Colorado Med Spa Compliance Checklist (2026): Full Guide

Colorado is an unusual place to operate a med spa, because two of its defining features pull in opposite directions. It grants nurse practitioners full practice authority — no collaborative agreement, no supervising physician, no MD signature required to see and treat patients. It also enforces a real corporate practice of medicine doctrine, a delegation rule with unusually specific conditions, and, since 2025, a disclosure law aimed squarely at med spas using unlicensed staff.

Everything runs through the Department of Regulatory Agencies (DORA) and its Division of Professions and Occupations, which houses the Colorado Medical Board, the Colorado State Board of Nursing, and the Office of Barber, Hairstylist, and Cosmetology Licensure. All three have interests in your treatment rooms, and the cosmetology office has been referring cases to the Medical Board when delegation looks improper.

This checklist leads with nurse practitioner authority, because that is where Colorado differs most from states you may have operated in before. For the wider picture, our med spa regulations by state reference compares frameworks side by side, and our 2026 med spa compliance overview covers the national baseline.

1. Full Practice Authority Is Not Full Prescriptive Authority

This is the most misunderstood rule in the state, and it drives more bad business plans than any other. Colorado is a full practice authority state for nurse practitioners: an APRN needs no collaborative agreement, no supervisory agreement, and no chart-review relationship to evaluate, diagnose, and treat. That authority is why so many independent, nurse-owned aesthetic practices exist across the Front Range.

What full practice authority does not do is hand you a prescription pad. Prescribing is a separate credential granted by the Board of Nursing under C.R.S. 12-255-112, and it arrives in two stages.

The two tiers: RXN-P and RXN

An APRN who wants to prescribe must be listed on Colorado's Advanced Practice Registry and then obtain prescriptive authority. The first tier is provisional prescriptive authority (RXN-P): graduate-level coursework in pharmacology, pathophysiology, and physical assessment, national certification from a Board-recognized body, and a documented preceptorship of at least 1,800 hours completed within the five years immediately preceding the application.

Provisional authority is not the finish line. Within three years, the APRN must complete a 750-hour mentorship with a physician or full-authority APRN — documented in writing, signed by both parties, and setting out the frequency of ongoing discussion about prescriptive practice. Synchronous remote communication counts. Full authority (RXN) follows the mentorship plus an Articulated Plan matching the APRN's role, specialty, and population focus.

What this means operationally

An NP-led med spa built around a provisionally authorized prescriber is legitimate and common — but it is not the unsupervised model the phrase "full practice authority" suggests. There is a named mentor, a running hour count, and a three-year clock. If you are hiring an NP to prescribe, ask which tier they hold, how many hours are logged, and when the clock expires.

2. What Counts as a Medical-Aesthetic Service in Colorado

Colorado is unusually precise about where medicine begins, and the definition is the hinge every other rule swings on. Under Rule 1.17, Medical-Aesthetic Services are medical services in the cosmetic or aesthetic field that constitute the practice of medicine. The rule gives two anchors.

The device line

Use of a Class IIIb or higher laser, a radiofrequency device, intense pulsed light, or any other technique that results in the revision, destruction, incision, or other structural alteration of human tissue — including for hair removal — is a medical-aesthetic service. Colorado then draws the line explicitly on the other side: Class I, II, and IIIa devices do not constitute a medical service — a cleaner boundary than most states offer, and worth knowing device by device.

The injection line

The second anchor is broader: the injection of any substance into the human body is a medical-aesthetic service. Not just neurotoxin, not just prescription drugs — any injection. That sweeps in filler, biostimulators, deoxycholic acid, vitamin injections, and IV therapy.

Where the recodification tripped people up

The rule most Colorado operators still call "Rule 800" was codified at 3 CCR 713-30, recodified into 3 CCR 713-1 effective July 15, 2023, and now sits at 3 CCR 713-1.17 under the delegation statute at C.R.S. 12-240-107(3)(l). A compliance packet citing Rule 800 without mentioning 1.17 has not been reviewed since 2023.

3. Delegation and Supervision Under Rule 1.17

Colorado allows a physician to delegate medical services, including medical-aesthetic services, to people not licensed to perform them — broader authority than strict states allow, with the most specific conditions in the Colorado rulebook.

What may be delegated

Delegated medical-aesthetic services must be routine, technical services whose performance does not require the special skills of a licensed physician. A service demanding real clinical judgment in the moment — an atypical presentation, a mid-treatment plan change, a complication — is not routine and technical, however well trained the delegatee is. Facilities must also be appropriate to the service provided.

What the delegating provider must do

Before authorizing anyone, the delegating physician must personally assess that person's qualifications and competence, including initial over-the-shoulder monitoring of each delegated service. Not a weekend-course certificate — the provider watches them do it. They then maintain a list of all delegatees and each one's authorized services with supporting qualification documentation, and the written delegation agreement must be available to the public at the site.

The thirty-minute rule

The baseline expectation is that a physician is on the premises and readily available. Colorado then provides a conditional relief valve: where the delegatee acts pursuant to specific and detailed written protocols and adequate written emergency protocols are in place, on-premises presence may not be necessary — but the delegating physician must be able to attend the patient in person within thirty minutes. Read that as a design constraint, not a loophole: it limits how far your delegating provider can be during operating hours, and applies only if the detailed protocols actually exist.

4. HB25-1024: The Unlicensed-Delegatee Disclosure Law

This is the newest Colorado-specific obligation, and the one most likely missing from a spa that opened before it took effect. Governor Polis signed HB25-1024, Medical-Aesthetic Services Delegation Disclosures, on April 7, 2025; it took effect roughly ninety days after the legislature adjourned on May 7, 2025.

What the law does and does not change

It is a transparency measure, not a scope measure. It does not alter what may be delegated under Rule 1.17. It changes what the public and the patient must be told when the person performing a medical-aesthetic service is not a licensed health-care provider — and it reaches APRN delegators as well as physicians, which matters in a full practice authority state where many aesthetic practices are nurse-led.

The three disclosures

There are three distinct obligations, and they fail independently — satisfying two of three is still a gap:

• A posted notice at the physical location, displayed conspicuously, carrying the delegating provider's name, license number, and contact information, plus the board's web address for filing a complaint.
• Disclosure on the business's public website and in all advertising materials identifying that the person performing the service is unlicensed — the disclosure travels with the advertising.
• A signed informed consent collected before the delegated service, acknowledging that the individual performing it is not a licensed health-care provider — and retained in the record.

Practically, the law makes your delegation model public. If your medical director is a name on a contract rather than an engaged supervisor, HB25-1024 is the rule that surfaces it.

5. Who Can Inject in Colorado: Scope by Role

Because injection of any substance is a medical-aesthetic service, injector staffing in Colorado is a delegation question first and a license question second. For the national breakdown, see who can inject Botox across the United States.

Physicians, APRNs, and physician assistants

Physicians inject on their own authority and are the source of delegation for everyone else. APRNs with prescriptive authority order and inject within nursing scope, and can themselves delegate. Physician assistants sit under SB23-083, effective August 7, 2023, which replaced physician supervision with a collaborative agreement — except that a PA still requires a supervisory agreement during their first 5,000 practice hours. Check which side of 5,000 hours a PA hire falls on before writing the agreement.

Registered and practical nurses

An RN may inject as a delegatee, working from a valid order issued by a provider who has evaluated the patient; the RN does not independently select drug or dose. Colorado's nursing delegation statute, C.R.S. 12-255-131, adds a layer when a nurse is the delegator: the task must sit within that nurse's own scope, must not require the delegatee to exercise nursing judgment, and the nurse must judge the person can safely perform it for that patient. LPNs practice dependently, and an injector model built on LPNs is not defensible without confirming it with the Board of Nursing.

The unlicensed delegatee question

Here is where Colorado genuinely differs. Rule 1.17 permits a physician or APRN to delegate injections to a person holding no health-care license at all, provided the service is routine and technical, competence has been personally assessed, detailed treatment and emergency protocols exist, and the availability standard is met. In California or New York that would be unlawful outright; in Colorado it is permitted and regulated.

Permitted is not advisable. It triggers every HB25-1024 disclosure, puts your provider's license number on the wall beside a complaint address, and the cosmetology office has been referring exactly these situations to the Medical Board. If you use unlicensed delegatees, the documentation has to be immaculate.

6. The Medical Director Role in Colorado

Colorado has no med spa licensing statute and no rule using the phrase "medical director." The title is shorthand; the job is real, because Rule 1.17 assigns a named set of duties to whoever delegates your medical-aesthetic services, and HB25-1024 now publishes that person's identity.

What the job actually is in Colorado

Strip away the title and the Colorado medical director assesses each delegatee's competence by watching them work; maintains the delegatee roster and authorized-service lists; writes or approves the treatment and emergency protocols; keeps the delegation agreement available to the public at the site; stays able to attend a patient in person within thirty minutes; and appears by name and license number on the posted notice and website. That is a working relationship, not a signature. For the national view, see our guide to med spa medical director requirements.

Compensation and the coverage question

Pay fair market value for oversight actually delivered, and avoid anything resembling a share of clinical revenue — that is where corporate practice and fee-splitting concerns bite. Be realistic about coverage: a director listed at eight Front Range sites cannot be thirty minutes from all of them. If your growth plan multiplies locations, it must multiply delegating providers.

7. Laser and Energy-Based Device Oversight

Colorado's laser rules are simple to state and hard to satisfy casually. There is no laser operator license, no state certification course, and no registry. Authority to operate a qualifying device comes from one place only: delegation under Rule 1.17.

Classify every device before you assign an operator

The Class IIIb boundary is the whole ballgame. Build a device inventory recording the class of every unit on the floor and hang operator authorization off that inventory. A practice that cannot say which class its hair removal laser falls into is not positioned to defend who has been firing it.

What a compliant Colorado laser program looks like

For every qualifying device: a delegating provider who has personally assessed the operator's competence on that device; the device on that operator's authorized-service list; written treatment and emergency protocols; a documented pre-treatment evaluation; eye protection and a laser safety program; and the availability standard met throughout the day. Add the HB25-1024 disclosures if the operator is unlicensed, which in hair removal is common.

8. Esthetician Scope: Where Cosmetology Ends

Colorado licenses estheticians through the Office of Barber, Hairstylist, and Cosmetology Licensure, and the license authorizes cosmetic skin care not intended to treat disease or physical ailment. It does not authorize the practice of medicine, and no amount of physician presence converts a cosmetology license into a medical one. The only route by which an esthetician performs a medical-aesthetic service is as a Rule 1.17 delegatee — acting, for that purpose, as an unlicensed person.

What is inside the license

Non-medical facials, extractions, and manual exfoliation sit comfortably inside esthetician scope, and dermaplaning falls within scope for a licensee trained in it. Chemical peels — framed in Colorado's rules as chemical resurfacing exfoliation — are permitted but conditioned: the licensee must complete 24 hours of cosmeceutical coursework from a school approved by the Division of Private Occupational Schools or the Colorado Community College System, and the peel must not alter skin structures beyond the epidermis.

What is outside it

Injections of any kind are outside the license, as are Class IIIb and higher lasers, IPL, tissue-altering radiofrequency, and peels going below the epidermis. Treat microneedling depth conservatively and confirm it with the cosmetology office before adding it to an esthetician's menu. Keep peel coursework certificates in the personnel file — a small requirement practices routinely cannot produce.

9. Ownership and the Corporate Practice of Medicine

Colorado enforces a corporate practice of medicine doctrine, stricter than newcomers expect from a state otherwise permissive about delegation. The operative statute is C.R.S. 12-240-138, governing professional service corporations, LLCs, and registered LLPs organized to practice medicine.

Who may hold shares

All shareholders must be individuals licensed by the Colorado Medical Board to practice medicine, holding shares in their own right, with one carve-out: licensed physician assistants may be shareholders so long as physician shareholders retain majority ownership. Shareholders must be actively engaged in practice in the corporation's offices. Lay directors, officers, and heirs may not exercise authority over a physician's independent medical judgment, and an heir may hold shares for at most two years.

The 2026 bill that did not pass

Colorado came close to changing this for aesthetics. HB26-1249 would have created a medical-aesthetics professional corporation letting PAs hold a majority and letting estheticians, cosmetologists, nurses, APRNs, and PAs be shareholders. The House Committee on Health and Human Services postponed it indefinitely on March 25, 2026, so the existing restriction stands — and any plan drafted in anticipation of it needs revisiting.

Structures that work

Non-physician capital typically participates through a management services organization: the MSO provides space, staffing, marketing, billing, and administration, while a physician-owned professional entity retains clinical control. The agreement must be drafted so the MSO fee is not a disguised split of professional revenue. Separately — and importantly in Colorado — an APRN with full practice authority who owns a practice is practicing nursing, not medicine, one reason NP ownership is such an attractive route here. Our guide to nurse practitioner med spa ownership covers those structures in depth.

10. Informed Consent and Medical Records

Colorado has no single cosmetic-consent statute for med spas. The obligation comes from the standard of care and the Medical Board's disciplinary authority — plus, since 2025, the separate acknowledgment HB25-1024 requires for unlicensed delegatees. Those are two documents, and one does not substitute for the other.

Consent that holds up

Consent should be procedure-specific and obtained before treatment rather than while the patient is reclined and prepped, covering risks, benefits, alternatives, expected course, and complication handling. Where a delegatee performs the service, the consent should name who is performing it and under whose delegation. Marketing photography needs its own separate written authorization.

How long to keep records

C.R.S. 25-1-802 governs patient access to records held by individual providers. For retention, the operative guidance is Colorado Medical Board Policy 40-07, which recommends keeping records at least seven years after the last date of treatment, and for minors seven years past the age of majority — until they turn twenty-five. Retention extends through any litigation or board investigation, and closing practices should notify patients seen in the last three years.

11. Emergency Preparedness and Adverse-Event Response

Written emergency protocols are not decoration in Colorado — they are a precondition. The Rule 1.17 relief that lets a delegating physician be off the premises applies only where adequate written emergency protocols are in place alongside detailed treatment protocols. If your emergency documentation is thin, your off-site supervision model collapses back to the baseline: a physician on the premises.

What the protocols have to cover

Anaphylaxis is the most common med spa emergency and can arise from injectables, peels, and topicals alike; vascular occlusion from filler has the shortest clock; burns and pigmentary injury are the laser side. Each needs a written response path a delegatee can execute without waiting for a callback: recognition criteria, immediate steps, drugs and doses, who to call, and how the event is documented and reviewed.

The Complete Colorado Med Spa Compliance Checklist

Run this table before you open, before you add a service, and before any DORA inquiry. Each row maps to a section above. If any row is a "no," fix it before you treat the next patient — and if you would rather not build the documentation from scratch, our ready-to-use med spa compliance SOPs cover the policy and protocol side of every row.

This checklist is for informational purposes only and does not constitute legal or medical advice. Colorado rules are administered by several DORA offices and change frequently — the delegation rule was recodified in 2023, the disclosure law took effect in 2025, and an ownership bill was postponed indefinitely in March 2026. Confirm current requirements with the Colorado Medical Board, the Colorado State Board of Nursing, and the Office of Barber, Hairstylist, and Cosmetology Licensure, and consult a Colorado healthcare attorney before acting on your specific situation.

Frequently Asked Questions