A handful of state legislatures have passed laws this year that limit how health insurers use artificial intelligence when making coverage or reimbursement decisions.
Seven state laws enacted this year:
- Alabama — SB 63 regulates how insurers use AI when making coverage authorization determinations. Coverage decisions can’t be solely made by AI, insurers must disclose when AI is used in the review process, and determinations are expected to reflect the patient’s own clinical circumstances rather than automated output alone. Effective Oct. 1
- Colorado — HB 1139 covers insurers, pharmacy benefit managers, private utilization review organizations, behavioral health ASOs and managed care entities. Any AI used for utilization review must base decisions on the patient’s individual clinical history rather than group data alone, must not be applied in a discriminatory way, and must be periodically audited for accuracy. A denial based on medical necessity cannot be issued on AI output alone without review by a qualified professional. The law also bars insurers from covering AI-delivered psychotherapy. Effective Jan. 1, 2027
- Georgia — SB 444 amends the state’s private review agent statute to provide that insurance coverage decisions for healthcare services cannot be based solely on AI systems or other software tools. Effective Jan. 1, 2027
- Illinois — SB 3114 creates the Transparency in Downcoding Act, which targets claim downcoding. It bans insurers from using any algorithm or automated process that bypasses the information a billing professional submitted in order to downcode a claim. Automated tools may flag claims for review, but a person must make or review every downcoding determination using current AMA CPT coding guidelines. The law also bars downcoding based solely on diagnosis codes and prohibits targeting clinicians who treat complex or chronic patients. Self-insured ERISA plans and workers’ compensation plans are excluded. Effective Jan. 1, 2028
- Iowa — HF 2635 allows insurers and utilization review organizations to use an AI-based algorithm for the initial review of a prior authorization request, but it prohibits using AI as the sole basis to deny, delay or downgrade a medical necessity request. The law also addresses claims audits and certificate of need processes. Effective July 1
- Utah — SB 319 requires insurers to post their prior authorization requirements and approval and denial statistics publicly, and to disclose to the state, providers and enrollees when AI is used in reviewing requests. Anyone reviewing an adverse determination must use independent medical judgment rather than relying solely on any other source. The law also sets maximum decision timeframes and minimum validity periods for chronic or long-term care requests. Effective Jan. 1, 2027
- Washington — SB 5395 builds on existing prior authorization law to add AI transparency and accountability requirements. Only a licensed physician or health professional may deny a request on medical necessity grounds, and AI cannot be the sole means used to deny, delay or modify care. Effective June 11, 2026
At the Becker's 5th Annual Fall Payer Issues Roundtable, taking place November 2–3 in Chicago, payer executives and healthcare leaders will come together to discuss value-based care, regulatory changes, cost management strategies and innovations shaping the future of payer-provider collaboration. Apply for complimentary registration now.