C.R.S. § 5-19-206.7: Remote work authorized - definition.

(1) Subject to rules adopted by the administrator, nothing in this part 2 prohibits a registered provider from permitting its employees to work from a remote location so long as the registered provider:

(a) Ensures that no in-person customer interactions are conducted at the remote location and does not designate the remote location to consumers as a business location;

(b) Maintains appropriate safeguards for registered provider and consumer data, information, and records, including the use of secure virtual private networks, also known as "VPNs", where appropriate;

(c) Employs appropriate risk-based monitoring and oversight processes of work performed from a remote location and maintains records of the monitoring and oversight processes;

(d) Ensures consumer information and records are not maintained at a remote location;

(e) Ensures consumer and registered provider information and records remain accessible and available for regulatory oversight and examination; and

(f) Provides appropriate employee training to ensure employees working from a remote location keep all conversations about and with consumers that are conducted from the remote location confidential, as if conducted from a commercial location, and to ensure that employees working at a remote location work in an environment that is conducive and appropriate to ensuring privacy and confidential conversations.

(2) As used in this section, "remote location" means a private residence of an employee of a registered provider or another location selected by the employee and approved by the registered provider.