On May 6th, 2025, the Colorado House passed SB25-297—legislation that adds a major new layer to the state’s evolving natural medicine framework. This bill directs the Colorado Department of Public Health and Environment (CDPHE), in coordination with other state agencies, to collect data on the health effects and broader impacts of regulated natural medicine use across the state.
This marks a significant step toward building a more evidence-based, accountable, and responsive psychedelic care system in Colorado. But it also introduces complex questions about data privacy, trust, and the infrastructure required to responsibly gather sensitive participant information.
What the Bill Requires
SB25-297 (find the bill here) mandates CDPHE to collect and maintain de-identified data from healing centers and licensed facilitators starting in July 2026. This includes:
- Health outcomes from psychedelic sessions
- Demographic information
- Session details and service delivery
- Behavioral health impacts
- Law enforcement or hospital incidents involving natural medicine
The data must be stripped of all personal identifiers and stored in a secure, confidential database. It may only be released for regulatory purposes, public health research, or outcome reporting—and never for commercial use.
Why It Matters
As Colorado becomes the second state in the U.S. to roll out a licensed psychedelic therapy program, this bill represents an effort to learn from the inside out. At the heart of SB25-297 is a critical goal: to better understand the risks—and realities—of psychedelic use in real-world settings. While clinical trials have shown promising results, regulated natural medicine programs are unfolding in far more diverse, dynamic, and unpredictable environments. Without robust data, we risk operating on assumptions instead of facts.
By collecting de-identified, outcome-based information from healing centers and facilitators, we can:
-
Identify patterns in adverse events – Understand when and where complications are most likely to occur—whether medical, psychological, or social—and what contextual factors (dosage, setting, preparation, etc.) may contribute.
-
Refine safety protocols and training – Use evidence to inform facilitator certification standards, emergency response practices, and harm reduction techniques.
-
Protect vulnerable populations – Detect if certain demographic groups (e.g., age, race, or pre-existing conditions) are disproportionately affected by negative outcomes—or systematically excluded from healing opportunities.
-
Validate the effectiveness of integration and preparation – Correlate outcomes with levels of participant readiness, support, and follow-up care to highlight which practices contribute most to positive change.
-
Inform insurance, reimbursement, and clinical adoption – Clear, aggregated outcome data is essential to building a case for wider inclusion of psychedelic therapy in formal healthcare systems, including getting payers to the table to cover this expensive therapy for the populations who need it most.
-
Distinguish signal from noise in public discourse – In a landscape filled with hype and headlines, a centralized and responsibly managed dataset can help ground conversations in what’s actually happening—not just what’s hoped for or feared. This can inform policy decisions in future states or at the federal level.
This isn’t about surveillance. It’s about stewardship. By illuminating risk with clarity, compassion, and accountability, Colorado can pave the way for a more trusted, transparent psychedelic care system—one that evolves in response to what we actually see, not just what we expect.
Concerns We Must Address
However, collecting sensitive data from people engaging in deeply personal healing work comes with real concerns:
- Re-identification risk: Even “de-identified” datasets can be vulnerable, especially when combined with demographic or geographic information.
- Surveillance fears: Some participants may feel reluctant to engage if they worry about their experiences being monitored or misused.
- Data misuse: Without strict guardrails, there’s potential for data to be misinterpreted, commercialized, or politicized.
Safeguards to strengthen privacy protections
To address these concerns, several high-level mitigation strategies should be front and center during the rulemaking process. As these rules are being contemplated, we will urge CDPHE to employ modern data privacy risk mitigation techniques to ensure the benefits of this program can be realized, while keeping privacy and security front and center.
- Small Cell Suppression: Prohibit the reporting of any demographic subgroup or outcome category where fewer than a set number of participants (e.g., N < 10) are represented, to reduce the risk of singling out individuals.
- Data Aggregation and Generalization: Use age bands, date ranges (rather than specific session dates), and broader geographic categories to prevent indirect identification through unique combinations of data points.
- Limit Behavioral Detail Granularity: Where possible, aggregate behavioral health outcomes and avoid collecting overly specific free-text responses that may unintentionally reveal participant identity.
- Strict Access Controls and Use Restrictions: Ensure that only authorized personnel working under formal data use agreements have access to raw data, with regular audits and monitoring of data access and use.
- Application of Modern Privacy Standards: Use statistical disclosure limitation techniques, such as k-anonymity, l-diversity, or differential privacy, which are widely used in health data protection to further reduce re-identification risk.
- Transparency and Opt-out option with Participants: Clearly communicate to participants how their data will be used, how their privacy will be protected, and what risks exist despite de-identification efforts. Allow participants to opt-out of this program if it will prevent them from moving forward with care.
How Althea Is Already Doing This in Oregon
At Althea, we’ve already built secure infrastructure to support service centers and licensed facilitators in Oregon under SB 303—a similar bill requiring de-identified data for the state’s psilocybin program. Our tools make it easy for facilitators to collect participant input before and after sessions, while ensuring compliance with privacy. The system aggregates data for service center operators, enabling them to share summary-level data with the Oregon Health Authority on a quarterly basis.
We believe responsible data collection can coexist with psychedelic care, but only if it centers privacy, transparency, and security. As Colorado finalizes its own approach, we’re committed to supporting this next phase of regulated psychedelic care—grounded in integrity, driven by evidence, and always in service to healing.
See you at the rulemaking meetings. 🙂
