C.R.S. § 5-19-206.7

(1) Subject to rules adopted by the administrator, nothing in this part 2 prohibits a registered provider from permitting its employees to work from a remote location so long as the registered provider: (a) Ensures that no in-person customer interactions are conducted at the remote location and does not designate the remote location to consumers as a business location; (b) Maintains appropriate safeguards for registered provider and consumer data, information, and records, including the use of secure virtual private networks, also known as “VPNs”, where appropriate; (c) Employs appropriate risk-based monitoring and oversight processes of work performed from a remote location and maintains records of the monitoring and oversight processes; (d) Ensures consumer information and records are not maintained at a remote location; (e) Ensures consumer and registered provider information and records remain accessible and available for regulatory oversight and examination; and (f) Provides appropriate employee training to ensure employees working from a remote location keep all conversations about and with consumers that are conducted from the remote location confidential, as if conducted from a commercial location, and to ensure that employees working at a remote location work in an environment that is conducive and appropriate to ensuring privacy and confidential conversations. (2) As used in this section, “remote location” means a private residence of an employee of a registered provider or another location selected by the employee and approved by the registered provider.