New Hampshire: AI health laws
2 entries on the map: 2 in force.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin Docket #INS 24-011-AB, adopting the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers
Adopts the NAIC model bulletin, which expects insurers to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of adverse consumer outcomes and addressing governance, risk management controls, internal audit and third-party AI systems and data, and states that decisions made using AI systems must comply with applicable law, including unfair trade practice laws.
Physician read. It places no duty on physicians. Since Feb. 20, 2024, insurers in New Hampshire, including health insurers, are expected under the model bulletin to govern AI systems used in decisions that affect patients and can expect to be asked about that use in investigations and market conduct actions.
Notes: The Insurance Department's bulletin pages could not be opened, so the bulletin's own text, title and signatory could not be checked. The NAIC's Aug. 31, 2026 map lists Bulletin Docket #INS 24-011-AB, adopted Feb. 20, 2024, as New Hampshire's adoption of the NAIC Model Bulletin; the name gives that docket number with the model's title because the title as issued could not be confirmed. The summary describes the model bulletin's text (adopted by the NAIC Dec. 4, 2023), which the state bulletin may have modified. The adoption date is used as the effective date because no other date could be confirmed.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
Nothing in this category was found in the review of Sept 29, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
SB 255, Chapter 5 (2024), relative to the expectation of privacy (RSA 507-H, Expectation of Privacy)
Gives consumers rights over their personal data, including opting out of targeted advertising, sale and profiling in furtherance of solely automated decisions with legal or similarly significant effects, and bars controllers from processing sensitive data, including data revealing a mental or physical health condition and precise geolocation, without the consumer's consent.
Physician read. It places no duty on HIPAA covered entities or business associates, which are exempt as entities. Since Jan. 1, 2025, other businesses above the thresholds, such as health and wellness apps outside HIPAA, need a New Hampshire consumer's consent to process data revealing a mental or physical health condition or diagnosis.
Notes: Creates RSA chapter 507-H. LegiScan's page is the source for status and dates (signed March 6, 2024; chapter 5; effective Jan. 1, 2025). The thresholds and exemptions come from the official RSA text on gc.nh.gov: RSA 507-H:2 reaches persons that conduct business in New Hampshire or target its residents and, in a one-year period, controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or of at least 10,000 unique consumers while deriving more than 25 percent of gross revenue from selling personal data; RSA 507-H:3 exempts covered entities and business associates as entities, and protected health information. RSA 507-H:2's source note shows a 2024 amendment (chapter 229, section 3, effective Jan. 1, 2025 at 12:01 a.m.), and the text of chapter 5 as signed could not be opened, so whether chapter 5 itself set these figures is not confirmed; the only text LegiScan holds is the Senate's amended version of March 16, 2023, which set 100,000 consumers, or 25,000 with more than 25 percent of revenue from data sales. The Attorney General has exclusive enforcement authority; from Jan. 1 to Dec. 31, 2025 the Attorney General had to give notice and 60 days to cure before acting, and may now allow a cure at the Attorney General's discretion.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.