A friend of mine who is a MMJ user said that the CO MMJ law specifies that only patients and the state have access to the card holder records.

So, your guess is as good as mine to which is true.