Illinois: AI health laws
9 entries on the map: 5 in force, 1 enacted and not yet in force (main duties begin Jan 1, 2028) and 3 bills in the legislature.
Dates ahead
- Jan 1, 2028SB 3114, Transparency in Downcoding Act (Public Act 104-0568)Payer and utilization review AI
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Company Bulletin 2024-08, The Use of Artificial Intelligence Systems in Insurance
Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems, covering governance, risk management and internal controls and the oversight of third-party AI vendors, to prevent adverse consumer outcomes, and lists the documentation the Department of Insurance may request; the NAIC lists it as Illinois' adoption of its model bulletin.
Physician read. It places no duty on physicians. Since March 2024, health insurers in Illinois are expected to govern the AI systems they use in decisions that affect consumers and to show the Department of Insurance their governance, testing and vendor controls on request.
Notes: Signed by Director Dana Popish Severinghaus. The bulletin states no separate effective date; the issue date is used. It applies to all lines and does not single out health insurers or utilization review; it cites the Illinois Insurance Code's unfair methods of competition and improper claims practices provisions, among others.
HB 2472, Ins-Adverse Determination (Public Act 103-0656)
Requires a health care plan or other utilization review program that uses an algorithmic automated process in utilization review for medical necessity to ensure that only a clinical peer makes any adverse determination based on medical necessity, and requires programs that use algorithmic automated processes to decide on adverse determinations to use objective, evidence-based criteria that meet URAC or NCQA accreditation requirements.
Physician read. Since Jan. 1, 2025, a health care plan or utilization review program that uses an algorithm in medical necessity review must have a clinical peer, a health care professional in the same profession and the same or similar specialty as the provider who typically manages the condition, make any adverse determination based on medical necessity. It places no duty on physicians.
Notes: Status, dates and text come from LegiScan's bill page and its copy of the chaptered act. The act amends, among others, the Managed Care Reform and Patient Rights Act (Sections 10, 45 and 85), the Health Carrier External Review Act and the Prior Authorization Reform Act. The chaptered text has no effective-date section; under 5 ILCS 75/1 a bill passed before June 1 that sets no effective date takes effect Jan. 1 of the following year, and this bill passed both houses in May 2024, so it took effect Jan. 1, 2025, the date LegiScan also gives.
SB 3114, Transparency in Downcoding Act (Public Act 104-0568)
Bars a health care payor from using any policy, algorithm or other automated process, system or tool that bypasses evaluation of the billing professional's information to downcode a claim, requires every downcoding determination to be made or reviewed by a natural person following AMA CPT coding guidelines, and requires notice of the specific reason, the original and revised codes and payment amounts, and a dispute process that allows at least 90 days.
Physician read. From Jan. 1, 2028, a payor that downcodes a claim from a physician, physician assistant or advanced practice registered nurse must have a natural person make or review the decision under CPT guidelines, state the specific reason with the clinical information and coding guidance used, list the original and revised codes and payments, and allow at least 90 days to dispute. Automated tools may flag claims for possible downcoding but may not bypass the billing professional's documentation, and payors may not target professionals who routinely treat patients with complex or chronic conditions.
Notes: Status, dates and text come from LegiScan. The enrolled text does not use the term artificial intelligence; it reaches any algorithm or other automated process, system or tool. Section 10(a) applies the act to policies and contracts for health insurance coverage and to State, employee, county, municipality and school district group health plans issued, amended, delivered or renewed on or after the act's Jan. 1, 2028 effective date. It adds Section 5-5.12g to the Illinois Public Aid Code to bind Medicaid managed care organizations. Disputes go to a qualified person who did not make the original downcode. A tracker lead that listed this law as HB 3568 is wrong: HB 3568 (2025) is an unrelated single-payer bill.
HB 35, Artificial Intelligence Systems Use in Health Insurance Act
Would bar a health insurance issuer from issuing an adverse consumer outcome that denies, reduces or terminates coverage or benefits solely on the use of an AI system or predictive model, require that any such AI-driven decision be meaningfully reviewed, under procedures set by Department of Insurance rules, by an individual with authority to override the AI system, who must be a clinical peer when the decision is an adverse determination under the Managed Care Reform and Patient Rights Act, set out the department's authority to examine insurers' AI systems, and let the department adopt rules on disclosing insurers' AI use to consumers.
Physician read. It binds no one yet. As passed by the House, a health insurer could not deny, reduce or terminate coverage or benefits solely on an AI system's or predictive model's output, and when such a decision is an adverse determination under the Managed Care Reform and Patient Rights Act, a clinical peer with authority to override the AI system would have to review it.
Notes: The history and text come from LegiScan. Prefiled Dec. 6, 2024; passed the House Insurance Committee March 11, 2025 (11-6); House Floor Amendment No. 1 adopted and the bill passed the House 79-35 on April 9, 2025; in the Senate it was assigned to the Executive Committee April 23, 2025; the last action was June 2, 2025, when Senate Committee Amendment No. 1 was re-referred to Assignments under Rule 3-9(a). LegiScan lists the bill as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The engrossed text defines an adverse consumer outcome to include any claim denial determined by the use of an AI system; its disclosure section only authorizes rules, which may cover notice before AI use and after an adverse decision, correction of inaccurate information and appeal instructions. It sets no effective date; under 5 ILCS 75/2 a bill passed after May 31 takes effect June 1 of the next year unless three-fifths of each house votes for an earlier date.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054) (under mental health AI); HB 35, Artificial Intelligence Systems Use in Health Insurance Act (under payer and utilization review AI); SB 316, Artificial Intelligence Companion Model Safety Act (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
SB 316, Artificial Intelligence Companion Model Safety Act
Would require operators of AI companions to keep a protocol with reasonable methods to detect users' expressions of suicidal ideation or self-harm, to refer those users to crisis services such as the 988 Suicide and Crisis Lifeline and to prevent content encouraging or describing how to commit self-harm, to post a description of the protocol and the yearly number of crisis referrals on their websites, to tell users at the start of an interaction and at least every 3 hours during it that they are communicating with an automated system and not a human, and to take reasonable measures to keep companions from producing material harmful to minors for users the operator knows to be minors.
Physician read. It binds no one yet; as passed by the Senate, it would take effect Jan. 1, 2027 and would require AI companion operators to refer users who express suicidal ideation or self-harm to crisis services such as 988. It would also amend the Wellness and Oversight for Psychological Resources Act so that a chatbot that complies with this act and does not provide therapy or psychotherapy services falls outside that Act.
Notes: The history and text come from LegiScan. Filed Jan. 24, 2025; passed the Senate Executive Committee March 19, 2025; re-referred to Assignments April 11, 2025; approved for consideration May 7, 2026; Senate Floor Amendments No. 2 and 3 were adopted and the bill passed the Senate 57-0 on May 21, 2026; in the House it was assigned to the Executive Committee and re-referred to the Rules Committee under Rule 19(a) May 31, 2026; an alternate chief co-sponsor was added June 15, 2026. LegiScan lists it as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The engrossed text says the act takes effect Jan. 1, 2027. The Attorney General or a State's Attorney would enforce it as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, with a share of penalties going to the 9-8-8 Trust Fund, and a person who suffers actual damage could sue under that Act. The minors' duty applies to users the operator knows to be minors, based on ages users give or the operator attributes to them; the bill does not require operators to collect new age data.
Also relevant here: HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054) (under mental health AI).
Mental health AI
AI in therapy and mental health care.
HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054)
Bars anyone from providing, advertising or offering therapy or psychotherapy to the public in Illinois, including through internet-based AI, unless a licensed professional conducts it; limits licensed professionals' use of AI to administrative and supplementary support and bars them from letting AI make independent therapeutic decisions, interact therapeutically with clients, generate treatment plans without their review and approval, or detect emotions or mental states; and requires written notice and consent before AI is used on a recorded or transcribed session.
Physician read. Since Aug. 1, 2025, no person or company may offer AI therapy to the public in Illinois, and psychologists, counselors, social workers, marriage and family therapists, psychiatric advanced practice nurses and other licensed therapists may use AI only for administrative and supplementary tasks, with written notice and consent before AI is used on a recorded or transcribed session. The Act's definition of licensed professional excludes physicians; the Department of Financial and Professional Regulation enforces it with civil penalties of up to $10,000 per violation.
Notes: Status, dates and text come from LegiScan; the department's release of Monday, Aug. 4, 2025 says the governor signed the bill the previous Friday. The Act does not apply to religious counseling, peer support, or self-help and educational materials that do not purport to offer therapy. HB 5003 (2026), which would have exempted AI-assisted therapy in qualified research programs, did not leave committee. SB 316 (2025-26), which passed the Senate May 21, 2026 and is pending in the House (separate entry), would add to those exceptions a chatbot that complies with the Artificial Intelligence Companion Model Safety Act and does not provide therapy or psychotherapy services.
Also relevant here: SB 316, Artificial Intelligence Companion Model Safety Act (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
Biometric Information Privacy Act, 740 ILCS 14 (Public Act 95-994)
Requires a private entity to keep a public written policy with a retention schedule and destruction guidelines, to give written notice of the purpose and length of collection and obtain a written release before collecting a biometric identifier or biometric information, and bars selling or profiting from it, with a private right of action for $1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages if greater.
Physician read. The Act excludes information captured from a patient in a health care setting and information collected, used or stored for treatment, payment or operations under HIPAA. Outside those exclusions, a practice that collects fingerprints, face geometry or other biometric identifiers, for example from employees, must give written notice, obtain a written release and follow a public retention and destruction schedule.
Notes: The statute text and its source notes were read on Justia's copy of the 2025 Illinois Compiled Statutes, which cites P.A. 95-994, effective Oct. 3, 2008, for the original sections and P.A. 103-769, effective Aug. 2, 2024, for Sections 10 and 20. The governor's approval date for P.A. 95-994 was not confirmed. The 2024 amendment (SB 2979) is a separate entry.
SB 2979, BIPA-Procedure-Damages (Public Act 103-0769)
Amends the Biometric Information Privacy Act so that a private entity that collects the same person's biometric identifier or information more than once by the same method, or discloses it more than once to the same recipient by the same method, commits a single violation with at most one recovery, and allows the required written release to be given by electronic signature.
Physician read. Since Aug. 2, 2024, a practice or other private entity that repeatedly collects the same person's biometric identifier by the same method without meeting the Act's requirements has committed one violation, with at most one recovery for that person, and the written release the Act requires may be signed electronically.
Notes: Status and dates come from LegiScan, which records the act as effective Aug. 2, 2024, the day the governor approved it. The amended Sections 10 and 20 were read in LegiScan's copy of the chaptered act and on Justia's copy of the statute.
SB 340, Illinois Consumer Data Privacy Act
Would give consumers rights to access, correct, delete and port their personal data, to opt out of targeted advertising, sale and profiling in furtherance of automated decisions with legal or similarly significant effects, including decisions on health care services, and to question the result of such profiling, would require consent before a controller processes sensitive data, which includes mental or physical health conditions and diagnoses, and would require data protection assessments for processing such as sensitive data and certain profiling.
Physician read. It binds no one yet. As passed by the Senate, it would exclude protected health information and health records but not HIPAA-covered practices as such, so a practice that meets its thresholds would have to apply it to personal data it holds that is not protected health information or a health record, and from Jan. 1, 2028 a person who suffers actual damage from a violation could sue.
Notes: The history and text come from LegiScan. Filed Jan. 24, 2025; passed the Senate Executive Committee March 19, 2025; re-referred to Assignments April 11, 2025; approved for consideration May 7, 2026; four Senate floor amendments were adopted and the bill passed the Senate 54-3 on May 21, 2026; in the House it was assigned to the Executive Committee and re-referred to the Rules Committee under Rule 19(a) May 31, 2026. LegiScan lists it as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The health exclusions cover protected health information, health records and information that originates from and is intermingled with them when maintained by a covered entity or business associate acting as such. The Attorney General and State's Attorneys would enforce it through the Consumer Fraud and Deceptive Business Practices Act, after a warning letter and a 30-day cure period that ends Jan. 1, 2028; from Jan. 1, 2028 a person who suffers actual damage could sue under that Act. The engrossed text sets no effective date.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.