7 IT Questions Behind Colorado's Assisted Living Rules

Colorado's assisted living regulation runs 83 pages and never uses the words network, internet, backup, or password. It uses the phrase "readily available" 15 times. Seven operational questions live in that gap, and a survey will not ask you any of them.

That is not a criticism of the rule. It is a description of what happens when a regulation written around outcomes meets a building where every one of those outcomes now runs through a network nobody wrote into the text.

The source here is 6 CCR 1011-1 Chapter 7, Assisted Living Residences, published by the Colorado Department of Public Health and Environment. The version checked is the one effective July 1, 2025, downloaded on August 20, 2026 from the Colorado Secretary of State's Code of Colorado Regulations, which is the official publisher of state administrative rules and states that its PDF governs in all cases. Everything below is quoted from that text. Nothing below is a legal opinion, and none of it is a claim about how any community is performing. If you want the wider operational frame rather than the Colorado specifics, start with what business continuity actually means for a senior living community.

The Finding: 15 Mentions of "Readily Available," Zero of "Network"

We searched the full chapter for the vocabulary of modern operations. The searches were run without regard to spacing or punctuation, so a word broken across a line break could not hide. These are the counts.

• Zero occurrences: network, internet, Wi-Fi, wireless, cyber, cybersecurity, backup, password, encrypt, firewall, software, vendor, breach, ransomware, phishing, HIPAA, business associate, information technology, and nurse call.
• 15 occurrences: "readily available."
• Also frequent: "at all times" (10), "immediately" (13), "readily accessible" (3).

Read those two lists next to each other and the shape of the problem is obvious. Colorado tells an operator that a long list of things must be readily available and never once defines what makes them available. In 2026 the answer is almost always a network, a database, and a phone system. None of them is named, and none of them gets asked about until the day it fails.

The seven questions below are ordered by how much time you would have to work around the gap once something has already gone wrong. The first gives you days. The last gives you none, and it is the one most operators have never been asked.

The Seven Questions, Ranked by How Much Time You Would Have

1. Can you actually get the records back, and when did you last prove it?

Rule 18.5 requires "a means of securing resident records that preserves their confidentiality and provides protection from loss, damage, and unauthorized access."

Loss, damage, and unauthorized access is a plain-language description of three separate technical controls: a backup that works, redundancy so a single failure does not destroy the only copy, and access control so the wrong person cannot open the file. The rule describes the outcome perfectly and never once names the mechanism.

This is first on the list because it is the failure you discover last. Nobody finds out their backup has been silently failing on the day it fails. They find out weeks later, on the day they need it. The question is not whether you have backups. It is when someone last restored one and confirmed the contents opened.

2. Is "on site at all times" still true when the record lives in a data center?

Rule 18.2 is one sentence: "Health information records for current residents shall be kept on site at all times."

The chapter does not define "on site." That matters, because most communities now keep those records in a health record system hosted somewhere else and reached over the internet. Whether that satisfies 18.2 is a genuinely open question, and it is not one we can answer. It is a question for a Colorado healthcare attorney, and it is worth asking before someone else asks it for you.

Two related rules sharpen it. Rule 18.13 requires records of former residents to be "maintained and readily available at the assisted living residence location for a minimum of six (6) months" after the stay ends, and Rule 18.12 requires them kept for at least three years. Rule 18.7 opens records to inspection by the resident, the state and local long-term care ombudsman, and Department representatives. Retention and availability are two different obligations, and most operators track only the first.

3. Has a systems outage ever been one of your drills?

Rule 10.5 requires a community to identify its highest potential risk and hold routine drills against it, with written documentation of each one.

Fire drills happen. Severe weather drills happen. In most buildings the drill list was written when the highest potential risk was something you could see. Ask what the community would actually do if the health record system, the phone system, and the internet connection all went down at the same time on a Sunday, and then ask whether that has ever been practiced or written up.

This is the only rule in the chapter that turns a hypothetical into a document. It is also the cheapest of the seven to close, because the requirement is a drill and a written record, not a purchase.

4. What in the building actually runs for 72 hours?

Rule 10.3 requires written policies ensuring "the continuation of necessary care to all residents for at least 72 hours immediately following any emergency including, but not limited to, a long-term power failure."

Seventy-two hours is a technical specification, whether or not it was written as one. It is a duration, and every system in the building either meets it or does not. Walk the list out loud: medication administration, the resident roster, family contact, staff scheduling, the door locks, the call system. For each one, name what it runs on and how long that thing lasts without mains power.

Most communities can answer this for the generator and the lights. Very few can answer it for the systems that hold the information the care depends on.

5. Is the network closet on the generator, or just the lights?

Rule 10.6(E) requires "a plan that ensures the availability of, or access to, emergency power for essential functions and all resident-required medical devices or auxiliary aids." Rule 10.12 separately requires battery or generator-powered alternative lighting.

Notice the asymmetry. Lighting gets its own rule and its own named power source. "Essential functions" is left for the operator to define. In a building from 1995 that list was lights, heat, and the elevator. In a building operating in 2026 it also includes the cabinet holding the switches, the internet connection, and the phone system, because without those the medication record and the ability to call anyone both stop.

This is a question with a physical answer. Someone can walk to the room, look at what is plugged into what, and tell you in five minutes. For why that room deserves attention on its own, see why clinical systems, resident Wi-Fi, and building controls should never share one flat network.

6. Can you produce the resident roster with the network down?

Rule 10.1 requires a community to keep "readily available a roster of current residents, their room assignments and emergency contact information, along with a facility diagram showing room locations."

If that roster lives only in the health record system, it is readily available for exactly as long as the network is. In an evacuation, that is the document that tells the fire department who is in the building and which room they are in.

Rule 10.6(A) is the rule's own answer to this and it is easy to miss. It requires written emergency instructions to be "readily available 24 hours a day in more than one location with all staff aware of the locations." More than one location is a redundancy requirement written in plain English. A single shared drive is one location. So is a single binder. Rule 12.33 extends the same logic outside the building, requiring staff who accompany residents off site to have "ready access to the pertinent personal information of those residents in the event of an emergency."

7. Does your emergency telephone still work when the building loses power?

This is the one most operators have never been asked, and it is last because it gives you no time at all.

Rule 10.11 requires "at least one telephone, not powered by household electrical current" to be available for immediate emergency use, with police, fire, ambulance, and poison control contacts readily accessible.

That rule was written for a copper landline. A copper line draws its power from the phone company, not from the building, which is exactly why it keeps working when the power goes out. It was a deliberate piece of engineering, and the rule encodes it.

Most communities have since replaced those lines with voice over IP, which is a phone system that runs over the building's own internet connection and the building's own power. It is cheaper, it is more flexible, and it dies with the network. The regulation still requires a telephone that works when household current does not, and it never says the words voice over IP, network, or internet, so nothing in the upgrade process would have flagged the conflict.

We cannot tell you how many Colorado communities are affected, because no data on that exists and we will not invent it. What we can tell you is that the question has a definite answer in your building, that answer is knowable this afternoon, and Rule 10.6(D) is waiting behind it: the plan must include "a pre-determined means of communicating with residents, families, staff and other providers." Which is what, exactly, when the phones are down?

What To Do With This

Five of the seven can be checked this week without spending anything.

• Ask whoever handles your IT to restore one resident record from backup and show you the result. Not a report saying the backup ran. The restored file.
• Unplug the building's internet connection for sixty seconds and try to place a call from the emergency telephone. That is the 10.11 test, and it takes a minute.
• Print the current resident roster and the facility diagram, and put a copy somewhere that is not the network. Then name the second location out loud, because 10.6(A) requires more than one.
• Walk to the room that holds your network equipment and find out whether it is on the generator.
• Look at your drill documentation and see whether a technology outage has ever been one of them.

The two that take longer are the ones with real judgment in them: whether a hosted health record system satisfies 18.2's "on site at all times," and what belongs on your definition of "essential functions" in 10.6(E). Both deserve a written answer from someone accountable, and the first deserves an attorney.

If you operate more than one community, there is a harder question underneath all seven. Would you get the same answer at every building? In most portfolios one community has a landline nobody ever removed and one replaced it three years ago, and nobody has compared them. That gap is a standards problem before it is a technology problem, and a survey will find it one building at a time. For what a full outage actually costs while it is happening, see what happens when a senior living community loses internet for 24 hours, and for the documentation side, what belongs in a compliance binder covers what a carrier or a surveyor asks to see.

Frequently Asked Questions

Does Colorado's assisted living regulation require cybersecurity?

No. 6 CCR 1011-1 Chapter 7 does not use the words network, internet, cybersecurity, backup, password, or encryption anywhere in its 83 pages, as checked against the version effective July 1, 2025 on August 20, 2026. What it does instead is require outcomes. Records must be protected from loss, damage, and unauthorized access. Care must continue for at least 72 hours after an emergency. A roster must be readily available. In 2026 those outcomes almost always depend on a network, a database, and a phone system, none of which the rule names.

What does Colorado require for assisted living resident records?

Rule 18.2 requires health information records for current residents to be kept on site at all times. Rule 18.5 requires a means of securing resident records that preserves confidentiality and provides protection from loss, damage, and unauthorized access. Rule 18.12 requires records of former residents to be kept for at least three years after the stay ends, and Rule 18.13 requires those records to be maintained and readily available at the residence for a minimum of six months after move-out. Retention and availability are two separate obligations.

Does a VoIP phone system meet Colorado's emergency telephone requirement?

That is a question worth asking your provider rather than assuming. Rule 10.11 requires at least one telephone not powered by household electrical current to be available for immediate emergency use. The rule was written for a copper landline, which draws power from the phone company rather than from the building. A voice over IP system runs on the building's own network and its own power. Whether a specific setup satisfies 10.11 depends on that setup, and it is a reasonable question to put in writing.

Does Colorado's assisted living regulation mention HIPAA?

No. The chapter never names HIPAA or business associates. Rule 18.6 requires resident record confidentiality to be protected in accordance with all applicable federal and state laws, which brings federal privacy law in by reference without naming it. Whether HIPAA applies to a particular community is determined by that community's own circumstances, not by this chapter.