What applies to a practice owner in Colorado
A guide to the entries on this map, not legal advice. Whether a law covers you depends on its text, its thresholds and its exemptions; check the entry and its sources, and ask counsel before you rely on it.
Applies to your practice
15 entries
- ColoradoIn forceIn force since July 1, 2023SB21-190, Protect Personal Data Privacy (the Colorado Privacy Act)
Applies to: Businesses that handle the personal data of 100,000 or more Colorado consumers a year, or sell data and handle that of 25,000 or more
Binds controllers of 100,000 or more Colorado consumers' data; PHI-only exemption, so practices and hospitals over the threshold are covered for other personal data, though most practices fall below it.
- FederalFinalIn force since March 18, 2024HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (bulletin issued December 2022, revised March 18, 2024)
Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps
HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.
- ColoradoIn forceIn force since Aug. 7, 2024HB24-1058, Protect Privacy of Biological Data
Applies to: Businesses covered by the Colorado Privacy Act
Binds controllers covered by the Colorado Privacy Act; PHI-only exemption, so practices and hospitals over its thresholds need consent for biological or neural data used for identification.
- FederalFinalIn force since Jan. 10, 2025HHS Office for Civil Rights, Dear Colleague letter: Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies (Jan. 10, 2025)
Applies to: Covered entities under Section 1557 that use patient care decision support tools
OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.
- FederalIn forceIn force since May 1, 2025Nondiscrimination in Health Programs and Activities, final rule, 89 FR 37522 (May 6, 2024); 45 CFR 92.210, Nondiscrimination in the use of patient care decision support tools
Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges
Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.
- ColoradoIn forceIn force since May 23, 2025SB25-276, Protect Civil Rights Immigration Status
Applies to: Businesses covered by the Colorado Privacy Act
Binds controllers covered by the Colorado Privacy Act; PHI-only exemption, so practices and hospitals over its thresholds need consent to process precise geolocation or sell any sensitive data.
- ColoradoIn forceIn force since July 1, 2025HB24-1130, Privacy of Biometric Identifiers & Data
Applies to: Anyone who controls or processes any amount of biometric identifiers
Binds any controller of biometric identifiers, whatever its size; PHI-only exemption under the Colorado Privacy Act, so staff time-clock or door-access scans at practices and hospitals are covered.
- ColoradoIn forceIn force since Oct. 1, 2025SB24-041, Privacy Protections for Children's Online Data
Applies to: Controllers offering an online service, product or feature to a consumer they actually know or willfully disregard is under 18, regardless of the Colorado Privacy Act's volume thresholds, and their processors
Binds controllers of any size offering online services to known minors; PHI-only exemption under the Colorado Privacy Act, so a practice or hospital website or app used by minors is covered.
- ColoradoIn forceIn force since Dec. 1, 2025Colorado Privacy Act Rules (4 CCR 904-3)
Applies to: Businesses covered by the Colorado Privacy Act
Binds controllers covered by the Colorado Privacy Act; PHI-only exemption, so practices and hospitals over its thresholds need consent for health inferences and must offer a profiling opt-out.
- ColoradoEnactedTakes effect Jan. 1, 2027HB26-1263, Conversational Artificial Intelligence Service Operator Requirements
Applies to: Operators of chatbots available to the public
Binds anyone who offers a public chatbot to consumers; the bill summary lists no customer-service or health care exclusion, so a practice's or hospital's patient-facing chatbot appears covered.
- ColoradoEnactedTakes effect Jan. 1, 2027SB26-189, Automated Decision-Making Technology
Applies to: Developers and deployers of automated decision-making technology used in consequential decisions, including health care services
Binds deployers of automated decision-making technology; HIPAA covered entities are exempt from most duties but must still give patients a general notice of their advanced technology use.
- FederalFinalHHS Office for Civil Rights, Business Associates guidance (web page, content last reviewed July 30, 2026): AI chatbot example
Applies to: HIPAA covered entities and the vendors that handle PHI for them
HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.
- FederalProposedSigned Jan. 6, 2025HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22
Applies to: HIPAA covered entities and business associates
Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.
- ColoradoProposedAutomated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General
Applies to: Developers and deployers of automated decision-making technology, and operators of public chatbots
Proposed rules would bind deployers of automated decision-making technology and operators of public chatbots, roles a practice or hospital takes on when it deploys either.
- FederalIntroducedS. 3062, Guidelines for User Age-verification and Responsible Dialogue Act of 2026 (GUARD Act), 119th Congress, reported by the Senate Judiciary Committee with an amendment (Calendar No. 406)
Applies to: Anyone who makes an AI chatbot publicly available to consumers
Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.
Applies to your physicians
0 entries
None on the map.
Also affects your practice
10 entries
- FederalIn forceIn force since Jan. 1, 2024Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly, final rule (CMS-4201-F), 88 FR 22120 (April 12, 2023), RIN 0938-AU96; 42 CFR 422.101(b)(6) and (c)(1) and 422.566(d)
Applies to: Medicare Advantage organizations
Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.
- FederalFinalIn force since Feb. 6, 2024CMS, Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F), HPMS memo, Feb. 6, 2024
Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans
Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.
- FederalIn forceIn force since Jan. 1, 2025Medicare physician fee schedule payment for digital mental health treatment devices, HCPCS G0552, G0553 and G0554: CY 2025 final rule (CMS-1807-F), 89 FR 97710 (Dec. 9, 2024), expanded in the CY 2026 final rule (CMS-1832-F), 90 FR 49266 (Nov. 5, 2025)
Applies to: Physicians and other practitioners billing the Medicare physician fee schedule
Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.
- ColoradoIn forceIn force since Oct. 15, 2025Regulation 10-1-1 (3 CCR 702-10), Governance and Risk Management Framework Requirements for Life Insurers', Private Passenger Automobile Insurers', and Health Benefit Plan Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models
Applies to: Life, private passenger auto and health benefit plan insurers that use external consumer data, or models built on it; those that do not use it file an annual attestation
Binds health benefit plan insurers: a provider acting for the plan must be ultimately responsible for prior authorization or concurrent review denials and modifications that consumer-data models inform.
- FederalIn forceIn force since Jan. 1, 2026Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes, final rule (CMS-0057-F), 89 FR 8758 (Feb. 8, 2024), RIN 0938-AU87
Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges
Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.
- FederalIn effectIn force since July 5, 2026CMS Innovation Center, Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model (request for applications issued Dec. 5, 2025; version 1.1, Feb. 12, 2026)
Applies to: Medicare Part B-enrolled organizations that join the model, other than suppliers of durable medical equipment, prosthetics, orthotics and supplies and laboratory suppliers; their Original Medicare patients; and clinicians who co-manage those patients
Voluntary CMS model: participating organizations and co-managing clinicians gain new billing options; no duty unless an organization joins.
- ColoradoEnactedTakes effect Jan. 1, 2027HB26-1139, Use of Artificial Intelligence in Health Care
Applies to: Carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations and managed care entities that use AI in utilization review; the payment ban binds carriers and payers under Medicaid and the Children's Basic Health Plan
Binds carriers and UR entities: no medical necessity denial solely on AI output without clinician review; a provider billing bar appears only in the Legislative Council summary, so no role.
- FederalProposedSigned July 16, 2026Medicare and Medicaid Programs; CY 2027 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies, proposed rule (CMS-1848-P), 91 FR 43842 (July 16, 2026), RIN 0938-AV82
Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule
Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.
- FederalIntroducedH.R. 3514, Improving Seniors' Timely Access to Care Act of 2025, 119th Congress, ordered reported by the House Ways and Means Committee
Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress
Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.
- FederalIntroducedS. 3097, Health Information Privacy Reform Act, 119th Congress, reported by the Senate Health, Education, Labor, and Pensions Committee with an amendment (Calendar No. 538)
Applies to: HHS (rulemaking); entities that process identifiable health information outside HIPAA's protections for protected health information, including data brokers; HIPAA covered entities for the AI-related minimum necessary rules
Would direct HHS to write rules on how the minimum necessary standard applies to PHI used for AI; covered entities would be bound only through those future rules, so it affects them.
Calendar of dates laws take effect (Colorado): subscribe or download the .ics file.
Colorado on the map · Federal entries · About the data · How to read the law map