Alabama: AI health laws
2 entries on the map: 2 enacted and not yet in force (main duties begin Oct 1, 2026 and May 1, 2027).
Dates ahead
- Oct 1, 2026SB 63, Health care plans; to regulate the use of artificial intelligence in determinations of coveragePayer and utilization review AI
- May 1, 2027HB 351, Alabama Personal Data Protection ActData and privacy
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
SB 63, Health care plans; to regulate the use of artificial intelligence in determinations of coverage
Requires a health benefit plan provider that uses AI to decide medical necessity on prior authorization requests to base those determinations on the enrollee's medical history, clinical circumstances presented by the requesting provider and other clinical information in the medical record, and to certify to the Department of Insurance each year that the AI does not rely on a group dataset to make determinations, is fairly and equitably applied and does not discriminate against any subscriber group or enrollee in violation of state or federal law; requires plan providers to disclose their AI use in utilization review in their policies and procedures, review that use and its outcomes periodically and keep patient data used by the AI to its intended and stated purpose; and requires a licensed physician or other competent health care professional to make every determination to deny, delay or modify a prior authorization request based on medical necessity.
Physician read. From Oct. 1, 2026, a health benefit plan provider's determination to deny, delay or modify a prior authorization request based on medical necessity must be made by a licensed physician or other health care professional competent to evaluate any AI recommendation in light of the enrollee's specific clinical issues, and a plan that uses AI for these determinations must base them on the enrollee's medical history, the clinical circumstances the requesting provider presents and other clinical information in the medical record. It places no duty on treating physicians.
Notes: LegiScan's history records the bill as enacted April 17, 2026, with no separate signing entry, and Holland & Knight (secondary) gives April 17 as the signing date; the act number was not found on LegiScan's bill or text pages. The House Insurance Committee substitute replaced the Senate text; the entry follows the enrolled act. The act says the requirements of subsections (b) and (c) are satisfied by an attestation by an authorized representative of the plan provider based on reasonable reliance on internal policies, procedures and third-party vendors. The Department of Insurance may investigate, hold a hearing and impose a plan to correct procedures; for repeat violations of subsection (b) frequent enough to indicate a general business pattern or practice, it may impose fines of up to $5,000 or suspend or revoke a certificate of authority. The act directs the department to adopt rules; the department's regulations, bulletins and hearing-notice pages showed none on Sept. 29, 2026. Tracker summaries listed this law as HB 272 and SB 271 (or HB 273); those numbers belong to unrelated 2026 bills.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
Nothing in this category was found in the review of Sept 29, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
HB 351, Alabama Personal Data Protection Act
Gives consumers rights to confirm, correct, delete and obtain a portable copy of their personal data and to opt out of targeted advertising, sale and profiling in furtherance of solely automated significant decisions, a term that includes decisions on health care services, and requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic or biometric data used to identify a person, and precise geolocation.
Physician read. From May 1, 2027, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health condition or diagnosis, identifying genetic or biometric data or precise geolocation, and must let consumers opt out of profiling used for solely automated decisions on health care services and other significant matters. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.
Notes: The act does not require data protection assessments. Section 11 provides that the Attorney General may enforce the act and must first issue a notice of violation; if the controller corrects the violation within 45 days and gives the Attorney General an express written statement that it has been corrected and will not recur, no action may be brought, and otherwise a court may assess a civil penalty of up to $15,000 per violation. The text names no other enforcer but does not say the Attorney General's authority is exclusive or use the phrase 'private right of action.' Opt-out preference signals: Section 6(b) requires a controller to offer a clear and conspicuous opt-out link or up-to-date contact information; the act does not define an opt-out preference signal or say how one is sent; Section 6(c)(1) provides that when an opt-out made through an opt-out preference signal 'sent in accordance with this section' conflicts with a consumer's controller-specific privacy setting or loyalty program participation, the controller shall comply with the signal but may notify the consumer. Hunton (secondary) reads the act as not requiring controllers to honor universal opt-out preference signals such as the Global Privacy Control. The signing date comes from LegiScan's history, which records the bill as enacted April 17, 2026, and from Hunton; the act number was not found.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.