# Colorado MedSpa Business Facts

## Executive Summary
Operating a MedSpa in Colorado requires navigating strict Corporate Practice of Medicine rules necessitating an MSO, alongside the tight supervision matrices defined by Colorado Medical Board Rule 400. Furthermore, Colorado imposes intense data privacy rules, including a 30-day breach notification window and mandatory opt-in consent for handling sensitive consumer health data.

**Difficulty Rating:** Hard

## 1. Ownership Rules & CPOM
- **The Core Rule:** Colorado strictly enforces the Corporate Practice of Medicine (CPOM). Non-physicians are prohibited from owning a medical practice or employing physicians to practice medicine.
- **Corporate Structures:** A MedSpa offering medical aesthetic services must legally operate as a Professional Corporation (PC) or a Professional Limited Liability Company (PLLC) owned exclusively by a Colorado-licensed physician.
- **The MSO Model:** Entrepreneurs, marketers, and RNs who are not physicians must utilize the Management Services Organization (MSO) model. The non-physician owns an LLC that leases operations to and contracts with the physician-owned PLLC via a formal Management Services Agreement (MSA).
- **Fee-Splitting Prohibitions:** The MSO cannot be paid a typical percentage of the medical clinic’s revenue derived from patient care. Management fees must be established at a fair market value (FMV) flat rate.

## 2. Everyday Clinical Operations & Medical Board Rule 400
The Colorado Medical Board governs the delegation of cosmetic treatments strictly through **Rule 400**.
- **The Baseline Exam:** Firing a laser or injecting a filler is practicing medicine. Before an RN or esthetician performs a procedure, the delegating physician MUST establish a baseline assessment and essentially write the order.
- **Supervision Limits (On-Site vs. Direct):** Rule 400 demands that physicians provide supervision appropriate to the delegate's skills and the procedure's risk. For unlicensed personnel (like estheticians) operating powerful Class IV medical lasers, the standard of care in Colorado frequently requires the physician to be *on-site* (physically present in the facility) to provide direct supervision, unless written, pre-approved protocols explicitly outline safe, indirect supervision methods.
- **Injectables:** The administration of Botox and dermal fillers is the practice of medicine. Physicians may delegate injections to an RN or PA under standing orders following the initial exam. **Rule 400 effectively prohibits estheticians and unlicensed medical assistants from injecting neuromodulators or dermal fillers.**

## 3. Key Challenges & Common Pitfalls
- **CPA Sensitive Data Violations:** A MedSpa MSO capturing website inquiries about "acne treatment" and using that data for targeted Facebook ads without obtaining the explicit, opt-in consent required by the Colorado Privacy Act for "sensitive data."
- **The 30-Day Breach Trap:** Failing to realize that Colorado requires consumer notification within 30 days of a data breach, which is half the time allowed by many other states like Texas.
- **Improper Esthetician Delegation:** Allowing an esthetician to fire a high-powered laser while the Medical Director is on vacation, violating Rule 400's supervision mandates.

## 4. Timeline & Costs
- **Legal Setup:** Proper MSO agreements, professional entity formation, and drafting clinical protocols tightly aligned to Rule 400 take time. Expect 3 to 6 months to establish the complete legal framework.
- **Costs:** Legal setup fees for establishing the MSO, PC structure, and outlining precise Rule 400 delegation protocols typically range from $12,000 to $20,000.