Oklahoma: AI health laws
2 entries on the map: 1 in force and 1 enacted and not yet in force (main duties begin Jan 1, 2027).
Dates ahead
- Jan 1, 2027
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin No. 2024-11, Use of Artificial Intelligence Systems in Insurance
Reminds insurers that decisions affecting consumers that are made or supported by AI systems must comply with state insurance law, including the unfair practices and Unfair Claims Settlement Practices laws, and expects each insurer to maintain a written AI systems program with governance, risk management and internal controls, oversight of third-party AI systems and documentation the department may review.
Physician read. It places no duty on physicians. Since Nov. 14, 2024, an insurer licensed in Oklahoma, including a health insurer, is expected to govern the AI systems it uses in decisions affecting consumers under a written program.
Notes: Signed by Insurance Commissioner Glen Mulready and addressed to all insurers licensed to do business in Oklahoma. The NAIC's adoption map lists it as Oklahoma's adoption of the NAIC Model Bulletin; the bulletin's text refers to the NAIC's 2020 AI principles, does not single out health insurers or utilization review, and states no separate effective date, so the issue date is used.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
Nothing in this category was found in the review of Sept 29, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
SB 546, Data privacy; establishing consumer rights; appeal process; privacy notice; data protection assessments
Gives consumers rights over their personal data, including to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent before processing sensitive data, including a mental or physical health diagnosis, identifying genetic or biometric data and precise geolocation, and requires data protection assessments for sensitive data and risky profiling.
Physician read. From Jan. 1, 2027, a business covered by the act needs a consumer's consent before processing data revealing a mental or physical health diagnosis, identifying genetic or biometric data, or precise geolocation. HIPAA covered entities, business associates and protected health information are exempt, so it places no new duty on a practice covered by HIPAA.
Notes: Status, dates and text come from LegiScan. Filed in 2025, the bill passed the Senate March 26, 2025 and carried over; the House passed it Feb. 19, 2026, the Senate gave final passage March 16, and the governor approved it March 20, 2026. The enrolled text has no short title and is codified as new sections of Title 75A. The Attorney General enforces it exclusively after a 30-day cure period, with civil penalties of up to $7,500 per violation and no private right of action.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.