Colorado: AI health laws

SB21-169, Restrict Insurers' Use of External Consumer Data

Bars insurers from unfairly discriminating by race, disability and other protected traits in any insurance practice, including utilization management and claims, and, under rules set by the Commissioner of Insurance, from using external consumer data, or algorithms and predictive models that use such data, in ways that unfairly discriminate.

Physician read. The law's definition of insurance practice includes utilization management and claims management, and Regulation 10-1-1, adopted under it, applies to health plans' prior authorization decisions informed by external consumer data. It places no duty on physicians.

Applies to: Insurers, including health insurers

Notes: Long title: Concerning protecting consumers from unfair discrimination in insurance practices. Carried out through Regulation 10-1-1, the next entry.

Regulation 10-1-1 (3 CCR 702-10), Governance and Risk Management Framework Requirements for Life Insurers', Private Passenger Automobile Insurers', and Health Benefit Plan Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models

Requires insurers that use external consumer data, or algorithms and predictive models that use it, to test them for unfair discrimination under a risk-based governance framework, and requires health plans to make a provider acting for the plan ultimately responsible for decisions to modify or deny prior authorization or concurrent review requests that such data or models inform.

Physician read. Since Oct. 15, 2025, when external consumer data (such as credit scores, location, purchasing or social media data, but not a patient's medical records), or an algorithm or model that uses such data, informs a health plan's decision to modify or deny a prior authorization or concurrent review request, a provider acting for the plan must be ultimately responsible for the decision. Plans that use such data file a compliance report with the Division of Insurance each July 1 from 2026; plans that do not file an officer's attestation each Dec. 1.

Applies to: Life, private passenger auto and health benefit plan insurers that use external consumer data, or models built on it; those that do not use it file an annual attestation

Notes: The current version was adopted Aug. 19, 2025, according to the Secretary of State; the original rule took effect Nov. 14, 2023.

HB26-1139, Use of Artificial Intelligence in Health Care

Requires AI used in utilization review to base decisions on the individual patient's clinical circumstances, bars a denial based in whole or in part on medical necessity issued solely on an AI system's output without review by a licensed clinician or other competent regulated professional, requires disclosure to state regulators of where AI is used in utilization review, and bars payment for psychotherapy conducted by an AI system.

Physician read. From Jan. 1, 2027, a carrier or other entity using AI in utilization review cannot issue a denial based in whole or in part on medical necessity solely on an AI system's output; a licensed clinician or other competent regulated professional must review it, while AI-assisted approvals remain allowed. Psychotherapy conducted directly by an AI system is not payable by carriers, Medicaid or the Children's Basic Health Plan; the Legislative Council summary also says the review rule covers delays and that a mental health provider may not bill for services an AI system provides, points the bill page's summary does not mention.

Applies to: Carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations and managed care entities that use AI in utilization review; the payment ban binds carriers and payers under Medicaid and the Children's Basic Health Plan
Also touches: Mental health AI

Notes: The signed act could not be opened by automated reading; the entry rests on the official bill summary and the Legislative Council summary, which differ on delays and billing.

SB26-189, Automated Decision-Making Technology

Replaces the 2024 Colorado AI Act with notice-based duties: deployers must tell consumers when they interact with automated decision-making technology and, after an adverse outcome, give an explanation, a chance to correct data and a right to request meaningful human review; enforced by the Attorney General.

Physician read. From Jan. 1, 2027, HIPAA covered entities doing business in Colorado (providers must operate from a Colorado location) and their business associates are exempt from most duties but must give patients a general notice of how they use advanced technologies and, when such technology determines eligibility for financial assistance, specified disclosures, according to law firm summaries. Employment decisions carry the full duties, and organizations that are neither covered entities nor business associates get no carve-out.

Applies to: Developers and deployers of automated decision-making technology used in consequential decisions, including health care services
Also touches: Clinical decision and chatbot limits

Notes: The act took effect May 14, 2026, repealing and reenacting SB24-205 (the 2024 Colorado AI Act), which never became operative: SB25B-004 delayed it, and its enforcement was paused under a stipulated federal court order in xAI v. Weiser on April 27, 2026, according to a law firm summary. Its duties begin Jan. 1, 2027. The health care carve-out comes from law firm summaries, not the act's text. The Legislative Digest lists a portion effective July 1, 2027 that could not be identified.

Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General

Proposed rules on developers' disclosures to deployers, disclosures after an adverse outcome, correction and meaningful human review, age assurance, disclosures to chatbot users, protections for minors and claims that chatbot output comes from licensed professionals; written comments accepted until Oct. 26, 2026.

Physician read. Nothing here binds anyone yet; the final rules will set the content of explanations and human review under SB26-189 and how HB26-1263's duties work, and proposed Rule 12 would bar claims that chatbot outputs come from, are endorsed by or equal the services of licensed health care, mental health, legal or dietitian professionals, according to a law firm summary. Written comments are accepted until 11:59 p.m. on Oct. 26, 2026.

Applies to: Developers and deployers of automated decision-making technology, and operators of public chatbots
Also touches: Clinical decision and chatbot limits; Mental health AI

Notes: Filed with the Secretary of State Aug. 11, 2026. On the Attorney General's page the proposed rules are posted only as a Word file, which could not be read here; the topics, the Oct. 26 hearing date and a planned Jan. 1, 2027 effective date come from a law firm alert.

HB26-1263, Conversational Artificial Intelligence Service Operator Requirements

Requires chatbot operators to disclose that the service is AI, keep a protocol for prompts about suicidal ideation or self-harm, report on it annually to the Attorney General and add protections for users under 18, and bars stating that output is provided by, endorsed by or equivalent to the services of certain licensed or certified professionals.

Physician read. From Jan. 1, 2027, an operator of a chatbot available to the public may not state that its output is provided by, endorsed by or equivalent to the services of certain licensed or certified professionals, and must disclose that the service is AI and keep a protocol for prompts about suicidal ideation or self-harm. The act counts anyone who offers such a service to a consumer as an operator, and its official summary lists no exception for health care organizations.

Applies to: Operators of chatbots available to the public
Also touches: Patient disclosure of AI use; Mental health AI

Notes: The act took effect Aug. 12, 2026; operator duties begin Jan. 1, 2027. It was signed May 29, 2026, according to the bill page, the Legislative Digest and Healthier Colorado; the Attorney General's page says July 1. The introduced bill's summary made violations deceptive trade practices under the Colorado Consumer Protection Act, and Healthier Colorado, an advocacy group, says they carry that act's penalty of $20,000 per violation; the enacted summary does not address enforcement.

HB26-1195, Psychotherapy Artificial Intelligence Restrictions

Allows AI for administrative or supplementary tasks, with the professional keeping full responsibility for reviewing its output; requires written notice and written consent before AI records or transcribes a session; and bars AI from therapeutic communication except in real time with the therapist and client, and from generating treatment plans or therapeutic recommendations without the therapist's review and approval.

Physician read. Since Aug. 12, 2026, Colorado mental health licensees may have AI record or transcribe a session only after telling the client in writing of its use and purpose and getting written consent, and may not deny services to a client who refuses or revokes consent. AI may take part in therapeutic communication only in real time with the therapist and client, and may not generate treatment plans or therapeutic recommendations without the therapist's review and approval.

Applies to: Mental health licensees and others lawfully providing psychotherapy
Also touches: Patient disclosure of AI use; Clinical decision and chatbot limits

Notes: The Division of Professions and Occupations applies the duties to mental health licensees; whether psychiatrists and other physicians fall within the act's list of professionals could not be confirmed. A ban on offering or advertising psychotherapy through AI, enforced under the Colorado Consumer Protection Act, appears in the introduced bill's summary and a law firm summary but not in the official summaries written after signing.

SB21-190, Protect Personal Data Privacy (the Colorado Privacy Act)

Requires consent before processing sensitive data, including data revealing a health condition or diagnosis, and lets consumers opt out of profiling used in decisions with legal or similarly significant effects, including decisions about health care services; enforced by the Attorney General and district attorneys.

Physician read. Protected health information collected, stored and processed by HIPAA covered entities and their business associates is outside the act, so it reaches health data held by others, such as consumer apps and wearables, when the business meets the act's thresholds. Where it applies, a business needs consent before processing health-condition data, which the act defines to include its collection, use and analysis.

Applies to: Businesses that handle the personal data of 100,000 or more Colorado consumers a year, or sell data and handle that of 25,000 or more

Notes: No private right of action; the 60-day cure period ended Jan. 1, 2025.

HB24-1058, Protect Privacy of Biological Data

Adds biological data, including neural data measured by devices, to the Colorado Privacy Act's sensitive data when it is used or intended for identification.

Physician read. Neural and other biological data from consumer devices count as sensitive data when used or intended for identification, so covered businesses need opt-in consent to process them. Data held as protected health information by a covered entity stays under HIPAA.

Applies to: Businesses covered by the Colorado Privacy Act

SB25-276, Protect Civil Rights Immigration Status

Among other changes, amends the Colorado Privacy Act to make precise geolocation data sensitive data and to bar selling any consumer's sensitive data without consent.

Physician read. Since May 23, 2025, precise geolocation data is sensitive data under the Colorado Privacy Act, so businesses that meet the act's thresholds need consent to process it, and consent before selling any sensitive data, including health-condition data. Location-targeted advertising near a clinic, for example, would fall under the consent rule for a business that meets the thresholds.

Applies to: Businesses covered by the Colorado Privacy Act

Notes: Its privacy amendments are what place it on this map.

HB24-1130, Privacy of Biometric Identifiers & Data

Requires a written retention and deletion policy and an incident-response protocol for biometric identifiers and disclosure and consent before collecting them, and limits the purposes for which an employer may require employees' consent as a condition of employment.

Physician read. Since July 1, 2025, any organization that controls or processes biometric identifiers, including fingerprints or face scans used for staff time clocks or building access outside HIPAA-protected records, needs a written retention and deletion policy with an incident-response protocol and must meet disclosure and consent requirements before collecting them. An employer may make consent a condition of employment only for listed purposes, such as secure access, recording the work day and workplace safety, and needs the employee's consent for any other use.

Applies to: Anyone who controls or processes any amount of biometric identifiers

Colorado Privacy Act Rules (4 CCR 904-3)

Treats inferences about health drawn from ordinary personal data as sensitive data needing consent, defines levels of human involvement in automated processing, and requires a clear opt-out for profiling used in decisions that provide or deny health care services.

Physician read. A health inference that software draws from ordinary personal data, such as an app concluding a user is likely depressed, needs consent unless the user is over 13, the purpose is obvious from context, and the inference is deleted within 24 hours, not shared with any processor, affiliate or third party, and used only for the disclosed purpose. Businesses covered by the act that use profiling in decisions that provide or deny health care services must offer a clear and conspicuous opt-out at or before the profiling.

Applies to: Businesses covered by the Colorado Privacy Act

Notes: First version effective July 1, 2023. Part 9, on profiling disclosures, could not be read in full.