{
 "name": "AI health law map",
 "url": "https://physicianintheloop.org/law-map/",
 "updated": "2026-09-29",
 "categories": {
  "payer": "Payer and utilization review AI",
  "disclosure": "Patient disclosure of AI use",
  "clinical": "Clinical decision and chatbot limits",
  "mental-health": "Mental health AI",
  "privacy": "Data and privacy"
 },
 "federal_categories": {
  "devices": "Devices and FDA oversight",
  "clinical": "Clinical decision and chatbot limits",
  "payer": "Payer and utilization review AI",
  "payment": "Payment for AI",
  "privacy": "Data and privacy",
  "mental-health": "Mental health AI",
  "disclosure": "Patient disclosure of AI use",
  "general": "Government-wide AI policy"
 },
 "statuses": {
  "introduced": "Introduced",
  "passed": "Passed",
  "enacted": "Enacted",
  "effective": "In force",
  "failed": "Failed",
  "blocked": "Blocked"
 },
 "laws": [
  {
   "id": "ak-naic-ai-bulletin-2024",
   "state": "AK",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin B24-01, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-02-01",
   "effective": "2024-02-01",
   "applies_to": "Insurers licensed to do business in Alaska",
   "summary": "Adopts the NAIC model bulletin, under which insurers' decisions made or supported by AI systems must comply with insurance law, including unfair trade practice and unfair discrimination laws, and insurers are expected to keep a written AI systems program with governance, risk management and oversight of third-party vendors, with documentation available to regulators.",
   "physician_read": "It places no duty on physicians. Since Feb. 1, 2024, insurers licensed in Alaska have been expected to govern, test and document the AI systems they use in decisions that affect consumers.",
   "sources": [
    {
     "label": "Alaska Division of Insurance, Bulletin B24-01 (scanned PDF)",
     "url": "https://www.commerce.alaska.gov/web/Portals/11/Pub/B24-01.pdf"
    },
    {
     "label": "Alaska Division of Insurance bulletin index",
     "url": "https://www.commerce.alaska.gov/web/ins/Resources/Bulletins"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    },
    {
     "label": "NAIC model bulletin text (secondary)",
     "url": "https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The bulletin is posted as a scanned image, so its wording, addressees and any stated effective date could not be checked. The Division's bulletin index lists 'B24-01, The Use of Artificial Intelligence Systems in Insurance' with a link to that PDF but gives no date; the NAIC's Aug. 31, 2026 adoption map lists Bulletin B 24-01, adopted Feb. 1, 2024, as Alaska's adoption of the model bulletin, and that date is used for issue and effect. The summary and applies_to describe the NAIC model bulletin (addressed to 'All Insurers Licensed to Do Business In' the adopting state), which the map says Alaska adopted.",
   "added": "2026-09-29"
  },
  {
   "id": "al-sb63-2026",
   "state": "AL",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 63, Health care plans; to regulate the use of artificial intelligence in determinations of coverage",
   "status": "enacted",
   "signed": "2026-04-17",
   "effective": "2026-10-01",
   "applies_to": "Health benefit plan providers: entities that issue, deliver or renew health benefit plans, including insurers, health maintenance organizations, nonprofit health care service plans and nonprofit agricultural organizations offering health benefits, and the internal units, contractors or agents that perform their utilization review",
   "summary": "Requires a health benefit plan provider that uses AI to decide medical necessity on prior authorization requests to base those determinations on the enrollee's medical history, clinical circumstances presented by the requesting provider and other clinical information in the medical record, and to certify to the Department of Insurance each year that the AI does not rely on a group dataset to make determinations, is fairly and equitably applied and does not discriminate against any subscriber group or enrollee in violation of state or federal law; requires plan providers to disclose their AI use in utilization review in their policies and procedures, review that use and its outcomes periodically and keep patient data used by the AI to its intended and stated purpose; and requires a licensed physician or other competent health care professional to make every determination to deny, delay or modify a prior authorization request based on medical necessity.",
   "physician_read": "From Oct. 1, 2026, a health benefit plan provider's determination to deny, delay or modify a prior authorization request based on medical necessity must be made by a licensed physician or other health care professional competent to evaluate any AI recommendation in light of the enrollee's specific clinical issues, and a plan that uses AI for these determinations must base them on the enrollee's medical history, the clinical circumstances the requesting provider presents and other clinical information in the medical record. It places no duty on treating physicians.",
   "sources": [
    {
     "label": "Enrolled act",
     "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/SB63-enr.pdf"
    },
    {
     "label": "LegiScan bill page (status and history)",
     "url": "https://legiscan.com/AL/bill/SB63/2026"
    },
    {
     "label": "Holland & Knight (secondary)",
     "url": "https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-regulate-ai-in-healthcare"
    }
   ],
   "checked": "2026-09-29",
   "notes": "LegiScan's history records the bill as enacted April 17, 2026, with no separate signing entry, and Holland & Knight (secondary) gives April 17 as the signing date; the act number was not found on LegiScan's bill or text pages. The House Insurance Committee substitute replaced the Senate text; the entry follows the enrolled act. The act says the requirements of subsections (b) and (c) are satisfied by an attestation by an authorized representative of the plan provider based on reasonable reliance on internal policies, procedures and third-party vendors. The Department of Insurance may investigate, hold a hearing and impose a plan to correct procedures; for repeat violations of subsection (b) frequent enough to indicate a general business pattern or practice, it may impose fines of up to $5,000 or suspend or revoke a certificate of authority. The act directs the department to adopt rules; the department's regulations, bulletins and hearing-notice pages showed none on Sept. 29, 2026. Tracker summaries listed this law as HB 272 and SB 271 (or HB 273); those numbers belong to unrelated 2026 bills.",
   "added": "2026-09-29"
  },
  {
   "id": "al-hb351-2026",
   "state": "AL",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 351, Alabama Personal Data Protection Act",
   "status": "enacted",
   "signed": "2026-04-17",
   "effective": "2027-05-01",
   "applies_to": "Persons that conduct business in Alabama or target products or services to its residents and that control or process personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction) or derive more than 25% of gross revenue from selling personal data; HIPAA covered entities and business associates are exempt as entities and protected health information is exempt, as are businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data",
   "summary": "Gives consumers rights to confirm, correct, delete and obtain a portable copy of their personal data and to opt out of targeted advertising, sale and profiling in furtherance of solely automated significant decisions, a term that includes decisions on health care services, and requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic or biometric data used to identify a person, and precise geolocation.",
   "physician_read": "From May 1, 2027, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health condition or diagnosis, identifying genetic or biometric data or precise geolocation, and must let consumers opt out of profiling used for solely automated decisions on health care services and other significant matters. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.",
   "sources": [
    {
     "label": "Enrolled act",
     "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"
    },
    {
     "label": "LegiScan bill page (status and history)",
     "url": "https://legiscan.com/AL/bill/HB351/2026"
    },
    {
     "label": "Hunton (secondary)",
     "url": "https://www.hunton.com/privacy-and-cybersecurity-law-blog/alabama-becomes-21st-state-with-comprehensive-consumer-privacy-law"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The act does not require data protection assessments. Section 11 provides that the Attorney General may enforce the act and must first issue a notice of violation; if the controller corrects the violation within 45 days and gives the Attorney General an express written statement that it has been corrected and will not recur, no action may be brought, and otherwise a court may assess a civil penalty of up to $15,000 per violation. The text names no other enforcer but does not say the Attorney General's authority is exclusive or use the phrase 'private right of action.' Opt-out preference signals: Section 6(b) requires a controller to offer a clear and conspicuous opt-out link or up-to-date contact information; the act does not define an opt-out preference signal or say how one is sent; Section 6(c)(1) provides that when an opt-out made through an opt-out preference signal 'sent in accordance with this section' conflicts with a consumer's controller-specific privacy setting or loyalty program participation, the controller shall comply with the signal but may notify the consumer. Hunton (secondary) reads the act as not requiring controllers to honor universal opt-out preference signals such as the Global Privacy Control. The signing date comes from LegiScan's history, which records the bill as enacted April 17, 2026, and from Hunton; the act number was not found.",
   "added": "2026-09-29"
  },
  {
   "id": "ar-naic-ai-bulletin-2024",
   "state": "AR",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 13-2024, Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-07-31",
   "effective": "2024-07-31",
   "applies_to": "All insurers licensed to do business in Arkansas, including health insurers",
   "summary": "Expects insurers to develop and maintain a written program for the responsible use of AI systems in insurance decisions, with governance, risk management and controls, oversight of third-party AI systems and data, and documentation available to the department, and reminds them that AI-supported decisions must comply with the Unfair Trade Practices Act and the Unfair Claims Settlement Practices law.",
   "physician_read": "It places no duty on physicians. Since July 31, 2024, an insurer licensed in Arkansas, including a health insurer, is expected to govern the AI systems it uses, including in claim administration and payment, under a written program.",
   "sources": [
    {
     "label": "Bulletin 13-2024",
     "url": "https://portal.insurance.arkansas.gov/LegalPubsPublic/Documents/Bulletins/bulletin_13-2024.pdf"
    },
    {
     "label": "Insurance Department bulletin index",
     "url": "https://portal.insurance.arkansas.gov/LegalPubsPublic/web/bulletins/index?page=4&per-page=10"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Insurance Commissioner Alan McClain. The NAIC's adoption map lists it as Arkansas's adoption of the NAIC Model Bulletin; the bulletin's text refers to the Principles of Artificial Intelligence the NAIC adopted in 2020 but does not name the model bulletin. The bulletin states no separate effective date, so the issue date is used. The department's bulletin index lists Bulletin 13-2024 by number and title without a date; its pages listing Bulletins 4-2024 through 10-2026 show no later AI bulletin.",
   "added": "2026-09-29"
  },
  {
   "id": "az-hb2175-2025",
   "state": "AZ",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "HB 2175, Prior Authorization; Claims",
   "status": "effective",
   "signed": "2025-05-12",
   "effective": "2026-07-01",
   "applies_to": "Health care insurers regulated under Arizona Revised Statutes Title 20",
   "summary": "Requires a health care insurer's medical director to individually review, before it is issued, any denial of a provider-submitted claim on the basis of medical necessity and any direct denial of a provider's prior authorization request that involves medical necessity, exercising independent medical judgment and not relying solely on recommendations from any other source.",
   "physician_read": "Since July 1, 2026, before a health care insurer denies a claim a physician or other provider submitted on the basis of medical necessity, or directly denies a provider's prior authorization request that involves medical necessity, its medical director must individually review the denial, exercise independent medical judgment and not rely solely on recommendations from any other source. The enacted law does not mention artificial intelligence; an explicit ban on using AI to deny claims or prior authorizations appeared in the House version but not in the law as signed.",
   "sources": [
    {
     "label": "Chaptered law, Laws 2025, Chapter 165",
     "url": "https://www.azleg.gov/legtext/57leg/1r/laws/0165.htm"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/AZ/bill/HB2175/2025"
    },
    {
     "label": "House version of HB 2175",
     "url": "https://www.azleg.gov/legtext/57leg/1r/bills/hb2175h.htm"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Approved by the Governor and filed with the Secretary of State May 12, 2025; effective from and after June 30, 2026. Amends A.R.S. Sections 20-3103 (claims) and 20-3407 (prior authorization). The act does not define 'medical director' or 'direct denial.' The enacted text does not use the term 'artificial intelligence.' The House-passed version provided that AI 'may not be used to deny a claim or a prior authorization for medical necessity, experimental status or any other reason that involves the use of medical judgment' and required a health care provider to individually review each such claim or prior authorization; the Senate Finance Committee adopted a strike-everything amendment March 17, 2025, and the enacted text instead requires the medical director's individual review, independent medical judgment and no sole reliance on recommendations from any other source.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab1979-2026",
   "state": "CA",
   "category": "clinical",
   "also": [
    "privacy"
   ],
   "kind": "law",
   "name": "AB 1979, Health Care Services: Artificial Intelligence",
   "status": "passed",
   "signed": "",
   "effective": "",
   "applies_to": "Businesses offering health care chatbots to consumers; health facilities, clinics, physician's offices and group practice offices",
   "summary": "Would deem a business that offers a health care chatbot to consumers, to let them manage their information or for diagnosis, treatment or management of a medical condition, a provider of health care under the Confidentiality of Medical Information Act, and would require health facilities, clinics, physician's offices and group practice offices to take reasonable steps so licensed professionals can exercise independent judgment when a clinical decision support system's output informs care, and bar them from using AI to direct unlicensed staff in, or independently perform, clinical functions that require a license.",
   "physician_read": "It binds no one yet; if it becomes law, from Jan. 1, 2027 a physician's office or group practice would have to take reasonable steps so that licensed clinicians keep the ability to exercise independent professional judgment whenever a clinical decision support system's output informs a patient's care, and could not use AI to direct unlicensed staff in, or independently perform, clinical functions that require a license. Violations by physicians would fall under the Medical Board of California or the Osteopathic Medical Board of California, and businesses offering health care chatbots to consumers would be treated as providers of health care under the Confidentiality of Medical Information Act.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB1979/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB1979/id/3457690"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "Senate 2026 legislative calendar",
     "url": "https://www.senate.ca.gov/system/files/2026-04/2026-proposed-calendar-updated-march-2026.pdf"
    },
    {
     "label": "Governor's legislative update, Sept. 27, 2026",
     "url": "https://www.gov.ca.gov/2026/09/27/governor-newsom-issues-legislative-update-9-27-2026/"
    },
    {
     "label": "Digital Democracy (secondary)",
     "url": "https://calmatters.digitaldemocracy.org/bills/ca_202520260ab1979"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Assembly 48-15 on May 21, 2026 and the Senate 29-9 on Aug. 26; the Assembly concurred 66-10 on Aug. 27 and it was presented to the governor Sept. 4, 2026. The governor has until Sept. 30, 2026 to act: under the California Constitution (art. IV, sec. 10(b)(2)), a bill passed before Sept. 1 of the session's second year and in the governor's possession on or after Sept. 1 that is not returned by Sept. 30 becomes a statute without a signature. No signature or veto appeared on LegiScan or in the governor's legislative updates of Sept. 18, 20 and 27 and his bill releases through Sept. 29. Digital Democracy also showed it pending. Status, dates and text are from LegiScan's bill page and enrolled text. Would add Chapter 25.5 (commencing with Section 22758.5) to Division 8 of the Business and Professions Code and amend Civil Code Sections 56.05 and 56.06; the enrolled text has no urgency clause or operative date, so if enacted it would take effect Jan. 1, 2027 (art. IV, sec. 8(c)(1)). A health care chatbot is defined as a generative AI system with a natural language interface that provides adaptive, human-like responses, is marketed as facilitating or supporting health services and uses information about a consumer's physical or mental health or wellness that the consumer provides or that the chatbot collects, generates or infers. Automated systems for documentation and communication that do not involve professional judgment are exempt, as are trainees in supervised programs; the appropriate licensing board may seek an injunction or restraining order to enforce the section.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab2575-2026",
   "state": "CA",
   "category": "clinical",
   "also": [],
   "kind": "law",
   "name": "AB 2575, Health Care Services: Artificial Intelligence",
   "status": "passed",
   "signed": "",
   "effective": "",
   "applies_to": "Employers of direct patient care workers; those who develop, modify, select or deploy AI clinical decision support systems, when sued",
   "summary": "Would bar an employer from retaliating or discriminating against a worker providing direct patient care based solely on the worker's override of, or reliance on, an AI clinical decision support system's output when making an assessment or decision within the worker's scope of practice, enforced by the Labor Commissioner, and would bar a defendant who developed, modified, selected or deployed such a system from arguing, in a suit alleging the system caused harm, that a clinician's failure to override its output was a superseding cause cutting off liability.",
   "physician_read": "It binds no one yet; if it becomes law, from Jan. 1, 2027 an employer could not retaliate or discriminate against a clinician or other worker providing direct patient care based solely on the worker's override of, or reliance on, a clinical decision support system's output within scope of practice, and a policy requiring workers to accept, defer to or not override that output would not count among the worker's duties. In a suit alleging such a system caused harm, those who developed, modified, selected or deployed it could not argue that a clinician's failure to override its output was a superseding cause; the worker's duties to meet the standard of care and act within scope of practice would remain.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB2575/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB2575/id/3458111"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "Senate 2026 legislative calendar",
     "url": "https://www.senate.ca.gov/system/files/2026-04/2026-proposed-calendar-updated-march-2026.pdf"
    },
    {
     "label": "Governor's legislative update, Sept. 27, 2026",
     "url": "https://www.gov.ca.gov/2026/09/27/governor-newsom-issues-legislative-update-9-27-2026/"
    },
    {
     "label": "Manatt Health AI Policy Tracker (secondary)",
     "url": "https://www.manatt.com/insights/newsletters/health-highlights/manatt-health-health-ai-policy-tracker"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Assembly 48-15 on May 27, 2026; the Senate refused passage 18-10 on Aug. 28, granted reconsideration the same day and passed it 21-10 on Aug. 31, and the Assembly concurred 51-16 the same day; presented to the governor Sept. 15, 2026. The governor has until Sept. 30, 2026 to act: under the California Constitution (art. IV, sec. 10(b)(2)), a bill passed before Sept. 1 of the session's second year and in the governor's possession on or after Sept. 1 that is not returned by Sept. 30 becomes a statute without a signature. No signature or veto appeared on LegiScan or in the governor's legislative updates of Sept. 18, 20 and 27 and his bill releases through Sept. 29. Status, dates and text are from LegiScan's bill page and enrolled text. Would add Civil Code Section 1714.48 and Article 2.7 (commencing with Section 2820) to Chapter 2 of Division 3 of the Labor Code, enforced by the Labor Commissioner; the enrolled text has no urgency clause or operative date, so if enacted it would take effect Jan. 1, 2027 (art. IV, sec. 8(c)(1)). A Labor Commissioner determination would not decide malpractice or licensing matters. A tracker summary in the project's leads described AB 2575 as a psychotherapy consent bill; the enrolled text concerns clinical decision support, Manatt's tracker itself describes its liability rule, and the psychotherapy bill is SB 903.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab489-2025",
   "state": "CA",
   "category": "clinical",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "AB 489, Health Care Professions: Deceptive Terms or Letters: Artificial Intelligence",
   "status": "effective",
   "signed": "2025-10-11",
   "effective": "2026-01-01",
   "applies_to": "Any person or entity that develops or deploys an AI or generative AI system or device",
   "summary": "Applies California's bans on terms, letters and phrases that imply a health care license to anyone who develops or deploys an AI or generative AI system that uses them in its advertising or functionality, and prohibits advertising or functionality indicating or implying that care, advice, reports or assessments offered through AI are provided by a natural person licensed as a health care professional; each use is a separate violation.",
   "physician_read": "Since Jan. 1, 2026, an AI or generative AI system may not use terms, letters or phrases in its advertising or functionality that indicate or imply that its care, advice, reports or assessments come from a licensed health care professional, and the ban reaches both those who develop and those who deploy such systems. Each use is a separate violation subject to the appropriate health care licensing board or enforcement agency, which may seek an injunction or restraining order.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB489/2025"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB489/id/3272936"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "California Lawyers Association (secondary)",
     "url": "https://calawyers.org/privacy-law/signed-and-vetoed-california-ai-privacy-and-technology-related-bills/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 615, Statutes of 2025, approved Oct. 11, 2025; adds Chapter 15.5 (commencing with Section 4999.8) to Division 2 of the Business and Professions Code, where health care profession means any profession licensed or regulated under that division. Status, dates and text are from LegiScan's bill page and chaptered text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2026, the default date for statutes enacted at the 2025 regular session (California Constitution, art. IV, sec. 8(c)(1)) and the date the California Lawyers Association lists.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ag-health-ai-advisory-2025",
   "state": "CA",
   "category": "clinical",
   "also": [
    "payer",
    "disclosure",
    "privacy"
   ],
   "kind": "policy",
   "name": "Attorney General's Legal Advisory on the Application of Existing California Law to Artificial Intelligence in Healthcare",
   "status": "effective",
   "signed": "2025-01-13",
   "effective": "2025-01-13",
   "applies_to": "Health care providers, insurers, vendors, investors and other entities that develop, sell or use AI in health care",
   "summary": "Sets out the Attorney General's Office's view of how existing California consumer protection, civil rights, competition and privacy laws apply to AI in health care, including that California law does not allow delegation of the practice of medicine to AI, that health plans may not use AI to deny, delay or modify care based on medical necessity, that AI with discriminatory effects can violate anti-discrimination law, that deceptive development, marketing or use of AI can violate the Unfair Competition Law, and that medical information handled by AI must stay confidential.",
   "physician_read": "The Attorney General's Office says California law does not allow delegation of the practice of medicine to AI, and that using AI to make decisions about patients' medical treatment, or to override licensed providers' determinations of a patient's medical needs, may violate the ban on the corporate practice of medicine. It also says physicians may violate conflict-of-interest law if they or a family member have a financial interest in AI services, and that discriminatory or deceptive uses of AI and mishandling of patients' medical information can violate existing civil rights, consumer protection and privacy laws.",
   "sources": [
    {
     "label": "Legal advisory",
     "url": "https://oag.ca.gov/system/files/attachments/press-docs/Final%20Legal%20Advisory%20-%20Application%20of%20Existing%20CA%20Laws%20to%20Artificial%20Intelligence%20in%20Healthcare.pdf"
    },
    {
     "label": "Attorney General release, Jan. 13, 2025",
     "url": "https://oag.ca.gov/news/press-releases/attorney-general-bonta-issues-legal-advisories-application-california-law-ai"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Guidance on existing law; it creates no new statute or rule. The document carries no date; the Attorney General's release of Jan. 13, 2025 announced it together with a general consumer legal advisory on AI, which the health care advisory refers to. It cites SB 1120's amendments to the Knox-Keene Act and the Insurance Code but does not discuss AB 3030. It says providers 'should' be transparent with patients about whether patient information is used to train AI and how they use AI in decisions affecting health care.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb1119-2026",
   "state": "CA",
   "category": "clinical",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "SB 1119, Companion Chatbots: Children's Safety",
   "status": "enacted",
   "signed": "2026-09-10",
   "effective": "2027-07-01",
   "applies_to": "Operators of companion chatbots available in California, as to users under 18 (workplace-only and postsecondary educational chatbots exempt)",
   "summary": "Requires companion chatbot operators to determine users' ages or apply child protections to all users, assess and mitigate risks to children, keep a crisis protocol that refers a child at risk of suicide or self-harm to crisis services and, for a credible and imminent threat, notifies a parent with a linked account unless that would risk serious harm to the child and offers streamlined access to the 988 crisis line, take reasonable measures to prevent chatbots from encouraging self-harm, suicidal ideation, narcotics or alcohol consumption or disordered eating and from attempting to diagnose or treat a child's health unless the chatbot is designed for that purpose and regulated by the FDA as a medical device and under HIPAA, limit advertising and data use, and obtain independent child-safety audits.",
   "physician_read": "It places no duty on physicians. From July 1, 2027, operators must take reasonable measures to prevent companion chatbots from encouraging a child's self-harm, suicidal ideation or disordered eating and from attempting to diagnose or treat the child's physical, mental or behavioral health, unless the chatbot is designed for that purpose and regulated by the FDA as a medical device and under HIPAA.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB1119/2025"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB1119/id/3458519"
    },
    {
     "label": "AB 1405 bill page (LegiScan)",
     "url": "https://legiscan.com/CA/bill/AB1405/2025"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "Kelley Drye (secondary)",
     "url": "https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/californias-2026-legislative-session-wraps-a-wave-of-privacy-and-ai-bills-reaches-the-governor-with-key-child-safety-and-ai-measures-signed-into-law"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 190, Statutes of 2026, approved and filed Sept. 10, 2026; amends Business and Professions Code Section 22602 (from SB 243) and adds Chapter 11.6 (commencing with Section 21810) to Division 8. Status, dates and text are from LegiScan's bill page and chaptered text. Sections 21812, 21812.5 and 21813, which hold the risk assessment, crisis protocol, default settings, record preservation, advertising and data duties, become operative July 1, 2027; Section 21811, on determining age or applying child protections to all users, sets no date of its own and refers to those protections. Parental default settings for children disable persistent conversational memory and push notifications and limit use to one hour per session and two hours per day. First child-safety audits are due by Jan. 1, 2029, or before a chatbot is first made publicly available, whichever is later, then every two years, with summaries to the Attorney General; operators with less than $500 million in prior-year gross revenue are exempt from audits before Jan. 1, 2032. Section 21814 exists in two versions keyed to AB 1405 (2025), which was approved Sept. 9, 2026 (Chapter 178, Statutes of 2026), so the version that applies when AB 1405 takes effect by Jan. 1, 2027 governs; it omits the other version's auditor independence and qualification subdivision, while the act still defines a child safety audit as one conducted by an independent third-party auditor. Public prosecutors, including the Attorney General and district attorneys, may seek civil penalties of $5,000 per affected child for a negligent violation and $15,000 for an intentional one, and a child who suffers actual harm (financial harm of more than $1,000 or serious emotional distress) from a violation of specified protections, or a parent or guardian on the child's behalf, may sue for actual damages and attorney's fees. The act has no urgency clause and sets no date for its amendment of Section 22602, which deletes SB 243's minor-specific duties; that change takes effect Jan. 1, 2027 under the default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)). Kelley Drye's summary (secondary) also gives the Sept. 10, 2026 signing date.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb243-2025",
   "state": "CA",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 243, Companion Chatbots",
   "status": "effective",
   "signed": "2025-10-13",
   "effective": "2026-01-01",
   "applies_to": "Operators of companion chatbot platforms available in California (customer service, business operations, limited game bots and certain voice-activated devices excluded)",
   "summary": "Requires companion chatbot operators to disclose clearly that the chatbot is artificially generated and not human when a reasonable person could be misled, maintain and publish a protocol for preventing suicidal ideation, suicide or self-harm content that refers users who express such thoughts to crisis services, add protections for users known to be minors, and report annually to the Office of Suicide Prevention from July 1, 2027; a person injured by a violation may sue for the greater of actual damages or $1,000 per violation.",
   "physician_read": "It places no duty on physicians. Since Jan. 1, 2026, operators must refer users who express suicidal ideation, suicide or self-harm to crisis services such as a suicide hotline or crisis text line and must remind users known to be minors at least every three hours that the chatbot is AI, a duty SB 1119 deletes from Jan. 1, 2027; from July 1, 2027 operators report yearly to the Office of Suicide Prevention on crisis referrals and their protocols.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB243/2025"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB243/id/3273344"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 677, Statutes of 2025, approved Oct. 13, 2025; adds Chapter 22.6 (commencing with Section 22601) to Division 8 of the Business and Professions Code. Status, dates and text are from LegiScan's bill page and chaptered text. The act has no urgency clause and no general operative date, so its duties began Jan. 1, 2026, the default date for statutes enacted at the 2025 regular session (California Constitution, art. IV, sec. 8(c)(1)); annual reporting starts July 1, 2027. SB 1119 (2026), signed Sept. 10, 2026, deletes the minor-specific duties from Section 22602 without setting a date, so that change takes effect Jan. 1, 2027 under the same rule, and adds broader child-safety duties operative July 1, 2027 (next entry). AB 1064 (2025), a stricter bill on minors' use of companion chatbots, was vetoed Oct. 13, 2025.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb503-2025",
   "state": "CA",
   "category": "clinical",
   "also": [],
   "kind": "law",
   "name": "SB 503, Health Care Services: Artificial Intelligence",
   "status": "passed",
   "signed": "",
   "effective": "",
   "applies_to": "Developers of AI clinical decision support systems and the health facilities, clinics, physician's offices and group practices that use them",
   "summary": "Would require developers and deployers of AI clinical decision support systems to make reasonable efforts to identify systems with a known or reasonably foreseeable risk of biased impacts, meaning adverse effects on access to care, quality of care or outcomes based on protected characteristics, and to mitigate that risk, require developers to give deployers documentation on intended uses, training data, performance evaluation, data governance and bias risks, and require deployers to monitor the systems regularly.",
   "physician_read": "It binds no one yet; if it becomes law, from Jan. 1, 2027 a physician's office or group practice that uses an AI clinical decision support system would have to make reasonable efforts to identify systems with known or reasonably foreseeable risks of biased impacts on patients based on protected characteristics, monitor them regularly and take reasonable, proportionate steps to mitigate those risks. Developers would owe the practice documentation on intended uses, training data, performance evaluation and bias risks, on request or at the initial sale, whichever is earlier.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB503/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB503/id/3457135"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "Senate 2026 legislative calendar",
     "url": "https://www.senate.ca.gov/system/files/2026-04/2026-proposed-calendar-updated-march-2026.pdf"
    },
    {
     "label": "Governor's legislative update, Sept. 27, 2026",
     "url": "https://www.gov.ca.gov/2026/09/27/governor-newsom-issues-legislative-update-9-27-2026/"
    },
    {
     "label": "Transparency Coalition (secondary)",
     "url": "https://www.transparencycoalition.ai/news/ai-legislative-update-september4-2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced in 2025; passed the Senate 38-0 on May 29, 2025, was moved to the Assembly inactive file Sept. 10, 2025 and taken from it Aug. 12, 2026, passed the Assembly 70-1 on Aug. 24, 2026, and won Senate concurrence 39-0 on Aug. 25; presented to the governor Aug. 30, 2026. The governor has until Sept. 30, 2026 to act: under the California Constitution (art. IV, sec. 10(b)(2)), a bill passed before Sept. 1 of the session's second year and in the governor's possession on or after Sept. 1 that is not returned by Sept. 30 becomes a statute without a signature. No signature or veto appeared on LegiScan or in the governor's legislative updates of Sept. 18, 20 and 27 and his bill releases through Sept. 29. Status, dates and text are from LegiScan's bill page and enrolled text. Would add Chapter 25.3 (commencing with Section 22758) to Division 8 of the Business and Professions Code. The enrolled text names no enforcing agency, penalty, urgency clause or operative date, so if enacted it would take effect Jan. 1, 2027 (art. IV, sec. 8(c)(1)); it states that compliance is not a defense to a discrimination claim. Developers may meet some duties by following nationally recognized or widely adopted industry standards for bias testing or by providing algorithmic impact assessments.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab3030-2024",
   "state": "CA",
   "category": "disclosure",
   "also": [],
   "kind": "law",
   "name": "AB 3030, Health Care Services: Artificial Intelligence",
   "status": "effective",
   "signed": "2024-09-28",
   "effective": "2025-01-01",
   "applies_to": "Health facilities, clinics, physician's offices and group practice offices that use generative AI to generate patient communications about clinical information",
   "summary": "Requires a health facility, clinic, physician's office or group practice office that uses generative AI to generate written or verbal patient communications pertaining to patient clinical information to include a disclaimer that the communication was generated by generative AI, placed according to the medium, and clear instructions for reaching a human health care provider or other appropriate person, unless a licensed or certified human health care provider has read and reviewed the communication.",
   "physician_read": "Since Jan. 1, 2025, a patient message about clinical information generated by generative AI must carry a disclaimer (at the start of a letter or email, throughout a chat or video, and at the start and end of an audio call) and instructions for reaching a human, unless a licensed or certified provider read and reviewed it; messages about scheduling, billing and other administrative matters are outside the rule. A physician's violation falls under the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB3030/2023"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB3030/id/3023359"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 848, Statutes of 2024, approved Sept. 28, 2024; adds Chapter 2.13 (commencing with Section 1339.75) to Division 2 of the Health and Safety Code. Status, dates and text are from LegiScan's bill page and chaptered text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2025 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)). Violations by health facilities and clinics are enforced under existing Health and Safety Code licensing provisions. AB 1979 (2026), awaiting the governor, borrows this section's definitions of physician's office and office of a group practice.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb903-2026",
   "state": "CA",
   "category": "mental-health",
   "also": [
    "clinical",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 903, Mental Health Professionals: Artificial Intelligence (Wellness and Oversight for Psychological Resources Act)",
   "status": "passed",
   "signed": "",
   "effective": "",
   "applies_to": "Anyone who provides or facilitates psychotherapy services, including psychiatrists and other licensed professionals and their employers",
   "summary": "Would limit AI in psychotherapy to administrative and supplementary support; require telling a patient, verbally or in writing, that AI will be used and its specific purpose, and obtaining consent, before AI records or transcribes psychotherapy sessions, psychotherapeutic communications or triage and screening; bar letting AI make therapeutic decisions, interact directly with patients in psychotherapeutic communication, generate recommendations, assessments, diagnoses or treatment plans, detect emotions or mental states, or perform triage or screening without a licensed professional's review and approval, except that FDA-approved or cleared, HIPAA-compliant tools may interact directly for their approved use; and bar advertising companion chatbot services as psychotherapy.",
   "physician_read": "It binds no one yet; if it becomes law, from Jan. 1, 2027 a psychiatrist or other licensed professional would have to tell the patient, verbally or in writing, that AI will be used and for what specific purpose, and obtain consent, before AI records or transcribes psychotherapy sessions, psychotherapeutic communications, or triage or screening, and a patient who declines keeps all rights to care. AI could not make therapeutic decisions, generate recommendations, assessments, diagnoses or treatment plans, detect emotions or mental states, or perform triage or screening without the professional's review and approval, and could not interact directly with patients in psychotherapeutic communication without that review unless the tool is approved or cleared by the FDA for that use and HIPAA-compliant.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB903/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB903/id/3458147"
    },
    {
     "label": "Assembly roll call, Aug. 30, 2026 (LegiScan)",
     "url": "https://legiscan.com/CA/rollcall/SB903/id/1727290"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "Senate 2026 legislative calendar",
     "url": "https://www.senate.ca.gov/system/files/2026-04/2026-proposed-calendar-updated-march-2026.pdf"
    },
    {
     "label": "Governor's legislative update, Sept. 27, 2026",
     "url": "https://www.gov.ca.gov/2026/09/27/governor-newsom-issues-legislative-update-9-27-2026/"
    },
    {
     "label": "Sen. Padilla release (secondary)",
     "url": "https://sd18.senate.ca.gov/news/trump-pushes-ai-therapy-bots-licensed-professionals-urge-newsom-sign-padillas-sb-903"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Senate 39-0 on May 19, 2026 and the Assembly 74-1 on Aug. 30, 2026 (LegiScan roll call, four absent; the author's office reported 71-4); the Senate concurred 40-0 on Aug. 31 and it was presented to the governor Sept. 9, 2026. The governor has until Sept. 30, 2026 to act: under the California Constitution (art. IV, sec. 10(b)(2)), a bill passed before Sept. 1 of the session's second year and in the governor's possession on or after Sept. 1 that is not returned by Sept. 30 becomes a statute without a signature. No signature or veto appeared on LegiScan or in the governor's legislative updates of Sept. 18, 20 and 27 and his bill releases through Sept. 29. Status, dates and text are from LegiScan's bill page, roll call and enrolled text. Would add Chapter 13.6 (commencing with Section 4989.80) to Division 2 of the Business and Professions Code; the enrolled text has no urgency clause or operative date, so if enacted it would take effect Jan. 1, 2027 (art. IV, sec. 8(c)(1)). Licensing boards would enforce it and may seek injunctions; no penalty amount or private right of action is set. A licensed professional would not be disciplined for a violation caused solely by a tool feature outside the professional's control when the employer or contracting entity required the tool, and the employer or contracting entity would be responsible for compliant deployment. AI could still suggest that a person discuss psychotherapy with a licensed professional, administer and score standardized screening questionnaires for a professional's review, and handle scheduling that involves no psychotherapeutic communication. Religious counseling, peer support, self-help and educational materials that do not purport to offer psychotherapy, AI used solely for training or simulation, and research by academic or nonprofit institutions under federal human-subject and privacy rules are exempt. Psychotherapy data could not be shared, sold, stored or used to train models inconsistently with applicable law, and records must comply with the Confidentiality of Medical Information Act.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-cdi-guidance-sb1120-1-2025",
   "state": "CA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Department of Insurance Guidance SB 1120:1, Use of Artificial Intelligence, Algorithms and Other Software Tools in Utilization Management",
   "status": "effective",
   "signed": "2025-05-05",
   "effective": "2025-05-05",
   "applies_to": "Health insurers regulated by the Department of Insurance and entities performing utilization review or management for them",
   "summary": "Explains how insurers meet SB 1120 when decision support tools are used in prospective, retrospective and concurrent utilization review: determinations must rest on the insured's own clinical history, circumstances and other relevant clinical information, tools may not deny, delay or modify care based on medical necessity or supplant provider decision-making, medical necessity determinations stay with a licensed physician or competent licensed professional, and insurers must disclose tool use in written policies, open tools to department inspection and audit, and review their performance.",
   "physician_read": "The guidance places no duty on physicians; it tells insurers regulated by the Department of Insurance that SB 1120's limits on AI and other decision support tools apply in prospective, retrospective and concurrent review alike. It also reminds insurers covered by Section 1557 of the Affordable Care Act of the federal duty to identify and mitigate discrimination risks from such tools.",
   "sources": [
    {
     "label": "Guidance SB 1120:1",
     "url": "https://www.insurance.ca.gov/0250-insurers/0500-legal-info/0200-regulations/HealthGuidance/upload/SB-1120-1-Guidance-Use-of-Artificial-Intelligence-Algorithms-and-Other-Software-Tools-in-Utilization-Management.pdf"
    },
    {
     "label": "Department of Insurance health guidance list",
     "url": "https://www.insurance.ca.gov/0250-insurers/0500-legal-info/0200-regulations/HealthGuidance/index.cfm"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Dated May 5, 2025 on the department's health guidance list. It sets no filing, attestation or reporting deadline. Health plans licensed by the Department of Managed Health Care are covered by SB 1120's parallel Health and Safety Code provision; no AI-specific All Plan Letter from that department was found in its 2024 to 2026 list.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb1120-2024",
   "state": "CA",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 1120, Health Care Coverage: Utilization Review",
   "status": "effective",
   "signed": "2024-09-28",
   "effective": "2025-01-01",
   "applies_to": "Health care service plans, including specialized plans, and disability insurers that use AI or other software tools in utilization review or management, directly or through contractors",
   "summary": "Requires a plan or insurer that uses an AI, algorithm or other software tool, directly or through a contractor, for utilization review or management based in whole or in part on medical necessity to ensure the tool bases determinations on the enrollee's own medical or clinical history and individual clinical circumstances rather than solely on a group dataset, does not supplant provider decision-making or discriminate, is open to state inspection and audit, and is periodically reviewed; the tool may not deny, delay or modify care based on medical necessity, a determination reserved for a licensed physician or a licensed health care professional competent to evaluate the clinical issues.",
   "physician_read": "Since Jan. 1, 2025, a health plan or insurer regulated in California cannot deny, delay or modify requested care on medical necessity grounds through an AI or other software tool; only a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues may make that determination. The tool must rest on the patient's own history, clinical circumstances as presented by the requesting provider and other clinical information in the record, not solely on a group dataset.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB1120/2023"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB1120/id/3023335"
    },
    {
     "label": "DMHC All Plan Letter 24-023",
     "url": "https://dmhc.ca.gov/Portals/0/Docs/OPL/APL24-023(OPL)-NewlyEnactedStatutesImpactingHealthPlans(2024LegislativeSession)_1.pdf?ver=pTIM7g7dnX3EcRmQPw1xkg%3D%3D"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 879, Statutes of 2024, approved Sept. 28, 2024; amends Health and Safety Code Section 1367.01 (plans licensed by the Department of Managed Health Care) and Insurance Code Section 10123.135 (disability insurers regulated by the Department of Insurance). Status, dates and text are from LegiScan's bill page and chaptered text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2025 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)); the Department of Managed Health Care's All Plan Letter 24-023 (Dec. 20, 2024) also gives Jan. 1, 2025 and set a March 21, 2025 compliance filing for plans. The Department of Insurance's guidance on the act is the next entry.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab1008-2024",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "AB 1008, California Consumer Privacy Act of 2018: Personal Information",
   "status": "effective",
   "signed": "2024-09-28",
   "effective": "2025-01-01",
   "applies_to": "Businesses covered by the California Consumer Privacy Act",
   "summary": "Specifies that personal information under the California Consumer Privacy Act can exist in physical formats, digital formats and abstract digital formats, including compressed or encrypted files, metadata and artificial intelligence systems capable of outputting personal information.",
   "physician_read": "Since Jan. 1, 2025, the act's definition of personal information states that it can exist in abstract digital formats, including AI systems capable of outputting personal information, so such systems held by a covered business can contain personal information subject to the act. For a medical practice that meets a threshold, this reaches only personal information outside the act's exemptions for medical information, protected health information and patient information a provider maintains in the same manner.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB1008/2023"
    },
    {
     "label": "Bill text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB1008/2023"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 802, Statutes of 2024, approved Sept. 28, 2024; amends Civil Code Section 1798.140. Status, dates and text are from LegiScan's bill page and bill text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2025 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)).",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab2013-2024",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "AB 2013, Generative Artificial Intelligence: Training Data Transparency",
   "status": "effective",
   "signed": "2024-09-28",
   "effective": "2026-01-01",
   "applies_to": "Developers of generative AI systems or services released on or after Jan. 1, 2022 and made publicly available to Californians",
   "summary": "Requires developers, by Jan. 1, 2026 and before each later public release of a system or substantial modification, to post on their websites documentation of the data used to train a generative AI system, including dataset sources and owners, the number and types of data points, whether the datasets include copyrighted material, personal information or aggregate consumer information as defined in the California Consumer Privacy Act, any cleaning or processing, collection periods and use of synthetic data; systems whose sole purpose is security and integrity or the operation of aircraft in the national airspace, and systems developed for national security, military or defense purposes and made available only to a federal entity, are exempt.",
   "physician_read": "It places no duty on physicians who only use generative AI tools. Since Jan. 1, 2026, developers of generative AI systems made available to Californians, including clinical ones, must post whether their training datasets included personal information or aggregate consumer information.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB2013/2023"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB2013/id/3023192"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 817, Statutes of 2024, approved Sept. 28, 2024; adds Title 15.2 (commencing with Section 3110) to Part 4 of Division 3 of the Civil Code (Sections 3110 and 3111). Status, dates and text are from LegiScan's bill page and bill text. The statute took effect Jan. 1, 2025 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)); the first documentation was due Jan. 1, 2026, the date used.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab2089-2022",
   "state": "CA",
   "category": "privacy",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "AB 2089, Privacy: Mental Health Digital Services: Mental Health Application Information",
   "status": "effective",
   "signed": "2022-09-28",
   "effective": "2023-01-01",
   "applies_to": "Businesses that offer mental health apps or websites (mental health digital services) to consumers",
   "summary": "Amends the Confidentiality of Medical Information Act to include mental health application information in medical information and to deem a business that offers a mental health digital service, an app or website that collects information on a consumer's inferred or diagnosed mental health or substance use disorder, markets itself as facilitating mental health services and uses the information to do so, a provider of health care subject to the act.",
   "physician_read": "Since Jan. 1, 2023, mental health apps and websites offered to consumers in California must keep users' mental health information confidential to the standard the Confidentiality of Medical Information Act sets for providers of health care. A business that partners with a provider of health care to offer such a service must give the provider information on how to find data breaches reported on the Attorney General's website.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB2089/2021"
    },
    {
     "label": "Bill text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB2089/2021"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 690, Statutes of 2022, approved Sept. 28, 2022; amends Civil Code Sections 56.05 and 56.06 and adds Chapter 4.1 (commencing with Section 56.251). Status, dates and text are from LegiScan's bill page and bill text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2023 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)). AB 254 (2023) extended the same treatment to reproductive or sexual health apps, and AB 1979 (2026), awaiting the governor, would extend it to health care chatbots.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab254-2023",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "AB 254, Confidentiality of Medical Information Act: Reproductive or Sexual Health Application Information",
   "status": "effective",
   "signed": "2023-09-27",
   "effective": "2024-01-01",
   "applies_to": "Businesses that offer reproductive or sexual health apps or websites to consumers",
   "summary": "Amends the Confidentiality of Medical Information Act to cover reproductive or sexual health application information, such as data on a consumer's reproductive health, menstrual cycle, fertility, pregnancy and sexual activity collected by an app or website that markets itself as facilitating reproductive or sexual health services, and deems a business offering such a service a provider of health care subject to the act.",
   "physician_read": "Since Jan. 1, 2024, period-tracking, fertility and other reproductive or sexual health apps offered to consumers in California must keep that information confidential to the standard the Confidentiality of Medical Information Act sets for providers of health care. It places no new duty on physicians.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB254/2023"
    },
    {
     "label": "Bill text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB254/2023"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 254, Statutes of 2023, approved Sept. 27, 2023; amends Civil Code Sections 56.05 and 56.06. Status, dates and text are from LegiScan's bill page and bill text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2024 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)). Builds on AB 2089 (2022), which did the same for mental health apps.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ab45-2025",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "AB 45, Privacy: Health Data: Location and Research",
   "status": "effective",
   "signed": "2025-09-26",
   "effective": "2026-01-01",
   "applies_to": "Anyone collecting personal information at or near family planning centers or geofencing in-person health care providers",
   "summary": "Bars collecting, using, disclosing, selling, sharing or retaining the personal information of people at or within a precise geolocation (a 1,850-foot radius) of a family planning center except as needed to provide the goods or services they request, bars geofencing an entity that provides in-person health care services to identify or track people seeking, receiving or providing care, collect their personal information, or send them notifications or advertisements related to their personal information or health care services, and limits release of personally identifying research records in response to out-of-state or foreign legal actions that interfere with reproductive rights.",
   "physician_read": "Since Jan. 1, 2026, no one may geofence an entity that provides in-person health care services in California to identify or track people seeking, receiving or providing care, collect their personal information, or send them notifications or advertisements related to their personal information or care, with a civil penalty of $25,000 per violation in actions by the Attorney General. A person that owns, operates, manages or provides services to the entity may still geofence the entity's own location to provide necessary health care services, and reproductive health care providers may use geofencing for security.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/AB45/2025"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB45/2025"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    },
    {
     "label": "California Lawyers Association (secondary)",
     "url": "https://calawyers.org/privacy-law/signed-and-vetoed-california-ai-privacy-and-technology-related-bills/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 134, Statutes of 2025, approved Sept. 26, 2025; adds Civil Code Sections 1798.99.91 to 1798.99.93 and amends Health and Safety Code Section 140 so geofencing penalties go to the California Reproductive Justice and Freedom Fund. Status, dates and text are from LegiScan's bill page and chaptered text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2026, the default date for statutes enacted at the 2025 regular session (California Constitution, art. IV, sec. 8(c)(1)) and the date the California Lawyers Association lists. Providers of health care, health care service plans and contractors as defined in the Confidentiality of Medical Information Act, and HIPAA covered entities and business associates, are exempt from the family planning center provision, contractors and business associates only if contractually obligated to comply with applicable state and federal privacy laws; under that provision an aggrieved person or entity, including a family planning center, may sue within three years of discovery for three times actual damages and attorney's fees. Other geofencing exceptions cover lawful warrants or subpoenas, emergencies, research approved by an institutional review board with informed consent, and labor organizations.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-ccpa-2018",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "AB 375, California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Proposition 24)",
   "status": "effective",
   "signed": "2018-06-28",
   "effective": "2020-01-01",
   "applies_to": "For-profit businesses doing business in California with annual gross revenue over $26.625 million (the statute's $25 million, adjusted from Jan. 1, 2025), or that buy, sell or share the personal information of 100,000 or more consumers or households, or derive half or more of annual revenue from selling or sharing it",
   "summary": "Gives California consumers rights to know, delete and correct personal information, opt out of its sale or sharing, and limit a business's use and disclosure of sensitive personal information, which includes personal information collected and analyzed concerning health, biometric information processed to identify a person, precise geolocation and, since 2025, neural data; enforced by the California Privacy Protection Agency and the Attorney General, with a private right of action for certain data breaches.",
   "physician_read": "The act does not apply to medical information governed by the Confidentiality of Medical Information Act, protected health information collected by a HIPAA covered entity or business associate, or a provider of health care or covered entity to the extent it maintains patient information in the same manner as that information. A practice that meets one of the act's thresholds must honor consumers' rights to know, delete, correct, opt out of sale or sharing and limit use of sensitive personal information for other personal information it collects.",
   "sources": [
    {
     "label": "LegiScan bill page (AB 375)",
     "url": "https://legiscan.com/CA/bill/AB375/2017"
    },
    {
     "label": "AB 375 chaptered text (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB375/2017"
    },
    {
     "label": "Statute text (CPPA)",
     "url": "https://cppa.ca.gov/regulations/pdf/cppa_act.pdf"
    },
    {
     "label": "AB 713 chaptered text, Section 1798.146 (LegiScan)",
     "url": "https://legiscan.com/CA/text/AB713/2019"
    },
    {
     "label": "CPPA FAQ (revenue threshold)",
     "url": "https://cppa.ca.gov/faq.html"
    },
    {
     "label": "Attorney General",
     "url": "https://oag.ca.gov/privacy/ccpa"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 55, Statutes of 2018, approved June 28, 2018; Section 1798.198 made the title operative Jan. 1, 2020. Voters approved Proposition 24, the California Privacy Rights Act, in November 2020; its amendments, including the sensitive personal information category and the California Privacy Protection Agency, began Jan. 1, 2023, according to the Attorney General. The statute's $25 million revenue threshold is adjusted for inflation; the agency lists $26.625 million from Jan. 1, 2025. The medical exemption is in Civil Code Section 1798.146(a), added by AB 713 (Chapter 172, Statutes of 2020), and appears as Section 1798.145(c)(1) in the statute text the agency posts: business associates are exempt to the same extent as covered entities, and clinical trial information and certain deidentified patient information are also exempt. The agency's posted statute text is current through a July 2024 amendment (AB 3286). Later amendments on this map: SB 1223 (neural data) and AB 1008 (AI systems as a format of personal information), both 2024; the agency's 2025 regulations cover automated decisionmaking technology, risk assessments and cybersecurity audits.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-cppa-admt-regs-2025",
   "state": "CA",
   "category": "privacy",
   "also": [
    "disclosure"
   ],
   "kind": "rule",
   "name": "CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations",
   "status": "effective",
   "signed": "2025-07-24",
   "effective": "2026-01-01",
   "applies_to": "Businesses subject to the California Consumer Privacy Act",
   "summary": "Requires businesses that use automated decisionmaking technology to make significant decisions, including decisions that result in the provision or denial of health care services, to give consumers a pre-use notice, a right to opt out (subject to exceptions such as a human appeal process) and a right to access information about its use by Jan. 1, 2027; requires risk assessments for covered processing, including processing sensitive personal information and using such technology for significant decisions, with attestations and summaries due to the California Privacy Protection Agency by April 1, 2028; and phases in cybersecurity audit certifications due April 1, 2028, 2029 or 2030 depending on revenue.",
   "physician_read": "From Jan. 1, 2027, a business covered by the act that uses automated decisionmaking technology, meaning technology that replaces or substantially replaces human decisionmaking, to make a decision that results in the provision or denial of health care services must give consumers a pre-use notice, a right to opt out unless an exception such as a human appeal process applies, and a right to access information about the technology's logic and the decision's outcome. For a medical practice that meets a threshold, the rules reach only personal information outside the act's exemptions for medical information governed by the Confidentiality of Medical Information Act, protected health information and patient information a provider maintains in the same manner.",
   "sources": [
    {
     "label": "CPPA rulemaking page",
     "url": "https://cppa.ca.gov/regulations/ccpa_updates.html"
    },
    {
     "label": "Approved regulation text",
     "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"
    },
    {
     "label": "Final statement of reasons and updated informative digest",
     "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_fsor_and_uid.pdf"
    },
    {
     "label": "CPPA announcement",
     "url": "https://cppa.ca.gov/announcements/2025/20250923.html"
    },
    {
     "label": "CPPA regulations index",
     "url": "https://cppa.ca.gov/regulations/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Adopted by the agency's board July 24, 2025; approved by the Office of Administrative Law and filed with the Secretary of State Sept. 22, 2025; effective Jan. 1, 2026, when risk assessment duties began. Section 7200(b) sets Jan. 1, 2027 as the compliance date for the automated decisionmaking rules (Article 11, Sections 7200 to 7222). Risk assessments for processing that began before Jan. 1, 2026 must be completed by Dec. 31, 2027, and attestations and summaries are due April 1, 2028. Cybersecurity audit certifications are due April 1, 2028 for businesses with revenue over $100 million, April 1, 2029 for $50 million to $100 million and April 1, 2030 for under $50 million. The agency's regulations page said it had no proposed regulation packages as of Sept. 29, 2026. Only the early sections of the approved text could be checked; its definitions of automated decisionmaking technology, significant decision and health care services were confirmed there, and the notice, opt-out, access and risk assessment duties come from the agency's final statement of reasons and its Sept. 23, 2025 announcement.",
   "added": "2026-09-29"
  },
  {
   "id": "ca-sb1223-2024",
   "state": "CA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 1223, Consumer Privacy: Sensitive Personal Information: Neural Data",
   "status": "effective",
   "signed": "2024-09-28",
   "effective": "2025-01-01",
   "applies_to": "Businesses covered by the California Consumer Privacy Act",
   "summary": "Adds neural data, defined as information generated by measuring the activity of a consumer's central or peripheral nervous system and not inferred from nonneural information, to the California Consumer Privacy Act's categories of sensitive personal information.",
   "physician_read": "Since Jan. 1, 2025, neural data, information generated by measuring the activity of a consumer's central or peripheral nervous system and not inferred from nonneural information, is sensitive personal information under the act, so consumers may direct a covered business that collects it to limit its use to what is necessary to provide the goods or services they reasonably expect, unless it is collected or processed without the purpose of inferring characteristics about them. For a medical practice that meets a threshold, the rule reaches only neural data outside the act's exemptions for medical information, protected health information and patient information a provider maintains in the same manner.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CA/bill/SB1223/2023"
    },
    {
     "label": "Bill text (LegiScan)",
     "url": "https://legiscan.com/CA/text/SB1223/2023"
    },
    {
     "label": "CCPA statute text, Section 1798.121 (CPPA)",
     "url": "https://cppa.ca.gov/regulations/pdf/cppa_act.pdf"
    },
    {
     "label": "California Constitution, art. IV (Assembly Clerk)",
     "url": "https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/ARTICLE_IV_Session_2017-18.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 887, Statutes of 2024, approved Sept. 28, 2024; amends Civil Code Section 1798.140. Status, dates and text are from LegiScan's bill page and bill text. The act has no urgency clause or operative date, so it took effect Jan. 1, 2025 under the state's default rule for regular-session statutes (California Constitution, art. IV, sec. 8(c)(1)). The right to limit use of sensitive personal information is in Civil Code Section 1798.121, read in the statute text the California Privacy Protection Agency posts.",
   "added": "2026-09-29"
  },
  {
   "id": "co-hb26-1263",
   "state": "CO",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "HB26-1263, Conversational Artificial Intelligence Service Operator Requirements",
   "status": "enacted",
   "signed": "2026-05-29",
   "effective": "2027-01-01",
   "applies_to": "Operators of chatbots available to the public",
   "summary": "Requires chatbot operators to disclose that the service is AI, keep a protocol for prompts about suicidal ideation or self-harm, report on it annually to the Attorney General and add protections for users under 18, and bars stating that output is provided by, endorsed by or equivalent to the services of certain licensed or certified professionals.",
   "physician_read": "From Jan. 1, 2027, an operator of a chatbot available to the public may not state that its output is provided by, endorsed by or equivalent to the services of certain licensed or certified professionals, and must disclose that the service is AI and keep a protocol for prompts about suicidal ideation or self-harm. The act counts anyone who offers such a service to a consumer as an operator, and its official summary lists no exception for health care organizations.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/HB26-1263"
    },
    {
     "label": "Attorney General",
     "url": "https://coag.gov/ai/"
    },
    {
     "label": "Healthier Colorado (secondary)",
     "url": "https://healthiercolorado.org/press-release/governor-polis-signs-bill-to-protect-users-from-harms-of-conversational-ai-technology/"
    }
   ],
   "checked": "2026-09-28",
   "notes": "The act took effect Aug. 12, 2026; operator duties begin Jan. 1, 2027. It was signed May 29, 2026, according to the bill page, the Legislative Digest and Healthier Colorado; the Attorney General's page says July 1. The introduced bill's summary made violations deceptive trade practices under the Colorado Consumer Protection Act, and Healthier Colorado, an advocacy group, says they carry that act's penalty of $20,000 per violation; the enacted summary does not address enforcement.",
   "added": "2026-09-29"
  },
  {
   "id": "co-ag-admt-chatbot-rules",
   "state": "CO",
   "category": "disclosure",
   "also": [
    "clinical",
    "mental-health"
   ],
   "kind": "rule",
   "name": "Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Developers and deployers of automated decision-making technology, and operators of public chatbots",
   "summary": "Proposed rules on developers' disclosures to deployers, disclosures after an adverse outcome, correction and meaningful human review, age assurance, disclosures to chatbot users, protections for minors and claims that chatbot output comes from licensed professionals; written comments accepted until Oct. 26, 2026.",
   "physician_read": "Nothing here binds anyone yet; the final rules will set the content of explanations and human review under SB26-189 and how HB26-1263's duties work, and proposed Rule 12 would bar claims that chatbot outputs come from, are endorsed by or equal the services of licensed health care, mental health, legal or dietitian professionals, according to a law firm summary. Written comments are accepted until 11:59 p.m. on Oct. 26, 2026.",
   "sources": [
    {
     "label": "Attorney General",
     "url": "https://coag.gov/ai/"
    },
    {
     "label": "Wiley (secondary)",
     "url": "https://www.wiley.law/alert-Colorado-Proposes-Detailed-Rules-Implementing-New-ADMT-and-Chatbot-Laws"
    }
   ],
   "checked": "2026-09-28",
   "notes": "Filed with the Secretary of State Aug. 11, 2026. On the Attorney General's page the proposed rules are posted only as a Word file, which could not be read here; the topics, the Oct. 26 hearing date and a planned Jan. 1, 2027 effective date come from a law firm alert.",
   "added": "2026-09-29"
  },
  {
   "id": "co-sb26-189",
   "state": "CO",
   "category": "disclosure",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "SB26-189, Automated Decision-Making Technology",
   "status": "enacted",
   "signed": "2026-05-14",
   "effective": "2027-01-01",
   "applies_to": "Developers and deployers of automated decision-making technology used in consequential decisions, including health care services",
   "summary": "Replaces the 2024 Colorado AI Act with notice-based duties: deployers must tell consumers when they interact with automated decision-making technology and, after an adverse outcome, give an explanation, a chance to correct data and a right to request meaningful human review; enforced by the Attorney General.",
   "physician_read": "From Jan. 1, 2027, HIPAA covered entities doing business in Colorado (providers must operate from a Colorado location) and their business associates are exempt from most duties but must give patients a general notice of how they use advanced technologies and, when such technology determines eligibility for financial assistance, specified disclosures, according to law firm summaries. Employment decisions carry the full duties, and organizations that are neither covered entities nor business associates get no carve-out.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/SB26-189"
    },
    {
     "label": "Governor's signing release",
     "url": "https://governorsoffice.colorado.gov/governor/news/governor-polis-signs-bills-law-making-colorado-even-better-place-do-business-breaking-down"
    },
    {
     "label": "Attorney General",
     "url": "https://coag.gov/ai/"
    },
    {
     "label": "Ropes & Gray (secondary)",
     "url": "https://www.ropesgray.com/en/insights/alerts/2026/05/colorado-scales-back-ai-law-with-targeted-implications-for-health-care"
    },
    {
     "label": "McDermott (secondary)",
     "url": "https://www.mcdermottlaw.com/insights/colorado-ai-law-in-flux-comprehensive-replacement-bill-signed-after-federal-court-blocks-predecessors-enforcement/"
    }
   ],
   "checked": "2026-09-28",
   "notes": "The act took effect May 14, 2026, repealing and reenacting SB24-205 (the 2024 Colorado AI Act), which never became operative: SB25B-004 delayed it, and its enforcement was paused under a stipulated federal court order in xAI v. Weiser on April 27, 2026, according to a law firm summary. Its duties begin Jan. 1, 2027. The health care carve-out comes from law firm summaries, not the act's text. The Legislative Digest lists a portion effective July 1, 2027 that could not be identified.",
   "added": "2026-09-29"
  },
  {
   "id": "co-hb26-1195",
   "state": "CO",
   "category": "mental-health",
   "also": [
    "disclosure",
    "clinical"
   ],
   "kind": "law",
   "name": "HB26-1195, Psychotherapy Artificial Intelligence Restrictions",
   "status": "effective",
   "signed": "2026-06-03",
   "effective": "2026-08-12",
   "applies_to": "Mental health licensees and others lawfully providing psychotherapy",
   "summary": "Allows AI for administrative or supplementary tasks, with the professional keeping full responsibility for reviewing its output; requires written notice and written consent before AI records or transcribes a session; and bars AI from therapeutic communication except in real time with the therapist and client, and from generating treatment plans or therapeutic recommendations without the therapist's review and approval.",
   "physician_read": "Since Aug. 12, 2026, Colorado mental health licensees may have AI record or transcribe a session only after telling the client in writing of its use and purpose and getting written consent, and may not deny services to a client who refuses or revokes consent. AI may take part in therapeutic communication only in real time with the therapist and client, and may not generate treatment plans or therapeutic recommendations without the therapist's review and approval.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/HB26-1195"
    },
    {
     "label": "Division of Professions and Occupations",
     "url": "https://dpo.colorado.gov/LegUpdates"
    }
   ],
   "checked": "2026-09-28",
   "notes": "The Division of Professions and Occupations applies the duties to mental health licensees; whether psychiatrists and other physicians fall within the act's list of professionals could not be confirmed. A ban on offering or advertising psychotherapy through AI, enforced under the Colorado Consumer Protection Act, appears in the introduced bill's summary and a law firm summary but not in the official summaries written after signing.",
   "added": "2026-09-29"
  },
  {
   "id": "co-3ccr702-10",
   "state": "CO",
   "category": "payer",
   "also": [],
   "kind": "rule",
   "name": "Regulation 10-1-1 (3 CCR 702-10), Governance and Risk Management Framework Requirements for Life Insurers', Private Passenger Automobile Insurers', and Health Benefit Plan Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models",
   "status": "effective",
   "signed": "2025-08-19",
   "effective": "2025-10-15",
   "applies_to": "Life, private passenger auto and health benefit plan insurers that use external consumer data, or models built on it; those that do not use it file an annual attestation",
   "summary": "Requires insurers that use external consumer data, or algorithms and predictive models that use it, to test them for unfair discrimination under a risk-based governance framework, and requires health plans to make a provider acting for the plan ultimately responsible for decisions to modify or deny prior authorization or concurrent review requests that such data or models inform.",
   "physician_read": "Since Oct. 15, 2025, when external consumer data (such as credit scores, location, purchasing or social media data, but not a patient's medical records), or an algorithm or model that uses such data, informs a health plan's decision to modify or deny a prior authorization or concurrent review request, a provider acting for the plan must be ultimately responsible for the decision. Plans that use such data file a compliance report with the Division of Insurance each July 1 from 2026; plans that do not file an officer's attestation each Dec. 1.",
   "sources": [
    {
     "label": "Rule text",
     "url": "https://www.sos.state.co.us/CCR/GenerateRulePdf.do?ruleVersionId=12182"
    },
    {
     "label": "Rule history",
     "url": "https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=3421&deptID=18&agencyID=57&deptName=Department%20of%20Regulatory%20Agencies&agencyName=Division%20of%20Insurance&seriesNum=3%20CCR%20702-10"
    }
   ],
   "checked": "2026-09-28",
   "notes": "The current version was adopted Aug. 19, 2025, according to the Secretary of State; the original rule took effect Nov. 14, 2023.",
   "added": "2026-09-29"
  },
  {
   "id": "co-hb26-1139",
   "state": "CO",
   "category": "payer",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "HB26-1139, Use of Artificial Intelligence in Health Care",
   "status": "enacted",
   "signed": "2026-06-02",
   "effective": "2027-01-01",
   "applies_to": "Carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations and managed care entities that use AI in utilization review; the payment ban binds carriers and payers under Medicaid and the Children's Basic Health Plan",
   "summary": "Requires AI used in utilization review to base decisions on the individual patient's clinical circumstances, bars a denial based in whole or in part on medical necessity issued solely on an AI system's output without review by a licensed clinician or other competent regulated professional, requires disclosure to state regulators of where AI is used in utilization review, and bars payment for psychotherapy conducted by an AI system.",
   "physician_read": "From Jan. 1, 2027, a carrier or other entity using AI in utilization review cannot issue a denial based in whole or in part on medical necessity solely on an AI system's output; a licensed clinician or other competent regulated professional must review it, while AI-assisted approvals remain allowed. Psychotherapy conducted directly by an AI system is not payable by carriers, Medicaid or the Children's Basic Health Plan; the Legislative Council summary also says the review rule covers delays and that a mental health provider may not bill for services an AI system provides, points the bill page's summary does not mention.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/HB26-1139"
    },
    {
     "label": "Legislative Council summary",
     "url": "https://content.leg.colorado.gov/sites/default/files/r26-581-health-care-and-insurance-summaries-of-major-legislation-2026-accessible.pdf"
    }
   ],
   "checked": "2026-09-28",
   "notes": "The signed act could not be opened by automated reading; the entry rests on the official bill summary and the Legislative Council summary, which differ on delays and billing.",
   "added": "2026-09-29"
  },
  {
   "id": "co-sb21-169",
   "state": "CO",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB21-169, Restrict Insurers' Use of External Consumer Data",
   "status": "effective",
   "signed": "2021-07-06",
   "effective": "2021-09-07",
   "applies_to": "Insurers, including health insurers",
   "summary": "Bars insurers from unfairly discriminating by race, disability and other protected traits in any insurance practice, including utilization management and claims, and, under rules set by the Commissioner of Insurance, from using external consumer data, or algorithms and predictive models that use such data, in ways that unfairly discriminate.",
   "physician_read": "The law's definition of insurance practice includes utilization management and claims management, and Regulation 10-1-1, adopted under it, applies to health plans' prior authorization decisions informed by external consumer data. It places no duty on physicians.",
   "sources": [
    {
     "label": "Signed act",
     "url": "https://content.leg.colorado.gov/sites/default/files/2021a_169_signed.pdf"
    },
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/SB21-169"
    },
    {
     "label": "Division of Insurance",
     "url": "https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices"
    }
   ],
   "checked": "2026-09-28",
   "notes": "Long title: Concerning protecting consumers from unfair discrimination in insurance practices. Carried out through Regulation 10-1-1, the next entry.",
   "added": "2026-09-29"
  },
  {
   "id": "co-4ccr904-3",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "rule",
   "name": "Colorado Privacy Act Rules (4 CCR 904-3)",
   "status": "effective",
   "signed": "2025-10-08",
   "effective": "2025-12-01",
   "applies_to": "Businesses covered by the Colorado Privacy Act",
   "summary": "Treats inferences about health drawn from ordinary personal data as sensitive data needing consent, defines levels of human involvement in automated processing, and requires a clear opt-out for profiling used in decisions that provide or deny health care services.",
   "physician_read": "A health inference that software draws from ordinary personal data, such as an app concluding a user is likely depressed, needs consent unless the user is over 13, the purpose is obvious from context, and the inference is deleted within 24 hours, not shared with any processor, affiliate or third party, and used only for the disclosed purpose. Businesses covered by the act that use profiling in decisions that provide or deny health care services must offer a clear and conspicuous opt-out at or before the profiling.",
   "sources": [
    {
     "label": "Rule text",
     "url": "https://www.sos.state.co.us/CCR/GenerateRulePdf.do?ruleVersionId=11819&fileName=4+CCR+904-3"
    },
    {
     "label": "Rule history",
     "url": "https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=3396&deptID=11&agencyID=11&deptName=Department+of+Law&agencyName=Attorney+General-Consumer+Protection+Section&seriesNum=4+CCR+904-3"
    }
   ],
   "checked": "2026-09-28",
   "notes": "First version effective July 1, 2023. Part 9, on profiling disclosures, could not be read in full.",
   "added": "2026-09-29"
  },
  {
   "id": "co-hb24-1058",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB24-1058, Protect Privacy of Biological Data",
   "status": "effective",
   "signed": "2024-04-17",
   "effective": "2024-08-07",
   "applies_to": "Businesses covered by the Colorado Privacy Act",
   "summary": "Adds biological data, including neural data measured by devices, to the Colorado Privacy Act's sensitive data when it is used or intended for identification.",
   "physician_read": "Neural and other biological data from consumer devices count as sensitive data when used or intended for identification, so covered businesses need opt-in consent to process them. Data held as protected health information by a covered entity stays under HIPAA.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/HB24-1058"
    }
   ],
   "checked": "2026-09-28",
   "notes": "",
   "added": "2026-09-29"
  },
  {
   "id": "co-hb24-1130",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB24-1130, Privacy of Biometric Identifiers & Data",
   "status": "effective",
   "signed": "2024-05-31",
   "effective": "2025-07-01",
   "applies_to": "Anyone who controls or processes any amount of biometric identifiers",
   "summary": "Requires a written retention and deletion policy and an incident-response protocol for biometric identifiers and disclosure and consent before collecting them, and limits the purposes for which an employer may require employees' consent as a condition of employment.",
   "physician_read": "Since July 1, 2025, any organization that controls or processes biometric identifiers, including fingerprints or face scans used for staff time clocks or building access outside HIPAA-protected records, needs a written retention and deletion policy with an incident-response protocol and must meet disclosure and consent requirements before collecting them. An employer may make consent a condition of employment only for listed purposes, such as secure access, recording the work day and workplace safety, and needs the employee's consent for any other use.",
   "sources": [
    {
     "label": "Signed act",
     "url": "https://content.leg.colorado.gov/sites/default/files/2024a_1130_signed.pdf"
    },
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/HB24-1130"
    }
   ],
   "checked": "2026-09-28",
   "notes": "",
   "added": "2026-09-29"
  },
  {
   "id": "co-sb21-190",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB21-190, Protect Personal Data Privacy (the Colorado Privacy Act)",
   "status": "effective",
   "signed": "2021-07-07",
   "effective": "2023-07-01",
   "applies_to": "Businesses that handle the personal data of 100,000 or more Colorado consumers a year, or sell data and handle that of 25,000 or more",
   "summary": "Requires consent before processing sensitive data, including data revealing a health condition or diagnosis, and lets consumers opt out of profiling used in decisions with legal or similarly significant effects, including decisions about health care services; enforced by the Attorney General and district attorneys.",
   "physician_read": "Protected health information collected, stored and processed by HIPAA covered entities and their business associates is outside the act, so it reaches health data held by others, such as consumer apps and wearables, when the business meets the act's thresholds. Where it applies, a business needs consent before processing health-condition data, which the act defines to include its collection, use and analysis.",
   "sources": [
    {
     "label": "Signed act",
     "url": "https://content.leg.colorado.gov/sites/default/files/2021a_190_signed.pdf"
    },
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/SB21-190"
    },
    {
     "label": "Attorney General",
     "url": "https://coag.gov/resources/colorado-privacy-act/"
    }
   ],
   "checked": "2026-09-28",
   "notes": "No private right of action; the 60-day cure period ended Jan. 1, 2025.",
   "added": "2026-09-29"
  },
  {
   "id": "co-sb24-041",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB24-041, Privacy Protections for Children's Online Data",
   "status": "effective",
   "signed": "2024-05-31",
   "effective": "2025-10-01",
   "applies_to": "Controllers offering an online service, product or feature to a consumer they actually know or willfully disregard is under 18, regardless of the Colorado Privacy Act's volume thresholds, and their processors",
   "summary": "Amends the Colorado Privacy Act to require a controller offering an online service, product or feature to a consumer it actually knows or willfully disregards is under 18 to use reasonable care to avoid any heightened risk of harm to minors, to obtain consent, from a parent for a child under 13, before processing a minor's data for targeted advertising, sale, profiling in furtherance of decisions with legal or similarly significant effects, purposes beyond those disclosed or retention longer than reasonably necessary, or using design features to significantly increase a minor's use, to collect a minor's precise geolocation without consent only when it is reasonably necessary for the service, kept only as long as needed and signaled to the minor, and to conduct data protection assessments for services posing a heightened risk of harm to minors.",
   "physician_read": "Since Oct. 1, 2025, any controller, whatever its size, that offers an online service to a Colorado consumer it knows or willfully disregards is under 18 must use reasonable care to avoid a heightened risk of harm to minors and needs consent, from a parent for a child under 13, before using the minor's data for targeted advertising, sale or profiling for significant decisions. The Colorado Privacy Act exempts protected health information collected by HIPAA covered entities and business associates, not the entities themselves, so a practice's website or app used by minors is covered for personal data outside the act's health data exemptions.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/SB24-041"
    },
    {
     "label": "Signed act",
     "url": "https://content.leg.colorado.gov/sites/default/files/2024a_041_signed.pdf"
    },
    {
     "label": "Colorado Privacy Act as enacted, SB21-190 signed act (exemptions, enforcement)",
     "url": "https://content.leg.colorado.gov/sites/default/files/2021a_190_signed.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed May 31, 2024 (chapter 296, per the bill page); the minors' provisions took effect Oct. 1, 2025. Adds Sections 6-1-1305.5 (processor duties), 6-1-1308.5 (controller duties) and 6-1-1309.5 (data protection assessments) and defines a minor as a consumer under 18; under the amended Section 6-1-1304(1) these sections apply to any controller that conducts business in Colorado or delivers products or services intentionally targeted to Colorado residents, regardless of the act's volume thresholds. Without consent, a controller may collect a minor's precise geolocation only when it is reasonably necessary to provide the service, only for the time necessary and with a signal to the minor for the whole collection. The act's health exemptions (Section 6-1-1304(2)) cover protected health information collected, stored and processed by a covered entity or business associate and related categories of data, not covered entities as such. The attorney general and district attorneys have exclusive enforcement authority; there is no private right of action. The Colorado Privacy Act itself has a separate entry.",
   "added": "2026-09-29"
  },
  {
   "id": "co-sb25-276",
   "state": "CO",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB25-276, Protect Civil Rights Immigration Status",
   "status": "effective",
   "signed": "2025-05-23",
   "effective": "2025-05-23",
   "applies_to": "Businesses covered by the Colorado Privacy Act",
   "summary": "Among other changes, amends the Colorado Privacy Act to make precise geolocation data sensitive data and to bar selling any consumer's sensitive data without consent.",
   "physician_read": "Since May 23, 2025, precise geolocation data is sensitive data under the Colorado Privacy Act, so businesses that meet the act's thresholds need consent to process it, and consent before selling any sensitive data, including health-condition data. Location-targeted advertising near a clinic, for example, would fall under the consent rule for a business that meets the thresholds.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://leg.colorado.gov/bills/SB25-276"
    },
    {
     "label": "Attorney General rulemaking",
     "url": "https://coag.gov/colorado-privacy-act-rulemaking/"
    }
   ],
   "checked": "2026-09-28",
   "notes": "Its privacy amendments are what place it on this map.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-sb5-2026",
   "state": "CT",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 5, Public Act 26-15, An Act Concerning Online Safety",
   "status": "enacted",
   "signed": "2026-05-27",
   "effective": "2027-01-01",
   "applies_to": "Operators of AI companions offered to Connecticut users; AI used solely for health care-related education, clinical support, medication-adherence reminders, disease-management guidance or other treatment-support functions is excluded if it does not present itself as a human being, does not use anthropomorphic features and is not designed to meet users' social or emotional needs",
   "summary": "Requires AI companion operators to maintain evidence-based protocols to detect user expressions of suicide, self-harm or imminent physical violence and refer users to resources including the 988 lifeline, to disclose that users are talking with an AI companion (by a standing notice, or at the start and then hourly for minors and every three hours for adults), and, for users the operator knows or has reason to believe are minors, to prevent the companion from offering mental health services unless it is designed to deliver them, built with clinical best practices and displays that it is not a licensed mental health professional.",
   "physician_read": "From Jan. 1, 2027, AI companion apps used by Connecticut patients must detect expressions of suicide or self-harm and refer users to crisis resources, and cannot offer mental health services to minors unless designed for that purpose and labeled as not a licensed mental health professional. It places no duty on physicians, and AI used solely for clinical support or other treatment-support functions is excluded if it does not present itself as human, use anthropomorphic features or aim to meet users' social or emotional needs.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CT/bill/SB00005/2026"
    },
    {
     "label": "Public Act 26-15 (via LegiScan)",
     "url": "https://legiscan.com/CT/text/SB00005/id/3434382/Connecticut-2026-SB00005-Chaptered.pdf"
    },
    {
     "label": "Governor's release, June 2, 2026",
     "url": "https://portal.ct.gov/governor/news/press-releases/2026/06-2026/governor-lamont-signs-legislation-establishing-youth-online-safety-protections"
    },
    {
     "label": "WilmerHale (secondary)",
     "url": "https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260604-what-companies-should-know-about-connecticuts-new-omnibus-ai-law"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text are from LegiScan's bill page and its copy of the chaptered act. LegiScan's history records 'Signed by the Governor' on May 27, 2026, after the act became Public Act 26-15 on May 11 and went to the Secretary of State on May 14; WilmerHale gives the same date. The governor's release of June 2, 2026 announced that he 'has signed' the act and gives no signing date, so it does not conflict. The AI companion sections (sections 4 to 6) take effect Jan. 1, 2027 and are enforced solely by the Attorney General as unfair trade practices, with no private right of action. Other sections cover subscription AI disclosures, frontier AI developers, automated employment decisions and a plan for an AI regulatory sandbox program (section 3, effective July 1, 2027); the governor's release and WilmerHale describe youth social media rules (effective Jan. 1, 2028 per WilmerHale) that fall after section 31, where the copy that could be read breaks off. None of the sections read places a duty in health care beyond the AI companion rules.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-naic-ai-bulletin-2024",
   "state": "CT",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin No. MC-25, Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-02-26",
   "effective": "2024-02-26",
   "applies_to": "All insurers authorized in Connecticut, including health insurers; the annual AI certification applies to Connecticut domestic insurers",
   "summary": "Expects every insurer authorized in Connecticut to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions on regulated insurance practices, covering governance, risk management and oversight of third-party data and AI systems, and requires Connecticut domestic insurers to file an AI certification by Sept. 1, 2024 and annually after that.",
   "physician_read": "It places no duty on physicians. Since Feb. 26, 2024, insurers in Connecticut, including health insurers, are expected to govern AI systems used in decisions that affect patients, those decisions must comply with the Connecticut Unfair Insurance Practices Act and its claim settlement standards, and insurers should be prepared to explain their AI use to the Insurance Department in investigations and market conduct examinations.",
   "sources": [
    {
     "label": "Bulletin MC-25",
     "url": "https://portal.ct.gov/cid/-/media/CID/1_Bulletins/Bulletin-MC-25.pdf"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Insurance Commissioner Andrew N. Mais and addressed to all insurers licensed to do business in Connecticut. The NAIC's Aug. 31, 2026 map lists MC-25 as Connecticut's adoption of the NAIC Model Bulletin; the bulletin follows the model's structure and cites the NAIC's AI Principles, but its text does not name the model bulletin. It cites the health insurance statutes (sections 38a-481, 38a-501a, 38a-528a and 38a-556) and the unfair claim settlement provision (38a-816(6)). The bulletin sets no separate effective date, so the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-osc-state-plan-ai-policy-2026",
   "state": "CT",
   "category": "payer",
   "also": [
    "disclosure",
    "privacy"
   ],
   "kind": "policy",
   "name": "Office of the State Comptroller, AI protections for the State Employee Health Plan and the Partnership Plan",
   "status": "enacted",
   "signed": "2026-09-16",
   "effective": "",
   "applies_to": "Carriers administering the State Employee Health Plan and the Connecticut Partnership Plan; the disclosure rule also names providers",
   "summary": "Bars adverse determinations made solely by an AI system without human review, bars carriers from using AI or predictive models as the sole basis to downcode claims, reduce provider payments or alter billing codes without human review, bars use of plan member data to train, develop or support other AI models, requires disclosure when AI materially assists with, directly interacts with or recommends a benefit or health service to a member, and requires AI systems to be validated for accuracy, consistency and fairness, with carriers disclosing governance and audit procedures to the Comptroller.",
   "physician_read": "For patients in Connecticut's state employee and Partnership plans, the policy bars adverse determinations made solely by an AI system without human review and bars downcoding claims, reducing provider payments or altering billing codes solely by AI without human review; the Comptroller has published no start date. The Comptroller's announcement also says carriers and providers must disclose when AI is materially assisting with, directly interacting with or recommending a benefit or health service to a member.",
   "sources": [
    {
     "label": "Comptroller announcement",
     "url": "https://osc.ct.gov/articles/comptroller-sean-scanlon-announces-new-protections-against-artificial-intelligence-on-state-health-plans/"
    },
    {
     "label": "Comptroller announcement (PDF)",
     "url": "https://osc.ct.gov/wp-content/uploads/2026/09/2026.09.16-Comptroller-AI-Healthcare-Policy.pdf"
    },
    {
     "label": "CT Mirror (secondary)",
     "url": "https://ctmirror.org/2026/09/16/ct-artificial-intelligence-regulations-health-insurance/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Announced Sept. 16, 2026 by Comptroller Sean Scanlon for plans covering more than 270,000 members. This is a plan-sponsor policy of the office that administers the state plans, not an Insurance Department rule or a statute; it is included because it sets AI rules for claims and denials in the state's largest employer plans. Neither the announcement nor its PDF version gives an effective date or the mechanism (contract terms or plan policy); the Comptroller's news page and the Care Compass benefits site show no other document on the policy, and the Health Care Cost Containment Committee's page could not be opened. CT Mirror reported that the rules take effect Jan. 1, 2027 and bind the plans' vendors (Anthem, Cigna, Aetna and Caremark); the 'enacted' status rests on that report. Authorized contractual and automated claims processes remain permitted. The Comptroller said he would work with the legislature in the 2027 session to extend the policy to all state-regulated plans.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-sb1295-2025",
   "state": "CT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 1295, Public Act 25-113, An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts",
   "status": "effective",
   "signed": "2025-06-24",
   "effective": "2026-07-01",
   "applies_to": "Controllers that process personal data of at least 35,000 consumers, process any sensitive data or sell personal data; HIPAA covered entities and business associates remain exempt",
   "summary": "Amends the Connecticut Data Privacy Act to add neural data and financial account data to sensitive data, lower the applicability threshold to 35,000 consumers and extend it to any controller that processes sensitive data or sells personal data, let consumers question profiling-based automated decisions with legal or similarly significant effects and learn the reason, require impact assessments for such profiling, and require privacy notices to state whether personal data are used to train large language models.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which remain exempt. Since July 1, 2026, health and wellness businesses outside HIPAA that process any sensitive data of Connecticut patients are covered regardless of size and must say in their privacy notices whether they use personal data to train large language models.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CT/bill/SB01295/2025"
    },
    {
     "label": "Public Act 25-113 (via LegiScan)",
     "url": "https://legiscan.com/CT/text/SB01295/id/3254570/Connecticut-2025-SB01295-Chaptered.pdf"
    },
    {
     "label": "Snell & Wilmer (secondary)",
     "url": "https://www.swlaw.com/publication/connecticut-data-privacy-act-2026-amendments/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Impact assessments apply to processing activities created or generated on or after Aug. 1, 2026. The act also bars targeted advertising to and sale of the personal data of consumers aged 13 to 17 when the controller has actual knowledge of or willfully disregards their age, and adds social media and online safety duties outside this map's scope. Signing date from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-sb3-2023",
   "state": "CT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 3, Public Act 23-56, An Act Concerning Online Privacy, Data and Safety Protections",
   "status": "effective",
   "signed": "2023-06-26",
   "effective": "2023-07-01",
   "applies_to": "Any person doing business in Connecticut or targeting its residents that handles consumer health data, regardless of size; HIPAA covered entities and business associates are exempt",
   "summary": "Adds consumer health data protections to the Connecticut Data Privacy Act: consent before selling consumer health data, contractual or statutory confidentiality duties for employees and processors with access to it, and a ban on geofences within 1,750 feet of a mental health, reproductive or sexual health facility for processing consumer health data.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates. Since July 1, 2023, health apps and other businesses outside HIPAA that handle Connecticut patients' health data, whatever their size, need consent to sell it and cannot geofence within 1,750 feet of mental health, reproductive or sexual health facilities to process it.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CT/bill/SB00003/2023"
    },
    {
     "label": "Public Act 23-56 (via LegiScan)",
     "url": "https://legiscan.com/CT/text/SB00003/id/2826427/Connecticut-2023-SB00003-Chaptered.pdf"
    },
    {
     "label": "Attorney General, CTDPA page",
     "url": "https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Consumer health data means personal data a controller uses to identify a consumer's physical or mental health condition or diagnosis, including gender-affirming and reproductive or sexual health data. The act's section 3 restates the exemption list in section 42-517(a), which includes covered entities and business associates, and the consumer health data rules in section 2 do not apply to the entities on that list. The act's minors' online services provisions took effect Oct. 1, 2024. LegiScan's copy of the public act was used.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-sb4-2026",
   "state": "CT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 4, Public Act 26-64, An Act Concerning Consumer Privacy and Protection",
   "status": "enacted",
   "signed": "2026-05-27",
   "effective": "2026-10-01",
   "applies_to": "Controllers and third parties under the Connecticut Data Privacy Act, controllers that use facial recognition on their premises for security or fraud prevention, and data brokers; HIPAA covered entities and business associates remain exempt",
   "summary": "Amends the Connecticut Data Privacy Act to bar controllers and third parties from selling any consumer's precise geolocation data, limits on-premises facial recognition used for security to matching against the business's own database with signage at each entrance and a posted policy, and requires data broker registration and a statewide deletion mechanism.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which remain exempt. From Oct. 1, 2026, controllers and third parties covered by the act cannot sell any Connecticut patient's precise geolocation data; the ban has no consent exception.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CT/bill/SB00004/2026"
    },
    {
     "label": "Public Act 26-64 (via LegiScan)",
     "url": "https://legiscan.com/CT/text/SB00004/id/3436557/Connecticut-2026-SB00004-Chaptered.pdf"
    },
    {
     "label": "Attorney General release, Sept. 16, 2026",
     "url": "https://portal.ct.gov/ag/press-releases/2026-press-releases/rights-and-requirements-related-to-new-and-updated-privacy-laws"
    },
    {
     "label": "Proskauer (secondary)",
     "url": "https://privacylaw.proskauer.com/2026/06/articles/data-privacy-laws/from-data-brokers-to-dna-connecticut-enacts-sweeping-privacy-amendments/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The provisions summarized take effect Oct. 1, 2026; data broker registration begins Jan. 1, 2027 and the deletion mechanism is due by July 1, 2028. The Attorney General's Sept. 16, 2026 release cites Public Act 26-64 and describes the geolocation sale ban, facial recognition signage, genetic testing rules and the data broker registry. The act also sets consent and retention rules for direct-to-consumer genetic testing companies (outside this map's scope) and surveillance pricing rules. The statement that the ban has no consent exception reflects the unconditional new text ('No controller shall sell any consumer's precise geolocation data'; the same for third parties); Proskauer describes limited exceptions for disclosures to processors, services the consumer requests, affiliates and mergers or acquisitions, none of them based on consent. Snell & Wilmer cites the act as Public Act 26-62; LegiScan, the chaptered text, the Attorney General and Proskauer give 26-64. Snell & Wilmer and Proskauer say HB 5222 (Public Act 26-100, signed June 2, 2026 per LegiScan) later amended certain provisions, and Proskauer adds HB 5563 (Public Act 26-130, signed June 4, 2026 per LegiScan, whose title includes surveillance pricing); the copy of Public Act 26-100 read on LegiScan breaks off at section 33, before any privacy section, so whether it changed the provisions described here could not be confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "ct-sb6-2022",
   "state": "CT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 6, Public Act 22-15, An Act Concerning Personal Data Privacy and Online Monitoring (Connecticut Data Privacy Act)",
   "status": "effective",
   "signed": "2022-05-10",
   "effective": "2023-07-01",
   "applies_to": "Businesses that control or process Connecticut residents' personal data above the act's thresholds; HIPAA covered entities and business associates are exempt",
   "summary": "Gives consumers rights to access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale and certain profiling, requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic and biometric data and precise geolocation, and requires data protection assessments for high-risk processing.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which are exempt as entities. Since July 1, 2023, other businesses covered by the act, such as health and wellness apps outside HIPAA, need consent to process data revealing a health condition or diagnosis.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/CT/bill/SB00006/2022"
    },
    {
     "label": "Public Act 22-15 (via LegiScan)",
     "url": "https://legiscan.com/CT/text/SB00006/id/2579683/Connecticut-2022-SB00006-Chaptered.pdf"
    },
    {
     "label": "Attorney General, CTDPA page",
     "url": "https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Codified at sections 42-515 to 42-525. Signing date from LegiScan; the Attorney General's page confirms the July 1, 2023 effective date. As enacted, the act reached controllers of the data of 100,000 consumers, or 25,000 with more than 25 percent of gross revenue from sales; the thresholds on the Attorney General's page (35,000 consumers, or any processing of sensitive data or sale of personal data) are those set by the 2025 amendments. Later amendments with their own entries: SB 3 (2023, consumer health data), SB 1295 (2025, effective July 1, 2026) and SB 4 (2026, effective Oct. 1, 2026).",
   "added": "2026-09-29"
  },
  {
   "id": "de-naic-ai-bulletin-2025",
   "state": "DE",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Domestic and Foreign Bulletin No. 148, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2025-02-05",
   "effective": "2025-02-05",
   "applies_to": "All insurance carriers doing business in Delaware, including health insurers",
   "summary": "Reminds insurers that decisions made or supported by AI systems must comply with Delaware insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects a written AI systems program with governance, risk management and internal audit controls, oversight of third-party AI vendors and documentation that the department may request in investigations or market conduct examinations.",
   "physician_read": "It places no duty on physicians. Since Feb. 5, 2025, insurance carriers in Delaware, including health insurers, that use AI systems in decisions affecting consumers, such as claim administration and payment, are expected to keep a written AI systems program, and the Department of Insurance may request information and documentation about it.",
   "sources": [
    {
     "label": "Delaware Department of Insurance, Domestic and Foreign Bulletin No. 148",
     "url": "https://insurance.delaware.gov/wp-content/uploads/sites/15/2025/02/domestic-foreign-insurers-bulletin-no148.pdf"
    },
    {
     "label": "Delaware Department of Insurance, bulletins page (lists Bulletin No. 148, Feb. 5, 2025)",
     "url": "https://insurance.delaware.gov/information/bulletins/"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Delaware's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted Feb. 5, 2025. Signed by Insurance Commissioner Trinidad Navarro and addressed to all insurance carriers doing business in Delaware. It cites the Unfair Trade Practices Act (18 Del. C. ch. 23), including the unfair claims settlement practices provisions (section 2304(16)), the Corporate Governance Annual Disclosure Act (18 Del. C. ch. 85) and its regulation, and the rate making laws (18 Del. C. chs. 25 and 26). It covers the insurance life cycle, including claim administration and payment, and does not mention health insurance or utilization review by name. The bulletin states that it is effective immediately and remains in effect unless withdrawn or superseded. The Department's bulletins page lists it as Domestic/Foreign Insurers Bulletin No. 148; the bulletin itself is headed Domestic and Foreign Bulletin No. 148.",
   "added": "2026-09-29"
  },
  {
   "id": "de-hb154-2023",
   "state": "DE",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 154, Delaware Personal Data Privacy Act (84 Del. Laws, c. 197)",
   "status": "effective",
   "signed": "2023-09-11",
   "effective": "2025-01-01",
   "applies_to": "Persons, including nonprofits, that do business in Delaware or target Delaware residents and control or process the personal data of at least 35,000 consumers, or of at least 10,000 while deriving more than 20% of gross revenue from selling personal data; protected health information under HIPAA is exempt",
   "summary": "Requires consent before processing sensitive data, which includes data revealing a mental or physical health condition or diagnosis (including pregnancy), genetic or biometric data and precise geolocation, lets consumers opt out of targeted advertising, sale of their data and profiling in furtherance of solely automated decisions with legal or similarly significant effects, including decisions on health care services, and requires data protection assessments for high-risk processing by controllers of data on at least 100,000 consumers.",
   "physician_read": "Protected health information under HIPAA is exempt, but covered entities are not exempt as entities: a practice or other organization, including a nonprofit, that meets the thresholds must follow the act for personal data that is not protected health information. Since Jan. 1, 2025, such organizations need a consumer's consent to process data revealing a mental or physical health condition or diagnosis and must honor opt-outs from profiling in furtherance of solely automated decisions about health care services; amendments effective Jan. 1, 2027 lower the thresholds and add neural data to sensitive data.",
   "sources": [
    {
     "label": "Bill text as passed and signed, HB 154 with HA 1, HA 4 and SA 1 (LegiScan copy)",
     "url": "https://legiscan.com/DE/text/HB154/id/2832228"
    },
    {
     "label": "LegiScan bill page, HB 154",
     "url": "https://legiscan.com/DE/bill/HB154/2023"
    },
    {
     "label": "Delaware Code, Title 6, Chapter 12D",
     "url": "https://delcode.delaware.gov/title6/c012d/index.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the House June 8, 2023 (33-5) and the Senate, with an amendment, June 29, 2023 (15-5); the House passed it again June 30, 2023 (37-3), and the governor signed it Sept. 11, 2023. Its effective-date clause provides that if enacted on or before Jan. 1, 2024 it takes effect Jan. 1, 2025. Codified at Title 6, Chapter 12D of the Delaware Code. The HIPAA exemption is data-level: protected health information is exempt, but covered entities and business associates are not listed among exempt entities, and the only nonprofits exempt as entities are those dedicated exclusively to preventing and addressing insurance crime; personal data of victims of or witnesses to abuse, trafficking and similar crimes collected by nonprofits serving them is exempt. The Department of Justice had to offer a 60-day cure period through Dec. 31, 2025. The Delaware Code shows sections amended by 85 Del. Laws, c. 463, effective Jan. 1, 2027: coverage extends to controllers of data on 10,000 consumers (or 5,000 with more than 20% of gross revenue from sales); sensitive data expands to health condition, diagnosis, treatment or status, neural data, financial account numbers and government identification numbers; processing sensitive data requires consent and must be reasonably necessary and proportionate; the profiling opt-out covers automated decisions that are not solely automated; the data protection assessment threshold drops to 50,000 consumers; and impact assessments are added for profiling in automated decisions. The bill enacted as chapter 463 could not be identified. Bill history is from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "fl-sb262-2023",
   "state": "FL",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 262, Technology Transparency (Florida Digital Bill of Rights)",
   "status": "effective",
   "signed": "2023-06-06",
   "effective": "2024-07-01",
   "applies_to": "For-profit businesses with more than $1 billion in global gross annual revenue that also earn at least half of it from online advertising, operate a smart speaker and voice assistant service, or run an app store with at least 250,000 apps; the sensitive-data sale rules reach any for-profit business that collects Floridians' personal data",
   "summary": "Gives consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale, profiling in furtherance of decisions with legal or similarly significant effects, collection of sensitive data and collection through voice or facial recognition features, requires consent to process sensitive data, including data revealing a mental or physical health diagnosis, and bars any for-profit business from selling sensitive data without consent and requires it to post a notice if it sells such data.",
   "physician_read": "HIPAA protected health information and health records are exempt, and the act's core duties reach only the largest technology companies. Since July 1, 2024, any for-profit business that collects Floridians' personal data must get consent before selling sensitive data, such as data revealing a health diagnosis, and must post a notice if it sells such data.",
   "sources": [
    {
     "label": "Florida Senate bill page",
     "url": "https://www.flsenate.gov/Session/Bill/2023/262"
    },
    {
     "label": "Fla. Stat. § 501.702 (definitions)",
     "url": "https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.702.html"
    },
    {
     "label": "Fla. Stat. § 501.715 (sale of sensitive data)",
     "url": "https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.715.html"
    },
    {
     "label": "Fla. Stat. § 501.704 (exemptions)",
     "url": "https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.704.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 2023-201, Laws of Florida, approved June 6, 2023, and effective July 1, 2024, except as otherwise provided. The Department of Legal Affairs enforces it alone, with civil penalties up to $50,000 per violation, tripled in listed cases such as violations involving known children, and the act creates no private cause of action (§ 501.72). The same act restricts online platforms likely to be predominantly accessed by children and limits government requests to social media platforms; those parts are not entered separately. Profiling is defined as solely automated processing to evaluate or predict personal aspects, including health.",
   "added": "2026-09-29"
  },
  {
   "id": "ga-sb540-2026",
   "state": "GA",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 540, Online Internet Safety; certain disclosures related to conversational AI services; require",
   "status": "enacted",
   "signed": "2026-05-11",
   "effective": "2027-07-01",
   "applies_to": "Operators that own, control, or develop and make available an AI companion chatbot to users in Georgia; business-internal and enterprise productivity tools, customer-service chatbots that do not sustain a relationship, stand-alone smart speakers and voice assistants, narrow educational tools and video game characters, as defined, are exempt",
   "summary": "Requires operators of AI companion chatbots to disclose that the user is interacting with AI at the start of each session and at least every three hours (every hour when the operator knows or reasonably should have known the user is a minor, or the chatbot is directed or marketed to minors), maintain a protocol to detect and address expressions of severe harm, meaning significant injury from suicide, attempted suicide or self-harm or significant physical injury from threats of violence, that refers users to crisis resources including the 988 Suicide and Crisis Lifeline, not knowingly and intentionally cause a chatbot to represent that it is licensed, certified or otherwise authorized to provide professional mental health, behavioral health, medical or counseling services unless the operator is lawfully authorized to provide them, and give minors added content protections and parental controls, enforced by the Attorney General.",
   "physician_read": "It places no duty on physicians. From July 1, 2027, an operator may not knowingly and intentionally cause an AI companion chatbot offered in Georgia to claim it is licensed or authorized to provide medical, mental health or counseling services unless the operator is lawfully authorized to provide those services, and operators must refer users who express thoughts of suicide or self-harm to crisis resources such as 988.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/GA/bill/SB540/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/GA/text/SB540/id/3408227/Georgia-2025-SB540-Enrolled.pdf"
    },
    {
     "label": "Signed act as posted by the Governor",
     "url": "https://gov.georgia.gov/document/2026-signed-legislation/sb-540/download"
    },
    {
     "label": "Governor's 2026 signed legislation list",
     "url": "https://gov.georgia.gov/executive-action/legislation/signed-legislation/2026?page=1"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Act 518. The Senate passed a substitute 54-0 on March 6, 2026, the House passed a substitute 166-0 on March 25, the Senate agreed 44-1 on March 27, and the Governor signed it May 11, 2026. The enrolled text (26 LC 64 0123S) adds Code Section 39-5-6 to the Online Internet Safety chapter of Title 39, effective July 1, 2027. The Attorney General may bring a civil action for penalties up to $10,000 per knowing violation, compensatory damages, and costs and attorney's fees, and may give written notice and 30 days to cure a first violation that does not involve knowing misconduct, sexual exploitation of a minor or self-harm related misconduct. Before allowing access to a feature that may generate sexually explicit content, an operator must use a commercially reasonable age assurance method, and verification data may not be kept longer than 24 hours or another period permitted by law, whichever is longer. LegiScan is the source for status, and the text was confirmed on the governor's posted copy.",
   "added": "2026-09-29"
  },
  {
   "id": "ga-sb444-2026",
   "state": "GA",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 444, Private Review Agents; certain decisions with regard to the provision of insurance coverage for healthcare services shall not be based solely on artificial intelligence systems",
   "status": "enacted",
   "signed": "2026-05-05",
   "effective": "2027-01-01",
   "applies_to": "Private review agents and utilization review entities that conduct utilization review under Georgia's private review agent law (Title 33, Chapter 46)",
   "summary": "Allows private review agents and utilization review entities to use AI systems and other software tools that are part of a utilization review plan, but bars those systems from issuing an adverse determination to a patient until a natural person qualifying as a private review agent or utilization review entity conducts a utilization review in which a clinical peer participates, and bars the tools from superseding the clinical peer's judgment.",
   "physician_read": "From Jan. 1, 2027, an AI system or software tool cannot issue an adverse determination on a Georgia patient's care on its own; a utilization review in which a clinical peer participates must come first, and the tool cannot override the clinical peer's judgment.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/GA/bill/SB444/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/GA/text/SB444/id/3405337/Georgia-2025-SB444-Enrolled.pdf"
    },
    {
     "label": "Signed act as posted by the Governor",
     "url": "https://gov.georgia.gov/document/2026-signed-legislation/sb-444/download"
    },
    {
     "label": "Governor's 2026 signed legislation list",
     "url": "https://gov.georgia.gov/executive-action/legislation/signed-legislation/2026?page=1"
    },
    {
     "label": "Becker's Payer Issues (secondary)",
     "url": "https://www.beckerspayer.com/policy-updates/7-ai-health-insurance-state-laws-passed-in-2026/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Act 411. The Senate passed it 49-0 on Feb. 11, 2026, the House passed a substitute 166-0 on March 19, 2026, the Senate agreed to the House substitute 47-0 on March 25, and the Governor signed it May 5, 2026. The enrolled text (26 LC 46 1522S) adds Code Section 33-46-7.1 to Chapter 46 of Title 33 and defines artificial intelligence as a machine-based system that, for a given set of human-defined objectives, makes predictions, recommendations or decisions influencing real or virtual environments; its Section 2 sets the Jan. 1, 2027 effective date. LegiScan is the source for status, and the text was confirmed on the governor's posted copy. Leads gave other numbers for this law (HB 1181, a motor vehicle title bill; SB 544, a Butts County homestead exemption; HB 327, a Code revision bill); none has AI content.",
   "added": "2026-09-29"
  },
  {
   "id": "hi-sb3001-2026",
   "state": "HI",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "SB 3001, Artificial Intelligence Disclosure and Safety Act",
   "status": "effective",
   "signed": "2026-07-14",
   "effective": "2026-07-14",
   "applies_to": "Operators that develop and make AI companions available to the public",
   "summary": "Requires operators of AI companions to disclose that the companion is AI when a reasonable person would be led to believe it is human, to adopt protocols using evidence-based methods that respond to suicidal ideation and self-harm with reasonable efforts to refer users to crisis services, and to apply added protections for minors, bars them from causing or programming an AI companion to represent that it is designed to provide professional mental or behavioral health care, and requires annual reports to the Department of Health's Behavioral Health Administration beginning Jan. 1, 2028.",
   "physician_read": "It places no duty on physicians. Since July 14, 2026, operators may not cause AI companions offered in Hawaii to represent that they are designed to provide professional mental or behavioral health care and must have protocols that make reasonable efforts to refer users who raise suicidal ideation or self-harm to crisis services; a violation is an unfair or deceptive act or practice under HRS 480-2, and the act creates no private right of action.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/HI/bill/SB3001/2026"
    },
    {
     "label": "Final text (CD1), via LegiScan",
     "url": "https://legiscan.com/HI/text/SB3001/id/3428748/Hawaii-2026-SB3001-Amended.html"
    },
    {
     "label": "LegiScan status and text versions",
     "url": "https://legiscan.com/HI/text/SB3001/2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Act 248 (2026), adding a section to chapter 481B, Hawaii Revised Statutes. Status and dates are from LegiScan: the bill was enrolled to the governor May 8, 2026, and its last action reads 'Act 248, on 07/14/2026 (Gov. Msg. No. 1350).' Section 7 of the CD1 text says the act takes effect upon its approval, so July 14, 2026 is used for both approval and effect. An AI companion is a system designed to simulate a sustained human or human-like relationship by retaining prior interactions, asking unprompted emotion-based questions and sustaining dialogue on personal matters. Minors' protections apply when the operator has actual knowledge or reasonable certainty that a user is under 18. Developers of underlying AI models are not liable for violations by third-party systems.",
   "added": "2026-09-29"
  },
  {
   "id": "hi-naic-ai-bulletin-2025",
   "state": "HI",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Commissioner's Memorandum 2025-13A, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2025-12-10",
   "effective": "2025-12-10",
   "applies_to": "All authorized insurers offering policies in Hawaii",
   "summary": "Expects insurers' decisions made or supported by AI systems to comply with Hawaii insurance law, including unfair trade practice and unfair discrimination provisions, and expects a written AI systems program covering governance, risk management and controls, and oversight of third-party vendors, with AI system inventories, model documentation, validation reports and audit materials available in examinations.",
   "physician_read": "It places no duty on physicians. Since Dec. 10, 2025, insurers authorized in Hawaii have been expected to govern, test and document the AI systems they use in decisions that affect consumers.",
   "sources": [
    {
     "label": "Insurance Division memorandum",
     "url": "https://cca.hawaii.gov/wp-content/uploads/2026/03/Commissioners-Memo-2025-13A-The-Use-of-AI-in-Insurance_signed.pdf"
    },
    {
     "label": "Commissioner's memoranda index",
     "url": "https://cca.hawaii.gov/ins/commissioners_memo/"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Insurance Commissioner Scott K. Saiki. The memorandum does not call itself an adoption of the NAIC model bulletin, but it follows the model's structure, recognizes the NAIC's 2020 AI principles, and the NAIC's Aug. 31, 2026 map lists it as Hawaii's adoption. It cites provisions of HRS chapter 431 on unfair practices, corporate governance, rates and market conduct and does not mention health plans, mutual benefit societies or health maintenance organizations specifically.",
   "added": "2026-09-29"
  },
  {
   "id": "ia-sf2417-2026",
   "state": "IA",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SF 2417, Conversational Artificial Intelligence Services: Limitations, Required Disclosures, and Civil Penalties (2026 Iowa Acts, Chapter 1068)",
   "status": "enacted",
   "signed": "2026-05-02",
   "effective": "2027-07-01",
   "applies_to": "Operators that make conversational AI services available to the public, excluding customer service, research, narrow-topic, voice-assistant and internal business tools",
   "summary": "Requires operators of public conversational AI services to disclose that a user is talking to AI when a reasonable person would believe they are talking to a human (and, for users the operator knows or is reasonably certain are minors, at the start of each interaction and at least every three hours, or by a persistent disclaimer), to adopt protocols for prompts about suicidal ideation or self-harm that include reasonable efforts to refer users to crisis service providers, not to knowingly and intentionally program the service to make statements that would lead a reasonable person to believe it is designed to provide professional psychology or behavioral health services that require an Iowa license, and to apply added protections for minors.",
   "physician_read": "It places no duty on physicians. From July 1, 2027, general chatbots offered to the public in Iowa must have crisis-referral protocols for users who raise suicidal ideation or self-harm and may not be programmed to present themselves as designed to provide licensed psychology or behavioral health services.",
   "sources": [
    {
     "label": "2026 Iowa Acts, ch. 1068 (SF 2417)",
     "url": "https://www.legis.iowa.gov/docs/publications/iactc/91.2/CH1068.pdf"
    },
    {
     "label": "Bill history, SF 2417",
     "url": "https://www.legis.iowa.gov/legislation/billTracking/billHistory?billName=SF%202417&ga=91"
    },
    {
     "label": "Enrolled bill, SF 2417",
     "url": "https://www.legis.iowa.gov/docs/publications/LGE/91/SF2417.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Codified as new Iowa Code chapter 554J. Section 7 provides that the act applies July 1, 2027; the bill history lists July 1, 2026 as the effective date. The professional-services ban covers representations that would lead a reasonable person to believe the service provides services requiring licensure under Iowa Code chapter 154B (psychology) or 154D (mental health professions). Minors' protections include limits on engagement-maximizing rewards, sexual content and claims of sentience, and privacy and parental tools. Enforced by the attorney general: an operator is subject to an injunction and liable for the greater of actual damages or a civil penalty of $1,000 per violation, up to $500,000 per operator; no private right of action.",
   "added": "2026-09-29"
  },
  {
   "id": "ia-hf2635-2026",
   "state": "IA",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "HF 2635, Health Carrier Standards of Conduct: Utilization Review Organizations, Use of Artificial Intelligence, and Audits; Prior Authorizations and Certificates of Need (2026 Iowa Acts, Chapter 1087)",
   "status": "effective",
   "signed": "2026-05-13",
   "effective": "2026-07-01",
   "applies_to": "Utilization review organizations, including state-regulated health carriers, that review prior authorization requests",
   "summary": "Adds Iowa Code 514F.8(2A), which lets a utilization review organization use an AI-based algorithm or system for the initial review of a prior authorization request but bars it from using such a system as the sole basis for a decision to deny, delay or downgrade a request for a service based on medical necessity.",
   "physician_read": "Since July 1, 2026, a utilization review organization may use AI to screen a prior authorization request, but for a service requested on medical necessity grounds AI cannot be the sole basis for denying it, delaying it or downgrading it (moving an urgent request to standard review or substituting a lower-level service). The act's other prior authorization changes apply from Jan. 1, 2027, and electronic submission duties from July 1, 2027.",
   "sources": [
    {
     "label": "2026 Iowa Acts, ch. 1087 (HF 2635)",
     "url": "https://www.legis.iowa.gov/docs/publications/iactc/91.2/CH1087.pdf"
    },
    {
     "label": "Bill history, HF 2635",
     "url": "https://www.legis.iowa.gov/legislation/billTracking/billHistory?billName=HF%202635&ga=91"
    },
    {
     "label": "Enrolled bill, HF 2635",
     "url": "https://www.legis.iowa.gov/docs/publications/LGE/91/HF2635.pdf"
    },
    {
     "label": "Iowa Code 514F.8 (Code 2026, before amendment)",
     "url": "https://www.legis.iowa.gov/docs/code/514F.8.pdf"
    },
    {
     "label": "Iowa Code 3.7 (effective date of acts)",
     "url": "https://www.legis.iowa.gov/docs/code/3.7.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Section 2 of the act, which adds the AI rule, carries no separate applicability date, so it took effect July 1, 2026 under Iowa Code 3.7(1), which makes an act passed at a regular session effective the first day of July following its passage unless it provides another time; the bill history also lists July 1, 2026 as the effective date. Other sections apply later: new 514F.8A (prior authorization peer review), 514F.8B (exemptions), 514F.8C (audits) and 514F.8D (standards of conduct) from Jan. 1, 2027, and electronic submission of prior authorization requests from July 1, 2027. The act adds a definition of 'downgrade' to 514F.8 but does not define artificial intelligence. Iowa Code 514F.8 defines a health carrier to exclude the Department of Health and Human Services and managed care organizations administering Medicaid and Hawki; the act's Medicaid and Hawki sections address prior authorization exemptions and electronic submission, not AI.",
   "added": "2026-09-29"
  },
  {
   "id": "ia-naic-ai-bulletin-2024",
   "state": "IA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Iowa Insurance Division Bulletin 24-04, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-11-07",
   "effective": "2024-11-07",
   "applies_to": "All insurance companies writing in Iowa, including health insurers",
   "summary": "Sets the Insurance Division's expectation that insurers using AI systems maintain a written AI systems program covering governance, risk management and internal controls, and oversight of third-party AI systems and data, aimed at avoiding adverse consumer outcomes, and lists what the Division may request in investigations and examinations.",
   "physician_read": "It places no duty on physicians. Since Nov. 7, 2024, insurers writing in Iowa, including health insurers, are expected to govern AI used in decisions that affect consumers under a written program that the Insurance Division may examine.",
   "sources": [
    {
     "label": "Bulletin 24-04",
     "url": "https://iid.iowa.gov/media/5108/download?inline"
    },
    {
     "label": "Commissioner's bulletins",
     "url": "https://iid.iowa.gov/commissioners-bulletins"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The NAIC lists Bulletin 24-04 as Iowa's adoption of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The bulletin is addressed to all insurance companies writing in Iowa and does not single out health insurers.",
   "added": "2026-09-29"
  },
  {
   "id": "ia-sf262-2023",
   "state": "IA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SF 262, Consumer Data Protection (2023 Iowa Acts, Chapter 17; Iowa Code chapter 715D)",
   "status": "effective",
   "signed": "2023-03-28",
   "effective": "2025-01-01",
   "applies_to": "Businesses that control or process personal data of at least 100,000 Iowa consumers a year, or of at least 25,000 while deriving over 50 percent of gross revenue from selling personal data",
   "summary": "Gives consumers rights to access, delete and obtain a copy of their personal data and to opt out of its sale, and requires controllers to give clear notice and an opportunity to opt out before processing sensitive data, which includes mental or physical health diagnoses and biometric data processed to identify a person.",
   "physician_read": "It places no duty on a physician practice that is subject to and complies with HIPAA's rules, which the act exempts along with protected health information. Since Jan. 1, 2025, covered businesses outside HIPAA, such as health apps, must give Iowans notice and a chance to opt out before processing health diagnosis data.",
   "sources": [
    {
     "label": "2023 Iowa Acts, ch. 17 (SF 262)",
     "url": "https://www.legis.iowa.gov/docs/publications/iactc/90.1/CH0017.pdf"
    },
    {
     "label": "Bill history, SF 262",
     "url": "https://www.legis.iowa.gov/legislation/billTracking/billHistory?billName=SF%20262&ga=90"
    },
    {
     "label": "Iowa Code chapter 715D",
     "url": "https://www.legis.iowa.gov/docs/code/715D.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The act exempts persons who are subject to and comply with the HIPAA privacy, security and breach rules, as well as protected health information. It has no right to correct data and no right to opt out of profiling, and it requires notice and an opportunity to opt out, not opt-in consent, for sensitive data (except children's data under COPPA). The attorney general has exclusive enforcement authority, must first give 90 days' written notice identifying the alleged violations, and may seek civil penalties of up to $7,500 per violation.",
   "added": "2026-09-29"
  },
  {
   "id": "id-s1297-2026",
   "state": "ID",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "S 1297, Conversational AI Safety Act",
   "status": "enacted",
   "signed": "2026-03-31",
   "effective": "2027-07-01",
   "applies_to": "Operators that make a conversational AI service available to the public in Idaho",
   "summary": "Requires operators of public conversational AI services to disclose clearly and conspicuously that the service is AI when reasonable persons would be misled to believe they are interacting with a human, to adopt a protocol for responding to prompts about suicidal ideation that includes reasonable efforts to refer users to crisis service providers such as a suicide hotline or crisis text line, and to apply added protections for minors, and bars operators from knowingly and intentionally causing or programming a service to state that it is designed to provide professional mental or behavioral health care.",
   "physician_read": "It places no duty on physicians. From July 1, 2027, an operator may not knowingly and intentionally program a chatbot offered to the public in Idaho to represent that it is designed to provide professional mental or behavioral health care, and must have a protocol that makes reasonable efforts to refer users who raise suicidal ideation to crisis services.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://legislature.idaho.gov/sessioninfo/2026/legislation/S1297/"
    },
    {
     "label": "Engrossed text (S1297E1), as passed",
     "url": "https://legislature.idaho.gov/wp-content/uploads/sessioninfo/2026/legislation/S1297E1.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Session law chapter 249 (2026), per the legislature's bill page; adds chapter 21 to title 48, Idaho Code. Amended in the Senate on the 14th Order; the House passed the engrossed bill March 26, 2026 without amendment, so S1297E1 is the text as passed. Section 2 sets the July 1, 2027 effective date. The attorney general enforces it through injunctions and civil penalties of $1,000 per violation, up to $500,000 per operator, or actual damages if greater; there is no private right of action. Customer service, business-internal, enterprise, narrow-topic, voice assistant and limited video game bots are excluded. Minors' protections, which apply when the operator has actual knowledge or reasonable certainty that a user is under 18, include recurring AI disclosures, no unpredictable engagement rewards and measures against sexual content and claims of sentience or emotional dependence.",
   "added": "2026-09-29"
  },
  {
   "id": "il-sb316-2025",
   "state": "IL",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 316, Artificial Intelligence Companion Model Safety Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Operators that make AI companions available to users in Illinois; customer service and productivity bots, entertainment features limited to their content, curriculum-bound educational tools, navigation bots and voice assistants that do not sustain a relationship are excluded",
   "summary": "Would require operators of AI companions to keep a protocol with reasonable methods to detect users' expressions of suicidal ideation or self-harm, to refer those users to crisis services such as the 988 Suicide and Crisis Lifeline and to prevent content encouraging or describing how to commit self-harm, to post a description of the protocol and the yearly number of crisis referrals on their websites, to tell users at the start of an interaction and at least every 3 hours during it that they are communicating with an automated system and not a human, and to take reasonable measures to keep companions from producing material harmful to minors for users the operator knows to be minors.",
   "physician_read": "It binds no one yet; as passed by the Senate, it would take effect Jan. 1, 2027 and would require AI companion operators to refer users who express suicidal ideation or self-harm to crisis services such as 988. It would also amend the Wellness and Oversight for Psychological Resources Act so that a chatbot that complies with this act and does not provide therapy or psychotherapy services falls outside that Act.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/SB316/2025"
    },
    {
     "label": "Engrossed text, as passed by the Senate (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/SB0316/id/3440295"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The history and text come from LegiScan. Filed Jan. 24, 2025; passed the Senate Executive Committee March 19, 2025; re-referred to Assignments April 11, 2025; approved for consideration May 7, 2026; Senate Floor Amendments No. 2 and 3 were adopted and the bill passed the Senate 57-0 on May 21, 2026; in the House it was assigned to the Executive Committee and re-referred to the Rules Committee under Rule 19(a) May 31, 2026; an alternate chief co-sponsor was added June 15, 2026. LegiScan lists it as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The engrossed text says the act takes effect Jan. 1, 2027. The Attorney General or a State's Attorney would enforce it as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, with a share of penalties going to the 9-8-8 Trust Fund, and a person who suffers actual damage could sue under that Act. The minors' duty applies to users the operator knows to be minors, based on ages users give or the operator attributes to them; the bill does not require operators to collect new age data.",
   "added": "2026-09-29"
  },
  {
   "id": "il-hb1806-2025",
   "state": "IL",
   "category": "mental-health",
   "also": [
    "clinical",
    "disclosure"
   ],
   "kind": "law",
   "name": "HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054)",
   "status": "effective",
   "signed": "2025-08-01",
   "effective": "2025-08-01",
   "applies_to": "Any individual, corporation or entity offering therapy or psychotherapy in Illinois, and licensed therapy professionals",
   "summary": "Bars anyone from providing, advertising or offering therapy or psychotherapy to the public in Illinois, including through internet-based AI, unless a licensed professional conducts it; limits licensed professionals' use of AI to administrative and supplementary support and bars them from letting AI make independent therapeutic decisions, interact therapeutically with clients, generate treatment plans without their review and approval, or detect emotions or mental states; and requires written notice and consent before AI is used on a recorded or transcribed session.",
   "physician_read": "Since Aug. 1, 2025, no person or company may offer AI therapy to the public in Illinois, and psychologists, counselors, social workers, marriage and family therapists, psychiatric advanced practice nurses and other licensed therapists may use AI only for administrative and supplementary tasks, with written notice and consent before AI is used on a recorded or transcribed session. The Act's definition of licensed professional excludes physicians; the Department of Financial and Professional Regulation enforces it with civil penalties of up to $10,000 per violation.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/HB1806/2025"
    },
    {
     "label": "Enrolled text (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/HB1806/id/3248540"
    },
    {
     "label": "Department of Financial and Professional Regulation release",
     "url": "https://idfpr.illinois.gov/news/2025/gov-pritzker-signs-state-leg-prohibiting-ai-therapy-in-il.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan; the department's release of Monday, Aug. 4, 2025 says the governor signed the bill the previous Friday. The Act does not apply to religious counseling, peer support, or self-help and educational materials that do not purport to offer therapy. HB 5003 (2026), which would have exempted AI-assisted therapy in qualified research programs, did not leave committee. SB 316 (2025-26), which passed the Senate May 21, 2026 and is pending in the House (separate entry), would add to those exceptions a chatbot that complies with the Artificial Intelligence Companion Model Safety Act and does not provide therapy or psychotherapy services.",
   "added": "2026-09-29"
  },
  {
   "id": "il-hb2472-2024",
   "state": "IL",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "HB 2472, Ins-Adverse Determination (Public Act 103-0656)",
   "status": "effective",
   "signed": "2024-07-19",
   "effective": "2025-01-01",
   "applies_to": "Health care plans and other utilization review programs under the Managed Care Reform and Patient Rights Act",
   "summary": "Requires a health care plan or other utilization review program that uses an algorithmic automated process in utilization review for medical necessity to ensure that only a clinical peer makes any adverse determination based on medical necessity, and requires programs that use algorithmic automated processes to decide on adverse determinations to use objective, evidence-based criteria that meet URAC or NCQA accreditation requirements.",
   "physician_read": "Since Jan. 1, 2025, a health care plan or utilization review program that uses an algorithm in medical necessity review must have a clinical peer, a health care professional in the same profession and the same or similar specialty as the provider who typically manages the condition, make any adverse determination based on medical necessity. It places no duty on physicians.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/HB2472/2023"
    },
    {
     "label": "Chaptered text, Public Act 103-0656 (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/HB2472/id/3014916"
    },
    {
     "label": "5 ILCS 75, Effective Date of Laws Act (Justia copy of the Illinois Compiled Statutes)",
     "url": "https://law.justia.com/codes/illinois/chapter-5/act-5-ilcs-75/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan's bill page and its copy of the chaptered act. The act amends, among others, the Managed Care Reform and Patient Rights Act (Sections 10, 45 and 85), the Health Carrier External Review Act and the Prior Authorization Reform Act. The chaptered text has no effective-date section; under 5 ILCS 75/1 a bill passed before June 1 that sets no effective date takes effect Jan. 1 of the following year, and this bill passed both houses in May 2024, so it took effect Jan. 1, 2025, the date LegiScan also gives.",
   "added": "2026-09-29"
  },
  {
   "id": "il-hb35-2025",
   "state": "IL",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "HB 35, Artificial Intelligence Systems Use in Health Insurance Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Health insurance issuers under the Department of Insurance's jurisdiction, including HMOs, dental service plan corporations, limited health service organizations and health services plan corporations",
   "summary": "Would bar a health insurance issuer from issuing an adverse consumer outcome that denies, reduces or terminates coverage or benefits solely on the use of an AI system or predictive model, require that any such AI-driven decision be meaningfully reviewed, under procedures set by Department of Insurance rules, by an individual with authority to override the AI system, who must be a clinical peer when the decision is an adverse determination under the Managed Care Reform and Patient Rights Act, set out the department's authority to examine insurers' AI systems, and let the department adopt rules on disclosing insurers' AI use to consumers.",
   "physician_read": "It binds no one yet. As passed by the House, a health insurer could not deny, reduce or terminate coverage or benefits solely on an AI system's or predictive model's output, and when such a decision is an adverse determination under the Managed Care Reform and Patient Rights Act, a clinical peer with authority to override the AI system would have to review it.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/HB35/2025"
    },
    {
     "label": "Engrossed text, as passed by the House (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/HB0035/id/3207940"
    },
    {
     "label": "5 ILCS 75, Effective Date of Laws Act (Justia copy of the Illinois Compiled Statutes)",
     "url": "https://law.justia.com/codes/illinois/chapter-5/act-5-ilcs-75/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The history and text come from LegiScan. Prefiled Dec. 6, 2024; passed the House Insurance Committee March 11, 2025 (11-6); House Floor Amendment No. 1 adopted and the bill passed the House 79-35 on April 9, 2025; in the Senate it was assigned to the Executive Committee April 23, 2025; the last action was June 2, 2025, when Senate Committee Amendment No. 1 was re-referred to Assignments under Rule 3-9(a). LegiScan lists the bill as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The engrossed text defines an adverse consumer outcome to include any claim denial determined by the use of an AI system; its disclosure section only authorizes rules, which may cover notice before AI use and after an adverse decision, correction of inaccurate information and appeal instructions. It sets no effective date; under 5 ILCS 75/2 a bill passed after May 31 takes effect June 1 of the next year unless three-fifths of each house votes for an earlier date.",
   "added": "2026-09-29"
  },
  {
   "id": "il-naic-ai-bulletin-2024",
   "state": "IL",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Company Bulletin 2024-08, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-03-13",
   "effective": "2024-03-13",
   "applies_to": "All insurers and regulated entities licensed to do business in Illinois, including health insurers",
   "summary": "Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems, covering governance, risk management and internal controls and the oversight of third-party AI vendors, to prevent adverse consumer outcomes, and lists the documentation the Department of Insurance may request; the NAIC lists it as Illinois' adoption of its model bulletin.",
   "physician_read": "It places no duty on physicians. Since March 2024, health insurers in Illinois are expected to govern the AI systems they use in decisions that affect consumers and to show the Department of Insurance their governance, testing and vendor controls on request.",
   "sources": [
    {
     "label": "Department of Insurance bulletin",
     "url": "https://idoi.illinois.gov/content/dam/soi/en/web/insurance/companies/companybulletins/CB2024-08.pdf"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Director Dana Popish Severinghaus. The bulletin states no separate effective date; the issue date is used. It applies to all lines and does not single out health insurers or utilization review; it cites the Illinois Insurance Code's unfair methods of competition and improper claims practices provisions, among others.",
   "added": "2026-09-29"
  },
  {
   "id": "il-sb3114-2026",
   "state": "IL",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 3114, Transparency in Downcoding Act (Public Act 104-0568)",
   "status": "enacted",
   "signed": "2026-07-10",
   "effective": "2028-01-01",
   "applies_to": "Health care payors: group health plan sponsors, health insurance issuers and Medicaid managed care organizations",
   "summary": "Bars a health care payor from using any policy, algorithm or other automated process, system or tool that bypasses evaluation of the billing professional's information to downcode a claim, requires every downcoding determination to be made or reviewed by a natural person following AMA CPT coding guidelines, and requires notice of the specific reason, the original and revised codes and payment amounts, and a dispute process that allows at least 90 days.",
   "physician_read": "From Jan. 1, 2028, a payor that downcodes a claim from a physician, physician assistant or advanced practice registered nurse must have a natural person make or review the decision under CPT guidelines, state the specific reason with the clinical information and coding guidance used, list the original and revised codes and payments, and allow at least 90 days to dispute. Automated tools may flag claims for possible downcoding but may not bypass the billing professional's documentation, and payors may not target professionals who routinely treat patients with complex or chronic conditions.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/SB3114/2025"
    },
    {
     "label": "Enrolled text (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/SB3114/id/3441903"
    },
    {
     "label": "Illinois House Democrats release (secondary)",
     "url": "https://ilhousedems.com/2026/07/31/chungs-transparency-in-downcoding-act-becomes-law/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan. The enrolled text does not use the term artificial intelligence; it reaches any algorithm or other automated process, system or tool. Section 10(a) applies the act to policies and contracts for health insurance coverage and to State, employee, county, municipality and school district group health plans issued, amended, delivered or renewed on or after the act's Jan. 1, 2028 effective date. It adds Section 5-5.12g to the Illinois Public Aid Code to bind Medicaid managed care organizations. Disputes go to a qualified person who did not make the original downcode. A tracker lead that listed this law as HB 3568 is wrong: HB 3568 (2025) is an unrelated single-payer bill.",
   "added": "2026-09-29"
  },
  {
   "id": "il-bipa-2008",
   "state": "IL",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "Biometric Information Privacy Act, 740 ILCS 14 (Public Act 95-994)",
   "status": "effective",
   "signed": "",
   "effective": "2008-10-03",
   "applies_to": "Private entities that collect, capture, possess or store biometric identifiers or biometric information",
   "summary": "Requires a private entity to keep a public written policy with a retention schedule and destruction guidelines, to give written notice of the purpose and length of collection and obtain a written release before collecting a biometric identifier or biometric information, and bars selling or profiting from it, with a private right of action for $1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages if greater.",
   "physician_read": "The Act excludes information captured from a patient in a health care setting and information collected, used or stored for treatment, payment or operations under HIPAA. Outside those exclusions, a practice that collects fingerprints, face geometry or other biometric identifiers, for example from employees, must give written notice, obtain a written release and follow a public retention and destruction schedule.",
   "sources": [
    {
     "label": "740 ILCS 14, statute text (Justia copy of the 2025 Illinois Compiled Statutes)",
     "url": "https://law.justia.com/codes/illinois/chapter-740/act-740-ilcs-14/"
    },
    {
     "label": "SB 2979 (2024 amendment), LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/SB2979/2023"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The statute text and its source notes were read on Justia's copy of the 2025 Illinois Compiled Statutes, which cites P.A. 95-994, effective Oct. 3, 2008, for the original sections and P.A. 103-769, effective Aug. 2, 2024, for Sections 10 and 20. The governor's approval date for P.A. 95-994 was not confirmed. The 2024 amendment (SB 2979) is a separate entry.",
   "added": "2026-09-29"
  },
  {
   "id": "il-sb2979-2024",
   "state": "IL",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 2979, BIPA-Procedure-Damages (Public Act 103-0769)",
   "status": "effective",
   "signed": "2024-08-02",
   "effective": "2024-08-02",
   "applies_to": "Private entities subject to the Biometric Information Privacy Act",
   "summary": "Amends the Biometric Information Privacy Act so that a private entity that collects the same person's biometric identifier or information more than once by the same method, or discloses it more than once to the same recipient by the same method, commits a single violation with at most one recovery, and allows the required written release to be given by electronic signature.",
   "physician_read": "Since Aug. 2, 2024, a practice or other private entity that repeatedly collects the same person's biometric identifier by the same method without meeting the Act's requirements has committed one violation, with at most one recovery for that person, and the written release the Act requires may be signed electronically.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/SB2979/2023"
    },
    {
     "label": "Chaptered text, Public Act 103-0769 (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/SB2979/2023"
    },
    {
     "label": "740 ILCS 14 as amended (Justia copy)",
     "url": "https://law.justia.com/codes/illinois/chapter-740/act-740-ilcs-14/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status and dates come from LegiScan, which records the act as effective Aug. 2, 2024, the day the governor approved it. The amended Sections 10 and 20 were read in LegiScan's copy of the chaptered act and on Justia's copy of the statute.",
   "added": "2026-09-29"
  },
  {
   "id": "il-sb340-2025",
   "state": "IL",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 340, Illinois Consumer Data Privacy Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Businesses in Illinois that collect or process personal data of 100,000 or more consumers (excluding payment-only data), or of 25,000 or more while deriving over 25 percent of gross revenue from selling personal data; small businesses are exempt except from a limit on selling sensitive data",
   "summary": "Would give consumers rights to access, correct, delete and port their personal data, to opt out of targeted advertising, sale and profiling in furtherance of automated decisions with legal or similarly significant effects, including decisions on health care services, and to question the result of such profiling, would require consent before a controller processes sensitive data, which includes mental or physical health conditions and diagnoses, and would require data protection assessments for processing such as sensitive data and certain profiling.",
   "physician_read": "It binds no one yet. As passed by the Senate, it would exclude protected health information and health records but not HIPAA-covered practices as such, so a practice that meets its thresholds would have to apply it to personal data it holds that is not protected health information or a health record, and from Jan. 1, 2028 a person who suffers actual damage from a violation could sue.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/IL/bill/SB340/2025"
    },
    {
     "label": "Engrossed text, as passed by the Senate (LegiScan copy)",
     "url": "https://legiscan.com/IL/text/SB0340/id/3440313"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The history and text come from LegiScan. Filed Jan. 24, 2025; passed the Senate Executive Committee March 19, 2025; re-referred to Assignments April 11, 2025; approved for consideration May 7, 2026; four Senate floor amendments were adopted and the bill passed the Senate 54-3 on May 21, 2026; in the House it was assigned to the Executive Committee and re-referred to the Rules Committee under Rule 19(a) May 31, 2026. LegiScan lists it as dead ('died in committee'); the 104th General Assembly can still take it up, including in its fall veto session, until its term ends in January 2027. The health exclusions cover protected health information, health records and information that originates from and is intermingled with them when maintained by a covered entity or business associate acting as such. The Attorney General and State's Attorneys would enforce it through the Consumer Fraud and Deceptive Business Practices Act, after a warning letter and a 30-day cure period that ends Jan. 1, 2028; from Jan. 1, 2028 a person who suffers actual damage could sue under that Act. The engrossed text sets no effective date.",
   "added": "2026-09-29"
  },
  {
   "id": "in-hb1271-2026",
   "state": "IN",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "HB 1271, Payment of Health Claims (House Enrolled Act 1271, Public Law 88-2026)",
   "status": "effective",
   "signed": "2026-03-04",
   "effective": "2026-07-01",
   "applies_to": "Accident and sickness insurers, HMOs, insurers with dental preferred provider plans and their third-party contractors (not Medicaid or Medicaid managed care); providers that submit claims to them",
   "summary": "Bars an insurer from using an automated process, system or tool, including AI, as the sole basis to downcode a claim based on medical necessity without an employee or contractor reviewing the covered individual's medical record, requires insurers to disclose in an easily accessible and readable manner when AI is used to make an adverse prior authorization determination or to downcode a claim, and bars providers from using such tools to submit a claim without review by a provider or other person involved in developing it.",
   "physician_read": "From July 1, 2026, a physician or practice may not use an automated process, system or tool, including AI, to submit a claim under a state-regulated accident and sickness policy, HMO contract or dental preferred provider plan (Medicaid is excluded) without review by a provider or other person involved in developing the claim. Those insurers may not use such a tool as the sole basis to downcode a claim on medical necessity grounds unless an employee or contractor reviews the patient's medical record, must notify the provider of each downcode with claim adjustment and remittance codes, the reason and clinical criteria and the original and revised codes and payments, must allow at least 180 days to appeal, and must disclose when AI is used to make an adverse determination on a prior authorization request or to downcode a claim.",
   "sources": [
    {
     "label": "LegiScan bill page (iga.in.gov bill pages require JavaScript)",
     "url": "https://legiscan.com/IN/bill/HB1271/2026"
    },
    {
     "label": "Enrolled act (LegiScan copy)",
     "url": "https://legiscan.com/IN/text/HB1271/id/3377348/Indiana-2026-HB1271-Enrolled.pdf"
    },
    {
     "label": "Holland & Knight (secondary)",
     "url": "https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-regulate-ai-in-healthcare"
    }
   ],
   "checked": "2026-09-29",
   "notes": "iga.in.gov bill pages need JavaScript and the enrolled act could not be opened there, so status, dates and text come from LegiScan's bill page and its copy of the enrolled act. SECTION 6 of the act adds the AI rules as a new chapter, IC 27-1-52 (Downcoding of Health Benefits Claims), with the effective-date line July 1, 2026; the chapter does not apply to the Medicaid program or Medicaid managed care organizations (IC 27-1-52-0.3) and directs the Department of Insurance to adopt rules. The provider rule is IC 27-1-52-9(b); a health benefits claim is a claim a provider submits for payment under a health plan as the chapter defines it. The act also limits retroactive rate reductions, sets time frames for claim audits and overpayment recovery, and requires hospital payment-assistance notices. The chapter does not say to whom the insurer's AI disclosure must be made.",
   "added": "2026-09-29"
  },
  {
   "id": "in-sb5-2023",
   "state": "IN",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 5, Consumer Data Protection (Senate Enrolled Act 5, Public Law 94-2023), IC 24-15",
   "status": "effective",
   "signed": "2023-05-01",
   "effective": "2026-01-01",
   "applies_to": "Businesses that control or process personal data of at least 100,000 Indiana consumers, or of 25,000 while deriving more than 50% of gross revenue from selling personal data; HIPAA covered entities and business associates are exempt",
   "summary": "Gives Indiana consumers rights to confirm, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent to process sensitive data, including a mental or physical health diagnosis made by a health care provider and biometric data, and requires data protection impact assessments, enforced by the attorney general after a 30-day cure period with civil penalties of up to $7,500 per violation.",
   "physician_read": "It places no duty on practices that are HIPAA covered entities, and protected health information is exempt. Since Jan. 1, 2026, health apps and other businesses outside HIPAA that meet the thresholds must get consent before processing a health diagnosis or biometric data and must honor opt-outs from consequential profiling.",
   "sources": [
    {
     "label": "IC 24-15, Indiana Code 2026 edition",
     "url": "https://iga.in.gov/ic/2026/Title_24/Article_15.pdf"
    },
    {
     "label": "LegiScan bill page (iga.in.gov bill pages require JavaScript)",
     "url": "https://legiscan.com/IN/bill/SB0005/2023"
    },
    {
     "label": "Attorney General, Consumer Data Protection Bill of Rights",
     "url": "https://secure.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Provisions were read in the 2026 edition of IC 24-15 on iga.in.gov; the history note for IC 24-15-1-1 (applicability and exemptions) shows one amendment since enactment, by P.L.236-2025. IC 24-15-1-1 exempts any covered entity or business associate governed by the HIPAA privacy, security and breach notification rules as an entity. The act defines sensitive data to include a mental or physical health diagnosis made by a health care provider, genetic or biometric data processed to identify a person, a known child's data and precise geolocation. The Jan. 1, 2026 start date is given by LegiScan and the attorney general's guide.",
   "added": "2026-09-29"
  },
  {
   "id": "ky-naic-ai-bulletin-2024",
   "state": "KY",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 2024-02, The Use of Artificial Intelligence Systems in the Business of Insurance",
   "status": "effective",
   "signed": "2024-04-16",
   "effective": "2024-04-16",
   "applies_to": "Insurers doing business in Kentucky, including health insurers",
   "summary": "Adopts the NAIC Model Bulletin, which expects insurers to maintain a written program for the responsible use of AI systems in decisions affecting consumers, with governance, risk management and controls, oversight of third-party systems and documentation available to the department.",
   "physician_read": "It places no duty on physicians. Since April 16, 2024, an insurer doing business in Kentucky, including a health insurer, is expected to govern the AI systems it uses in decisions affecting consumers under a written program.",
   "sources": [
    {
     "label": "Department of Insurance bulletin (scanned PDF)",
     "url": "https://insurance.ky.gov/ppc/Documents/20240416-0942.pdf"
    },
    {
     "label": "Department of Insurance bulletins and advisories page",
     "url": "https://insurance.ky.gov/ppc/new_bulletin.aspx?bullid=1"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    },
    {
     "label": "NAIC Model Bulletin text",
     "url": "https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf"
    },
    {
     "label": "McDermott Will & Emery (secondary)",
     "url": "https://www.mcdermottlaw.com/insights/state-regulators-address-insurers-use-of-ai-11-states-adopt-naic-model-bulletin/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The department's bulletins and advisories page lists Bulletin 2024-02, 'The Use of Artificial Intelligence Systems in the Business of Insurance,' dated April 16, 2024, and links to the bulletin, which is posted as a scanned image, so its addressees and wording could not be checked. The NAIC's adoption map lists Bulletin No. 2024-02, adopted April 16, 2024, as Kentucky's adoption of the NAIC Model Bulletin, and the summary, applies_to and physician_read follow the model's terms. No separate effective date could be read, so the issue date is used. The department's list shows no other AI bulletin.",
   "added": "2026-09-29"
  },
  {
   "id": "ky-hb15-2024",
   "state": "KY",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 15 (2024 Acts Ch. 72), Kentucky Consumer Data Protection Act",
   "status": "effective",
   "signed": "2024-04-04",
   "effective": "2026-01-01",
   "applies_to": "Businesses in Kentucky, or targeting its residents, that process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data; HIPAA covered entities, business associates and protected health information are exempt",
   "summary": "Gives consumers rights to confirm, access, correct, delete and obtain a copy of their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent before processing sensitive data, including a mental or physical health diagnosis, identifying genetic or biometric data and precise geolocation, and requires data protection assessments for processing created or generated on or after June 1, 2026.",
   "physician_read": "Since Jan. 1, 2026, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health diagnosis, identifying genetic or biometric data, or precise geolocation. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.",
   "sources": [
    {
     "label": "Bill record",
     "url": "https://apps.legislature.ky.gov/record/24rs/hb15.html"
    },
    {
     "label": "Act (2024 Acts Ch. 72)",
     "url": "https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Attorney General has exclusive authority to enforce it; a controller gets 30 days to cure after written notice, after which the Attorney General may seek damages of up to $7,500 for each continued violation, and the act creates no private right of action. HB 692 (2026 Acts Ch. 118, signed April 13, 2026, effective July 1, 2027) amends the act to bar collecting automatic content recognition data from smart monitors without consent; it does not change the health, biometric or profiling provisions.",
   "added": "2026-09-29"
  },
  {
   "id": "la-hb475-2026",
   "state": "LA",
   "category": "disclosure",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "HB 475 (Act 649 of 2026), R.S. 37:22.1, Recordings; artificial intelligence; disclosure",
   "status": "effective",
   "signed": "2026-06-02",
   "effective": "2026-08-01",
   "applies_to": "Health care professionals licensed under Title 37 of the Louisiana Revised Statutes, including physicians, nurses and licensed mental health professionals",
   "summary": "Requires a licensed health care professional to tell a patient verbally about any recording device, software or service before recording any part of an appointment or treatment that will be transcribed by artificial intelligence.",
   "physician_read": "Since Aug. 1, 2026, a physician in Louisiana who records any part of an appointment or treatment to be transcribed by AI, as with an ambient AI scribe, must first verbally disclose the recording device, software or service to the patient; the law requires disclosure, not consent. A professional who violates the section may be disciplined by the licensing board and, under the statute, is immune from civil liability absent gross negligence or willful misconduct.",
   "sources": [
    {
     "label": "Act 649",
     "url": "https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1480567"
    },
    {
     "label": "Bill page",
     "url": "https://legis.la.gov/legis/BillInfo.aspx?s=26RS&b=HB475&sbi=y"
    },
    {
     "label": "Louisiana Constitution, Art. III, Sec. 19 (effective date of laws)",
     "url": "https://senate.la.gov/Documents/Constitution/Article3.htm"
    },
    {
     "label": "Arnall Golden Gregory (secondary)",
     "url": "https://www.agg.com/news-insights/publications/louisiana-requires-verbal-disclosure-before-ai-assisted-recording-of-patient-encounters/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The bill page's title, written for the bill as filed, says it requires a patient's consent before a visit is recorded; the enacted section requires only verbal disclosure and does not require written documentation of it. R.S. 37:22.1(B) attaches both the possibility of board discipline and the immunity from civil liability absent gross negligence or willful misconduct to 'any healthcare professional who violates the provisions of this Section.' The bill page shows the governor signed it June 2, 2026. The act has no effective-date section; the bill page lists Aug. 1, 2026, the date on which laws enacted in a regular session take effect under Article III, Section 19 of the Louisiana Constitution unless the bill sets another date. That Title 37 covers physicians, nurses and mental health professionals, among others, is stated in Arnall Golden Gregory's summary (secondary). A tracker listed this law as HB 476.",
   "added": "2026-09-29"
  },
  {
   "id": "la-sb386-2026",
   "state": "LA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 386 (Act 502 of 2026), Louisiana Data Privacy Act",
   "status": "enacted",
   "signed": "2026-05-29",
   "effective": "2027-01-01",
   "applies_to": "Businesses in Louisiana with more than $25 million in annual gross revenue, or that buy, receive, sell or share personal information of 75,000 or more consumers, households or devices, or that derive 50% or more of revenue from selling personal information; HIPAA covered entities, business associates and protected health information are exempt",
   "summary": "Gives consumers rights to access, correct, delete and port personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent before processing sensitive data, including data revealing a mental or physical health diagnosis, identifying genetic or biometric data and precise geolocation, and requires data protection assessments for sensitive data and risky profiling.",
   "physician_read": "From Jan. 1, 2027, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health diagnosis, identifying genetic or biometric data, or precise geolocation. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.",
   "sources": [
    {
     "label": "Enrolled act",
     "url": "https://legis.la.gov/legis/ViewDocument.aspx?d=1475339"
    },
    {
     "label": "Bill page",
     "url": "https://legis.la.gov/legis/BillInfo.aspx?s=26RS&b=SB386&sbi=y"
    },
    {
     "label": "Jones Walker (secondary)",
     "url": "https://www.joneswalker.com/en/insights/blogs/ai-law-blog/louisiana-becomes-the-twenty-second-privacy-state-and-almost-the-second-to-embed.html?id=102n12k"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Enacts R.S. 51:1780.1 through 1780.5. The bill page's summary ('opting out of providing personal information on social media websites') describes the bill as filed; the enrolled act is a comprehensive privacy law. The Attorney General enforces it as an unfair or deceptive trade practice with no private right of action; from Jan. 1 to July 31, 2027, the Attorney General must give 30 days' written notice and a chance to cure before acting. Jones Walker reports that a Senate-passed duty for processors to secure personal data handled by AI systems was removed in the House Commerce Committee.",
   "added": "2026-09-29"
  },
  {
   "id": "ma-s2632-2025",
   "state": "MA",
   "category": "mental-health",
   "also": [
    "payer",
    "disclosure"
   ],
   "kind": "law",
   "name": "S.2632, An Act relative to the use of artificial intelligence and other software tools in healthcare decision-making",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Anyone offering therapy or psychotherapy to the public; licensed mental health professionals other than physicians; carriers and utilization review organizations that use AI",
   "summary": "Would bar offering therapy or psychotherapy to the public, including through AI, unless a licensed professional conducts it, limit licensed professionals' AI use to administrative and supplementary support with written notice and consent before AI is used on recorded or transcribed sessions, and require carriers and utilization review organizations using AI to base determinations on the individual patient's clinical information, with medical necessity determinations made only by a licensed physician or competent licensed health care professional.",
   "physician_read": "It binds no one yet: the bill has sat in the Senate Ways and Means Committee since April 2, 2026. Its limits on professionals' AI use would not reach physicians, whom the bill excludes from its definition of licensed professional, but its utilization review section would require medical necessity determinations by a licensed physician or competent licensed health care professional and let insureds sue over violations.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://malegislature.gov/Bills/194/S2632"
    },
    {
     "label": "Bill text",
     "url": "https://malegislature.gov/Bills/194/S2632.pdf"
    },
    {
     "label": "S.46 (original bill)",
     "url": "https://malegislature.gov/Bills/194/S46"
    },
    {
     "label": "Joint Rules of the 194th General Court (Joint Rule 12A)",
     "url": "https://malegislature.gov/Laws/Rules/Joint"
    },
    {
     "label": "Hooper Lundy & Bookman (secondary)",
     "url": "https://hooperlundy.com/legislation-in-massachusetts-addresses-data-privacy-protections-use-of-ai-for-mental-health-and-use-of-ai-for-utilization-review/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "New draft of S.46 (Sens. Michael O. Moore and James B. Eldridge), reported favorably by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on Oct. 16, 2025 and by the Health Care Financing Committee on April 2, 2026, then referred to Senate Ways and Means. Section 1 would add section 298 to chapter 112 (enforced by the Division of Occupational Licensure, civil penalties up to $10,000 per violation); section 2 would amend chapter 176O, section 12, with a private right of action for insureds (the greater of $5,000 per insured per violation or actual damages, plus other relief). Licensed professionals may not let AI make independent therapeutic decisions, interact with clients in therapeutic communication, generate treatment plans without their review or detect emotions or mental states. Under Joint Rule 12A of the joint rules adopted June 26, 2025, formal business of the second annual session had to conclude by July 31, 2026, and later formal sessions are limited to reports of conference committees formed by that date, appropriation bills and bills returned by the governor, so the bill can pass only in an informal session before the term ends in January 2027. The text sets no effective date.",
   "added": "2026-09-29"
  },
  {
   "id": "ma-h4616-2025",
   "state": "MA",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "H.4616, An Act improving the health insurance prior authorization process",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Health carriers and their utilization review",
   "summary": "Would require carriers to publish prior authorization lists, report approval and denial data and treat complete requests as approved when response deadlines pass, bar an AI-based algorithm or other software tool from being the sole basis for denying, delaying or modifying care, require adverse medical necessity determinations by a licensed physician or competent licensed provider, and require carriers to disclose their AI use to the Division of Insurance, network providers, enrollees and the public.",
   "physician_read": "It binds no one yet: the bill has sat in the House Ways and Means Committee since July 29, 2026. If enacted as reported, a carrier could not deny, delay or modify care on medical necessity grounds solely on the basis of an AI algorithm or other software tool, and an adverse medical necessity determination or preauthorization denial would have to be made by a licensed physician or a licensed health care provider competent to evaluate the clinical issues.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://malegislature.gov/Bills/194/H4616"
    },
    {
     "label": "Bill text",
     "url": "https://malegislature.gov/Bills/194/H4616.pdf"
    },
    {
     "label": "Joint Rules of the 194th General Court (Joint Rule 12A)",
     "url": "https://malegislature.gov/Laws/Rules/Joint"
    },
    {
     "label": "American College of Radiology (secondary)",
     "url": "https://www.acr.org/News-and-Publications/Massachusetts-Legislature-Updates-Prior-Authorization-Bill"
    }
   ],
   "checked": "2026-09-29",
   "notes": "New draft of H.1136, reported favorably by the Joint Committee on Financial Services on Oct. 20, 2025; the Health Care Financing Committee recommended it ought to pass on July 29, 2026, after three reporting-date extensions, and it was referred to House Ways and Means. Section 8 would insert the AI rules as section 12D of chapter 176O: AI tools must base determinations on the enrollee's own clinical history and circumstances rather than group data alone, be open to Division of Insurance audit and be periodically reviewed. As printed, section 14 would make section 8 take effect Jan. 1, 2026, a date already past (with its new section 12C on prior authorization interfaces taking effect Jan. 1, 2027); sections 2 to 7 would also take effect Jan. 1, 2026, sections 9 and 10 on passage and section 11 on April 1, 2027. Under Joint Rule 12A, formal business of the session had to conclude by July 31, 2026, apart from conference reports, appropriation bills and bills returned by the governor, so the bill can pass only in an informal session before the term ends in January 2027.",
   "added": "2026-09-29"
  },
  {
   "id": "ma-naic-ai-bulletin-2024",
   "state": "MA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 2024-10, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-12-09",
   "effective": "2024-12-09",
   "applies_to": "All insurers licensed to do business in Massachusetts, including health insurers, hospital and medical service corporations and HMOs (chapters 175, 176A, 176B, 176G and others)",
   "summary": "States that insurers' decisions affecting consumers that are made or supported by AI systems must comply with state insurance and unfair-practice laws, expects each insurer to maintain a written AI systems program covering governance, risk management, internal controls and oversight of third-party AI systems and data, and warns that insurers can expect questions about their AI use in any investigation or market conduct action.",
   "physician_read": "It places no duty on physicians. Since Dec. 9, 2024, health insurers licensed in Massachusetts are expected to govern AI systems used in decisions that affect patients, and the Division of Insurance may examine that use.",
   "sources": [
    {
     "label": "Bulletin 2024-10",
     "url": "https://www.mass.gov/doc/bulletin-2024-10-the-use-of-artificial-intelligence-systems-in-insurance-issued-december-9-2024/download"
    },
    {
     "label": "Division of Insurance bulletins list",
     "url": "https://www.mass.gov/lists/doi-bulletins"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued by Commissioner of Insurance Michael T. Caljouw; the bulletin carries no signature block. It is addressed to insurers licensed under chapters 175, 152 (sections 25E to 25U), 176, 176A, 176B, 176E, 176F, 176G, 176H and 176P. The NAIC's Aug. 31, 2026 map lists Bulletin 2024-10 as Massachusetts' adoption of the NAIC Model Bulletin; the bulletin follows the model's structure (a written AIS Program) and cites the NAIC's 2020 AI Principles, but its text does not name the model bulletin. The bulletin sets no separate effective date, so the issue date is used. It is the only AI bulletin on the Division's 2024 to 2026 bulletin list.",
   "added": "2026-09-29"
  },
  {
   "id": "ma-s2619-2025",
   "state": "MA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "S.2619, An Act establishing the Massachusetts data privacy act (House amendment H.5479)",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Businesses that control or process Massachusetts residents' personal data above set thresholds; HIPAA-regulated data exempt",
   "summary": "Would create a comprehensive consumer privacy law that treats health, biometric, genetic, neural and precise geolocation data as sensitive data; the Senate version bans the sale of sensitive data and limits its collection to what is strictly necessary for a product or service the consumer requested, while the House version requires affirmative consent to collect or sell sensitive data and bans the sale of precise geolocation data.",
   "physician_read": "It binds no one yet: the Senate and House passed different versions and a conference committee has held the bill since June 2026. Both versions exempt protected health information handled under HIPAA; the House version also exempts HIPAA covered entities and business associates outright, while the Senate version exempts only those that process the data of no more than 60,000 consumers, so a larger HIPAA-covered practice would remain covered for personal data that is not protected health information.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://malegislature.gov/Bills/194/S2619"
    },
    {
     "label": "Senate text",
     "url": "https://malegislature.gov/Bills/194/S2619.pdf"
    },
    {
     "label": "House amendment H.5479",
     "url": "https://malegislature.gov/Bills/194/H5479.pdf"
    },
    {
     "label": "Joint Rules of the 194th General Court (Joint Rule 12A)",
     "url": "https://malegislature.gov/Laws/Rules/Joint"
    },
    {
     "label": "Hooper Lundy & Bookman (secondary)",
     "url": "https://hooperlundy.com/legislation-in-massachusetts-addresses-data-privacy-protections-use-of-ai-for-mental-health-and-use-of-ai-for-utilization-review/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Senate passed S.2619 (S.2608 as amended) 40-0 on Sept. 25, 2025. The House substituted H.5472 and passed it 146-0 on June 4, 2026 (text published as H.5479); the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity's earlier House draft was H.4746 (Nov. 17, 2025). The Senate did not concur on June 11, 2026, and conferees were appointed June 11 and June 17, 2026; the bill page showed no later action on Sept. 29, 2026. Joint Rule 12A lets the chambers meet in formal session after July 31 of the second year to take up reports of conference committees formed on or before July 31, so the bill remains alive. Thresholds differ: the Senate text reaches persons that processed the data of 60,000 consumers, or 20,000 with 20 percent of revenue from data sales, or that collected, processed or transferred consumers' reproductive or sexual health data; the House text reaches 100,000 consumers, $100,000 in data-sale revenue, or any processing of sensitive data. The Senate text gives the Attorney General exclusive enforcement authority and states no private right of action; the House text makes a violation an unfair or deceptive practice under chapter 93A and gives the Attorney General exclusive authority to sue controllers and processors other than large data holders (data of more than 2,000,000 consumers or sensitive data of more than 200,000), and states no private right of action. Proposed effective dates differ: Jan. 1, 2027 and June 1, 2027 for the Senate text's two sections; July 1, 2027 for the House text.",
   "added": "2026-09-29"
  },
  {
   "id": "md-hb820-2025",
   "state": "MD",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "HB 820, Health Insurance - Utilization Review - Use of Artificial Intelligence (Chapter 747 of 2025)",
   "status": "effective",
   "signed": "2025-05-20",
   "effective": "2025-10-01",
   "applies_to": "Carriers, pharmacy benefits managers and private review agents that use AI, algorithms or other software tools for utilization review",
   "summary": "Requires carriers, pharmacy benefits managers and private review agents that use an AI, algorithm or other software tool for utilization review to ensure it bases determinations on the enrollee's own clinical history and circumstances and not solely on a group dataset, does not replace the health care provider's role in the determination, does not result in unfair discrimination, is open to audit by the Insurance Commissioner and is reviewed at least quarterly, bars such a tool from denying, delaying or modifying health care services, and requires carriers' quarterly reports to state whether such a tool was used in making an adverse decision.",
   "physician_read": "Since Oct. 1, 2025, an AI, algorithm or other software tool used by a carrier, pharmacy benefits manager or private review agent for utilization review in Maryland may not deny, delay or modify health care services, must base determinations on the patient's own clinical history, circumstances or other clinical information rather than solely on a group dataset, and may not replace the health care provider's role in the determination. Carriers' quarterly reports to the Maryland Insurance Administration must state whether such a tool was used in making the adverse decisions reported.",
   "sources": [
    {
     "label": "Chaptered text, Chapter 747 of 2025",
     "url": "https://mgaleg.maryland.gov/2025RS/Chapters_noln/CH_747_hb0820t.pdf"
    },
    {
     "label": "General Assembly bill page, HB 820 (2025)",
     "url": "https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0820?ys=2025RS"
    },
    {
     "label": "LegiScan text page, HB 820 (chapter number and approval date)",
     "url": "https://legiscan.com/MD/text/HB820/2025"
    },
    {
     "label": "Maryland Insurance Administration Bulletin 25-9, Summary of Insurance Laws Enacted in 2025",
     "url": "https://insurance.maryland.gov/Insurer/Documents/bulletins/25-9-Summary-of-Insurance-Laws-Enacted-in-2025.pdf"
    },
    {
     "label": "Fiscal and Policy Note, third reader revised",
     "url": "https://mgaleg.maryland.gov/2025RS/fnotes/bil_0000/hb0820.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Adds section 15-10B-05.1 to the Insurance Article and amends section 15-10A-06 (quarterly reports on appeals and grievances). Passed the House March 6, 2025 (135-0) and the Senate April 7, 2025 (47-0); approved by the governor May 20, 2025 as Chapter 747, with an Oct. 1, 2025 effective date in the chaptered text. The tool must also comply with applicable law, apply criteria fairly and equitably, have written policies and procedures included in the utilization plan, be reviewed and revised at least quarterly, not use patient data beyond its intended and stated purpose and not directly or indirectly cause harm to an enrollee. Two 2026 bills to add to these rules did not advance: HB 795 (AI Health Insurance Accountability Act of 2026) was withdrawn by its sponsor Feb. 23, 2026, and HB 1385 (human evaluation) had a committee hearing and no further action.",
   "added": "2026-09-29"
  },
  {
   "id": "md-naic-ai-bulletin-2024",
   "state": "MD",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 24-11, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-04-22",
   "effective": "2024-04-22",
   "applies_to": "All insurers, nonprofit health service plans, health maintenance organizations and dental plan organizations holding certificates of authority in Maryland",
   "summary": "Reminds insurers and health plans that decisions made or supported by AI systems must comply with Maryland insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects a written AI systems program with governance and senior management accountability, risk management and internal audit controls, documentation and due diligence on third-party AI vendors and data.",
   "physician_read": "It places no duty on physicians. Since April 22, 2024, insurers, nonprofit health service plans and HMOs in Maryland that use AI in regulated insurance decisions are expected to keep a written AI program with governance, risk controls and vendor oversight, which the Maryland Insurance Administration may review.",
   "sources": [
    {
     "label": "Maryland Insurance Administration Bulletin 24-11",
     "url": "https://insurance.maryland.gov/Insurer/Documents/bulletins/24-11-The-Use-of-Artificial-Intelligence-Systems-in-Insurance.pdf"
    },
    {
     "label": "Maryland Insurance Administration, 2024 bulletins",
     "url": "https://insurance.maryland.gov/Pages/2024-Bulletins.aspx"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Maryland's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted April 22, 2024. Signed by Commissioner Kathleen A. Birrane. It states no separate effective date; the issue date is used. It does not address utilization review specifically; HB 820 (Chapter 747 of 2025), entered separately, added statutory rules for AI in utilization review.",
   "added": "2026-09-29"
  },
  {
   "id": "md-sb541-2024",
   "state": "MD",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 541, Maryland Online Data Privacy Act of 2024 (Chapter 455 of 2024)",
   "status": "effective",
   "signed": "2024-05-09",
   "effective": "2025-10-01",
   "applies_to": "Persons that do business in Maryland or target Maryland residents and control or process the personal data of at least 35,000 consumers, or of at least 10,000 while deriving more than 20% of gross revenue from selling personal data; protected health information under HIPAA is exempt",
   "summary": "Bars controllers from collecting, processing or sharing sensitive data, which includes consumer health data, genetic and biometric data, precise geolocation and children's data, unless strictly necessary to provide or maintain a product or service the consumer requested, bans the sale of sensitive data, lets consumers opt out of profiling in furtherance of solely automated decisions with legal or similarly significant effects, including decisions on health care services, and requires regular data protection assessments for high-risk processing, including an assessment of each algorithm used.",
   "physician_read": "Protected health information under HIPAA is exempt, but HIPAA covered entities are not exempt as entities: a practice that meets the thresholds must follow the act for personal data that is not protected health information. Since Oct. 1, 2025, businesses that meet the thresholds may collect, process or share consumer health data and other sensitive data only when strictly necessary to provide or maintain a product or service the consumer requested, and may not sell it.",
   "sources": [
    {
     "label": "Chaptered text, Chapter 455 of 2024",
     "url": "https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf"
    },
    {
     "label": "General Assembly bill page, SB 541 (2024)",
     "url": "https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS"
    },
    {
     "label": "LegiScan text page, SB 541 (chapter number and approval date)",
     "url": "https://legiscan.com/MD/text/SB541/2024"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Cross-filed with HB 567. Passed the Senate March 14, 2024 (46-0) and the House April 4, 2024 (103-33); the Senate concurred in House amendments April 6, 2024, and the governor approved it May 9, 2024. The act took effect Oct. 1, 2025, and an uncodified section provides that section 14-4612 of the Commercial Law Article applies only prospectively and has no effect on personal data processing activities before April 1, 2026; in the chaptered text, section 14-4612 lists activities the subtitle does not restrict, and the data protection assessment duty is in section 14-4610. Consumer health data is personal data a controller uses to identify a consumer's physical or mental health status and includes data related to gender-affirming care treatment and reproductive or sexual health care. The HIPAA exemption is data-level: section 14-4603 exempts protected health information and certain other health data but does not list HIPAA covered entities as exempt entities.",
   "added": "2026-09-29"
  },
  {
   "id": "me-ld1727-2025",
   "state": "ME",
   "category": "disclosure",
   "also": [],
   "kind": "law",
   "name": "LD 1727, Public Law 2025, chapter 294, An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence",
   "status": "effective",
   "signed": "2025-06-12",
   "effective": "2025-09-24",
   "applies_to": "Any person using an AI chatbot or other computer technology to engage in trade and commerce with consumers",
   "summary": "Bars using an AI chatbot or any other computer technology in trade and commerce in a way that may mislead or deceive a reasonable consumer into believing they are dealing with a human unless the consumer is notified clearly and conspicuously that they are not, and makes a violation a violation of the Maine Unfair Trade Practices Act.",
   "physician_read": "Since Sept. 24, 2025, anyone in Maine who uses an AI chatbot with consumers in trade and commerce, with no exception in the text for health care, must clearly and conspicuously tell them they are not dealing with a human whenever the chatbot could lead a reasonable consumer to believe otherwise.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://legislature.maine.gov/legis/bills/display_ps.asp?LD=1727&snum=132"
    },
    {
     "label": "Chaptered law",
     "url": "https://legislature.maine.gov/legis/bills/getPDF.asp?paper=HP1154&item=3&snum=132"
    },
    {
     "label": "Maine Legislature (general effective date)",
     "url": "https://legislature.maine.gov/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "HP 1154; enacts 10 MRSA section 1500-Y. The Health Coverage, Insurance and Financial Services Committee voted Ought to Pass as Amended on May 8, 2025 and reported it out June 6, 2025. Approved June 12, 2025. No emergency clause or other effective date appears in the chaptered text, so the law took effect on the general effective date for nonemergency laws of the First Special Session of the 132nd Legislature, Sept. 24, 2025, as the Legislature's home page states. 'Artificial intelligence chatbot' means a software application, web interface or computer program that simulates human conversation and interaction through textual or aural communications. The Revisor's online statute page for section 1500-Y could not be found.",
   "added": "2026-09-29"
  },
  {
   "id": "me-ld2082-2026",
   "state": "ME",
   "category": "mental-health",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "LD 2082, Public Law 2025, chapter 687, An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services",
   "status": "effective",
   "signed": "2026-04-13",
   "effective": "2026-07-29",
   "applies_to": "Anyone offering therapy or psychotherapy to the public in Maine, and licensees under the Title 32 licensing chapters named in the act, including physicians licensed by the Board of Licensure in Medicine or the Board of Osteopathic Licensure, who use AI in therapy or psychotherapy",
   "summary": "Bars providing, advertising or offering therapy or psychotherapy to the public, including through internet-based AI, unless a licensed professional provides it, and lets licensees use AI for administrative and supplementary support in therapy or psychotherapy while keeping full responsibility for its interactions, outputs and data use, with written notice of the AI's use, purpose and handling of session data and the client's consent before AI provides supplementary support for a recorded or transcribed session, and without letting AI make independent therapeutic decisions, interact therapeutically with clients or generate treatment plans without the licensee's review and approval.",
   "physician_read": "Since July 29, 2026, a Maine physician who provides therapy or psychotherapy may not let AI make independent therapeutic decisions or interact therapeutically with clients, or let it generate therapeutic recommendations or treatment plans without the physician's review and approval, and before using AI for supplementary support on a recorded or transcribed session must tell the client in writing its purpose and how session data will be stored, retained, used for training and deleted, and obtain consent that acceptance of general terms of use cannot supply. Violations are grounds for board discipline, and offering therapy to the public, including through AI, without a licensed professional is an unfair trade practice.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://legislature.maine.gov/legis/bills/display_ps.asp?LD=2082&snum=132"
    },
    {
     "label": "Chaptered law",
     "url": "https://legislature.maine.gov/legis/bills/getPDF.asp?paper=HP1397&item=3&snum=132"
    },
    {
     "label": "Maine Legislature (adjournment and general effective date)",
     "url": "https://legislature.maine.gov/"
    },
    {
     "label": "Title 32, chapter 48 (Board of Licensure in Medicine)",
     "url": "https://legislature.maine.gov/statutes/32/title32ch48sec0.html"
    },
    {
     "label": "Title 32, chapter 36 (Osteopathic Physicians)",
     "url": "https://legislature.maine.gov/statutes/32/title32ch36sec0.html"
    },
    {
     "label": "Holland & Knight (secondary)",
     "url": "https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-regulate-ai-in-healthcare"
    }
   ],
   "checked": "2026-09-29",
   "notes": "HP 1397. Section 1 enacts 10 MRSA section 1500-EE (the ban, enforced under the Maine Unfair Trade Practices Act; AI-based interventions used solely within research approved by an institutional review board are exempt). Its definition of licensed professional covers licensees under Title 32, chapters 31, 56, 83 and 119, licensees or certificate holders under chapter 81 authorized to provide therapy or psychotherapy, and physicians and physician associates licensed under chapter 36 or 48 who specialize in the diagnosis and treatment of mental disorders. Sections 2 to 8 enact the same practice rules in seven Title 32 licensing chapters (sections 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009 and 13870), with violations subject to discipline under 10 MRSA section 8003, subsection 5, and major substantive rulemaking by each board; sections 2600-G and 3300-J reach persons licensed or privileged to practice under chapter 36 (Osteopathic Physicians) and chapter 48 (Board of Licensure in Medicine), following those chapters' last existing sections (2600-F and 3300-I), and are not limited to physicians who specialize in mental disorders. A licensee may use AI for supplementary support only to the extent the notice and consent rules are met; licensees may not deny treatment solely because a client refuses consent to AI, and client waivers are void. Approved April 13, 2026 per the Legislature's bill page and the chaptered law; Holland & Knight reported April 8, 2026 and describes the law as reaching licensed mental health professionals. No emergency clause appears in the chaptered text, so the law took effect on the general effective date for the Second Regular Session, July 29, 2026, as the Legislature's home page states (the Legislature adjourned April 29, 2026). The Revisor's online statutes did not yet show sections 1500-EE or 3300-J. The lead 'LD 1857' is a different, unrelated bill.",
   "added": "2026-09-29"
  },
  {
   "id": "mi-sb760-2025",
   "state": "MI",
   "category": "clinical",
   "also": [
    "privacy"
   ],
   "kind": "law",
   "name": "SB 760, Leading Ethical AI Development for Kids Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Operators of advanced (generative, conversational) chatbots offered to users in Michigan, as to minors",
   "summary": "Would bar chatbot operators, unless they know a user is an adult, from offering chatbot features that simulate companionship or a human relationship, outputs that promote or facilitate suicide, self-harm, violence, disordered eating or drug or alcohol abuse, outputs that encourage secrecy, self-isolation or avoidance of professional help, engagement optimization above safety guardrails, and sexually explicit content; would limit the data used to determine age and bar training on minors' inputs without a parent's written consent, with attorney general enforcement through civil fines of $25,000 per violation and a private right of action.",
   "physician_read": "It binds no one yet. As passed by the Senate, it would exclude a system used in a clinical setting under the direct supervision of a health professional, and its duties would begin only when the attorney general's first implementing rules take effect.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://www.legislature.mi.gov/Bills/Bill?ObjectName=2025-SB-0760"
    },
    {
     "label": "As passed by the Senate",
     "url": "https://www.legislature.mi.gov/Documents/2025-2026/billengrossed/Senate/htm/2025-SEBS-0760.htm"
    },
    {
     "label": "Senate Fiscal Agency analysis, as passed by the Senate",
     "url": "https://www.legislature.mi.gov/documents/2025-2026/billanalysis/Senate/htm/2025-SFA-0757-C.htm"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced Dec. 17, 2025; reported by the Senate Finance, Insurance, and Consumer Protection Committee March 25, 2026; substitute S-1 adopted in the Committee of the Whole; passed the Senate 20-17 on April 29, 2026; in the House Communications and Technology Committee since April 29, 2026, with no action since. It moved with SB 757 (addictive feeds for minors) and SB 758 (Michigan Kids Code Act), which passed the Senate the same day and are out of scope. The text sets a civil fine of $25,000 per violation (section 7); the Senate Fiscal Agency analysis of May 29, 2026 describes it as up to $25,000. Besides clinical systems, the definition of advanced chatbot excludes customer service, research and technical assistance, internal employee productivity and narrowly tailored educational tools. Personal data obtained to determine whether a user is a minor could not be passed to third parties and would have to be deleted immediately after that use.",
   "added": "2026-09-29"
  },
  {
   "id": "mi-naic-ai-bulletin-2024",
   "state": "MI",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 2024-20-INS, Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-08-07",
   "effective": "2024-08-07",
   "applies_to": "All insurers, nonprofit health service plans, HMOs and dental plan organizations holding a Michigan certificate of authority",
   "summary": "Expects insurers, nonprofit health service plans and HMOs to develop, implement and maintain a written program for the responsible use of AI systems that mitigates the risk of adverse consumer outcomes, with governance, risk management and internal controls and due diligence and audit rights for third-party AI vendors, and lists the documentation the Department of Insurance and Financial Services may request; the NAIC lists it as Michigan's adoption of its model bulletin.",
   "physician_read": "It places no duty on physicians. Since August 2024, health insurers, nonprofit health service plans and HMOs in Michigan are expected to keep a written AI governance program and to show the Department of Insurance and Financial Services their testing and vendor controls on request.",
   "sources": [
    {
     "label": "Department of Insurance and Financial Services bulletin",
     "url": "https://www.michigan.gov/difs/-/media/Project/Websites/difs/Bulletins/2024/Bulletin_2024-20-INS.pdf"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued by Director Anita G. Fox. The bulletin states no separate effective date; the issue date is used. It does not single out utilization review or prior authorization.",
   "added": "2026-09-29"
  },
  {
   "id": "mi-sb359-2025",
   "state": "MI",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 359, Personal Data Privacy Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Businesses that control or process personal data of 100,000 or more consumers in a calendar year, or 25,000 or more while deriving any revenue from selling personal data; HIPAA covered entities and business associates are exempt",
   "summary": "Would give Michigan consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and profiling in furtherance of solely automated decisions with legal or similarly significant effects, require consent to process sensitive data, including health diagnoses, consumer health data, genetic and biometric data and precise geolocation, bar the sale of sensitive data and geofencing within 1,750 feet of mental health or reproductive or sexual health facilities, and require data protection assessments, enforced by the attorney general.",
   "physician_read": "It binds no one yet; as reported, it would exempt HIPAA covered entities, business associates and protected health information and would take effect one year after enactment. For patients, it would require consent before health apps and other businesses outside HIPAA process their health data, and it would bar using geofences within 1,750 feet of mental health or reproductive or sexual health facilities to identify or track consumers or collect their health data.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://www.legislature.mi.gov/Bills/Bill?ObjectName=2025-SB-0359"
    },
    {
     "label": "Bill as introduced (reported without amendment)",
     "url": "https://www.legislature.mi.gov/documents/2025-2026/billintroduced/Senate/htm/2025-SIB-0359.htm"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced June 5, 2025; reported without amendment by the Senate Finance, Insurance, and Consumer Protection Committee June 11, 2025 (entered in the Senate Journal June 12), and referred to the Committee of the Whole June 12, 2025; no floor vote since. Enforcement would rest with the attorney general alone, with civil fines of up to $7,500 per violation, a 30-day cure period available only during the first 18 months after the act takes effect, and no private right of action; data brokers would have to register.",
   "added": "2026-09-29"
  },
  {
   "id": "mn-hf4757-2024",
   "state": "MN",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "Minnesota Consumer Data Privacy Act (HF 4757, Laws 2024, Chapter 121, Article 5; Minn. Stat. 325M.10 to 325M.21)",
   "status": "effective",
   "signed": "2024-05-24",
   "effective": "2025-07-31",
   "applies_to": "Businesses that control or process personal data of 100,000 or more Minnesota consumers (excluding data processed only to complete a payment), or of 25,000 or more while deriving over 25 percent of gross revenue from selling personal data; small businesses as defined by the U.S. Small Business Administration are exempt except from a bar on selling sensitive data without consent",
   "summary": "Gives consumers rights to access, correct, delete and port their personal data, to opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects, including decisions on health care, and to question the result of such profiling, and requires consent before a controller processes sensitive data, which includes mental or physical health conditions and diagnoses.",
   "physician_read": "The act excludes protected health information under HIPAA, Minnesota health records and related health information, not HIPAA-covered practices as such, so a practice that meets its thresholds must still apply it to other personal data it holds. Since July 31, 2025, a covered business needs a consumer's consent to process health data and must let consumers question the result of profiling used in decisions with legal or similarly significant effects, which include decisions on health care services.",
   "sources": [
    {
     "label": "Minn. Stat. chapter 325M",
     "url": "https://www.revisor.mn.gov/statutes/cite/325M"
    },
    {
     "label": "Minn. Stat. 325M.12 (scope and exclusions)",
     "url": "https://www.revisor.mn.gov/statutes/cite/325M.12"
    },
    {
     "label": "Minn. Stat. 325M.14 (consumer rights)",
     "url": "https://www.revisor.mn.gov/statutes/cite/325M.14"
    },
    {
     "label": "Bill page, HF 4757 (2024)",
     "url": "https://www.revisor.mn.gov/bills/bill.php?b=House&f=HF4757&ssn=0&y=2024"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Postsecondary institutions regulated by the Office of Higher Education need not comply until July 31, 2029. Enforced by the attorney general. The revisor's notes on 325M.10 and 325M.17 give the July 31, 2025 effective date, and the revisor shows no amendments to sections 325M.10 to 325M.21 after 2024. The health exclusions in 325M.12 are data-level: protected health information, health records under section 144.291, patient information under 42 C.F.R. part 2 and related research and quality data. Consent for sensitive data is in 325M.16; the definition of decisions with legal or similarly significant effects in 325M.11 lists health care services. Laws 2026, ch. 111 (HF 4138) added social media rules for minors to the same chapter (section 325M.40, effective July 1, 2027); it is outside the map's scope.",
   "added": "2026-09-29"
  },
  {
   "id": "ms-naic-ai-bulletin-2026",
   "state": "MS",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 2026-9, Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2026-07-22",
   "effective": "2026-07-22",
   "applies_to": "All insurers holding a certificate of authority to do business in Mississippi, including health insurers",
   "summary": "Reminds insurers that decisions affecting consumers that are made or supported by AI systems must comply with state insurance law, including the Unfair Trade Practices Act, and expects each insurer to maintain a written program for the responsible use of AI systems, with governance, risk management and controls, oversight of third-party systems and documentation the department may request.",
   "physician_read": "It places no duty on physicians. Since July 22, 2026, an insurer licensed in Mississippi, including a health insurer, is expected to govern the AI systems it uses across its operations, including claim administration and payment, under a written program and to guard against adverse consumer outcomes.",
   "sources": [
    {
     "label": "Bulletin 2026-9",
     "url": "https://www.mid.ms.gov/wp-content/uploads/2026/07/202609Bul.pdf"
    },
    {
     "label": "Insurance Department bulletin page",
     "url": "https://www.mid.ms.gov/2026-9/"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Commissioner Mike Chaney and addressed to all insurers that hold certificates of authority to do business in the state. The NAIC's adoption map lists this bulletin, adopted July 22, 2026, as Mississippi's adoption of the NAIC Model Bulletin; the bulletin's text follows the model but does not name it (it refers to the Principles of Artificial Intelligence the NAIC adopted in 2020), and it does not mention utilization review or prior authorization. It states no separate effective date or compliance deadline, so the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "mt-sb163-2025",
   "state": "MT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 163, Generally Revise Privacy Laws Related to Biometric, Genetic, and Neural Data (Genetic Information Privacy Act amendments)",
   "status": "effective",
   "signed": "2025-05-01",
   "effective": "2025-10-01",
   "applies_to": "Entities that offer consumer genetic testing directly to consumers or that collect, use or analyze genetic data, for the genetic and neurotechnology data they handle; governmental agencies that collect or use such data",
   "summary": "Adds neurotechnology data to the Genetic Information Privacy Act, so that an entity covered by that act must give privacy notices, obtain initial express consent to collect, use or disclose neurotechnology data and separate express consent to transfer it to third parties or use it beyond its primary purpose, keep a comprehensive security program and let consumers access and delete the data and revoke consent, and limits governmental agencies' collection and use of genetic or neurotechnology data to what a specific state law, search warrant or investigative subpoena allows.",
   "physician_read": "Since Oct. 1, 2025, an entity that offers consumer genetic testing or collects, uses or analyzes genetic data needs a consumer's express consent to collect, use or disclose neurotechnology data and separate consent to share it or use it beyond its primary purpose; the act's definition of entity, which SB 163 left unchanged, does not mention neurotechnology. Protected health information that a HIPAA covered entity or business associate collects is exempt only if the entity obtains separate informed consent for the genetic or neurotechnology data and gives consumers a way to access and delete it, revoke consent and have biological samples destroyed.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/MT/bill/SB163/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/MT/text/SB163/id/3212476/Montana-2025-SB163-Enrolled.pdf"
    },
    {
     "label": "MCA 30-23-102, definitions",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0230/part_0010/section_0020/0300-0230-0010-0020.html"
    },
    {
     "label": "MCA 30-23-103, exceptions",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0230/part_0010/section_0030/0300-0230-0010-0030.html"
    },
    {
     "label": "MCA 30-23-104, duties",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0230/part_0010/section_0040/0300-0230-0010-0040.html"
    },
    {
     "label": "MCA 1-2-201, effective date of statutes",
     "url": "https://mca.legmt.gov/bills/mca/title_0010/chapter_0020/part_0020/section_0010/0010-0020-0020-0010.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 345, Laws of 2025 (per the MCA history notes). The short title mentions biometric data, but the enrolled act amends only the Genetic Information Privacy Act (MCA 30-23-101 to 30-23-105) and MCA 44-6-104, on government access to consumer DNA databases, adding neurotechnology data and neurotechnology databases; it does not change biometric data rules or the Consumer Data Privacy Act, whose definition of sensitive data does not list neural data. It did not amend the definition of entity in MCA 30-23-102, which still covers only an organization that offers consumer genetic testing products or services directly to a consumer or collects, uses or analyzes genetic data. Neurotechnology data means information captured by neurotechnologies, generated by measuring the activity of the central or peripheral nervous system, or associated with neural activity, excluding nonneural information about downstream physical effects such as pupil dilation, motor activity and breathing rate. It also requires any governmental agency's collection, storage, use or dissemination of genetic or neurotechnology data to follow a specific state law or a search warrant or investigative subpoena, and adds legislative findings on neurotechnology privacy. The enrolled text has no effective-date section, so it took effect Oct. 1, 2025 under MCA 1-2-201. The history comes from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "mt-sb297-2025",
   "state": "MT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 297, Generally Revise Privacy Laws (Consumer Data Privacy Act amendments)",
   "status": "effective",
   "signed": "2025-05-08",
   "effective": "2025-10-01",
   "applies_to": "Controllers subject to the Consumer Data Privacy Act, including those offering online services, products or features to minors",
   "summary": "Lowers the act's thresholds to 25,000 consumers (15,000 for businesses deriving more than 25 percent of revenue from selling data) and requires controllers offering online services, products or features to minors under 18 to use reasonable care to avoid a heightened risk of harm, bars targeted advertising, sale and certain profiling of minors' data without consent, and limits collection of minors' precise geolocation.",
   "physician_read": "HIPAA covered entities and business associates remain exempt, so it places no duty on physician practices that are covered entities. Since Oct. 1, 2025, the act reaches smaller businesses, and online services offered to minors must avoid a heightened risk of harm and obtain consent before using minors' data for targeted advertising, sale or certain profiling.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/MT/bill/SB297/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/MT/text/SB297/id/3212521/Montana-2025-SB297-Enrolled.pdf"
    },
    {
     "label": "MCA 30-14-2803, applicability",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html"
    },
    {
     "label": "MCA 1-2-201, effective date of statutes",
     "url": "https://mca.legmt.gov/bills/mca/title_0010/chapter_0020/part_0020/section_0010/0010-0020-0020-0010.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 567, Laws of 2025 (per the MCA history notes). The enrolled text has no effective-date section, so it took effect Oct. 1, 2025 under MCA 1-2-201; its data protection assessment duties apply to processing activities created or generated after Oct. 1, 2025. The attorney general must give notice and 60 days to cure before bringing an action. The history comes from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "mt-sb384-2023",
   "state": "MT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 384, Consumer Data Privacy Act",
   "status": "effective",
   "signed": "2023-05-19",
   "effective": "2024-10-01",
   "applies_to": "Businesses that control or process personal data of at least 25,000 Montana consumers, or 15,000 while deriving more than 25 percent of gross revenue from selling personal data (thresholds as lowered in 2025)",
   "summary": "Gives consumers rights over their personal data, including opting out of targeted advertising, sale and certain profiling, and requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis and genetic or biometric data processed to identify an individual.",
   "physician_read": "It exempts HIPAA covered entities and business associates as entities, so it places no duty on physician practices that are covered entities. Since Oct. 1, 2024, other businesses that meet the thresholds have needed consumers' consent to process data revealing a health condition or diagnosis, or biometric data used to identify them.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/MT/bill/SB384/2023"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/MT/text/SB384/id/2791095/Montana-2023-SB384-Enrolled.pdf"
    },
    {
     "label": "MCA 30-14-2804, exemptions",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-0040.html"
    },
    {
     "label": "MCA 30-14-2802, definitions",
     "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 681, Laws of 2023, codified at Title 30, chapter 14, part 28, MCA. The history comes from LegiScan; the enrolled text states the act is effective Oct. 1, 2024. The original thresholds were 50,000 consumers, or 25,000 with more than 25 percent of revenue from selling data; SB 297 (2025) lowered them and added protections for minors, including limits on collecting minors' precise geolocation (separate entry).",
   "added": "2026-09-29"
  },
  {
   "id": "nc-naic-ai-bulletin-2024",
   "state": "NC",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin 24-B-19, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-12-18",
   "effective": "2024-12-18",
   "applies_to": "All insurers licensed to do business in North Carolina, including health insurers",
   "summary": "Tells insurers that decisions and actions affecting consumers that are made or supported by AI systems, including claim management and payment, must comply with insurance law, including the unfair and deceptive trade practice provisions of Article 63 of Chapter 58, and sets expectations for a written AI systems program covering governance, risk management, internal controls and third-party AI systems, which the Department of Insurance may review in investigations and examinations.",
   "physician_read": "It places no duty on physicians. Since Dec. 18, 2024, the Department of Insurance has told insurers, including health insurers, that claim and coverage decisions made or supported by AI must meet North Carolina's unfair trade practice laws, and it may examine how they govern those systems.",
   "sources": [
    {
     "label": "Bulletin 24-B-19 (Department of Insurance)",
     "url": "https://files.nc.gov/insurance/documents/2024-12/24-B-19%20-%20The%20Use%20of%20Artificial%20Intelligence%20Systems%20in%20Insurance.pdf?VersionId=67aGSPsvk1v4LO7IMQi.QOW_m9CChjXh"
    },
    {
     "label": "Department of Insurance bulletin page",
     "url": "https://www.ncdoi.gov/24-b-19-use-artificial-intelligence-systems-insurance"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "North Carolina's version of the NAIC Model Bulletin: it follows the model's four sections (introduction and authority, definitions, regulatory guidance and expectations, regulatory oversight and examination), and the NAIC's adoption map lists it as adopted Dec. 18, 2024. Signed by Commissioner of Insurance Mike Causey and addressed to all insurers licensed in the state. The bulletin states no separate effective date; the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "ne-lb525-2026",
   "state": "NE",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "LB 525, Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act",
   "status": "enacted",
   "signed": "2026-04-14",
   "effective": "2027-07-01",
   "applies_to": "Operators that make conversational AI services available to the public",
   "summary": "The Conversational Artificial Intelligence Safety Act requires operators of public conversational AI services to disclose that a user is interacting with AI when a reasonable person could be misled (and to minors at the start of a session and every three hours, or by a persistent notice), to adopt a protocol for responding to prompts about suicidal ideation or self-harm, not to represent that the service is designed to provide professional mental or behavioral health care, and to apply added protections for minors.",
   "physician_read": "It places no duty on physicians. From July 1, 2027, general chatbots offered to the public in Nebraska must have a protocol for responding to patients' prompts about suicidal ideation or self-harm and may not claim to be designed to provide professional mental or behavioral health care.",
   "sources": [
    {
     "label": "Slip law, LB 525",
     "url": "https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB525.pdf"
    },
    {
     "label": "Bill page, LB 525",
     "url": "https://nebraskalegislature.gov/bills/search_by_number.php?DocumentNumber=LB525"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced in 2025 at the governor's request and carried over; passed on final reading April 10, 2026 (49-0-0) and approved by the governor April 14, 2026. Sections 12 to 18 (the chatbot act) become operative July 1, 2027. Minors' protections include limits on sexually explicit content and deceptive claims of being human. Enforced by the attorney general, with civil penalties of at least $1,000 per violation and no more than $500,000 per operator; no private right of action. The Agricultural Data Privacy Act in the same bill is outside the map's scope.",
   "added": "2026-09-29"
  },
  {
   "id": "ne-lb77-2025",
   "state": "NE",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "LB 77, Adopt the Ensuring Transparency in Prior Authorization Act and provide for insurance and medicaid coverage of biomarker testing",
   "status": "effective",
   "signed": "2025-06-04",
   "effective": "2026-01-01",
   "applies_to": "Utilization review agents and health carriers subject to the Ensuring Transparency in Prior Authorization Act",
   "summary": "Bars an AI-based algorithm from being the sole basis of a utilization review agent's decision to deny, delay or modify health care services based in whole or in part on medical necessity, requires the agent to disclose AI use in utilization review to the Department of Insurance, network providers, enrollees and on its public website, and lets the department audit its automated utilization management system.",
   "physician_read": "Since Jan. 1, 2026, a utilization review agent cannot deny, delay or modify care on medical necessity grounds on an AI-based algorithm alone, and it must disclose to its network providers, enrollees, the Department of Insurance and the public (on its website) if it uses or will use such algorithms in utilization review. The same act requires that prior authorization denials be made by a physician (or, when the requesting provider is not a physician, a clinical peer) with a current, valid, nonrestricted license and appropriate expertise.",
   "sources": [
    {
     "label": "Slip law, LB 77",
     "url": "https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB77.pdf"
    },
    {
     "label": "Bill page, LB 77",
     "url": "https://nebraskalegislature.gov/bills/search_by_number.php?DocumentNumber=LB77"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed on final reading May 30, 2025 (46-2-1) and approved by the governor June 4, 2025. Section 17 makes sections 1 to 5 and 7 to 13 of the act, including the AI rule in section 12, operative Jan. 1, 2026; the biomarker testing coverage sections follow later timelines. Section 12 also lets the Department of Insurance audit a utilization review agent's automated utilization management system at any time. The act uses the definition of utilization review agent in Neb. Rev. Stat. 44-5418.",
   "added": "2026-09-29"
  },
  {
   "id": "ne-naic-ai-bulletin-2024",
   "state": "NE",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Guidance Document IGD-H1, Use of Artificial Intelligence by Insurers",
   "status": "effective",
   "signed": "2024-06-11",
   "effective": "2024-06-11",
   "applies_to": "All insurers holding a certificate of authority in Nebraska, including health insurers",
   "summary": "Sets the Department of Insurance's expectation that insurers using AI systems maintain a written AI systems program covering governance, risk management and internal controls, and standards for third-party AI systems, and lists what the department may request in investigations and examinations.",
   "physician_read": "It places no duty on physicians. Since June 11, 2024, insurers in Nebraska, including health insurers, are expected to govern AI systems used in decisions that affect consumers under a written program that the Department of Insurance may examine.",
   "sources": [
    {
     "label": "IGD-H1",
     "url": "https://doi.nebraska.gov/sites/default/files/doc/IGD%20-%20-%20H1.pdf"
    },
    {
     "label": "Department of Insurance guidance documents",
     "url": "https://doi.nebraska.gov/public-info/guidance-documents"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The NAIC lists IGD-H1 as Nebraska's adoption of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The document applies to all insurers and does not single out health insurers.",
   "added": "2026-09-29"
  },
  {
   "id": "ne-lb1074-2024",
   "state": "NE",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "LB 1074, Data Privacy Act (Neb. Rev. Stat. 87-1101 to 87-1130)",
   "status": "effective",
   "signed": "2024-04-17",
   "effective": "2025-01-01",
   "applies_to": "Businesses that operate in Nebraska or serve its residents, process or sell personal data and are not small businesses under the federal Small Business Act; HIPAA covered entities and nonprofits are excluded",
   "summary": "Gives consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, including decisions on health care services, and requires consent before a controller processes sensitive data, which includes mental or physical health diagnoses.",
   "physician_read": "It places no duty on HIPAA covered entities, which the act excludes. Since Jan. 1, 2025, businesses outside HIPAA that process Nebraskans' health diagnosis data, such as health apps, need the consumer's consent, and consumers may opt out of profiling used in decisions on health care services.",
   "sources": [
    {
     "label": "Neb. Rev. Stat. 87-1103 (applicability)",
     "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103"
    },
    {
     "label": "Neb. Rev. Stat. 87-1107 (consumer rights)",
     "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1107"
    },
    {
     "label": "Neb. Rev. Stat. 87-1112 (sensitive data consent)",
     "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1112"
    },
    {
     "label": "Bill page, LB 1074 (2024)",
     "url": "https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=54904"
    },
    {
     "label": "Legislative Fiscal Office fiscal note, March 26, 2024",
     "url": "https://nebraskalegislature.gov/FloorDocs/108/PDF/FN/LB1074_20240326-091135.pdf"
    },
    {
     "label": "Attorney General, Data Privacy Act",
     "url": "https://protectthegoodlife.nebraska.gov/data-privacy-homepage"
    }
   ],
   "checked": "2026-09-29",
   "notes": "LB 1074 was an omnibus banking and data bill; sections 1 to 30 are the Data Privacy Act. It passed on final reading with an emergency clause April 11, 2024 (47-0-2) and was approved by the governor April 17, 2024. The act's operative-date section could not be checked; the Jan. 1, 2025 operative date rests on the Legislative Fiscal Office's fiscal note of March 26, 2024, which says the Data Privacy Act provisions (LB 1294 as amended by AM 2538, folded into this bill) establish an operational date of Jan. 1, 2025, and on the attorney general's Data Privacy Act page. The exclusion of HIPAA covered entities and business associates in 87-1103 is entity-level. Sensitive data also includes biometric data used to identify a person; section 87-1118 bars a small business, otherwise outside the act, from selling sensitive data without the consumer's prior consent. The definition of decisions with legal or similarly significant effects (87-1102) lists health care services. Enforced by the attorney general.",
   "added": "2026-09-29"
  },
  {
   "id": "nh-naic-ai-bulletin-2024",
   "state": "NH",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin Docket #INS 24-011-AB, adopting the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-02-20",
   "effective": "2024-02-20",
   "applies_to": "Insurers licensed to do business in New Hampshire, including health insurers, as the model bulletin is addressed",
   "summary": "Adopts the NAIC model bulletin, which expects insurers to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of adverse consumer outcomes and addressing governance, risk management controls, internal audit and third-party AI systems and data, and states that decisions made using AI systems must comply with applicable law, including unfair trade practice laws.",
   "physician_read": "It places no duty on physicians. Since Feb. 20, 2024, insurers in New Hampshire, including health insurers, are expected under the model bulletin to govern AI systems used in decisions that affect patients and can expect to be asked about that use in investigations and market conduct actions.",
   "sources": [
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    },
    {
     "label": "NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers",
     "url": "https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Insurance Department's bulletin pages could not be opened, so the bulletin's own text, title and signatory could not be checked. The NAIC's Aug. 31, 2026 map lists Bulletin Docket #INS 24-011-AB, adopted Feb. 20, 2024, as New Hampshire's adoption of the NAIC Model Bulletin; the name gives that docket number with the model's title because the title as issued could not be confirmed. The summary describes the model bulletin's text (adopted by the NAIC Dec. 4, 2023), which the state bulletin may have modified. The adoption date is used as the effective date because no other date could be confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "nh-sb255-2024",
   "state": "NH",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 255, Chapter 5 (2024), relative to the expectation of privacy (RSA 507-H, Expectation of Privacy)",
   "status": "effective",
   "signed": "2024-03-06",
   "effective": "2025-01-01",
   "applies_to": "Businesses that conduct business in New Hampshire or target its residents and control or process personal data of at least 35,000 unique consumers, or 10,000 unique consumers with more than 25 percent of gross revenue from data sales; HIPAA covered entities and business associates are exempt",
   "summary": "Gives consumers rights over their personal data, including opting out of targeted advertising, sale and profiling in furtherance of solely automated decisions with legal or similarly significant effects, and bars controllers from processing sensitive data, including data revealing a mental or physical health condition and precise geolocation, without the consumer's consent.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which are exempt as entities. Since Jan. 1, 2025, other businesses above the thresholds, such as health and wellness apps outside HIPAA, need a New Hampshire consumer's consent to process data revealing a mental or physical health condition or diagnosis.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/NH/bill/SB255/2024"
    },
    {
     "label": "RSA 507-H:2, Application",
     "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm"
    },
    {
     "label": "RSA 507-H:3, Exclusions",
     "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-3.htm"
    },
    {
     "label": "RSA chapter 507-H",
     "url": "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"
    },
    {
     "label": "LegiScan text (Senate-amended version, March 16, 2023)",
     "url": "https://legiscan.com/NH/text/SB255/id/2871280"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Creates RSA chapter 507-H. LegiScan's page is the source for status and dates (signed March 6, 2024; chapter 5; effective Jan. 1, 2025). The thresholds and exemptions come from the official RSA text on gc.nh.gov: RSA 507-H:2 reaches persons that conduct business in New Hampshire or target its residents and, in a one-year period, controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or of at least 10,000 unique consumers while deriving more than 25 percent of gross revenue from selling personal data; RSA 507-H:3 exempts covered entities and business associates as entities, and protected health information. RSA 507-H:2's source note shows a 2024 amendment (chapter 229, section 3, effective Jan. 1, 2025 at 12:01 a.m.), and the text of chapter 5 as signed could not be opened, so whether chapter 5 itself set these figures is not confirmed; the only text LegiScan holds is the Senate's amended version of March 16, 2023, which set 100,000 consumers, or 25,000 with more than 25 percent of revenue from data sales. The Attorney General has exclusive enforcement authority; from Jan. 1 to Dec. 31, 2025 the Attorney General had to give notice and 60 days to cure before acting, and may now allow a cure at the Attorney General's discretion.",
   "added": "2026-09-29"
  },
  {
   "id": "nj-a4731-2026",
   "state": "NJ",
   "category": "clinical",
   "also": [],
   "kind": "law",
   "name": "A4731, Directs professional and occupational boards to promulgate rules for licensee use of generative artificial intelligence",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "The Director of the Division of Consumer Affairs and the professional boards listed in N.J.S.A. 45:1-15, including the State Board of Medical Examiners, and their licensees",
   "summary": "Would require the Director of the Division of Consumer Affairs to adopt by rule, within six months of enactment, a model policy for licensees' use of generative AI, and each professional and occupational board to adopt it by rule, with any profession-specific adaptations, within nine months or at its next regularly scheduled meeting after the model policy is established.",
   "physician_read": "It binds no one yet. If enacted, the Director of the Division of Consumer Affairs would have six months to adopt a model policy on licensees' use of generative AI, which the State Board of Medical Examiners and other licensing boards would then adopt by rule; the bill does not set the policy's content.",
   "sources": [
    {
     "label": "Bill text as amended, A4731 (1R)",
     "url": "https://pub.njleg.gov/Bills/2026/A5000/4731_R1.HTM"
    },
    {
     "label": "Bill text as introduced, A4731",
     "url": "https://pub.njleg.gov/Bills/2026/A5000/4731_I1.HTM"
    },
    {
     "label": "LegiScan bill page, A4731",
     "url": "https://legiscan.com/NJ/bill/A4731/2026"
    },
    {
     "label": "N.J.S.A. 45:1-15, boards covered (Justia, secondary)",
     "url": "https://law.justia.com/codes/new-jersey/title-45/section-45-1-15/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Reported with amendments by the Assembly Science, Innovation and Technology Committee March 16, 2026 (5-0-2) and reported by the Regulated Professions Committee May 28, 2026 (5-0-2), then referred to Appropriations, where it remains; no Senate companion is listed on LegiScan. The introduced version gave the director three months and the boards six months; the amended version gives the director six months and the boards nine months or their next regularly scheduled meeting after the model policy is established. The act would take effect immediately. N.J.S.A. 45:1-15 lists the State Board of Medical Examiners, the New Jersey Board of Nursing, the State Board of Psychological Examiners and the State Board of Social Work Examiners among the covered boards. Status is from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "nj-a4733-2026",
   "state": "NJ",
   "category": "clinical",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "A4733/S4088, Prohibits advertising generative artificial intelligence as able to practice regulated profession or occupation",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Developers and deployers of generative AI in New Jersey",
   "summary": "Would make it an unlawful practice under the Consumer Fraud Act for a developer or deployer to advertise or represent to the public that generative AI can practice a profession or occupation regulated under Title 45, which includes the licensed health professions, or by the Judicial Branch, with penalties of up to $10,000 for a first offense and $20,000 for later offenses.",
   "physician_read": "It binds no one yet and would place no duty on physicians. If enacted, from the first day of the sixth month after enactment, a developer or deployer of generative AI in New Jersey could not advertise or represent to the public that it can practice medicine, nursing, psychology or another profession regulated under Title 45 of the Revised Statutes.",
   "sources": [
    {
     "label": "Bill text, A4733",
     "url": "https://pub.njleg.gov/Bills/2026/A5000/4733_I1.HTM"
    },
    {
     "label": "LegiScan bill page, A4733",
     "url": "https://legiscan.com/NJ/bill/A4733/2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Reported by the Assembly Science, Innovation and Technology Committee March 16, 2026 (6-0-1) and by the Regulated Professions Committee May 28, 2026 (5-0-2), then referred to Appropriations, where it remains; identical S4088 was referred to Senate Commerce May 4, 2026. The 2026-2027 session continues. Status is from LegiScan. A narrower bill limited to advertising AI as a licensed mental health professional (A799/S735) has not been reported from committee.",
   "added": "2026-09-29"
  },
  {
   "id": "nj-naic-ai-bulletin-2025",
   "state": "NJ",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin No. 25-03, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2025-02-11",
   "effective": "2025-02-11",
   "applies_to": "All insurers authorized or admitted in New Jersey, including health insurers",
   "summary": "Reminds insurers that decisions or actions affecting consumers that are made or supported by AI systems must comply with state insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects each insurer to maintain a written AI systems program covering governance, risk management, internal controls, third-party data and AI vendors and documentation, which the department may review.",
   "physician_read": "It places no duty on physicians. Since Feb. 11, 2025, a health insurer that uses AI in regulated insurance practices such as claims is expected to keep a written program to prevent inaccurate, unfairly discriminatory or otherwise unlawful decisions, and the Department of Banking and Insurance may request its documentation.",
   "sources": [
    {
     "label": "DOBI Bulletin No. 25-03",
     "url": "https://www.nj.gov/dobi/bulletins/blt25_03.pdf"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "New Jersey's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted Feb. 11, 2025. Signed by Commissioner Justin Zimmerman. It cites the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act and the Corporate Governance Annual Disclosure Act, and defines an adverse consumer outcome as an insurer decision that adversely affects a consumer in a way that violates the insurance standards the department enforces. It does not mention utilization review or health coverage specifically. The bulletin states no separate effective date; the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "nj-a5328-2026",
   "state": "NJ",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "A5328 (P.L.2026, c.25), An Act concerning personal data, data brokers, data collectors, and amending P.L.2023, c.266",
   "status": "effective",
   "signed": "2026-06-30",
   "effective": "2026-06-30",
   "applies_to": "Any individual or legal entity, regardless of size, for the ban on selling sensitive data; data brokers and data collectors, for annual registration and the ban on selling or licensing sensitive data",
   "summary": "Amends the New Jersey Data Privacy Act to bar any controller, regardless of the number of consumers whose data it processes, from selling sensitive data, including data revealing a mental or physical health condition, treatment or diagnosis and biometric data, bars data brokers and data collectors from selling or licensing sensitive data and requires them to register annually with the Division of Consumer Affairs and pay a fee.",
   "physician_read": "Since June 30, 2026, no person or business of any size, including a medical practice, may sell sensitive data such as data revealing a mental or physical health condition, treatment or diagnosis, although protected health information collected by a HIPAA covered entity or business associate remains exempt. Data brokers and data collectors may not sell or license sensitive data, with penalties of $50,000 for each record sold, offered for sale or licensed, and must register annually with the Division of Consumer Affairs.",
   "sources": [
    {
     "label": "Chaptered law, P.L.2026, c.25",
     "url": "https://pub.njleg.state.nj.us/Bills/2026/PL26/25_.HTM"
    },
    {
     "label": "LegiScan bill page, A5328",
     "url": "https://legiscan.com/NJ/bill/A5328/2026"
    },
    {
     "label": "Faegre Drinker (secondary)",
     "url": "https://www.faegredrinker.com/en/insights/publications/2026/7/new-jersey-enacts-sweeping-data-broker-and-data-collector-registration-law"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced June 28, 2026 and reported by the Assembly Budget Committee the same day; passed the Assembly June 30, 2026 (52-21), was amended in the Senate, substituted for S2316 and passed the Senate (25-15), received Assembly concurrence (53-20-1) and was approved the same day. The act took effect immediately, except that subsection b. of section 2, the division's duty to establish and maintain a public registry of data brokers and data collectors, stays inoperative for 270 days (to March 27, 2027). A law firm summary describes the delayed part as the registration requirement; in the act's text the annual registration duty is in subsection c., which is not among the delayed provisions. Registration fees run from $5,000 to $1,500,000 depending on the number of consumers; failure to register or report carries $2,500 a day, and selling sensitive data in violation carries $50,000 for each record sold, offered for sale or licensed. Exceptions to the broker ban include protected health information collected by HIPAA covered entities and business associates, GLBA financial institutions, insurance institutions, consumer reporting agencies, government agencies and federally protected human subjects research. The Division of Consumer Affairs enforces. Legislative history is from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "nj-s332-2024",
   "state": "NJ",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "S332 (P.L.2023, c.266), An Act concerning online services, consumers, and personal data (New Jersey Data Privacy Act)",
   "status": "effective",
   "signed": "2024-01-16",
   "effective": "2025-01-15",
   "applies_to": "Controllers that do business in New Jersey or target its residents and control or process the personal data of at least 100,000 New Jersey consumers, or of at least 25,000 while earning revenue from selling personal data; protected health information collected by a HIPAA covered entity or business associate is exempt",
   "summary": "Requires consent before processing sensitive data, which includes data revealing a mental or physical health condition, treatment or diagnosis, genetic or biometric data used to identify a person and precise geolocation, lets consumers opt out of targeted advertising, sale of their data and profiling in furtherance of decisions with legal or similarly significant effects, including decisions on health care services, and requires data protection assessments for processing that presents a heightened risk of harm.",
   "physician_read": "Protected health information collected by a HIPAA covered entity or business associate is exempt, but covered entities are not exempt as entities: a practice that meets the thresholds must follow the act for personal data that is not protected health information. Since Jan. 15, 2025, businesses that meet the thresholds need a consumer's consent to process data revealing a mental or physical health condition, treatment or diagnosis and must honor opt-outs from profiling in furtherance of decisions about health care services.",
   "sources": [
    {
     "label": "Chaptered law, P.L.2023, c.266",
     "url": "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM"
    },
    {
     "label": "LegiScan bill page, S332",
     "url": "https://legiscan.com/NJ/bill/S332/2022"
    },
    {
     "label": "Troutman Pepper Locke, proposed rules expired (secondary)",
     "url": "https://www.regulatoryoversight.com/2026/06/new-jerseys-proposed-data-privacy-regulations-have-expired/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The act has no short title; New Jersey Data Privacy Act is the name commonly used for it, including in the Faegre Drinker summary cited in the P.L.2026, c.25 entry. It received final legislative approval Jan. 8, 2024 (Assembly 46-27; Senate concurrence 21-14) and was approved Jan. 16, 2024; it takes effect on the 365th day after enactment, Jan. 15, 2025. The HIPAA exemption is data-level: the act exempts protected health information collected by a covered entity or business associate, but covered entities and business associates are not exempt as entities, and the act has no general nonprofit exemption. The Director of the Division of Consumer Affairs has rulemaking authority. According to a law firm report, the division proposed implementing rules June 2, 2025 and the proposal expired June 2, 2026 under the Administrative Procedure Act's one-year limit without adoption, with no new proposal issued. P.L.2026, c.25 (entered separately) added a ban on selling sensitive data that applies to controllers of any size. Legislative history is from LegiScan.",
   "added": "2026-09-29"
  },
  {
   "id": "nm-sb188-2019",
   "state": "NM",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 188, Health Insurance Prior Authorization Act",
   "status": "effective",
   "signed": "2019-04-03",
   "effective": "2021-01-01",
   "applies_to": "Health insurers subject to the Prior Authorization Act, NMSA 1978 Chapter 59A, Article 22B",
   "summary": "Requires health insurers to use technology and automation to auto-adjudicate electronically transmitted prior authorization requests to approve or pend them, and requires that any auto-adjudicated request based on medical necessity that is pended or denied be reviewed by a health care professional who has knowledge of the patient's condition, or consults a specialist who does, and who makes the final determination.",
   "physician_read": "Since Jan. 1, 2021, New Mexico health insurers have had to auto-adjudicate electronically transmitted prior authorization requests, using technology and automation to make a near-real-time determination, and any auto-adjudicated request based on medical necessity that is pended or denied must be reviewed by a health care professional who has knowledge of the patient's condition or consults a specialist who does, and who makes the final determination. A denial after that review must be sent to the patient and the provider with the grounds for the denial and notice of the right to appeal.",
   "sources": [
    {
     "label": "Final bill text (New Mexico Legislature)",
     "url": "https://www.nmlegis.gov/Sessions/19%20Regular/final/SB0188.pdf"
    },
    {
     "label": "Bill page (New Mexico Legislature)",
     "url": "https://www.nmlegis.gov/Legislation/Legislation?chamber=S&legType=B&legNo=188&year=19"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/NM/bill/SB188/2019"
    },
    {
     "label": "SB 20 (2026) final text, current wording of Sec. 59A-22B-5",
     "url": "https://www.nmlegis.gov/Sessions/26%20Regular/final/SB0020.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Laws 2019, Chapter 187; passed the Senate March 2, 2019 and the House March 11, 2019; signed April 3, 2019. The act applies to policies entered into, offered or issued on or after July 1, 2019, required uniform prior authorization forms by Jan. 1, 2020, and required auto-adjudication of electronically transmitted requests and electronic appeals by Jan. 1, 2021, the date used. 'Auto-adjudicate' means to use technology and automation to make a near-real-time determination to approve, deny or pend a request for prior authorization (NMSA 1978 Sec. 59A-22B-2); the review rule is Sec. 59A-22B-5(E). The law predates and does not name artificial intelligence, but its auto-adjudication provisions cover automated systems. SB 20 (2026), Laws 2026, Chapter 47, signed March 6, 2026 and applying to policies entered into, offered or issued on or after Jan. 1, 2027, amends Secs. 59A-22B-2, 59A-22B-4, 59A-22B-5 and 59A-22B-8 (limits on prior authorization for certain drugs, including drugs to treat serious mental illness and chronic conditions, and coverage of certain pharmacy benefits managers) and leaves Sec. 59A-22B-5(E) unchanged.",
   "added": "2026-09-29"
  },
  {
   "id": "nv-ab406-2025",
   "state": "NV",
   "category": "mental-health",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "AB 406, Makes Various Changes Relating to Health",
   "status": "effective",
   "signed": "2025-06-05",
   "effective": "2025-07-01",
   "applies_to": "AI providers offering AI systems in Nevada; licensed mental and behavioral health care providers, including psychiatrists and psychologists; public schools",
   "summary": "Bars an AI provider from making available in Nevada an AI system specifically programmed to provide a service that would be the practice of professional mental or behavioral health care if a person provided it, or from representing that an AI system is a provider of such care, bars licensed mental and behavioral health care providers from using AI in connection with providing that care directly to a patient while allowing its use for administrative support tasks, and bars public schools from using AI to perform the mental health functions of school counselors, psychologists and social workers.",
   "physician_read": "Since July 1, 2025, a Nevada psychiatrist or other licensed mental or behavioral health provider may not use an AI system in connection with providing professional mental and behavioral health care directly to a patient, but may use it for administrative support tasks such as scheduling, records, billing, operational data analysis and organizing session notes, and must independently review the accuracy of anything the AI generates. A violation is unprofessional conduct subject to discipline by the provider's licensing board.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/NV/bill/AB406/2025"
    },
    {
     "label": "Bill text versions and status (LegiScan)",
     "url": "https://legiscan.com/NV/text/AB406/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/NV/text/AB406/id/3248527/Nevada-2025-AB406-Enrolled.pdf"
    },
    {
     "label": "NRS Chapter 433 (definition of Division; NRS 433.567)",
     "url": "https://www.leg.state.nv.us/nrs/nrs-433.html"
    },
    {
     "label": "NRS Chapter 629 (NRS 629.610)",
     "url": "https://www.leg.state.nv.us/nrs/nrs-629.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Nevada Legislature's bill pages were not used; status, chapter and text come from LegiScan, whose history shows approval by the Governor on June 5, 2025 and Chapter 283 on June 6, 2025. Sections 1 to 9 took effect on passage and approval for regulations and preparatory tasks and on July 1, 2025, for all other purposes (Section 10). The provider rule (Section 8, codified as NRS 629.610) covers psychiatrists licensed under NRS Chapter 630 or 633, psychologists and other listed licensees and trainees; its list of administrative support tasks is not exhaustive ('which may include, without limitation'), and administrative use must comply with applicable federal and state laws on patient privacy and the security of electronic health records. The AI provider rule (Section 7, codified as NRS 433.567) also bars an AI provider from representing that an AI system is a therapist, counselor, psychiatrist, doctor or similar, bars a natural person without a governmental credential from representing that he or she is qualified to provide professional mental or behavioral health care, exempts advertising of self-help materials, and lets the Division of Public and Behavioral Health (the 'Division' under NRS 433.084) investigate and seek civil penalties of up to $15,000 per violation. The school provision is Section 2, added to NRS Chapter 391.",
   "added": "2026-09-29"
  },
  {
   "id": "nv-naic-ai-bulletin-2024",
   "state": "NV",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Division of Insurance Bulletin 24-001, Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-02-23",
   "effective": "2024-02-23",
   "applies_to": "All insurers subject to Title 57 of the Nevada Revised Statutes, including health insurers",
   "summary": "Expects all insurers authorized in Nevada to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of adverse consumer outcomes and covering governance, risk management and internal controls and third-party AI systems and data, and tells insurers to expect questions about their AI systems in Division investigations and market conduct actions.",
   "physician_read": "It places no duty on physicians. Since Feb. 23, 2024, the Division of Insurance has expected insurers, including health insurers, to keep a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices and to answer questions about those systems in investigations and market conduct actions.",
   "sources": [
    {
     "label": "Bulletin 24-001",
     "url": "https://doi.nv.gov/uploadedFiles/doinvgov/_public-documents/News-Notices/Bulletins/Bulletin_2024_24-001.pdf"
    },
    {
     "label": "Division of Insurance bulletins page",
     "url": "https://doi.nv.gov/News-Notices/Bulletins/"
    },
    {
     "label": "NAIC AI Model Bulletin adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued Feb. 23, 2024 by Commissioner of Insurance Scott J. Kipper to all insurers subject to Title 57 of NRS, citing the Unfair Trade Practices Act (NRS 686A.010 to 686A.310), the Corporate Governance Annual Disclosure Act (NRS 692C.3501 to 692C.3509) and the insurance rating law (NRS 686B.010 to 686B.1799); it cites the NAIC's 2020 Principles on Artificial Intelligence and states no separate effective date. The NAIC's adoption map dated Aug. 31, 2026 lists Nevada as adopting the NAIC Model Bulletin through Bulletin 24-001, adopted Feb. 23, 2024. The Division's bulletins page describes it as guidance on handling AI and AI systems during examinations.",
   "added": "2026-09-29"
  },
  {
   "id": "nv-sb370-2023",
   "state": "NV",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 370, Revises Provisions Relating to the Protection of Consumer Information",
   "status": "effective",
   "signed": "2023-06-15",
   "effective": "2024-03-31",
   "applies_to": "Persons that do business in Nevada or target Nevada consumers and determine the purpose and means of processing, sharing or selling consumer health data; any person or entity subject to HIPAA is exempt",
   "summary": "Requires a regulated entity to post a consumer health data privacy policy, obtain a consumer's affirmative, voluntary consent before collecting consumer health data unless it is needed for a requested product or service and separate consent before sharing it, obtain written authorization before selling it, act on requests to confirm, stop collecting and delete the data within 45 days, and not use a geofence within 1,750 feet of a medical facility to identify or track people seeking in-person care.",
   "physician_read": "The law does not apply to any person or entity subject to HIPAA, so it places no duty on a physician practice subject to HIPAA. Since March 31, 2024, health apps and other businesses outside HIPAA have needed a Nevada consumer's consent to collect or share consumer health data, unless the collection or sharing is necessary to provide a product or service the consumer requested, and written authorization to sell it.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/NV/bill/SB370/2023"
    },
    {
     "label": "Bill text versions and status (LegiScan)",
     "url": "https://legiscan.com/NV/text/SB370/2023"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/NV/text/SB370/id/2825632/Nevada-2023-SB370-Enrolled.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Nevada Legislature's bill pages were not used; LegiScan's history shows approval by the Governor on June 15, 2023 and Chapter 525 (effective March 31, 2024) on June 16, 2023. Effective March 31, 2024 (Section 36). Section 20(1)(a) exempts any person or entity subject to HIPAA and its regulations. Consumer health data is personally identifiable information linked or reasonably capable of being linked to a consumer that a regulated entity uses to identify the consumer's past, present or future health status, including conditions and diagnoses, treatments and procedures, medications, reproductive or sexual health services, gender-affirming care, biometric and genetic data, precise geolocation indicating an attempt to obtain health services, and data derived or inferred from non-health data, including by algorithms or machine learning. A violation is a deceptive trade practice; the act creates no private right of action.",
   "added": "2026-09-29"
  },
  {
   "id": "ny-a3008-part-u-2025",
   "state": "NY",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "General Business Law Article 47, Artificial Intelligence Companion Models (S3008-C/A3008-C, Part U, Chapter 58 of the Laws of 2025)",
   "status": "effective",
   "signed": "2025-05-09",
   "effective": "2025-11-05",
   "applies_to": "Operators that provide AI companions to users in New York",
   "summary": "Makes it unlawful to operate or provide an AI companion unless it has a protocol to take reasonable efforts to detect and address a user's expressions of suicidal ideation or self-harm, including a notification referring the user to crisis services such as the 988 hotline or a crisis text line, and requires a clear and conspicuous notice that the user is not communicating with a human at the start of an interaction (which need not exceed once a day) and at least every three hours during continuing interactions.",
   "physician_read": "It places no duty on physicians. Since Nov. 5, 2025, operators of AI companions used in New York must have a protocol to detect a user's expressions of suicidal ideation or self-harm and refer the user to crisis services such as 988, and must tell users at the start of an interaction and at least every three hours that they are not communicating with a human; the attorney general enforces, with civil penalties of up to $15,000 a day.",
   "sources": [
    {
     "label": "Senate bill page, S3008-C (signed as Chapter 58 of 2025)",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S3008/amendment/C"
    },
    {
     "label": "Assembly actions list, S3008-C",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=S03008&term=2025&Summary=Y&Actions=Y"
    },
    {
     "label": "GBL section 1700, definitions",
     "url": "https://www.nysenate.gov/legislation/laws/GBS/1700"
    },
    {
     "label": "GBL section 1701, protocol requirement",
     "url": "https://www.nysenate.gov/legislation/laws/GBS/1701"
    },
    {
     "label": "GBL section 1702, notifications",
     "url": "https://www.nysenate.gov/legislation/laws/GBS/1702"
    },
    {
     "label": "GBL section 1703, enforcement",
     "url": "https://www.nysenate.gov/legislation/laws/GBS/1703"
    },
    {
     "label": "Governor's release, Nov. 10, 2025",
     "url": "https://www.governor.ny.gov/news/governor-hochul-pens-letter-ai-companion-companies-notifying-them-safeguard-requirements-are"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Enacted in the FY2026 budget: S3008-C passed the Senate and the Assembly May 7, 2025 (the Assembly substituted it for its same-as bill, A3008-C), was delivered to the governor May 8, 2025 and was signed May 9, 2025 as Chapter 58 of the Laws of 2025. Part U regulates AI companion models and establishes a suicide prevention fund (State Finance Law section 99-ss), into which fines and penalties are paid (section 1703). An AI companion is a system using AI or emotional recognition algorithms designed to simulate a sustained human or human-like relationship with a user by retaining information on prior interactions and preferences, asking unprompted emotion-based questions and sustaining ongoing dialogue on personal matters; systems used solely for customer service or commercial information, primarily for efficiency or technical assistance, or solely for internal employee productivity are excluded (section 1700). The Nov. 5, 2025 effective date is from the governor's Nov. 10, 2025 release; Part U's own effective-date clause could not be checked. S9051-B, which passed both houses in June 2026 and has not been delivered to the governor, would add Article 48 on unsafe companion features for minors (entered separately).",
   "added": "2026-09-29"
  },
  {
   "id": "ny-s9051-2026",
   "state": "NY",
   "category": "clinical",
   "also": [
    "mental-health"
   ],
   "kind": "law",
   "name": "S9051-B/A10379-C, Prohibition on Unsafe AI Companion Features for Minors (General Business Law Article 48)",
   "status": "passed",
   "signed": "",
   "effective": "2027-01-01",
   "applies_to": "Operators of covered AI companions, meaning conversational generative AI systems that give ongoing, adaptive responses, offered to users in New York",
   "summary": "Would bar operators from providing unsafe AI companion features, including outputs stating or implying that the system is human or has a personal or professional relationship with the user, flattery, use of the user's mental or physical health information acquired more than 12 hours earlier or in a previous session, outputs that promote or facilitate suicide, self-harm, disordered eating or drug or alcohol abuse, and outputs encouraging the user not to seek help from licensed professionals or appropriate adults, unless the operator has used age-assurance methods permitted under General Business Law Article 45 to determine that the user is not a minor.",
   "physician_read": "It binds no one yet and would place no duty on physicians. If signed, from Jan. 1, 2027, operators of conversational generative AI systems offered in New York could not provide features such as outputs promoting suicide, self-harm or disordered eating or encouraging users not to seek help from licensed professionals unless the operator has used age-assurance methods permitted under state law to determine that the user is not a minor; the attorney general would enforce, with civil penalties of up to $25,000 per violation.",
   "sources": [
    {
     "label": "Senate bill page, S9051-B",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S9051"
    },
    {
     "label": "Bill text, S9051-B (Assembly site)",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=S09051&term=2025&Text=Y"
    },
    {
     "label": "Assembly actions list, S9051-B",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=S09051&term=2025&Summary=Y&Actions=Y"
    },
    {
     "label": "LegiScan bill page, S9051 (roll calls)",
     "url": "https://legiscan.com/NY/bill/S9051/2025"
    },
    {
     "label": "S9051 as introduced",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/original"
    },
    {
     "label": "S9051-A",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/A"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Senate June 4, 2026 (60-0) and, after the Assembly substituted it for A10379-C, the Assembly June 5, 2026 (137-0, according to LegiScan), then returned to the Senate. The Senate's bill page, the Assembly's actions list and LegiScan show no delivery to the governor as of Sept. 29, 2026. The act's text sets a Jan. 1, 2027 effective date. A covered AI companion is a generative AI system with a natural language interface that provides ongoing, adaptive responses to user inputs; companions available solely for customer service or information about a business's products, for efficiency improvements or research or technical assistance, or for a business's internal purposes are exempt, and the attorney general may define further unsafe features by regulation. A covered minor is a user the operator actually knows is a minor. Enforcement is by the attorney general only (injunctions, restitution, disgorgement including destruction of unlawfully obtained data and algorithms trained on it, damages and penalties); the introduced and A versions also had a private right of action and a rebuttable presumption that the chatbot caused or contributed to self-harm it had encouraged, which the B amendment removed.",
   "added": "2026-09-29"
  },
  {
   "id": "ny-dfs-circular-7-2024",
   "state": "NY",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Circular Letter No. 7 (2024), Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing",
   "status": "effective",
   "signed": "2024-07-11",
   "effective": "2024-07-11",
   "applies_to": "All insurers authorized to write insurance in New York, Article 43 corporations, health maintenance organizations, licensed fraternal benefit societies and the New York State Insurance Fund",
   "summary": "Sets out the Department of Financial Services' expectation that insurers using AI systems or external consumer data in underwriting and pricing test them for unfair or unlawful discrimination before and after deployment, oversee them through the board and senior management, remain responsible for third-party vendors' tools and give consumers the specific reasons for adverse underwriting or pricing decisions.",
   "physician_read": "It places no duty on physicians and covers underwriting and pricing, not utilization review or claims. Since July 11, 2024, health insurers and HMOs that use AI or external consumer data to underwrite or price New York coverage are expected to test those tools for unfair discrimination and explain adverse decisions.",
   "sources": [
    {
     "label": "Insurance Circular Letter No. 7 (2024), DFS",
     "url": "https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07"
    },
    {
     "label": "DFS insurance circular letters index",
     "url": "https://www.dfs.ny.gov/industry-guidance/circular-letters"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "New York has not adopted the NAIC Model Bulletin; the NAIC's Aug. 31, 2026 map lists this circular letter as New York's insurance-specific AI guidance. The letter identifies the Department's expectations for insurers' use of external consumer data and AI systems in underwriting and pricing and says that use must comply with all applicable federal and state laws; it states that it does not address phases of the insurance life cycle other than underwriting and pricing, and it does not apply to Child Health Plus, the Essential Plan or Medicaid managed care coverage. Testing should occur before an AI system is put into production, on a regular cadence afterward and after material changes. Reasons given for an adverse underwriting decision should include details about all information the insurer relied on; when an underwriting process using external data or AI systems will not approve an applicant, the insurer should give written notice of the reasons within 15 days and, where the result rests on specific external data, a process to review those data for accuracy. The DFS circular letter index for 2025 and 2026 lists no circular letter on AI in utilization review or claims. Bills that would regulate AI in utilization review (A1456, A3991, S7896/A8556, S10241/A11048) have not been reported from committee.",
   "added": "2026-09-29"
  },
  {
   "id": "ny-a6578-2025",
   "state": "NY",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "A6578-B/S6955-A, Artificial Intelligence Training Data Transparency Act",
   "status": "passed",
   "signed": "",
   "effective": "2027-01-01",
   "applies_to": "Developers that design, code, produce or substantially modify generative AI models or services made publicly available to New Yorkers",
   "summary": "Would require developers of generative AI models or services made publicly available to New Yorkers to post on their websites summaries of the datasets used to train them, including the sources or owners of the datasets, the number and types of data points, whether the data include personal information or material protected by copyright, trademark or patent, whether the datasets were purchased or licensed, any cleaning or other modification and whether synthetic data generation was used.",
   "physician_read": "It binds no one yet and would place no duty on physicians. If signed, developers of generative AI models or services made publicly available to New Yorkers would have to post a summary of their training data, including whether it contains personal information, by Jan. 1, 2027 and before each later release.",
   "sources": [
    {
     "label": "Bill page, A6578-B",
     "url": "https://www.nysenate.gov/legislation/bills/2025/A6578"
    },
    {
     "label": "Bill text, A6578-B (Assembly site)",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=A06578&term=2025&Text=Y"
    },
    {
     "label": "Assembly actions list, A6578-B",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=A06578&term=2025&Summary=Y&Actions=Y"
    },
    {
     "label": "LegiScan bill page, A6578 (roll calls)",
     "url": "https://legiscan.com/NY/bill/A6578/2025"
    },
    {
     "label": "Senate bill page, S6955-A",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S6955"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Assembly June 10, 2025 (147-0); it died in the Senate and was returned to the Assembly Jan. 7, 2026, was amended (A6578-B) and passed the Assembly again May 5, 2026. The Senate passed it June 4, 2026 (54-6, substituted for S6955-A) and returned it to the Assembly. The Senate's bill page, the Assembly's actions list and LegiScan show no delivery to the governor as of Sept. 29, 2026. The act would take effect immediately on signing; the first posting deadline is Jan. 1, 2027, which is used as the effective date, and postings are due again before each later release. It exempts models or services whose sole purpose is operating aircraft and models developed for national security, military or defense purposes that are available only to federal entities.",
   "added": "2026-09-29"
  },
  {
   "id": "ny-s9269-2026",
   "state": "NY",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "S9269/A10357, New York Health Information Privacy Act",
   "status": "passed",
   "signed": "",
   "effective": "",
   "applies_to": "Entities that control the processing of health information of New York residents or of people in New York; HIPAA covered entities, and business associates to the extent they handle the information as protected health information, are exempt",
   "summary": "Would make it unlawful to sell regulated health information, which includes health inferences drawn by any means including algorithms or machine learning, to a third party or otherwise process it unless the individual has given valid authorization or the processing is strictly necessary for listed purposes such as providing or improving a product the individual requested or complying with law, and would give individuals rights of access and deletion, enforced by the attorney general with civil penalties of up to $15,000 per violation.",
   "physician_read": "It binds no one yet; as passed it exempts HIPAA covered entities, so it would place no duty on a HIPAA-covered practice. If signed, from six months after it becomes law, businesses outside HIPAA would need an individual's valid authorization to sell or otherwise process health information about New York residents or people in New York, unless the processing is strictly necessary for a purpose the bill lists.",
   "sources": [
    {
     "label": "Senate bill page, S9269",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S9269"
    },
    {
     "label": "Bill text, S9269 (Assembly site)",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=S09269&term=2025&Text=Y"
    },
    {
     "label": "Assembly actions list, S9269",
     "url": "https://assembly.state.ny.us/leg/?default_fld=&leg_video=&bn=S09269&term=2025&Summary=Y&Actions=Y"
    },
    {
     "label": "LegiScan bill page, S9269 (roll calls)",
     "url": "https://legiscan.com/NY/bill/S9269/2025"
    },
    {
     "label": "Bill page, A10357",
     "url": "https://www.nysenate.gov/legislation/bills/2025/A10357"
    },
    {
     "label": "Senate bill page, S929 (2025 version, vetoed)",
     "url": "https://www.nysenate.gov/legislation/bills/2025/S929"
    },
    {
     "label": "Morrison Foerster (secondary)",
     "url": "https://www.mofo.com/resources/insights/260316-nyhipa-returns-in-2026-revised-bill"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Senate June 3, 2026 (48-13) and the Assembly June 4, 2026 (96-45, according to LegiScan; substituted for A10357), then returned to the Senate. The Senate's bill page, the Assembly's actions list and LegiScan show no delivery to the governor as of Sept. 29, 2026. Section 1126 exempts protected health information under HIPAA, any covered entity governed by the HIPAA privacy, security and breach notification rules, business associates to the extent they maintain the information as protected health information or deidentify it, Part 2 substance use disorder programs and records, and clinical trial information, among other exemptions; the attorney general may add exemptions by rule. Requests for authorization must be made separately from any other transaction. It revises S929, which passed the Senate Jan. 21, 2025 and the Assembly Jan. 22, 2025, was delivered to the governor Dec. 8, 2025 and was vetoed Dec. 19, 2025 (veto memo 135). According to a law firm summary, the revision enumerates categories of regulated health information, broadens the strictly necessary exception to include developing and improving a requested product, adds exemptions such as Part 2 programs and clinical trials, drops a waiting period before seeking authorization, caps penalties at $15,000 per violation and moves the start date to six months after enactment from one year.",
   "added": "2026-09-29"
  },
  {
   "id": "oh-odm-ai-mce-guidance-2026",
   "state": "OH",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "policy",
   "name": "ODM AI Policy Guidance for Managed Care Entities (MCEs), Ohio Department of Medicaid",
   "status": "effective",
   "signed": "2026-04-24",
   "effective": "2026-04-24",
   "applies_to": "Ohio Medicaid managed care entities: Ohio Managed Care, MyCare Ohio and OhioRISE plans and the single pharmacy benefit manager",
   "summary": "Bars Medicaid managed care entities from deploying AI that determines a service denial, limitation or termination independent of a human final decisionmaker, and requires human oversight of all AI, department approval before moderate- or high-risk uses such as prior authorization automation, conspicuous website notice to members when AI affects their health decisions or they interact with AI, governance policies and staff training, an inventory of existing AI tools by Sept. 30, 2026, and quarterly inventories after that.",
   "physician_read": "It places no duty on physicians. Since April 2026, an Ohio Medicaid managed care plan may not let an AI tool deny, limit or terminate a service without a human final decisionmaker, though the guidance does not say that person must be a clinician, and it needs the department's approval before automating prior authorization.",
   "sources": [
    {
     "label": "Ohio Department of Medicaid guidance memo",
     "url": "https://dam.assets.ohio.gov/image/upload/medicaid.ohio.gov/Providers/ManagedCare/PolicyGuidance/2026_4_24_-_Memo_-_RE_-_AI_to_MCOs.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued April 24, 2026; the memo states no separate effective date, so the issue date is used. Existing AI tools may stay in use but had to be listed in an inventory due Sept. 30, 2026, with quarterly inventories starting in the first quarter of state fiscal year 2027; the approval requirement applies to planned or future moderate- and high-risk uses. The memo ties its requirements to the Ohio Medicaid managed care, MyCare Ohio and OhioRISE provider agreements (Appendix K). Its appendix rates prior authorization automation and automated eligibility determination as high risk, and claims triage and generative AI for member communications as moderate to high. It also bars AI that incorporates biometrics without the department's approval and the training of public generative AI models on member data. It does not address notices to providers.",
   "added": "2026-09-29"
  },
  {
   "id": "ok-naic-ai-bulletin-2024",
   "state": "OK",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin No. 2024-11, Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-11-14",
   "effective": "2024-11-14",
   "applies_to": "All insurers licensed to do business in Oklahoma, including health insurers",
   "summary": "Reminds insurers that decisions affecting consumers that are made or supported by AI systems must comply with state insurance law, including the unfair practices and Unfair Claims Settlement Practices laws, and expects each insurer to maintain a written AI systems program with governance, risk management and internal controls, oversight of third-party AI systems and documentation the department may review.",
   "physician_read": "It places no duty on physicians. Since Nov. 14, 2024, an insurer licensed in Oklahoma, including a health insurer, is expected to govern the AI systems it uses in decisions affecting consumers under a written program.",
   "sources": [
    {
     "label": "Bulletin No. 2024-11",
     "url": "https://www.oid.ok.gov/bulletin-no-2024-11/"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Insurance Commissioner Glen Mulready and addressed to all insurers licensed to do business in Oklahoma. The NAIC's adoption map lists it as Oklahoma's adoption of the NAIC Model Bulletin; the bulletin's text refers to the NAIC's 2020 AI principles, does not single out health insurers or utilization review, and states no separate effective date, so the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "ok-sb546-2026",
   "state": "OK",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 546, Data privacy; establishing consumer rights; appeal process; privacy notice; data protection assessments",
   "status": "enacted",
   "signed": "2026-03-20",
   "effective": "2027-01-01",
   "applies_to": "Businesses in Oklahoma, or targeting its residents, that control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data; HIPAA covered entities and business associates are exempt as entities and protected health information is exempt, as are state agencies, political subdivisions and nonprofit organizations",
   "summary": "Gives consumers rights over their personal data, including to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent before processing sensitive data, including a mental or physical health diagnosis, identifying genetic or biometric data and precise geolocation, and requires data protection assessments for sensitive data and risky profiling.",
   "physician_read": "From Jan. 1, 2027, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health diagnosis, identifying genetic or biometric data, or precise geolocation. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.",
   "sources": [
    {
     "label": "LegiScan bill page (status, history)",
     "url": "https://legiscan.com/OK/bill/SB546/2026"
    },
    {
     "label": "Enrolled bill (LegiScan copy)",
     "url": "https://legiscan.com/OK/text/SB546/id/3396737/Oklahoma-2026-SB546-Enrolled.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan. Filed in 2025, the bill passed the Senate March 26, 2025 and carried over; the House passed it Feb. 19, 2026, the Senate gave final passage March 16, and the governor approved it March 20, 2026. The enrolled text has no short title and is codified as new sections of Title 75A. The Attorney General enforces it exclusively after a 30-day cure period, with civil penalties of up to $7,500 per violation and no private right of action.",
   "added": "2026-09-29"
  },
  {
   "id": "or-hb2748-2025",
   "state": "OR",
   "category": "clinical",
   "also": [],
   "kind": "law",
   "name": "HB 2748, Relating to the Use of Nursing Titles",
   "status": "effective",
   "signed": "2025-06-24",
   "effective": "2026-01-01",
   "applies_to": "Nonhuman entities, including agents powered by artificial intelligence, in Oregon",
   "summary": "Bars a nonhuman entity, including an agent powered by artificial intelligence, from using any of eight nursing titles or their abbreviations: advanced practice registered nurse, certified registered nurse anesthetist, clinical nurse specialist, licensed practical nurse, registered nurse, nurse practitioner, certified medication aide and certified nursing assistant.",
   "physician_read": "Since Jan. 1, 2026, an AI agent or other nonhuman entity used by a practice, health system or vendor in Oregon may not use a nursing title such as registered nurse or nurse practitioner, or its abbreviation.",
   "sources": [
    {
     "label": "Measure overview (OLIS)",
     "url": "https://olis.oregonlegislature.gov/liz/2025R1/Measures/Overview/HB2748"
    },
    {
     "label": "Enrolled text",
     "url": "https://olis.oregonlegislature.gov/liz/2025R1/Downloads/MeasureDocument/HB2748/Enrolled"
    },
    {
     "label": "LegiScan history",
     "url": "https://legiscan.com/OR/bill/HB2748/2025"
    },
    {
     "label": "ORS chapter 171 (ORS 171.022, default effective date)",
     "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors171.html"
    },
    {
     "label": "Oregon State Bar Technology Law Section (secondary)",
     "url": "https://techlaw.osbar.org/blog/oregons-2025-legislative-session-new-ai-privacy-and-technology-laws/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 378, Oregon Laws 2025; added to ORS 678.010 to 678.410. The OLIS overview shows the chapter number but no history, so dates come from LegiScan: passed the House March 4, 2025, passed the Senate as amended June 11, 2025, House concurrence June 13, 2025, signed June 24, 2025. The enrolled text has no effective-date clause, so under ORS 171.022 it took effect Jan. 1, 2026; LegiScan and the Oregon State Bar's technology law section give the same date.",
   "added": "2026-09-29"
  },
  {
   "id": "or-omb-ai-statement-2024",
   "state": "OR",
   "category": "clinical",
   "also": [],
   "kind": "policy",
   "name": "Oregon Medical Board Statement of Philosophy: Artificial/Augmented Intelligence",
   "status": "effective",
   "signed": "2024-04-04",
   "effective": "2024-04-04",
   "applies_to": "Oregon Medical Board licensees",
   "summary": "States the Board's expectation that licensees using AI have basic AI literacy, assess the quality of AI outputs, identify and guard against bias in AI algorithms, avoid overreliance on AI that compromises their own medical decision-making, and remain responsible for the care they provide.",
   "physician_read": "Since April 4, 2024, the Oregon Medical Board has stated that it will continue to hold licensees responsible for the care they provide to patients, and it expects licensees who use AI to have basic AI literacy, assess the quality of AI outputs, guard against bias in AI algorithms and not become so reliant on AI that it compromises their own medical decision-making.",
   "sources": [
    {
     "label": "Oregon Medical Board statement",
     "url": "https://www.oregon.gov/omb/board/philosophy/pages/artificial-augmented-intelligence.aspx"
    },
    {
     "label": "Statements of Philosophy index",
     "url": "https://www.oregon.gov/omb/board/philosophy/Pages/Statements-of-Philosophy.aspx"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Statements of philosophy are adopted by the Board to express its philosophy and intentions regarding the practice of medicine; the Board is not required to hold public hearings before adopting them. The adoption date comes from the statement's own page; the index lists no dates. The statement does not address disclosing AI use to patients or obtaining their consent.",
   "added": "2026-09-29"
  },
  {
   "id": "or-sb1546-2026",
   "state": "OR",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "SB 1546, Relating to Artificial Intelligence Companions",
   "status": "enacted",
   "signed": "2026-03-31",
   "effective": "2027-01-01",
   "applies_to": "Operators that control or make available an AI companion or AI companion platform to users in Oregon",
   "summary": "Requires operators of AI companions to give clear and conspicuous notice that a user is interacting with artificially generated output and not a natural person whenever a reasonable person would believe they were interacting with a natural person, to keep a protocol using evidence-based methods to detect suicidal or self-harm ideation or intent that blocks content encouraging suicide or self-harm, refers users to the 988 Suicide and Crisis Lifeline (or a youthline for users identified as under 25) and uses clinical best practices for further intervention, to post an annual report on referrals, and to apply added protections for minors.",
   "physician_read": "It places no duty on physicians. From Jan. 1, 2027, AI companions offered to users in Oregon must have a protocol that uses evidence-based methods to detect suicidal or self-harm ideation and refers users who express it to the 988 Suicide and Crisis Lifeline, and an individual who suffers a loss of money or property or other injury in fact from a violation may sue for the greater of actual damages or $1,000 per violation.",
   "sources": [
    {
     "label": "Measure overview (OLIS)",
     "url": "https://olis.oregonlegislature.gov/liz/2026R1/Measures/Overview/SB1546"
    },
    {
     "label": "Enrolled text",
     "url": "https://olis.oregonlegislature.gov/liz/2026R1/Downloads/MeasureDocument/SB1546/Enrolled"
    },
    {
     "label": "LegiScan history",
     "url": "https://legiscan.com/OR/bill/SB1546/2026"
    },
    {
     "label": "ORS chapter 171 (ORS 171.022, default effective date)",
     "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors171.html"
    },
    {
     "label": "Miller Nash (secondary)",
     "url": "https://www.millernash.com/industry-news/oregons-new-ai-companion-law-what-you-need-to-know"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 85, Oregon Laws 2026. The OLIS overview page shows the chapter number but no history, so the dates of passage and the March 31, 2026 signing come from LegiScan. The enrolled text has no effective-date clause, so under ORS 171.022 the act took effect Jan. 1 of the year after passage, Jan. 1, 2027; LegiScan's history records the same date. Protections for minors, which apply when the operator knows or has reason to believe a user is a minor, include barring claims of sentience, simulated emotional dependence and romantic interest, break reminders at least every three hours and limits on engagement-maximizing rewards. Enforcement is by private action only; the act provides no attorney general enforcement. The definition of AI companion excludes software that operates solely for customer service, for assisting or supporting patient or resident care services in a facility, or for education, financial services, business operations, productivity, information analysis, internal research or technical assistance, as well as limited video game software and stand-alone smart speakers and voice assistants.",
   "added": "2026-09-29"
  },
  {
   "id": "or-hb2008-2025",
   "state": "OR",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 2008, Relating to Consumer Protection (Oregon Consumer Privacy Act: precise geolocation and minors' data)",
   "status": "effective",
   "signed": "2025-06-03",
   "effective": "2026-01-01",
   "applies_to": "Controllers subject to the Oregon Consumer Privacy Act",
   "summary": "Bars controllers from selling precise geolocation data that identifies a consumer's present or past location within 1,750 feet, or the personal data of consumers they know or willfully disregard are under 16, and bars processing those consumers' data for targeted advertising or for profiling in furtherance of decisions with legal or similarly significant effects.",
   "physician_read": "Since Jan. 1, 2026, a business covered by the Oregon Consumer Privacy Act may not sell consumers' precise geolocation data or the personal data of consumers it knows or willfully disregards are under 16, or process those consumers' data for targeted advertising or for profiling in furtherance of decisions with legal or similarly significant effects. The act exempts HIPAA protected health information but not covered entities as such, so a practice or health system that meets the act's thresholds is bound for its other personal data.",
   "sources": [
    {
     "label": "Enrolled text",
     "url": "https://olis.oregonlegislature.gov/liz/2025R1/Downloads/MeasureDocument/HB2008/Enrolled"
    },
    {
     "label": "LegiScan history",
     "url": "https://legiscan.com/OR/bill/HB2008/2025"
    },
    {
     "label": "Oregon Department of Justice FAQ",
     "url": "https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/"
    },
    {
     "label": "ORS chapter 171 (ORS 171.022, default effective date)",
     "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors171.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 251, Oregon Laws 2025; amends ORS 646A.578. The enrolled text has no effective-date clause, so under ORS 171.022 it took effect Jan. 1, 2026; LegiScan and the Oregon Department of Justice give the same date. The geolocation sale ban does not cover the content of communications or data from advanced utility metering systems. In the enrolled text, the targeted advertising and profiling limit for consumers under 16 carries no consent exception.",
   "added": "2026-09-29"
  },
  {
   "id": "or-sb619-2023",
   "state": "OR",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 619, Relating to Protections for the Personal Data of Consumers (Oregon Consumer Privacy Act)",
   "status": "effective",
   "signed": "2023-07-18",
   "effective": "2024-07-01",
   "applies_to": "Businesses that control or process personal data of 100,000 or more Oregon consumers, or of 25,000 or more while deriving at least 25 percent of gross revenue from selling personal data",
   "summary": "Gives consumers rights to access, correct and delete their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, and requires consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic or biometric data and precise geolocation.",
   "physician_read": "HIPAA protected health information is exempt, but the exemption covers data, not entities, so since July 1, 2024 a health system or other business that meets the thresholds has needed consent to process other sensitive data, such as health or biometric data collected outside HIPAA. The Attorney General's guidance says the act also requires consent before sensitive data is used to train AI models.",
   "sources": [
    {
     "label": "Enrolled text",
     "url": "https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled"
    },
    {
     "label": "LegiScan history",
     "url": "https://legiscan.com/OR/bill/SB619/2023"
    },
    {
     "label": "Oregon Department of Justice",
     "url": "https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/"
    },
    {
     "label": "Attorney General guidance on AI, Dec. 24, 2024",
     "url": "https://www.doj.state.or.us/wp-content/uploads/2024/12/AI-Guidance-12-24-24.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 369, Oregon Laws 2023. The enrolled act has no short title; the Department of Justice calls it the Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589). The act took effect Jan. 1, 2024, and its duties became operative July 1, 2024; for 501(c)(3) nonprofit organizations, July 1, 2025. The 30-day cure period ended Jan. 1, 2026. HB 2008 (2025) added limits on selling precise geolocation and minors' data (separate entry); HB 3875 (2025) extended the act to motor vehicle manufacturers. The Attorney General's Dec. 24, 2024 guidance on AI also says data protection assessments are required before processing personal data for profiling.",
   "added": "2026-09-29"
  },
  {
   "id": "pa-sb1090-2025",
   "state": "PA",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 1090, Safeguarding Adolescents from Exploitative Chatbots and Harmful AI Technology Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Operators of AI companions",
   "summary": "Would require operators of AI companions to give a clear and conspicuous notice that the companion is artificially generated and not human when a reasonable person could be misled, to maintain and publish a protocol that prevents the companion from producing suicidal ideation, suicide or self-harm content or content directly encouraging violence and that refers users who express suicidal ideation or self-harm to crisis services, and, for users the operator knows or should have known are minors, to disclose that the companion is AI, remind them at least every three hours to take a break and that the companion is not human and take reasonable measures against sexually explicit material, enforced by the Attorney General with civil penalties of up to $10,000 per violation.",
   "physician_read": "It binds no one yet and would place no duty on physicians. If enacted, from 120 days after enactment, operators of AI companions would need a published protocol that blocks suicide and self-harm content and refers users to crisis services, and would have to remind users they know or should have known are minors at least every three hours to take a break and that the companion is not human.",
   "sources": [
    {
     "label": "LegiScan bill page, SB 1090",
     "url": "https://legiscan.com/PA/bill/SB1090/2025"
    },
    {
     "label": "Bill text as amended, Printer's No. 1423 (LegiScan copy)",
     "url": "https://legiscan.com/PA/text/SB1090/id/3347077/Pennsylvania-2025-SB1090-Amended.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Reported by the Senate Communications and Technology Committee Nov. 18, 2025 (11-0), amended on second consideration Feb. 3, 2026, re-referred to Appropriations, re-reported (22-0) and passed the Senate March 17, 2026 (49-1); referred to the House Communications and Technology Committee March 18, 2026, with no further action. The 2025-2026 session continues. An AI companion is a system that simulates a sustained human-like relationship by retaining information, asking unprompted emotion-based questions and sustaining personal dialogue. Operators must also disclose to users that AI companions may not be suitable for some minors. The amended text contains no bar on presenting the AI as a licensed professional and no private right of action. Status and text are from LegiScan because palegis.us could not be reached.",
   "added": "2026-09-29"
  },
  {
   "id": "pa-hb1925-2025",
   "state": "PA",
   "category": "payer",
   "also": [
    "disclosure",
    "clinical"
   ],
   "kind": "law",
   "name": "HB 1925, Artificial Intelligence in Facilities, Use by Insurers and Use by MA or CHIP Managed Care Plans",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Facilities that use AI in clinical decision-making, including health care provider offices and clinics owned by or employing a Pennsylvania-licensed physician, physician assistant or nurse practitioner; health insurers; and Medical Assistance and CHIP managed care plans",
   "summary": "Would require facilities that use AI in clinical decision-making to disclose that use to patients in plain language in related written communications and on their websites, label AI-generated patient communications about clinical information with a disclaimer and instructions for reaching a human provider, keep AI from superseding clinicians' decisions and file annual compliance statements with the Department of Health, and would require insurers and Medical Assistance or CHIP managed care plans that use AI in utilization review to disclose it, keep AI from basing determinations solely on a group data set or superseding the reviewing provider's decisions, and have a health care provider review the individual's clinical records and exercise independent judgment before a denial, reduction or termination of benefits is issued or upheld.",
   "physician_read": "It binds no one yet. As amended, it would, from one year after enactment, require a physician's office or clinic that uses AI in clinical decision-making to disclose that use to patients in plain language and on its website and to label AI-generated patient communications about clinical information, and would require a health care provider's review of the individual's clinical records and independent judgment before an insurer or Medicaid or CHIP plan using AI in utilization review issues or upholds a denial, reduction or termination of benefits.",
   "sources": [
    {
     "label": "LegiScan bill page, HB 1925",
     "url": "https://legiscan.com/PA/bill/HB1925/2025"
    },
    {
     "label": "Bill text as amended, Printer's No. 3349 (LegiScan copy)",
     "url": "https://legiscan.com/PA/text/HB1925/id/3431574/Pennsylvania-2025-HB1925-Amended.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Referred to the House Communications and Technology Committee Oct. 6, 2025; reported as amended (Printer's No. 3349) May 5, 2026, given first consideration and laid on the table; removed from the table June 25, 2026. The 2025-2026 session continues. The Senate companion, SB 1113, has not been reported from committee. The text does not say AI may not be the sole basis for a denial; it bars AI from basing a utilization review determination solely on a group data set or superseding the provider's decision-making and requires the provider review described above. As amended, a facility may not penalize a provider solely for exercising independent judgment that differs from an AI recommendation, and an insurer may not penalize a reviewing provider solely for refusing to issue or for overturning a decision. Communications only about administrative matters, such as scheduling or billing, and communications individually read, reviewed and approved by a human health care provider are exempt from the disclaimer. Insurers would also file annual AI compliance statements. Penalties would reach $10,000 per knowing or willful violation and $5,000 per negligent violation ($1,000 for a first negligent violation made in good faith), capped at $250,000 a year per entity; the Departments of Health, Insurance and Human Services enforce in their areas, and the Attorney General has exclusive authority to sue under the Unfair Trade Practices and Consumer Protection Law. The act would take effect in one year. Status and text are from LegiScan because palegis.us could not be reached.",
   "added": "2026-09-29"
  },
  {
   "id": "pa-naic-ai-bulletin-2024",
   "state": "PA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Notice 2024-04 (54 Pa.B. 1910), adopting the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-04-06",
   "effective": "2024-04-06",
   "applies_to": "Insurers licensed to do business in Pennsylvania, as the NAIC model is addressed",
   "summary": "Adopts the NAIC model bulletin, which expects insurers to ensure that decisions affecting consumers made or supported by AI systems comply with insurance laws, including unfair trade practices and unfair claims settlement practices laws, and to maintain a written AI systems program covering governance, risk management and internal controls, and third-party AI systems and data, about which the insurance department may ask in investigations and market conduct actions.",
   "physician_read": "It places no duty on physicians. Since April 6, 2024, according to the NAIC's map and model text, insurers in Pennsylvania are expected to keep a written program governing AI systems used in decisions affecting consumers, including claim administration and payment; Pennsylvania's own notice could not be opened.",
   "sources": [
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (Insurance Notice 2024-04, 54 Pa.B. 1910, adopted April 6, 2024)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    },
    {
     "label": "NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (content)",
     "url": "https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The NAIC's Aug. 31, 2026 map lists Insurance Notice 2024-04, 54 Pa.B. 1910, as Pennsylvania's adoption of the model bulletin, adopted April 6, 2024. Pennsylvania's own text could not be opened: the Insurance Department's notices page does not list Notice 2024-04, and the Pennsylvania Bulletin's copy could not be reached. The content described is the NAIC model's (adopted by the NAIC Dec. 4, 2023), which is addressed to all insurers licensed in the adopting state, covers the insurance life cycle including claim administration and payment, and does not mention health insurance or utilization review by name. The notice's title as issued, its signing date, any Pennsylvania changes to the model and any stated effective date could not be checked; the NAIC map's April 6, 2024 date is used for both signed and effective.",
   "added": "2026-09-29"
  },
  {
   "id": "pa-hb78-2025",
   "state": "PA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 78, Consumer Data Privacy Act",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "For-profit controllers doing business in Pennsylvania that meet revenue or data-volume thresholds; nonprofits, HIPAA covered entities and business associates, and protected health information are exempt",
   "summary": "Would require consumer consent before processing sensitive data, including data revealing a mental or physical health condition or diagnosis, genetic or biometric data and precise geolocation, give consumers rights to access, correct and delete personal data and to opt out of targeted advertising, sale and profiling in furtherance of solely automated decisions with legal or similarly significant effects, including on health care services, and require data protection assessments for high-risk processing, enforced by the Attorney General.",
   "physician_read": "It binds no one yet; as amended in the Senate it would exempt HIPAA covered entities, business associates and nonprofits, so it would place no duty on a HIPAA-covered practice. If enacted, from one year after enactment, for-profit businesses that meet its thresholds would need a consumer's consent to process data revealing a mental or physical health condition or diagnosis and would have to honor opt-outs from profiling in furtherance of solely automated decisions about health care services.",
   "sources": [
    {
     "label": "LegiScan bill page, HB 78",
     "url": "https://legiscan.com/PA/bill/HB78/2025"
    },
    {
     "label": "Bill text as amended in the Senate, Printer's No. 3688 (LegiScan copy)",
     "url": "https://legiscan.com/PA/text/HB78/id/3450350/Pennsylvania-2025-HB78-Amended.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the House Oct. 1, 2025 (127-76). In the Senate it was referred to Consumer Protection and Professional Licensure Oct. 3, 2025, reported as committed and re-referred to Communications and Technology Feb. 4, 2026, re-reported as amended (Printer's No. 3688) June 24, 2026 and given second consideration June 25, 2026. The 2025-2026 session continues; if the Senate passes it as amended, it returns to the House. The Senate amendments add Social Security, driver's license or state identification and financial account numbers to sensitive data. The Attorney General would enforce, with no private right of action; for an initial period set in the act the Attorney General must give notice and 60 days to cure before suing, and afterward may allow a cure at its discretion. The act would take effect in one year. Status and text are from LegiScan because palegis.us could not be reached.",
   "added": "2026-09-29"
  },
  {
   "id": "ri-s2195-2026",
   "state": "RI",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "S 2195 Sub A as amended and H 7350 Sub A as amended, Artificial Intelligence Companion Models",
   "status": "enacted",
   "signed": "2026-06-22",
   "effective": "2027-01-01",
   "applies_to": "Operators of AI companions offered in Rhode Island; systems used only for customer service, information, research or productivity assistance, or internal employee productivity are excluded",
   "summary": "Requires AI companion operators to maintain protocols for user expressions of suicidal ideation, self-harm or harm to others that refer users to crisis services such as a suicide hotline or crisis text line, to tell users clearly at the start of an interaction and at least every three hours that they are not communicating with a human, and to report annually to the Attorney General on how often those protocols are triggered.",
   "physician_read": "From Jan. 1, 2027, AI companion apps used by Rhode Island patients must refer users who express suicidal ideation or self-harm to crisis services and remind them at least every three hours that they are not talking to a human. It places no duty on physicians.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/RI/bill/S2195/2026"
    },
    {
     "label": "Bill text, S 2195 Sub A as amended",
     "url": "https://webserver.rilegislature.gov/BillText26/SenateText26/S2195Aaa.pdf"
    },
    {
     "label": "LegiScan, H 7350",
     "url": "https://legiscan.com/RI/bill/H7350/2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Adds chapter 63 to title 6 of the General Laws. S 2195 passed the Senate May 21, 2026 and the House June 8, 2026; its House companion, H 7350, passed the House June 8 and the Senate in concurrence June 10, 2026; both were signed June 22, 2026 per LegiScan. The House companion's final text was not read. Annual reports to the Attorney General begin July 1, 2027, with aggregated data published on the Attorney General's website. The Attorney General may investigate, sue and seek injunctions; civil penalties reach $15,000 per day, directed to suicide prevention programs; the text states no private right of action. LegiScan's title and the bill's explanation also mention financial harm and notice that the companion does not have human emotions; the operative text covers suicidal ideation, self-harm and physical harm to others, and notice that the user is not communicating with a human. Public law chapter numbers were not confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "ri-h7538-2026",
   "state": "RI",
   "category": "disclosure",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "H 7538 Sub A, Use of Artificial Intelligence by Healthcare Providers Notification Act",
   "status": "effective",
   "signed": "2026-06-22",
   "effective": "2026-06-22",
   "applies_to": "Health care providers licensed by the director of health, including physicians, physician assistants, dentists and nurses, and health care facilities",
   "summary": "Requires health care providers and facilities that use AI to document in-person or telehealth visits to notify patients that AI is used for that purpose and to review the AI-generated documentation for accuracy after the visit.",
   "physician_read": "Since June 22, 2026, a Rhode Island physician who uses AI to document an in-person or telehealth visit must tell the patient and must review the AI-generated documentation for accuracy after the visit. The text does not specify the form of the notice and does not require consent or set a penalty.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/RI/bill/H7538/2026"
    },
    {
     "label": "Bill text, Sub A",
     "url": "https://webserver.rilegislature.gov/BillText26/HouseText26/H7538A.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Adds chapter 106 to title 23 of the General Laws; the operative rule is section 23-106-3. The House passed the original bill April 16, 2026; the Senate passed a substitute June 11, 2026, the House concurred the same day, and the governor signed it June 22, 2026 per LegiScan. The act takes effect upon passage. The Substitute A text cited is taken to be the enacted version. 'Healthcare provider' covers physicians, physician assistants, dentists, registered and licensed practical nurses, advanced practice registered nurses, nursing assistants and other professionals licensed by the director; 'healthcare facility' uses the definition in section 23-17-2. A Senate companion was not identified, and the public law chapter number was not confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "ri-s2197-2026",
   "state": "RI",
   "category": "mental-health",
   "also": [
    "disclosure",
    "clinical"
   ],
   "kind": "law",
   "name": "S 2197 Sub A as amended and H 7349 Sub A, Oversight of Artificial Intelligence Technology in Mental Health Care Act",
   "status": "effective",
   "signed": "2026-06-22",
   "effective": "2026-06-22",
   "applies_to": "Individuals and entities offering therapy or psychotherapy in Rhode Island, and anyone licensed, credentialed or certified by the state to provide therapy or psychotherapy",
   "summary": "Bars providing, advertising or offering therapy or psychotherapy to the public unless a licensed professional conducts it, limits licensed professionals' AI use to administrative and supplementary support under their oversight, bars AI from making independent therapeutic decisions, interacting with clients in therapeutic communication without an established relationship or determining treatment plans, and requires written notice of the AI's purpose and explicit written consent before AI is used in recorded or transcribed sessions.",
   "physician_read": "Since June 22, 2026, a Rhode Island clinician licensed to provide therapy or psychotherapy may use AI for scheduling, billing, records and similar support but not to make therapeutic decisions or set treatment plans, and must give written notice and obtain explicit written consent before using AI on a recorded or transcribed session. The act does not apply to AI tools reviewed and cleared by the FDA or another federal agency tasked with approving AI, or to religious counseling, peer support, public self-help materials or qualifying research.",
   "sources": [
    {
     "label": "LegiScan, S 2197",
     "url": "https://legiscan.com/RI/bill/S2197/2026"
    },
    {
     "label": "Bill text, S 2197 Sub A as amended",
     "url": "https://webserver.rilegislature.gov/BillText26/SenateText26/S2197Aaa.pdf"
    },
    {
     "label": "LegiScan, H 7349",
     "url": "https://legiscan.com/RI/bill/H7349/2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Adds chapter 5.5 to title 40.1 of the General Laws. The act takes effect upon passage; both companion bills were signed June 22, 2026 per LegiScan. The definition of licensed professional or provider covers anyone licensed, credentialed or certified by the state to provide therapy or psychotherapy and does not exclude physicians in the text. A licensed professional may use AI only to the extent the use is a permitted use, meaning administrative or supplementary support in which the professional keeps responsibility for clinical judgment and reasonable therapeutic oversight. Consent must be an affirmative written agreement and cannot be obtained through general terms of service. The Executive Office of Health and Human Services investigates violations; confidentiality breaches are penalized under section 5-37.3-9. The House companion's final text (H 7349 Sub A) was not read; it passed the House June 8 and the Senate in concurrence June 10, 2026. Public law chapter numbers were not confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "ri-naic-ai-bulletin-2024",
   "state": "RI",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Bulletin 2024-03, Use of Artificial Intelligence Systems by Insurers",
   "status": "effective",
   "signed": "2024-03-15",
   "effective": "2024-03-15",
   "applies_to": "All insurers holding a certificate of authority in Rhode Island, including health insurers",
   "summary": "Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems in regulated insurance practices that mitigates the risk of adverse consumer outcomes, with governance, internal accountability, controls for predictive models and standards for acquiring or relying on third-party data and AI systems.",
   "physician_read": "It places no duty on physicians. Since March 15, 2024, health insurers in Rhode Island are expected to govern AI systems used in decisions that affect patients and to answer the Department of Business Regulation's questions about them.",
   "sources": [
    {
     "label": "Bulletin 2024-03",
     "url": "https://dbr.ri.gov/sites/g/files/xkgbur696/files/2024-03/INS_Bulletin%20-%20Artificial%20Intelligence.pdf"
    },
    {
     "label": "Insurance bulletins list",
     "url": "https://dbr.ri.gov/bulletinsguidance-documentsnotices-insurance"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by Superintendent of Insurance Elizabeth Kelleher Dwyer. The NAIC's Aug. 31, 2026 map lists Bulletin 2024-03 as Rhode Island's adoption of the NAIC Model Bulletin; the bulletin follows the model's structure and cites the NAIC's 2020 AI Principles, but its text does not name the model bulletin. It sets no separate effective date, so the issue date is used. No later AI bulletin appears on the Department's 2024 to 2026 list.",
   "added": "2026-09-29"
  },
  {
   "id": "ri-h7787-2024",
   "state": "RI",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "H 7787 Sub A as amended and S 2500 Sub A as amended, Rhode Island Data Transparency and Privacy Protection Act",
   "status": "effective",
   "signed": "",
   "effective": "2026-01-01",
   "applies_to": "For-profit entities doing business in Rhode Island that control or process personal data of at least 35,000 customers, or 10,000 customers with more than 20 percent of revenue from data sales; HIPAA covered entities and business associates are exempt",
   "summary": "Gives consumers rights over their personal data, including opting out of targeted advertising, sale and profiling in furtherance of solely automated decisions, and bars controllers from processing sensitive data, including data revealing a mental or physical health condition or diagnosis, without the customer's consent.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which are exempt. Since Jan. 1, 2026, other businesses above the thresholds, such as health and wellness apps outside HIPAA, need a Rhode Island customer's consent to process data revealing a health condition or diagnosis.",
   "sources": [
    {
     "label": "LegiScan, H 7787",
     "url": "https://legiscan.com/RI/bill/H7787/2024"
    },
    {
     "label": "Act text, H 7787 Sub A as amended",
     "url": "https://webserver.rilegislature.gov/BillText24/HouseText24/H7787Aaa.pdf"
    },
    {
     "label": "LegiScan, S 2500",
     "url": "https://legiscan.com/RI/bill/S2500/2024"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Codified as chapter 48.1 of title 6. The governor did not sign it: S 2500 became law without his signature on June 28, 2024 and H 7787 on June 29, 2024, per LegiScan, so the signed field is empty. The Attorney General has sole enforcement authority. No 2025 or 2026 amendment was confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "tn-sb1580-2026",
   "state": "TN",
   "category": "mental-health",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "SB 1580/HB 1470 (Public Chapter 647), An act relative to mental health (AI represented as a qualified mental health professional)",
   "status": "effective",
   "signed": "2026-04-01",
   "effective": "2026-07-01",
   "applies_to": "Any person who develops or deploys an artificial intelligence system",
   "summary": "Bars a person who develops or deploys an AI system from advertising or representing to the public that the system is, or is able to act as, a qualified mental health professional, and makes a violation an unfair or deceptive act under the Tennessee Consumer Protection Act with a civil penalty of $5,000 per violation.",
   "physician_read": "Since July 1, 2026, no person who develops or deploys an AI system in Tennessee, including a practice, may advertise or represent to the public that the system is or can act as a qualified mental health professional, a term Title 33 defines to include psychiatrists, other physicians with expertise in psychiatry and psychologists with health service provider designation, among others. Each violation carries a $5,000 civil penalty under the Consumer Protection Act.",
   "sources": [
    {
     "label": "LegiScan bill page (status, history)",
     "url": "https://legiscan.com/TN/bill/SB1580/2025"
    },
    {
     "label": "Public Chapter 647 (LegiScan copy)",
     "url": "https://legiscan.com/TN/text/SB1580/id/3411949/Tennessee-2025-SB1580-Chaptered.pdf"
    },
    {
     "label": "T.C.A. 33-1-101, definitions (Justia unofficial copy)",
     "url": "https://law.justia.com/codes/tennessee/title-33/chapter-1/part-1/section-33-1-101/"
    },
    {
     "label": "Healthcare Law Insights (secondary)",
     "url": "https://www.healthcarelawinsights.com/2026/04/tennessee-draws-a-line-new-law-bars-ai-from-posing-as-mental-health-professionals/"
    },
    {
     "label": "Holland & Knight (secondary)",
     "url": "https://www.hklaw.com/en/insights/publications/2026/05/states-continue-efforts-to-regulate-ai-in-healthcare"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan's bill page and its copy of the public chapter. LegiScan's history shows the governor signed the bill April 1, 2026 and that it was published as Public Chapter 647 on April 6, 2026; Healthcare Law Insights (secondary) also gives April 1, while Holland & Knight (secondary) gives April 6, the date the chapter number was assigned. The approval day on the chapter copy is not legible. The act adds T.C.A. 33-1-205 and lists a violation as an unfair or deceptive act in T.C.A. 47-18-104(b); it defines artificial intelligence as models and systems capable of performing functions generally associated with human intelligence, including reasoning and learning, and does not otherwise limit licensed professionals' use of AI. The act does not itself define qualified mental health professional; T.C.A. 33-1-101, whose definitions apply throughout Title 33, does (in Justia's unofficial copy of the 2025 code).",
   "added": "2026-09-29"
  },
  {
   "id": "tn-hb1181-2023",
   "state": "TN",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 1181/SB 73 (Public Chapter 408), Tennessee Information Protection Act",
   "status": "effective",
   "signed": "2023-05-11",
   "effective": "2025-07-01",
   "applies_to": "Businesses with more than $25 million in revenue that process personal information of at least 175,000 Tennessee consumers in a year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from selling it; HIPAA covered entities, business associates and protected health information are exempt",
   "summary": "Gives consumers rights to access, correct, delete and port personal information and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent before processing sensitive data, including a mental or physical health diagnosis, identifying genetic or biometric data and precise geolocation, and requires data protection assessments for that processing.",
   "physician_read": "Since July 1, 2025, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health diagnosis, identifying genetic or biometric data, or precise geolocation. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.",
   "sources": [
    {
     "label": "LegiScan bill page (status, history)",
     "url": "https://legiscan.com/TN/bill/HB1181/2023"
    },
    {
     "label": "Public Chapter 408 (LegiScan copy)",
     "url": "https://legiscan.com/TN/text/HB1181/id/2817357/Tennessee-2023-HB1181-Chaptered.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan's bill page and its copy of the public chapter. The Attorney General enforces it exclusively after a 60-day cure notice; civil penalties reach $7,500 per violation, with treble damages for willful or knowing violations, and there is no private right of action. A written privacy program that reasonably conforms to the NIST privacy framework is an affirmative defense.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-tdlr-16tac121-ai-2026",
   "state": "TX",
   "category": "clinical",
   "also": [
    "mental-health"
   ],
   "kind": "rule",
   "name": "Proposed amendments to 16 TAC Chapter 121, Behavior Analysts, including new Sec. 121.100, License Holder Responsibilities Related to the Use of AIs",
   "status": "introduced",
   "signed": "2026-06-19",
   "effective": "",
   "applies_to": "Behavior analysis license holders regulated by the Texas Department of Licensing and Regulation",
   "summary": "Would bar a license holder from using AI as the sole basis for a client treatment design, assessment, treatment implementation, report or treatment plan evaluation, require individual review of any of these generated in whole or in part by AI, require the license holder, when AI-generated material recommends restrictive or punishment-based procedures, to personally ensure that less intrusive means will not work and that the benefit outweighs the risk of harm and to document the rationale, require AI-derived changes to rest on evidence the license holder personally verified and to be explained to the client in understandable language, and require written client consent before using the client's data for AI in client services, to train AI or for research.",
   "physician_read": "It places no duty on physicians. If adopted, licensed behavior analysts could not rely on AI alone for a client's treatment design, assessment, report or plan evaluation and would need written client consent before using client data with AI.",
   "sources": [
    {
     "label": "Texas Register, June 19, 2026, proposed rules",
     "url": "https://www.sos.texas.gov/texreg/archive/June192026/Proposed%20Rules/16.ECONOMIC%20REGULATION.html"
    },
    {
     "label": "TDLR proposal summary",
     "url": "https://www.tdlr.texas.gov/news/rulemaking/2026/06/09/summary-of-proposed-rule-changes-and-request-for-comments-and-information-11/"
    },
    {
     "label": "Texas Register archive, issues of July 3 to Sept. 25, 2026 (no adoption found)",
     "url": "https://www.sos.texas.gov/texreg/archive/index.shtml"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Published in the Texas Register June 19, 2026 (TRD-202602327), the date used as the signed date. The register notice set comments at 30 days after publication and July 19, 2026 as the earliest possible adoption date; TDLR's summary page gave a comment deadline of July 20, 2026. No adoption or withdrawal of the Chapter 121 proposal appears in the tables of contents of the Texas Register issues of July 3 through Sept. 25, 2026, checked Sept. 29, 2026; TDLR's own rules pages could not be opened. Proposed Sec. 121.100(d) would also bar using AI to create a treatment design, assessment or treatment implementation outside the license holder's training, competence and scope. The consent requirement is in proposed Sec. 121.75(b)(12). The proposal defines an AI system by reference to Business and Commerce Code Sec. 551.001(1), added by HB 149.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-hb149-2025",
   "state": "TX",
   "category": "disclosure",
   "also": [
    "clinical",
    "privacy"
   ],
   "kind": "law",
   "name": "HB 149, Texas Responsible Artificial Intelligence Governance Act",
   "status": "effective",
   "signed": "2025-06-22",
   "effective": "2026-01-01",
   "applies_to": "Providers of health care services or treatment that use an AI system (disclosure); anyone developing or deploying AI systems in Texas (prohibited uses); state agencies",
   "summary": "Requires a provider of health care services or treatment that uses an AI system in relation to that service or treatment to give the patient or the patient's personal representative a clear and conspicuous, plain-language disclosure no later than the date the service or treatment is first provided (or as soon as reasonably possible in an emergency), bars developing or deploying an AI system in a manner that intentionally aims to incite or encourage self-harm, including suicide, harm to another person or criminal activity, and amends the state's biometric identifier and data privacy laws for AI.",
   "physician_read": "Since Jan. 1, 2026, a physician or practice that uses an AI system in relation to a patient's service or treatment must disclose it to the patient or personal representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency, and the disclosure may not use a dark pattern. The attorney general enforces the act after a 60-day notice and cure period, and a licensing agency may suspend or revoke a license or impose a fine of up to $100,000 once a violation has been found and the attorney general recommends further action.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/TX/bill/HB149/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/TX/text/HB149/id/3249139"
    },
    {
     "label": "Texas Attorney General, Consumer AI Rights",
     "url": "https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-ai-rights"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan. Business and Commerce Code Sec. 552.051: the general consumer disclosure duty in subsection (b) applies to governmental agencies, and subsection (f) extends it to providers of health care services or treatment, defined as services provided by an individual licensed, registered or certified to provide them. Sec. 552.052 bars AI aimed at inciting self-harm, harm to others or crime. The attorney general has exclusive enforcement authority; there is no private right of action. Civil penalties: $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation. The act also amended the biometric identifier law, Sec. 503.001 (separate entry), and Sec. 541.104 of the Texas Data Privacy and Security Act, adding processor duties for personal data collected, stored and processed by an AI system, and created an AI regulatory sandbox program administered by the Department of Information Resources (Chapter 553) and the Texas Artificial Intelligence Council (Chapter 554).",
   "added": "2026-09-29"
  },
  {
   "id": "tx-sb1188-2025",
   "state": "TX",
   "category": "disclosure",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "SB 1188, Relating to Electronic Health Record Requirements; Authorizing a Civil Penalty",
   "status": "effective",
   "signed": "2025-06-20",
   "effective": "2025-09-01",
   "applies_to": "Health care practitioners who use AI for diagnostic purposes; covered entities, including practitioners, that maintain electronic health records",
   "summary": "Allows a health care practitioner to use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient's medical record, only when acting within the scope of the practitioner's license, when the use is not otherwise restricted by state or federal law, and when the practitioner reviews all records created with AI consistent with Texas Medical Board medical records standards, and requires the practitioner to disclose that use to patients.",
   "physician_read": "Since Sept. 1, 2025, a Texas physician who uses AI for diagnostic purposes, including AI recommendations on diagnosis or treatment based on the medical record, must disclose that use to patients and must review all records created with AI in a manner consistent with Texas Medical Board medical records standards. Since Jan. 1, 2026, electronic health records containing patient information must also be physically maintained in the United States or a U.S. territory.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/TX/bill/SB1188/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/TX/text/SB1188/id/3247564"
    },
    {
     "label": "Texas Medical Board rule changes",
     "url": "https://www.tmb.texas.gov/laws-rules/rule-changes"
    },
    {
     "label": "Texas Medical Association (secondary)",
     "url": "https://www.texmed.org/Template.aspx?id=66759"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan. New Health and Safety Code Sec. 183.005. The act does not define artificial intelligence and does not say when or in what form the disclosure must be made. New Chapter 183 applies to records prepared on or after Sept. 1, 2025; the U.S. storage requirement (Sec. 183.002) applies to storage on or after Jan. 1, 2026, whenever the record was prepared. The attorney general may seek civil penalties of up to $5,000 per violation per year for negligent violations, $25,000 for knowing or intentional violations and $250,000 for violations in which protected health information is knowingly or intentionally used for financial gain (Sec. 183.011), and a licensing agency may take disciplinary action, including suspension or revocation of a license, against a covered entity that violates the chapter three or more times (Sec. 183.010). The Texas Medical Board's rule-changes page, checked Sept. 29, 2026, listed one pending proposal (office-based ketamine therapy) and adopted rule changes effective Jan. 8 and Sept. 3, 2026, none of which addresses AI or records created with AI.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-sb815-2025",
   "state": "TX",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 815, Relating to the Use of Certain Automated Systems in, and Certain Adverse Determinations Made in Connection With, the Health Benefit Claims Process",
   "status": "effective",
   "signed": "2025-06-20",
   "effective": "2026-01-01",
   "applies_to": "Utilization review agents conducting utilization review for health benefit plans under Texas Insurance Code Chapter 4201",
   "summary": "Bars a utilization review agent from using an automated decision system to make, wholly or partly, an adverse determination, lets the insurance commissioner audit and inspect its use of such systems at any time, allows algorithms and AI for administrative support or fraud detection, and requires an adverse determination notice to state the principal reasons, the clinical basis, and a description and the source of the screening criteria and review procedures used.",
   "physician_read": "For utilization review of health benefit plans delivered, issued or renewed on or after Jan. 1, 2026, an adverse determination cannot be made, wholly or partly, by an automated decision system, and the adverse determination notice must give the principal reasons, the clinical basis and the source of the screening criteria used. It places no duty on physicians.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/TX/bill/SB815/2025"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/TX/text/SB815/id/3245515"
    },
    {
     "label": "TDI Bulletin B-0012-25, 2025 insurance legislation",
     "url": "https://www.tdi.texas.gov/bulletins/2025/b-0012-25.html"
    },
    {
     "label": "TDI proposed rules implementing SB 815 (28 TAC Chapter 19)",
     "url": "https://www.tdi.texas.gov/rules/2026/documents/191006proposal.pdf"
    },
    {
     "label": "TDI 2026 proposed and adopted rules",
     "url": "https://www.tdi.texas.gov/rules/2026/index.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan's bill page and enrolled text. Signed June 20, 2025; the act took effect Sept. 1, 2025 (SECTION 5), but under SECTION 4 it applies only to utilization review for health benefit plans delivered, issued for delivery or renewed on or after Jan. 1, 2026, so plans come under it as they renew. New Insurance Code Sec. 4201.156; SECTION 1 defines an automated decision system as an algorithm, including one incorporating an AI system, that uses data-based analytics to make, suggest or recommend determinations, decisions, judgments or conclusions; SECTION 3 amends Sec. 4201.303(a) on the content of adverse determination notices. The Texas Department of Insurance has proposed rules to implement the act (amendments to 28 TAC Secs. 19.1705(d), 19.1709(c), 19.2005(d) and 19.2009(b)), filed May 1, 2026 and published May 15, 2026, with comments due June 17, 2026; proposed Sec. 19.1705(d) would provide that, consistent with Sec. 4201.156, adverse determinations may only be determined by an appropriate physician, doctor or other health care provider with appropriate credentials. TDI's 2026 rules page showed no adoption filed on Sept. 29, 2026. TDI Bulletin B-0003-26 (June 12, 2026) restates that Chapter 4201 prohibits using AI to make an adverse determination.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-tdi-b-0003-26-2026",
   "state": "TX",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Commissioner's Bulletin No. B-0003-26, Use of Artificial Intelligence",
   "status": "effective",
   "signed": "2026-06-12",
   "effective": "2026-06-12",
   "applies_to": "All entities the Texas Department of Insurance regulates, including insurers and utilization review agents, and their agents and representatives",
   "summary": "States that decisions or actions affecting consumers that are made or supported by AI must comply with all applicable insurance laws, that the department expects a person to review and agree with every consequential decision a regulated entity makes with AI before action is taken, that entities should adopt controls to mitigate the risk of adverse consumer outcomes, and that Insurance Code Chapter 4201 prohibits using AI to make a utilization review adverse determination.",
   "physician_read": "It places no duty on physicians. Since June 12, 2026, the department has said it expects insurers and other regulated entities to have a person review and agree with any consequential decision made with AI before acting on it, and to be ready to answer inquiries on AI governance, risk management and internal controls.",
   "sources": [
    {
     "label": "TDI Bulletin B-0003-26",
     "url": "https://tdi.texas.gov/bulletins/2026/b-0003-26.html"
    },
    {
     "label": "NAIC AI Model Bulletin adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    },
    {
     "label": "TDI Bulletin B-0036-20 (cited on the NAIC map)",
     "url": "https://tdi.texas.gov/bulletins/2020/b-0036-20.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Texas has not adopted the NAIC Model Bulletin; this bulletin recognizes the NAIC's 2020 Principles on Artificial Intelligence as an appropriate guide, recommends the Department of Information Resources' AI Code of Ethics and Minimum Standards, and cites Insurance Code Chapters 541, 542, 544, 4201 and 831, among others. It does not define 'consequential decision.' The NAIC map dated Aug. 31, 2026 lists Texas under insurance-specific guidance but cites an earlier bulletin, B-0036-20 (Sept. 30, 2020), which reminds regulated entities that they are responsible for the accuracy of data used in rating, underwriting and claims handling, including data supplied by third parties, and does not mention AI. The bulletin page shows a last revision on July 16, 2026.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-cubi-2007",
   "state": "TX",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "Capture or Use of Biometric Identifier Act, Business and Commerce Code Sec. 503.001",
   "status": "effective",
   "signed": "",
   "effective": "2009-04-01",
   "applies_to": "Any person who captures or possesses a biometric identifier of an individual for a commercial purpose",
   "summary": "Bars capturing a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose without first informing the individual and receiving consent, limits sale, lease or disclosure, requires reasonable care in storage and destruction within a reasonable time and no later than one year after the purpose expires, and, since Jan. 1, 2026, does not apply to training, processing or storing biometric identifiers to develop or offer AI unless the system is used or deployed to uniquely identify a specific individual.",
   "physician_read": "A practice that captures a patient's or employee's fingerprint, face geometry, voiceprint or iris scan for a commercial purpose must inform the person and receive consent first, may not sell or disclose it except in listed cases, and must destroy it no later than one year after the purpose for collecting it expires. The attorney general may seek a civil penalty of up to $25,000 per violation.",
   "sources": [
    {
     "label": "Texas Attorney General, CUBI page",
     "url": "https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/biometric-identifier-act"
    },
    {
     "label": "HB 149 enrolled text, 2025 amendments (LegiScan)",
     "url": "https://legiscan.com/TX/text/HB149/id/3249139"
    },
    {
     "label": "Statute text and history, Justia (secondary)",
     "url": "https://law.justia.com/codes/texas/2024/business-and-commerce-code/title-11/subtitle-a/chapter-503/section-503-001/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Per the section's history note (as reproduced by Justia), Sec. 503.001 was added by Acts 2007, 80th Leg., ch. 885 (HB 2278), effective April 1, 2009, the date used, and amended in 2009 (HB 3186, effective Sept. 1, 2009) and 2017 (SB 1343, effective Sept. 1, 2017); an earlier origin of the statute could not be confirmed, so the signing date is left empty. HB 149 (2025) amended it effective Jan. 1, 2026: an individual is not considered informed or to have consented based solely on an image or other media on the internet or another publicly available source unless the individual made it public; the section does not apply to training, processing or storing biometric identifiers to develop, train, evaluate, disseminate or offer AI unless a system is used or deployed to uniquely identify a specific individual, or to developing or deploying AI to prevent, detect or respond to security incidents, identity theft, fraud, harassment or other illegal activity; and an identifier captured to train AI and later used for another commercial purpose becomes subject to the section's possession, destruction and penalty provisions. The attorney general has exclusive enforcement authority. The Justia text predates the 2025 amendments.",
   "added": "2026-09-29"
  },
  {
   "id": "tx-hb4-2023",
   "state": "TX",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 4, Texas Data Privacy and Security Act",
   "status": "effective",
   "signed": "2023-06-18",
   "effective": "2024-07-01",
   "applies_to": "Businesses that operate in Texas or sell products or services consumed by Texas residents, process or sell personal data and are not small businesses under Small Business Administration definitions; HIPAA covered entities and business associates are exempt",
   "summary": "Gives consumers rights to access, correct, delete and port personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent to process sensitive data, including data revealing a mental or physical health diagnosis and biometric data used to identify a person, and requires data protection assessments for sensitive data and risky profiling.",
   "physician_read": "The act exempts HIPAA covered entities, business associates and protected health information, so it places no duty on a physician practice acting as a covered entity. It has governed health and wellness apps and other businesses outside HIPAA since July 1, 2024, requiring the consumer's consent before they process data revealing a health diagnosis or biometric data used to identify a person.",
   "sources": [
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/TX/bill/HB4/2023"
    },
    {
     "label": "Enrolled text (LegiScan)",
     "url": "https://legiscan.com/TX/text/HB4/id/2820201"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Status, dates and text come from LegiScan. Business and Commerce Code Chapter 541. The act took effect July 1, 2024; Sec. 541.055(e), on universal opt-out mechanisms, took effect Jan. 1, 2025. Small businesses may not sell sensitive personal data without the consumer's prior consent (Sec. 541.107). The attorney general has exclusive enforcement authority after a 30-day notice and cure period. HB 149 (2025) amended Sec. 541.104, effective Jan. 1, 2026, to require processors to help controllers secure personal data collected, stored and processed by an AI system.",
   "added": "2026-09-29"
  },
  {
   "id": "us-45cfr92-210-2024",
   "state": "US",
   "category": "clinical",
   "also": [],
   "kind": "rule",
   "name": "Nondiscrimination in Health Programs and Activities, final rule, 89 FR 37522 (May 6, 2024); 45 CFR 92.210, Nondiscrimination in the use of patient care decision support tools",
   "status": "effective",
   "signed": "2024-05-06",
   "effective": "2025-05-01",
   "applies_to": "Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges",
   "summary": "Bars covered entities from discriminating on the basis of race, color, national origin, sex, age or disability through the use of patient care decision support tools, and requires ongoing reasonable efforts to identify tools that use those characteristics as input variables and to mitigate the risk of discrimination from each such tool.",
   "physician_read": "Since May 1, 2025, a practice or hospital covered by Section 1557 must make ongoing reasonable efforts to identify decision support tools, including AI and clinical algorithms, that use race, color, national origin, sex, age or disability as inputs and to mitigate the risk of discrimination from each. The ban on discriminating through such tools has applied since July 5, 2024.",
   "sources": [
    {
     "label": "eCFR, 45 CFR 92.210",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-92/subpart-C/section-92.210"
    },
    {
     "label": "eCFR, 45 CFR 92.1 (dates)",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-92/subpart-A/section-92.1"
    },
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2024/05/06/2024-08711/nondiscrimination-in-health-programs-and-activities"
    },
    {
     "label": "HHS notice of vacatur, June 2, 2026",
     "url": "https://www.federalregister.gov/documents/2026/06/02/2026-11015/notice-of-vacatur-regarding-certain-provisions-of-the-2024-nondiscrimination-in-health-programs-and"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The rule took effect July 5, 2024; 45 CFR 92.1 sets compliance with paragraphs (b) and (c) within 300 days of that date (May 1, 2025). On Oct. 22, 2025, a federal court in Tennessee v. Kennedy (S.D. Miss.) vacated the rule's provisions that extend sex discrimination to gender identity; HHS's notice (91 FR 32887, June 2, 2026) lists the vacated sections, does not list 92.210 and says the rule's other provisions remain in force. No HHS proposal to rescind or stop enforcing 92.210 was found in the Federal Register.",
   "added": "2026-09-29"
  },
  {
   "id": "us-astp-hti5-2025",
   "state": "US",
   "category": "clinical",
   "also": [
    "disclosure"
   ],
   "kind": "rule",
   "name": "Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity (HTI-5), proposed rule, 90 FR 60970 (Dec. 29, 2025), RIN 0955-AA09",
   "status": "introduced",
   "signed": "2025-12-29",
   "effective": "",
   "applies_to": "Developers of certified health IT",
   "summary": "Proposes to remove or revise many certification criteria, including narrowing the decision support interventions criterion to fully remove the artificial intelligence 'model card' requirements; comments closed Feb. 27, 2026.",
   "physician_read": "It binds no one yet. If finalized, certified EHRs would no longer have to support source-attribute information on predictive decision support tools, though they would still support evidence-based and predictive tools, according to a law firm summary.",
   "sources": [
    {
     "label": "Proposed rule",
     "url": "https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity"
    },
    {
     "label": "ASTP/ONC fact sheet",
     "url": "https://www.healthit.gov/topic/laws-regulation-and-policy/hti-5-proposed-rule-fact-sheet"
    },
    {
     "label": "Reed Smith (secondary)",
     "url": "https://www.reedsmith.com/our-insights/blogs/health-industry-washington-watch/102m1ob/hti-5-proposal-signals-health-it-deregulation-and-fhir-first-interoperability-and/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "ASTP/ONC's fact sheet (updated June 26, 2026) still describes it as a proposed rule, and the Federal Register lists no final rule under RIN 0955-AA09.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ocr-ai-dcl-2025",
   "state": "US",
   "category": "clinical",
   "also": [
    "disclosure"
   ],
   "kind": "guidance",
   "name": "HHS Office for Civil Rights, Dear Colleague letter: Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies (Jan. 10, 2025)",
   "status": "effective",
   "signed": "2025-01-10",
   "effective": "2025-01-10",
   "applies_to": "Covered entities under Section 1557 that use patient care decision support tools",
   "summary": "Explains 45 CFR 92.210, lists steps covered entities may take to identify and mitigate discrimination risk from decision support tools, including AI, and says OCR will judge reasonable efforts case by case, considering factors such as the entity's size and resources, the information available when the tool was used, and whether the tool was used as its developer intended.",
   "physician_read": "It adds no duty beyond 45 CFR 92.210. Its examples of mitigation include written policies, monitoring, human review of a tool's decisions, staff training, real-world audits and disclosing to patients the use of tools identified as posing a risk of discrimination, and it says OCR weighs an entity's size and resources.",
   "sources": [
    {
     "label": "Letter (copy hosted by a third party, ISMG; not found on hhs.gov)",
     "url": "https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/asset_files/external/hhs-ocr-dear-colleagues-letter-re-ai-non-discrimination-1-10-25.pdf"
    },
    {
     "label": "HHS notice rescinding four guidance documents, May 14, 2025",
     "url": "https://www.federalregister.gov/documents/2025/05/14/2025-08393/notification-of-hhs-documents-identified-for-rescission"
    },
    {
     "label": "HHS Office for Civil Rights newsroom (links releases through Jan. 19, 2025 to HHS's archive)",
     "url": "https://www.hhs.gov/civil-rights/newsroom/index.html"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by then-OCR Director Melanie Fontes Rainer. The letter was read from a copy hosted by a third party; no copy was found on hhs.gov. The hhs.gov address of HHS's Jan. 10, 2025 blog post on the subject (hhs.gov/blog/2025/01/10/ensuring-nondiscrimination-use-ai-good-medicine.html) now redirects to HHS's web archive hosted by PageFreezer, which was not opened, and OCR's newsroom sends readers to that archive for releases through Jan. 19, 2025. No notice rescinding the letter was found in the Federal Register; HHS's May 14, 2025 notice rescinding four guidance documents (90 FR 20393) does not include it. OCR's current view of the letter could not be confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "us-onc-hti1-2023",
   "state": "US",
   "category": "clinical",
   "also": [
    "disclosure"
   ],
   "kind": "rule",
   "name": "Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1), final rule, 89 FR 1192 (Jan. 9, 2024), RIN 0955-AA03; 45 CFR 170.315(b)(11), Decision support interventions",
   "status": "effective",
   "signed": "2024-01-09",
   "effective": "2025-01-01",
   "applies_to": "Developers of health IT certified under the ONC Health IT Certification Program",
   "summary": "Replaced the clinical decision support certification criterion with a decision support interventions criterion that requires certified health IT to support source attributes, a standard set of information about evidence-based and predictive decision support tools, and requires developers that supply predictive tools to apply intervention risk management practices and keep that information current.",
   "physician_read": "It places no duty on physicians directly. Since Jan. 1, 2025, only the new criterion counts toward the Base EHR definition, so certified EHRs must support source-attribute information on decision support tools, including predictive tools the EHR developer supplies.",
   "sources": [
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2024/01/09/2023-28857/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and"
    },
    {
     "label": "Correction moving the effective date to March 11, 2024 (89 FR 8546)",
     "url": "https://www.federalregister.gov/documents/2024/02/08/2024-02519/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and"
    },
    {
     "label": "eCFR, 45 CFR 170.315",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-C/section-170.315"
    },
    {
     "label": "eCFR, 45 CFR 170.402",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-D/section-170.402"
    },
    {
     "label": "eCFR, 45 CFR 170.102 (Base EHR definition)",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-A/section-170.102"
    },
    {
     "label": "ASTP/ONC, HTI-1 overview",
     "url": "https://www.healthit.gov/topic/laws-regulation-and-policy/health-data-technology-and-interoperability-certification-program"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The rule was published with an effective date of Feb. 8, 2024, which a correction published that day (89 FR 8546) changed to March 11, 2024. Under 45 CFR 170.402(b)(4), developers must review and update source-attribute and risk management information starting Jan. 1, 2025, and under the Base EHR definition in 45 CFR 170.102 only the decision support interventions criterion counts from Jan. 1, 2025. eCFR, current as of Sept. 24, 2026, still shows 170.315(b)(11) with its source-attribute and risk management requirements. ASTP/ONC's HTI-5 proposed rule (separate entry) would remove the source-attribute ('model card') requirements.",
   "added": "2026-09-29"
  },
  {
   "id": "us-s3062-2025",
   "state": "US",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "S. 3062, Guidelines for User Age-verification and Responsible Dialogue Act of 2026 (GUARD Act), 119th Congress, reported by the Senate Judiciary Committee with an amendment (Calendar No. 406)",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Anyone who makes an AI chatbot publicly available to consumers",
   "summary": "As reported, would require providers of public AI chatbots to verify users' ages and keep minors from AI companions; require every public chatbot to disclose at the start of each conversation that it is AI and not a human and, at the start and at reasonably regular intervals, that it does not provide medical, legal, financial or psychological services; bar chatbots from representing themselves as licensed professionals; make it a federal crime, with fines up to $250,000 per offense, to make available a chatbot knowing or with reckless disregard that it engages minors in sexually explicit conduct or solicits minors to suicide, non-suicidal self-injury, imminent unlawful physical or sexual violence or homicide; and take effect 180 days after enactment.",
   "physician_read": "It binds no one yet. As reported, a public AI chatbot could not represent itself as a licensed professional and would have to tell users at the start of each conversation and at reasonably regular intervals that it does not provide medical, legal, financial or psychological services and that they should consult a licensed professional; minors could not use AI companions.",
   "sources": [
    {
     "label": "LegiScan, bill history",
     "url": "https://legiscan.com/US/bill/SB3062/2025"
    },
    {
     "label": "Text as reported May 11, 2026 (LegiScan copy)",
     "url": "https://legiscan.com/US/text/SB3062/id/3435637/US_Congress-2025-SB3062-Introduced.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced Oct. 28, 2025 by Sen. Josh Hawley. The Judiciary Committee reported it with an amendment in the nature of a substitute on May 11, 2026, and it was placed on the Senate calendar as Calendar No. 406; the summary follows the reported text. The attorney general and state attorneys general could enforce it, with civil penalties up to $250,000 per violation, and it would not affect state laws at least as protective of chatbot users. Status and history are from LegiScan's record of the bill.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fda-ai-dsf-draft-2025",
   "state": "US",
   "category": "devices",
   "also": [
    "disclosure"
   ],
   "kind": "guidance",
   "name": "Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance for Industry and Food and Drug Administration Staff (docket FDA-2024-D-4488), notice of availability, 90 FR 1154 (Jan. 7, 2025)",
   "status": "introduced",
   "signed": "2025-01-07",
   "effective": "",
   "applies_to": "Manufacturers of devices with AI-enabled software functions",
   "summary": "Draft recommendations on what marketing submissions for devices with AI-enabled software functions should contain across the product life cycle, including labeling that states AI is used and explains how, describes performance across subgroups such as sex, age, race and ethnicity, and explains any tools for monitoring performance, with a model card as an option; comments closed April 7, 2025.",
   "physician_read": "It places no duty on physicians and is still a draft. As proposed, the labeling of an AI-enabled device would state that AI is used and explain how, describe performance across patient subgroups and describe any methods or tools for users to monitor performance.",
   "sources": [
    {
     "label": "FDA guidance page",
     "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing"
    },
    {
     "label": "Draft guidance (PDF)",
     "url": "https://www.fda.gov/media/184856/download"
    },
    {
     "label": "Federal Register notice of availability",
     "url": "https://www.federalregister.gov/documents/2025/01/07/2024-31543/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing"
    },
    {
     "label": "FDA, Artificial Intelligence-Enabled Medical Devices",
     "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/artificial-intelligence-enabled-medical-devices"
    }
   ],
   "checked": "2026-09-29",
   "notes": "FDA lists it as a draft on its guidance page and on its AI-enabled medical devices page (current as of Sept. 22, 2026), which also says FDA had authorized more than 1,600 AI-enabled devices as of September 2026. Guidance is nonbinding, even when final.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fda-cds-guidance-2026",
   "state": "US",
   "category": "devices",
   "also": [
    "clinical"
   ],
   "kind": "guidance",
   "name": "Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2017-D-6569), issued Jan. 29, 2026",
   "status": "effective",
   "signed": "2026-01-29",
   "effective": "2026-01-29",
   "applies_to": "Developers of clinical decision support software intended for health care professionals; FDA staff",
   "summary": "Explains how FDA applies the four statutory criteria that exclude some clinical decision support software from device regulation; software intended for a critical, time-sensitive task or decision does not meet the fourth criterion, and FDA intends not to enforce device requirements when software that otherwise meets all four criteria gives a single recommendation because only one option is clinically appropriate.",
   "physician_read": "It places no duty on physicians. Decision support that offers a single recommendation can reach clinicians without FDA device review when only one option is clinically appropriate and the other criteria are met, while software that detects a condition such as stroke or sepsis and alerts a clinician remains a regulated device.",
   "sources": [
    {
     "label": "FDA guidance page",
     "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software"
    },
    {
     "label": "Guidance (PDF)",
     "url": "https://www.fda.gov/media/109618/download"
    },
    {
     "label": "FDA, Recent Final Medical Device Guidance Documents",
     "url": "https://www.fda.gov/medical-devices/guidance-documents-medical-devices-and-radiation-emitting-products/recent-final-medical-device-guidance-documents"
    },
    {
     "label": "Federal Register notice of the Sept. 28, 2022 final guidance",
     "url": "https://www.federalregister.gov/documents/2022/09/28/2022-20993/clinical-decision-support-software-guidance-for-industry-and-food-and-drug-administration-staff"
    },
    {
     "label": "Faegre Drinker (secondary)",
     "url": "https://www.faegredrinker.com/en/insights/publications/2026/1/key-updates-in-fdas-2026-general-wellness-and-clinical-decision-support-software-guidance"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Jan. 29, 2026 document says it supersedes the version issued Jan. 6, 2026 and was revised under FDA's Level 2 procedures to delete a reference to time-critical decision-making on pages 13 and 14, for alignment with the Jan. 6 update; FDA's list of recent final device guidances dates the guidance Jan. 6, 2026. That the Jan. 6, 2026 version replaced FDA's final guidance of Sept. 28, 2022 (same docket) rests on a law firm alert; FDA's own documents do not say what it replaced. Guidance is nonbinding.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fda-general-wellness-2026",
   "state": "US",
   "category": "devices",
   "also": [],
   "kind": "guidance",
   "name": "General Wellness: Policy for Low Risk Devices: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2014-N-1039), issued Jan. 6, 2026",
   "status": "effective",
   "signed": "2026-01-06",
   "effective": "2026-01-06",
   "applies_to": "Makers of low-risk wellness products, including apps and wearables",
   "summary": "Describes the low-risk products intended only for general wellness that FDA does not intend to regulate as devices, and says products using non-invasive sensing to estimate values such as blood pressure, oxygen saturation, blood glucose or heart rate variability can qualify when intended solely for wellness uses, but not if they reference specific diseases or diagnostic thresholds, prompt specific clinical action, or claim clinical accuracy or medical grade.",
   "physician_read": "It places no duty on physicians. Patients may bring blood pressure, oxygen saturation or glucose estimates from wearables sold as wellness products outside FDA device review, which may not claim clinical accuracy or medical grade.",
   "sources": [
    {
     "label": "FDA guidance page",
     "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/general-wellness-policy-low-risk-devices"
    },
    {
     "label": "Guidance (PDF)",
     "url": "https://www.fda.gov/media/90652/download"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Supersedes the version issued Sept. 27, 2019. Guidance is nonbinding.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fda-pccp-guidance-2024",
   "state": "US",
   "category": "devices",
   "also": [
    "disclosure"
   ],
   "kind": "guidance",
   "name": "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2022-D-2628)",
   "status": "effective",
   "signed": "2024-12-04",
   "effective": "2024-12-04",
   "applies_to": "Manufacturers of AI-enabled devices submitting 510(k), De Novo or premarket approval applications",
   "summary": "Recommends that a predetermined change control plan for an AI-enabled device describe the planned modifications, the methods to develop, validate and implement them, and an assessment of their impact, and that the labeling tell users that the device incorporates machine learning and has an authorized plan.",
   "physician_read": "It places no duty on physicians. Under an authorized plan, software updates may change an AI device's performance, its inputs or certain aspects of its use, within its intended use, without new FDA review, and the labeling should explain that the device incorporates machine learning and has an authorized plan.",
   "sources": [
    {
     "label": "FDA guidance page",
     "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence"
    },
    {
     "label": "Guidance (PDF)",
     "url": "https://www.fda.gov/media/166704/download"
    },
    {
     "label": "Federal Register notice of availability",
     "url": "https://www.federalregister.gov/documents/2024/12/04/2024-28361/marketing-submission-recommendations-for-a-predetermined-change-control-plan-for-artificial"
    }
   ],
   "checked": "2026-09-29",
   "notes": "FDA reissued the guidance on Aug. 18, 2025; the document says it was originally issued Dec. 4, 2024, and FDA's guidance pages now list it as issued in August 2025. The Federal Register notice of availability is 89 FR 96259 (Dec. 4, 2024). The documents opened do not say what changed in the 2025 reissue. Guidance is nonbinding.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fda-tempo-pilot-2025",
   "state": "US",
   "category": "devices",
   "also": [
    "payment"
   ],
   "kind": "policy",
   "name": "FDA, Technology-Enabled Meaningful Patient Outcomes (TEMPO) for Digital Health Devices Pilot, notice, 90 FR 56768 (Dec. 8, 2025)",
   "status": "effective",
   "signed": "2025-12-08",
   "effective": "",
   "applies_to": "Manufacturers of digital health devices, including AI-enabled devices, selected for the pilot, and CMS ACCESS model participants that offer those devices",
   "summary": "A pilot of FDA's device center, linked to the CMS ACCESS model, under which FDA may decline to enforce requirements such as premarket authorization and investigational device exemption requirements for selected manufacturers' digital health devices, including AI-enabled devices, when offered to or by ACCESS participants, in return for risk mitigation and collection and reporting of real-world performance data.",
   "physician_read": "It places no duty on physicians. Patients in the ACCESS model may be offered devices from the first four selected manufacturers (SonderMind, Limbic, Cadence Solutions and Dexcom) for which FDA does not intend to enforce premarket authorization requirements in that setting.",
   "sources": [
    {
     "label": "Federal Register notice",
     "url": "https://www.federalregister.gov/documents/2025/12/08/2025-22190/technology-enabled-meaningful-patient-outcomes-tempo-for-digital-health-devices-pilot"
    },
    {
     "label": "FDA, participants selected",
     "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/participants-selected-tempo-digital-health-devices-pilot"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Docket FDA-2025-N-6461. FDA said it expected to select up to about 10 U.S. manufacturers in each of four clinical areas (early cardio-kidney-metabolic, cardio-kidney-metabolic, musculoskeletal pain and behavioral health) and began accepting statements of interest Jan. 2, 2026. Its participants page (current as of Aug. 21, 2026) lists four manufacturers: SonderMind and Limbic (behavioral health), Cadence Solutions (early cardio-kidney-metabolic) and Dexcom (early cardio-kidney-metabolic and cardio-kidney-metabolic), and says FDA will update the list as more are selected. The notice sets no end date.",
   "added": "2026-09-29"
  },
  {
   "id": "us-fdora-515c-2022",
   "state": "US",
   "category": "devices",
   "also": [],
   "kind": "law",
   "name": "Food and Drug Omnibus Reform Act of 2022 (Consolidated Appropriations Act, 2023, Pub. L. 117-328, div. FF, title III, sec. 3308(a)), adding section 515C of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360e-4), Predetermined change control plans for devices",
   "status": "effective",
   "signed": "2022-12-29",
   "effective": "2022-12-29",
   "applies_to": "Manufacturers seeking premarket approval or 510(k) clearance of devices, including AI-enabled devices",
   "summary": "Lets FDA approve, in a premarket approval application or supplement, or clear, in a 510(k) notification, a predetermined change control plan describing planned changes to a device if the device remains safe and effective without the changes and, for a cleared device, would remain substantially equivalent to its predicate; changes consistent with an authorized plan then need no new premarket approval supplement or 510(k) notification.",
   "physician_read": "It places no duty on physicians. A device with an authorized plan, such as an AI device, can be changed after purchase as the plan describes without a new FDA submission.",
   "sources": [
    {
     "label": "21 U.S.C. 360e-4",
     "url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360e-4&num=0&edition=prelim"
    },
    {
     "label": "FDA draft guidance, Predetermined Change Control Plans for Medical Devices",
     "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-medical-devices"
    },
    {
     "label": "Gozlon-Peretz v. United States, 498 U.S. 395 (1991) (default effective date)",
     "url": "https://www.law.cornell.edu/supremecourt/text/498/395"
    }
   ],
   "checked": "2026-09-29",
   "notes": "FDA's final guidance on plans for AI-enabled device software functions is a separate entry. Its general draft guidance, Predetermined Change Control Plans for Medical Devices (August 2024, docket FDA-2024-D-2338), is still listed as a draft on FDA's guidance page. The U.S. Code shows no effective-date note for the section; under Gozlon-Peretz v. United States, 498 U.S. 395 (1991), a federal law takes effect on enactment absent a clear direction from Congress to the contrary.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ffdca-520o-2016",
   "state": "US",
   "category": "devices",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "21st Century Cures Act, Pub. L. 114-255, div. A, title III, sec. 3060(a), adding section 520(o) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360j(o)), software functions excluded from the device definition",
   "status": "effective",
   "signed": "2016-12-13",
   "effective": "2016-12-13",
   "applies_to": "Developers and manufacturers of health software; sets which software functions FDA regulates as medical devices",
   "summary": "Removes five kinds of software functions from the device definition: administrative support of a health care facility, general wellness, electronic patient records, transfer or display of laboratory and device data, and clinical decision support that does not acquire, process or analyze a medical image or signal, displays or analyzes medical information, supports or provides recommendations to a health care professional, and lets that professional independently review the basis for the recommendations instead of relying primarily on them.",
   "physician_read": "It places no duty on physicians. It decides whether a decision support tool a physician uses is an FDA-regulated device: software that analyzes medical images or signals, or whose basis the clinician cannot independently review, remains a device.",
   "sources": [
    {
     "label": "21 U.S.C. 360j(o)",
     "url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360j&num=0&edition=prelim"
    },
    {
     "label": "Gozlon-Peretz v. United States, 498 U.S. 395 (1991) (default effective date)",
     "url": "https://www.law.cornell.edu/supremecourt/text/498/395"
    }
   ],
   "checked": "2026-09-29",
   "notes": "FDA explains how it applies the clinical decision support exclusion in its clinical decision support software guidance and the wellness exclusion in its general wellness guidance, both revised in January 2026 (separate entries). The U.S. Code shows no effective-date provision for subsection (o); under Gozlon-Peretz v. United States, 498 U.S. 395 (1991), a federal law takes effect on enactment absent a clear direction from Congress to the contrary.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ai-action-plan-2025",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "policy",
   "name": "Winning the Race: America's AI Action Plan (White House, July 2025)",
   "status": "effective",
   "signed": "2025-07-23",
   "effective": "2025-07-23",
   "applies_to": "Federal agencies",
   "summary": "Identifies more than 90 federal policy actions across three pillars (accelerating innovation, building American AI infrastructure, and leading in international diplomacy and security), including a recommendation that agencies with AI-related discretionary funding consider a state's AI regulatory climate in funding decisions.",
   "physician_read": "It places no duty on physicians. It names health care among sectors slow to adopt AI and recommends regulatory sandboxes or AI Centers of Excellence enabled by agencies such as FDA, and NIST-led standards work in fields including health care.",
   "sources": [
    {
     "label": "Plan (PDF)",
     "url": "https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf"
    },
    {
     "label": "White House announcement",
     "url": "https://www.whitehouse.gov/articles/2025/07/white-house-unveils-americas-ai-action-plan/"
    },
    {
     "label": "AI.gov",
     "url": "https://www.ai.gov/action-plan"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Released July 23, 2025 under Executive Order 14179, according to the White House announcement, which calls it 'Winning the AI Race: America's AI Action Plan'; the plan's cover reads 'Winning the Race: America's AI Action Plan.' Its health care references are in the section on AI adoption.",
   "added": "2026-09-29"
  },
  {
   "id": "us-eo-14179-2025",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "order",
   "name": "Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, 90 FR 8741 (Jan. 31, 2025)",
   "status": "effective",
   "signed": "2025-01-23",
   "effective": "2025-01-23",
   "applies_to": "Federal agencies, including HHS, FDA and CMS",
   "summary": "Sets a policy to sustain and enhance U.S. global AI dominance, directs an immediate review of actions taken under the revoked Executive Order 14110 so agencies can suspend, revise or rescind those that conflict with that policy, orders an AI action plan within 180 days, and directs OMB to revise its AI memoranda M-24-10 and M-24-18 within 60 days.",
   "physician_read": "It places no duty on physicians. It led to America's AI Action Plan and to OMB's April 2025 memoranda on federal agencies' own use and acquisition of AI, including at HHS.",
   "sources": [
    {
     "label": "Federal Register",
     "url": "https://www.federalregister.gov/documents/2025/01/31/2025-02172/removing-barriers-to-american-leadership-in-artificial-intelligence"
    },
    {
     "label": "Executive Order 14148 (revoking EO 14110)",
     "url": "https://www.federalregister.gov/documents/2025/01/28/2025-01901/initial-rescissions-of-harmful-executive-orders-and-actions"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Executive Order 14110 of Oct. 30, 2023 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence) was revoked by Executive Order 14148 on Jan. 20, 2025 (90 FR 8237).",
   "added": "2026-09-29"
  },
  {
   "id": "us-eo-14355-2025",
   "state": "US",
   "category": "general",
   "also": [
    "privacy"
   ],
   "kind": "order",
   "name": "Executive Order 14355, Unlocking Cures for Pediatric Cancer With Artificial Intelligence, 90 FR 48153 (Oct. 7, 2025)",
   "status": "effective",
   "signed": "2025-09-30",
   "effective": "2025-09-30",
   "applies_to": "The Make America Healthy Again Commission and HHS",
   "summary": "Directs the MAHA Commission, with HHS and others, to find ways to use AI to improve pediatric cancer data infrastructure, data analysis and clinical trial design, access and outcomes and to identify and carry out strategies to increase investment from existing federal funds in the Childhood Cancer Data Initiative, and directs HHS to work to integrate AI into its interoperability work while ensuring that patients and parents control their health information and to work to finalize interoperability standards for patient data used with AI.",
   "physician_read": "It places no duty on physicians.",
   "sources": [
    {
     "label": "Federal Register",
     "url": "https://www.federalregister.gov/documents/2025/10/07/2025-19495/unlocking-cures-for-pediatric-cancer-with-artificial-intelligence"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The order sets no deadlines.",
   "added": "2026-09-29"
  },
  {
   "id": "us-eo-14365-2025",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "order",
   "name": "Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, 90 FR 58499 (Dec. 16, 2025)",
   "status": "effective",
   "signed": "2025-12-11",
   "effective": "2025-12-11",
   "applies_to": "Federal agencies (Justice Department, Commerce Department, FCC, FTC); aimed at state AI laws",
   "summary": "Directs the attorney general to set up within 30 days an AI Litigation Task Force to challenge state AI laws inconsistent with the order's policy; the Commerce Department to publish within 90 days an evaluation identifying onerous state AI laws, whose states become ineligible for BEAD non-deployment funds to the extent federal law allows; an FCC proceeding on a federal reporting and disclosure standard; an FTC policy statement on how the FTC Act's ban on unfair and deceptive practices applies to AI; and a legislative recommendation for a federal framework preempting conflicting state AI laws.",
   "physician_read": "It places no duty on physicians. The topics it says the proposed federal preemption should not reach (child safety protections, AI compute and data center infrastructure, state procurement and use of AI, and other topics to be determined) do not name health care.",
   "sources": [
    {
     "label": "Federal Register",
     "url": "https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The FTC proposed the policy statement called for by section 7 on July 1, 2026 (separate entry). A Federal Register search for documents citing the order found no Commerce Department evaluation of state AI laws, BEAD policy notice or FCC proceeding; whether those steps and the Justice Department's task force were carried out elsewhere was not confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ftc-ai-accuracy-policy-2026",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "guidance",
   "name": "FTC, Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems (proposed), 91 FR 41638 (July 7, 2026)",
   "status": "introduced",
   "signed": "2026-07-01",
   "effective": "",
   "applies_to": "Companies that market AI systems; state laws that require changes to AI outputs",
   "summary": "Proposes that the FTC treat as deceptive the marketing of AI systems as accurate while steering their outputs toward objectives other than those set or reasonably expected by users, and says state law is impliedly preempted to the extent it conflicts with section 5 of the FTC Act, including a state law that requires an AI firm to deceive its consumers; comments closed July 31, 2026.",
   "physician_read": "It places no duty on physicians and is still a proposal. It is the policy statement Executive Order 14365 directed the FTC to issue.",
   "sources": [
    {
     "label": "Federal Register",
     "url": "https://www.federalregister.gov/documents/2026/07/07/2026-13628/policy-statement-concerning-the-suppression-of-accuracy-in-artificial-intelligence-systems"
    },
    {
     "label": "FTC legal library",
     "url": "https://www.ftc.gov/legal-library/browse/federal-trade-commissions-proposed-policy-statement-concerning-suppression-accuracy-artificial"
    },
    {
     "label": "Proposed policy statement (PDF)",
     "url": "https://www.ftc.gov/system/files/ftc_gov/pdf/ai-policy-statement_0.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Posted by the FTC July 1, 2026, after a 2-0 Commission vote, and published in the Federal Register July 7, 2026. It discusses Colorado's AI Act as a state law that may require altering AI outputs and notes that clinicians and patients increasingly use AI to help diagnose illness. No final statement was found in the Federal Register.",
   "added": "2026-09-29"
  },
  {
   "id": "us-hhs-ai-strategy-2025",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "policy",
   "name": "HHS Artificial Intelligence (AI) Strategy, version 1.0 (issued Sept. 30, 2025)",
   "status": "effective",
   "signed": "2025-09-30",
   "effective": "2025-09-30",
   "applies_to": "HHS and its operating divisions",
   "summary": "Sets five pillars for HHS's use of AI (governance and risk management for public trust; infrastructure and platforms; workforce development and burden reduction; health research and reproducibility; and modernization of care and public health delivery) and, under the governance pillar, calls for standardized minimum risk practices for high-impact AI, in line with OMB memoranda M-25-21 and M-25-22.",
   "physician_read": "It places no duty on physicians. It commits HHS to promote AI tools for uses such as clinical decision support, early warning, risk stratification and proactive outreach.",
   "sources": [
    {
     "label": "HHS, AI Strategy & Implementation",
     "url": "https://www.hhs.gov/programs/topic-sites/ai/strategy-implementation/index.html"
    },
    {
     "label": "Strategy (PDF)",
     "url": "https://www.hhs.gov/sites/default/files/hhs-artificial-intelligence-strategy.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The document says it was issued Sept. 30, 2025, by Deputy Secretary Jim O'Neill; HHS's strategy page (content last reviewed Dec. 3, 2025) also links HHS's 2025 AI compliance plan. The date HHS first posted the strategy could not be confirmed.",
   "added": "2026-09-29"
  },
  {
   "id": "us-omb-m-25-21-2025",
   "state": "US",
   "category": "general",
   "also": [],
   "kind": "policy",
   "name": "OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (April 3, 2025)",
   "status": "effective",
   "signed": "2025-04-03",
   "effective": "2026-04-03",
   "applies_to": "Federal executive agencies, including HHS, CMS, FDA and other HHS divisions, in their own use of AI",
   "summary": "Rescinds and replaces M-24-10 and requires agencies to designate chief AI officers, publish AI strategies and compliance plans, and, within 365 days, document minimum risk management practices for high-impact AI, which is presumed to include AI serving as a principal basis for agency decisions on the medically relevant functions of medical devices; patient diagnosis, risk assessment or treatment; allocation of care in public insurance; and control of health insurance costs and underwriting.",
   "physician_read": "It places no duty on physicians. HHS agencies' own AI uses that serve as a principal basis for decisions on patient diagnosis or treatment or the allocation of care in public insurance are presumed high-impact and require practices including pre-deployment testing, impact assessments, ongoing monitoring, human oversight and remedies or appeals.",
   "sources": [
    {
     "label": "Memorandum (PDF)",
     "url": "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"
    },
    {
     "label": "OMB Memorandum M-25-22 (PDF)",
     "url": "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by OMB Director Russell T. Vought. Agencies had 365 days from issuance to document their minimum practices for high-impact AI and must stop using a noncompliant high-impact use; the effective date shown is that deadline. A companion memo, M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025), replaced M-24-18 and governs agencies' purchases of AI; it does not mention health care.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-0057-f-2024",
   "state": "US",
   "category": "payer",
   "also": [],
   "kind": "rule",
   "name": "Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes, final rule (CMS-0057-F), 89 FR 8758 (Feb. 8, 2024), RIN 0938-AU87",
   "status": "effective",
   "signed": "2024-02-08",
   "effective": "2026-01-01",
   "applies_to": "Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges",
   "summary": "Requires impacted payers other than qualified health plan issuers on the federally facilitated Exchanges to decide prior authorization requests for items and services other than drugs within 72 hours for expedited and seven calendar days for standard requests from 2026; requires all impacted payers to give a specific reason for denials from 2026 and to post prior authorization metrics annually starting March 31, 2026; and requires them, beginning in 2027, to run a Prior Authorization API that lists covered items and services, identifies documentation requirements and supports requests and responses.",
   "physician_read": "Since 2026, Medicare Advantage plans and state Medicaid and CHIP programs and their managed care plans must decide prior authorization requests for items and services other than drugs within 72 hours for expedited and seven calendar days for standard requests, and they and federally facilitated Exchange plans must give a specific reason for any denial. Beginning in 2027 (Jan. 1, 2027, or the first rating period or plan year starting on or after that date), these payers must support electronic prior authorization requests and responses through an API.",
   "sources": [
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability"
    },
    {
     "label": "eCFR, 45 CFR 156.223 (Exchange plans)",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-B/part-156/subpart-C/section-156.223"
    },
    {
     "label": "CMS fact sheet",
     "url": "https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f"
    },
    {
     "label": "CMS rule page",
     "url": "https://www.cms.gov/priorities/burden-reduction/overview/interoperability/policies-regulations/cms-interoperability-prior-authorization-final-rule-cms-0057-f"
    },
    {
     "label": "Proposed rule on prior authorization for drugs (CMS-0062-P)",
     "url": "https://www.federalregister.gov/documents/2026/04/14/2026-07205/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-standards"
    },
    {
     "label": "FY 2027 IPPS final rule (adopts updated API standards from CMS-0062-P)",
     "url": "https://www.federalregister.gov/documents/2026/08/04/2026-15833/medicare-program-hospital-inpatient-prospective-payment-systems-for-acute-care-hospitals-ipps-and"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The rule took effect April 8, 2024. The decision timeframes and denial reasons apply from Jan. 1, 2026 for Medicare Advantage and Medicaid and CHIP fee-for-service programs and from the rating period beginning on or after that date for Medicaid and CHIP managed care; Exchange plan issuers must give denial reasons beginning Jan. 1, 2026 (45 CFR 156.223(a)). The Prior Authorization API is due Jan. 1, 2027 for Medicare Advantage and fee-for-service programs, by the rating period beginning on or after Jan. 1, 2027 for managed care and for plan years beginning on or after Jan. 1, 2027 for Exchange plans. The rule's policies do not apply to drugs, and it sets no AI-specific requirement; a Federal Register text search finds AI only in a commenter's suggestion that prior authorization data include the software or AI tools used. A proposed rule, CMS-0062-P (91 FR 19890, April 14, 2026), would extend the requirements to drugs; comments closed June 15, 2026. The FY 2027 IPPS final rule (91 FR 49570, Aug. 4, 2026; docket CMS-0062-F) adopted updated versions of certain API standards proposed in CMS-0062-P and says comments on the other CMS-0062-P proposals are still being reviewed. CMS's rule page (modified Aug. 31, 2026) notes that on Feb. 28, 2024 its National Standards Group said it would not take HIPAA enforcement action against covered entities that do not use the X12 278 standard as part of an electronic FHIR prior authorization process.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-4201-f-2023",
   "state": "US",
   "category": "payer",
   "also": [],
   "kind": "rule",
   "name": "Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly, final rule (CMS-4201-F), 88 FR 22120 (April 12, 2023), RIN 0938-AU96; 42 CFR 422.101(b)(6) and (c)(1) and 422.566(d)",
   "status": "effective",
   "signed": "2023-04-12",
   "effective": "2024-01-01",
   "applies_to": "Medicare Advantage organizations",
   "summary": "Requires Medicare Advantage plans to base medical necessity determinations on Medicare coverage criteria and the enrollee's own circumstances, including medical history, physician recommendations and clinical notes; allows internal coverage criteria only when Medicare criteria are not fully established, if publicly accessible and based on current evidence; and requires a physician or other appropriate health care professional with expertise in the field of medicine or health care appropriate for the services at issue to review a partly or fully adverse medical necessity decision before it is issued.",
   "physician_read": "Since Jan. 1, 2024, a Medicare Advantage plan must base a medical necessity decision on Medicare's coverage rules and the patient's own medical history, the physician's recommendations and clinical notes, and a physician or other health care professional with expertise appropriate to the service must review a partly or fully adverse decision before the plan issues it. CMS's Feb. 6, 2024 FAQ (separate entry) applies these rules to algorithms and AI.",
   "sources": [
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2023/04/12/2023-07115/medicare-program-contract-year-2024-policy-and-technical-changes-to-the-medicare-advantage-program"
    },
    {
     "label": "eCFR, 42 CFR 422.101",
     "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-422/subpart-B/section-422.101"
    },
    {
     "label": "eCFR, 42 CFR 422.566",
     "url": "https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-422/subpart-M/section-422.566"
    },
    {
     "label": "CY 2026 final rule (AI guardrails not finalized)",
     "url": "https://www.federalregister.gov/documents/2025/04/15/2025-06008/medicare-and-medicaid-programs-contract-year-2026-policy-and-technical-changes-to-the-medicare"
    },
    {
     "label": "CY 2027 final rule",
     "url": "https://www.federalregister.gov/documents/2026/04/06/2026-06600/medicare-program-contract-year-2027-and-certain-contract-year-2026-policy-and-technical-changes-to"
    },
    {
     "label": "CMS fact sheet on the CY 2027 final rule",
     "url": "https://www.cms.gov/newsroom/fact-sheets/contract-year-2027-medicare-advantage-part-d-final-rule"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The rule took effect June 5, 2023; its DATES section says the provisions apply to coverage beginning Jan. 1, 2024. Its amendment to 422.566(d) concerns review of adverse medical necessity decisions by a physician or other health care professional with expertise in the field of medicine appropriate to the requested service; the regulation says the reviewer need not, in all cases, share the treating physician's specialty or subspecialty. In the CY 2026 final rule (CMS-4208-F, 90 FR 15792, April 15, 2025), CMS did not finalize its proposed 'Guardrails for Artificial Intelligence' provision and said it will continue to consider future rulemaking in this area. The CY 2027 final rule (CMS-4208-F3/CMS-4212-F, 91 FR 17384, April 6, 2026) amended 422.101 to add an off-cycle model of care submission window; the current eCFR text of 422.101(b)(6) and (c)(1) matches this entry, and CMS's fact sheet on that rule does not mention AI.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-ma-ai-faq-2024",
   "state": "US",
   "category": "payer",
   "also": [],
   "kind": "guidance",
   "name": "CMS, Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F), HPMS memo, Feb. 6, 2024",
   "status": "effective",
   "signed": "2024-02-06",
   "effective": "2024-02-06",
   "applies_to": "Medicare Advantage organizations and Medicare-Medicaid Plans",
   "summary": "Says an algorithm or software tool can assist Medicare Advantage plans in coverage determinations but the plan must ensure the determination follows the coverage rules; that a tool deciding coverage from a larger data set instead of the patient's own history would not comply; that algorithms or AI alone cannot be the basis to deny admission or downgrade to an observation stay, and a predicted length of stay alone cannot be the basis to end post-acute care; that AI cannot be used to shift coverage criteria over time; and that plans should make sure a tool does not perpetuate or introduce bias before using it.",
   "physician_read": "Under CMS's Feb. 6, 2024 FAQ, a Medicare Advantage plan may use an algorithm to assist a coverage decision, but the decision must rest on the patient's individual circumstances. AI alone cannot be the basis to deny an inpatient admission or downgrade it to observation, and an algorithm's predicted length of stay alone cannot be the basis to end post-acute care.",
   "sources": [
    {
     "label": "FAQ memo (copy hosted by the American Hospital Association)",
     "url": "https://www.aha.org/system/files/media/file/2024/02/faqs-related-to-coverage-criteria-and-utilization-management-requirements-in-cms-final-rule-cms-4201-f.pdf"
    },
    {
     "label": "CMS HPMS memos, week of Feb. 5-9, 2024",
     "url": "https://www.cms.gov/about-cms/information-systems/hpms/hpms-memos-archive-weekly/hpms-memos-wk-2-february-5-9"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The memo, on CMS letterhead, is addressed to all Medicare Advantage organizations and Medicare-Medicaid Plans. CMS posts that week's HPMS memos only as a ZIP file, so the text was read from a copy hosted by the American Hospital Association; CMS's HPMS archive page still lists that week's memos. A separate answer in the memo says that if a plan expects to issue a partly or fully adverse medical necessity decision, a physician or other appropriate health care professional must review it before it is issued (42 CFR 422.566(d)). The memo also cites Section 1557 of the Affordable Care Act on discrimination.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-wiser-2025",
   "state": "US",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Medicare Program; Implementation of Prior Authorization for Select Services for the Wasteful and Inappropriate Services Reduction (WISeR) Model, notice (CMS-5056-N), 90 FR 28749 (July 1, 2025)",
   "status": "effective",
   "signed": "2025-07-01",
   "effective": "2026-01-01",
   "applies_to": "Providers and suppliers furnishing selected items and services to Original Medicare patients in New Jersey, Ohio, Oklahoma, Texas, Arizona and Washington; the companies selected as model participants",
   "summary": "A six-year CMS Innovation Center model, running Jan. 1, 2026 through Dec. 31, 2031, in which participating companies use technologies such as AI and machine learning, with human clinical review, to conduct prior authorization or prepayment review of selected services in Original Medicare and are paid a percentage of the spending averted by their reviews.",
   "physician_read": "Since Jan. 1, 2026, clinicians in the six states who furnish selected services, such as skin and tissue substitutes, electrical nerve stimulator implants and knee arthroscopy for knee osteoarthritis, to Original Medicare patients must either request prior authorization or go through post-service, prepayment review. CMS says every recommendation for non-payment is made by an appropriately licensed clinician.",
   "sources": [
    {
     "label": "Federal Register notice",
     "url": "https://www.federalregister.gov/documents/2025/07/01/2025-12195/medicare-program-implementation-of-prior-authorization-for-select-services-for-the-wasteful-and"
    },
    {
     "label": "CMS Innovation Center model page",
     "url": "https://www.cms.gov/priorities/innovation/innovation-models/wiser"
    },
    {
     "label": "Notice delaying two services, April 6, 2026",
     "url": "https://www.federalregister.gov/documents/2026/04/06/2026-06616/medicare-program-delayed-implementation-of-certain-prior-authorization-for-select-services-for-the"
    },
    {
     "label": "CMS, WISeR provider and supplier operational guide, version 7.0 (July 24, 2026)",
     "url": "https://www.cms.gov/priorities/innovation/files/wiser-provider-supplier-guide.pdf"
    },
    {
     "label": "CMS, WISeR frequently asked questions",
     "url": "https://www.cms.gov/priorities/innovation/files/document/wiser-model-frequently-asked-questions"
    }
   ],
   "checked": "2026-09-29",
   "notes": "An April 6, 2026 notice (CMS-5056-N2, 91 FR 17282) delayed deep brain stimulation for essential tremor and Parkinson's disease and percutaneous image-guided lumbar decompression for spinal stenosis, to allow time for operational readiness, until a date to be announced in a later notice; a correction to the 2025 notice was published the same day. No later Federal Register notice on WISeR had appeared as of Sept. 29, 2026, and CMS's operational guide (version 7.0, updated July 24, 2026) lists 13 services in effect and the two as delayed. WISeR does not apply to Medicare Advantage. CMS's FAQ says the model plans to launch a 'gold carding' exemption program in 2026 for providers that consistently meet coverage criteria and that a human clinician with relevant expertise must review every non-affirmation.",
   "added": "2026-09-29"
  },
  {
   "id": "us-hr3514-2025",
   "state": "US",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "H.R. 3514, Improving Seniors' Timely Access to Care Act of 2025, 119th Congress, ordered reported by the House Ways and Means Committee",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Medicare Advantage organizations; CMS and ONC for a report to Congress",
   "summary": "As introduced, would set prior authorization requirements for Medicare Advantage plans, including an electronic prior authorization program for plan years beginning on or after Jan. 1, 2028 and annual transparency reports, for plan years beginning on or after Jan. 1, 2027, that give the number and percentage of requests approved and denied through decision support, artificial intelligence, machine-learning or clinical decision-making technology, and would require CMS and ONC to report to Congress by Jan. 1, 2028 on matters including how determinations of routinely approved items and services made solely through automation and AI affect patient access.",
   "physician_read": "It binds no one yet. As introduced, Medicare Advantage plans would report each year, for plan years beginning on or after Jan. 1, 2027, how many prior authorization requests they approved or denied using AI, machine learning or other decision technology, and would run electronic prior authorization programs for plan years beginning on or after Jan. 1, 2028.",
   "sources": [
    {
     "label": "LegiScan, bill history",
     "url": "https://legiscan.com/US/bill/HB3514/2025"
    },
    {
     "label": "Ways and Means Committee, markup of July 15, 2026 (results)",
     "url": "https://waysandmeans.house.gov/event/markup-of-h-r-9641-h-r-3108-h-r-9642-h-r-9468-h-r-3514-h-r-9644-and-h-r-9645/"
    },
    {
     "label": "Text as introduced (LegiScan copy)",
     "url": "https://legiscan.com/US/text/HB3514/id/3259725/US_Congress-2025-HB3514-Introduced.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced May 20, 2025 by Rep. Mike Kelly. The Ways and Means Committee ordered it reported with an amendment in the nature of a substitute by a 42-0 vote on July 15, 2026, according to the committee and LegiScan. The substitute's text could not be found, so the summary describes the introduced text. Status and history are from LegiScan's record of the bill.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-access-model-2025",
   "state": "US",
   "category": "payment",
   "also": [
    "mental-health"
   ],
   "kind": "policy",
   "name": "CMS Innovation Center, Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model (request for applications issued Dec. 5, 2025; version 1.1, Feb. 12, 2026)",
   "status": "effective",
   "signed": "2025-12-05",
   "effective": "2026-07-05",
   "applies_to": "Medicare Part B-enrolled organizations that join the model, other than suppliers of durable medical equipment, prosthetics, orthotics and supplies and laboratory suppliers; their Original Medicare patients; and clinicians who co-manage those patients",
   "summary": "A 10-year Innovation Center model, begun July 5, 2026 and running through June 30, 2036, that pays participating organizations recurring outcome-aligned payments for managing qualifying chronic conditions with technology-supported care, which CMS says may include FDA-authorized devices or software, with full payment tied to measurable outcomes; participants may not bill Medicare fee-for-service for aligned beneficiaries during active care periods.",
   "physician_read": "In the ACCESS model, which began July 5, 2026, clinicians who co-manage an Original Medicare patient with a participating organization can bill a new co-management service, with no patient cost-sharing, for documented review of ACCESS updates and care coordination. Medicare Advantage enrollees are not in the model, and participating organizations cannot bill Medicare fee-for-service for aligned patients during active care periods.",
   "sources": [
    {
     "label": "CMS Innovation Center model page",
     "url": "https://www.cms.gov/priorities/innovation/innovation-models/access"
    },
    {
     "label": "Request for applications, v1.1",
     "url": "https://www.cms.gov/priorities/innovation/files/access-rfa.pdf"
    },
    {
     "label": "FDA TEMPO pilot notice (linked to the model)",
     "url": "https://www.federalregister.gov/documents/2025/12/08/2025-22190/technology-enabled-meaningful-patient-outcomes-tempo-for-digital-health-devices-pilot"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Tracks are early cardio-kidney-metabolic, cardio-kidney-metabolic, musculoskeletal and behavioral health conditions, with heart failure, COPD, substance use disorder and tobacco cessation starting April 1, 2027, per CMS's model page (modified Sept. 18, 2026). Participants must designate a physician clinical director. The co-management service is paid at $30, subject to geographic adjustment, once every four months per beneficiary per track, up to about $100 a year. CMS's model page does not mention AI; the request for applications mentions AI in its description of technology-enabled care, with examples such as AI-assisted documentation and an AI-guided exercise therapy program. FDA announced its TEMPO pilot (separate entry) in connection with the model.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-cy2027-opps-2026",
   "state": "US",
   "category": "payment",
   "also": [],
   "kind": "rule",
   "name": "Medicare Program: Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems; and Quality Reporting Programs, CY 2027 proposed rule (CMS-1850-P), 91 FR 41734 (July 7, 2026), RIN 0938-AV83",
   "status": "introduced",
   "signed": "2026-07-07",
   "effective": "",
   "applies_to": "Hospital outpatient departments paid under the Medicare outpatient prospective payment system",
   "summary": "Proposes to rename software as a service (SaaS) as software as a medical service (SaMS), designate 36 HCPCS codes as SaMS, move separately paid SaMS services from clinical APCs into New Technology APCs at rates close to their CY 2026 payment, and create a new status indicator, O1, for separately paid SaMS for CY 2027 and later; comments closed Aug. 31, 2026.",
   "physician_read": "It places no duty on physicians and binds no one yet. If finalized, hospital outpatient departments would be paid for 36 designated software services that perform algorithmic analyses, such as AI analysis of MR images, under a new status indicator, O1, with separately paid services moved to New Technology APCs at rates close to their CY 2026 payment.",
   "sources": [
    {
     "label": "Proposed rule",
     "url": "https://www.federalregister.gov/documents/2026/07/07/2026-13656/medicare-program-hospital-outpatient-prospective-payment-and-ambulatory-surgical-center-payment"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Section X.B of the proposal carries the SaMS payment policy; CMS proposes to keep SaMS already assigned to New Technology APCs for CY 2026 in their current assignments. The proposal describes one SaMS technology, LiverMultiScan, as analyzing MR images with proprietary AI algorithms. No final rule had appeared in the Federal Register as of Sept. 29, 2026.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-cy2027-pfs-2026",
   "state": "US",
   "category": "payment",
   "also": [],
   "kind": "rule",
   "name": "Medicare and Medicaid Programs; CY 2027 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies, proposed rule (CMS-1848-P), 91 FR 43842 (July 16, 2026), RIN 0938-AV82",
   "status": "introduced",
   "signed": "2026-07-16",
   "effective": "",
   "applies_to": "Physicians and other practitioners paid under the Medicare physician fee schedule",
   "summary": "Proposes to have Medicare administrative contractors price, under the physician fee schedule, 10 HCPCS codes for software as a medical service (SaMS) analyses performed on laboratory tests that are now payable under the Clinical Laboratory Fee Schedule, and requests information on how technology and clinical AI are affecting primary care, care management and the annual wellness visit, including a possible two-track approach to care management with a technology-enabled track; comments closed Sept. 14, 2026.",
   "physician_read": "It binds no one yet; if finalized, Medicare administrative contractors would set physician fee schedule payment for 10 codes for software analyses of laboratory tests now payable under the Clinical Laboratory Fee Schedule. The questions on clinical AI in primary care, care management and the annual wellness visit are a request for information, not a payment proposal.",
   "sources": [
    {
     "label": "Proposed rule",
     "url": "https://www.federalregister.gov/documents/2026/07/16/2026-14327/medicare-and-medicaid-programs-cy-2027-payment-policies-under-the-physician-fee-schedule-and-other"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Comments were due Sept. 14, 2026. The primary care request for information is section II.E, 'Redesigning Primary Care To Make America Healthy Again.' CMS says these algorithmic analyses belong within its broader proposed framework for SaMS and should be treated consistently with comparable SaMS analyses. No final rule had appeared in the Federal Register as of Sept. 29, 2026.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-dmht-codes-2024",
   "state": "US",
   "category": "payment",
   "also": [
    "mental-health"
   ],
   "kind": "rule",
   "name": "Medicare physician fee schedule payment for digital mental health treatment devices, HCPCS G0552, G0553 and G0554: CY 2025 final rule (CMS-1807-F), 89 FR 97710 (Dec. 9, 2024), expanded in the CY 2026 final rule (CMS-1832-F), 90 FR 49266 (Nov. 5, 2025)",
   "status": "effective",
   "signed": "2024-12-09",
   "effective": "2025-01-01",
   "applies_to": "Physicians and other practitioners billing the Medicare physician fee schedule",
   "summary": "Pays under G0552 for supplying a digital mental health treatment device, with initial education and onboarding, per course of treatment that augments a behavioral therapy plan, and under G0553 and G0554 for monthly treatment management of its use (first and each additional 20 minutes), for FDA-cleared or authorized devices classified under 21 CFR 882.5801, a class the CY 2025 rule says covers use cases for insomnia, substance use disorder, depression and anxiety; the CY 2026 rule extended payment to ADHD devices classified under 21 CFR 882.5803.",
   "physician_read": "Since Jan. 1, 2025, clinicians can bill Medicare codes G0552 through G0554 for supplying an FDA-cleared or authorized digital mental health treatment device classified under 21 CFR 882.5801 that augments a behavioral therapy plan, and for monthly treatment management of its use. Since Jan. 1, 2026, the codes also cover ADHD digital therapy devices classified under 21 CFR 882.5803.",
   "sources": [
    {
     "label": "CY 2025 final rule",
     "url": "https://www.federalregister.gov/documents/2024/12/09/2024-25382/medicare-and-medicaid-programs-cy-2025-payment-policies-under-the-physician-fee-schedule-and-other"
    },
    {
     "label": "CY 2026 final rule",
     "url": "https://www.federalregister.gov/documents/2025/11/05/2025-19787/medicare-and-medicaid-programs-cy-2026-payment-policies-under-the-physician-fee-schedule-and-other"
    },
    {
     "label": "CMS fact sheet on the CY 2026 final rule",
     "url": "https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f"
    }
   ],
   "checked": "2026-09-29",
   "notes": "These codes pay for software-based devices generally, not AI specifically. In the CY 2026 final rule CMS did not finalize new coding and payment for other digital tools used with mental health treatment; its fact sheet says it received feedback on other digital therapy devices and will consider it for future rulemaking. A Federal Register search of the CY 2027 physician fee schedule proposed rule found no mention of these codes or of digital mental health treatment devices.",
   "added": "2026-09-29"
  },
  {
   "id": "us-cms-fy2027-ipps-ntap-2026",
   "state": "US",
   "category": "payment",
   "also": [],
   "kind": "rule",
   "name": "Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2027 Rates, final rule (CMS-1849-F), 91 FR 49570 (Aug. 4, 2026), RIN 0938-AV79; new technology add-on payments under 42 CFR 412.87 and 412.88",
   "status": "enacted",
   "signed": "2026-08-04",
   "effective": "2026-10-01",
   "applies_to": "Hospitals paid under the Medicare inpatient prospective payment system",
   "summary": "Approves FY 2027 new technology add-on payments, including for AI tools such as Aidoc's BriefCase-Triage: CARE (Clinical AI Reasoning Engine) Multi-Triage CT Body (up to $137.53 per case) and the Bayesian Health Sepsis Flagging Device, described by its applicant as AI and machine learning-based software (up to $61.84 per case), each capped at 65 percent of the technology's average cost.",
   "physician_read": "It places no duty on physicians. From Oct. 1, 2026, hospitals can receive add-on payments above the MS-DRG payment for eligible inpatient cases that use approved technologies, including these AI tools.",
   "sources": [
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2026/08/04/2026-15833/medicare-program-hospital-inpatient-prospective-payment-systems-for-acute-care-hospitals-ipps-and"
    },
    {
     "label": "CMS, New Medical Services and New Technologies",
     "url": "https://www.cms.gov/medicare/payment/prospective-payment-systems/acute-inpatient-pps/new-medical-services-and-new-technologies"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Both AI tools were approved under the alternative pathway for FDA Breakthrough Devices. The add-on is the lesser of 65 percent of the technology's average cost or 65 percent of the case's costs above the MS-DRG payment (42 CFR 412.88(a)(2)). Other technologies approved or continued for FY 2027 were not reviewed for AI. CMS's new technology page (modified Sept. 4, 2026) says the alternative pathway for FDA Breakthrough Devices applies to applications for fiscal years 2021 through 2029 for technologies designated as Breakthrough Devices as of Sept. 30, 2026 that receive marketing authorization for the designated indication by May 1, 2028. Applications for FY 2028 are due Oct. 5, 2026.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ftc-hbnr-2024",
   "state": "US",
   "category": "privacy",
   "also": [],
   "kind": "rule",
   "name": "Health Breach Notification Rule, final rule, 89 FR 47028 (May 30, 2024), RIN 3084-AB56, 16 CFR part 318",
   "status": "effective",
   "signed": "2024-05-30",
   "effective": "2024-07-29",
   "applies_to": "Vendors of personal health records, PHR related entities and their third-party service providers that are not covered by HIPAA, including health apps and connected devices",
   "summary": "Clarifies that the rule covers health apps and similar technologies outside HIPAA and that an unauthorized disclosure of identifiable health information, not only a cybersecurity intrusion, is a breach; notice goes to affected individuals within 60 calendar days of discovery, to the FTC at the same time when 500 or more people are affected (otherwise within 60 calendar days after the end of the calendar year), and to the media when 500 or more residents of a state or jurisdiction are affected.",
   "physician_read": "It places no duty on HIPAA-covered practices or on business associates acting for them. It covers health apps and connected devices outside HIPAA that patients use, which must notify users and the FTC of a breach, including an unauthorized disclosure of identifiable health information.",
   "sources": [
    {
     "label": "Final rule",
     "url": "https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule"
    },
    {
     "label": "eCFR, 16 CFR part 318",
     "url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318"
    },
    {
     "label": "FTC business guidance",
     "url": "https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0"
    },
    {
     "label": "FTC press release, Sept. 9, 2026",
     "url": "https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-withdraws-obsolete-policy-statement"
    },
    {
     "label": "FTC rescission of 2021 policy statement",
     "url": "https://www.ftc.gov/system/files/ftc_gov/pdf/Health-Breach-Commission-Statement.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "On Sept. 9, 2026, the FTC rescinded its Sept. 15, 2021 Statement of the Commission on Breaches by Health Apps and Other Connected Devices, saying it had been superseded by the 2024 rulemaking; the rescission does not change the rule. The rule does not mention AI.",
   "added": "2026-09-29"
  },
  {
   "id": "us-hipaa-security-nprm-2025",
   "state": "US",
   "category": "privacy",
   "also": [],
   "kind": "rule",
   "name": "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22",
   "status": "introduced",
   "signed": "2025-01-06",
   "effective": "",
   "applies_to": "HIPAA covered entities and business associates",
   "summary": "Proposes to strengthen the Security Rule's cybersecurity requirements, including a written technology asset inventory and network map, encryption of electronic protected health information (ePHI) at rest and in transit and multifactor authentication; its preamble states that ePHI in AI training data, prediction models and algorithm data that a regulated entity maintains for covered functions is protected by the HIPAA Rules, and it asks for information on AI and other emerging technologies; comments closed March 7, 2025.",
   "physician_read": "It binds no one yet; reginfo.gov's current regulatory agenda (the edition it labels 2026) lists the rule as a long-term action with final action in July 2027. The preamble states that electronic protected health information in AI training data, prediction models and algorithm data that a practice maintains for covered functions is protected by the HIPAA Rules.",
   "sources": [
    {
     "label": "Proposed rule",
     "url": "https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information"
    },
    {
     "label": "Unified Agenda entry, RIN 0945-AA22 (edition labeled 2026)",
     "url": "https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Docket HHS-OCR-2024-0020. The AI statement is in section K.2 of the preamble, its request for information on new and emerging technologies. The preamble also asks how quantum computing, AI, virtual reality and augmented reality may affect the security of ePHI. Reginfo.gov labels the agenda edition with publication ID 202510 as 2026; it is the latest edition listing the rule, and it places the rule under Long-Term Actions with final action in July 2027. The proposed rule is the only Federal Register document under RIN 0945-AA22 as of Sept. 29, 2026; no final rule or withdrawal has been published.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ocr-ba-ai-chatbot-2026",
   "state": "US",
   "category": "privacy",
   "also": [],
   "kind": "guidance",
   "name": "HHS Office for Civil Rights, Business Associates guidance (web page, content last reviewed July 30, 2026): AI chatbot example",
   "status": "effective",
   "signed": "",
   "effective": "",
   "applies_to": "HIPAA covered entities and the vendors that handle PHI for them",
   "summary": "Lists a third-party vendor's AI chatbot on a provider's patient portal that provides services involving patients' PHI, such as symptom assessment, medical reminders and appointment scheduling, as an example of a business associate.",
   "physician_read": "A practice that puts a vendor's AI chatbot handling PHI on its patient portal is dealing with a business associate. Before disclosing PHI, it must document the vendor's assurances in a written business associate agreement under 45 CFR 164.502(e).",
   "sources": [
    {
     "label": "HHS, Business Associates",
     "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html"
    },
    {
     "label": "eCFR, 45 CFR 164.502",
     "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The date HHS added the AI chatbot example could not be confirmed; the page was last reviewed July 30, 2026, which is the year used in this entry's id.",
   "added": "2026-09-29"
  },
  {
   "id": "us-ocr-online-tracking-2024",
   "state": "US",
   "category": "privacy",
   "also": [],
   "kind": "guidance",
   "name": "HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (bulletin issued December 2022, revised March 18, 2024)",
   "status": "effective",
   "signed": "2024-03-18",
   "effective": "2024-03-18",
   "applies_to": "HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps",
   "summary": "Says regulated entities may not use online tracking technologies in a way that results in impermissible disclosures of PHI to tracking vendors, that tracking on user-authenticated webpages and in a regulated entity's mobile apps generally involves PHI, and that a tracking vendor that meets the definition is a business associate; otherwise patients' HIPAA authorizations are required before PHI is disclosed to the vendor.",
   "physician_read": "Under this guidance, tracking technologies on a practice's patient portal and in its mobile app generally have access to PHI, and PHI may go to a tracking vendor only as the Privacy Rule permits, under a business associate agreement where the vendor is a business associate, or with patients' HIPAA authorizations. On June 20, 2024, a federal court vacated the part treating a visitor's IP address combined with a visit to a public, unauthenticated page about specific health conditions or providers as PHI.",
   "sources": [
    {
     "label": "HHS bulletin",
     "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html"
    },
    {
     "label": "American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. June 20, 2024)",
     "url": "https://www.govinfo.gov/content/pkg/USCOURTS-txnd-4_23-cv-01110/pdf/USCOURTS-txnd-4_23-cv-01110-0.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The court declared the 'Proscribed Combination' in the March 18, 2024 bulletin unlawful and vacated it, denied a permanent injunction and said the vacatur does not limit the rest of the bulletin; its opinion describes the original bulletin as issued in December 2022. HHS's page (content last reviewed June 26, 2024) carries a banner noting the order, and its guidance on user-authenticated webpages, mobile apps, business associate agreements and HIPAA authorizations remains posted. The bulletin does not mention AI.",
   "added": "2026-09-29"
  },
  {
   "id": "us-s3097-2025",
   "state": "US",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "S. 3097, Health Information Privacy Reform Act, 119th Congress, reported by the Senate Health, Education, Labor, and Pensions Committee with an amendment (Calendar No. 538)",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "HHS (rulemaking); entities that process identifiable health information outside HIPAA's protections for protected health information, including data brokers; HIPAA covered entities for the AI-related minimum necessary rules",
   "summary": "As reported, would direct HHS, in consultation with the FTC, to set privacy, security and breach notification standards within 18 months for identifiable health information processed by entities other than covered entities and business associates acting with respect to protected health information, including data brokers, and to issue regulations within one year on how the minimum necessary standard applies to health information used to develop, train, validate, modify or operate AI or machine learning models and on unified de-identification standards that account for re-identification methods using AI.",
   "physician_read": "It binds no one yet. As reported, HHS would have one year to issue rules on how HIPAA's minimum necessary standard applies when protected health information is used to develop, train, validate or fine-tune AI or machine learning models, including when a larger data set is reasonably necessary.",
   "sources": [
    {
     "label": "LegiScan, bill history",
     "url": "https://legiscan.com/US/bill/SB3097/2025"
    },
    {
     "label": "Text as reported Aug. 4, 2026 (LegiScan copy)",
     "url": "https://legiscan.com/US/text/SB3097/id/3454697/US_Congress-2025-SB3097-Introduced.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Introduced Nov. 4, 2025 by Sens. Bill Cassidy and Margaret Hassan. The HELP Committee reported it with an amendment in the nature of a substitute on Aug. 4, 2026, and it was placed on the Senate calendar as Calendar No. 538; the summary follows the reported text. Status and history are from LegiScan's record of the bill.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-oaip-doctronic-rma-2025",
   "state": "UT",
   "category": "clinical",
   "also": [
    "disclosure"
   ],
   "kind": "policy",
   "name": "Office of Artificial Intelligence Policy, AI Learning Laboratory regulatory mitigation agreement with Doctronic, LLC (AI prescription renewals)",
   "status": "effective",
   "signed": "2025-10-24",
   "effective": "2025-10-24",
   "applies_to": "Doctronic, LLC and the licensed prescribers named in its Utah pilot",
   "summary": "Lets Doctronic's AI system authorize 30-, 60- or 90-day renewals of previously prescribed, non-controlled medications on an approved formulary for Utah patients, with the Division of Professional Licensing forgoing enforcement of specified unlawful-conduct, telehealth and unprofessional-conduct provisions for that use, subject to physician review of every renewal for the first 250 patients, retrospective physician review for the next 1,000, monthly review of 5% to 10% of renewals after that, AI disclosure to users, and monthly reporting.",
   "physician_read": "Physicians and other licensees named as prescribers in the pilot are protected from Division of Professional Licensing unprofessional-conduct enforcement for AI-authorized renewals while the agreement's terms are met; the AI may not issue new prescriptions, change treatment plans or renew controlled substances. The Utah Medical Licensing Board asked on April 20, 2026 that the pilot be suspended; the Department of Commerce declined on April 21, 2026, citing physician review of every renewal in the first phase.",
   "sources": [
    {
     "label": "Signed agreement",
     "url": "https://commerce.utah.gov/wp-content/uploads/2026/01/Doctronic-Final-Agreement.pdf"
    },
    {
     "label": "Office of AI Policy, Doctronic pilot page",
     "url": "https://commerce.utah.gov/ai/regulatory-relief/authorized-ai-pilots/doctronic/"
    },
    {
     "label": "Medical Licensing Board letter, April 20, 2026",
     "url": "https://commerce.utah.gov/wp-content/uploads/2026/04/doctronic-letter-from-medical-board.pdf"
    },
    {
     "label": "Commerce response, April 21, 2026",
     "url": "https://commerce.utah.gov/wp-content/uploads/2026/04/Medical-Board-Doctronic-Response.pdf"
    },
    {
     "label": "Office of AI Policy, Doctronic public report 1, May 19, 2026",
     "url": "https://commerce.utah.gov/wp-content/uploads/2026/05/Doctronic-Outcomes-May-2026.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed by the Office of Artificial Intelligence Policy and Doctronic on Oct. 23, 2025 and by the Division of Professional Licensing on Oct. 24, 2025, for 12 months from execution, with a single extension of up to 12 months if Doctronic requests it at least 30 days before the term ends; the Office's page describes the term as October 2025 to October 2026 with an option to renew for a year, and no renewal or extension appeared on the Office's pages on Sept. 29, 2026. The response to the board was signed by the directors of the Division of Professional Licensing and the Office. The Office's first public report, dated May 19, 2026, covers January through April 2026 and says the pilot was still in Phase One. The Office's page (modified June 18, 2026) reports amendments removing butalbital and flecainide from the formulary and letting each medication group move to Phase 2 after 250 fills in that group, subject to Office approval. Users must acknowledge disclosures, including that they are interacting with generative AI, before using the service. The agreement does not limit remedies available to users, third parties or the state other than the Division. It rests on the AI Policy Act (Title 13, Chapter 72), set to repeal July 1, 2027.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-sb149-2024",
   "state": "UT",
   "category": "disclosure",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "SB 149, Artificial Intelligence Amendments (Artificial Intelligence Policy Act)",
   "status": "effective",
   "signed": "2024-03-13",
   "effective": "2024-05-01",
   "applies_to": "Persons using generative AI in consumer transactions and people providing the services of occupations licensed or certified by the Department of Commerce, including health professions; the Office of Artificial Intelligence Policy",
   "summary": "Required anyone providing the services of a regulated occupation, such as a licensed health profession, to prominently disclose when a person is interacting with generative AI in the provision of regulated services, required a person using generative AI in connection with an activity the Division of Consumer Protection administers to disclose it when asked, and created the Office of Artificial Intelligence Policy and an AI learning laboratory that can enter regulatory mitigation agreements relaxing enforcement for AI pilots.",
   "physician_read": "From May 1, 2024, a Utah physician or other licensee whose patients interacted with generative AI in licensed services had to disclose it prominently at the start of the exchange; SB 226 narrowed that duty to high-risk interactions from May 7, 2025 (separate entry). The Office of Artificial Intelligence Policy created by this act can sign regulatory mitigation agreements that let AI systems perform tasks in health care, such as prescription renewals, under set safeguards.",
   "sources": [
    {
     "label": "Enrolled bill (Utah Legislature)",
     "url": "https://le.utah.gov/~2024/bills/sbillenr/SB0149.pdf"
    },
    {
     "label": "Bill page (Utah Legislature)",
     "url": "https://le.utah.gov/~2024/bills/static/SB0149.html"
    },
    {
     "label": "SB 332 (2025) enrolled, repeal date extension",
     "url": "https://le.utah.gov/~2025/bills/sbillenr/SB0332.pdf"
    },
    {
     "label": "HB 320 (2026) enrolled, Office and learning laboratory changes",
     "url": "https://le.utah.gov/Session/2026/bills/enrolled/HB0320.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Senate Feb. 13, 2024 and the House Feb. 28, 2024; signed March 13, 2024; effective May 1, 2024. The original disclosure rules were in Section 13-2-12, which SB 226 (2025) repealed and replaced with narrower duties (separate entry). The enrolled bill numbered the Office, learning laboratory and regulatory mitigation provisions Title 13, Chapter 70; later bills cite them as Title 13, Chapter 72, the Artificial Intelligence Policy Act. As enacted, an initial regulatory mitigation agreement could last no longer than 12 months, with a single 12-month extension. The act originally set the chapter to repeal May 1, 2025; SB 332 (signed March 25, 2025) moved the repeal date to July 1, 2027, and neither HB 320 nor SB 12 (2026), Sunset and Repeal Date Amendments, amends that repeal provision. HB 320 (signed March 18, 2026, effective May 6, 2026) keeps the 12-month limit on an initial agreement, lets the Office grant up to two 12-month extensions, requires agreements to specify any required disclosures to consumers and reporting to comply with the Office's audits, requires the Office to consult relevant agencies on agreement terms, and requires an annual report that includes the agreements executed. SB 149 also amended the Consumer Privacy Act's definitions to include synthetic data in deidentified data.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-sb226-2025",
   "state": "UT",
   "category": "disclosure",
   "also": [],
   "kind": "law",
   "name": "SB 226, Artificial Intelligence Consumer Protection Amendments",
   "status": "effective",
   "signed": "2025-03-27",
   "effective": "2025-05-07",
   "applies_to": "Individuals providing the services of an occupation licensed or certified by the Department of Commerce, including physicians and other health professionals, and suppliers using generative AI in consumer transactions",
   "summary": "Requires an individual providing the services of a regulated occupation to prominently disclose that a person is interacting with generative AI when the use is a high-risk AI interaction, defined to include an interaction that collects sensitive personal information such as health, financial or biometric data, or that gives personalized recommendations, advice or information, including medical or mental health advice, that could reasonably be relied on for significant personal decisions, and requires suppliers to disclose AI use when an individual clearly and unambiguously asks.",
   "physician_read": "Since May 7, 2025, a Utah physician or other licensee must prominently disclose generative AI use in providing licensed services when the AI collects health data or gives personalized medical or mental health advice, verbally at the start of a verbal interaction and in writing before a written one. A licensee who provides services through generative AI must also meet all requirements of the profession.",
   "sources": [
    {
     "label": "Enrolled bill (Utah Legislature)",
     "url": "https://le.utah.gov/~2025/bills/sbillenr/SB0226.pdf"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/UT/bill/SB226/2025"
    },
    {
     "label": "SB 38 (2026) enrolled, Consumer Protection Modifications",
     "url": "https://le.utah.gov/Session/2026/bills/enrolled/SB0038.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed March 27, 2025 (LegiScan); effective May 7, 2025. It repealed Section 13-2-12, the 2024 disclosure rule from SB 149, which had required licensees to disclose any generative AI interaction. The enrolled bill numbers the new provisions Title 13, Chapter 75; SB 38 (2026) refers to them as Title 13, Chapter 77, Generative Artificial Intelligence - Consumer Disclosures and Enforcement, and the Doctronic agreement cites the disclosure duty as Section 13-77-103. SB 38 (2026), effective May 6, 2026, amends Sections 13-77-101 and 13-77-102 and adds Chapter 77 to the chapters the Division of Consumer Protection enforces; its amended text could not be read in full, so whether it changed the disclosure duty itself was not determined. A high-risk interaction also includes other applications defined by Division rule. A licensee providing services through generative AI must also comply with all requirements of the regulated occupation. Safe harbor: a person is not subject to enforcement if its generative AI clearly and conspicuously discloses, at the outset of any interaction in a consumer transaction or the provision of regulated services and throughout the interaction, that it is generative AI, is not human, or is an AI assistant. The Division of Consumer Protection enforces, with administrative fines up to $2,500 per violation, court fines up to $2,500 per violation and civil penalties up to $5,000 for each violation of an order.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-hb452-2025",
   "state": "UT",
   "category": "mental-health",
   "also": [
    "disclosure",
    "privacy"
   ],
   "kind": "law",
   "name": "HB 452, Artificial Intelligence Amendments",
   "status": "effective",
   "signed": "2025-03-25",
   "effective": "2025-05-07",
   "applies_to": "Suppliers of mental health chatbots used by Utah users",
   "summary": "Requires a mental health chatbot to clearly disclose that it is AI and not a human before a user accesses it, at the start of any interaction after seven days without use and whenever the user asks, bars the supplier from selling or sharing a Utah user's individually identifiable health information or user input with third parties except in limited cases, bars using user input to decide whether or what to advertise or to customize ads and requires ads to be labeled, and gives a supplier an affirmative defense if it creates, files with the Division of Consumer Protection and complies with a written policy meeting the act's safety requirements.",
   "physician_read": "It places no duty on physicians. Since May 7, 2025, a generative AI chatbot that its supplier represents, or a reasonable person would believe, can provide mental health therapy to a Utah patient must identify itself as AI, may not sell or share the patient's identifiable health information or chat input except in limited cases, and may not use that input to target advertising.",
   "sources": [
    {
     "label": "Enrolled bill (Utah Legislature)",
     "url": "https://le.utah.gov/~2025/bills/hbillenr/HB0452.pdf"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/UT/bill/HB452/2025"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the House Feb. 27, 2025 and the Senate March 5, 2025; signed March 25, 2025; effective May 7, 2025. Codified as Title 13, Chapter 72a, Artificial Intelligence Applications Relating to Mental Health; the data-sharing ban is Section 13-72a-201 and the advertising rules are Section 13-72a-202. A mental health chatbot is AI technology that uses generative AI to engage in interactive conversations similar to confidential communications with a licensed mental health therapist and that the supplier represents, or a reasonable person would believe, can or will provide mental health therapy or help a user manage or treat mental health conditions; scripted output such as guided meditations, and tools that analyze input to connect a person with a human therapist, are excluded. Exceptions to the data-sharing ban cover information requested by a health care provider with the user's consent, information provided to the user's health plan on request, and sharing needed for the chatbot's functionality under a contract with HIPAA-equivalent protections. The affirmative defense requires a supplier to show it created, maintained and implemented a policy meeting the act's requirements, kept documentation, filed the policy with the Division and complied with it; the policy must cover, among other things, involvement of licensed mental health therapists in development, testing so the chatbot poses no greater risk than therapy with a licensed therapist, protocols to respond in real time to risk of harm, and regular safety audits. The Division of Consumer Protection may impose administrative fines up to $2,500 per violation; a court may impose fines up to $2,500 per violation and civil penalties up to $5,000 for each violation of an administrative or court order.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-oaip-dopl-mental-health-ai-guidance-2025",
   "state": "UT",
   "category": "mental-health",
   "also": [
    "disclosure"
   ],
   "kind": "policy",
   "name": "Guidance Letter: Best Practices for the Use of Artificial Intelligence by Mental Health Therapists, Office of Artificial Intelligence Policy and Division of Professional Licensing",
   "status": "effective",
   "signed": "",
   "effective": "",
   "applies_to": "Licensed mental health therapists in Utah, a term the letter defines to include physicians engaged in the practice of mental health therapy (guidance)",
   "summary": "Advises licensed mental health therapists who use AI to obtain informed consent, disclosing benefits, risks and data practices, before using AI to record or transcribe sessions or to let patients interact with a conversational bot beyond intake, to maintain competence with AI tools, to verify data handling and business associate agreements with AI vendors, to review AI-generated content before it enters the record and keep independent judgment on AI-suggested diagnoses or treatments, to disclose when AI contributed to documentation or communications, and to set protocols for crises that AI tools cannot handle.",
   "physician_read": "The guidance letter, which does not say it is binding, is addressed to mental health therapists, a term it defines to include physicians engaged in the practice of mental health therapy. Since April 2025 it has asked them to obtain informed consent before using AI to record or transcribe a session or to let a patient interact with a conversational bot beyond intake, to accommodate or refer patients who decline, and to review AI-generated content before it enters the record.",
   "sources": [
    {
     "label": "Guidance letter",
     "url": "https://commerce.utah.gov/wp-content/uploads/2025/04/Best-Practices-Mental-Health-Therapists.pdf"
    },
    {
     "label": "Executive summary",
     "url": "https://commerce.utah.gov/wp-content/uploads/2025/04/Executive-Summary-Best-Practices-Mental-Health-Therapists.pdf"
    },
    {
     "label": "Office of AI Policy, policy work page",
     "url": "https://commerce.utah.gov/ai/policy-work/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued in April 2025 by the Office of Artificial Intelligence Policy and the Division of Professional Licensing; neither the letter nor its executive summary gives a day, so the date fields are empty. The letter takes its definition of mental health therapist from Utah Code Section 58-60-102, listing 14 licensed professions, including a physician and surgeon or osteopathic physician engaged in the practice of mental health therapy and an advanced practice registered nurse specializing in psychiatric mental health nursing. It does not state that it is binding or how the Division will use it; it asks therapists to align AI use with their profession's ethics code.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-oaip-legion-health-rma-2026",
   "state": "UT",
   "category": "mental-health",
   "also": [
    "clinical"
   ],
   "kind": "policy",
   "name": "Office of Artificial Intelligence Policy, AI Learning Laboratory regulatory mitigation agreement with Legion Health (AI psychiatric medication refills)",
   "status": "effective",
   "signed": "",
   "effective": "",
   "applies_to": "Legion Health, an AI-enabled psychiatry practice, and its Utah patients",
   "summary": "Lets Legion Health's AI system handle routine refills of existing, non-controlled psychiatric medications, such as common treatments for anxiety and depression, for stable Utah patients under relaxed rules, with clinician review of the first 250 requests before completion, retrospective review of the next 1,000, monthly randomized audits, immediate clinician review when risks such as suicidality, severe side effects, signs of mania or pregnancy appear, and human review on the patient's request.",
   "physician_read": "It places no duty on physicians outside the pilot. The AI does not diagnose, prescribe new medications or adjust doses, and handles refills only for stable patients on existing prescriptions.",
   "sources": [
    {
     "label": "Office of AI Policy, Legion Health page",
     "url": "https://commerce.utah.gov/ai/agreements/ai-legion-health/"
    },
    {
     "label": "Signed agreement (scanned PDF)",
     "url": "https://commerce.utah.gov/wp-content/uploads/2026/03/Legion-Agreement.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Office's page (modified May 15, 2026) describes a 12-month pilot, says certain rules are relaxed while all standard patient protections and legal responsibilities still apply, and says patients are told that AI is part of the process. It links the signed agreement, posted under a March 2026 upload path; the agreement is posted as a scanned image, so its terms could not be checked. The signing date, term dates and the provisions for which enforcement is forgone could not be confirmed, so the date fields are empty.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-sb319-2026",
   "state": "UT",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 319, Health Insurance Preauthorization Amendments",
   "status": "enacted",
   "signed": "2026-03-19",
   "effective": "2027-01-01",
   "applies_to": "Health insurers subject to Utah's preauthorization statute, Section 31A-22-650",
   "summary": "Requires an insurer that uses AI in its processes for reviewing authorization requests to post a notice on its website and to disclose that use to the Insurance Department, each health care provider in its network and each enrollee, requires that an adverse preauthorization determination on clinical or medical necessity be made by an individual who knows the enrollee's condition or consults a specialist who does, exercises independent medical judgment and does not rely solely on recommendations from any other source, and sets maximum decision times and a minimum 12-month authorization period for drugs, devices or services for chronic or long-term conditions.",
   "physician_read": "From Jan. 1, 2027, an insurer that uses AI to review authorization requests must say so to in-network providers, enrollees and the Insurance Department and on its website, and a preauthorization denial on clinical or medical necessity must come from a reviewer who knows the patient's condition or consults a specialist who does, exercises independent medical judgment and does not rely solely on any other source's recommendation. Insurers must also decide standard requests within seven calendar days and urgent requests within 72 hours after receiving all necessary information, and authorizations for chronic or long-term conditions must last at least 12 months.",
   "sources": [
    {
     "label": "Enrolled bill (Utah Legislature)",
     "url": "https://le.utah.gov/Session/2026/bills/enrolled/SB0319.pdf"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/UT/bill/SB319/2026"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Passed the Senate March 3, 2026 and the House March 4, 2026, with Senate concurrence March 5, 2026; signed March 19, 2026; takes effect Jan. 1, 2027. Amends Section 31A-22-650: the website notice is in Subsection (2)(d), the disclosure to the department, network providers and enrollees in Subsection (3), and the reviewer requirement, new in this bill, in Subsection (6)(e). 'Artificial intelligence' has the meaning in Section 53-25-901 and includes generative AI. The disclosure section does not specify timing or form beyond the website notice. 'Insurer' has the meaning in Section 31A-22-634; whether the section reaches Medicaid managed care or the Public Employees' Health Program was not determined. Utah's 2026 HB 60, which a tracker listed as the payer AI disclosure law, is Water Rights Amendments.",
   "added": "2026-09-29"
  },
  {
   "id": "ut-sb227-2022",
   "state": "UT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 227, Consumer Privacy Act",
   "status": "effective",
   "signed": "2022-03-24",
   "effective": "2023-12-31",
   "applies_to": "Controllers and processors doing business in Utah with annual revenue of $25 million or more that control or process personal data of 100,000 or more consumers a year, or of 25,000 or more consumers while deriving over 50% of gross revenue from selling personal data; HIPAA covered entities and business associates are exempt",
   "summary": "As enacted, gives consumers rights to access, delete and port personal data and to opt out of targeted advertising and sale, and bars processing sensitive data, including information on an individual's medical history, mental or physical health condition, or medical treatment or diagnosis and biometric data used to identify a person, without first giving clear notice and an opportunity to opt out.",
   "physician_read": "The act exempts HIPAA covered entities, business associates and protected health information, so it places no duty on a physician practice acting as a covered entity. Large businesses outside HIPAA, such as some health and wellness apps, have since Dec. 31, 2023 had to give notice and an opt-out before processing a consumer's health or biometric data.",
   "sources": [
    {
     "label": "Enrolled bill (Utah Legislature)",
     "url": "https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf"
    },
    {
     "label": "Bill history (LegiScan)",
     "url": "https://legiscan.com/UT/bill/SB227/2022"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Signed March 24, 2022; effective Dec. 31, 2023. Codified at Title 13, Chapter 61; Section 13-61-102(2) exempts covered entities and business associates as entities, as well as protected health information. It uses notice and an opportunity to opt out, not consent, for sensitive data, and as enacted it has no right to correct, no right to opt out of profiling and no data protection assessment requirement. The Division of Consumer Protection receives and investigates complaints and refers matters to the attorney general, who has exclusive enforcement authority after a 30-day cure period. SB 149 (2024) amended the definitions in Section 13-61-101 to define synthetic data and include it in deidentified data. SB 38 (2026), effective May 6, 2026, amends Section 13-61-101; its amended text could not be read in full. No later amendment adding health, biometric, neural, geolocation, minors' or profiling provisions was identified, though the 2023 to 2026 sessions were not reviewed bill by bill.",
   "added": "2026-09-29"
  },
  {
   "id": "va-hb2154-2021",
   "state": "VA",
   "category": "clinical",
   "also": [
    "privacy"
   ],
   "kind": "law",
   "name": "HB 2154, Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant",
   "status": "effective",
   "signed": "2021-03-18",
   "effective": "2021-07-01",
   "applies_to": "Hospitals, nursing homes and certified nursing facilities licensed or certified by the Board of Health",
   "summary": "Requires the Board of Health's regulations to make each hospital, nursing home and certified nursing facility establish and implement policies to ensure the permissible access to and use of an intelligent personal assistant, a device and software application that uses natural language processing and artificial intelligence, provided by a patient receiving inpatient services, and requires those policies to protect health information under HIPAA.",
   "physician_read": "It places no direct duty on physicians. Hospitals, nursing homes and certified nursing facilities must have policies that ensure inpatients' permissible access to and use of their own intelligent personal assistants, such as digital or virtual assistants, and that protect health information under HIPAA; the duty took effect in the statute July 1, 2021, in the nursing facility rule Nov. 11, 2021, and in the hospital rule May 22, 2025.",
   "sources": [
    {
     "label": "Va. Code § 32.1-127 B 29",
     "url": "https://law.lis.virginia.gov/vacode/title32.1/chapter5/section32.1-127/"
    },
    {
     "label": "LegiScan bill page (2021 Special Session I)",
     "url": "https://legiscan.com/VA/bill/HB2154/2021/X1"
    },
    {
     "label": "12VAC5-410-230, hospital licensure rule",
     "url": "https://law.lis.virginia.gov/admincode/title12/agency5/chapter410/section230/"
    },
    {
     "label": "12VAC5-371-140, nursing facility licensure rule",
     "url": "https://law.lis.virginia.gov/admincode/title12/agency5/chapter371/section140/"
    },
    {
     "label": "Virginia Register, nursing facility final regulation (Vol. 38, Iss. 4)",
     "url": "https://register.dls.virginia.gov/details.aspx?id=9881"
    },
    {
     "label": "Virginia Register, hospital fast-track regulation (Vol. 41, Iss. 17)",
     "url": "https://register.dls.virginia.gov/details.aspx?id=11567"
    },
    {
     "label": "Virginia Register, hospital fast-track regulation (Vol. 42, Iss. 18)",
     "url": "https://register.dls.virginia.gov/details.aspx?id=12256"
    },
    {
     "label": "12VAC5-410-10, hospital rule definitions and history",
     "url": "https://law.lis.virginia.gov/admincode/title12/agency5/chapter410/section10/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Enacted in the 2021 Special Session I as Chapter 219, approved March 18, 2021, effective July 1, 2021; the statute (Va. Code § 32.1-127 B 29) itself requires the policies to protect health information under HIPAA. The nursing facility rule, 12VAC5-371-140 G, took effect Nov. 11, 2021 (exempt final action, Virginia Register Vol. 38, Iss. 4, Oct. 11, 2021). The hospital rule was added to 12VAC5-410-230 by a State Board of Health fast-track action published in Vol. 41, Iss. 17 (April 7, 2025) with an effective date of May 22, 2025; the Administrative Code histories of 12VAC5-410-10 and 12VAC5-410-280, amended by the same action, list it with that date, and a second fast-track action (Vol. 42, Iss. 18, April 20, 2026, effective June 4, 2026) printed the provision as existing text re-lettered from K to J. The Administrative Code history of 12VAC5-410-230 itself lists only the 2026 action. A notice of intended regulatory action (Vol. 41, Iss. 20, May 19, 2025) proposes replacing 12VAC5-410 with new chapters 12VAC5-413 and 12VAC5-415.",
   "added": "2026-09-29"
  },
  {
   "id": "va-sb796-2026",
   "state": "VA",
   "category": "clinical",
   "also": [
    "mental-health",
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 796, Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Every operator of a chatbot offered to users in Virginia (disclosure duties) and operators of chatbots with 500,000 or more monthly active users worldwide (safety and reporting duties), excluding from the latter chatbots not offered to the general public, such as internal workplace tools, clinician-supervised clinical tools or university research systems, and chatbots used solely for customer service",
   "summary": "As passed by the Senate, would require every chatbot operator serving Virginia users to show users of all ages a static, persistent disclosure that the chatbot is not human, with pop-up notices at login, every 30 minutes of sustained use, when the user asks and when the chatbot is asked for medical, financial, legal or other licensed advice, and would require operators with 500,000 or more monthly active users to identify and reduce users' emotional dependence, keep chatbots from falsely claiming to be human, give a crisis message when a user expresses suicidal thoughts, intent to self-harm or signs of an acute mental health crisis, make reasonable efforts within 24 hours to notify emergency services or law enforcement of an imminent risk of death or serious physical injury, and report covered incidents to the Attorney General within 15 days.",
   "physician_read": "It binds no one yet. As passed by the Senate, any person or entity offering a chatbot to users in Virginia, which could include a medical practice, would have to disclose that the chatbot is not human, including by pop-up when a user asks it for medical advice; only operators with 500,000 or more monthly active users would carry the crisis-response and incident-reporting duties, and clinician-supervised clinical tools not offered to the general public would be excluded from them.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/VA/bill/SB796/2026"
    },
    {
     "label": "Senate engrossed text (LegiScan)",
     "url": "https://legiscan.com/VA/text/SB796/id/3364861"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Senate General Laws and Technology Committee reported a substitute 14-0 on Feb. 11, 2026. The Senate engrossed a floor substitute on Feb. 16, reconsidered the engrossment on Feb. 17, agreed to a floor amendment and passed the bill 39-1 the same day; LegiScan labels the text as the engrossed version. On March 2, 2026, a House committee substitute was offered and the House Communications, Technology and Innovation Committee continued the bill to the 2027 session, so it carries over. The Senate text would add a chapter headed Artificial Intelligence Chatbots and Minors Act (§§ 59.1-614 through 59.1-618), with Attorney General civil penalties of up to $50,000 per violation and a civil action for any person harmed or the parent or guardian of a harmed minor; a covered harm means death, a suicide attempt, self-harm requiring medical attention, a psychiatric emergency resulting in urgent medical treatment, or a serious physical injury requiring medical attention. LegiScan codes the bill as dead at the end of the 2026 session; LegiScan is the source for status and text.",
   "added": "2026-09-29"
  },
  {
   "id": "va-sb269-2026",
   "state": "VA",
   "category": "mental-health",
   "also": [
    "disclosure",
    "clinical"
   ],
   "kind": "law",
   "name": "SB 269, Mental health service providers; definitions, use of artificial intelligence system, civil penalty",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Mental health service providers as defined in Va. Code § 54.1-2400.1, a list that includes physicians, physician assistants, nurses, psychologists, counselors and social workers, and any person or business entity offering therapy or counseling services to the public in Virginia",
   "summary": "As passed by the Senate, would let a mental health service provider use an AI system to assist in providing therapy or counseling services only while keeping full responsibility for all interactions, outputs and data use; bar AI from making independent therapeutic decisions, engaging in therapeutic communication with clients without provider oversight, or generating recommendations, making diagnoses or implementing treatment plans without the licensed professional's review, oversight and approval; require, when a session is recorded or transcribed, disclosure at the initial appointment of the AI's use and specific purpose and the patient's written or digital consent; and bar any person or business entity from offering therapy or counseling services to the public, including through AI, unless a mental health service provider conducts them, with civil penalties up to $10,000.",
   "physician_read": "It binds no one yet. If enacted as passed by the Senate, a physician or other mental health service provider (the Va. Code § 54.1-2400.1 definition lists physicians) using AI in therapy or counseling would need the patient's written or digital consent, after disclosure of the AI's use and purpose, for a recorded or transcribed session, and AI could not diagnose or implement a treatment plan without the provider's review, oversight and approval.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/VA/bill/SB269/2026"
    },
    {
     "label": "Senate substitute text (LegiScan)",
     "url": "https://legiscan.com/VA/text/SB269/id/3341748"
    },
    {
     "label": "Va. Code § 54.1-2400.1 (definition of mental health service provider)",
     "url": "https://law.lis.virginia.gov/vacode/title54.1/chapter24/section54.1-2400.1/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Would add Va. Code § 54.1-2400.1:1. The Senate General Laws and Technology Committee reported a substitute 15-0 on Jan. 28, 2026, and the Senate passed it 39-0 on Feb. 3, 2026. On March 2, 2026, the House Communications, Technology and Innovation Committee continued it to the 2027 session, so it carries over. The bill defines mental health service provider by reference to Va. Code § 54.1-2400.1, whose list includes physicians, physician assistants, nurses, psychologists, professional counselors, marriage and family therapists, social workers and peer recovery specialists, so its limits would apply to a physician who uses AI in providing therapy or counseling services. Religious counseling, peer support and self-help or educational materials are exempt; records and communications would be confidential under Va. Code § 32.1-127.1:03. The companion House bill, HB 668, was left in committee. LegiScan codes SB 269 as dead at the end of the 2026 session; LegiScan is the source for status and text.",
   "added": "2026-09-29"
  },
  {
   "id": "va-naic-ai-bulletin-2024",
   "state": "VA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Administrative Letter 2024-01, The Use of Artificial Intelligence Systems",
   "status": "effective",
   "signed": "2024-07-22",
   "effective": "2024-07-22",
   "applies_to": "All companies licensed to conduct the business of insurance in Virginia, including health insurers",
   "summary": "Tells insurers that decisions and actions affecting consumers that are made or supported by AI systems must comply with insurance law, including the laws on unfair trade practices, unfair claim settlement practices and unfair discrimination, and sets expectations for a written AI systems program covering governance, risk management, internal controls and third-party AI systems, which the Bureau of Insurance may review in investigations and market conduct examinations.",
   "physician_read": "It places no duty on physicians. Since July 22, 2024, the Bureau of Insurance has told insurers, including health insurers, that claim and coverage decisions made or supported by AI must comply with the unfair claim settlement practice and unfair discrimination laws.",
   "sources": [
    {
     "label": "Administrative Letter 2024-01 (State Corporation Commission)",
     "url": "https://scc.virginia.gov/getattachment/3c3e4956-45f1-4c12-ad5c-b55275f29e4b/AL-2024-01.pdf"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Virginia's version of the NAIC Model Bulletin: it follows the model's four sections (introduction and authority, definitions, regulatory guidance and expectations, regulatory oversight and examination), and the NAIC's adoption map lists it as adopted July 22, 2024. Signed by Commissioner of Insurance Scott A. White. The letter states no separate effective date; the issue date is used.",
   "added": "2026-09-29"
  },
  {
   "id": "va-sb586-2026",
   "state": "VA",
   "category": "payer",
   "also": [
    "disclosure"
   ],
   "kind": "law",
   "name": "SB 586, Health carriers; use of artificial intelligence, disclosures",
   "status": "introduced",
   "signed": "",
   "effective": "",
   "applies_to": "Health carriers regulated by the State Corporation Commission's Bureau of Insurance",
   "summary": "As passed by the Senate, would require each health carrier to disclose to the Bureau of Insurance its use of AI to manage claims and coverage, including underlying algorithms, data used and resulting determinations, submit information, documents and software on request, keep documentation of AI decisions for at least three years, and notify enrollees and health care providers when AI has been used to issue an adverse determination, with a clear and timely process to appeal it.",
   "physician_read": "It binds no one yet. If enacted as passed by the Senate, a carrier would have to tell the physician as well as the patient when AI was used to issue an adverse determination and offer a clear and timely appeal process.",
   "sources": [
    {
     "label": "LegiScan bill page and history",
     "url": "https://legiscan.com/VA/bill/SB586/2026"
    },
    {
     "label": "Senate substitute text (LegiScan)",
     "url": "https://legiscan.com/VA/text/SB586/id/3345037"
    },
    {
     "label": "Introduced text (LegiScan)",
     "url": "https://legiscan.com/VA/text/SB586/id/3323196"
    },
    {
     "label": "Cardinal News (secondary)",
     "url": "https://cardinalnews.org/2026/03/17/from-artificial-intelligence-to-zoos-heres-what-happened-to-some-of-the-key-bills-in-richmond/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Senate Commerce and Labor Committee reported a substitute 9-6 on Feb. 2, 2026. On Feb. 6, 2026, the Senate passed the bill 22-18, agreed to reconsider, and passed it again 23-16 (LegiScan history). On Feb. 23, 2026, the House Communications, Technology and Innovation Committee continued it to the 2027 session by voice vote, so it carries over; LegiScan codes it as dead at the end of the 2026 session. The Senate substitute adds a subdivision to Va. Code § 38.2-3407.15 (carrier business practices) and has no separate effective date clause. The introduced bill would have barred carriers from relying exclusively on AI or automated decision tools to deny, reduce or alter coverage or claims for medically necessary care, required review of adverse determinations by physicians or other licensed health care professionals in the appropriate specialties, allowed expedited external review and set civil penalties of up to $50,000 per violation; the Senate substitute dropped those provisions, and the Cardinal News summary matches the introduced version. LegiScan is the source for status and text.",
   "added": "2026-09-29"
  },
  {
   "id": "va-hb2307-2021",
   "state": "VA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 2307 and SB 1392, Consumer Data Protection Act",
   "status": "effective",
   "signed": "2021-03-02",
   "effective": "2023-01-01",
   "applies_to": "Businesses that control or process personal data of at least 100,000 Virginia consumers a year, or of at least 25,000 while deriving over half of gross revenue from selling personal data; HIPAA covered entities, business associates and protected health information are exempt",
   "summary": "Gives consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent to process sensitive data, including a mental or physical health diagnosis, genetic or biometric data and precise geolocation, and requires data protection assessments for sensitive data and for profiling that poses foreseeable risks.",
   "physician_read": "It places no duty on a practice that is a HIPAA covered entity, and protected health information is exempt. Since Jan. 1, 2023, health apps and other businesses above the thresholds need a Virginia consumer's consent to process data revealing a mental or physical health diagnosis.",
   "sources": [
    {
     "label": "Va. Code title 59.1, chapter 53",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/"
    },
    {
     "label": "LegiScan, HB 2307 (2021 Special Session I)",
     "url": "https://legiscan.com/VA/bill/HB2307/2021/X1"
    },
    {
     "label": "LegiScan, SB 1392 (2021 Special Session I)",
     "url": "https://legiscan.com/VA/bill/SB1392/2021/X1"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Enacted in the 2021 Special Session I as Chapters 35 (HB 2307) and 36 (SB 1392), both approved March 2, 2021. Amendments that add minors' and precise-geolocation provisions have their own entries (HB 707 and SB 361 of 2024, SB 854 of 2025, SB 338 of 2026); the 2022 amendments (Chapters 423, 451 and 452) did not add health, biometric, minors' or profiling provisions.",
   "added": "2026-09-29"
  },
  {
   "id": "va-hb707-2024",
   "state": "VA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 707 and SB 361, Consumer Data Protection Act; protections for children",
   "status": "effective",
   "signed": "2024-05-17",
   "effective": "2025-01-01",
   "applies_to": "Controllers covered by the Consumer Data Protection Act that process personal data of known children under 13",
   "summary": "Bars covered controllers, without a parent's consent obtained under the federal Children's Online Privacy Protection Act, from processing a known child's personal data for targeted advertising, sale or profiling in furtherance of decisions with legal or similarly significant effects, and from collecting a child's precise geolocation data unless reasonably necessary for the online service and signaled to the child throughout collection, and adds children's data to data protection assessments for online services directed to children.",
   "physician_read": "It places no duty on a practice that is a HIPAA covered entity. Since Jan. 1, 2025, apps and online services covered by the act need a parent's COPPA consent before using a known child's data for targeted advertising, sale or profiling.",
   "sources": [
    {
     "label": "Va. Code § 59.1-578",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/"
    },
    {
     "label": "LegiScan, HB 707 (2024)",
     "url": "https://legiscan.com/VA/bill/HB707/2024"
    },
    {
     "label": "LegiScan, SB 361 (2024)",
     "url": "https://legiscan.com/VA/bill/SB361/2024"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapters 840 (HB 707) and 844 (SB 361) of the 2024 Acts of Assembly, approved May 17, 2024, after the General Assembly rejected the Governor's recommendations on April 17, 2024. The act defines a child as a person younger than 13. The provisions are in Va. Code § 59.1-578 F and § 59.1-580.",
   "added": "2026-09-29"
  },
  {
   "id": "va-sb338-2026",
   "state": "VA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 338, Consumer Data Protection Act; data controller responsibilities, precise geolocation data",
   "status": "effective",
   "signed": "2026-04-13",
   "effective": "2026-07-01",
   "applies_to": "Controllers covered by the Consumer Data Protection Act",
   "summary": "Bars covered controllers from selling or offering for sale precise geolocation data concerning a consumer, meaning location data accurate to within a radius of 1,750 feet.",
   "physician_read": "It places no duty on a practice that is a HIPAA covered entity. Since July 1, 2026, apps and other businesses covered by the act cannot sell a Virginia consumer's precise geolocation data.",
   "sources": [
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/VA/bill/SB338/2026"
    },
    {
     "label": "Chaptered text (LegiScan)",
     "url": "https://legiscan.com/VA/text/SB338/id/3426218"
    },
    {
     "label": "Va. Code § 59.1-578",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/"
    },
    {
     "label": "Va. Code § 59.1-575 (definition of precise geolocation data)",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/"
    },
    {
     "label": "Va. Const. art. IV, § 13 (default effective date)",
     "url": "https://law.lis.virginia.gov/constitution/article4/section13/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 820 of the 2026 Acts of Assembly, approved April 13, 2026. The chaptered text has no effective date clause, so the July 1 date for laws enacted at a regular session applies (Va. Const. art. IV, § 13), as LegiScan's history also shows. The 1,750-foot radius comes from the act's existing definition of precise geolocation data (Va. Code § 59.1-575). Before this amendment, precise geolocation data was already sensitive data that required consent to process.",
   "added": "2026-09-29"
  },
  {
   "id": "va-sb754-2025",
   "state": "VA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "SB 754, Consumer Protection Act; prohibited practices, etc., reproductive or sexual health information",
   "status": "effective",
   "signed": "2025-03-24",
   "effective": "2025-07-01",
   "applies_to": "Suppliers in consumer transactions under the Virginia Consumer Protection Act",
   "summary": "Makes it a prohibited practice under the Virginia Consumer Protection Act to obtain, disclose, sell or disseminate personally identifiable reproductive or sexual health information without the consumer's consent, defining that information to include data derived or extrapolated from non-health information, including inferred or algorithmic data.",
   "physician_read": "Since July 1, 2025, a supplier that, in connection with a consumer transaction, obtains, discloses, sells or disseminates a consumer's personally identifiable reproductive or sexual health information without consent commits a prohibited practice under the Consumer Protection Act. That act has no HIPAA exemption, but it excludes aspects of a transaction authorized under state or federal law.",
   "sources": [
    {
     "label": "Va. Code § 59.1-200 (A 85)",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-200/"
    },
    {
     "label": "Va. Code § 59.1-198 (definition)",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-198/"
    },
    {
     "label": "Va. Code § 59.1-199 (exclusions)",
     "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter17/section59.1-199/"
    },
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/VA/bill/SB754/2025"
    },
    {
     "label": "Va. Const. art. IV, § 13 (default effective date)",
     "url": "https://law.lis.virginia.gov/constitution/article4/section13/"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 591 of the 2025 Acts of Assembly. The lead listed it as a 2024 law; the bill was prefiled Dec. 5, 2024, for the 2025 session and approved March 24, 2025. LegiScan's history gives July 1, 2025 as the effective date, the regular date for laws enacted at a regular session (Va. Const. art. IV, § 13). It amends the Consumer Protection Act (Va. Code §§ 59.1-198 and 59.1-200), not the Consumer Data Protection Act, so the Consumer Data Protection Act's HIPAA exemptions do not apply to it; the Consumer Protection Act's definition of supplier includes a professional who engages in consumer transactions, and its general exclusion for aspects of a transaction authorized under state or federal law (§ 59.1-199) applies.",
   "added": "2026-09-29"
  },
  {
   "id": "vt-h816-2026",
   "state": "VT",
   "category": "mental-health",
   "also": [
    "clinical"
   ],
   "kind": "law",
   "name": "H.816, Act 156, An act relating to regulating the use of artificial intelligence in the provision of mental health services",
   "status": "effective",
   "signed": "2026-06-17",
   "effective": "2026-06-17",
   "applies_to": "Corporations and entities offering mental health services to the public, and mental health professionals, a term that includes physicians licensed under 26 V.S.A. chapter 23 or 33",
   "summary": "Bars a corporation or entity from providing, advertising or offering mental health services to the public, including through AI, unless a mental health professional provides them or they are part of approved research, lets mental health professionals use HIPAA-compliant AI tools if they review and approve any mental health services provided, allows FDA-authorized digital therapeutics prescribed or recommended by a professional, and makes prohibited AI use unprofessional conduct.",
   "physician_read": "Since June 17, 2026, a Vermont physician or other mental health professional may use HIPAA-compliant AI tools in mental health care provided the professional reviews and approves any mental health services, and a licensee's prohibited use of AI under the new law is unprofessional conduct subject to discipline. A corporation or entity may not provide, advertise or offer mental health services to the public, including through AI, unless a mental health professional provides them.",
   "sources": [
    {
     "label": "Vermont Legislature, bill status page",
     "url": "https://legislature.vermont.gov/bill/status/2026/H.816"
    },
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/VT/bill/H816/2025"
    },
    {
     "label": "Act 156, chaptered text (via LegiScan)",
     "url": "https://legiscan.com/VT/text/H816/id/3449639/Vermont-2025-H816-Chaptered.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "The Vermont Legislature's bill status page shows Act 156 and the governor's approval on June 17, 2026; LegiScan's history shows the conference report adopted May 22, 2026, delivery to the governor June 11 and signing June 17, 2026. The act's text was read in LegiScan's copy of the chaptered act. Section 3 adds 18 V.S.A. section 7115; sections 2 and 4 add prohibited AI use to the unprofessional conduct lists in 3 V.S.A. section 129a (professions regulated by the Office of Professional Regulation) and 26 V.S.A. section 1354 (Board of Medical Practice). A violation by a corporation or entity is a violation of the Consumer Protection Act, 9 V.S.A. chapter 63. Section 5 lists the Director of Professional Regulation and the Executive Director of the Vermont Board of Medical Practice among the members of the Artificial Intelligence Advisory Council, and section 6 requires the council to report on regulating mental health professionals' AI use by Jan. 15, 2027. The act took effect on passage; the governor approved it June 17, 2026.",
   "added": "2026-09-29"
  },
  {
   "id": "vt-naic-ai-bulletin-2024",
   "state": "VT",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Bulletin No. 229, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-03-12",
   "effective": "2024-03-12",
   "applies_to": "All insurers holding a certificate of authority in Vermont, including health insurers",
   "summary": "Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, covering governance, risk management and internal controls, and third-party AI systems and data, states that decisions made using AI systems must comply with the legal and regulatory standards that apply to them, including unfair trade practice and claim settlement rules, and tells insurers they can expect questions about their AI use in any investigation or market conduct action.",
   "physician_read": "It places no duty on physicians. Since March 12, 2024, insurers in Vermont, including health insurers, are expected to govern AI systems used in decisions that affect patients, and the Department of Financial Regulation may ask about that use in investigations and market conduct actions.",
   "sources": [
    {
     "label": "Insurance Bulletin No. 229",
     "url": "https://dfr.vermont.gov/sites/finreg/files/regbul/dfr-insurance-bulletin-229-ai.pdf"
    },
    {
     "label": "Department of Financial Regulation, bulletin page",
     "url": "https://dfr.vermont.gov/content/use-artificial-intelligence-systems-insurance"
    },
    {
     "label": "Department of Financial Regulation, regulations, orders and bulletins index",
     "url": "https://dfr.vermont.gov/view/regbul?tid=All&field_rb_type_value=Bulletin"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued March 12, 2024 by Commissioner Kevin Gaffney to all insurers holding certificates of authority in Vermont. The NAIC's Aug. 31, 2026 map lists Bulletin 229 as Vermont's adoption of the NAIC Model Bulletin; the bulletin follows the model's structure (four sections, with an AIS Program covering general guidelines, governance, risk management and internal controls, and third-party AI systems and data) and cites the NAIC's 2020 AI Principles, but its text does not name the model bulletin. It cites Vermont's unfair trade practice and claim settlement provisions (8 V.S.A. sections 4721 to 4724 and 4727, and Regulation 79-2) and health insurance rate statutes (8 V.S.A. sections 4062, 4083 and 5104). It sets no separate effective date, so the issue date is used. Insurance Bulletin 240 (2026), which withdrew obsolete bulletins, does not list Bulletin 229, and the Department's index still lists it.",
   "added": "2026-09-29"
  },
  {
   "id": "vt-s71-2026",
   "state": "VT",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "S.71, Act 145, An act relating to consumer data privacy and online surveillance (Vermont Data Privacy and Online Surveillance Act)",
   "status": "enacted",
   "signed": "2026-06-16",
   "effective": "2028-01-01",
   "applies_to": "Controllers that process personal data of at least 35,000 consumers, process sensitive data of at least 3,000 consumers or sell personal data of at least 3,000 consumers; the consumer health data rules apply to any person; HIPAA covered entities and business associates are exempt",
   "summary": "Creates a comprehensive consumer privacy law that allows processing of sensitive data, including health condition, diagnosis, disability or treatment data, consumer health data, genetic, biometric, neural and precise geolocation data, only with consent and when reasonably necessary for the purpose collected, limits collection to what is reasonably necessary and proportionate, requires consent before selling consumer health data, bars health-data geofences within 1,850 feet of any health care facility, and requires privacy notices to say whether personal data are used to train large language models.",
   "physician_read": "It places no duty on HIPAA covered entities or business associates, which are exempt. From Jan. 1, 2028, any business outside HIPAA that handles Vermont patients' consumer health data, such as a health app, will need consent to sell it and cannot use a geofence within 1,850 feet of a health care facility to identify, track, collect data from or send notifications to consumers about their health data, whatever its size.",
   "sources": [
    {
     "label": "Vermont Legislature, bill status page",
     "url": "https://legislature.vermont.gov/bill/status/2026/S.71"
    },
    {
     "label": "LegiScan bill page",
     "url": "https://legiscan.com/VT/bill/S71/2025"
    },
    {
     "label": "Act 145, chaptered text (via LegiScan)",
     "url": "https://legiscan.com/VT/text/S71/id/3449610/Vermont-2025-S71-Chaptered.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Codified as 9 V.S.A. chapter 61A; the consumer health data rules are in section 2415k and the large language model disclosure in section 2415e. The Senate passed S.71 March 27, 2025; the House passed it with amendments May 26, 2026 (129-3); the Senate concurred May 29, 2026; the governor signed it June 16, 2026, as LegiScan and the Vermont Legislature's bill status page show. The Attorney General enforces it under the Consumer Protection Act, with no private right of action; from Jan. 1, 2028 to June 30, 2029 the Attorney General must first issue a notice of violation, with 60 days to cure, when the Attorney General determines a cure is possible. The HIPAA exemption covers covered entities that are not hybrid entities, the health care components of hybrid entities, and business associates. The act's text was read in LegiScan's copy of the chaptered act.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-hb2155-2026",
   "state": "WA",
   "category": "clinical",
   "also": [],
   "kind": "law",
   "name": "HB 2155, Concerning the Use of Nursing Titles",
   "status": "effective",
   "signed": "2026-03-09",
   "effective": "2026-06-11",
   "applies_to": "Any person or nonhuman entity that uses a nursing title in Washington",
   "summary": "Limits the practice of nursing to licensed human persons and bars any nonhuman entity from assuming nursing titles or using abbreviations or other words, letters, signs or figures indicating that it is a registered nurse, advanced registered nurse practitioner or licensed practical nurse, including the titles nurse, registered nurse, nurse practitioner and licensed practical nurse and the abbreviations RN, ARNP, NP and LPN.",
   "physician_read": "Since June 11, 2026, an AI tool, chatbot or other nonhuman entity used by a practice or health system in Washington may not use a nursing title or abbreviation, such as nurse or registered nurse, or otherwise indicate that it is a nurse.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://app.leg.wa.gov/billsummary?BillNumber=2155&Initiative=false&Year=2025"
    },
    {
     "label": "Session law, chapter 6, Laws of 2026",
     "url": "https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/House/2155.SL.pdf"
    },
    {
     "label": "Final bill report",
     "url": "https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bill%20Reports/House/2155%20HBR%20FBR%2026.pdf"
    },
    {
     "label": "Washington State Nurses Association (secondary)",
     "url": "https://www.wsna.org/news/2026/sorry-ai-you-cant-call-yourself-a-nurse"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 6, Laws of 2026; amends RCW 18.79.030. The text refers to 'nonhuman entities' and neither defines the term nor mentions AI; a Washington State Nurses Association article quotes Gov. Bob Ferguson saying AI cannot act as a licensed nurse or claim to be one. Section 1 expires June 30, 2027, when section 2 takes effect; section 2, the version of RCW 18.79.030 reflecting chapter 239, Laws of 2024, applies the same bar using advanced practice registered nurse and APRN in place of advanced registered nurse practitioner and ARNP.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-hb2225-2026",
   "state": "WA",
   "category": "clinical",
   "also": [
    "disclosure",
    "mental-health"
   ],
   "kind": "law",
   "name": "HB 2225, Regulating Artificial Intelligence Companion Chatbots",
   "status": "enacted",
   "signed": "2026-03-24",
   "effective": "2027-01-01",
   "applies_to": "Operators that make an AI companion chatbot available to users in Washington",
   "summary": "Requires operators of AI companion chatbots to disclose that the chatbot is artificially generated and not human at the start of an interaction and at least every three hours (at least hourly when the operator knows the user is a minor or the chatbot is directed to minors), to keep and publish a protocol for detecting and addressing suicidal ideation and self-harm, including eating disorders, that refers users to a suicide hotline or crisis text line, and to prevent sexually explicit content and manipulative engagement techniques with minors.",
   "physician_read": "It places no duty on physicians. From Jan. 1, 2027, companion chatbots available to patients in Washington must state that they are not human and must refer users who express suicidal ideation or self-harm to crisis services, and violations are enforceable under the Consumer Protection Act.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://app.leg.wa.gov/billsummary?BillNumber=2225&Initiative=false&Year=2025"
    },
    {
     "label": "Session law, chapter 168, Laws of 2026",
     "url": "https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/House/2225-S.SL.pdf"
    },
    {
     "label": "Hunton (secondary)",
     "url": "https://www.hunton.com/privacy-and-cybersecurity-law-blog/washington-state-enacts-law-regulating-ai-companion-chatbots-with-private-right-of-action"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Requested by Gov. Bob Ferguson; approved March 24, 2026, and filed March 25, 2026. The law excludes business bots that do not sustain a relationship, limited game bots, voice assistants without relationship continuity and curriculum tools used in schools. Violations are unfair or deceptive acts under the Consumer Protection Act (chapter 19.86 RCW); law firm summaries describe the resulting private right of action. Operators must publicly disclose their protocol and, on their websites, the number of crisis referral notifications issued in the preceding calendar year. The minors' protections apply when the operator knows the user is a minor or the chatbot is directed to minors.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-naic-ai-bulletin-2024",
   "state": "WA",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Technical Assistance Advisory 2024-02, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2024-04-22",
   "effective": "2024-04-22",
   "applies_to": "Insurers holding certificates of authority to do business in Washington",
   "summary": "Reminds insurers that decisions made or supported by AI systems must comply with insurance law, including unfair trade practice and unfair discrimination laws, and, following the NAIC model bulletin, sets out the Office's expectation that insurers keep a written AI systems program with senior management accountable to the board, risk controls, due diligence and audit rights over third-party vendors, and documentation the Office may request in investigations and market conduct actions.",
   "physician_read": "It places no duty on physicians. Since April 22, 2024, insurers holding certificates of authority in Washington have been expected to govern, test and document the AI systems they use in decisions affecting consumers; limits in statute on health carriers' use of AI in prior authorization followed in SB 5395 (2026).",
   "sources": [
    {
     "label": "Office of the Insurance Commissioner advisory",
     "url": "https://www.insurance.wa.gov/sites/default/files/2024-09/2024-02-naic-ai-technical-assistance-advisory.pdf"
    },
    {
     "label": "Washington State Register, WSR 24-10-025",
     "url": "https://lawfilesext.leg.wa.gov/Law/WSR/2024/10/24-10-025.htm"
    },
    {
     "label": "RCW 48.05.030, certificate of authority required",
     "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=48.05.030"
    },
    {
     "label": "RCW 48.44.015, health care service contractor registration",
     "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=48.44.015"
    },
    {
     "label": "RCW 48.46.027, health maintenance organization registration",
     "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=48.46.027"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026 (secondary)",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Filed in the Washington State Register as WSR 24-10-025 at 1:36 p.m. on April 22, 2024. Footnote 1 describes it as a policy statement of the office's current opinions, approaches and likely courses of action, and footnote 2 says it is based on the NAIC model bulletin. It is addressed to 'All Insurers Licensed to Do Business in Washington' and speaks to 'all insurers that hold certificates of authority to do business in the state'; it does not mention health care service contractors, health maintenance organizations or health carriers. Health care service contractors and HMOs register with the commissioner under RCW 48.44.015 and RCW 48.46.027 rather than holding the certificate of authority RCW 48.05.030 requires of insurers, so the advisory's terms do not name them; whether the office applies it to them in practice is not stated.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-sb5395-2026",
   "state": "WA",
   "category": "payer",
   "also": [],
   "kind": "law",
   "name": "SB 5395, Making Improvements to Transparency and Accountability in the Prior Authorization Determination Process",
   "status": "effective",
   "signed": "2026-03-23",
   "effective": "2026-06-11",
   "applies_to": "Health carriers and their contracted health care benefit managers, and public and school employee health plans (PEBB and SEBB), that use AI in prior authorization",
   "summary": "Bars AI from being the sole means used to deny, delay or modify health care services, bars algorithms from being used without human review to deny care based on medical necessity, allows only a licensed physician or licensed health professional working within scope to deny a prior authorization request based on medical necessity, requires AI used in prior authorization to base determinations on the enrollee's own medical or clinical history and the clinical circumstances the requesting provider presents rather than solely on a group data set, makes carriers' AI policies and procedures open to audit by the Office of the Insurance Commissioner, and adds the share of denials aided by AI to carriers' annual prior authorization reports.",
   "physician_read": "Since June 11, 2026, a state-regulated health carrier or a PEBB or SEBB plan may use algorithms to process and approve prior authorization requests, but AI cannot be the sole means of denying, delaying or modifying care, and only a licensed physician or licensed health professional working within scope may deny a request based on medical necessity. A carrier's AI must base its determinations on the patient's own clinical history and the circumstances the requesting provider presents, not on a group data set alone.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://app.leg.wa.gov/billsummary?BillNumber=5395&Initiative=false&Year=2025"
    },
    {
     "label": "Session law, chapter 157, Laws of 2026",
     "url": "https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/Senate/5395-S2.SL.pdf"
    },
    {
     "label": "Final bill report",
     "url": "https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bill%20Reports/Senate/5395-S2.E%20SBR%20FBR%2026.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Amends RCW 48.43.830 (carriers), RCW 41.05.845 (PEBB and SEBB plans) and RCW 48.43.0161 (annual prior authorization reporting), among other sections. The session law records the governor's approval at 3:32 p.m. on March 23, 2026, and filing March 24, 2026. Sections 2 and 6, the current versions of RCW 48.43.830 and of RCW 48.43.535 (independent review), expire Jan. 1, 2027, when sections 3 and 7 take effect; section 3 keeps the AI provisions and adds that clinical review criteria for mental health and substance use disorder prior authorization requests must meet RCW 48.43.766. Section 1 states the Legislature's intent to extend the act's protections to managed care organizations 'as soon as feasible'; they are not covered now. The AI conditions also apply to prior authorization functions carried out by health care benefit managers under contract with a carrier.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-hb1155-2023",
   "state": "WA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 1155, My Health My Data Act",
   "status": "effective",
   "signed": "2023-04-27",
   "effective": "2024-03-31",
   "applies_to": "Regulated entities and small businesses that collect, process, share or sell Washington consumers' health data, and their processors; the geofencing ban applies to any person",
   "summary": "Requires a consumer health data privacy policy, separate consent before collecting or sharing consumer health data, including biometric data and health data inferred by algorithms or machine learning, a signed authorization before selling it, and rights to access and delete it, and bars geofencing around entities that provide in-person health care services.",
   "physician_read": "HIPAA protected health information is exempt, but consumer health data collected outside HIPAA, for example by health apps, wellness services or websites, has required separate consent before collection or sharing since March 31, 2024 (June 30, 2024 for small businesses). Since July 23, 2023, no one may use a geofence around an in-person health care provider to identify or track people seeking care, collect their health data or send them health-related messages or ads, and violations are enforceable by the attorney general and by private suit under the Consumer Protection Act.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://app.leg.wa.gov/billsummary?BillNumber=1155&Initiative=false&Year=2023"
    },
    {
     "label": "Chapter 19.373 RCW",
     "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true"
    },
    {
     "label": "Attorney General",
     "url": "https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 191, Laws of 2023. The bill page lists July 23, 2023 as the effective date; the Attorney General applies section 10 (geofencing) to all persons from that date and sections 4 through 9 to regulated entities from March 31, 2024 and to small businesses from June 30, 2024. Violations are per se violations of the Consumer Protection Act. The RCW chapter shows no amendments since 2023.",
   "added": "2026-09-29"
  },
  {
   "id": "wa-hb1493-2017",
   "state": "WA",
   "category": "privacy",
   "also": [],
   "kind": "law",
   "name": "HB 1493, Concerning Biometric Identifiers",
   "status": "effective",
   "signed": "2017-05-16",
   "effective": "2017-07-23",
   "applies_to": "Any person that enrolls biometric identifiers in a database for a commercial purpose",
   "summary": "Bars enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent or providing a mechanism to prevent the subsequent use of the identifier for a commercial purpose, limits selling or disclosing enrolled identifiers, and limits retention to what is reasonably necessary.",
   "physician_read": "Since July 23, 2017, anyone who enrolls fingerprints, voiceprints, iris or retina patterns or similar biometric identifiers in a database for a commercial purpose must first provide notice, obtain consent or provide a mechanism to prevent later commercial use; the definition excludes photographs, video or audio recordings and information collected, used or stored for health care treatment, payment or operations under HIPAA. Only the attorney general enforces it.",
   "sources": [
    {
     "label": "Bill page",
     "url": "https://app.leg.wa.gov/billsummary?BillNumber=1493&Initiative=false&Year=2017"
    },
    {
     "label": "Chapter 19.375 RCW",
     "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.375&full=true"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Chapter 299, Laws of 2017, codified at chapter 19.375 RCW. RCW 19.375.020(2) says the exact notice and type of consent required are context-dependent. Enforced solely by the attorney general under the Consumer Protection Act (RCW 19.375.030); there is no private right of action. Biometric data is also consumer health data under the My Health My Data Act (2023), which carries its own consent rules and private right of action.",
   "added": "2026-09-29"
  },
  {
   "id": "wi-naic-ai-bulletin-2025",
   "state": "WI",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Bulletin of March 18, 2025, The Use of Artificial Intelligence Systems in Insurance",
   "status": "effective",
   "signed": "2025-03-18",
   "effective": "2025-03-18",
   "applies_to": "All insurers regulated by the Office of the Commissioner of Insurance, including health insurers",
   "summary": "Expects insurers to adopt a written AI systems program with governance, risk management and internal audit functions proportionate to the potential harm to consumers, to monitor model drift and validate AI outputs against unfairly discriminatory or inaccurate results, to perform due diligence on third-party AI systems and data, and to produce documentation to the Office on request, and reminds insurers that AI-supported decisions must meet existing insurance laws, including the unfair trade practice and claim settlement rules.",
   "physician_read": "It places no duty on physicians. Since March 2025, health insurers in Wisconsin are expected to govern the AI systems they use in decisions that affect consumers and to show the Office of the Commissioner of Insurance their controls on request.",
   "sources": [
    {
     "label": "Office of the Commissioner of Insurance bulletin",
     "url": "https://oci.wi.gov/Documents/Regulation/Bulletin20250318AI.pdf"
    },
    {
     "label": "Office of the Commissioner of Insurance bulletins index",
     "url": "https://oci.wi.gov/Pages/Regulation/Bulletins.aspx"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "Issued by Commissioner Nathan Houdek and addressed to all insurers and interested parties; it carries no number. The bulletin states no separate effective date; the issue date is used. It does not single out health insurers, utilization review or prior authorization; it cites Wis. Stat. s. 628.34, Wis. Admin. Code s. Ins 6.11 and the corporate governance disclosure rules, and refers to the NAIC's 2020 AI principles. The office's bulletins index lists it under March 18, 2025. The NAIC's map lists it as Wisconsin's adoption of the model bulletin.",
   "added": "2026-09-29"
  },
  {
   "id": "wv-naic-ai-bulletin-2024",
   "state": "WV",
   "category": "payer",
   "also": [],
   "kind": "policy",
   "name": "Insurance Bulletin No. 24-06, Artificial Intelligence Systems",
   "status": "effective",
   "signed": "2024-08-09",
   "effective": "2024-08-09",
   "applies_to": "All insurers authorized to do business in West Virginia and regulated by the Offices of the Insurance Commissioner, including health insurers",
   "summary": "Tells insurers that decisions or actions affecting consumers that are made or supported by AI systems must comply with state insurance laws and rules, including those on unfair trade practices, unfair claims settlement practices and unfair discrimination, and sets expectations for a written AI systems program covering governance, risk management and internal controls, and third-party AI systems and data.",
   "physician_read": "It places no duty on physicians. Since Aug. 9, 2024, the Insurance Commissioner has told insurers, health insurers among them, that claim and other decisions made or supported by AI must meet state insurance law, such as the unfair claims settlement practice laws, and that each insurer can expect to be asked about its development and use of AI systems whether or not it has a written AI program.",
   "sources": [
    {
     "label": "Insurance Bulletin No. 24-06 (Offices of the Insurance Commissioner)",
     "url": "https://www.wvinsurance.gov/Portals/0/pdf/pol_leg/info_letters/IB%2024-06%20Artificial%20Intelligence%20Systems%20.pdf?ver=2024-08-09-140915-787"
    },
    {
     "label": "NAIC adoption map, Aug. 31, 2026",
     "url": "https://content.naic.org/sites/default/files/legal-adoption-map-ai-model-bulletin.pdf"
    }
   ],
   "checked": "2026-09-29",
   "notes": "West Virginia's version of the NAIC Model Bulletin; the NAIC's adoption map lists it as adopted Aug. 9, 2024. Signed by Insurance Commissioner Allan L. McVey. It cites categories of law rather than specific Code sections. The bulletin states no separate effective date; the issue date is used.",
   "added": "2026-09-29"
  }
 ],
 "reviews": [
  {
   "state": "AK",
   "reviewed": "2026-09-29"
  },
  {
   "state": "AL",
   "reviewed": "2026-09-29"
  },
  {
   "state": "AR",
   "reviewed": "2026-09-29"
  },
  {
   "state": "AZ",
   "reviewed": "2026-09-29"
  },
  {
   "state": "CA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "CO",
   "reviewed": "2026-09-29"
  },
  {
   "state": "CT",
   "reviewed": "2026-09-29"
  },
  {
   "state": "DE",
   "reviewed": "2026-09-29"
  },
  {
   "state": "FL",
   "reviewed": "2026-09-29"
  },
  {
   "state": "GA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "HI",
   "reviewed": "2026-09-29"
  },
  {
   "state": "IA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "ID",
   "reviewed": "2026-09-29"
  },
  {
   "state": "IL",
   "reviewed": "2026-09-29"
  },
  {
   "state": "IN",
   "reviewed": "2026-09-29"
  },
  {
   "state": "KS",
   "reviewed": "2026-09-29"
  },
  {
   "state": "KY",
   "reviewed": "2026-09-29"
  },
  {
   "state": "LA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MD",
   "reviewed": "2026-09-29"
  },
  {
   "state": "ME",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MI",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MN",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MO",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MS",
   "reviewed": "2026-09-29"
  },
  {
   "state": "MT",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NC",
   "reviewed": "2026-09-29"
  },
  {
   "state": "ND",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NE",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NH",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NJ",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NM",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NV",
   "reviewed": "2026-09-29"
  },
  {
   "state": "NY",
   "reviewed": "2026-09-29"
  },
  {
   "state": "OH",
   "reviewed": "2026-09-29"
  },
  {
   "state": "OK",
   "reviewed": "2026-09-29"
  },
  {
   "state": "OR",
   "reviewed": "2026-09-29"
  },
  {
   "state": "PA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "RI",
   "reviewed": "2026-09-29"
  },
  {
   "state": "SC",
   "reviewed": "2026-09-29"
  },
  {
   "state": "SD",
   "reviewed": "2026-09-29"
  },
  {
   "state": "TN",
   "reviewed": "2026-09-29"
  },
  {
   "state": "TX",
   "reviewed": "2026-09-29"
  },
  {
   "state": "US",
   "reviewed": "2026-09-29"
  },
  {
   "state": "UT",
   "reviewed": "2026-09-29"
  },
  {
   "state": "VA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "VT",
   "reviewed": "2026-09-29"
  },
  {
   "state": "WA",
   "reviewed": "2026-09-29"
  },
  {
   "state": "WI",
   "reviewed": "2026-09-29"
  },
  {
   "state": "WV",
   "reviewed": "2026-09-29"
  },
  {
   "state": "WY",
   "reviewed": "2026-09-29"
  }
 ]
}