
You can read the rules here:
http://www.colorado.gov/cs/Satellite/Rev-Enforcement/RE/1251575119584
It appears the DOR has tried to address security and privacy concerns of patients, but they still fall far short of what is necessary to ensure patient confidentiality. The new rules state that "Surveillance recordings and clear still photos must be made available to the MMED and law enforcement upon an dministrative or law enforcement request demonstrating that the information sought is relevant and material to a legitimate regulatory or law enforcement inquiry."
There is no definition of the word "legitimate", so this would probably require MMCs to give patient surveillance recordings to the DOR or any other law enforcement agency on demand, unless the MMC was willing to go to court to challenge the "legitimacy" of the request.