Based on the CO APCD statute and HCPF rules, the CO APCD must adhere to federal privacy laws, specifically HIPAA, regarding data disclosures, just as your insurance company must do with respect to claims information. The CO APCD statute and rules provide no special protection from law enforcement, and there are HIPAA exceptions that, under some circumstances, allow for data disclosures (e.g., certain law enforcement purposes, certain judicial proceedings, etc.). Any data that was released under such circumstances would, however, require that HIPAA’s privacy standards be met.