Artificial intelligence is spreading quickly through the American health care system. Insurers use algorithms to review claims and prior authorization requests. Hospitals use AI tools to draft clinical notes and flag patients at risk. And millions of people, including teenagers, now talk to AI chatbots about their mental health. Congress has yet to pass significant legislation regulating AI in health care, so states have stepped in [1]. In 2026 alone, at least a dozen states enacted laws setting limits on how AI can be used.
Keeping humans in charge of denials
The most common type of law focuses on insurers. Prior authorization, the process in which an insurer must approve a treatment before it is covered, has long frustrated doctors and patients. As insurers adopt AI to speed up those reviews, critics have worried that algorithms could deny care automatically, with little meaningful human review. Several states responded this year, according to an analysis by the law firm Holland & Knight [1]: • Washington (SB 5395) bars AI from being the sole basis for denying, delaying or limiting services, and only qualified health professionals can make adverse decisions. Insurers must report AI-aided denials.
•
Utah (SB 319) requires insurers to disclose when they use AI in prior authorization and requires independent clinician judgment for denials, starting January 1, 2027.
•
Georgia (SB 544) allows AI for administrative tasks in prior authorization but requires a licensed provider to review and approve any denial, starting January 1, 2027.
•
Maryland (HB 1563) requires insurers to report adverse decisions quarterly, including whether AI was used, and allows the state insurance commissioner to investigate spikes in denials, especially for emergency services.
•
Alabama (SB 63) requires that prior authorization decisions be based on a patient's own medical history and clinical circumstances, effective October 1, 2026.
•
Indiana (HB 1271) says AI cannot be the only basis for "downcoding" a claim, meaning paying it at a lower level, without review by a health care professional. The common thread is simple: a machine can help, but a qualified human must make decisions that limit a patient's care.
Chatbots and mental health
A second category addresses AI chatbots, especially those that offer emotional support or mental health advice. Concerns grew after reports of young people forming intense relationships with AI companions and, in some cases, receiving harmful responses during a crisis. Idaho and Nebraska enacted nearly identical "Conversational AI Safety Act" laws that require chatbots to disclose that users are talking to AI, require crisis-response protocols when a user expresses suicidal thoughts and bar chatbots from claiming to provide professional mental health care. Both take effect July 1, 2027 [1]. Oregon (SB
1546) goes further, requiring AI disclosure, detection of suicide and self-harm risk with
crisis referrals, extra protections for minors and incident reporting. It also allows people harmed by violations to sue, starting January 1, 2027 [1]. Tennessee (SB 1580) bans advertising or representing an AI system as qualified to act as a licensed mental health professional, with violations enforceable under consumer protection law [1]. Delaware (HB 191) prohibits AI agents from being licensed as nurses, physicians or physician assistants or from using those protected titles [1].
Rules for clinicians
Some states are regulating how licensed professionals use AI. Maine (HB 2082) allows licensed mental health professionals to use AI only for administrative and limited supplementary tasks, bars AI from making therapeutic decisions or interacting independently with patients and requires patient consent before using "ambient listening" tools that record sessions [1]. Arizona's behavioral health licensing board adopted a regulation requiring informed consent before AI-assisted services, effective January 1, 2027 [1].
Not all regulation is restrictive
States are also experimenting with letting AI do more. Utah runs a "regulatory sandbox" under its 2024 AI Policy Act that allows AI systems, under supervision, to autonomously renew certain routine prescriptions for chronic conditions [1]. Delaware and Texas reportedly have similar programs [1]. Supporters say these pilots could reduce paperwork and help patients in areas with doctor shortages, while gathering evidence about safety.
A patchwork problem
Health care companies that operate nationally now face different rules in different states, a situation some analysts describe as a fragmenting compliance landscape [2][3]. Industry groups have argued that a single federal standard would be more workable, while patient advocates and many state officials say states cannot wait for Congress, which has debated AI legislation for years without passing comprehensive rules [1]. The tension between state action and federal preemption, meaning a federal law that overrides state laws, is likely to be a major issue as AI regulation develops.
The case for and against
Supporters of these laws argue that patients deserve to know when AI is involved in their care and that life-altering decisions, such as whether a treatment is covered, should not be made by software alone. They point to research and lawsuits alleging that some insurers' algorithms produced high denial rates. Critics worry that overly strict rules could slow the adoption of tools that may actually reduce errors, speed approvals and lower costs. AI developers note that human reviewers also make mistakes and that well-designed AI can flag cases a person might miss.
What patients can do
For patients, the new laws create practical rights in some states. Where disclosure is required, people can ask whether AI was used in reviewing a claim or prior authorization request. Where laws require a licensed professional to make denials, patients who receive a denial can request information about who reviewed it and appeal. In states such as Maryland, regulators will also receive data on AI-assisted denials, which could reveal patterns that individual patients cannot see on their own [1].
Why it matters
AI is likely to touch nearly every part of health care in the coming decade, from billing to diagnosis to therapy. The laws passed in 2026 represent an early attempt to set ground rules: transparency, human oversight and special protection for vulnerable users, especially young people in crisis. For patients, the practical result in many states will be a right to know when AI is involved and a guarantee that a human, not an algorithm, has the final word on denials of care.
Sources
- 1. "States Continue Efforts to Regulate AI in Healthcare: A Review of Legislation Passed in 2026," Holland & Knight, May 26, 2026. https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-r egulate-ai-in-healthcare
- 2. "Manatt Health: Health AI Policy Tracker," Manatt, Phelps & Phillips, 2026. https://www.manatt.com/insights/newsletters/health-highlights/manatt-health-health-ai-policy-tracker
- 3. "The State AI Health Law Patchwork Is Fragmenting Compliance," AI2 Work, 2026. https://ai2.work/blog/the-state-ai-health-law-patchwork-is-fragmenting-compliance Information in this article is current as of October 10, 2026. Bracketed numbers refer to the sources listed above.