August 21, 2013 Updated: August 21, 2013 at 3:49 pm
DENVER -- About a dozen medical marijuana patients wore paper bags over their heads Wednesday morning in front of the Department of Public Health and Environment to illustrate the fact that their anonymity has been compromised.
More than a month ago, an audit revealed that the Health Department's registry of 108,000 active medical marijuana patients had not been treated as confidential and had been breached.
"I'm concerned about the registry and the policies for access to it," said "Wayward" Bill Chengelis, chair of the U.S. Marijuana Party. "It's a violation of HIPPA. Why do they need to know who patients are?"
HIPPA - the Health Insurance Portability and Accountability Act - mandates patient medical records be kept confidential.
The audit released in June found that "Public Health staff did not take the proper precautions to ensure that only appropriate individuals were exposed to confidential registry data."
Ron Hyman, who manages the state's patient registry, told the Associated Press the agency is doing everything possible to respond to the audit and keep the database secure.
"We take every breach seriously," he said.
Several breaches in security were noted in the audit including when patient information was accidentally sent to the wrong person. Other noted shortfalls occurred when third-party vendors were granted access to the database without signing a confidentiality agreement first.
Among the protesters Wednesday was Audrey Hatfield, of Colorado Springs, who runs Coloradans for Cannabis Patient Rights.
Hatfield, 53, said three medical marijuana patients from Colorado have told her they were pulled over in other states and the officers knew without asking that they were medical marijuana patients.
Patients are issued red cards once a doctor prescribes marijuana for a qualifying medical need. It's the applications for red cards that puts patients in the health department's registry and that registry is what patients fear is being misused.
Laura Kriho with Cannabis Therapy Institute called for the health department to destroy the registry and start over.
However, the Colorado Board of Health rejected the group's request to draft emergency rules governing the registry.
While marijuana is now legal for all adults to possess and will be available in retail stores January without a prescription, those with a medical need want to keep their red cards.
Mimi Friedman, 30, of Colorado Springs, said her prescribed marijuana is the only thing allowing her to live without a feeding tube after her digestive track was destroyed.
She said maintaining her prescription is important because her medical dosage is much higher than the 1 ounce allowed to be purchased and possessed by non-medical patients.
But Friedman said she doesn't want her name on a registry when other patients - those with chronic pain using heavy pain killers - don't have to be tracked.
Contact Megan Schrader