Utah Expands AI Sandbox Initiatives with New Healthcare Pilots

The Utah Office of Artificial Intelligence Policy (OAIP) on October 5, 2026, announced three new clinical pilots under its regulatory sandbox as part of the state's "Pro-Human AI Initiative." The announcement coincided with the addition of healthcare as a fundamental "pillar" of the initiative, which serves as Utah's artificial intelligence (AI) framework. This Holland & Knight alert summarizes the pilots, describes their phased approach to professional oversight and outlines considerations for healthcare and technology companies.

Regulatory Mitigation Agreements for 3 Pilots

Utah Senate Bill (SB) 149 (2024) authorized OAIP and the Utah Division of Professional Licensing (DOPL) to enter into regulatory mitigation agreements (RMAs) that allow specific pilot participants to test AI-powered service offerings without enforcement of certain state regulatory requirements. Three healthcare-related pilot participants – Expect Fitness, August AI and Nolla Health (collectively, the Healthcare Pilots) – entered into RMAs with OAIP and DOPL. OAIP also announced agreements with two major health systems for future AI pilots.

As summarized below, the Healthcare Pilots directly authorize AI-powered decision-making in patient care, raising important questions regarding professional oversight and clinical accountability.

• The Expect Fitness pilot will allow the Expect Fitness platform to use AI to develop individualized pelvic floor physical therapy plans for women experiencing conditions such as urinary incontinence, pelvic pain and postpartum pelvic floor disorders. The platform analyzes patients' pelvic floor health questionnaire responses to assign International Classification of Diseases (ICD)-10 diagnosis codes to the patients. The system uses those diagnosis codes to draft home exercise plans for the patients. Licensed physical therapists will review the plans in the initial phase of the rollout. As part of the RMA, DOPL agreed to forgo enforcement of applicable healthcare laws including, but not limited to, the Utah Telehealth Act and provisions of the Pharmacy Practice Act, Medical Practice Act (Sections 58-67-501 and -502) and Physical Therapy Practice Act.
• The August AI pilot will allow patients to seek refills of their existing prescriptions without interacting with the original prescriber. August AI's system verifies patient identity before reconciling each refill request against Surescripts data and screening for possible medication interactions, gaps and patient suicidality. The app will authorize 30-, 60- or 90-day refills of existing, non-controlled maintenance medications for stable adults. The RMA does not authorize August AI to start new prescriptions or change the dosage of existing prescriptions. Licensed prescribers will initially review refills before they reach the patient and move to retroactive review only in later phases. DOPL grants August AI relief from enforcement under the pharmacy, nursing, medical, osteopathic, and telehealth statutes and rules similar to those granted to Expect Fitness.
• Finally, the Nolla Health pilot will allow patients to seek prescription treatment for mild to moderate acne without a synchronous physician visit. Nolla Health's app scores acne severity from five-angle facial images and selects a prescription treatment from a restricted drug formulary. The RMA authorizes the app to issue first-time and renewal prescriptions for topical acne medications, including compounded formulations, and transmit them to Utah pharmacists. Licensed prescribers will initially review the prescriptions proactively and move to retroactive review in later phases, as detailed in the following section. DOPL grants Nolla Health similar relief from enforcement under the pharmacy, medical and osteopathic statutes and rules.

In each RMA, Utah has agreed only to forgo enforcement of specified unlawful and unprofessional conduct provisions for the participant and certain affiliated clinicians and only for the service described. Notably, this relief from enforcement covers Utah state administrative enforcement only – each app is still subject to federal laws and regulations. The RMAs do not provide a liability shield for the participant or its affiliated clinicians or alter the relevant professional standard of care. Any conduct outside the strict confines of the RMA is subject to state enforcement action.

A Phased Model of Professional Oversight

The pilots offer a useful view into how Utah is approaching "human in the loop" requirements. Rather than applying a single oversight standard, the RMAs each dictate a phased rollout of app functionality conditioned on the app's achievement of certain clinical metrics. Each healthcare pilot must meet specific performance benchmarks to receive OAIP's approval to advance to lower levels of human oversight.

The Nolla Health RMA provides a clear example of the phased approach. In the first phase of the pilot, two physicians will review every prescription before it is submitted. In the second phase, the AI will submit the prescription directly to the pharmacist, and physicians will review all cases retrospectively. By the final phase, physicians will review only a sample of at least 10 percent of cases. To advance to the next phase, Nolla Health must 1) achieve at least 95 percent concordance between the AI-generated prescriptions and the reviewing physician's determinations and 2) miss zero "hard stops" or immediate physician escalations for patients who are not qualified for the drug. Throughout the pilot, patients may message a licensed physician in-app at any time, and certain cases are escalated for physician review prior to prescribing. AI-initiated prescriptions are identified as such in the prescription record alongside the overseeing prescriber's National Provider Identifier for ease of identification by pharmacies and regulators.

This phased approach reflects OAIP's effort to ensure that licensed professionals oversee or are otherwise involved in the pilot process and delivery of care while evidence is gathered. OAIP's announcement follows earlier tension between the Utah Medical Licensing Board and the state's first refill pilot. The Medical Licensing Board warned that AI would authorize refills without adequate clinical oversight, but DOPL and OAIP declined to suspend the pilot.

Broader Policy Context

Utah's initiative comes as states consider how existing healthcare laws regarding professional licensure, scope of practice, telehealth and responsibility for clinical decisions apply when AI systems participate more directly in clinical services. Although professional licensure and scope of practice remain core state functions, the pilots operate within federal constraints the state cannot alter, including the prescription requirement under the Federal Food, Drug, and Cosmetic Act, U.S. Drug Enforcement Administration rules governing prescriptions for controlled substances and U.S. Food and Drug Administration (FDA) jurisdiction over medical devices.

Federal health agencies are also addressing payment. In the calendar year 2027 Outpatient Prospective Payment System (OPPS) and Physician Fee Schedule (PFS) proposed rules released in July 2026, the Centers for Medicare & Medicaid Services (CMS) would establish a new Medicare category, Software as a Medical Service (SaMS), marking its first effort to pay for software-based clinical services as their own category rather than as a cost embedded in another procedure. Under the OPPS proposal, 21 SaMS codes, including electrocardiogram interpretation algorithms, computed-tomography (CT)-based fracture risk prediction and retinal imaging AI for diabetic retinopathy, would move to a new payment track in 2027. The PFS proposed rule also sought feedback on paying for AI-enabled care.

The underlying tension is that fee-for-service payment is calculated on inputs that do not underpin the value of autonomous clinical AI. The PFS pays for per-encounter clinician work, practice expense and liability while autonomous AI's costs are largely fixed and front-loaded, with minimal marginal cost per use. Applying per-service payment without addressing that mismatch could drive utilization and spending without a clear link to outcomes.

CMS and FDA are also generating evidence through deployment of various payment models; however, these efforts leave largely untouched who may deliver care and under what supervision. Unlike states focused on disclosure or risk-management requirements, Utah's sandbox lets the state evaluate specific technologies and adjust professional involvement based on deployment evidence, paralleling the Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) and Technology-Enabled Meaningful Patient Outcomes (TEMPO) models. Its value will depend on the quality of those evaluations and whether findings inform future state and federal standards.

Considerations for Healthcare and Technology Companies

Approximately 40 states have passed legislation governing the extent to which providers can use AI in delivering clinical care. The federal government for its part has provided limited guidance, and Congress has not enacted any legislation addressing the use of AI in clinical care.

The Healthcare Pilots offer insight into the types of issues that may arise for companies considering participation in Utah's sandbox program or developing similar healthcare applications in other states. Among other things, the RMAs illustrate how the app's patient population, clinical activity and the limits of the proposed AI use may be defined, as well as how professional review requirements, adverse event reporting requirements and criteria excluding certain decisions from AI review may be structured. Questions regarding how payers will reimburse AI-powered services may also be relevant in an environment where payment models are evolving significantly more slowly than healthcare technology. The relevance of these and other issues will depend on each company'’s particular facts and circumstances.

Physicians, nurse practitioners and physical therapists serving as the prescriber or reviewer of record may retain personal license exposure for conduct outside the RMA's terms, and RMAs provide no malpractice shield. Whether existing malpractice coverage extends to AI-initiated clinical risk may therefore be an open question for some clinicians.

Moreover, pharmacies receiving AI-generated orders are not parties to the RMAs and do not benefit from their nonenforcement relief. As a result, pharmacies may face questions regarding how they verify AI-flagged prescriptions, when they use the participant's physician escalation channel when necessary for verification of the prescription and compliance with standards of care, and how they document drug utilization review.

Successful participation may generate evidence supporting a technology's broader deployment, but a state sandbox authorization does not resolve every regulatory or commercial issue. The pilot's ability to comply with federal requirements, applicable professional standards of care, privacy obligations, reimbursement rules and the operational demands of implementation will continue to influence whether the app can be scaled for wider adoption.

Utah's AI sandbox program warrants continued attention as the pilots move through their demonstration periods. For healthcare organizations, technology companies and investors, the initiative offers an early indication of how states may approach prescribing authority, professional accountability and AI-enabled clinical services.

If you have any questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.