Colorado Healthcare
Compliance Guide

Colorado presents a dynamic yet generally favorable regulatory environment for healthcare companies, balancing patient access with robust oversight. The state has historically been progressive in its adoption of telehealth, particularly accelerated by the COVID-19 pandemic, leading to permanent expansions in coverage and modalities. Key regulatory bodies include the Colorado Medical Board, the Colorado Board of Nursing, the Colorado Dental Board, and the Colorado Department of Regulatory Agencies (DORA), which oversees many professional licensing boards. The general business climate is conducive to healthcare innovation, but companies must navigate a well-established Corporate Practice of Medicine (CPOM) doctrine, stringent prescribing rules, and evolving scope of practice regulations. Recent legislative actions have focused on solidifying telehealth parity, addressing behavioral health access, and refining professional licensure requirements. Colorado's commitment to expanding access, especially in rural and underserved areas, makes it an attractive market for telehealth and innovative care models, provided companies adhere strictly to its nuanced regulatory framework. The state's emphasis on patient safety and quality of care means that while innovation is encouraged, robust compliance infrastructure is paramount. Companies expanding into Colorado should anticipate a regulatory landscape that demands meticulous attention to licensure, professional independence, and the appropriate use of technology in healthcare delivery. The state's proactive approach to healthcare policy means continuous monitoring of legislative and regulatory updates is essential for sustained compliance.

Colorado maintains a robust Corporate Practice of Medicine (CPOM) doctrine, primarily rooted in statutory prohibitions and reinforced by administrative interpretations and historical case law, although not explicitly codified as a single 'CPOM statute.' The fundamental principle is that medical decisions and the practice of medicine must be free from corporate or lay control. Colorado Revised Statutes (C.R.S.) § 12-240-107(1)(a) states that 'A person shall not practice medicine... without a license.' This, coupled with prohibitions against aiding and abetting the unlicensed practice of medicine (C.R.S. § 12-240-120(1)(c)), forms the bedrock of CPOM enforcement. The Colorado Medical Board has consistently interpreted these provisions to mean that only licensed physicians or professional medical corporations (PCs) owned by physicians may employ other physicians to practice medicine. Non-physicians, including corporations, are generally prohibited from employing physicians or controlling medical judgments. This applies equally to dental practices (C.R.S. § 12-220-105(1)(a)) and other licensed professions. Ownership structures are critical: a standard business corporation cannot directly employ physicians or other licensed practitioners to provide professional services. Instead, professional corporations (PCs) or professional limited liability companies (PLLCs) are typically required, with ownership restricted to licensed professionals of the same profession. For instance, a medical PC must be owned by physicians, a dental PC by dentists, etc. This means non-physicians cannot own a medical practice, nor can a general business entity. This has significant implications for telehealth companies, medspas, dental practices, and wellness clinics. These entities cannot directly employ physicians, advanced practice registered nurses (APRNs), or physician assistants (PAs) to render professional services. Instead, a management services organization (MSO) structure is almost universally required. The MSO, a separate non-professional entity, provides administrative and non-clinical services (e.g., billing, marketing, IT, real estate) to a professional entity (PC/PLLC) owned and controlled by licensed practitioners. The professional entity then employs the practitioners and delivers the clinical services. This separation ensures that the MSO does not interfere with clinical decision-making, and the professional entity retains full control over the practice of medicine. Fee-splitting is also strictly prohibited under C.R.S. § 12-240-120(1)(g), meaning the MSO's compensation must be for legitimate, fair market value services and not tied to a percentage of professional fees. The Colorado Medical Board is vigilant in scrutinizing arrangements that appear to circumvent CPOM, especially in rapidly expanding sectors like telehealth and medspas where direct-to-consumer models might blur the lines of professional control.

Colorado has a progressive and comprehensive framework for telehealth, largely codified in C.R.S. § 10-16-123. The state explicitly permits the establishment of a valid practitioner-patient relationship via telehealth, provided the standard of care is met. This means an in-person visit is generally not required to initiate care, making Colorado highly favorable for telehealth-first models. All modalities are permitted: live interactive audio-visual (video conferencing) is the preferred standard, but live interactive audio-only (telephone) is also allowed when appropriate and clinically necessary, particularly for behavioral health and in situations where video is unavailable. Asynchronous (store-and-forward) technology is also recognized, especially for specialties like dermatology or radiology, as long as it supports the standard of care. There are no specific telehealth registration requirements for providers beyond their standard professional licensure with the relevant Colorado board (e.g., Medical Board, Board of Nursing). However, providers must be fully licensed in Colorado to provide telehealth services to patients located in Colorado, unless they are operating under an interstate compact to which Colorado is a party (e.g., IMLC, NLC, PSYPACT). Informed consent is a critical requirement. C.R.S. § 10-16-123(3)(d) mandates that providers obtain informed consent from the patient, or the patient’s legal guardian, prior to the delivery of telehealth services. This consent must include information about the services, the technology used, and patient rights, including confidentiality and data security. The standard of care for telehealth services is explicitly stated to be the same as the standard of care for in-person services (C.R.S. § 10-16-123(3)(a)). This means providers must ensure the telehealth interaction is sufficient to meet the clinical needs of the patient. There are no specific geographic restrictions within Colorado for telehealth delivery; services can be provided to patients anywhere in the state, provided the provider is licensed in Colorado. Payor parity laws (C.R.S. § 10-16-123) ensure that commercial health insurance carriers and Medicaid reimburse for telehealth services at the same rate as in-person services, further supporting telehealth adoption. While Colorado is welcoming to telehealth, providers must ensure their technology is secure and HIPAA-compliant, and that they maintain proper documentation of all telehealth encounters.

Colorado’s prescribing rules for telehealth largely align with in-person prescribing, with specific considerations for controlled substances. For non-controlled substances, a valid practitioner-patient relationship established via telehealth is sufficient for prescribing, provided the standard of care is met. For controlled substances, C.R.S. § 12-30-106(1) generally permits prescribing via telehealth if the prescriber has established a legitimate medical purpose and a bona fide practitioner-patient relationship. However, federal DEA regulations (21 CFR Part 1304) historically required an in-person medical evaluation prior to prescribing controlled substances, with exceptions during the COVID-19 public health emergency. While the DEA has proposed new rules, the current landscape (as of late 2024/early 2025) requires careful adherence to the 'Ryan Haight Online Pharmacy Consumer Protection Act of 2008' which mandates an in-person medical evaluation or a referral from a practitioner who has conducted one, unless a specific exception applies (e.g., for qualifying telemedicine encounters during a declared emergency or for practitioners operating within a hospital/clinic setting). For Colorado-licensed prescribers, the state generally defers to federal DEA guidelines for controlled substances when the patient is located in Colorado. All prescribers of controlled substances in Colorado are required to register with the Colorado Prescription Drug Monitoring Program (PDMP) and check the PDMP prior to prescribing Schedule II, III, and IV controlled substances, as mandated by C.R.S. § 12-30-106(4). This check must occur at the initial prescription and periodically thereafter. There are no specific quantity or refill limitations via telehealth beyond those applicable to in-person prescribing, which are often dictated by clinical appropriateness and federal/state scheduling. However, for specific drug classes like GLP-1s, testosterone, and stimulants, prescribers must exercise heightened caution and ensure comprehensive patient evaluations, monitoring, and adherence to specific guidelines from their respective boards. For example, the Colorado Medical Board emphasizes thorough documentation, appropriate diagnostic workups, and ongoing patient monitoring, especially for chronic conditions or medications with abuse potential. Prescribing controlled substances for weight loss, ADHD, or hormone therapy via telehealth without a robust initial evaluation and ongoing monitoring is a high-risk area. Providers must ensure their telehealth platform allows for secure communication and proper record-keeping to meet these stringent requirements. The DEA’s final rules on telehealth prescribing of controlled substances, expected in 2025, will be critical to monitor for any changes to these requirements.

Colorado has a progressive approach to the scope of practice for Advanced Practice Registered Nurses (APRNs), Physician Assistants (PAs), and other mid-level providers, emphasizing independent practice within their training and competency. Advanced Practice Registered Nurses (APRNs), specifically Nurse Practitioners (NPs), Clinical Nurse Specialists (CNSs), Certified Nurse Midwives (CNMs), and Certified Registered Nurse Anesthetists (CRNAs), generally have full practice authority in Colorado. C.R.S. § 12-255-112 grants APRNs the authority to practice independently, including diagnosing, ordering, performing, supervising, and interpreting diagnostic tests, and prescribing medications, including controlled substances, within their scope of practice and specialty. While a collaborative agreement is not legally mandated for most APRN functions, some may choose to enter into one for professional support or specific complex cases. However, it is not a prerequisite for practice authority. Physician Assistants (PAs) in Colorado operate under a more collaborative model. While C.R.S. § 12-240-113 allows PAs to provide medical services, they must do so under the supervision of a physician. The supervision requirements are not as rigid as in some states; PAs are not required to have constant direct supervision. Instead, the statute emphasizes a 'supervising physician' who is responsible for the PA's practice and maintains appropriate oversight. This typically involves regular review of charts, consultation, and availability for questions, rather than physical presence. The specific terms of supervision are often outlined in a delegated prescriptive authority agreement and a practice agreement between the PA and the supervising physician. PAs can prescribe controlled substances within their scope of practice under the delegated authority of their supervising physician. For Medical Assistants (MAs), particularly in settings like medspas, their scope of practice is strictly limited to delegated tasks that do not require independent medical judgment. C.R.S. § 12-240-107(1)(b) prohibits the unlicensed practice of medicine. MAs can perform administrative tasks and certain clinical tasks under the direct supervision of a physician, PA, or APRN. In medspas, this typically means MAs can assist with procedures but cannot perform injections, laser treatments, or other procedures that constitute the practice of medicine or nursing, unless specifically trained and delegated by a licensed professional who is physically present and directly supervising. Delegation rules are stringent: the delegating practitioner must ensure the MA is competent, the task is within the delegator's scope, and the delegation is appropriate for the patient's condition. The Colorado Medical Board and Board of Nursing frequently issue guidance on appropriate delegation. For all mid-level providers, their scope is defined by their education, training, and competence, and they are expected to practice within those boundaries, adhering to the same standard of care as physicians when performing similar services.

Navigating Colorado's Corporate Practice of Medicine (CPOM) doctrine necessitates careful business structuring, with the Professional Corporation (PC) and Management Services Organization (MSO) model being the predominant compliant framework. PC-MSO structures are almost always needed for any healthcare business where non-licensed individuals or entities seek to have an ownership stake or exert control over the business operations, or where a general business entity wishes to employ licensed practitioners. The PC (or PLLC) must be owned exclusively by licensed professionals of the same profession (e.g., physicians owning a medical PC, dentists owning a dental PC). This professional entity employs the licensed practitioners and delivers all clinical services. The MSO, a separate, non-professional entity, provides all non-clinical administrative, technical, and management services to the PC. This separation ensures that the MSO does not engage in the practice of medicine and that clinical decisions remain solely with the licensed professionals. Fee-splitting rules are strictly enforced in Colorado, primarily under C.R.S. § 12-240-120(1)(g) for physicians, which prohibits splitting fees for professional services. This means the MSO's compensation from the PC must be for legitimate services rendered at fair market value (FMV) and cannot be a percentage of professional fees or directly tied to patient volume or revenue. MSO fees are typically structured as a fixed monthly fee, a cost-plus model, or a percentage of the PC's overhead/expenses, but never a percentage of professional revenue. Management Services Agreement (MSA) requirements are critical. The MSA between the MSO and the PC must clearly delineate the services provided by the MSO, the compensation structure (FMV), and explicitly state that the MSO has no control over clinical decision-making, hiring/firing of clinical staff, or the practice of medicine. The PC must retain full autonomy over all clinical aspects. Professional Corporation (PC) requirements in Colorado are outlined in C.R.S. Title 7, Article 101, Part 9. A PC must be organized under the Colorado Business Corporation Act, and its shareholders must be licensed professionals authorized to practice the specific professional service. The name of the PC must include 'Professional Corporation' or 'P.C.' or 'PC.' For compliance, the PC must have its own separate bank accounts, EIN, and operational independence from the MSO regarding clinical matters. Structuring ownership for compliance involves ensuring that the PC is 100% owned by licensed professionals, while the MSO can be owned by non-licensed individuals or entities. This allows for investment and business expertise without violating CPOM. For telehealth companies, medspas, dental practices, and wellness clinics, this structure is paramount. Failure to adhere to these principles can lead to severe penalties, including license revocation, civil fines, and criminal charges for the unlicensed practice of medicine or aiding and abetting. It is imperative to have legal counsel experienced in Colorado healthcare law to draft and review all corporate documents and agreements to ensure strict compliance.

Colorado's regulatory landscape is continuously evolving, with several key developments and pending legislative actions impacting healthcare companies in 2024-2026. A significant focus remains on solidifying telehealth access and reimbursement. While the major telehealth parity laws are in place (C.R.S. § 10-16-123), legislative efforts continue to refine specific aspects, such as expanding audio-only telehealth for certain conditions or populations, and ensuring long-term stability of reimbursement rates. For instance, recent legislative sessions have seen bills aimed at extending or making permanent certain telehealth flexibilities that were initially temporary during the pandemic, particularly for behavioral health. Another area of focus is interstate compacts. Colorado is a member of the Interstate Medical Licensure Compact (IMLC), the Nurse Licensure Compact (NLC), and the Psychology Interjurisdictional Compact (PSYPACT). There is ongoing discussion and potential legislation to join other compacts, such as the Audiology and Speech-Language Pathology Interstate Compact (ASLP-IC) or the Physical Therapy Compact, which would further streamline multi-state practice for relevant professionals. Companies should monitor these compacts for expanded provider mobility. The Colorado Medical Board and other professional boards continue to issue guidance and take enforcement actions related to appropriate telehealth practice, especially concerning controlled substance prescribing and the standard of care. There's an increased scrutiny on direct-to-consumer telehealth models, particularly those involving high-risk medications or services, to ensure compliance with CPOM and patient safety standards. Recent enforcement cases often highlight inadequate initial evaluations, lack of ongoing patient monitoring, or failure to adhere to PDMP requirements for controlled substances prescribed via telehealth. Regarding GLP-1 medications, the boards are closely monitoring prescribing practices due to the surge in demand. While specific legislation is not yet enacted, expect increased guidance or potential regulations from the Medical Board concerning appropriate diagnostic criteria, patient selection, monitoring protocols, and off-label use for weight management, particularly in telehealth settings. There is also ongoing legislative interest in addressing healthcare workforce shortages, which may lead to further expansions in scope of practice for certain mid-level providers or initiatives to attract and retain healthcare professionals in the state. Companies should regularly check the Colorado General Assembly website for bill tracking and the DORA website for board updates and proposed rule changes.

Entering the Colorado healthcare market requires a methodical approach to ensure compliance from the outset. Here's actionable guidance: 1. Conduct a Thorough CPOM Analysis: Before any operations begin, engage experienced Colorado healthcare counsel to structure your entity. Assume a PC-MSO model will be necessary if non-licensed individuals or entities have an ownership stake or control. Ensure the PC is 100% owned by Colorado-licensed professionals and the MSO's services and compensation are fair market value and non-clinical. 2. Secure Proper Licensure: All healthcare professionals providing services to Colorado patients must hold an active, unencumbered Colorado license for their specific profession. If utilizing interstate compacts (IMLC, NLC, PSYPACT), ensure providers meet all compact requirements and have their privilege to practice in Colorado. Initiate licensing applications well in advance, as processing times can vary. 3. Implement Robust Telehealth Protocols: Develop clear policies and procedures for establishing the practitioner-patient relationship, obtaining informed consent (C.R.S. § 10-16-123(3)(d)), documenting telehealth encounters, and ensuring technology is HIPAA-compliant. Train all staff on these protocols. 4. Adhere to Prescribing Regulations: For controlled substances, ensure compliance with both federal DEA regulations (including the Ryan Haight Act) and Colorado's PDMP requirements (C.R.S. § 12-30-106(4)). Implement a system for mandatory PDMP checks. For high-risk medications like GLP-1s, testosterone, or stimulants, establish rigorous clinical protocols for evaluation, monitoring, and documentation. 5. Define Scope of Practice Clearly: For NPs, PAs, and MAs, ensure they operate strictly within their Colorado-defined scope of practice. For PAs, formalize supervising physician agreements. For MAs, ensure direct supervision for any delegated clinical tasks, especially in medspas. 6. Review All Agreements: All contracts (e.g., MSO agreements, employment agreements, independent contractor agreements, medical director agreements) must be reviewed by Colorado counsel to ensure compliance with CPOM, anti-kickback statutes, and fee-splitting prohibitions (C.R.S. § 12-240-120(1)(g)). Common Pitfalls to Avoid: Directly employing physicians in a non-professional entity, compensation models that constitute illegal fee-splitting, failure to obtain proper licensure, inadequate informed consent for telehealth, and non-compliance with controlled substance prescribing rules. Timeline Expectations: Licensing can take anywhere from 2-6 months depending on the board and individual circumstances. Entity formation and MSO agreement drafting can take 1-3 months. Plan for at least 6-9 months for full setup and compliance review before launching services. Continuous monitoring of DORA and legislative updates is essential for ongoing compliance.