Texas: AI health laws
7 entries on the map: 6 in force and 1 proposed rule.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
SB 815, Relating to the Use of Certain Automated Systems in, and Certain Adverse Determinations Made in Connection With, the Health Benefit Claims Process
Bars a utilization review agent from using an automated decision system to make, wholly or partly, an adverse determination, lets the insurance commissioner audit and inspect its use of such systems at any time, allows algorithms and AI for administrative support or fraud detection, and requires an adverse determination notice to state the principal reasons, the clinical basis, and a description and the source of the screening criteria and review procedures used.
Physician read. For utilization review of health benefit plans delivered, issued or renewed on or after Jan. 1, 2026, an adverse determination cannot be made, wholly or partly, by an automated decision system, and the adverse determination notice must give the principal reasons, the clinical basis and the source of the screening criteria used. It places no duty on physicians.
Notes: Status, dates and text come from LegiScan's bill page and enrolled text. Signed June 20, 2025; the act took effect Sept. 1, 2025 (SECTION 5), but under SECTION 4 it applies only to utilization review for health benefit plans delivered, issued for delivery or renewed on or after Jan. 1, 2026, so plans come under it as they renew. New Insurance Code Sec. 4201.156; SECTION 1 defines an automated decision system as an algorithm, including one incorporating an AI system, that uses data-based analytics to make, suggest or recommend determinations, decisions, judgments or conclusions; SECTION 3 amends Sec. 4201.303(a) on the content of adverse determination notices. The Texas Department of Insurance has proposed rules to implement the act (amendments to 28 TAC Secs. 19.1705(d), 19.1709(c), 19.2005(d) and 19.2009(b)), filed May 1, 2026 and published May 15, 2026, with comments due June 17, 2026; proposed Sec. 19.1705(d) would provide that, consistent with Sec. 4201.156, adverse determinations may only be determined by an appropriate physician, doctor or other health care provider with appropriate credentials. TDI's 2026 rules page showed no adoption filed on Sept. 29, 2026. TDI Bulletin B-0003-26 (June 12, 2026) restates that Chapter 4201 prohibits using AI to make an adverse determination.
Commissioner's Bulletin No. B-0003-26, Use of Artificial Intelligence
States that decisions or actions affecting consumers that are made or supported by AI must comply with all applicable insurance laws, that the department expects a person to review and agree with every consequential decision a regulated entity makes with AI before action is taken, that entities should adopt controls to mitigate the risk of adverse consumer outcomes, and that Insurance Code Chapter 4201 prohibits using AI to make a utilization review adverse determination.
Physician read. It places no duty on physicians. Since June 12, 2026, the department has said it expects insurers and other regulated entities to have a person review and agree with any consequential decision made with AI before acting on it, and to be ready to answer inquiries on AI governance, risk management and internal controls.
Notes: Texas has not adopted the NAIC Model Bulletin; this bulletin recognizes the NAIC's 2020 Principles on Artificial Intelligence as an appropriate guide, recommends the Department of Information Resources' AI Code of Ethics and Minimum Standards, and cites Insurance Code Chapters 541, 542, 544, 4201 and 831, among others. It does not define 'consequential decision.' The NAIC map dated Aug. 31, 2026 lists Texas under insurance-specific guidance but cites an earlier bulletin, B-0036-20 (Sept. 30, 2020), which reminds regulated entities that they are responsible for the accuracy of data used in rating, underwriting and claims handling, including data supplied by third parties, and does not mention AI. The bulletin page shows a last revision on July 16, 2026.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
SB 1188, Relating to Electronic Health Record Requirements; Authorizing a Civil Penalty
Allows a health care practitioner to use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient's medical record, only when acting within the scope of the practitioner's license, when the use is not otherwise restricted by state or federal law, and when the practitioner reviews all records created with AI consistent with Texas Medical Board medical records standards, and requires the practitioner to disclose that use to patients.
Physician read. Since Sept. 1, 2025, a Texas physician who uses AI for diagnostic purposes, including AI recommendations on diagnosis or treatment based on the medical record, must disclose that use to patients and must review all records created with AI in a manner consistent with Texas Medical Board medical records standards. Since Jan. 1, 2026, electronic health records containing patient information must also be physically maintained in the United States or a U.S. territory.
Notes: Status, dates and text come from LegiScan. New Health and Safety Code Sec. 183.005. The act does not define artificial intelligence and does not say when or in what form the disclosure must be made. New Chapter 183 applies to records prepared on or after Sept. 1, 2025; the U.S. storage requirement (Sec. 183.002) applies to storage on or after Jan. 1, 2026, whenever the record was prepared. The attorney general may seek civil penalties of up to $5,000 per violation per year for negligent violations, $25,000 for knowing or intentional violations and $250,000 for violations in which protected health information is knowingly or intentionally used for financial gain (Sec. 183.011), and a licensing agency may take disciplinary action, including suspension or revocation of a license, against a covered entity that violates the chapter three or more times (Sec. 183.010). The Texas Medical Board's rule-changes page, checked Sept. 29, 2026, listed one pending proposal (office-based ketamine therapy) and adopted rule changes effective Jan. 8 and Sept. 3, 2026, none of which addresses AI or records created with AI.
HB 149, Texas Responsible Artificial Intelligence Governance Act
Requires a provider of health care services or treatment that uses an AI system in relation to that service or treatment to give the patient or the patient's personal representative a clear and conspicuous, plain-language disclosure no later than the date the service or treatment is first provided (or as soon as reasonably possible in an emergency), bars developing or deploying an AI system in a manner that intentionally aims to incite or encourage self-harm, including suicide, harm to another person or criminal activity, and amends the state's biometric identifier and data privacy laws for AI.
Physician read. Since Jan. 1, 2026, a physician or practice that uses an AI system in relation to a patient's service or treatment must disclose it to the patient or personal representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency, and the disclosure may not use a dark pattern. The attorney general enforces the act after a 60-day notice and cure period, and a licensing agency may suspend or revoke a license or impose a fine of up to $100,000 once a violation has been found and the attorney general recommends further action.
Notes: Status, dates and text come from LegiScan. Business and Commerce Code Sec. 552.051: the general consumer disclosure duty in subsection (b) applies to governmental agencies, and subsection (f) extends it to providers of health care services or treatment, defined as services provided by an individual licensed, registered or certified to provide them. Sec. 552.052 bars AI aimed at inciting self-harm, harm to others or crime. The attorney general has exclusive enforcement authority; there is no private right of action. Civil penalties: $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation. The act also amended the biometric identifier law, Sec. 503.001 (separate entry), and Sec. 541.104 of the Texas Data Privacy and Security Act, adding processor duties for personal data collected, stored and processed by an AI system, and created an AI regulatory sandbox program administered by the Department of Information Resources (Chapter 553) and the Texas Artificial Intelligence Council (Chapter 554).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Proposed amendments to 16 TAC Chapter 121, Behavior Analysts, including new Sec. 121.100, License Holder Responsibilities Related to the Use of AIs
Would bar a license holder from using AI as the sole basis for a client treatment design, assessment, treatment implementation, report or treatment plan evaluation, require individual review of any of these generated in whole or in part by AI, require the license holder, when AI-generated material recommends restrictive or punishment-based procedures, to personally ensure that less intrusive means will not work and that the benefit outweighs the risk of harm and to document the rationale, require AI-derived changes to rest on evidence the license holder personally verified and to be explained to the client in understandable language, and require written client consent before using the client's data for AI in client services, to train AI or for research.
Physician read. It places no duty on physicians. If adopted, licensed behavior analysts could not rely on AI alone for a client's treatment design, assessment, report or plan evaluation and would need written client consent before using client data with AI.
Notes: Published in the Texas Register June 19, 2026 (TRD-202602327), the date used as the signed date. The register notice set comments at 30 days after publication and July 19, 2026 as the earliest possible adoption date; TDLR's summary page gave a comment deadline of July 20, 2026. No adoption or withdrawal of the Chapter 121 proposal appears in the tables of contents of the Texas Register issues of July 3 through Sept. 25, 2026, checked Sept. 29, 2026; TDLR's own rules pages could not be opened. Proposed Sec. 121.100(d) would also bar using AI to create a treatment design, assessment or treatment implementation outside the license holder's training, competence and scope. The consent requirement is in proposed Sec. 121.75(b)(12). The proposal defines an AI system by reference to Business and Commerce Code Sec. 551.001(1), added by HB 149.
Also relevant here: SB 1188, Relating to Electronic Health Record Requirements; Authorizing a Civil Penalty (under patient disclosure of AI use); HB 149, Texas Responsible Artificial Intelligence Governance Act (under patient disclosure of AI use).
Mental health AI
AI in therapy and mental health care.
Also relevant here: Proposed amendments to 16 TAC Chapter 121, Behavior Analysts, including new Sec. 121.100, License Holder Responsibilities Related to the Use of AIs (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
Capture or Use of Biometric Identifier Act, Business and Commerce Code Sec. 503.001
Bars capturing a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose without first informing the individual and receiving consent, limits sale, lease or disclosure, requires reasonable care in storage and destruction within a reasonable time and no later than one year after the purpose expires, and, since Jan. 1, 2026, does not apply to training, processing or storing biometric identifiers to develop or offer AI unless the system is used or deployed to uniquely identify a specific individual.
Physician read. A practice that captures a patient's or employee's fingerprint, face geometry, voiceprint or iris scan for a commercial purpose must inform the person and receive consent first, may not sell or disclose it except in listed cases, and must destroy it no later than one year after the purpose for collecting it expires. The attorney general may seek a civil penalty of up to $25,000 per violation.
Notes: Per the section's history note (as reproduced by Justia), Sec. 503.001 was added by Acts 2007, 80th Leg., ch. 885 (HB 2278), effective April 1, 2009, the date used, and amended in 2009 (HB 3186, effective Sept. 1, 2009) and 2017 (SB 1343, effective Sept. 1, 2017); an earlier origin of the statute could not be confirmed, so the signing date is left empty. HB 149 (2025) amended it effective Jan. 1, 2026: an individual is not considered informed or to have consented based solely on an image or other media on the internet or another publicly available source unless the individual made it public; the section does not apply to training, processing or storing biometric identifiers to develop, train, evaluate, disseminate or offer AI unless a system is used or deployed to uniquely identify a specific individual, or to developing or deploying AI to prevent, detect or respond to security incidents, identity theft, fraud, harassment or other illegal activity; and an identifier captured to train AI and later used for another commercial purpose becomes subject to the section's possession, destruction and penalty provisions. The attorney general has exclusive enforcement authority. The Justia text predates the 2025 amendments.
HB 4, Texas Data Privacy and Security Act
Gives consumers rights to access, correct, delete and port personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent to process sensitive data, including data revealing a mental or physical health diagnosis and biometric data used to identify a person, and requires data protection assessments for sensitive data and risky profiling.
Physician read. The act exempts HIPAA covered entities, business associates and protected health information, so it places no duty on a physician practice acting as a covered entity. It has governed health and wellness apps and other businesses outside HIPAA since July 1, 2024, requiring the consumer's consent before they process data revealing a health diagnosis or biometric data used to identify a person.
Notes: Status, dates and text come from LegiScan. Business and Commerce Code Chapter 541. The act took effect July 1, 2024; Sec. 541.055(e), on universal opt-out mechanisms, took effect Jan. 1, 2025. Small businesses may not sell sensitive personal data without the consumer's prior consent (Sec. 541.107). The attorney general has exclusive enforcement authority after a 30-day notice and cure period. HB 149 (2025) amended Sec. 541.104, effective Jan. 1, 2026, to require processors to help controllers secure personal data collected, stored and processed by an AI system.
Also relevant here: HB 149, Texas Responsible Artificial Intelligence Governance Act (under patient disclosure of AI use).
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.