Colorado consolidated psychologists, licensed clinical/master social workers, licensed marriage and family therapists (LMFT), licensed professional counselors (LPC), addiction counselors, and unlicensed psychotherapists into one statute: the Mental Health Practice Act, Title 12, Article 245, C.R.S. (recodified from the former Article 43 in 2019). Each profession still has its own board (Board of Psychologist Examiners, State Board of Social Work Examiners, State Board of Marriage and Family Therapist Examiners, State Board of Licensed Professional Counselor Examiners) and its own practice-act part (Parts 3 through 8 of Article 245), but the general "unprofessional conduct" and disclosure rules that govern advertising apply identically to all of them through Part 2 (§§ 12-245-201 to 12-245-234).

That means, for advertising and marketing purposes, LPC, LCSW, LMFT, and psychologist rules are largely the same statute, not four different regimes. Where a national ethics code differs (ACA vs. NASW vs. AAMFT vs. APA), that's where actual differences in testimonial rules emerge, and Colorado boards import those differences by reference to "generally accepted standards of the professional discipline" (§ 12-245-224(1)(g)(I), quoted below).

The bottom line for all four license types

Do not solicit, request, or ask for testimonials or reviews from current clients, under any license type. All four governing ethics codes prohibit this, and Colorado's board discipline statute independently prohibits "misleading, deceptive, or false" advertising, which boards have applied to unsubstantiated testimonials in analogous health-board rules (see the physician-board rule below, cited as illustrative, not directly binding on mental health boards).

Former clients are a gray zone that varies by license type. ACA and NASW explicitly restrict soliciting former clients too; APA and (per secondary sources) AAMFT's current code are narrower and speak only to "current" clients, though ethicists and malpractice-insurance guidance (Person Centered Tech, CPH & Associates-adjacent sources) treat former clients as still risky because the power imbalance and confidentiality exposure don't fully end at termination.

The safest system-wide rule to give Annette's clients: never solicit a testimonial or review from anyone who is or has ever been a therapy client of that specific provider, for any license type, full stop. Google/Yelp/unsolicited reviews that arrive organically are a separate, murkier issue (see the Translation section below) because they raise HIPAA and confidentiality concerns regardless of solicitation.

Per license type, with exact citations

Licensed Professional Counselors (LPC), governed by ACA Code of Ethics 2014, Standard C.3.b

"Counselors who use testimonials do not solicit them from current clients, former clients, or any other persons who may be vulnerable to undue influence. Counselors discuss with clients the implications of and obtain permission for the use of any testimonial."

Source: 2014 ACA Code of Ethics, Section C.3.b, "Testimonials." This is the strictest of the four codes: it bars soliciting testimonials from BOTH current and former clients, and even when a testimonial is used (e.g., unsolicited), the counselor must discuss implications and get permission.

Licensed Clinical Social Workers (LCSW), governed by NASW Code of Ethics, Standard 4.07(b)

"Social workers should not engage in solicitation of testimonial endorsements (including solicitation of consent to use a client's prior statement as a testimonial endorsement) from current clients or other persons who, because of their particular circumstances, are vulnerable to undue influence, manipulation, or coercion."

Source: NASW Code of Ethics, Section 4.07, "Solicitations." NASW's language is unusual and important: it explicitly bars even asking a current client for permission to use something they already said as a testimonial ("solicitation of consent to use a client's prior statement"). The text names "current clients" specifically (not "former clients" in the same clause), but the broader 4.07(a) prohibition on uninvited solicitation of vulnerable persons provides additional coverage.

Licensed Marriage and Family Therapists (LMFT), governed by AAMFT Code of Ethics

This one needs a flag. The AAMFT Code of Ethics effective January 1, 2015 (fetched and read in full) contains Standard IX (Advertising), sections 9.1 to 9.8, covering truthful representation, accurate professional identification, and correction of misinformation, but no explicit numbered standard on testimonials. Multiple secondary sources (practice-management blogs, an ethics CE provider) state that AAMFT's current code (AAMFT adopted a Revised Code of Ethics effective January 1, 2026) now includes language that marriage and family therapists "do not solicit testimonials or endorsements from current clients or from other persons who are vulnerable to undue influence," consistent with the APA/ACA/NASW pattern. The exact section number could not be pulled cleanly from the primary-source PDF. UNVERIFIED: exact section number of the testimonial provision in the AAMFT Code of Ethics effective 1/1/2026. Treat LMFTs as bound by the same "no solicitation from current clients / vulnerable persons" rule as the others until this is confirmed with AAMFT directly or via the Colorado LMFT board.

Source (verified, 2015 code, full text obtained): AAMFT Code of Ethics, effective Jan. 1, 2015 (hosted by AR Dept. of Health). Source (current code landing page, unverified exact clause): AAMFT Code of Ethics.

Psychologists, governed by APA Ethical Principles of Psychologists and Code of Conduct, Standard 5.05

"Psychologists do not solicit testimonials from current therapy clients/patients or other persons who because of their particular circumstances are vulnerable to undue influence."

Source: APA Ethical Principles of Psychologists and Code of Conduct, Standard 5.05, "Testimonials" (in Section 5, Advertising and Other Public Statements). Notably, APA's rule (like AAMFT's apparent current rule) says "current" clients only. It does not explicitly extend to former clients the way ACA and, arguably, NASW do. That is a real, citable difference between psychologists and LPCs specifically.

Summary table

Colorado's Mental Health Practice Act, § 12-245-224(1), C.R.S., defines "unprofessional conduct" (grounds for board discipline) for every license type covered by Article 245. The advertising-relevant subsections, quoted exactly from the statute:

(1)(c) "Has used advertising that is misleading, deceptive, or false;"

(1)(j) "Has exercised undue influence on the client, including the promotion of the sale of services, goods, property, or drugs in such a manner as to exploit the client for the financial gain of the practitioner or a third party;"

(1)(g)(I) "Has acted or failed to act in a manner that does not meet the generally accepted standards of the professional discipline under which the person practices. Generally accepted standards may include, at the board's discretion, the standards of practice generally recognized by state and national associations of practitioners in the field of the person's professional discipline."

That last clause, (1)(g)(I), is the legal hook that lets a Colorado board treat a violation of the ACA/NASW/AAMFT/APA code (guarantees of outcomes, misrepresented credentials, exploitative solicitation, etc.) as Colorado "unprofessional conduct" even though the statute itself doesn't spell out every advertising rule. It is also worth noting (1)(q), which explicitly permits paying "an independent advertising or marketing agent compensation for advertising or marketing services rendered on the person's behalf by the agent, including compensation that is paid for the results of performance of the services on a per-patient basis." This is a green light for performance-based marketing fee structures (e.g., pay-per-lead SEO/ads retainers), as long as the compensation is for marketing services and not a disguised patient-referral kickback.

Source: C.R.S. § 12-245-224, Colorado Revised Statutes (2025), "Prohibited activities - related provisions - definition."

Important scoping note: there is a Colorado administrative rule, 3 CCR 713-1.24, "Misleading, Deceptive or False Advertising," that lists highly specific prohibited advertising practices (unsubstantiated testimonials, guarantees of a cure, intimidating advertising, misleading board-certification claims, etc.). This rule belongs to the Colorado Medical Board and applies to physicians, physician assistants, and anesthesiologist assistants under § 12-240-121(1)(z), C.R.S., the Medical Practice Act, NOT the Mental Health Practice Act. It is not directly binding on LPC/LCSW/LMFT/psychologists. Its exact text is included below because it's a strong illustration of how Colorado's DORA boards interpret "misleading, deceptive, or false" advertising in a health-care context, and mental health boards would very plausibly reason the same way under § 12-245-224(1)(c)/(g), but do not cite this specific rule number to a therapist as if it applies to them.

3 CCR 713-1.24(D): licensees "shall avoid the following types of advertising: 1. Claims that the services performed ... are professionally superior ... unless superiority ... can be substantiated; 2. The misleading use of a claim regarding board certification or of an unearned or non-health degree ...; 3. Advertising that has the effect of intimidating or exerting undue pressure; 4. Advertising that uses unsubstantiated testimonials; 5. Advertising that creates an unjustified expectation or guarantees satisfaction or a cure; 6. Advertising that offers gratuitous services or discounts, the purpose of which is to deceive the public; or, 7. Advertising that is otherwise misleading, deceptive or false."

Source: 3 CCR 713-1.24, Colorado Medical Board rule (Cornell LII). Applies to physicians, not mental health licensees, cited as persuasive analogy only.

Bottom line on guarantees: don't let a therapist's site or ad copy promise outcomes ("guaranteed to fix your anxiety," "cure your depression in 6 sessions"). This is squarely within "misleading, deceptive, or false" under § 12-245-224(1)(c), and every national ethics code these boards reference independently prohibits guaranteeing results.

Confidence: high on the statutory text (verified verbatim from the current Colorado Revised Statutes). Medium on how aggressively each board actually enforces this in practice, since no published board disciplinary decisions specifically about marketing/advertising violations for LPC/LCSW/LMFT/psychologist licensees in Colorado were found in this pass (that would require a case-law/board-order search beyond this brief's scope).

Colorado statute doesn't have a marketing-specific confidentiality clause; confidentiality flows from two places: (1) the general therapist-client confidentiality obligation described in the mandatory disclosure statute (§ 12-245-216(1)(d)(IV), "information provided by the client during therapy sessions is legally confidential"), and (2) HIPAA, which treats anything that could identify a client as Protected Health Information (PHI) once it's tied to their record.

Practical rules that follow from this, corroborated by ethics-code and compliance sources:

• Testimonials, case studies, "success stories," before/after descriptions, or photos that are traceable to an identifiable current or former client require a specific, signed HIPAA marketing authorization, not just a general intake consent form. A valid authorization must describe the PHI to be disclosed, the purpose, who will see it, an expiration date/event, and the client's right to revoke it at any time. Source: Compliancy Group, "HIPAA Law on Advertising - Patient Testimonials"; Person Centered Tech, "Testimonials & Reviews in Mental Health Practice".
• AAMFT's Standard 2.4 (confirmed verbatim from the 2015 code, still substantively in force): "Marriage and family therapists use client and/or clinical materials in teaching, writing, consulting, research, and public presentations only if a written waiver has been obtained in accordance with Standard 2.2, or when appropriate steps have been taken to protect client identity and confidentiality." This generalizes across all four professions as a "generally accepted standard": don't publish a case study or client story, even anonymized-sounding, without either a written waiver or genuine de-identification.
• Composite/fictionalized case studies ("a client I'll call Sarah...") are the standard safe workaround used across the mental health field, provided they're genuinely composite/fictionalized and not a thinly-disguised real client, and ideally labeled as illustrative.
• De-identification is harder than it looks in a small market like Boulder: a "40-year-old Boulder mom of two who does trail running and works in tech" combined with a specific outcome story can be re-identifiable even without a name or photo. Advise caution on hyper-specific composite stories in a small city.

Confidence: high on the HIPAA-authorization requirement (well-documented, consistent across compliance sources). Medium on the Colorado-specific statutory confidentiality hook, since § 12-245-220 (referenced in § 12-245-216 as the source of confidentiality exceptions) was not independently pulled and read in this pass. UNVERIFIED beyond the disclosure-statute cross-reference.

This is governed by the same § 12-245-224(1)(c) (misleading/deceptive/false advertising) and (1)(g) (generally accepted standards) framework, plus the mandatory disclosure statute's own credential-accuracy requirement. Key points:

• § 12-245-216(1)(b)(II) requires every licensee to give clients, in writing, "a listing of any degrees, credentials, certifications, registrations, and licenses held or completed ... including the education, experience, and training the licensee ... was required to satisfy in order to complete the degree, credential, certification, registration, or license." This is a disclosure-to-client requirement, not a website requirement per se, but it sets the factual baseline: whatever's on the website/marketing materials should match what's disclosed and true.
• AAMFT 9.1 and 9.5 (verified verbatim, 2015 code): "Marriage and family therapists accurately represent their competencies, education, training, and experience relevant to their practice ... in accordance with applicable law," and "claim degrees for their clinical services only if those degrees demonstrate training and education in marriage and family therapy or related fields."
• AAMFT 9.7 (verified verbatim): "Marriage and family therapists represent themselves as providing specialized services only after taking reasonable steps to ensure the competence of their work." This generalizes: a website claiming "specializing in EMDR" or "trauma specialist" should reflect real training, not just interest or a weekend workshop.
• "Board certified" / similar claims: the physician-board rule (3 CCR 713-1.24(D)(2), cited above as analogy only) explicitly flags "misleading use of a claim regarding board certification or of an unearned or non-health degree" as prohibited advertising. The same logic applies to any mental health licensee claiming a certification, specialty designation, or credential they don't actually hold or that isn't a recognized credentialing body.
• License-type accuracy matters especially in Colorado because the state has multiple tiers (licensed, registered, certified, and "Unlicensed Psychotherapist," formerly called "Registered Psychotherapist") with real differences in training requirements. A website must not imply a higher tier of regulation than the provider actually holds. Unlicensed Psychotherapists specifically must disclose that they are "not licensed by the state and not required to satisfy any standardized educational or testing requirements" (§ 12-245-216(1)(e)), a strong signal this category needs extra-careful, honest marketing language, not aggrandizing claims.

Confidence: high on all quoted statutory/AAMFT text; medium for generalizing AAMFT-specific standards to the other three professions (reasonable inference via the "generally accepted standards" doctrine, not independently verified against ACA/NASW/APA credential-specific clauses in this pass).

Statute: § 12-245-216, C.R.S., "Mandatory disclosure of information to clients." Applies to every licensee, registrant, or certificate holder under Article 245 (psychologists, LCSWs, LMFTs, LPCs, addiction counselors, unlicensed psychotherapists).

Required elements, quoted from the statute (as amended; note a 2024 amendment via SB 24-115 removed the requirement to explain the differing "levels of regulation," see note below):

• (1)(a) name, business address, business phone number;
• (1)(b)(II) listing of degrees, credentials, certifications, registrations, licenses, and the education/experience/training required for each;
• (1)(c) a statement that the practice is regulated by the division (DORA), with the applicable board's address/phone;
• (1)(d)(I-IV) statements that: the client is entitled to info about methods/techniques/duration/fees; the client may get a second opinion or terminate at any time; sexual intimacy is never appropriate in a professional relationship and should be reported; and session information is legally confidential (with exceptions);
• (1)(e) for Unlicensed Psychotherapists specifically: a statement that they are listed in the state database, authorized to practice, but not licensed and not required to meet standardized education/testing requirements;
• (1)(f) a statement about the 7-year record retention limit.

Timing: "Unless the client, parent, or guardian is unable to write, or refuses or objects, the client, parent, or guardian shall sign the disclosure form required by this section not later than the second visit with the psychotherapist" (§ 12-245-216(6)).

Note on the 2024 amendment: Senate Bill 24-115 (effective 8/7/2024) removed the prior requirement to explain "the differences between licensure, registration, and certification" in the disclosure. The core degree/credential/confidentiality/complaint-process disclosures remain. Source: National Law Review / JD Supra summary, "Updated Mandatory Disclosure Requirements for Colorado Mental Health Providers Go into Effect", JD Supra version.

Failure to comply is independently disciplinable: § 12-245-224(1)(p) makes "failed to comply with any of the requirements pertaining to mandatory disclosure of information to clients pursuant to section 12-245-216" its own ground for board discipline.

Does this affect the website/intake flow? The statute requires the disclosure to be given "in writing to each client during the initial client contact" and signed by the second visit; it does not literally require it to be on the public website. But in practice, most Colorado therapists post their disclosure statement as a downloadable PDF or embed it in an online intake/consent form (via SimplePractice, TherapyNotes, etc.) so it's delivered and signed before or at the first session. This is a service opportunity, not a compliance risk, as long as Verity Agentic doesn't draft the disclosure content itself (that's the therapist's/their attorney's job) and just builds the delivery mechanism (a page, a PDF embed, or a signature-capture flow feeding into their EHR/practice-management system).

A model disclosure statement template (unofficial, from a Colorado psychotherapist association, useful as a reference for what real ones look like) is here: Model Mandatory Disclosure Statement, Colorado Association of Psychotherapists.

Sources: C.R.S. § 12-245-216 (2023 version, full text verified); C.R.S. § 12-245-224(1)(p).

Confidence: high on the pre-2024 statutory language (verified verbatim). Medium-high on the exact post-SB24-115 wording, since the 2023 ("Effective Until 8/7/2024") version was read verbatim but only the amendment's summary came from secondary sources, not the full current statutory text word-for-word.

This is general HIPAA knowledge, not Colorado-specific, but it's the single biggest risk area for an automation-focused marketing consultant, so it deserves real weight.

• The core rule: if a vendor (Verity Agentic, or any tool Verity Agentic wires up: a chatbot, an email automation, a form processor, an AI drafting tool) "creates, receives, maintains, or transmits" Protected Health Information (PHI) on behalf of a covered entity (the therapist), that vendor is a HIPAA "business associate" and must have a signed Business Associate Agreement (BAA) with the therapist before touching that data.
• What counts as PHI in a marketing/automation context: client name plus any health/treatment detail combined; intake form answers describing symptoms or diagnoses; appointment/scheduling data tied to a named client; chat transcripts where a prospective or current client describes their mental health situation; testimonials/case studies before they're properly de-identified and authorized.
• Vanilla consumer AI tools are a real risk: generic/free/consumer ChatGPT (Free, Plus, Team tiers) does not sign a BAA and is not HIPAA-compliant for PHI. OpenAI does offer a BAA for API customers and ChatGPT Enterprise specifically, meaning a properly configured, contracted enterprise/API integration can be made compliant, but "I asked ChatGPT to draft this using real client details" is not compliant. Source: HIPAA Journal, "Is ChatGPT HIPAA Compliant? Updated for 2026"; OpenAI Help Center, "How can I get a BAA with OpenAI for API Services?".
• Zapier and similar no-code automation tools: general consumer/free Zapier plans are not configured for HIPAA and don't include a BAA by default; this needs vendor-by-vendor verification rather than a blanket assumption (UNVERIFIED: Zapier's current specific BAA/HIPAA-tier offering could not be confirmed in this pass, check Zapier's current HIPAA page directly before recommending it for any PHI-touching workflow).
• The safe architecture for a therapist's marketing/automation stack: keep PHI entirely out of the marketing layer. Intake forms, scheduling, and clinical notes belong in a HIPAA-compliant EHR/practice-management system (SimplePractice, TherapyNotes, TheraNest, etc., which do sign BAAs), not in a general marketing CRM, a Zapier flow, a Google Form, or a ChatGPT prompt. Marketing automation (email nurture sequences, SEO content, ad campaigns, review requests) should operate on non-PHI marketing contact data only (name + email a prospect voluntarily submitted to a general contact form, not clinical detail) and should never pull client-identifying clinical data through an unsecured pipe.
• Bottom line for Verity Agentic's own liability: as a vendor helping a therapist build marketing systems, staying entirely on the "marketing/business" side of the line (SEO content, ad copy, non-clinical automation, appointment-request forms that don't collect clinical detail) avoids ever becoming a HIPAA business associate. The moment a system starts touching clinical intake content, diagnoses, treatment notes, or anything a reasonable person would call "PHI," a BAA and HIPAA-compliant tooling become necessary.

Confidence: high on the general HIPAA/BAA framework and the ChatGPT-tier distinction (well-documented, consistent across sources). Low/UNVERIFIED on Zapier's specific current HIPAA offering, verify before recommending.

Confirmed: life/business/executive/personal coaches are explicitly exempted from Colorado's mental health licensing requirements and are not bound by these board rules, per the scope-of-article exemption in the Mental Health Practice Act (§ 12-245-217, "Scope of article - exemptions"). Per multiple corroborating secondary sources: "A professional coach, including a life coach, executive coach, personal coach, or business coach, who has had coach-specific training and who serves clients exclusively as a coach, is exempt from licensing requirements ... as long as the professional coach does not engage in the practice of psychology, social work, marriage and family therapy, licensed professional counseling, psychotherapy, or addiction counseling."

This exemption exists specifically because of a prior Colorado enforcement dispute against a coach that the coaching industry organized against and successfully got carved out via legislative amendment. Source (secondary, industry account): search results referencing the Colorado Coalition of Coaches' lobbying effort; the exact statutory citation (§ 12-245-217) should be independently pulled and read verbatim before quoting it to a client, the primary Justia text of this specific section could not be fetched in this research pass due to a fetch failure (UNVERIFIED: exact statutory text of § 12-245-217, though its existence and general substance is corroborated by multiple secondary sources plus the DORA "Unlicensed Psychotherapy" program page).

What this means for marketing purely-coaching businesses: pure coaches (no license, no clinical claims, no diagnosis/treatment language) can market far more aggressively, testimonials, outcome-oriented claims, before/after transformation stories, guarantees; none of the § 12-245-224 or ACA/NASW/AAMFT/APA restrictions apply to them, because they're not licensed under Article 245 at all.

The gray area (important and genuinely risky): a licensed therapist (LPC/LCSW/LMFT/psychologist) who also markets "coaching" services is not automatically exempt just by using the word "coach." If the coaching still constitutes "the practice of psychology, social work, marriage and family therapy, licensed professional counseling, psychotherapy, or addiction counseling" in substance (working with the same population, addressing mental health symptoms, using clinical techniques), Colorado's board can treat it as practice under the license, meaning all the licensed-professional advertising/testimonial/confidentiality restrictions still apply regardless of the "coach" label. A licensed therapist cannot use a "coaching" label to solicit testimonials from current clients or make outcome guarantees that would be prohibited if labeled "therapy." This is a well-known compliance trap across the industry (labeling clinical work as "coaching" to escape licensing-board rules), and Colorado boards, like most states, look at substance over label.

Practical marketing guidance to give Annette's clients on this point: if a therapist wants a "coaching" side offering to market more freely, the safest approach is to make it genuinely, substantively different: different clientele (not current/former therapy clients), non-clinical scope (goal-setting, accountability, skill-building rather than treating a diagnosed condition), separate branding/entity, and separate intake, not just a marketing relabel of the same therapy service.

Confidence: medium-high on the exemption's existence and general substance (strongly corroborated across independent secondary sources and matches DORA's public program structure). Low on the exact statutory text/subsections of § 12-245-217 (should be verified against primary source before being quoted verbatim to a client).