A hospital employee was caught in an audit of medical record access, for improperly accessing the medical record of a patient. The audit confirmed that the employee had only accessed the patient's contact information (name and address) and not their actual medical information. The employee was fired.
The employee has now been criminally charged under Colorado R.S. Sec. 18-4-412 for theft of medical records. The statute does not appear to contemplate access to non-medical information. Does the statute apply to the employee's actions?