Major Breach of the CO MMJ Registry-Help protect medical marijuana patients privacy!

Major Breach of the CO MMJ Registry-Help protect medical marijuana patients privacy!

From Kathleen Chippi

After 13 yrs, the CO CDPHE has connected the Constitutionally protected registry with the CBI/NSA criminal database. Patients must respond.

Support this campaign

Subscribe to follow campaign updates!

Recent Updates

Update #1

about 3 years ago

Help me reach my campaign goal on #Fundly! You can donate as much or little as you want. Check it out:

More Info

The Constitutionally protected  Colorado Medical Marijuana Patient Registry has been breached (connected via the internet) by the CDPHE with the CBI/CCIC/NCIC national online criminal database.  Any patient who registered for a Colorado 'red card' anytime between 2000 through today, 2013 has been affected as expired cards/information were never purged from the CDPHE patient registry but instead put in an "expired licenses" file. 

Over 200,000 patients in Colorado could be/are affected by this unconstitutional breach of medical records and MMJ status while not being detained or put under arrest.

The PCRLP, CARE and Closer to the Heart Ministries need your help in raising funding to legally PULL THE PLUG on the CDPHE's now non-confidential patient registry.  The PCRLP co-filed an emergency rule request with the CDPHE on Aug. 15, 2013.  If 2,000 of the 200,000 patients who in the past had or today have red cards to donate $10 or more--we can 'safely' cover the costs in fighting for everyone's rights.


What can happen with the CDPHE emergency rule request:

1. They most likely will reject the request, after which we would appeal to the CO Medical Board.  If rejected again we will have to take our request/demands to the district court and ask for an injunction for the sake of all patients and caregivers.  We cannot do this w/o funding.


2.  The CDPHE adopts our emergency rule and we are successful in pulling the plug on the registry at which time we need to file a class action lawsuit for damages that would also require funding.

Protecting patients from criminal harm is essential as these are not only HIPPA protected medical records but the feds still consider MMJ illegal so the breach has many criminal implications.  All marijuana users, including patients, face discrimination in employment, housing, veteran's benefits, child custody, health insurance, school loans, automobile insurance, organ transplants, gun ownership, occupational licensing (DORA says over 70% of Colorado workers have occupational licenses that do not allow licensees illegal drug use) and in interactions with law enforcement.


Colorado voters passed medical marijuana (MMJ) into our state Constitution in 2000.  The intent was to protect MMJ patients from criminal prosecution/intrusion.  For 10 years patients and caregivers operated successful co-ops and dispensaries and supplied themselves medication. 


Registering as a patient with the state was/is voluntary/optional, as a doctors recommendation provides an affirmative defense in the court of law.  The MMJ patient registry was off line, in a locked room and privacy protected.  Access was limited to a handful of CDPHE employee's who had signed confidentiality agreements.

In 2010 Senators promised to close down 80% of the taxpaying MMJ businesses.  HB1284 was passed in May of 2010.  One of the rules in HB1284 requires patients who need to shop in storefronts to gain access to their meds to register with the state and posses a 'red card' (CO MMJ registry card).  This forced thousands of trusting patients to register with the CDPHE MMJ Registry.  After passage of HB1284 by the General Assembly, the CDPHE responded by interpreting the new state statute as authorization for them to connect the confidential MMJ patient registry with the CBI/CCIC/NCIC national online criminal database, as if they can override the state Constiution with statute.

I (Kathleen Chippi) immediately shuttered my Nederland dispensary, formed the Patient and Caregiver Rights Litigation Project and filed a Declaratory Judgement direct to the Colorado Supreme Court.  The Petition sought clarity on patient privacy and patient, caregiver and doctors rights.  The Court chose not to hear the case at that time.  The PCRLP then filed a lawsuit in Denver District Court in June of 2011, again seeking clarity on the same issues. 

A month after the district filing the Colorado Court of Appeals ruled against patient Jason Beinor in Beinor-V-ICAO.  The PCRLP agreed to place a stay on our district filing and at our expense, appealed the Beinor ruling to the Colorado Supreme Court.  The Supreme Court considered the appeal for 10 months and then in May of 2012 again refused to rule on patient privacy and patient and caregiver rights.  The state then removed the stay on the CARE/PCRLP district filing and 'suggested' we withdraw it without prejudice, allowing us the option to bring it back to the courts, if we chose to, after the November 2012 A64 vote.

Well, now is the time to refile the same arguments and attempt to get damages for everyone who ever registered with the CDPHE, as everyone has been irreparably harmed by the illegal actions of the state: CDPHE, the CBI, the DoR,  the MMED, The Governors Office of Information and Technology, and the 2010-2013 General Assemblies.


The CDPHE also admits to allowing the following private entities MMJ registry access:  Express  Employment Professionals, Colorado Department of Personnel and Administration, Rocky Mountain Poison and Drug Center and COHELP.  COHELP is an outside (homeland security) contractor that answers the state's Office of Emergency Preparedness and Response BIO-TERRORISM hotline.  Yes, you heard it right, call the bio-terrorism hotline for info on MMJ from the CDPHE confidential patient registry.


Legal Issues:

There is NO way for the CDPHE to 'take back' patients confidential info from law enforcement's criminal database.


Most of the research for any legal challenge we would make is complete, as all of the issues at hand were addressed in all three of our previous lawsuits that never were heard by the high court. 

Our goal is to raise $20,000 for whatever legal case we need to make in clarifying patient privacy and patient and caregiver rights and whatever we would need to file for damages in a class action suit. 

We would be retaining Andrew Reid, Senior Legal Counsel at Springer and Steinberg, Denver, who filed all three previous lawsuits and is up to date on the state and federal MMJ 'issues'.  He is also a Professor of Law at DU where constitutional law and administrative law are some of his specialties.  After searching for 3 years for an intelligent, interested administrative attorney--we have not found anyone who qualifies and is interested except Andrew.  With $55,000 already invested in Andrew on the research for the previous lawsuits that addressed these exact issues, our best option would be to follow through with our attorney and our (unheard by the high court) arguments, however his law firm will not let him begin work on this until we have raised $15,000.


If we fail to raise $15,000 we have two half a** options:

1. We will have to find and hire a newbie attorney, which has not been successful for us in three years as of this date (in regard to MMJ or administrative law).  We can still work off of our old lawsuits, but there will be loss of time in educating a new, unfamiliar attorney and in the long run, will still end up costing significantly.  I have made inquiry calls and attorneys are requesting $5,000-$10,000 up front to 'do research' to decide if they even want to take this on.  Most have never sued the government.  This option is my least favorite as I see a huge loss in time and money with no guarentee's of compentince. 

2: I would have to file pro se (w/o an attorney).  Believe me, I don't want to be schooled in the court but I would be as I understand the law but not court procedures enough to be fighting this on behalf of every patient and caregiver.  Too much is at stake.  This will set case law.  Yes, the passion I am known for would be there, but it would all be new to me and I don't want to screw it up. 


People who know me know I have worked tirelessly, without pay for the last three years, on this legal issue for patients and caregivers.  But just typing this info I see that we simply have to raise at least $15,000 so we can retain Andrew Reid.  He is the only person IMO worth paying to have chance to protect us all.   All we need is 2,000 out of 200,000 patients donating $10 or 1,000 patients out of 200,000 donating $20 to put this to bed.   Please help us get justice and patient/caregiver privacy!

Below is our press release with links to the state audit on the CDPHE (They got an F as in failed) and the emergency rule request filed by the PCRLP and CTI with the CDPHE. 

ACTION ALERT: Protest Law Enforcement Access to Medical Marijuana Patient Registry*Medical Marijuana Registry Confidentiality Breached by Law Enforcement*CTI and PCRLP File Emergency Rules Petition with Board of HealthFor immediate release, August 15, 2013[Denver] -- An investigation by the Patient Advocacy Project of the Cannabis Therapy Institute (CTI) and the Patient and Caregiver Rights Litigation Project (PCRLP) has uncovered that the Colorado Department of Public Health and Environment (CDPHE) has been illegally sharing confidential medical marijuana Registry data with law enforcement through the CCIC/NCIC national online criminal database, administered by the Colorado Bureau of Investigation (CBI). CTI and PCRLP have filed an Emergency Rules Petition with the Colorado Board of Health to stop this practice, which they plan to discuss at the Board of Health's next meeting on Aug. 21, 2013.AUDITOR'S REPORT: CDPHE PROVIDES TOO MUCH INFORMATION TO POLICEThe CTI/PCRLP investigation was triggered by a report released by the Colorado Office of the State Auditor on July 15, 2013 that first revealed details of a new online database that allows law enforcement direct access to the confidential medical marijuana patient Registry.Relevant parts of the June 2013 Auditor's Report on the CDPHE start on Page 59: Constitution requires the CDPHE to keep a confidential Registry of medical marijuana patients and states that law enforcement can only receive information from the Registry if they have stopped or arrested someone who presents them a with medical marijuana Registry ID card. Since the Registry was created in 2001, law enforcement has never had direct access to the Registry. CDPHE employees always handled all law enforcement inquiries, and the Registry was always on a single computer in a locked room and was not accessible through the Internet.The Auditor's Report states that the new "CCIC-Registry Online Database" went online in April 2013 and may be giving law enforcement too much information on patients, such as the plant count and quantity of cannabis a patient is allowed to possess. The Auditor writes, "It is not clear that Public Health has constitutional authority to provide information about patient plant and ounce counts through the Registry-CCIC interface."The Auditor also uncovered 15 reported confidentiality breach incidents, including an incident where 5400 caregiver names were "inappropriately provided to the State Auditor." The caregivers whose confidential information was breached were never notified.CTI/PCRLP EMERGENCY RULES PETITIONOn August 15, CTI and PCRLP filed a 10-page Emergency Rules Petition to the Board of Health seeking to stop law enforcement from gaining direct access to the Registry.  The Petition argues that any and all law enforcement access to the Registry is illegal. The Emergency Rules Petition provides further details of confidentiality breaches and states:"Over 200,000 patients, former-patients and caregivers have had their confidential data compromised in unknown ways. The many documented leaks of Registry information reported by the Auditor constitute a substantial failure of the CDPHE to protect the confidential Registry as required by the Constitution. It is unclear what information was given to whom and when, or even how many copies of the Registry exist. Because of these massive failures, the Registry must be presumed to be breached in its entirety. Even one breach of the Registry is too many.""Patients can no longer trust the CDPHE to maintain the confidential Registry that they paid them to maintain. The current Registry must be disabled, and an entirely new system must be devised to create a new Registry that is truly confidential."CLICK HERE TO READ FULL PETITION: MISSING CONFIDENTIALITY AGREEMENTSThe Auditor's Report also reveals many other areas where the confidentiality of patients has been violated, including access by state agencies and outside contractors to Registry data that the CDPHE cannot directly control. One of the entities that has full access to the Registry is an outside contractor operating the COHELP hotline, which is the state's main BIO-TERRORISM hotline. However, according to the Auditor, 95% of COHELP calls concern the Medical Marijuana Registry. CDHPE has no contract with COHELP and has no direct oversight. Because of this, the Auditor concludes, "The medical marijuana program does not have control of the work performance of COHELP staff."In addition, the Auditor stated that CDPHE was unable to provide signed confidentiality statements of 30% of the people that they checked in their random sample. A Colorado Open Records Request (CORA) from PCRLP revealed that the CDPHE has confidentiality statements from only a fraction of the people who have had access to the Registry. To get the other missing confidentiality agreements, the CDPHE directed PCRLP to contact the following outside entities and private contractors: Express Employment Professionals (a temp agency that the CDPHE hired to enter Registry applications), Colorado Department of Personnel and Administration, Rocky Mountain Poison and Drug Center, and the Governor's Office of Information Technology (OIT).  This is more proof of the Auditor's concerns that the CDPHE does not have direct control over the people and entities that have access to the Registry.PARALLEL DATABASE AND PARALLEL CONSTRUCTIONIn addition to the Auditor's report, the official Agreement between the CDPHE and CBI regarding "Law Enforcement Queries of the Medical Marijuana Registry Information" dated October 2012 (obtained through another CORA request) provides more details on law enforcement access to patient data.CLICK HERE TO READ CBI/CDPHE AGREEMENT: CBI/CDPHE Agreement on page 3-4 states: "The CCIC transaction log ... records every inquiry made through CCIC as well as the provided response ... The log's record of prior transactions is maintained for at least five years and its access is restricted to CCIC support personnel at CBI only."This means the CBI is keeping all results of its queries to the Registry, including names of patients, in their own "parallel database". Since only the CBI can access this data, no one can determine how the CBI may use or abuse this confidential patient information.A recent Reuters' story uncovered the common police practice of "Parallel Construction", where law enforcement will use unlawfully-obtained secret tips to begin investigations on people. There are no safeguards in the CBI/CDPHE Agreement preventing law enforcement from using confidential Registry information in their "parallel database" to begin investigations into people, and then use "parallel construction" to cover-up the original source of information. AGAINST MARIJUANA USERSAll marijuana users, including patients, face discrimination in employment, housing, veteran's benefits, child custody, health insurance, automobile insurance, organ transplants, firearm ownership, occupational licensing and in interactions with law enforcement. The main purpose of the Registry was to allow patients to use medical marijuana in a confidential way. With all the leaks of this private information reported by the Auditor, the Registry can no longer be trusted to protect patient information, and the sanctity of the Registry may never be repaired.*WHAT YOU CAN DO*1) WRITE TO COLORADO BOARD OF HEALTHTell them that the CCIC-Registry Online Database must be immediately disabled and ask the Board to support the CTI/PCRLP Emergency Rules to protect patient privacy.SAMPLE LETTERDear Board of Health members:This is a letter protesting the CDPHE's failure to maintain a confidential Medical Marijuana Registry, as reported by the state Auditor. The CDPHE has illegally set up an online computer database and made it available to law enforcement without sufficient safeguards. I demand that law enforcement direct access to the Registry be permanently disabled. I support the CTI/PCRLP Emergency Rules Petition (filed Aug. 15, 2013) and urge you to hear comments on this petition at your public meeting on August 21.EMAILSCut and paste and send to:,,,,,, sen.steadman@gmail.comKarin McGowan, Interim Executive Director, CDPHEEmail:, of HealthEmail: Marijuana RegistryEmail: John HickenlooperEmail: Pat Steadman (co-author of HB 1284)Email: sen.steadman@gmail.comCC: Cannabis Therapy Instituteinfo@cannabistherapyinstitute.com2) ATTEND PUBLIC HEARINGWednesday, August 21, 2013Board of Health Public MeetingColorado Department of Public Health and EnvironmentSabin-Cleere Conference Room4300 Cherry Creek Drive South, Denver, CO 802469:00am: PROTEST by Patients of Registry Confidentiality Breaches - Bring Signs9:45am: Signup for General Public CommentSignup to speak during general Public Comment. It is unclear at this point if the Board will discuss the CTI/PCRLP Emergency Rules Petition. In order to make sure patient concerns on violations of their privacy are heard at this meeting, we must take the opportunity for public comment at the beginning of the meeting during the open comment period.10:00am: General Public CommentThe Board President may limit comment time. Please be prepared to speak only 2 minutes.11:00am: The CDHPE's Annual Report on the Medical Marijuana Registry by Registry Director Ron Hyman was previously scheduled for this meeting. This is a "discussion" item, so there will be no opportunity for public comment on this item.3) SEND US YOUR STORYWe are requesting that any patient or caregiver, current or former, who believes he or she has been harmed in any way by breaches of confidentiality of the Registry to send us your story. Have you been pulled over, and the police knew you were a patient? Have you been denied firearms permits because it was discovered you were a patient? Are you worried that your Registry information will be used against you?Also please contact us if you would be willing to be part of a class action lawsuit concerning the violation of your constitutionally-protected confidentiality rights. The confidential information of over 200,000 active and inactive people may have been breached, and there should be a legal recourse for affected patients and caregivers.Send email to: with the word "Lawsuit" ---Provided as a Public Service by the:Cannabis Therapy Institute and the PCRLP

Campaign Wall

Join the Conversation

Sign in with your Facebook account or

Help Kathleen raise $15,000 by making a donation.

Kathleen Chippi posted a new update:
about 3 years ago

Check Out My Latest Campaign Update

Help me reach my campaign goal on #Fundly! You can donate as much or little as you want. Check it out:

Join the Conversation

Sign in with your Facebook account or