DORA Complaint and Record Production: Scope, Contact, and Withholding
Marisol is an LMFT in solo telehealth practice in Grand Junction. On March 3 she receives an email from DORA's Division of Professions and Occupations: a former client filed a complaint alleging that Marisol disclosed PHI in a group text, and Marisol must produce the client's complete record within 20 days. The file contains Marisol's individual notes about the client, a joint couple's file, and three paragraphs describing the client's husband's own therapy with a different provider. Marisol wants to send everything because the complaint mentions the husband. She also wants to call the former client to "clear things up." The client's attorney sends a letter demanding no contact. Marisol has 14 days left and asks whether she can withhold the record until the investigation ends.
1. Must Marisol produce records to DORA, and may she withhold them until the investigation concludes?
Read the worked answer
No. A Colorado licensee must cooperate with a DORA investigation; the Board's authority to investigate complaints necessarily includes obtaining relevant treatment records. Withholding the entire record because litigation is pending risks unprofessional conduct and independent discipline. The better course is to respond in writing within the deadline, produce the records that are responsive, and assert specific objections only where a recognized privilege or legal requirement applies. Marisol should not send the husband's individual therapy notes from a different provider: those belong to a non-complainant third party and are not shown to be relevant. She should redact or segregate third-party information, label each redaction, and include a privilege/confidentiality log. If she believes some material is protected, she should produce a withholding index and ask DORA whether a subpoena or release is required rather than ignore the request. She should also preserve the group text and all related metadata. The key judgment is that the complaint opens the door to the client's treatment record, but not to unrelated records of other clients or family members.
2. What are the risks of Marisol calling the former client, and what should she do instead?
Read the worked answer
Direct contact after a complaint and an attorney's no-contact letter is a poor judgment call. Even if Marisol's intent is benign, a call can be experienced as pressure to withdraw the complaint, retaliation, or an attempt to influence a witness. It also creates a new factual dispute about what was said. Colorado expects licensees to avoid conduct that exploits the therapist-client power differential and to cooperate with disciplinary processes. Marisol should not call, text, email, or send a message through social media. If she wants to communicate, she should route it through her own attorney or DORA, keep it factual, and avoid discussing the merits with the complainant. She should document the attorney letter and the decision not to contact the client. If the client later initiates contact, Marisol should keep the response minimal: acknowledge receipt, state that the matter is with DORA, and refer to counsel. She should also consult her malpractice carrier and an attorney experienced in DORA matters before submitting anything substantive.
3. How should Marisol handle the husband's three paragraphs and the couple's file?
Read the worked answer
She should separate three categories. First, the client's individual record is responsive and should be produced, subject to any lawful redaction. Second, the couple's file is jointly created but the complaint concerns only the former client; Marisol should review whether the couple's sessions are relevant to the allegation and whether the husband is a separate client. If the husband is a client, his information is protected and cannot be released merely because the wife filed a complaint. She should redact his identifiers and any individually identifiable therapy content, or withhold the file and explain why in a log. Third, the three paragraphs about the husband's therapy with a different provider are not Marisol's records to produce; they are third-party information. Marisol should not send them. The safest process is to produce a redaction log, produce the client's own record with third-party content removed, and state clearly that she is withholding the husband's separately protected information pending DORA's direction. Consulting counsel before production is appropriate, but the deadline still requires a timely response.