Sen. Janice Marchman

The act implements the recommendation of the Colorado office of policy, research, and regulatory reform in the department of regulatory agencies in its sunset review and report by continuing the regulation of hemodialysis clinics and technicians for 11 years, until September 1, 2037.(Note: This summary applies to this bill as enacted.)

The act implements the recommendations of the department of regulatory agencies in its 2025 sunset review and report by:Continuing the fire suppression programs of the division of fire prevention and control (division) for 11 years until September 1, 2037, pursuant to the provisions of the sunset law; andModifying certain provisions of the fire suppression programs of the division to replace gender-specific terminology with gender-neutral terminology.(Note: This summary applies to this bill as enacted.)

Current law imposes a tax on the first sale or transfer of unprocessed retail marijuana at a rate of 15% of the average market rate of the unprocessed retail marijuana. The 'average market rate' is currently defined as the average price, as determined by the department of revenue (department), of all unprocessed retail marijuana that is sold or transferred from retail marijuana cultivation facilities in the state to retail marijuana product manufacturing facilities or retail marijuana stores.     The act specifies that 'outdoor unprocessed retail marijuana' is cultivated under natural sunlight and weather conditions without artificial light or structures, except under limited specified circumstances, and 'indoor unprocessed retail marijuana' is cultivated in any manner other than 'outdoor unprocessed retail marijuana.'     The act also amends the existing definition of 'average market rate' to require separate rates for fresh frozen indoor unprocessed retail marijuana and fresh frozen outdoor unprocessed retail marijuana. The act requires the department to adopt rules to establish the rates for fresh frozen indoor unprocessed retail marijuana and fresh frozen outdoor unprocessed retail marijuana on or before July 1, 2027. In addition, the existing definition of 'average market rate' requires that unprocessed retail marijuana for extractions have a separate average market rate that is lower than the rate for unprocessed retail marijuana for direct sale to consumers. The act maintains this requirement.     The act also requires the department to publish a general description of the methodology and data sources used to establish the rate for each average market rate category of unprocessed retail marijuana.(Note: This summary applies to this bill as enacted.)

The act requires an entity that requires an individual to provide a social security number for a background check for a non-employment-based educational opportunity to accept an individual's taxpayer identification number in lieu of a social security number, including in clinical educational experiences for health-related academic programs, subject to certain exceptions.     A licensed or certified hospital or covered school, or a state institution of higher education or local district college that offers a non-employment-based educational opportunity that involves work with a vulnerable population, shall accept either an applicant's taxpayer identification number or a fingerprint-based background check in lieu of a social security number.     An applicant for a non-employment-based educational opportunity that involves work with a vulnerable population at a licensed or certified hospital or covered school, or a state institution of higher education or local district college, is permitted to have their fingerprints taken by a local law enforcement agency or an entity approved by the Colorado bureau of investigation for taking fingerprints for the purpose of a background check. A licensed or certified hospital or covered school, or state institution of higher education or local district college, must determine who pays the fee for the fingerprint-based background check.     The attorney general is authorized to bring a civil action to enforce the provisions of the act. An entity that violates this act is subject to a civil penalty of $2,000 for the first violation and $5,000 for each subsequent violation.(Note: This summary applies to this bill as enacted.)

Effective January 1, 2028, the act repeals a requirement that requires motor-vehicle license plates to be retired and reissued in certain circumstances and authorizes the owner to transfer the plates to a new motor vehicle.     The act requires the department of revenue (department) to develop, implement, and maintain a comprehensive contingency plan to ensure continuity of operations and the protection of critical services in the event of a disruption in vehicle licensing operations. Standards are set for the contingency plan. The governor's office of information technology must provide the appropriate network and equipment support to the department.     To implement this act, $18,170 is appropriated to the department from the Colorado DRIVES vehicle services account in the highway users tax fund.(Note: This summary applies to this bill as enacted.)

The act changes terminology related to child prostitution to commercial sexual activity with a child in the crimes of soliciting for child prostitution, pandering of a child, keeping a place of child prostitution, pimping a child, inducement of child prostitution, and patronizing a prostituted child, including changing the name of the offenses for soliciting for child prostitution, keeping a place of child prostitution, inducement of child prostitution, and patronizing a prostituted child.     A court is required to sentence an offender convicted of one of the listed offenses, other than soliciting for commercial sexual activity with a child, to at least the minimum of the presumptive range for the level of offense associated with the crime. For an offense of soliciting for commercial sexual activity with a child, if the court sentences the person to probation, the court shall order as a condition of probation that the person serve 364 days in the county jail.     In the crime of soliciting for commercial sexual activity with a child, the act adds knowingly soliciting a child for commercial sexual activity as a means of committing the offense and requires that when arranging or offering to arrange a meeting, the offender must know that meeting will facilitate commercial sexual activity with a child. The act removes the spousal exception from the crime of engaging in commercial sexual activity with a child.     The act makes the penalty for internet luring of a child a class 3 felony when the offense is committed with the intent to meet for the purpose of engaging in commercial sexual activity. In this circumstance, a court is required to sentence the offender to at least the minimum of the presumptive range for the class 3 felony.(Note: This summary applies to this bill as enacted.)

The act creates a statutory cause of action for a person who has their federal constitutional rights violated by another person who, acting under color of law, is participating in civil immigration enforcement. A person who violates the United States constitution while participating in civil immigration enforcement and whose conduct was the proximate cause of violating another person's constitutional rights is liable to the person whose rights are violated for legal or equitable relief or any other appropriate relief. The action must be commenced within 2 years after the cause of action accrues.     The act appropriates $125,604 to the department of law from the legal services cash fund to provide legal services for the department of personnel.(Note: This summary applies to this bill as enacted.)

The act creates the 'Colorado Mandatory Lethality Assessment Act', which requires peace officers to conduct a lethality assessment when responding to a domestic violence incident and include the completed lethality assessment in the incident report. A peace officer is not required to administer a lethality assessment if a victim is unavailable, not at the scene, incapacitated, or if circumstances otherwise make the administration of the lethality assessment impossible or impracticable. If the lethality assessment indicates that an individual is a high-risk victim, or if the lethality assessment does not indicate a victim is high-risk but a peace officer determines an individual is a high-risk victim based on the totality of the circumstances, the peace officer is required to immediately contact a community-based victim's advocate either by phone or in person and provide the high-risk victim the opportunity to speak with the advocate.     The act requires the attorney general's office, in consultation with a Colorado-based coalition that advocates for survivors of domestic violence, to develop a mandatory training for peace officers to learn how to administer the lethality assessment and provide victim referrals. No later than June 1, 2027, the attorney general is required to make the training available and offer assistance to law enforcement agencies in providing the training. Beginning July 1, 2027, the act requires each law enforcement agency to ensure that each peace officer employed by the agency has completed the mandatory training; except that a law enforcement agency that has provided training on the administration of lethality assessments prior to July 1, 2027, is not required to provide additional training.     Beginning January 2028, and each January thereafter, the act requires the attorney general's office to report to the general assembly certain information related to lethality assessments conducted in the previous calendar year. No later than January 31, 2030, the domestic violence fatality review board shall evaluate the effectiveness of mandatory lethality assessments and referrals to resources and submit the evaluation to the general assembly.     The act does not impose criminal, administrative, or civil liability on any person for an act or omission made in good faith related to administering a lethality assessment.(Note: This summary applies to this bill as enacted.)

For purposes of the 'Victim Rights Act', the act prohibits a defendant or alleged offender in the underlying case from being the 'lawful representative' of a victim or the victim's designee if the victim is a child or an at-risk adult.     The act creates new rights for a victim under the 'Victim Rights Act', including the right to:Be notified by the district attorney if the district attorney receives a notice that a crime laboratory employee engaged in a wrongful action that includes a crime against the victim and a notice that an evidentiary hearing on post-conviction petition for relief is held;Request to be referred to by an abbreviation, pseudonym, initials, or another preferred name during hearings; andBe heard at a restitution assessment hearing.(Note: This summary applies to this bill as enacted.)

The act allows the joint technology committee (JTC), within 90 days after the day that the chief information security officer of the office of information technology (security officer) files a written information technology security compliance report (compliance report) with the JTC as required by the act, to vote to request that the legislative audit committee direct the state auditor to conduct a special information technology security audit (IT security audit) of the office of information technology (OIT) if the compliance report indicates that one or more audit recommendations made by the state auditor is unresolved 2 or more years past the implementation date for the audit recommendation or if a material discrepancy exists between a representation in the compliance report and a previous audit finding.     If the JTC votes to request an IT security audit and if the legislative audit committee votes to direct the audit, the act requires:The state auditor to conduct the IT security audit;The state auditor to obtain input from OIT when the state auditor determines the scope and boundaries of the audit;The state auditor to submit the IT security audit report to the legislative audit committee, the JTC, the joint budget committee, and the governor; andOIT to reimburse the state auditor for the auditor's costs incurred in completing the IT security audit.     The act requires OIT to establish, maintain, keep, update, and make available to state agency information technology leadership and the members of the JTC a list of all active information technology vendor contracts for state agencies.     The act specifies that, except in the case of an information technology security emergency, OIT shall not publish or implement a technical information technology standard, and that the standard is void, unless the standard:Was publicly posted; andReceived approval from the security officer if the standard relates to security, access controls, or the handling of data.     The act requires OIT to ensure that, if an information technology contract provides ongoing service and delivery to Coloradans, the contract maintains current architecture diagrams that are updated at least annually.     The act prohibits the chief information officer from delegating a duty, responsibility, or power of the security officer.     The act requires the security officer to submit 2 annual reports to the JTC. The first report is a written compliance report that includes OIT's current compliance status with applicable security standards; all open audit recommendations regarding OIT made by the state auditor and the date on which each recommendation was made; and a timeline for remediation and a mitigation plan or compensation controls for each open audit recommendation made by the state auditor.     The second report is a written statewide information technology security risk report (security risk report) that assesses the overall security risk posture of state agency information technology systems. To support the preparation of the security risk report, the security officer may conduct evaluations of state agency information technology systems, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews. Each state agency shall provide to the security officer, upon request, the access and information necessary to conduct evaluations of state agency technology systems, including system access, product information, and architecture information.     The act requires the security officer, or the chief information officer if the security officer is unavailable, to perform the duties and uphold the responsibilities assigned to the security officer pursuant to law.(Note: This summary applies to this bill as enacted.)