What a provider can and can't say in Colorado
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | No CO statute specific to reviews located; HIPAA if covered |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | No CO statute specific to reviews located; HIPAA if covered |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | No CO statute specific to reviews located; HIPAA if covered |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | No CO statute specific to reviews located; HIPAA if covered |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | CPA applies if thresholds met or ANY biometric processing | No CO statute specific to reviews located; HIPAA if covered |
- Consumer privacy and health data law: Colorado has a consumer privacy law in force (CPA (biometrics any size)). It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [CO-001, CO-002]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if 500 or more residents affected. [CO-004]
- Patient confidentiality duties: Patient confidentiality duties appear to come mainly from licensing-board rules, but those rules were not verified in this research (a gap). [U-98]
- Research notes and gaps: A specific board confidentiality ground was not read or not located; this is a research gap, not a finding that none exists. [U-98]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (common-law claims only; no private action under the Colorado Privacy Act). [CO-003]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located in this research. [U-98]
- Med spa rules: Med spas: there is med-spa-specific law (HB25-1024). [CO-005]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists. [CO-003, U-97]
Sources:
- [CO-001] C.R.S. 6-1-1304(2)(a),(h) (https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [CO-002] C.R.S. 6-1-1304(1)(a)(II) (https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [CO-003] C.R.S. 6-1-1311 (1)(a)-(d) (https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [CO-004] C.R.S. 6-1-716 (1)(e),(g); (2)(a),(f); (3)(b) (https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [CO-005] Colo. HB25-1024, 2025 Sess. Laws ch. 59 (https://leg.colorado.gov/bills/hb25-1024)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Colorado (CO) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Board rules/unprofessional conduct (C.R.S. 12-240-121, not verified); privilege C.R.S. 13-90-107(1)(d) (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CPA 6-1-1301 et seq.: data-level PHI and provider-maintained health info exemptions; biometric rules apply regardless of size | 6-1-716: medical, health insurance, biometric covered; 30 days; AG within 30 days if 500+; shortest deadline controls | No CO statute specific to reviews located; HIPAA if covered | HIPAA if covered; CPA consent for sensitive data (non-exempt); HB25-1024 delegation disclosures (not photo consent) | None located (common-law appropriation; verify) | No CPA private action; common-law torts | Colorado Medical Board, Dental Board, Board of Nursing, DORA, AG/DAs | CPA: up to $20,000/violation ($50,000 if elderly) via 6-1-112; breach: AG action | E4 (no CO AG CPA action vs. aesthetic practice located) | Medium (Justia secondary for CRS) | 2026-10-22 |
| Colorado (CO) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Board rules/unprofessional conduct (C.R.S. 12-240-121, not verified); privilege C.R.S. 13-90-107(1)(d) (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CPA 6-1-1301 et seq.: data-level PHI and provider-maintained health info exemptions; biometric rules apply regardless of size | 6-1-716: medical, health insurance, biometric covered; 30 days; AG within 30 days if 500+; shortest deadline controls | No CO statute specific to reviews located; HIPAA if covered | HIPAA if covered; CPA consent for sensitive data (non-exempt); HB25-1024 delegation disclosures (not photo consent) | None located (common-law appropriation; verify) | No CPA private action; common-law torts | Colorado Medical Board, Dental Board, Board of Nursing, DORA, AG/DAs | CPA: up to $20,000/violation ($50,000 if elderly) via 6-1-112; breach: AG action | E4 (no CO AG CPA action vs. aesthetic practice located) | Medium (Justia secondary for CRS) | 2026-10-22 |
| Colorado (CO) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Board rules/unprofessional conduct (C.R.S. 12-240-121, not verified); privilege C.R.S. 13-90-107(1)(d) (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CPA 6-1-1301 et seq.: data-level PHI and provider-maintained health info exemptions; biometric rules apply regardless of size | 6-1-716: medical, health insurance, biometric covered; 30 days; AG within 30 days if 500+; shortest deadline controls | No CO statute specific to reviews located; HIPAA if covered | HIPAA if covered; CPA consent for sensitive data (non-exempt); HB25-1024 delegation disclosures (not photo consent) | None located (common-law appropriation; verify) | No CPA private action; common-law torts | Colorado Medical Board, Dental Board, Board of Nursing, DORA, AG/DAs | CPA: up to $20,000/violation ($50,000 if elderly) via 6-1-112; breach: AG action | E4 (no CO AG CPA action vs. aesthetic practice located) | Medium (Justia secondary for CRS) | 2026-10-22 |
| Colorado (CO) | Medical med spa | Depends; cash-only med spas often not covered | Board rules/unprofessional conduct (C.R.S. 12-240-121, not verified); privilege C.R.S. 13-90-107(1)(d) (not verified) | Yes - applies to licensed providers regardless of HIPAA status | CPA 6-1-1301 et seq.: data-level PHI and provider-maintained health info exemptions; biometric rules apply regardless of size | 6-1-716: medical, health insurance, biometric covered; 30 days; AG within 30 days if 500+; shortest deadline controls | No CO statute specific to reviews located; HIPAA if covered | HIPAA if covered; CPA consent for sensitive data (non-exempt); HB25-1024 delegation disclosures (not photo consent) | None located (common-law appropriation; verify) | No CPA private action; common-law torts | Colorado Medical Board, Dental Board, Board of Nursing, DORA, AG/DAs | CPA: up to $20,000/violation ($50,000 if elderly) via 6-1-112; breach: AG action | E4 (no CO AG CPA action vs. aesthetic practice located) | Medium (Justia secondary for CRS) | 2026-10-22 |
| Colorado (CO) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Board rules/unprofessional conduct (C.R.S. 12-240-121, not verified); privilege C.R.S. 13-90-107(1)(d) (not verified) | CPA applies if thresholds met or ANY biometric processing | CPA 6-1-1301 et seq.: data-level PHI and provider-maintained health info exemptions; biometric rules apply regardless of size | 6-1-716: medical, health insurance, biometric covered; 30 days; AG within 30 days if 500+; shortest deadline controls | No CO statute specific to reviews located; HIPAA if covered | HIPAA if covered; CPA consent for sensitive data (non-exempt); HB25-1024 delegation disclosures (not photo consent) | None located (common-law appropriation; verify) | No CPA private action; common-law torts | Colorado Medical Board, Dental Board, Board of Nursing, DORA, AG/DAs | CPA: up to $20,000/violation ($50,000 if elderly) via 6-1-112; breach: AG action | E4 (no CO AG CPA action vs. aesthetic practice located) | Medium (Justia secondary for CRS) | 2026-10-22 |
Related pages
Topics
Sources
CO-001. C.R.S. 6-1-1304(2)(a),(h)
CPA exempts PHI collected/processed by covered entities and BAs and information maintained in the same manner by covered entities, BAs, health-care facilities or health-care providers (data-level exemptions; no general entity-level exemption).
Statute · Explicit · High · Verified against the official OLLS CRS 2024 printout (6-1-1304(2)(a),(b),(e)); 2025 amendments not checked.
https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
CO-002. C.R.S. 6-1-1304(1)(a)(II)
CPA applies to controllers meeting 100,000/25,000-consumer thresholds, AND to any controller processing any amount of biometric identifiers or biometric data (for those data only), per HB24-1130 effective 2025-07-01.
Statute · Explicit · High · Verified against the official OLLS CRS 2024 printout (V-041). Version effective 2025-10-01: biometric trigger at (1)(a)(II); new (1)(b) applies minors' data duties (6-1-1305.5, -1308.5, -1309.5) to any controller regardless of volume. Relevant to face-scan/skin-analysis tools at small aesthetic businesses.
https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
CO-004. C.R.S. 6-1-716
Breach law covers medical information, health insurance ID and biometric data; notice no later than 30 days after determination that a breach occurred; AG notice within 30 days if 500+ residents; entities following a federal regulator's procedures are deemed compliant but must still notify the AG, and the shortest deadline controls.
Statute · Explicit · High · Verified against the official OLLS CRS 2024 printout (6-1-716(1)(e), (2), (3)).
https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
CO-003. C.R.S. 6-1-1311
AG and district attorneys have exclusive CPA enforcement; violation is a deceptive trade practice; no private right of action; a 60-day cure applies only to certain newer sections until 2026-12-31.
Statute · Explicit · High · Verified against the official OLLS CRS 2024 printout. Penalty amounts: see CO-006 (6-1-112). Closes U-38.
https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
CO-005. Colo. HB25-1024, 2025 Sess. Laws ch. 59
HB25-1024 (signed 2025-04-07; effective 2025-08-06; ch. 59) requires physicians and APRNs who delegate medical-aesthetic services to unlicensed persons to make patient disclosures (bill summary as enacted). Detailed terms (posted notice, website/advertising disclosure, signed consent retained 7 years) are from secondary summaries.
Session law · Explicit (status/summary); detailed terms secondary · Medium · Med spa transparency law, not a privacy law; signed-act PDF not read (U-39).
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All