Colorado Med Spa Medical Director Requirements (2026)

"Do I need a medical director?" is the highest-intent question a Colorado med spa operator asks, and the one most often answered wrong — usually by a vendor applying a supervision-state template to a full-practice-authority state. Colorado has no med spa facility license, no board-issued medical director credential, and no statute saying a medical spa shall designate one. It has a set of authority rules, and the role exists only where those rules put a physician in the chain.

That distinction is worth real money. A practice that assumes it needs a director may pay $2,000 a month for a signature it never required; a practice that assumes it does not may be delegating laser treatments to unlicensed staff with no lawful basis at all. This guide is the Colorado companion to our national complete medical director guide, and it starts where Colorado starts: with who holds authority for each act your practice performs.

Does Colorado Actually Require a Med Spa Medical Director?

Colorado requires physician involvement in some structures and not others, and the word "director" appears nowhere in the requirement.

No Med Spa License, No Named Medical Director

Colorado regulates med spas through the professions that work inside them, not the facility. The Department of Regulatory Agencies (DORA) houses the Colorado Medical Board, the Colorado State Board of Nursing, and the Colorado State Board of Pharmacy, and each licenses people, not spas. There is no facility inspection, no med spa registry, and no title of "medical director" that the state issues or defines — the term is industry shorthand that arrived from other states and stuck. That absence misleads operators in both directions: some read it as permission, which is wrong, because the underlying acts are still the practice of medicine under the Medical Practice Act at C.R.S. 12-240-101 et seq.

Where the Requirement Actually Comes From

Injecting neurotoxins and fillers and firing a Class IIIb or higher laser are the practice of medicine, so someone with authority to perform or lawfully delegate those acts must be responsible for them. When those acts are handed to a person not licensed to perform them independently, the Medical Board's delegation rule installs a named, accountable delegating physician — the real legal identity behind the medical director title. Colorado's corporate practice of medicine doctrine adds a third constraint, on who may own the entity and control clinical decisions.

The Full-Practice-Authority Exception

Colorado's distinguishing feature is that an advanced practice registered nurse with full prescriptive authority does not practice under a physician. Under the Nurse Practice Act at C.R.S. 12-255-101 et seq., an APRN who has completed the prescriptive-authority pathway evaluates, diagnoses, prescribes, and orders independently — no collaborating agreement, no countersignature, no supervising physician. Where an APRN performs the evaluations and writes the prescriptions, and injections are given by the APRN or by registered nurses on the APRN's individualized orders, no physician medical director is required anywhere in the structure. That is a genuine and underused advantage — and narrower than it looks.

The Colorado Rules That Create the Role

Four bodies of law decide whether your practice needs a physician and what that physician owes.

The Medical Practice Act — C.R.S. 12-240-101 et seq.

The Act defines the practice of medicine and gives the Colorado Medical Board authority over physicians and physician assistants. Two provisions matter most. C.R.S. 12-240-107(3)(l) is the delegation statute — the narrow doorway through which an unlicensed person may lawfully perform a medical service, and only under a physician's personal and responsible direction and supervision. C.R.S. 12-240-121 defines unprofessional conduct, including aiding or abetting the practice of medicine by an unlicensed person — which is why a physician who lends a name without supervising is exposed personally, not merely unhelpful.

Rule 1.17 — Delegation and Supervision of Unlicensed Persons

The rule operators still call Rule 800 now lives at 3 CCR 713-1.17, and it is the most important text in Colorado med spa practice. It defines Medical-Aesthetic Services to include use of a Class IIIb or higher laser, radio-frequency device, intense pulsed light, or any technique resulting in revision, destruction, incision, or other structural alteration of human tissue or hair removal — plus the injection of any substance into the human body, with narrow exceptions.

It then sets what the delegating physician must do: personally assess the delegatee's qualifications and competence including initial over-the-shoulder monitoring of each delegated service, reassess at least annually, maintain a written agreement listing the authorized services and available to the public at the site, ensure informed consent is obtained and charted, remain available to attend the patient in person within thirty minutes, and personally provide consultation or evaluation on request. Delegated services must be routine and technical, must not require the delegatee to exercise medical judgment, and must be what a reasonable and prudent physician would find within sound medical judgment to delegate. Prescribing may never be delegated. The rule does not govern delegation to physician assistants, anesthesiologist assistants, or individuals regulated by the Board of Nursing — those chains run elsewhere.

The Nurse Practice Act and Full Practice Authority

The Board of Nursing licenses APRNs, registered nurses, and LPNs. Registered nurses may administer injections pursuant to a valid order from an authorized prescriber; they may not evaluate, diagnose, select the patient for therapy, or prescribe. APRNs earn prescriptive authority in stages under C.R.S. 12-255-112: provisional authority (RXN-P) first, then a documented 750-hour prescribing mentorship with a physician or full-RXN APRN to convert to unrestricted authority. The mentorship may be remote so long as communication is synchronous — email does not count. Which tier a candidate holds is a fact to verify on the license lookup, not infer from a title. Scope for the injection itself is covered in who can inject Botox in Colorado.

HB25-1024 — The 2025 Disclosure Law

Colorado added a transparency layer with HB25-1024, Medical-Aesthetic Services Delegation Disclosures, signed by Governor Polis on April 7, 2025 and effective August 6, 2025. It did not change what may be delegated; it changed what must be told. Where a physician or APRN delegates medical-aesthetic services to someone who is not a licensed health-care provider, the practice must post a highly visible on-site sign naming the delegating practitioner with license number, contact information, and the board's complaint web address; disclose the arrangement on its website and in advertising for the unlicensed provider; and obtain written informed consent acknowledging that the service will be performed by an unlicensed individual under supervision.

Two details deserve attention. The obligation expressly reaches APRNs as well as physicians — the clearest signal yet that Colorado contemplates non-physician delegation. And because it took effect in August 2025, any spa that wrote its consent forms before then almost certainly has a gap; missing disclosures are among the most common findings in a 2026 Colorado file review.

When a Colorado Med Spa Must Have a Physician

Rather than asking whether you need a medical director, walk your service menu and ask which acts require physician authority. Physician prescribing is the obvious one — if your prescriptions come from a physician rather than an independently authorized APRN, that physician is the clinical keystone by definition. Three structural triggers cover almost everything else.

Delegation of Medical-Aesthetic Services to Unlicensed Staff

This is the most common trigger by a wide margin. If a laser technician, aesthetician, medical assistant, or anyone without an independent license to perform the service is running your IPL, Class IIIb+ laser, or RF device, that work happens under the Medical Board's delegation rule — which needs a delegating physician who has personally observed that specific person performing that specific service and who can be at the patient's side within thirty minutes. No version of this works with a physician who has never visited the site.

Physician Assistants Under a Collaborative Agreement

Colorado overhauled PA practice with SB23-083, effective August 7, 2023, replacing supervision with an ongoing collaborative agreement — which still needs a physician on the other side of it. A PA with fewer than three years of practice must have their first 160 working hours supervised by a physician at the same location, including at least 40 hours with a primary supervising physician. Hiring a newly graduated PA to run an injection clinic is a physician-required structure.

Ownership and the Corporate Practice of Medicine

Under C.R.S. 12-240-138, a professional service corporation for the practice of medicine must be owned by board-licensed physicians who actively practice in its offices and hold their shares in their own right; physician assistants may be shareholders only so long as physicians retain majority ownership. Lay directors, officers, and heirs may exercise no authority whatsoever over a licensee's independent medical judgment. A management services organization can run marketing, scheduling, facilities, and billing — it cannot decide who gets treated, with what, or by whom.

Who Qualifies as a Colorado Medical Director

Once your structure needs a physician, the qualification bar is narrower than the market implies.

Colorado Licensure Is Non-Negotiable

The medical director must be an MD or DO holding an active Colorado license in good standing with the Colorado Medical Board. A physician licensed in Texas or California who has never held Colorado licensure cannot serve, however the agreement is drafted, because the practice of medicine occurs where the patient is located. Oversight companies that assign a director from a national bench are a recurring source of this failure.

Genuine Competence in the Services Offered

Colorado imposes no specialty requirement — a family physician, internist, emergency physician, or dermatologist may all serve. But the rule requires the delegating physician to personally assess each delegatee's competence, including watching them perform each delegated service. A physician who has never operated an Nd:YAG device cannot meaningfully evaluate whether your technician is operating it safely, and a board reviewing an adverse event will ask exactly that.

Who Cannot Hold the Role

A registered nurse, LPN, medical assistant, aesthetician, or non-clinical owner cannot serve as the clinical authority for services requiring physician oversight. A physician assistant cannot be the delegating physician for unlicensed delegatees, nor supply the physician side of their own collaborative agreement. A non-clinical person may own a business entity that is not a medical professional service corporation and run its operations — never its clinical decisions.

Verifying a Candidate Before You Sign

Run the DORA license lookup and confirm an active Colorado license, no open discipline or restrictions, malpractice coverage reaching medical-director activity, and how many other Colorado practices and delegatees the candidate already carries. Then ask where they physically are during your treatment hours — not small talk in Colorado, but a direct test of the thirty-minute standard.

What a Colorado Medical Director Actually Does

Colorado is unusually specific here: the duties below come largely from rule text rather than best-practice inference. Our national breakdown sits in med spa medical director requirements; what follows is the Colorado layer.

Write and Approve the Written Protocols

Every service needs a written protocol and, where staff act on the physician's authority, standing orders: indications, contraindications, patient selection, technique parameters, device settings, adverse-event response, and escalation. Protocols are signed and dated before the first treatment and reviewed on a stated schedule. Undated protocols are the most common failure in file reviews.

Assess Each Delegatee — Over the Shoulder, Then Annually

Before a delegatee performs a medical-aesthetic service outside the physician's physical presence, the physician must personally assess their qualifications and competence, including initial over-the-shoulder monitoring of that person performing that specific service, then reassess at least annually. This is a per-person, per-procedure obligation: a physician who observed a technician performing IPL has not thereby cleared her for RF microneedling. Record the date, the service, the observation, and the sign-off, and keep prior years — a single current sign-off does not demonstrate an ongoing relationship.

Maintain a Public Written Delegation Agreement

Colorado requires a written agreement between the physician and each delegatee listing the authorized medical-aesthetic services and documenting training and qualifications — and it must be available to the public at the site. Most compliant spas keep it at the front desk; very few have one at all until someone asks.

Meet the Thirty-Minute Availability Standard

The delegating physician must be available to attend the patient in person within thirty minutes. This is the most operationally demanding sentence in Colorado med spa law, because it converts a paper relationship into a geographic constraint — shaping who you can hire and how many sites one physician can carry. Name a qualified alternate and document the handoff.

Own the Good-Faith Evaluation and Informed Consent

Colorado has no statute titled "good faith examination," but the requirement is unmistakable across the Medical Board's rules and telehealth policies: a clinically appropriate evaluation sufficient to establish the diagnosis must precede treatment, performed by someone with authority to order it. The physician must also ensure informed consent is obtained and timely charted. Support staff may collect intake data; they may not evaluate.

Review Charts and Run Quality Assurance

Colorado publishes no chart-review percentage, so the standard is that oversight be real and demonstrable: a stated review cadence, dated review notes, an adverse-event log, periodic QA meetings with minutes, and corrective action when something is flagged. If it is not written down, a Colorado regulator treats it as not done.

Can a Nurse Practitioner Be a Colorado Medical Director?

This is the Colorado question, and the answer is a qualified yes that operators routinely over-read.

What Full Practice Authority Does

An APRN holding full RXN is an independent practitioner. They can establish the provider-patient relationship, evaluate, diagnose, prescribe, write the standing orders registered nurses administer under, sign the protocols, and serve as the named clinical authority. For an APRN-owned injectables or weight-loss practice where every act stays in licensed nursing hands, that is a complete and lawful structure with no physician in it — the same logic driving the prescribing analysis in our Colorado GLP-1 and weight-loss compliance guide.

What Full Practice Authority Does Not Do

It does not make an APRN a physician for rules that name physicians. The Medical Board's delegation framework for unlicensed persons is a physician rule; a medical professional service corporation requires physician ownership; a PA collaborative agreement requires a physician. A practice that adds a laser technician, brings on a PA, or restructures its entity can move from "no physician required" to "physician required" without changing its service menu.

The honest gray zone is APRN delegation to unlicensed staff. HB25-1024 imposes disclosure duties on APRNs who delegate, implying the state contemplates it — but that delegation runs through the Nurse Practice Act and Board of Nursing rules rather than the Medical Board's, and the analysis is fact-specific. If your structure depends on it, get a Colorado healthcare attorney's written opinion.

One verification point closes this section. An APRN with provisional prescriptive authority (RXN-P) is still working through the 750-hour mentorship and has not converted to unrestricted authority — building an independent-practice structure on a provisional APRN is an error that surfaces only when someone checks the license.

What a Colorado Medical Director Costs

Colorado is a middle-of-the-market state, with Denver and Boulder above the Western Slope. What follows are observed ranges, not published rates; Colorado sets no fee schedule.

Typical 2026 Ranges

A light-touch arrangement — protocol sign-off, emergency availability, periodic remote chart review, no routine on-site presence — commonly runs $1,500 to $3,000 per month. Broader oversight covering multiple providers, higher-acuity services, or several locations typically runs $3,000 to $8,000 per month and can go higher. Hourly consulting for protocol drafting, delegatee assessments, and chart review generally runs $200 to $500 per hour. How these numbers are built is broken down in our medical director cost and agreement guide.

What Drives the Colorado Number Up

Three state-specific factors move price. The thirty-minute standard is the biggest: a physician who must reach your Cherry Creek treatment room in half an hour is selling scarce availability, and a mountain-town practice may find the pool very small. Assessment and reassessment require real site time, per delegatee. And a spa leaning on unlicensed delegatees buys more physician exposure than one staffed entirely by RNs and APRNs.

Compensation Structures That Create Risk

Pay a flat monthly retainer or an hourly rate at fair market value for services actually rendered. Never pay a percentage of revenue, a per-treatment fee, or anything scaling with patients treated — those structures invite fee-splitting and CPOM scrutiny. Treat an unusually cheap quote as a warning: a director charging a few hundred dollars a month is not performing per-delegatee assessments or meeting a thirty-minute standard.

How Many Med Spas Can One Colorado Medical Director Oversee?

Operators want a number. Colorado does not give one — it gives something harder to game.

The Thirty-Minute Rule Is the Real Limit

No Colorado statute or rule caps how many facilities one physician may serve, and many physicians are named at several. The availability standard does the work a cap would do: a physician cannot be thirty minutes from sites in Denver, Colorado Springs, and Grand Junction at once. Layer on per-delegatee assessment, annual reassessment, documented chart review, and genuine reachability, and the realistic ceiling for defensible oversight is a small cluster of nearby sites — not a portfolio.

Diligence Questions Before You Hire

Ask how many Colorado practices and delegatees the candidate covers, where they are during your operating hours, when they last performed an over-the-shoulder assessment, and who covers when they are unavailable. A candidate who cannot answer crisply is describing a title rather than a role — and the volume analysis in our national medical director liability guide applies with extra force in a state with a hard availability standard.

The Colorado Medical Director Agreement

The written agreement is the first document a board investigator or plaintiff's attorney asks for — and in Colorado, part of it is a public record at your front desk.

The Colorado-Specific Clauses

• The delegation agreement itself — between the physician and each delegatee, listing the specific authorized medical-aesthetic services and documenting training, kept available to the public at the site
• The over-the-shoulder assessment protocol — how initial competence is observed and signed off, per person and per procedure
• Annual reassessment — cadence, method, and who keeps the records
• The thirty-minute standard — how in-person availability is met during treatment hours, and the named alternate for coverage gaps
• HB25-1024 disclosures — who maintains the sign, the website and advertising language, and the patient consent
• Scope boundaries — an explicit statement that prescribing is not delegated and delegatees exercise no medical judgment

The Standard Terms That Still Matter

• Parties, Colorado license numbers, effective and renewal dates
• The specific services and devices overseen, and the sites covered
• Chart-review frequency, sampling method, and documentation format
• On-site visit cadence and expected response times
• Quality-assurance and adverse-event review, with meeting minutes
• Fair-market-value compensation, expressly not tied to revenue, volume, or referrals
• Malpractice coverage including tail coverage, and indemnification
• Authority to halt a service or suspend a delegatee on clinical grounds, with no business veto
• Termination, notice, and transition provisions, including who inherits the protocols

The recurring weak agreement is a two-page template from another state that names a physician, sets a monthly fee, and says nothing about delegatee assessment, availability, or disclosures — its silence on Colorado's duties is itself evidence. A close second is an agreement accurate on paper while the practice does none of it.

Liability — What a Colorado Medical Director Is On the Hook For

The exposure is real, and it runs in both directions.

Board Discipline

The Colorado Medical Board can discipline the physician for unprofessional conduct under C.R.S. 12-240-121, which expressly includes aiding or abetting the practice of medicine by an unlicensed person. Delegating a service that may not be delegated, delegating to someone whose competence was never assessed, or being unreachable while your name is on the wall all fit. Unauthorized practice of medicine is a class 6 felony under C.R.S. 12-240-135.

Civil Liability

When a patient is burned by a laser or suffers a vascular occlusion from filler, the medical director is a named defendant in nearly every complaint: the physician approved the protocol, cleared the person who performed the procedure, and was responsible for supervision. Confirm the carrier writes coverage for medical-director activity specifically — a policy covering clinical practice does not automatically extend to supervisory liability elsewhere.

Business and Structural Exposure

For the practice, a defective structure reaches past a board order: unwinding a non-compliant corporate arrangement, missing-disclosure findings under HB25-1024, carrier disputes, and losing a director mid-investigation with no succession plan. The Colorado med spa compliance checklist works through these as a box-by-box audit.

Ownership, CPOM, and What Did Not Change in 2026

Colorado's ownership rules were tested this year. Know the outcome before planning around a rumor.

The rules described above still stand: physician ownership of a medical professional service corporation, PAs as minority shareholders only, shareholders actively practicing in the corporation's offices, and no lay authority over medical judgment. An APRN within full practice authority may own and run a nursing practice — but the moment the entity is organized for the practice of medicine, the physician-ownership rules apply.

HB26-1249 Was Postponed Indefinitely

HB26-1249, Medical-Aesthetics Corporation Ownership, would have created a special medical-aesthetics professional corporation — allowing physician assistants to hold majority ownership and permitting estheticians, cosmetologists, practical nurses, registered nurses, APRNs, and PAs to be shareholders. It was postponed indefinitely by the House Health and Human Services Committee on March 25, 2026 after opposition from the Colorado Medical Society, Copic, and the Colorado Hospital Association. Nothing changed. Any structure built on the assumption that non-physician ownership of a medical-aesthetics corporation is now permitted rests on a bill that died in committee — though its introduction is a fair signal the question returns in a future session.

Onboarding a Colorado Medical Director — The Operational Checklist

If your structure needs a physician, this sequence produces a defensible arrangement rather than a paper one.

1. Map authority before you shop — list every service and who performs it, then flag which acts require physician authority.
2. Verify the candidate on the DORA license lookup — active Colorado MD or DO, no restrictions or open discipline, and their current site load.
3. Test the thirty-minute standard against your address, and name the alternate for coverage gaps.
4. Confirm malpractice coverage reaching medical-director activity, including tail, in writing from the carrier.
5. Draft the agreement to Colorado's duties — assessment, reassessment, availability, disclosures, chart review, fair-market-value pay, termination.
6. Execute the per-delegatee delegation agreements and put the public copy where patients can see it.
7. Run and document the over-the-shoulder assessments before anyone works unobserved: date, service, observer, outcome.
8. Sign and date protocols and standing orders before the first treatment, and set the review calendar.
9. Post the HB25-1024 disclosures — sign, website and advertising language, patient consent — and photograph the sign for the file.
10. Start the oversight record on day one — chart-review log, adverse-event log, QA minutes, reassessment calendar. Oversight that begins the week an investigator calls is not oversight.

Work that list and you have a Colorado structure that survives a board look. If you would rather not build the agreement, logs, and delegation SOPs from scratch, our ready-to-use med spa compliance SOPs cover the documentation layer behind every step above, and the Colorado compliance hub collects every Colorado-specific guide in one place. Primary sources are the Colorado Medical Board and the Colorado State Board of Nursing, with bill history at the Colorado General Assembly and industry updates from AmSpa.

Disclaimer: This article is for educational purposes only and does not constitute legal or medical advice. Colorado's delegation, supervision, and ownership rules are administered by several DORA boards and change frequently — the Medical Board's delegation rule was recodified from Rule 800 to 3 CCR 713-1.17, PA practice changed under SB23-083 in 2023, the HB25-1024 disclosure law took effect August 6, 2025, and HB26-1249 was postponed indefinitely in March 2026. Verify current rule text and consult a Colorado healthcare attorney before establishing or modifying a medical director arrangement.