Binding law — in force
C.R.S. 12-245-224.5(3), added by Colorado HB 26-1195, makes the use of an AI system by a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado subject to applicable state and federal privacy and security laws, including the Health Insurance Portability and Accountability Act of 1996 (Pub.L. 104-191) and its implementing regulations. Detect session notes, transcripts or other client records sent to a model API with no business-associate agreement, HIPAA-eligible endpoint or de-identification safeguard.
co-hb26-1195.ai-privacy-compliance · C.R.S. 12-245-224.5(3) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 12-245-224.5(4)(a), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from using an AI system to record or transcribe a client's therapeutic session unless the client or the client's legally authorized representative is told in advance in writing that an AI system will be used and its specific purpose, and consents in writing; the client's refusal or later revocation may not be used as a basis to deny psychotherapy services. Consent is a clear, explicit, affirmative, specific, unambiguous and revocable written agreement (electronic allowed); acceptance of general or broad terms of use, hovering over, muting, pausing or closing content, and deception do not count (1)(c). Consent is needed for the initial use on or after the effective date and again when the purpose or manner of use materially changes (4)(b). Detect session recordings or transcripts reaching AI with no consent check, consent bundled into terms of use, and copy that makes AI consent a condition of care.
co-hb26-1195.ai-session-recording-notice-consent · C.R.S. 12-245-224.5(4) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 12-245-224.5(6)(a), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from using an AI system to provide, direct or guide (or attempt to) psychotherapy, clinical intervention, counseling, diagnosis, treatment planning or any other practice of psychotherapy with an individual or a group unless the use complies with 12-245-224.5(5); (5)(a) bars allowing an AI system to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the professional, the AI system and the client. 'Synchronous' means simultaneous active participation of the client and the professional and does not mean a review after the interaction (1)(e); therapeutic communication includes reflecting a client's thoughts and emotions, therapeutic guidance or interventions, emotional support in response to distress, work on treatment goals and behavioral feedback, but not general wellness education (1)(f). At initial client contact the professional must give the client written information on these prohibitions (6)(b). Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are carved out (7)-(9). Detect an AI cast or offered as the therapist, and model replies sent straight to clients with no professional in the session.
co-hb26-1195.no-ai-psychotherapy-without-synchronous-therapist · C.R.S. 12-245-224.5(6)(a) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 6-1-1705.2(1)(c), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that represents that a user's data is confidential in a way that would lead a reasonable user to believe that the data is protected comparably to the privacy protections of therapist-client confidentiality in a relationship between a Colorado psychotherapy licensee, registrant, certificate holder or other person lawfully permitted to provide psychotherapy services and the client. Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect persona prompts, replies, onboarding and marketing copy that promise therapist-client or doctor-patient confidentiality or privilege, or confidentiality 'like therapy'.
co-hb26-1195.no-implied-therapist-client-confidentiality · C.R.S. 6-1-1705.2(1) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 6-1-1705.2(1)(a), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that indicates or implies that the system's output data is being provided by, is endorsed by, or is equivalent to services provided by an individual licensed, registered or certified in Colorado under article 245 of title 12 to engage in the practice of psychotherapy or to provide psychotherapy services. Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect personas, prompts, UI and marketing copy that give the AI a mental health licence or title, or claim therapist endorsement or equivalence.
co-hb26-1195.no-psychotherapist-equivalence-claims · C.R.S. 6-1-1705.2(1) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 6-1-1705.2(1)(b), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that represents that the AI system provides psychotherapy services ('psychotherapy' and 'psychotherapy services' as defined in 12-245-202, 6-1-1705.2(6)(b)). Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect persona prompts, replies, UI copy and listings that present the AI as a therapist or counselor, or offer therapy delivered by the AI.
co-hb26-1195.no-psychotherapy-service-representation · C.R.S. 6-1-1705.2(1) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — in force
C.R.S. 12-245-224.5(5)(b), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from allowing an AI system to generate therapeutic recommendations or treatment plans without the professional's review and approval. 12-245-224.5(2) permits AI for administrative support (scheduling and reminders, billing and insurance claims, logistics messages without therapeutic advice, (1)(a)) or supplementary support (client records and therapy notes, progress and trend analysis, resources and referrals, structured wellness data collection, (1)(d)) only if the professional keeps responsibility for reviewing any output used for that support and meets the recording consent rules of (4). Detect model output saved as an active treatment plan, sent to the client, or written to the client record or a claim with no recorded professional approval.
co-hb26-1195.therapist-review-of-ai-plans-and-outputs · C.R.S. 12-245-224.5(5) · official source · jurisdictions: US-CO
The guard to add, and how far to trust this rule
