AI in Health Care Laws by State: Insurers, Therapy (2027)

As of November 4, 2026, AI in health care is regulated mainly by state law: by our count of enacted laws, and subject to the search limits shown on our AI laws tracker, at least 22 states have enacted a law that names AI or automated processing in health care, and we found no federal statute that sets rules for AI in health care in the public laws of the 119th Congress.

Status as of November 4, 2026: Nineteen of those 22 states have a law in force today. Georgia's SB 444 and Minnesota's 62M.09 subd. 3(f) are scheduled for January 1, 2027. Colorado's first law, HB 26-1195, is in force only if no referendum petition was filed, which we have not confirmed. More California, Colorado, Utah and Washington provisions also start January 1, 2027, Colorado's unless a referendum petition was filed, and a federal ONC rule removing AI "model card" requirements is scheduled for December 28, 2026.

"Health AI law" is not one thing. This page sorts these laws by what they do: limits on insurers, notices to patients, limits on AI therapy, and rules for clinicians and licensing boards. It is general legal information, not legal or medical advice, and it reflects what we read through November 4, 2026, plus the Nevada bill record and statutes we read on November 5, 2026.

AI in Health Care Laws by State

The table lists each state in our count. It shows the laws we found, not every rule that could apply to AI in medicine. Each state's page has more detail.

A dash means this table lists nothing in that column. It is not a finding that the state has no such law. Our AI laws tracker shows how far the search went in each state.

How to read this count. It comes from our state-by-state search and is a floor. Our tracker marks the health care category as not verified for the District of Columbia, New Jersey, North Carolina and Ohio. We do not count companion chatbot laws, even where one touches mental health care, as Connecticut's PA 26-15 does. Vermont is counted on Act 156, not on Act 101 (H.814), a rights and study law: its AI part directs an AI Advisory Council report, and it contains no insurer restrictions.

Minnesota and the count. Twenty-one of the 22 states have a law that uses words like "artificial intelligence." Minnesota's text says "automated processing" and does not use those words, so a strict count of laws naming AI is 21.

New Mexico and the count. HB 178 is mostly a nursing scope and licensing bill. It is counted because NMSA 61-3-10(Y) says the board "shall promulgate rules establishing standards for the use of artificial intelligence in nursing."

AI in Prior Authorization and Utilization Review: 12 States

These laws govern what a health insurer, or the company reviewing claims for it, may do with AI when deciding whether care is covered. They differ on who is covered, what AI may do, and whether a person must make the decision. Minnesota is in this count, but its text says "automated processing", not AI.

Some of these states add duties beyond the denial itself. Alabama requires an annual certification to the Department of Insurance and a written disclosure in the plan's policies and procedures, and the act lets its requirements be satisfied by an attestation based on reasonable reliance on internal policies and vendors. Colorado, once HB 26-1139 takes effect, requires records, audit logs and written disclosures to regulators. Indiana requires insurers to disclose when AI is used in an adverse prior authorization determination or a downcoded claim.

Nebraska requires disclosure to the department, network providers, enrollees and the public website if such algorithms are used. Washington requires carriers that wrote at least one percent of the state's accident and health premiums to report, by October 1, 2026 and annually after that, "the percentage of total denials that were aided by artificial intelligence."

Colorado also limits coverage. Once in effect, HB 26-1139 bars coverage or payment for psychotherapy services "provided directly to an individual" and "conducted by an artificial intelligence system." For carriers, that applies to plans issued or renewed on or after its effective date.

Enforcement varies. Alabama's Department of Insurance may impose a corrective plan and, for violations at a frequency indicating a general business pattern or practice, a fine of not more than $5,000 or license action. Iowa's remedies come from chapters 505 and 507B, and the commissioner may suspend authority on a finding of a pattern or practice. Georgia's act sets no penalty of its own. Texas, Nebraska, Maryland and Washington open AI use to audit or inspection by the insurance regulator.

Laws Often Mislabeled as AI Laws

• Arizona HB 2175. In force since July 1, 2026. It requires a medical director to "individually review" certain medical-necessity denials and "may not rely solely on recommendations from any other source." Its text never mentions AI. It would reach AI in practice, but it is a human-review rule.
• North Dakota SB 2280 (NDCC ch. 26.1-36.12). It requires a licensed physician or licensed pharmacist to make adverse prior authorization determinations. It does not mention AI.
• Minnesota HF 2500. Not enacted, whatever a tracker may say: its record shows an introduction, a referral and author changes. The enacted Minnesota text is 62M.09 subd. 3(f), added by 2026 ch. 124, art. 3, sec. 6.

Insurance Bulletins on AI: Guidance, Not Statutes

The National Association of Insurance Commissioners adopted its model bulletin on insurers' use of AI on December 4, 2023. A bulletin is a regulator's statement of expectations under existing law, not a new law. The state bulletins described on our state pages go to insurers generally, not only health plans, and several say decisions made or supported by AI systems "must comply with all applicable insurance laws and regulations."

The NAIC's status list, dated November 3, 2026, shows 27 states, the District of Columbia and Puerto Rico as adopting it. It lists California, Colorado, New York and Texas separately, under insurance-specific regulation or guidance. The NAIC says the map is not a determination that a state's action contains every element of the model.

A state missing from that list may still have addressed AI in another document, and the list may lag. We do not count bulletins as enacted laws.

AI Therapy Laws: Illinois, Maine, Colorado, Nevada, Rhode Island and Vermont

Six states limit AI delivering therapy or mental health services, Colorado's only if no referendum petition was filed. Illinois, Maine and Rhode Island use similar words, but the laws are not identical, and each has its own exceptions.

Colorado's law works differently from the first four: it regulates providers and advertising claims, rather than barring unlicensed therapy offers in the same words. HB 26-1195 names August 12, 2026 as its effective date if the session adjourned May 13, 2026, and no referendum petition was filed. We have not confirmed the petition status.

Nevada's law has its own structure too: NRS 433.567 reaches AI providers' claims and systems, and NRS 629.610 reaches how covered providers use AI. We read those sections and the AB 406 bill record on November 5, 2026. The bill is Chapter 283, approved June 5, 2025, and the record lists July 1, 2025 for Sections 1 to 9 for all purposes other than preparatory work. The NRS source notes give 2025 Statutes page numbers, not a bill number. We tie these sections to AB 406 by its title, which is our inference, and we did not read the enrolled bill.

Utah and Tennessee: Different Rules

Utah. HB 452 does not ban AI therapy chatbots. A mental health chatbot must clearly and conspicuously disclose that it is AI and not a human, before access, after seven days without use, and when asked. A supplier may not sell or share a Utah user's identifiable health information or input, with listed exceptions, and advertising in a conversation must be identified. The Division of Consumer Protection enforces it, with fines up to $2,500 per violation.

Tennessee. T.C.A. 33-1-205 says a person who develops or deploys AI "shall not advertise or represent to the public that such system is or is able to act as a qualified mental health professional." That limits how a system is advertised or represented. It does not prohibit the tool itself. A violation is a Tennessee Consumer Protection Act violation with a $5,000 civil penalty for each one.

Chatbot-specific laws in other states may separately bar a companion from claiming to offer mental health care. Our AI laws tracker links those state pages.

Patient Disclosure Laws: When a Provider Must Tell You About AI

These laws are triggered by different uses of AI, so a patient in a covered state may still not get a notice for every AI tool in the building.

• California AB 3030 (H&S 1339.75). A health facility, clinic, physician's office or group practice office that uses generative AI for patient communications about clinical information must include a disclaimer and clear instructions for reaching a human. It does not apply to a communication "read and reviewed by a human licensed or certified health care provider," and administrative matters such as scheduling and billing are outside it. The chaptered text states no dollar penalty figure.
• Texas SB 1188 (H&S Code 183.005). A practitioner who uses AI for diagnostic purposes "must disclose the practitioner's use of that technology to the practitioner's patients." The statute sets no time for the disclosure and does not say whether it must be verbal or written.
• Texas HB 149 sec. 552.051(f). If an AI system "is used in relation to health care service or treatment," the provider gives the disclosure "not later than the date the service or treatment is first provided," or as soon as reasonably possible in an emergency.
• Louisiana Act 649 (R.S. 37:22.1). A licensed healthcare professional "shall verbally disclose the use of any recording device, software, or service to a patient before recording any part of an appointment or treatment to be transcribed by artificial intelligence." It is a disclosure rule, not a limit on AI in diagnosis or treatment.
• Rhode Island ch. 372 (ch. 23-108). Providers and facilities "that employ artificial intelligence ('AI') to document in-person or telehealth visits shall notify patients of the use of AI for that sole purpose and review the AI-generated documentation for accuracy after the visit." The enrolled text has no penalty or enforcement section.

Several therapy laws add consent rules when AI records or transcribes a session. Illinois and Maine tie written notice and consent to supplementary use in a recorded or transcribed session, Rhode Island has a narrower written-consent rule, and Colorado's act, if in force, requires advance written notice and written consent to record or transcribe with AI.

Utah's SB 226 also applies here: individuals in regulated occupations must prominently disclose generative AI in high-risk interactions, which can include medical or mental health advice.

Clinician, Title and Licensing-Board Rules

Delaware HB 191. A "nonhuman entity, including an agent powered by artificial intelligence," may not be certified to practice medicine, licensed in nursing or licensed as a physician associate, or use listed titles such as Doctor, Nurse or RN. The act speaks to licenses and titles. It does not address how clinicians or hospitals may use AI tools.

Oregon HB 2748. A nonhuman entity, including an agent powered by AI, "may not use" eight nursing titles and their abbreviations. It does not say whether AI may be used in care, and it has no penalty section of its own.

California AB 489. An AI system's advertising or functionality may not use a term implying that care or advice comes from a licensed natural person. Licensing boards enforce it, and each use is a separate violation.

California AB 1979 (from January 1, 2027). A business offering a "health care chatbot" to consumers for managing information, or for diagnosis or treatment, is deemed a provider of health care under the Confidentiality of Medical Information Act. Facilities, clinics and physician offices may not use AI "to independently perform any clinical function that is required by law to be performed by a person with a professional license."

California SB 503 (from January 1, 2027). Developers and deployers of clinical decision support systems must make reasonable efforts to identify systems with known or reasonably foreseeable risk of biased impacts, and to address that risk. We found no enforcement section in the chaptered text.

New Mexico HB 178. The Board of Nursing "shall promulgate rules establishing standards for the use of artificial intelligence in nursing." The statute states no deadline, and as of November 4, 2026, we found no such rule in published 16.12 NMAC. The state Medical Board has an AI policy, revised August 21, 2025, which is a board policy, not a statute.

Texas SB 1188. A practitioner may use AI for diagnostic purposes if acting within the scope of their license, the use is not otherwise restricted by law, and the practitioner reviews all AI-created records consistently with Texas Medical Board standards.

Pennsylvania used older law. In May 2026 the State Board of Medicine sued Character Technologies under the Medical Practice Act. The petition states allegations; our Pennsylvania page found no reported ruling and did not review the court docket.

Federal Rules: CMS and ONC

In the public laws of the 119th Congress, we found no federal statute that sets rules for AI in health care. We ran AI terms through the full text of all 136 public laws Congress.gov listed on November 4, 2026, and read the hits near health care terms.

Two laws mention AI in health care without setting rules for it. Public Law 119-21, sec. 71401, lists AI among the technologies in one use of Rural Health Transformation Program funds. Public Law 119-75, sec. 6216, orders a Comptroller General report on wearable medical devices that examines AI.

Two agency actions are also worth knowing.

CMS. In its April 2025 final rule, CMS-4208-F, 90 FR 15792, the agency said it would not finalize the proposed Medicare Advantage "Guardrails for Artificial Intelligence." It said it "will continue to consider the extent to which it may be appropriate to engage in future rulemaking in this area."

ONC. A final rule at 91 FR 67916, published October 28, 2026, and effective December 28, 2026, removes the "model card" source-attribute requirements of 45 CFR 170.315(b)(11) for certified health IT.

This page does not cover FDA review of AI medical devices or HIPAA, and those federal regimes can apply to AI tools.

What Changes in AI Health Care Law in 2027

Rules still to come. Alabama's act says the department "shall adopt rules," and we found none in the Alabama Administrative Monthly issues for April through October 2026. Washington's insurance commissioner released a prepublication draft on September 25, 2026 that would require carriers to disclose AI use in prior authorization to the enrollee. A draft is not a rule. Maine's licensing boards must adopt rules under LD 2082, and we did not confirm their status.

Bills, not laws. Each status below is the one our state page read on November 4, 2026.

Many other bills failed or were withdrawn in 2026, among them Florida's HB 527, Wisconsin's AB 1109 and South Dakota's SB 169 and HB 1144. California's AB 2575 and SB 903 were vetoed, per the Governor's September 30, 2026 update. We make no prediction about any bill.

Related AI Law Pages

• AI laws by state
• California AI laws
• Illinois AI laws
• Texas AI laws
• Utah AI laws
• Washington AI laws

Frequently Asked Questions

What states have laws on AI in health care?

By our count of enacted laws as of November 4, 2026, and subject to the search limits on our AI laws tracker, at least 22 states: Alabama, California, Colorado, Delaware, Georgia, Illinois, Indiana, Iowa, Louisiana, Maine, Maryland, Minnesota, Nebraska, Nevada, New Mexico, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont and Washington. Minnesota's text says automated processing, not AI. Nineteen have a law in force today.

Is there a federal law on AI in health care?

We found no federal statute that sets rules for AI in health care in the public laws of the 119th Congress, as of November 4, 2026. Public Laws 119-21 and 119-75 mention AI in health care but set no rules for it. CMS said in April 2025 that it would not finalize its proposed Medicare Advantage AI guardrails, and an ONC rule effective December 28, 2026 removes certain AI model card requirements for certified health IT.

Can an insurer use AI to deny prior authorization?

It depends on the state and the plan. Texas says a utilization review agent may not use an automated decision system to make an adverse determination, wholly or partly. Many other states with a law bar AI as the sole basis or require a person to make or review the denial. Most of these laws do not ban AI from utilization review altogether, and each has its own limits on which plans it covers.

Which states limit AI in insurance claim denials?

By our count, 12 states have a law on AI or automated processing in insurance review. It is in force in Alabama, California, Indiana, Iowa, Maryland, Nebraska, Texas and Washington, and scheduled for January 1, 2027 in Colorado, Georgia, Minnesota and Utah. Utah's is disclosure only, and Colorado's start depends on no referendum petition having been filed.

Is Arizona's HB 2175 an AI law?

No. It requires a health care insurer's medical director to individually review certain medical-necessity denials and bars relying solely on recommendations from any other source, but its text never mentions AI.

Did Minnesota pass HF 2500?

No. HF 2500 shows no floor action and no chapter on the Revisor's status page. But a separate provision, Minn. Stat. 62M.09 subd. 3(f), bars automated processing alone in adverse determinations from January 1, 2027.

What states ban AI therapy?

Illinois, Maine, Nevada, Rhode Island and Vermont limit AI delivering therapy or mental health services, in different words and with their own exceptions. Colorado's law does too if no referendum petition was filed, which we have not confirmed.

Does Utah ban AI therapy chatbots?

No. Utah's HB 452 sets disclosure, data and advertising rules for mental health chatbots. It does not ban them.

Does Tennessee ban AI therapy?

No. SB 1580 says a person who develops or deploys AI shall not advertise or represent to the public that the system is or is able to act as a qualified mental health professional. It limits the claim, not the tool.

Does my doctor have to tell me if they use AI?

In some states and situations. Texas practitioners who use AI for diagnostic purposes must disclose it, and Texas HB 149 has its own rule for AI used in care. California requires a disclaimer on generative AI patient communications about clinical information unless a licensed provider read and reviewed them. Louisiana and Rhode Island cover AI used to record or document visits.

Can AI be licensed as a doctor or nurse?

Delaware's HB 191 says a nonhuman entity, including an agent powered by AI, may not be certified to practice medicine or licensed in nursing, or use listed titles. Oregon's HB 2748 limits nursing titles, and California's AB 489 bars terms implying that care comes from a licensed person.

What is the NAIC model bulletin on AI?

It is a model the National Association of Insurance Commissioners adopted on December 4, 2023. State regulators who adopt it state their expectations for insurers' AI use under existing law. A bulletin is guidance, not a new statute. The NAIC's list dated November 3, 2026 shows 27 states, the District of Columbia and Puerto Rico as adopting it.

What can I do if I think AI denied my claim?

Ask your plan how the decision was made and use its appeal process. Your state insurance regulator handles complaints about many plans. Washington, for example, generally requires the carrier's grievance process first and then allows independent review. The rules differ by state and type of plan, and a lawyer licensed in your state can advise on your situation.