Vermont: AI health laws
3 entries on the map: 2 in force and 1 enacted and not yet in force (main duties begin Jan 1, 2028).
Dates ahead
- Jan 1, 2028
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Insurance Bulletin No. 229, The Use of Artificial Intelligence Systems in Insurance
Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, covering governance, risk management and internal controls, and third-party AI systems and data, states that decisions made using AI systems must comply with the legal and regulatory standards that apply to them, including unfair trade practice and claim settlement rules, and tells insurers they can expect questions about their AI use in any investigation or market conduct action.
Physician read. It places no duty on physicians. Since March 12, 2024, insurers in Vermont, including health insurers, are expected to govern AI systems used in decisions that affect patients, and the Department of Financial Regulation may ask about that use in investigations and market conduct actions.
Notes: Issued March 12, 2024 by Commissioner Kevin Gaffney to all insurers holding certificates of authority in Vermont. The NAIC's Aug. 31, 2026 map lists Bulletin 229 as Vermont's adoption of the NAIC Model Bulletin; the bulletin follows the model's structure (four sections, with an AIS Program covering general guidelines, governance, risk management and internal controls, and third-party AI systems and data) and cites the NAIC's 2020 AI Principles, but its text does not name the model bulletin. It cites Vermont's unfair trade practice and claim settlement provisions (8 V.S.A. sections 4721 to 4724 and 4727, and Regulation 79-2) and health insurance rate statutes (8 V.S.A. sections 4062, 4083 and 5104). It sets no separate effective date, so the issue date is used. Insurance Bulletin 240 (2026), which withdrew obsolete bulletins, does not list Bulletin 229, and the Department's index still lists it.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Also relevant here: H.816, Act 156, An act relating to regulating the use of artificial intelligence in the provision of mental health services (under mental health AI).
Mental health AI
AI in therapy and mental health care.
H.816, Act 156, An act relating to regulating the use of artificial intelligence in the provision of mental health services
Bars a corporation or entity from providing, advertising or offering mental health services to the public, including through AI, unless a mental health professional provides them or they are part of approved research, lets mental health professionals use HIPAA-compliant AI tools if they review and approve any mental health services provided, allows FDA-authorized digital therapeutics prescribed or recommended by a professional, and makes prohibited AI use unprofessional conduct.
Physician read. Since June 17, 2026, a Vermont physician or other mental health professional may use HIPAA-compliant AI tools in mental health care provided the professional reviews and approves any mental health services, and a licensee's prohibited use of AI under the new law is unprofessional conduct subject to discipline. A corporation or entity may not provide, advertise or offer mental health services to the public, including through AI, unless a mental health professional provides them.
Notes: The Vermont Legislature's bill status page shows Act 156 and the governor's approval on June 17, 2026; LegiScan's history shows the conference report adopted May 22, 2026, delivery to the governor June 11 and signing June 17, 2026. The act's text was read in LegiScan's copy of the chaptered act. Section 3 adds 18 V.S.A. section 7115; sections 2 and 4 add prohibited AI use to the unprofessional conduct lists in 3 V.S.A. section 129a (professions regulated by the Office of Professional Regulation) and 26 V.S.A. section 1354 (Board of Medical Practice). A violation by a corporation or entity is a violation of the Consumer Protection Act, 9 V.S.A. chapter 63. Section 5 lists the Director of Professional Regulation and the Executive Director of the Vermont Board of Medical Practice among the members of the Artificial Intelligence Advisory Council, and section 6 requires the council to report on regulating mental health professionals' AI use by Jan. 15, 2027. The act took effect on passage; the governor approved it June 17, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
S.71, Act 145, An act relating to consumer data privacy and online surveillance (Vermont Data Privacy and Online Surveillance Act)
Creates a comprehensive consumer privacy law that allows processing of sensitive data, including health condition, diagnosis, disability or treatment data, consumer health data, genetic, biometric, neural and precise geolocation data, only with consent and when reasonably necessary for the purpose collected, limits collection to what is reasonably necessary and proportionate, requires consent before selling consumer health data, bars health-data geofences within 1,850 feet of any health care facility, and requires privacy notices to say whether personal data are used to train large language models.
Physician read. It places no duty on HIPAA covered entities or business associates, which are exempt. From Jan. 1, 2028, any business outside HIPAA that handles Vermont patients' consumer health data, such as a health app, will need consent to sell it and cannot use a geofence within 1,850 feet of a health care facility to identify, track, collect data from or send notifications to consumers about their health data, whatever its size.
Notes: Codified as 9 V.S.A. chapter 61A; the consumer health data rules are in section 2415k and the large language model disclosure in section 2415e. The Senate passed S.71 March 27, 2025; the House passed it with amendments May 26, 2026 (129-3); the Senate concurred May 29, 2026; the governor signed it June 16, 2026, as LegiScan and the Vermont Legislature's bill status page show. The Attorney General enforces it under the Consumer Protection Act, with no private right of action; from Jan. 1, 2028 to June 30, 2029 the Attorney General must first issue a notice of violation, with 60 days to cure, when the Attorney General determines a cure is possible. The HIPAA exemption covers covered entities that are not hybrid entities, the health care components of hybrid entities, and business associates. The act's text was read in LegiScan's copy of the chaptered act.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.