Provides financial services, in Colorado

C.R.S. section 10-16-423 · Read the law's page

• If you are a health maintenance organization, hold in confidence any data or information about the diagnosis, treatment or health of an enrollee or applicant that you obtain from that person or from a provider, and do not disclose it to any person except as necessary to carry out part 1 of article 16 of title 10 or part 4, on the express consent of the enrollee or applicant, under a statute or court order for the production of evidence, in a claim or litigation between that person and the organization where the information is pertinent, or as state or federal law otherwise requires or permits (section 10-16-423).

C.R.S. section 10-3-1104.7 · Read the law's page

• If you are an entity that provides group disability insurance or long-term care insurance coverage and is subject to the jurisdiction of the commissioner of insurance, treat information derived from genetic testing as confidential and privileged, and release it for any purpose other than diagnosis, treatment or therapy, when it identifies the person tested with the test results released, only with the specific written consent of the person tested (section 10-3-1104.7(3)(a)).
• Do not seek, use or keep information derived from genetic testing for any nontherapeutic purpose or for any underwriting purpose connected with group disability insurance or long-term care insurance coverage (section 10-3-1104.7(3)(b)).
• If you are an insurer writing life insurance or individual disability insurance, do not require or perform a genetic test without first receiving the specific, written, informed consent of the subject of the test, or of a person authorized by law to consent for a subject who lacks capacity, in a form the commissioner prescribes. Keep the results privileged and confidential and release them only as state or federal law specifically authorizes (section 10-3-1104.7(10)).

3 CCR 702-6, Regulation 6-4-1 · Read the law's page

• If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (Regulation 6-4-1 Sections 5 and 6).
• Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Sections 16 and 17 authorize (Section 5.A.2).
• Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt out notice that states you disclose or reserve the right to disclose it, that the consumer has the right to opt out and a reasonable means to do so, and allow a reasonable opportunity to opt out; do not disclose it if the consumer opts out (Sections 8 and 12).
• Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Section 18.B lists; an authorization is written or electronic, states how long it is valid (not more than 24 months) and may be revoked at any time (Sections 18 and 19).
• Retain each authorization, or a copy, in the record of the individual who is the subject of the nonpublic personal health information (Section 19.D).
• Do not unfairly discriminate against a consumer or customer because the person opted out from the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (Section 24).

Colorado Division of Insurance Regulation 6-4-2, Standards for Safeguarding Customer Information (3 CCR 702-6) · Read the law's page

• Applies to a licensee under Colorado insurance law, which you declare by stating that you are an insurer: every licensed insurer, producer and other person licensed or required to be licensed, or authorized or required to be authorized, under the insurance laws of Colorado, other than a purchasing group or a nonadmitted insurer in regard to surplus lines business under article 5 of title 10.
• Implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information, meaning nonpublic personal financial information and nonpublic personal health information about a customer, in paper, electronic or other form, maintained by or on behalf of you.
• Keep the safeguards appropriate to your size and complexity and the nature and scope of your activities.
• Design the program to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
• The regulation lists non-exclusive examples you may follow to meet these duties: assess the risk to customer information and your systems, train staff and regularly test or monitor your key controls, exercise due diligence in selecting service providers and require them to implement appropriate measures designed to meet the regulation's objectives, and adjust the program as technology, threats and your business arrangements change.

C.R.S. section 10-3-1104.6 (HB 09-1338, 2009 Colo. Sess. Laws ch. 353, section 2) · Read the law's page

• If you are an entity that provides health care insurance or medicare supplement insurance coverage and is subject to the jurisdiction of the commissioner of insurance, treat an individual's genetic information as confidential and privileged, and release it for any purpose other than diagnosis, treatment or therapy, when it identifies the person tested with the test results released, only with the specific written consent of the person or the person's parent or guardian (section 10-3-1104.6(3)(a)).
• Do not seek, use or keep genetic information for any nontherapeutic purpose or for any underwriting purpose connected with the provision of health care insurance or medicare supplement insurance coverage (section 10-3-1104.6(3)(b)).
• Do not request or require an individual or a family member to undergo a genetic test unless state or federal law authorizes it (section 10-3-1104.6(3)(c)).

C.R.S. 10-3-1104.9 · Read the law's page

• Do not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice.when it serves a financial business
• Where the Commissioner of Insurance has adopted implementing rules for your type of insurance and practice, do not use an external consumer data and information source, or an algorithm or predictive model that uses one, in a way that unfairly discriminates on those same grounds.when it serves a financial business
• Cooperate with the Commissioner and the Division of Insurance in any examination or investigation of your use of an external consumer data and information source, algorithm, or predictive model.when it serves a financial business
• This duty does not reach title insurance, a surety bond, or most commercial insurance policies; it does reach a business owners' policy or a commercial general liability policy with an annual premium of ten thousand dollars or less.

3 CCR 702-10, Regulation 10-1-1 · Read the law's page

• Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.for a financial business
• If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model, file with the Division instead an attestation, signed by an officer, to that effect within one month of the regulation's effective date and on December 1 every year after that.when it serves a financial business
• File a compliance report with the Division on SERFF: annually by December 1 if you are a life insurer, and annually by July 1 if you are a private passenger automobile insurer or a health benefit plan insurer.when it serves a financial business
• Make every component of your governance and risk management framework available to the Division on request, as of December 1 each year if you are a life insurer and as of July 1 each year if you are a private passenger automobile or health benefit plan insurer.when it serves a financial business
• If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model as of the effective date but later plan to, submit the compliance report described in Section 6.B to the Division before you start using one.when it serves a financial business
• This duty reaches every insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan and uses an external consumer data and information source, or an ECDIS-based algorithm or predictive model, in any insurance practice.

Colo. HB 26-1139, 2026 Colo. Sess. Laws ch. 325 · Read the law's page

• Ensure that an AI system used for utilization review makes determinations based on the patient's medical or clinical history, individual clinical circumstances and other relevant clinical factors, with any denial of coverage reviewed by a licensed clinician, physician or other competent regulated professional
• Do not base a utilization review determination solely on group data without reference to the individual's data, and do not use the system in a way that discriminates against individuals in violation of state or federal law
• Periodically review the AI system to ensure its outcomes are accurate and reliable and that an individual's health data is not used beyond its intended or stated purpose
• Disclose to the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable, the utilization review functions for which the AI system will be used and the points in the process where it will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information
• As a carrier, do not issue a denial of coverage based in whole or in part on medical necessity solely on the output of an AI system without human review by a licensed clinician, physician or other competent regulated professional
• As a carrier or a payer under the Colorado Medical Assistance Act or the Children's Basic Health Plan Act, do not pay for psychotherapy services provided directly to a client and conducted by an AI system