C.R.S. § 6-1-1708: Compliance with other legal obligations - insurers - covered entities - disclosures. [Editor's note: This version of this section is effective January 1, 2027.]

(1) (a) An insurer, as defined in section 10-1-102 (13), and affiliated entities that are subject to the requirements of section 10-3-1104.9 are in compliance with this part 17 in the practice of insurance.

(b) If an insurer is not deemed in compliance pursuant to subsection (1)(a) of this section, the insurer shall provide notice and disclosure of its use of a covered ADMT in materially influencing a consequential decision regarding the practice of insurance pursuant to the disclosure requirements of section 6-1-1704 (3), to the extent applicable.

(2) This section does not limit the applicability of this part 17 to uses of covered ADMT related to insurer employment or insurer employment opportunities by insurers and affiliated entities that are subject to the requirements of section 10-3-1104.9.

(3) (a) Sections 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a covered entity within the meaning of the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9, and the regulations promulgated under the federal act, or a covered entity's business associates for any services rendered to a covered entity, to the extent the covered entity is doing business in Colorado, except for a consequential decision related to employment or an employment opportunity.

(b) Notwithstanding subsection (3)(a) of this section, for a covered entity that is a health-care provider, as defined in 45 CFR 160.103, this subsection (3) applies only if the health-care provider is operating from a location within Colorado.

(c) A covered entity shall provide patients with a general notice of use of advanced technologies, including a covered ADMT. The notice may be incorporated with other notices describing patient rights and how the covered entity provides care.

(d) Notwithstanding subsection (3)(a) of this section, a covered entity that uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care as described in section 25.5-3-502, shall provide a patient the following disclosures:

(I) A plain language description of the consequential decision and the role of the covered ADMT in the consequential decision;

(II) The types of information about the individual the covered entity relied upon in making its determination of eligibility, except for trade secrets and other confidential or legally protected information;

(III) Information on how to request correction of materially inaccurate personal data held by the covered entity consistent with the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9 and section 25.5-3-502; and

(IV) Information on how to request meaningful human review or reconsideration, where applicable.

(e) A covered entity may comply with subsection (3)(d) of this section through either an advance general disclosure of the information required by subsection (3)(d) of this section or through a notice provided within thirty calendar days after an adverse outcome. This section does not create a separate and duplicative disclosure process or appeal process if the review opportunities and information described in subsection (3)(d) of this section are provided.

(4) Sections 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a medical device subject to oversight by the United States food and drug administration or a pharmaceutical or medical device manufacturer's research and development activities that are subject to oversight by the United States food and drug administration, including clinical investigations conducted under 21 CFR 312.

(5) Nothing in this part 17 requires a covered entity or business associate, as those terms are defined under the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9, to disclose protected health information or other information in a manner that would violate federal law. To the extent compliance with section 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer shall comply with applicable federal law and provide disclosures and access consistent with that law.

(6) This part 17 does not require a person to disclose nonpublic personal information in a manner that would violate the federal "Gramm-Leach-Bliley Act", 15 U.S.C. sec. 6801 et seq., or its implementing regulations.