New Jersey: AI health laws
5 entries on the map: 3 in force and 2 bills in the legislature.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin No. 25-03, The Use of Artificial Intelligence Systems in Insurance
Reminds insurers that decisions or actions affecting consumers that are made or supported by AI systems must comply with state insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects each insurer to maintain a written AI systems program covering governance, risk management, internal controls, third-party data and AI vendors and documentation, which the department may review.
Physician read. It places no duty on physicians. Since Feb. 11, 2025, a health insurer that uses AI in regulated insurance practices such as claims is expected to keep a written program to prevent inaccurate, unfairly discriminatory or otherwise unlawful decisions, and the Department of Banking and Insurance may request its documentation.
Notes: New Jersey's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted Feb. 11, 2025. Signed by Commissioner Justin Zimmerman. It cites the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act and the Corporate Governance Annual Disclosure Act, and defines an adverse consumer outcome as an insurer decision that adversely affects a consumer in a way that violates the insurance standards the department enforces. It does not mention utilization review or health coverage specifically. The bulletin states no separate effective date; the issue date is used.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
A4731, Directs professional and occupational boards to promulgate rules for licensee use of generative artificial intelligence
Would require the Director of the Division of Consumer Affairs to adopt by rule, within six months of enactment, a model policy for licensees' use of generative AI, and each professional and occupational board to adopt it by rule, with any profession-specific adaptations, within nine months or at its next regularly scheduled meeting after the model policy is established.
Physician read. It binds no one yet. If enacted, the Director of the Division of Consumer Affairs would have six months to adopt a model policy on licensees' use of generative AI, which the State Board of Medical Examiners and other licensing boards would then adopt by rule; the bill does not set the policy's content.
Notes: Reported with amendments by the Assembly Science, Innovation and Technology Committee March 16, 2026 (5-0-2) and reported by the Regulated Professions Committee May 28, 2026 (5-0-2), then referred to Appropriations, where it remains; no Senate companion is listed on LegiScan. The introduced version gave the director three months and the boards six months; the amended version gives the director six months and the boards nine months or their next regularly scheduled meeting after the model policy is established. The act would take effect immediately. N.J.S.A. 45:1-15 lists the State Board of Medical Examiners, the New Jersey Board of Nursing, the State Board of Psychological Examiners and the State Board of Social Work Examiners among the covered boards. Status is from LegiScan.
A4733/S4088, Prohibits advertising generative artificial intelligence as able to practice regulated profession or occupation
Would make it an unlawful practice under the Consumer Fraud Act for a developer or deployer to advertise or represent to the public that generative AI can practice a profession or occupation regulated under Title 45, which includes the licensed health professions, or by the Judicial Branch, with penalties of up to $10,000 for a first offense and $20,000 for later offenses.
Physician read. It binds no one yet and would place no duty on physicians. If enacted, from the first day of the sixth month after enactment, a developer or deployer of generative AI in New Jersey could not advertise or represent to the public that it can practice medicine, nursing, psychology or another profession regulated under Title 45 of the Revised Statutes.
Notes: Reported by the Assembly Science, Innovation and Technology Committee March 16, 2026 (6-0-1) and by the Regulated Professions Committee May 28, 2026 (5-0-2), then referred to Appropriations, where it remains; identical S4088 was referred to Senate Commerce May 4, 2026. The 2026-2027 session continues. Status is from LegiScan. A narrower bill limited to advertising AI as a licensed mental health professional (A799/S735) has not been reported from committee.
Mental health AI
AI in therapy and mental health care.
Also relevant here: A4733/S4088, Prohibits advertising generative artificial intelligence as able to practice regulated profession or occupation (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
S332 (P.L.2023, c.266), An Act concerning online services, consumers, and personal data (New Jersey Data Privacy Act)
Requires consent before processing sensitive data, which includes data revealing a mental or physical health condition, treatment or diagnosis, genetic or biometric data used to identify a person and precise geolocation, lets consumers opt out of targeted advertising, sale of their data and profiling in furtherance of decisions with legal or similarly significant effects, including decisions on health care services, and requires data protection assessments for processing that presents a heightened risk of harm.
Physician read. Protected health information collected by a HIPAA covered entity or business associate is exempt, but covered entities are not exempt as entities: a practice that meets the thresholds must follow the act for personal data that is not protected health information. Since Jan. 15, 2025, businesses that meet the thresholds need a consumer's consent to process data revealing a mental or physical health condition, treatment or diagnosis and must honor opt-outs from profiling in furtherance of decisions about health care services.
Notes: The act has no short title; New Jersey Data Privacy Act is the name commonly used for it, including in the Faegre Drinker summary cited in the P.L.2026, c.25 entry. It received final legislative approval Jan. 8, 2024 (Assembly 46-27; Senate concurrence 21-14) and was approved Jan. 16, 2024; it takes effect on the 365th day after enactment, Jan. 15, 2025. The HIPAA exemption is data-level: the act exempts protected health information collected by a covered entity or business associate, but covered entities and business associates are not exempt as entities, and the act has no general nonprofit exemption. The Director of the Division of Consumer Affairs has rulemaking authority. According to a law firm report, the division proposed implementing rules June 2, 2025 and the proposal expired June 2, 2026 under the Administrative Procedure Act's one-year limit without adoption, with no new proposal issued. P.L.2026, c.25 (entered separately) added a ban on selling sensitive data that applies to controllers of any size. Legislative history is from LegiScan.
A5328 (P.L.2026, c.25), An Act concerning personal data, data brokers, data collectors, and amending P.L.2023, c.266
Amends the New Jersey Data Privacy Act to bar any controller, regardless of the number of consumers whose data it processes, from selling sensitive data, including data revealing a mental or physical health condition, treatment or diagnosis and biometric data, bars data brokers and data collectors from selling or licensing sensitive data and requires them to register annually with the Division of Consumer Affairs and pay a fee.
Physician read. Since June 30, 2026, no person or business of any size, including a medical practice, may sell sensitive data such as data revealing a mental or physical health condition, treatment or diagnosis, although protected health information collected by a HIPAA covered entity or business associate remains exempt. Data brokers and data collectors may not sell or license sensitive data, with penalties of $50,000 for each record sold, offered for sale or licensed, and must register annually with the Division of Consumer Affairs.
Notes: Introduced June 28, 2026 and reported by the Assembly Budget Committee the same day; passed the Assembly June 30, 2026 (52-21), was amended in the Senate, substituted for S2316 and passed the Senate (25-15), received Assembly concurrence (53-20-1) and was approved the same day. The act took effect immediately, except that subsection b. of section 2, the division's duty to establish and maintain a public registry of data brokers and data collectors, stays inoperative for 270 days (to March 27, 2027). A law firm summary describes the delayed part as the registration requirement; in the act's text the annual registration duty is in subsection c., which is not among the delayed provisions. Registration fees run from $5,000 to $1,500,000 depending on the number of consumers; failure to register or report carries $2,500 a day, and selling sensitive data in violation carries $50,000 for each record sold, offered for sale or licensed. Exceptions to the broker ban include protected health information collected by HIPAA covered entities and business associates, GLBA financial institutions, insurance institutions, consumer reporting agencies, government agencies and federally protected human subjects research. The Division of Consumer Affairs enforces. Legislative history is from LegiScan.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.