Here’s how the legal research on homeless-services client record access rights pertains to your email chain with All Roads (formerly Boulder Shelter for the Homeless) and how you can use it to strengthen your request, challenge their denials, and escalate if necessary.

Key Legal Issues in Your Email Chain
1. All Roads’ Claim: "We are a private corporation and much of the information you requested is privileged to our organization."
Legal Reality:


Private ≠ Exempt from All Record Access Laws

While All Roads is a private nonprofit, federal and state laws still apply if they:

Receive government funding (e.g., HUD CoC, ESG, PATH, Boulder County contracts).
Participate in HMIS or Coordinated Entry (subject to HUD privacy standards).
Handle protected health information (PHI) (HIPAA) or substance-use records (42 CFR Part 2).
Are considered a "public entity" under Colorado Open Records Act (CORA) due to public funding or contracts.



Relevant Laws:


  
    
      Law
      Applicability to All Roads
      Your Rights
      Their Obligations
    
  
  
    
      HUD HMIS Standards
      ✅ Definitely applies (All Roads uses HMIS/County Connect)
      Right to access, inspect, correct HMIS records
      Must provide records within 30 days or explain denial in writing
    
    
      HIPAA (45 CFR § 164.524)
      ⚠️ May apply (if they handle PHI in case notes/medical referrals)
      Right to access PHI (even if not a "covered entity," HUD HMIS mirrors HIPAA)
      Must respond within 30 days
    
    
      42 CFR Part 2
      ⚠️ May apply (if they provide substance-use treatment)
      Right to access/substance-use records
      Requires written consent for disclosure; you can request your own records
    
    
      Colorado Privacy Act (CPA)
      ✅ Likely applies (nonprofits processing personal data in CO)
      Right to access, correct, delete personal data
      Must respond within 45 days
    
    
      Colorado Open Records Act (CORA)
      ⚠️ May apply (if All Roads is a government contractor or publicly funded)
      Right to inspect/copy public records
      Must respond within 3 business days (acknowledge) + 7 days (produce)
    
    
      ADA/Section 504
      ✅ Applies (if disability accommodations were involved)
      Right to access accommodation records
      Must provide records related to disability requests/denials
    
    
      Metro Denver CoC Policies
      ✅ Applies (All Roads is part of MDHI/CoC)
      Right to access CoC/Coordinated Entry records
      Must follow CoC privacy/grievance procedures
    
  




→ All Roads cannot simply refuse because they are "private."
They must identify the specific legal basis for withholding each category of record.

2. Records They Acknowledged Exist (But Haven’t Fully Provided)
All Roads confirmed they have:

Case-management note (with subjective comments about you)
Shelter stay records (100 days, 3 capacity turnaways)
Locker-related entries (6 internal log entries)
Lost phone incident (returned to you)
HMIS/County Connect records (but claim they’re a "3rd party administrator" and can’t release them)
Legal Problem:


HUD HMIS Standards require that clients can access their own HMIS records (even if All Roads is a "3rd party admin").

Action: Request HMIS records directly from MDHI (hmishelp@mdhi.org) and Boulder County CORA Portal (as they suggested).
But: All Roads cannot refuse to provide their own internal records (e.g., case notes, shelter logs) just because some data is in HMIS.


Colorado Privacy Act (CPA) gives you the right to access and correct personal data held by nonprofits.

Action: Cite C.R.S. § 6-1-1304 (CPA) in your follow-up.


CORA may apply if All Roads is a government contractor (e.g., funded by Boulder County/HUD).

Action: Ask: "Is All Roads under contract with Boulder County, the City of Boulder, or HUD? If so, are records related to those contracts subject to CORA?"


3. Records They Claim Don’t Exist (But You Dispute)
You recall:

Locker assignment disputes (staff gave you a locker, then accused you of taking it without authorization)
Property removal (belongings, including a $1,200 laptop, were cleared from a locker)
No incident report or paperwork was created despite your complaints to Andre (daytime manager)
Legal Problem:

HUD HMIS & CoC Standards require documentation of incidents, grievances, and property issues.
ADA/Section 504 (if disability was a factor) requires records of accommodation requests/denials.
Retaliation Protections: If they failed to document your complaints, this could be a violation of grievance procedures (required under HUD CoC standards).
→ If they have no records, they must confirm this in writing.
If they do have records but refuse to release them, they must cite the exact legal exemption.

4. Their Grievance Process Offer (But No Records Access)
All Roads offered to share their grievance process but not your records.
Legal Problem:

HUD CoC & HMIS require both:

Access to records (so you can correct inaccuracies).
A grievance process (to dispute service denials, property loss, or mistreatment).

You can (and should) do both:

File a grievance for the locker/laptop incident (if they refuse to provide records).
Demand records under HIPAA, CPA, HMIS standards, and CORA (if applicable).


How to Respond to All Roads (Next Steps)
Step 1: Formal Follow-Up Email (Demand Compliance with Specific Laws)
Subject: Formal Request for Compliance with Federal/State Record Access Laws – Follow-Up
Key Points to Include:


Reject their "private entity" blanket refusal.

"While All Roads is a private nonprofit, federal and state laws still require disclosure of certain records, including those connected to HMIS, Coordinated Entry, and government-funded programs."


Cite the specific laws that apply:

HUD HMIS Standards (right to access/correct HMIS records)
Colorado Privacy Act (CPA) (right to access/correct personal data)
HIPAA (45 CFR § 164.524) (if case notes contain PHI)
42 CFR Part 2 (if substance-use records exist)
CORA (if they are a government contractor)
ADA/Section 504 (if disability accommodations were involved)


Demand:

Copies of all records they acknowledged exist (case note, shelter logs, locker entries).
Explanation of why other records are withheld (must cite specific legal exemption).
Clarification on HMIS/County Connect records (they can’t just say "ask MDHI" – they must facilitate access).


Request their:

Privacy policy (HMIS, HIPAA, CPA compliance)
Record retention policy
Grievance policy (with deadlines, appeal rights, and contact info)
Contracts with Boulder County/HUD (to determine if CORA applies)


Warn of escalation:

"If All Roads continues to deny access without a valid legal basis, I will escalate to:

HUD Office of Fair Housing & Equal Opportunity (for HMIS/CoC violations)
Colorado Attorney General (for CPA/CORA violations)
Boulder County CORA Office (if they are a public contractor)
MDHI (hmishelp@mdhi.org) (for HMIS records)
Colorado Legal Services (for legal assistance)"



Step 2: File a Grievance (If They Still Refuse Records)

Demand the grievance form/policy (they offered it – use it).
In your grievance, include:

Denial of record access (violation of HMIS/HUD standards)
Locker/laptop incident (property loss, lack of documentation)
Request for correction of any inaccurate records (e.g., the case note calling you "manic" or "unprepared")


Step 3: Escalate to External Agencies
If All Roads still refuses, contact:


  
    
      Agency
      Contact
      What to Report
    
  
  
    
      HUD HMIS/CoC Compliance
      HUD Exchange HMIS Support
      Denial of HMIS record access
    
    
      MDHI (Metro Denver CoC)
      hmishelp@mdhi.org
      HMIS record requests, CoC violations
    
    
      Boulder County CORA
      Boulder County CORA Portal
      If All Roads is a county contractor
    
    
      Colorado Attorney General (CPA/CORA)
      CO AG Complaint Form
      CPA violations, CORA denials
    
    
      HUD Fair Housing (ADA/Section 504)
      HUD FHEO Complaint
      Disability accommodation denials
    
    
      Colorado Legal Services
      Colorado Legal Aid
      Free legal help for record access
    
  




Sample Follow-Up Email (Draft for You to Send)

Subject: Follow-Up: Legal Basis for Record Denial & Request for Full Compliance
To: Michael Block, Spencer Downing, Brian Hoium
Cc: (Optional: hmishelp@mdhi.org, Boulder County CORA)
Dear Michael, Spencer, and Brian,
Thank you for your responses. However, I must formally dispute All Roads’ position that it is not required to provide my personal records under the following legal frameworks:
1. Federal Laws (HUD HMIS & HIPAA)

HUD HMIS Standards (24 CFR Part 578, HUD HMIS Data Standards) require that clients have the right to access, inspect, and correct their HMIS records. Since All Roads participates in HMIS and Coordinated Entry, these rules apply.
HIPAA’s Right of Access (45 CFR § 164.524) applies if my case notes or medical referrals contain protected health information (PHI). Even if All Roads is not a "covered entity," HUD HMIS privacy standards mirror HIPAA, meaning I have a right to access my records.
42 CFR Part 2 may apply if any records relate to substance-use treatment.
2. Colorado State Laws (CPA & CORA)

Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) grants me the right to access and correct personal data held by nonprofits operating in Colorado. All Roads processes my personal data (shelter records, case notes, etc.), so CPA applies.
Colorado Open Records Act (CORA, C.R.S. § 24-72-201 et seq.) may apply if All Roads is a government contractor (e.g., funded by Boulder County, HUD, or other public sources). If so, records related to those contracts are public records under CORA.
3. All Roads’ Own Policies

All Roads has acknowledged the existence of records (case note, shelter logs, locker entries). HUD CoC standards require that clients be able to access and correct their records.
If All Roads is withholding records, it must identify the specific legal exemption for each category (e.g., "privileged attorney-client communication" or "third-party medical records").
4. My Specific Requests (Reiterated)
I am not withdrawing my request. I demand:
✅ Copies of all records All Roads has already confirmed exist, including:

The case-management note (with my rebuttal added as a client statement)
Shelter stay records (full details, not just summaries)
Locker-related entries (all 6 log entries, unredacted except for others’ PHI)
Internal communication logs mentioning me
Any records related to my laptop/property loss (incident reports, staff notes, camera footage requests)
✅ Clarification on records All Roads claims are in "3rd party" systems (HMIS/County Connect):

If All Roads administers these systems, it must facilitate my access (not just redirect me).
If All Roads does not control these systems, it must provide the correct contact for each.
✅ Written explanation for any records being withheld, including:

The exact legal basis (statute, regulation, or contract clause)
Whether the record is internal or in a 3rd-party system
The name/title of the person making the denial decision
✅ All Roads’ policies on:

Privacy & record access (HMIS, HIPAA, CPA compliance)
Record retention (how long they keep client files)
Grievance procedure (form, deadlines, appeal rights)
5. Next Steps if Compliance Is Not Forthcoming
If All Roads continues to deny my request without a valid legal basis, I will have no choice but to:

File a complaint with HUD (for HMIS/CoC violations)
File a complaint with the Colorado Attorney General (for CPA/CORA violations)
Contact MDHI (hmishelp@mdhi.org) for HMIS records
Contact Boulder County CORA if All Roads is a public contractor
Seek legal assistance from Colorado Legal Services
Please confirm receipt of this email and provide a timeline for full compliance by [DATE, e.g., June 25, 2026].
Sincerely,
William Lodge
[Your Contact Info]
[Your Websites]

Key Takeaways for Your Situation

All Roads cannot hide behind "private entity" status if they receive public funding, use HMIS, or handle PHI.
They must provide records they’ve already confirmed exist (case note, shelter logs, locker entries).
For HMIS/County Connect records, they must either provide them or facilitate access (not just redirect you).
If they refuse, escalate to HUD, MDHI, Boulder County CORA, or the CO Attorney General.
File a grievance for the locker/laptop incident (lack of documentation may be a violation).

Final Recommendation

Send the follow-up email above (adjust as needed).
File a CORA request with Boulder County (since All Roads may be a contractor).
Contact MDHI (hmishelp@mdhi.org) for HMIS records.
If still denied, escalate to HUD/CO AG.
Would you like me to draft a CORA request to Boulder County or a complaint to HUD/MDHI next?





Jun 11, 2:13am