Connecticut: AI health laws
7 entries on the map: 4 in force and 3 enacted and not yet in force (main duties begin Oct 1, 2026 and Jan 1, 2027).
Dates ahead
- Oct 1, 2026
- Jan 1, 2027SB 5, Public Act 26-15, An Act Concerning Online SafetyClinical decision and chatbot limits
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin No. MC-25, Use of Artificial Intelligence Systems by Insurers
Expects every insurer authorized in Connecticut to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions on regulated insurance practices, covering governance, risk management and oversight of third-party data and AI systems, and requires Connecticut domestic insurers to file an AI certification by Sept. 1, 2024 and annually after that.
Physician read. It places no duty on physicians. Since Feb. 26, 2024, insurers in Connecticut, including health insurers, are expected to govern AI systems used in decisions that affect patients, those decisions must comply with the Connecticut Unfair Insurance Practices Act and its claim settlement standards, and insurers should be prepared to explain their AI use to the Insurance Department in investigations and market conduct examinations.
Notes: Signed by Insurance Commissioner Andrew N. Mais and addressed to all insurers licensed to do business in Connecticut. The NAIC's Aug. 31, 2026 map lists MC-25 as Connecticut's adoption of the NAIC Model Bulletin; the bulletin follows the model's structure and cites the NAIC's AI Principles, but its text does not name the model bulletin. It cites the health insurance statutes (sections 38a-481, 38a-501a, 38a-528a and 38a-556) and the unfair claim settlement provision (38a-816(6)). The bulletin sets no separate effective date, so the issue date is used.
Office of the State Comptroller, AI protections for the State Employee Health Plan and the Partnership Plan
Bars adverse determinations made solely by an AI system without human review, bars carriers from using AI or predictive models as the sole basis to downcode claims, reduce provider payments or alter billing codes without human review, bars use of plan member data to train, develop or support other AI models, requires disclosure when AI materially assists with, directly interacts with or recommends a benefit or health service to a member, and requires AI systems to be validated for accuracy, consistency and fairness, with carriers disclosing governance and audit procedures to the Comptroller.
Physician read. For patients in Connecticut's state employee and Partnership plans, the policy bars adverse determinations made solely by an AI system without human review and bars downcoding claims, reducing provider payments or altering billing codes solely by AI without human review; the Comptroller has published no start date. The Comptroller's announcement also says carriers and providers must disclose when AI is materially assisting with, directly interacting with or recommending a benefit or health service to a member.
Notes: Announced Sept. 16, 2026 by Comptroller Sean Scanlon for plans covering more than 270,000 members. This is a plan-sponsor policy of the office that administers the state plans, not an Insurance Department rule or a statute; it is included because it sets AI rules for claims and denials in the state's largest employer plans. Neither the announcement nor its PDF version gives an effective date or the mechanism (contract terms or plan policy); the Comptroller's news page and the Care Compass benefits site show no other document on the policy, and the Health Care Cost Containment Committee's page could not be opened. CT Mirror reported that the rules take effect Jan. 1, 2027 and bind the plans' vendors (Anthem, Cigna, Aetna and Caremark); the 'enacted' status rests on that report. Authorized contractual and automated claims processes remain permitted. The Comptroller said he would work with the legislature in the 2027 session to extend the policy to all state-regulated plans.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: Office of the State Comptroller, AI protections for the State Employee Health Plan and the Partnership Plan (under payer and utilization review AI); SB 5, Public Act 26-15, An Act Concerning Online Safety (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
SB 5, Public Act 26-15, An Act Concerning Online Safety
Requires AI companion operators to maintain evidence-based protocols to detect user expressions of suicide, self-harm or imminent physical violence and refer users to resources including the 988 lifeline, to disclose that users are talking with an AI companion (by a standing notice, or at the start and then hourly for minors and every three hours for adults), and, for users the operator knows or has reason to believe are minors, to prevent the companion from offering mental health services unless it is designed to deliver them, built with clinical best practices and displays that it is not a licensed mental health professional.
Physician read. From Jan. 1, 2027, AI companion apps used by Connecticut patients must detect expressions of suicide or self-harm and refer users to crisis resources, and cannot offer mental health services to minors unless designed for that purpose and labeled as not a licensed mental health professional. It places no duty on physicians, and AI used solely for clinical support or other treatment-support functions is excluded if it does not present itself as human, use anthropomorphic features or aim to meet users' social or emotional needs.
Notes: Status, dates and text are from LegiScan's bill page and its copy of the chaptered act. LegiScan's history records 'Signed by the Governor' on May 27, 2026, after the act became Public Act 26-15 on May 11 and went to the Secretary of State on May 14; WilmerHale gives the same date. The governor's release of June 2, 2026 announced that he 'has signed' the act and gives no signing date, so it does not conflict. The AI companion sections (sections 4 to 6) take effect Jan. 1, 2027 and are enforced solely by the Attorney General as unfair trade practices, with no private right of action. Other sections cover subscription AI disclosures, frontier AI developers, automated employment decisions and a plan for an AI regulatory sandbox program (section 3, effective July 1, 2027); the governor's release and WilmerHale describe youth social media rules (effective Jan. 1, 2028 per WilmerHale) that fall after section 31, where the copy that could be read breaks off. None of the sections read places a duty in health care beyond the AI companion rules.
Mental health AI
AI in therapy and mental health care.
Also relevant here: SB 5, Public Act 26-15, An Act Concerning Online Safety (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
SB 3, Public Act 23-56, An Act Concerning Online Privacy, Data and Safety Protections
Adds consumer health data protections to the Connecticut Data Privacy Act: consent before selling consumer health data, contractual or statutory confidentiality duties for employees and processors with access to it, and a ban on geofences within 1,750 feet of a mental health, reproductive or sexual health facility for processing consumer health data.
Physician read. It places no duty on HIPAA covered entities or business associates. Since July 1, 2023, health apps and other businesses outside HIPAA that handle Connecticut patients' health data, whatever their size, need consent to sell it and cannot geofence within 1,750 feet of mental health, reproductive or sexual health facilities to process it.
Notes: Consumer health data means personal data a controller uses to identify a consumer's physical or mental health condition or diagnosis, including gender-affirming and reproductive or sexual health data. The act's section 3 restates the exemption list in section 42-517(a), which includes covered entities and business associates, and the consumer health data rules in section 2 do not apply to the entities on that list. The act's minors' online services provisions took effect Oct. 1, 2024. LegiScan's copy of the public act was used.
SB 6, Public Act 22-15, An Act Concerning Personal Data Privacy and Online Monitoring (Connecticut Data Privacy Act)
Gives consumers rights to access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale and certain profiling, requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic and biometric data and precise geolocation, and requires data protection assessments for high-risk processing.
Physician read. It places no duty on HIPAA covered entities or business associates, which are exempt as entities. Since July 1, 2023, other businesses covered by the act, such as health and wellness apps outside HIPAA, need consent to process data revealing a health condition or diagnosis.
Notes: Codified at sections 42-515 to 42-525. Signing date from LegiScan; the Attorney General's page confirms the July 1, 2023 effective date. As enacted, the act reached controllers of the data of 100,000 consumers, or 25,000 with more than 25 percent of gross revenue from sales; the thresholds on the Attorney General's page (35,000 consumers, or any processing of sensitive data or sale of personal data) are those set by the 2025 amendments. Later amendments with their own entries: SB 3 (2023, consumer health data), SB 1295 (2025, effective July 1, 2026) and SB 4 (2026, effective Oct. 1, 2026).
SB 1295, Public Act 25-113, An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts
Amends the Connecticut Data Privacy Act to add neural data and financial account data to sensitive data, lower the applicability threshold to 35,000 consumers and extend it to any controller that processes sensitive data or sells personal data, let consumers question profiling-based automated decisions with legal or similarly significant effects and learn the reason, require impact assessments for such profiling, and require privacy notices to state whether personal data are used to train large language models.
Physician read. It places no duty on HIPAA covered entities or business associates, which remain exempt. Since July 1, 2026, health and wellness businesses outside HIPAA that process any sensitive data of Connecticut patients are covered regardless of size and must say in their privacy notices whether they use personal data to train large language models.
Notes: Impact assessments apply to processing activities created or generated on or after Aug. 1, 2026. The act also bars targeted advertising to and sale of the personal data of consumers aged 13 to 17 when the controller has actual knowledge of or willfully disregards their age, and adds social media and online safety duties outside this map's scope. Signing date from LegiScan.
SB 4, Public Act 26-64, An Act Concerning Consumer Privacy and Protection
Amends the Connecticut Data Privacy Act to bar controllers and third parties from selling any consumer's precise geolocation data, limits on-premises facial recognition used for security to matching against the business's own database with signage at each entrance and a posted policy, and requires data broker registration and a statewide deletion mechanism.
Physician read. It places no duty on HIPAA covered entities or business associates, which remain exempt. From Oct. 1, 2026, controllers and third parties covered by the act cannot sell any Connecticut patient's precise geolocation data; the ban has no consent exception.
Notes: The provisions summarized take effect Oct. 1, 2026; data broker registration begins Jan. 1, 2027 and the deletion mechanism is due by July 1, 2028. The Attorney General's Sept. 16, 2026 release cites Public Act 26-64 and describes the geolocation sale ban, facial recognition signage, genetic testing rules and the data broker registry. The act also sets consent and retention rules for direct-to-consumer genetic testing companies (outside this map's scope) and surveillance pricing rules. The statement that the ban has no consent exception reflects the unconditional new text ('No controller shall sell any consumer's precise geolocation data'; the same for third parties); Proskauer describes limited exceptions for disclosures to processors, services the consumer requests, affiliates and mergers or acquisitions, none of them based on consent. Snell & Wilmer cites the act as Public Act 26-62; LegiScan, the chaptered text, the Attorney General and Proskauer give 26-64. Snell & Wilmer and Proskauer say HB 5222 (Public Act 26-100, signed June 2, 2026 per LegiScan) later amended certain provisions, and Proskauer adds HB 5563 (Public Act 26-130, signed June 4, 2026 per LegiScan, whose title includes surveillance pricing); the copy of Public Act 26-100 read on LegiScan breaks off at section 33, before any privacy section, so whether it changed the provisions described here could not be confirmed.
Also relevant here: Office of the State Comptroller, AI protections for the State Employee Health Plan and the Partnership Plan (under payer and utilization review AI).
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.