If your Colorado med spa uses unlicensed staff for injections or laser work, the delegating physician must be on the premises unless physician-written procedure and emergency protocols are in place. Even then, Colorado Medical Board Rule 1.17 requires on-site monitoring at least every two weeks, review of every patient chart within 14 days, and a physician who is physically in Colorado.
Those numbers come from the rule text. Check whether your directorship agreement mentions any of them.
The rule applies to unlicensed delegatees, and RNs are outside it
Rule 1.17 sits in 3 CCR 713-1. Operators still call it Rule 800, its former number. It implements C.R.S. § 12-240-107(3)(l), which exempts from licensure a person who renders services, other than prescribing, “under the personal and responsible direction and supervision” of a licensed physician.
The rule covers delegation to a person who is not licensed to perform the service. That includes someone who holds a Colorado license and is working beyond its scope, such as an esthetician performing injections (Rule 1.17(F)(1)(b)).
It does not cover everyone in your building:
- Registered nurses are excluded. Their work, whether independent nursing or a delegated medical function, is governed by the Nurse Practice Act (Rule 1.17(F)(4)(c)).
- Licensed providers acting within their own scope are excluded (Rule 1.17(F)(4)(b)).
- Physician assistants and people regulated by the Board of Nursing are handled under other rules (Rule 1.17(B)).
So the first step is a staffing list: each person, the license held, and whether the service is inside its scope. Rule 1.17 governs every row where the answer is no. The rule defines medical-aesthetic services to include Class IIIb or higher lasers, radio-frequency and intense pulsed light that structurally alter tissue or remove hair, and “the performance of injection(s) of any substance into the human body” (Rule 1.17(D)(2)(a)).
The physician has to be eligible to delegate
Under Rule 1.17(E)(1)(b), a physician may delegate a service only if the physician is:
- Qualified by education, training and experience to perform it.
- Actively performing that service in their own practice, “and not exclusively by delegating the service to a delegatee.”
- Insured to perform it.
- Actively practicing and “available in the community,” which the rule defines as physically present in the State and able to promptly, personally consult or provide follow-up care.
Telehealth may be used for consultation and follow-up “where appropriate,” but the physician “should not rely exclusively” on it.
The supervision calendar
| Obligation | Timing | Rule 1.17 |
|---|---|---|
| Review the delegatee’s diplomas, certificates and credentials personally | Before delegating | (F)(1)(a)(2) |
| Over-the-shoulder observation of each delegated service | Before the delegatee performs it outside the physician’s physical presence | (F)(1)(a)(3) |
| Physician on the premises and readily available | Default for every delegated service | (H)(5) |
| Off-site supervision | Only with specific written procedure protocols and written emergency protocols; physician physically in Colorado, or a named in-state covering physician | (H)(6), (I)(1), (I)(2) |
| Quality monitoring at the site where services are performed | At least every two weeks | (H)(7) |
| Review every patient’s record, entry by entry, with initials and date | Within 14 days of the care | (I)(3)(b), (I)(3)(c) |
| Personal reassessment of the delegatee, including over-the-shoulder monitoring of each service | At least annually | (H)(8) |
| Document the initial assessment and each reassessment | Ongoing, produced to the Board on request | (H)(9) |
Three points to read closely.
The two-week monitoring is on site. Rule 1.17(H)(7) lists the methods: direct observation, review of care, outcomes, equipment, protocols and charts. Then it says the monitoring “must occur at the site where the delegated services are performed.” A remote chart audit does not satisfy that sentence.
Chart review is every patient. The physician “shall review the care provided to every patient who is treated by the delegatee” and initial and date the record. A percentage sample does not meet it. The exception is a same-day encounter in which the physician was personally involved. Then the physician’s own note is enough (Rule 1.17(I)(3)(d)).
Ongoing care needs the physician in it. Rule 1.17(H)(4) calls ongoing care of a patient without direct physician involvement “inappropriate.” The first factor it lists for an appropriate physician-patient relationship is the physician performing an initial consultation. That factor is the Colorado footing for a good faith exam before a delegated treatment.
The paperwork the Board can ask for
Rule 1.17(I) turns supervision into documents:
- Procedure protocols and emergency protocols, written by the physician. The rule says twice that the physician “may not rely upon a written protocol created by the delegatee.” The emergency protocol must require the delegatee to report every adverse event to the physician.
- The Appendix A written agreement between physician and delegatee, which “must be available to the public at the site.” If the physician is on site and personally directing at least 60% of the time, job descriptions and personnel records can stand in for it (Rule 1.17(I)(4)(c)).
- A list of every delegatee and the specific services each is authorized to perform.
- The medical director agreement itself. Rule 1.17(I)(5)(a)(2) names it as a document to be kept, and the physician “may not rely solely on a medical office or other entity” to produce records to the Board.
The rule also has its own patient notices: the delegating physician’s name and contact information posted in the reception area, and a written disclosure signed before each delegated medical-aesthetic service, with a copy to the patient and a copy in the chart (Rule 1.17(I)(6)(c), (d)). These sit beside the statutory sign, website and consent requirements in § 12-240-147, covered in Colorado’s HB25-1024 disclosure post. You need both sets.
What cannot be delegated at all
- Prescribing. The statute and Rule 1.17(D)(6)(a) exclude it. A refill at the same dose under a written physician protocol is the only carve-out.
- Anything requiring medical judgment. Delegated work should be “routine, technical services” (Rule 1.17(D)(5)).
- Off-label use, unless the physician has specifically authorized and delegated it and it is within accepted standards (Rule 1.17(D)(2)(c)).
- Titles that mislead. The rule’s own example is an aesthetician using “medical aesthetician” without a state credential to perform medical services (Rule 1.17(F)(2)(d)).
The consequence falls on two people
For the physician, any violation of the rule may be found to be unprofessional conduct under § 12-240-121, and substandard care by the delegatee is attributed to the physician (Rule 1.17(J)). For the delegatee, the licensure exemption exists only when the rule is followed. Rule 1.17(K)(1) says no person is exempt under § 12-240-107(3)(l) “unless such person is acting in conformance with these Rules.”
Where MDside differs
One offer you will see is a remote physician who signs a directorship agreement and reviews a sample of charts each month. For delegated services in Colorado, that arrangement fails the rule on its face: the physician must be in the state, on site every two weeks, and in every chart. MDside does not place a remote-only director over unlicensed delegatees in Colorado. Either the staffing changes, so that treatments are performed by licensed clinicians within scope, or the director is a Colorado physician who can meet the calendar. See medical director services in Colorado and our clinical standards.
What this means for you
Sort your staff into two columns: licensed and within scope, or delegated under Rule 1.17. For the second column, ask your director for the dates of the last on-site visit, the last over-the-shoulder assessment, and the protocols they wrote. If answers are missing, stop delegated injectable and laser services until they exist. Put the two-week visit and the 14-day chart review into the directorship agreement as duties, with a log. This post reflects the rule as published when checked on October 1, 2026.
Frequently asked questions
Does a medical director have to be on site at a Colorado med spa?
For services delegated to unlicensed staff, Rule 1.17(H)(5) requires the physician on the premises unless specific written procedure protocols and emergency protocols are in place. Even with protocols, the physician must monitor quality at the site at least every two weeks and be physically present in Colorado and available to attend to the patient.
How often must a Colorado medical director review charts?
Under Rule 1.17(I)(3), the delegating physician reviews the care of every patient treated by an unlicensed delegatee, initials and dates each record, and does so within 14 days of the care. A same-day encounter where the physician was personally involved is the exception, and the physician’s own note then satisfies the requirement.
Can an out-of-state physician be a medical director for a Colorado med spa?
Not for delegation to unlicensed staff under Rule 1.17. The delegating physician must be actively practicing and available in the community, defined as physically present in the State. When the physician is out of state, a named covering physician who is in Colorado must be available. Telehealth cannot be the exclusive means of follow-up.
Does Colorado Rule 1.17 apply to registered nurses?
No. Rule 1.17(F)(4)(c) states that the rule does not apply to a registered nurse, and that services provided by an RN, as independent nursing or as a delegated medical function, are governed by the Nurse Practice Act. The rule also does not apply to licensed providers acting within their own scope.
—
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.