States Continue Efforts to Regulate AI in Healthcare: A Review of Legislation Passed in 2026

Artificial intelligence (AI) is rapidly reshaping healthcare, influencing how insurers evaluate risk, providers deliver care and patients experience treatment. Though these technologies promise efficiency, innovation and improved outcomes, they also introduce new legal, ethical and regulatory risks. The U.S. Congress has yet to pass significant legislation regulating the use of AI in healthcare. By contrast, in 2024 and 2025, states across the country moved aggressively to enact laws governing the use of AI in healthcare. This trend has continued into 2026, as a number of state legislatures have enacted laws regulating AI's role in clinical decision‑making, patient care and broader healthcare operations.

Health Insurers

Health insurers are rapidly expanding their use of AI in claims processing and utilization review – areas that directly affect patient access to care. Although federal guidance on the use of AI by health insurers has been relatively sparse, the Centers for Medicare & Medicaid Services (CMS) has outlined key guardrails for AI use by Medicare Advantage (MA) plans in the prior authorization (PA) process. Notably, CMS has indicated that though MA plans may use AI to assist in making PA determinations, these tools must account for the beneficiary's unique clinical conditions and treatment recommendations of the beneficiary's supervising physician and may not rely on datasets that fail to account for the beneficiary's specific medical circumstances.

Though many states have adopted the CMS guardrails into law, others have taken approaches that reflect their own priorities. The following is a summary of legislation adopted in 2026 regulating the use of AI by health insurers:

• Alabama (April 17, 2026). Alabama enacted SB 63, which largely mirrors CMS' guardrails for MA plans. The law requires health insurers that use AI in prior authorization decisions to base their determinations on the beneficiary's medical history and unique clinical circumstances as presented by the beneficiary's treating provider. The law also requires health insurers to certify annually to the Department of Insurance that their use of AI does not rely on group datasets, does not discriminate against subscriber groups and is periodically monitored for accuracy. The law takes effect October 1, 2026.
• Indiana (March 4, 2026). Indiana's HB 1271 is unique in that it prohibits health insurers from using AI tools as the sole basis for downcoding a claim without a healthcare professional's review of the beneficiary's medical record. The law is not limited to the PA process. Additionally, the law prohibits healthcare providers from utilizing AI to submit claims without a review by the provider or a billing professional. The law takes effect July 1, 2026.
• Utah (March 19, 2026). Utah's SB 319 requires health insurers to disclose to the Utah Insurance Department, providers and enrollees whether AI is used to review PA The law further requires healthcare professionals to render adverse determinations based on their independent medical judgment, separate from and not dictated by AI recommendations. The law takes January 1, 2027.
• Washington (March 26, 2026). Washington's SB 5395 prohibits health carriers, healthcare benefit managers and public employee health plans from relying solely on AI to deny, delay or limit healthcare services in the PA process. The law further requires that only licensed or qualified health professionals make an adverse determination on a PA request. The law allows the use of AI provided the system accounts for the patient's individual clinical conditions and undergoes a periodic performance review. The law also requires health insurers to report to the insurance commissioner the number of PA requests denied with the aid of AI.
• Maryland (April 28, 2026). In 2025, Maryland passed HB 820, adopting the CMS guardrails discussed herein. Maryland's HB 1563, effective June 1, 2026, requires health insurers to comply with novel disclosure and transparency requirements, including quarterly reporting to the Insurance Commissioner the number of adverse decisions it issues, type of service it involved, and whether AI or another software tool was utilized in making the adverse decision. The law specifically gives the insurance commissioner the authority to investigate health insurers if there are significant increases in adverse determinations, particularly denials for emergency department services.
• Georgia (May 5, 2026). Georgia's SB 544, effective January 1, 2027, specifically permits health insurers to utilize AI in the prior authorization process to automate tasks, reduce administrative burdens, participate in decision-making and perform other lawful functions. Notwithstanding, the Georgia law prohibits health insurers from utilizing AI to issue adverse determinations without the review and approval of a licensed healthcare provider.

Though the states above have taken different approaches to regulating the use of AI by health insurers, the legislation reflects at least one unifying principle: AI may be used to assist and streamline insurance operations, but a health insurer cannot rely upon it as the sole basis for denying care.

Healthcare Providers and Professional Practice

In 2026, states continued efforts to regulate healthcare providers' use of AI by restricting autonomous clinical decision‑making, requiring patient disclosure of AI tools and, in some cases, informed consent. Examples from Maine and Arizona are instructive:

• Maine (April 8, 2026). Maine's HB 2082 allows licensed mental health professionals to use AI solely for administrative functions and limited supplementary purposes while expressly barring providers from utilizing AI for purposes of making therapeutic communications or treatment decisions or independently interacting with patients. The law further requires professionals to obtain patient consent prior to utilizing ambient listening or other AI-powered recording tools.
• Arizona (November 2, 2025). Arizona's Board of Behavioral Health Examiners enacted regulations that require behavioral health professionals to obtain and document informed consent before providing services that involve the use of AI, machine learning, deep learning or any other human simulation modality. The regulation is effective January 1, 2027.

Several other states, including Vermont and California, are considering legislation that would regulate how behavioral health professionals may use AI.

Limitations on AI Companions and Chatbots

Continuing a trend from 2025, states in 2026 have accelerated regulation of AI in digital health products, including AI companions and chatbots. This legislation has been enacted most predominantly in the behavioral and mental health space in response to heightened patient-safety concerns. The legislation generally aims to ensure that these tools do not provide professional healthcare services for which licensure is required and that they include safeguards to prevent users from inflicting self-harm.

• Idaho (March 1, 2026) and Nebraska (April 8, 2026): Idaho and Nebraska enacted nearly identical laws, both titled the Conversational AI Safety Act. The acts require operators of public‑facing AI chatbots to clearly disclose when users are interacting with AI, mandates crisis‑response protocols for expressions of suicidal ideation and expressly prohibits chatbots from representing that they provide professional mental or behavioral healthcare. Both laws are effective July 1, 2027.
• Oregon (April 6, 2026): Oregon SB 1546 requires operators of AI "companions" and chatbot platforms to clearly disclose when users are interacting with AI, implement evidence-based protocols to detect and respond to suicidal ideation or self‑harm (including crisis referrals), impose heightened safeguards for minors and report certain safety‑related incidents, while also allowing a private right of action for users who suffer harm. The law is effective January 1, 2027.
• Tennessee (April 6, 2026): Tennessee SB 1580 prohibits developers and deployers of AI systems, including chatbots, from advertising or representing that such systems are qualified or capable of acting as licensed mental or behavioral health professionals, treating violations as unfair or deceptive practices enforceable under the state's consumer protection laws. The law is effective July 1, 2026.
• Delaware (April 23, 2026): Delaware HB 191 prohibits any nonhuman entity, including an agent powered by AI, from being licensed or certified to practice as a professional nurse, advanced practice registered nurse, practical nurse, physician or physician assistant. The law further prohibits nonhuman entities from using any protected professional title or abbreviation associated with those professions.

The legislation reflects a broad public concern that AI companions and chatbots can pose significant risks when deployed for healthcare purposes, particularly mental health, without adequate oversight, especially when used by minors.

Utah's AI Regulatory Sandbox

A key development in 2026 is Utah's piloting of AI through its state regulatory framework, including a pilot program that allows AI systems to autonomously renew certain routine prescriptions for patients with chronic conditions. The pilot operates under Utah's AI Policy Act, enacted in 2024 and amended in 2025, which created a state-run regulatory "sandbox" administered by the Office of AI Policy. This framework allows companies to test AI-enabled systems within a tailored regulatory environment while the state evaluates how these technologies perform in practice and whether additional safeguards are needed before broader deployment. Other states, including Delaware and Texas, are implementing similar sandbox programs. 

Conclusion

Holland & Knight will continue to monitor and report on bills regulating AI in healthcare at both the federal and state levels on its Health AI Navigator. For more information or questions regarding legislative developments in healthcare or similar statutes and regulations, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.