Tessic Health

CO · STATE RULES

Telehealth rules in Colorado

Colorado is where a telehealth brand's software becomes a regulated object in its own right. An automated tool that helps decide who gets care owes a statutory duty of reasonable care against algorithmic discrimination, the privacy act makes a brand honor opt-out signals from a list the state publishes, and controlled-substance prescriptions go electronically unless a rural prescriber has won a hardship exception. This page covers those rules, the licensing route, advertising limits and how Tessic Health's providers work here.

Book a DemoAll states
First visit
Async with conditions
Physician license
IMLC member; own license
Controlled drugs
Electronic, with a rural waiver
Nurse practitioners
Full practice

Rules checked September 2026 · 30 sources cited

ONLY IN COLORADO

What is different about Colorado

Each rule here is true of Colorado and of none of the states that border it. Beside each one: what the neighbours do instead.

  1. 01 · Practice

    Software that helps decide owes a duty of care

    Colorado's artificial intelligence act puts a duty of reasonable care on developers and deployers of high-risk systems that make or substantially inform a consequential decision, and health-care services are named as one. The duty runs to protecting consumers from algorithmic discrimination, with impact assessments and notice behind it.

    Source: Colorado SB 24-205

    Across the border

    • Wyoming

      Wyoming has legislated nothing on automated decision tools. Its telehealth attention went instead to a statewide network coordinated by the Office of Rural Health under Wyo. Stat. 9-2-117.

      Source: Wyoming Statutes

    • Nebraska

      Nebraska imposes no duty of care around automated systems. The obligations its telehealth law creates are documentary, centered on the written consent statement Neb. Rev. Stat. 71-8505 requires before a first consultation.

      Source: Neb. Rev. Stat. 71-8505

    • Kansas

      Kansas wrote no algorithmic discrimination rule. Its telemedicine act works on the technology instead, defining telemedicine to exclude voice-only conversations and email-only exchanges between a physician and a patient.

      Source: Kansas Statutes chapter 40

    • Oklahoma

      Oklahoma has no comparable statute and regulates the encounter rather than the tool, asking under its board rule that the information available to the distant physician be equivalent to a face-to-face visit.

      Source: Oklahoma Statutes title 36

    • New Mexico

      New Mexico has enacted no artificial intelligence law for health services, so a decision support tool there answers only to the medical board's ordinary expectations of the licensee using it.

      Source: New Mexico Medical Board

    • Arizona

      Arizona legislated one use only: HB 2175 requires a licensed clinician to make the final call on a medical necessity denial, leaving clinical and triage tools outside any statutory duty.

      Source: Arizona HB 2175 summary (Healthcare Value Hub)

    • Utah

      Utah chose disclosure over a duty of care, requiring a supplier to say up front that a consumer is dealing with generative artificial intelligence in a high-risk interaction such as a clinical intake.

      Source: Utah SB 226, artificial intelligence amendments

  2. 02 · Advertising

    The state publishes the opt-out signals you must honor

    Under the Colorado Privacy Act the Department of Law maintains and publishes a public list of universal opt-out mechanisms, and a controller has to recognize the ones on it for targeted advertising and sale. Health information is sensitive data, so processing it needs consent on top.

    Source: C.R.S. 6-1-1313

    Across the border

    • Wyoming

      Wyoming has no comprehensive consumer privacy act, so what a brand may do with a visitor's data there turns on the promises in its own notice and the general consumer protection chapter.

      Source: Wyoming Statutes

    • Nebraska

      Nebraska's data privacy act does ask controllers to respect an opt-out preference signal, but the state keeps no published roster of approved mechanisms for a brand to check against.

      Source: Neb. Rev. Stat. 87-1101

    • Kansas

      Kansas has passed no general privacy statute. Marketing data there is governed by the consumer protection act and by federal health privacy law where the data came from a covered entity.

      Source: Kansas Statutes chapter 50

    • Oklahoma

      Oklahoma has no omnibus privacy law either, and its consumer protection act reaches advertising claims rather than the mechanics of how a tracker is switched off.

      Source: Oklahoma Statutes title 15

    • New Mexico

      New Mexico regulates health data mainly through its board rules and the federal floor, with no state privacy act creating opt-out rights a brand would have to build for.

      Source: Center for Connected Health Policy: New Mexico

    • Arizona

      Arizona has enacted no comprehensive privacy statute, so a tracking pixel there is constrained by federal health privacy law and by A.R.S. 44-1522 on deceptive practices.

      Source: A.R.S. 44-1522

    • Utah

      Utah's consumer privacy act grants opt-out rights for targeted advertising and sale and requires consent for sensitive data, but it does not oblige a controller to honor a browser-level signal at all.

      Source: Utah Code 13-61-101

  3. 03 · Prescribing

    Electronic prescriptions, unless the practice is rural

    C.R.S. 12-30-111 requires controlled-substance prescriptions to be sent electronically and then builds an escape hatch none of the neighbours copied: a prescriber can apply for an economic hardship exception, renewable, with rural area defined by county population against census estimates.

    Source: C.R.S. 12-30-111

    Across the border

    • Wyoming

      Wyoming has no electronic prescribing mandate to be excused from. Its controlled-substance rule bites earlier, barring an initial prescription over the internet without a documented relationship.

      Source: Wyoming Board of Medicine

    • Nebraska

      Nebraska requires controlled-substance prescriptions to be transmitted electronically without an economic hardship track, and its telehealth statute adds no prescribing limit of its own.

      Source: Neb. Rev. Stat. 38-1,143

    • Kansas

      Kansas applies the same prescribing law to a remote visit as to an office one and declines to treat a questionnaire as a valid prescriber relationship, without layering a transmission mandate on top.

      Source: Kansas Statutes chapter 40

    • Oklahoma

      Oklahoma's electronic prescribing requirement runs through its pharmacy and narcotics rules with waivers granted case by case rather than a statutory rural definition anyone can read off.

      Source: Oklahoma Statutes title 63

    • New Mexico

      New Mexico routes its controlled-substance control through a state registration with the Board of Pharmacy, which a prescriber must hold alongside the federal one, not through a transmission rule with exemptions.

      Source: New Mexico Statutes Annotated

    • Arizona

      Arizona's mandate is narrower from the start: A.R.S. 36-2525 covers Schedule II opioids, so non-opioid and non-controlled prescriptions never needed an exception.

      Source: A.R.S. 36-2525

    • Utah

      Utah puts its weight on permissions rather than transmission, requiring a state controlled substance license from the Division of Professional Licensing in addition to the federal registration.

      Source: Utah Code 58-37-6

PRACTICE RULES

How telehealth works in Colorado

Colorado spreads its telehealth duties across three places: the professions article for the clinician, the privacy act for the data, and the artificial intelligence act for anything automated sitting between them.

  1. 01

    The profile every clinician files

    C.R.S. 12-30-102 requires licensed health-care providers to file and keep current a profile with the state, covering education, practice history, malpractice judgments and disciplinary action, which the division publishes for consumers to read.

    Source: C.R.S. 12-30-102

  2. 02

    Tell the patient they can decline

    Before a first telemedicine treatment the provider gives a written statement that the patient keeps the option to refuse telemedicine at any time without losing care, and keeps access to their records. Consent at later visits may be verbal but is documented.

    Source: C.R.S. 25.5-5-320

  3. 03

    High-risk systems carry paperwork

    A deployer of a high-risk artificial intelligence system has to keep a risk management program, complete impact assessments, tell a consumer when such a system contributes to a consequential decision, and disclose the discovery of algorithmic discrimination.

    Source: Colorado SB 24-205

  4. 04

    Biological and neural data counted in

    Colorado extended its privacy act to biological data, including neural data generated by a device, so signals collected from a wearable or a consumer brain interface are sensitive data needing consent like any other health information.

    Source: Colorado HB 24-1058

FIRST VISIT

Can a first visit happen without a live call in Colorado?

Yes, with conditions

Yes, where the standard of care allows it. Colorado never wrote a questionnaire ban or a modality rule into its practice act, so a first visit turns on clinical judgement and on the written statement C.R.S. 25.5-5-320 requires before treatment begins.

The state left the clinical question open and spent its legislative energy on what surrounds the visit: the notice, the data, and the software. That makes documentation, rather than a fixed technology, the thing a brand has to get right here.

  1. 01

    Judgement, not a named technology

    No statute requires a particular medium for a first encounter, and the boards apply their ordinary standard of care. A brand's protocol carries the burden of showing the encounter supported the diagnosis it produced.

    Source: Center for Connected Health Policy: Colorado

  2. 02

    The refusal notice comes first

    The written statement precedes the initial telemedicine treatment, not the first prescription, so it belongs at the top of intake rather than at checkout. It also confirms the patient's continuing access to their own records.

    Source: C.R.S. 25.5-5-320

  3. 03

    Automated triage is a disclosure event

    Where an automated system substantially informs whether a patient is offered care, the deployer tells the consumer that it did so and explains the decision on request. A silent triage model is the thing the act was written against.

    Source: Colorado SB 24-205

PRESCRIBING

Prescriptions and controlled drugs in Colorado

Two duties shape prescribing here: prescriptions for controlled substances travel electronically, and the prescription drug monitoring program is queried before opioids and before benzodiazepines, with a named list of clinical exceptions.

  1. 01

    Query before an opioid

    C.R.S. 12-280-404 requires the practitioner or a designee to query the program before prescribing an opioid, and treats an attempted query during an outage as compliance. The duty repeats through continuing treatment.

    Source: C.R.S. 12-280-404

  2. 02

    Benzodiazepines too, with exceptions

    The same section extends the query to benzodiazepines, excepting prescriptions to treat a patient in hospice or to treat epilepsy, a seizure or suspected seizure disorder, spasticity, alcohol withdrawal, or a neurological condition such as a traumatic brain injury or catatonia.

    Source: C.R.S. 12-280-404

  3. 03

    The hardship exception

    C.R.S. 12-30-111 directs rules for applying for and renewing an economic hardship exception to electronic prescribing, with the information a prescriber must submit to show a continuing need. Rural area is defined against census population estimates.

    Source: C.R.S. 12-30-111

  4. 04

    No private claim from the query rule

    The electronic prescribing section states that it creates no private right of action, is not the basis of a cause of action, and does not establish a standard of care, so a lapse is a regulatory matter rather than evidence of negligence.

    Source: C.R.S. 12-30-111

Federal rules apply on top of every state's. Prescribing controlled substances by telehealth without an in-person visit runs on DEA flexibilities currently extended through December 31, 2026, with a permanent rule still pending.

LICENSES

Who can treat patients in Colorado

The Colorado Medical Board licenses physicians and the state belongs to the Interstate Medical Licensure Compact. Nurse practitioners hold full practice authority once their prescriptive authority is granted.

  1. 01

    The compact, then a state license

    A physician whose state of principal licensure issues a letter of qualification takes an expedited path to a Colorado license. There is no telehealth-only credential, so a clinician treating a patient located here holds the ordinary license.

    Source: Interstate Medical Licensure Compact

  2. 02

    Nurse practitioners practice independently

    Nurse practitioners hold full practice authority here on the American Association of Nurse Practitioners map, which lets them evaluate, diagnose, order tests and prescribe under the board of nursing once prescriptive authority is granted.

    Source: AANP: full practice authority brief

  3. 03

    The profile is part of the license

    Keeping the published provider profile current is a license duty, and the statute carries fines for failing to disclose. A brand's credentialing process has to track profile updates as well as renewals.

    Source: C.R.S. 12-30-102

  4. 04

    Prescribers named by the statute

    The electronic prescribing section defines prescriber to include dentists, physicians and physician assistants, advanced practice registered nurses and certified midwives with prescriptive authority, optometrists and podiatrists, which is the set the mandate and its exception apply to.

    Source: C.R.S. 12-30-111

How Tessic Health's providers are licensed in Colorado

ADVERTISING

Marketing to patients in Colorado

The privacy act does most of the work here, because it reaches the trackers and audiences a telehealth brand runs on, and the artificial intelligence act reaches any tool that shapes who is offered what.

  1. 01

    Honor the published signals

    A controller has to recognize a universal opt-out mechanism that appears on the list the Department of Law maintains, for both targeted advertising and the sale of personal data, without asking the consumer to find a settings page.

    Source: C.R.S. 6-1-1313

  2. 02

    Consent before sensitive data moves

    Health information is sensitive data under the act, so a controller obtains consent before processing it, and a data protection assessment is required for processing that presents a heightened risk of harm, including targeted advertising.

    Source: C.R.S. 6-1-1306

  3. 03

    Neural signals count as health data

    Because biological and neural data were folded into the definition, readings from a wearable or a consumer neurotechnology device are treated as sensitive, which matters for any brand marketing on sleep, focus or stress signals.

    Source: Colorado HB 24-1058

  4. 04

    Say when the system decided

    Notice to the consumer that a high-risk artificial intelligence system contributed to a consequential decision is part of the deployer's duty, along with a statement of the reasons and an opportunity to correct the data behind it.

    Source: Colorado SB 24-205

TESSIC HEALTH IN COLORADO

How Tessic Health's providers cover Colorado

In Colorado the brand runs the storefront and Tessic Health's clinicians run the medicine, inside a practice whose licensees keep their own published profiles current.

  1. 01

    Licensed and profiled

    Clinicians seeing a patient located here hold a current state license, taken through the compact where it is available, and their statutory provider profile is filed and refreshed as part of credentialing rather than as an afterthought.

  2. 02

    The refusal notice is in intake

    The written statement that a patient may refuse telemedicine at any time, and keeps access to their records, is delivered before the first treatment and stored with the chart.

  3. 03

    Queries before opioids and benzodiazepines

    Prescribing protocols query the monitoring program before an opioid and before a benzodiazepine, record the named clinical exception where one applies, and log an attempted query when the system is down.

  4. 04

    Electronic transmission by default

    Controlled-substance prescriptions for patients here go electronically, and the hardship exception is treated as a documented exception rather than a routine fallback.

  5. 05

    Automated tools are declared

    Where an automated system informs whether a patient is offered treatment, the brand tells the patient, keeps the impact assessment, and routes the final clinical judgement to a licensed clinician.

COMMON QUESTIONS

Questions about telehealth in Colorado

  • Yes, where the standard of care supports it. No statute names a required medium for a first encounter, so the protocol has to show the intake gathered enough to support the diagnosis, and the written refusal notice must come first.

  • High-risk systems that make or substantially inform a consequential decision, with health-care services named among them. Developers and deployers owe a duty of reasonable care against algorithmic discrimination, plus impact assessments and consumer notice.

  • For controlled substances, yes. C.R.S. 12-30-111 requires electronic transmission and allows a prescriber to apply for an economic hardship exception, which can be renewed on evidence of a continuing need.

  • Before prescribing an opioid, and before prescribing a benzodiazepine unless one of the named exceptions applies, such as hospice, epilepsy, spasticity, alcohol withdrawal or a neurological condition. An attempted query during an outage counts as compliance.

  • Yes. The Department of Law publishes a list of universal opt-out mechanisms, and a controller must recognize those on it for targeted advertising and the sale of personal data.

  • Yes. This is a full practice authority state, so once prescriptive authority is granted a nurse practitioner evaluates, diagnoses, orders tests and prescribes under the board of nursing without a physician agreement.

SOURCES

Rules checked September 2026 · 30 sources cited. A planning summary, not legal advice. Statutes, board rules and enforcement priorities change; a brand's own counsel should review its model and marketing before launch.

OTHER STATES

Rules in other states

Each state page is researched from that state's own statutes and board rules.

All state pages →