Health Law Advisor

[8/28/2025 UPDATE: Following a special session called by Governor Jared Polis, the Colorado legislature passed SB 25B-004 and it was signed by the governor on August 28, 2025. SB 25B-004 will delay the effective date for implementation of SB 24-205, the state’s historic artificial intelligence law, to June 30, 2026, instead of February 1, 2026.]

On May 17, 2024, Colorado Governor Jared Polis signed Colorado’s historic artificial intelligence (AI) consumer protection bill, SB 24-205, colloquially known as “Colorado’s AI Act” (“CAIA”), into law. As we noted at the time, CAIA aims to prevent algorithmic discrimination in AI decision-making that affects “consequential decisions”—including those with a material, legal, or similarly significant effect with respect to health care services and employment decision-making. The bill is scheduled to take effect February 1, 2026.

The same day he signed CAIA, however, Governor Polis addressed a “signing statement” letter to Colorado’s General Assembly articulating his reservations. He urged sponsors, stakeholders, industry leaders, and more to “fine tune” the measure over the next two years to sufficiently protect technology, competition, and innovation in the state.

As the local and national political climate steers toward a less restrictive AI policy, Governor Polis drafted another letter to the Colorado legislature. On May 5, 2025, Polis—along with Attorney General Phil Weiser, Denver Mayor Mike Johnston, and others—requested that CAIA’s effective date be delayed until January 2027.

On May 17, 2024, Colorado Governor Jared Polis signed into law SB 24-205—concerning consumer protections in interactions with artificial intelligence systems—after the Senate passed the bill on May 3. The law adds a new part 17, “Artificial Intelligence,” to Article I, Title 6 of the Colorado Consumer Protection Act, to take effect on February 1, 2026. This makes Colorado “among the first in the country to attempt to regulate the burgeoning artificial intelligence industry on such a scale,” Polis said in a letter to the Colorado General Assembly.

The new law will ...

In the absence of a comprehensive federal data privacy law, state legislators continue to add to the often-contradictory array of laws aimed at protecting the security and privacy of their residents’ data. Very recently, Washington State’s My Health My Data Act was signed into law by Governor Jay Inslee in late April, Florida lawmakers passed Senate Bill 262 in early May, and the Tennessee Information Protection Act was signed into law earlier this month as well. While preparing this update, Montana’s enacted its Consumer Data Privacy Act on May 19^th, which we will address in subsequent guidance due to its recency. These newly enacted state laws build upon the growing patchwork of laws enacted in California, Connecticut, Colorado, Virginia, and Utah, all of which we previously discussed here and here. Yet, among these state laws there is significant variety, including inconsistencies as to whether the laws allow for private rights of action, and whether the laws provide affirmative defenses and other incentives based on compliance with relevant best practices.

Our colleague Nancy Gunzenhauser Popper at Epstein Becker Green has recently published a post on the Workforce Bulletin blog that will be of interest to our readers in the health care industry: “Colorado Mandates 4 Days of Paid Leave for COVID-19 Testing.”

Following is an excerpt:

On March 10, 2020, Colorado Governor Jared Polis issued an executive order directing he Colorado Department of Labor and Employment (“DLE”) to create emergency rules to “ensure workers in food handling, hospitality, child care, health care, and education can get paid sick leave to ...

The market for direct-to-consumer (“DTC”) genetic testing has increased dramatically over recent years as more people are using at-home DNA tests.  The global market for this industry is projected to hit $2.5 billion by 2024.  Many consumers subscribe to DTC genetic testing because they can provide insights into genetic backgrounds and ancestry.  However, as more consumers’ genetic data becomes available and is shared, legal experts are growing concerned that safeguards implemented by U.S. companies are not enough to protect consumers from privacy risks.

Some states vary ...

Our colleague Daniel J. Green at Epstein Becker Green has a post on the Trade Secrets & Employee Mobility blog that will be of interest to our readers in the health care industry: “Colorado Places New Limitation on Physician Restrictive Covenants.”

Following is an excerpt:

Earlier this month, Colorado amended its law governing physician non-compete agreements (C.R.S. § 8-2-113(3)).  Since its enactment in 1982, that statute generally has prohibited agreements restricting the rights of physicians to practice medicine, but has allowed contractual provisions ...

Our colleagues David J. Clark and Erica R. McKinney at Epstein Becker Green has a post on the Trade Secrets & Employee Mobility blog that will be of interest to our readers in the health care industry: “Mile High Non-Compete Law: Colorado Court of Appeals Determines Enforceability of Liquidated Damages Clause in Physician Non-Compete Agreement.”

Following is an excerpt:

The Colorado Court of Appeals, in Crocker v. Greater Colorado Anesthesia, P.C., recently examined several unique enforceability considerations with respect to a physician non-compete agreement.  Of ...

The intersection of employment and marijuana laws has just gotten cloudier, thanks to a recent decision by the Rhode Island Superior Court interpreting that state’s medical marijuana and discrimination laws. In Callaghan v. Darlington Fabrics Corporation, the court broke with the majority of courts in other states in holding that an employer’s enforcement of its neutral drug testing policy to deny employment to an applicant because she held a medical marijuana card violated the anti-discrimination provisions of the state medical marijuana law.

Background

Plaintiff ...