Regulation of AI in Health Insurance: A Legislative Overview

State legislatures are increasingly regulating the use of artificial intelligence (AI) in health insurance decisions, such as prior authorizations and utilization reviews. Recent laws reflect evolving practices in the industry, demonstrated by several notable legislative actions.

Georgia's Approach

Georgia's Senate Bill 4441, effective January 1, 2027, authorizes insurers to utilize AI for administrative tasks, decision-making, and other legitimate functions. The legislation mandates that any adverse determination involving AI must be reviewed by a qualified utilization review agent with the inclusion of a clinical peer. Importantly, AI tools cannot override the clinical judgment of these peers. Unlike some states, Georgia does not require insurers to disclose their use of AI to members or providers.

Iowa's AI Regulations

In Iowa, House File 2635, effective July 1, 2026, allows utilization review organizations to initially employ AI algorithms in reviewing prior authorization requests. However, decisions regarding medical necessity cannot rely solely on AI, with denials or reductions needing assessment by a qualified reviewer or clinical peer. Organizations must provide written explanations for such decisions and disclose the qualifications of reviewers to healthcare providers.

AI Usage Transparency in Utah

Utah's Senate Bill 319, as of January 1, 2027, modifies the state's health care preauthorization statute, limiting AI's role in preauthorization decisions by requiring independent medical judgment for adverse determinations. Insurers must disclose AI usage in their review processes to the Utah Insurance Department, with this information also being clearly posted online for transparency.

Washington's Comprehensive Standards

Washington's Senate Bill 5395, effective June 11, 2026, establishes comprehensive standards for AI in prior authorization. The bill restricts AI usage in decision-making for medical necessity to human oversight, ensuring evaluations incorporate personalized medical histories rather than relying solely on aggregated data. AI systems must comply with state laws and privacy standards, subject to audits and reviews for fairness and accuracy. Insurers are required to disclose detailed credentials of reviewers involved in denial decisions, with additional mandates for public posting and reporting to state regulators.

Continued legislative monitoring is required, as bills in Pennsylvania and Oklahoma are still under consideration, while proposals in New Hampshire and Louisiana have been withdrawn or inactive. These developments underline the need for insurers to adapt to changing regulatory landscapes surrounding AI in healthcare decision-making.