disclosures we have made.
Restrict it
Limit how information is used or shared. We consider every request and say plainly when we cannot agree.
Redirect it
Choose the address or method we use to reach you.
Report us
To us, or straight to the HHS Office for Civil Rights. Retaliation is prohibited and would be indefensible besides.
If we ever have a breach
The Breach Notification Rule obliges us to tell affected individuals without unreasonable delay and within 60 days of discovering a breach of unsecured protected health information, notify HHS, and notify media where more than 500 residents of a state are affected. You would be told what happened, what was involved, what we did, and what we suggest you do. Colorado also has its own data breach notification requirements, and we would meet both.
Privacy and HIPAA questions
Will my landlord or HOA learn my diagnosis?
Not from us. The letter confirms a disability-related need without naming a condition. Colorado housing providers may request reasonable documentation of the need where the disability is not obvious; they are not entitled to your records.
Is a telehealth consultation actually private?
Yes, on a platform that supports encryption and operates under a business associate agreement, which is what we use. Consumer video apps without those protections are not used for clinical work.
Does Colorado's bona fide relationship rule mean more of my data is stored?
It means a genuine evaluation happens, so a clinical note exists. That note is protected exactly like the rest of your record and is never part of the letter your landlord sees.
Who holds my card details?
Our payment processor. Full card numbers never reach our servers; we see a confirmation and the last four digits.
How long do you keep my record?
For the period Colorado law and professional standards require, after which it is securely destroyed. Non-clinical data we are not obliged to retain can be deleted on request.
Official sources for this page
Nothing legal on this page is asserted without a source behind it. Open them and read the originals rather than taking our summary on trust.
- HHS — HIPAA for IndividualsThe official explanation of your federal health privacy rights.
- HHS — HIPAA Privacy RuleThe rule governing how protected health information may be used and disclosed.
- HHS — HIPAA Security RuleThe safeguards standard our encryption, access control and logging are built against.
- HHS — Breach Notification RuleThe obligations described at the end of this page.
- HHS Office for Civil Rights — File a ComplaintHow to report a suspected privacy or security violation to the federal regulator.
- Colorado Attorney General — Data protectionColorado's own data security and breach notification requirements.
- Colorado DORA — Division of Professions and OccupationsThe regulator overseeing the licensed professionals who handle your information.
Ready to start your evaluation?
Choose a slot that works for you. The consultation usually runs under 20 minutes, and an approved letter reaches your inbox 15 minutes after sign-off.