Colorado consolidated psychologists, licensed clinical/master social workers, LMFTs, LPCs, addiction counselors, and unlicensed psychotherapists into one statute: the Mental Health Practice Act, Title 12, Article 245, C.R.S. Your board (the State Board of Licensed Professional Counselor Examiners) enforces its own practice-act part, but the general "unprofessional conduct" and disclosure rules that govern advertising apply the same way across all four professions through Part 2 (§§ 12-245-201 to 12-245-234).

The statute itself doesn't spell out every advertising rule. Instead it references "generally accepted standards of the professional discipline" (§ 12-245-224(1)(g)(I), quoted below), and for you that discipline-specific standard is the ACA Code of Ethics. Practically: the Colorado statutory layer is the same for everyone, but the ACA testimonial rule is the strictest of the four national codes, so treating ACA as your baseline keeps you safely compliant.

Colorado's Mental Health Practice Act, § 12-245-224(1), C.R.S., defines "unprofessional conduct" (grounds for board discipline) for every license type under Article 245, including LPCs. The advertising-relevant subsections, quoted exactly from the statute:

(1)(c) "Has used advertising that is misleading, deceptive, or false;"

(1)(j) "Has exercised undue influence on the client, including the promotion of the sale of services, goods, property, or drugs in such a manner as to exploit the client for the financial gain of the practitioner or a third party;"

(1)(g)(I) "Has acted or failed to act in a manner that does not meet the generally accepted standards of the professional discipline under which the person practices. Generally accepted standards may include, at the board's discretion, the standards of practice generally recognized by state and national associations of practitioners in the field of the person's professional discipline."

That last clause, (1)(g)(I), is the legal hook that lets the board treat a violation of the ACA code (guarantees of outcomes, misrepresented credentials, exploitative solicitation) as Colorado "unprofessional conduct." Also worth noting: (1)(q) explicitly permits paying "an independent advertising or marketing agent compensation for advertising or marketing services rendered on the person's behalf by the agent, including compensation that is paid for the results of performance of the services on a per-patient basis." That's a green light for performance-based marketing arrangements, as long as the compensation is genuinely for marketing work and not a disguised referral kickback.

Source: C.R.S. § 12-245-224, Colorado Revised Statutes (2025).

Bottom line on guarantees: don't let Rebuilding or Bob Exec Coaching marketing promise outcomes ("guaranteed to heal your divorce grief," "guaranteed promotion within a year"). That's squarely "misleading, deceptive, or false" under § 12-245-224(1)(c), and the ACA code independently prohibits guaranteeing results.

Confidence: high on the statutory text (verified verbatim). Medium on real-world enforcement aggressiveness; no published board disciplinary decisions specifically about LPC marketing/advertising violations in Colorado were found in this research pass.

Colorado statute doesn't have a marketing-specific confidentiality clause; confidentiality flows from two places: (1) the general confidentiality obligation in the mandatory disclosure statute (§ 12-245-216(1)(d)(IV): "information provided by the client during therapy sessions is legally confidential"), and (2) HIPAA, which treats anything identifying a client as Protected Health Information (PHI) once tied to their record.

Practical rules that follow, and that apply directly to both Rebuilding and Bob Exec Coaching materials:

• Testimonials, case studies, "success stories," before/after descriptions, or photos traceable to an identifiable current or former client or participant require a specific, signed HIPAA marketing authorization, not just a general intake consent form. A valid authorization must describe the PHI to be disclosed, the purpose, who will see it, an expiration date/event, and the right to revoke it at any time.
• Composite or fictionalized stories ("a participant I'll call Sarah...") are the standard safe workaround across the field, provided they're genuinely composite and clearly labeled as illustrative rather than a real person's account.
• De-identification is harder than it looks in a market like Boulder. A hyper-specific composite ("a 52-year-old Boulder engineer going through a divorce after 20 years") combined with a detailed outcome story can be re-identifiable even with no name or photo. Be cautious with hyper-specific detail in Rebuilding article case studies.
• This applies just as much to Bob Exec Coaching materials as to Rebuilding, if a coaching story is traceable to a real executive client, it needs the same signed authorization or genuine fictionalization.

Confidence: high on the HIPAA-authorization requirement. Medium on the Colorado-specific statutory confidentiality cross-reference (§ 12-245-220), not independently verified in this pass.

Governed by the same § 12-245-224(1)(c)/(g) framework, plus the mandatory disclosure statute's own credential-accuracy requirement.

• § 12-245-216(1)(b)(II) requires you to give clients, in writing, "a listing of any degrees, credentials, certifications, registrations, and licenses held or completed ... including the education, experience, and training ... required to satisfy in order to complete" each. Whatever's on bobmanthy.com or the Rebuilding site should match what's disclosed and true.
• "Board certified" / specialist claims: any certification, specialty designation, or credential you advertise needs to be real, current, and from a recognized credentialing body. This applies to any "specializes in divorce recovery" or "trauma-informed" language on either brand's site.
• License-type accuracy matters especially in Colorado because the state has multiple tiers (licensed, registered, certified, unlicensed). Marketing should never imply a higher tier of regulation than you actually hold; as an LPC, this is straightforward for you, just keep "LPC" accurate and visible wherever credentials are cited.

Confidence: high on the Colorado statute text; medium on generalizing AAMFT-specific credential language (used as an illustrative "generally accepted standards" example in the underlying research) to LPC practice specifically.

Statute: § 12-245-216, C.R.S., "Mandatory disclosure of information to clients." Applies to every LPC.

Required elements, quoted from the statute (as amended; a 2024 amendment via SB 24-115 removed the requirement to explain differing "levels of regulation"):

• (1)(a) name, business address, business phone number;
• (1)(b)(II) listing of degrees, credentials, certifications, registrations, licenses, and the education/experience/training required for each;
• (1)(c) a statement that the practice is regulated by the division (DORA), with the applicable board's address/phone;
• (1)(d)(I-IV) statements that: the client is entitled to info about methods/techniques/duration/fees; the client may get a second opinion or terminate at any time; sexual intimacy is never appropriate in a professional relationship and should be reported; and session information is legally confidential (with exceptions);
• (1)(f) a statement about the 7-year record retention limit.

Timing: the client must sign the disclosure form "not later than the second visit" (§ 12-245-216(6)). Failure to comply is independently disciplinable under § 12-245-224(1)(p).

Does this affect the website? Not directly, the statute requires delivery in writing at initial contact and signature by the second visit, not publication on a public site. In practice most Colorado therapists post the disclosure as a downloadable PDF or embed it in intake/e-signature flow. Worth confirming your own disclosure statement is current post-SB24-115 and delivered consistently for both individual clients and, if applicable, Rebuilding intake.

A model template (unofficial): Colorado Association of Psychotherapists, Model Mandatory Disclosure Statement.

Confidence: high on pre-8/7/2024 statutory text (verified verbatim). Medium-high on exact current post-amendment wording (confirmed via secondary summary, not full primary text).

This is general HIPAA knowledge, not Colorado-specific, but it's the biggest risk area for anything automated (email sequences, chatbots, AI-drafted content referencing real people) touching Rebuilding or coaching marketing.

• The core rule: any tool that "creates, receives, maintains, or transmits" Protected Health Information (PHI) on your behalf is a HIPAA "business associate" and needs a signed Business Associate Agreement (BAA) before touching that data.
• What counts as PHI here: a client or Rebuilding participant's name plus any health/emotional detail combined; intake answers describing symptoms or circumstances; chat transcripts where someone describes their situation; testimonials/case studies before they're de-identified and authorized.
• Vanilla consumer AI tools are a real risk: free/consumer ChatGPT (Free, Plus, Team) does not sign a BAA. OpenAI offers a BAA for API customers and ChatGPT Enterprise specifically. "I asked ChatGPT to draft this using a real participant's story" is not compliant unless it's a properly contracted enterprise/API integration.
• The safe architecture: keep PHI out of the marketing layer entirely. Intake, scheduling, and clinical notes belong in a HIPAA-compliant EHR/practice-management system. Email nurture sequences, SEO content, and general automation should run on non-PHI marketing contact data only (name and email someone voluntarily submitted, no clinical or personal-circumstance detail).

Confidence: high on the general HIPAA/BAA framework and ChatGPT-tier distinction. Zapier's current specific HIPAA/BAA offering is UNVERIFIED, check directly before routing any PHI-adjacent data through it.