Maryland: AI health laws
3 entries on the map: 3 in force.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin 24-11, The Use of Artificial Intelligence Systems in Insurance
Reminds insurers and health plans that decisions made or supported by AI systems must comply with Maryland insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects a written AI systems program with governance and senior management accountability, risk management and internal audit controls, documentation and due diligence on third-party AI vendors and data.
Physician read. It places no duty on physicians. Since April 22, 2024, insurers, nonprofit health service plans and HMOs in Maryland that use AI in regulated insurance decisions are expected to keep a written AI program with governance, risk controls and vendor oversight, which the Maryland Insurance Administration may review.
Notes: Maryland's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted April 22, 2024. Signed by Commissioner Kathleen A. Birrane. It states no separate effective date; the issue date is used. It does not address utilization review specifically; HB 820 (Chapter 747 of 2025), entered separately, added statutory rules for AI in utilization review.
HB 820, Health Insurance - Utilization Review - Use of Artificial Intelligence (Chapter 747 of 2025)
Requires carriers, pharmacy benefits managers and private review agents that use an AI, algorithm or other software tool for utilization review to ensure it bases determinations on the enrollee's own clinical history and circumstances and not solely on a group dataset, does not replace the health care provider's role in the determination, does not result in unfair discrimination, is open to audit by the Insurance Commissioner and is reviewed at least quarterly, bars such a tool from denying, delaying or modifying health care services, and requires carriers' quarterly reports to state whether such a tool was used in making an adverse decision.
Physician read. Since Oct. 1, 2025, an AI, algorithm or other software tool used by a carrier, pharmacy benefits manager or private review agent for utilization review in Maryland may not deny, delay or modify health care services, must base determinations on the patient's own clinical history, circumstances or other clinical information rather than solely on a group dataset, and may not replace the health care provider's role in the determination. Carriers' quarterly reports to the Maryland Insurance Administration must state whether such a tool was used in making the adverse decisions reported.
Notes: Adds section 15-10B-05.1 to the Insurance Article and amends section 15-10A-06 (quarterly reports on appeals and grievances). Passed the House March 6, 2025 (135-0) and the Senate April 7, 2025 (47-0); approved by the governor May 20, 2025 as Chapter 747, with an Oct. 1, 2025 effective date in the chaptered text. The tool must also comply with applicable law, apply criteria fairly and equitably, have written policies and procedures included in the utilization plan, be reviewed and revised at least quarterly, not use patient data beyond its intended and stated purpose and not directly or indirectly cause harm to an enrollee. Two 2026 bills to add to these rules did not advance: HB 795 (AI Health Insurance Accountability Act of 2026) was withdrawn by its sponsor Feb. 23, 2026, and HB 1385 (human evaluation) had a committee hearing and no further action.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
Nothing in this category was found in the review of Sept 29, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
SB 541, Maryland Online Data Privacy Act of 2024 (Chapter 455 of 2024)
Bars controllers from collecting, processing or sharing sensitive data, which includes consumer health data, genetic and biometric data, precise geolocation and children's data, unless strictly necessary to provide or maintain a product or service the consumer requested, bans the sale of sensitive data, lets consumers opt out of profiling in furtherance of solely automated decisions with legal or similarly significant effects, including decisions on health care services, and requires regular data protection assessments for high-risk processing, including an assessment of each algorithm used.
Physician read. Protected health information under HIPAA is exempt, but HIPAA covered entities are not exempt as entities: a practice that meets the thresholds must follow the act for personal data that is not protected health information. Since Oct. 1, 2025, businesses that meet the thresholds may collect, process or share consumer health data and other sensitive data only when strictly necessary to provide or maintain a product or service the consumer requested, and may not sell it.
Notes: Cross-filed with HB 567. Passed the Senate March 14, 2024 (46-0) and the House April 4, 2024 (103-33); the Senate concurred in House amendments April 6, 2024, and the governor approved it May 9, 2024. The act took effect Oct. 1, 2025, and an uncodified section provides that section 14-4612 of the Commercial Law Article applies only prospectively and has no effect on personal data processing activities before April 1, 2026; in the chaptered text, section 14-4612 lists activities the subtitle does not restrict, and the data protection assessment duty is in section 14-4610. Consumer health data is personal data a controller uses to identify a consumer's physical or mental health status and includes data related to gender-affirming care treatment and reproductive or sexual health care. The HIPAA exemption is data-level: section 14-4603 exempts protected health information and certain other health data but does not list HIPAA covered entities as exempt entities.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.