Washington: AI health laws
6 entries on the map: 5 in force and 1 enacted and not yet in force (main duties begin Jan 1, 2027).
Dates ahead
- Jan 1, 2027HB 2225, Regulating Artificial Intelligence Companion ChatbotsClinical decision and chatbot limits
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Technical Assistance Advisory 2024-02, The Use of Artificial Intelligence Systems in Insurance
Reminds insurers that decisions made or supported by AI systems must comply with insurance law, including unfair trade practice and unfair discrimination laws, and, following the NAIC model bulletin, sets out the Office's expectation that insurers keep a written AI systems program with senior management accountable to the board, risk controls, due diligence and audit rights over third-party vendors, and documentation the Office may request in investigations and market conduct actions.
Physician read. It places no duty on physicians. Since April 22, 2024, insurers holding certificates of authority in Washington have been expected to govern, test and document the AI systems they use in decisions affecting consumers; limits in statute on health carriers' use of AI in prior authorization followed in SB 5395 (2026).
Notes: Filed in the Washington State Register as WSR 24-10-025 at 1:36 p.m. on April 22, 2024. Footnote 1 describes it as a policy statement of the office's current opinions, approaches and likely courses of action, and footnote 2 says it is based on the NAIC model bulletin. It is addressed to 'All Insurers Licensed to Do Business in Washington' and speaks to 'all insurers that hold certificates of authority to do business in the state'; it does not mention health care service contractors, health maintenance organizations or health carriers. Health care service contractors and HMOs register with the commissioner under RCW 48.44.015 and RCW 48.46.027 rather than holding the certificate of authority RCW 48.05.030 requires of insurers, so the advisory's terms do not name them; whether the office applies it to them in practice is not stated.
SB 5395, Making Improvements to Transparency and Accountability in the Prior Authorization Determination Process
Bars AI from being the sole means used to deny, delay or modify health care services, bars algorithms from being used without human review to deny care based on medical necessity, allows only a licensed physician or licensed health professional working within scope to deny a prior authorization request based on medical necessity, requires AI used in prior authorization to base determinations on the enrollee's own medical or clinical history and the clinical circumstances the requesting provider presents rather than solely on a group data set, makes carriers' AI policies and procedures open to audit by the Office of the Insurance Commissioner, and adds the share of denials aided by AI to carriers' annual prior authorization reports.
Physician read. Since June 11, 2026, a state-regulated health carrier or a PEBB or SEBB plan may use algorithms to process and approve prior authorization requests, but AI cannot be the sole means of denying, delaying or modifying care, and only a licensed physician or licensed health professional working within scope may deny a request based on medical necessity. A carrier's AI must base its determinations on the patient's own clinical history and the circumstances the requesting provider presents, not on a group data set alone.
Notes: Amends RCW 48.43.830 (carriers), RCW 41.05.845 (PEBB and SEBB plans) and RCW 48.43.0161 (annual prior authorization reporting), among other sections. The session law records the governor's approval at 3:32 p.m. on March 23, 2026, and filing March 24, 2026. Sections 2 and 6, the current versions of RCW 48.43.830 and of RCW 48.43.535 (independent review), expire Jan. 1, 2027, when sections 3 and 7 take effect; section 3 keeps the AI provisions and adds that clinical review criteria for mental health and substance use disorder prior authorization requests must meet RCW 48.43.766. Section 1 states the Legislature's intent to extend the act's protections to managed care organizations 'as soon as feasible'; they are not covered now. The AI conditions also apply to prior authorization functions carried out by health care benefit managers under contract with a carrier.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: HB 2225, Regulating Artificial Intelligence Companion Chatbots (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
HB 2155, Concerning the Use of Nursing Titles
Limits the practice of nursing to licensed human persons and bars any nonhuman entity from assuming nursing titles or using abbreviations or other words, letters, signs or figures indicating that it is a registered nurse, advanced registered nurse practitioner or licensed practical nurse, including the titles nurse, registered nurse, nurse practitioner and licensed practical nurse and the abbreviations RN, ARNP, NP and LPN.
Physician read. Since June 11, 2026, an AI tool, chatbot or other nonhuman entity used by a practice or health system in Washington may not use a nursing title or abbreviation, such as nurse or registered nurse, or otherwise indicate that it is a nurse.
Notes: Chapter 6, Laws of 2026; amends RCW 18.79.030. The text refers to 'nonhuman entities' and neither defines the term nor mentions AI; a Washington State Nurses Association article quotes Gov. Bob Ferguson saying AI cannot act as a licensed nurse or claim to be one. Section 1 expires June 30, 2027, when section 2 takes effect; section 2, the version of RCW 18.79.030 reflecting chapter 239, Laws of 2024, applies the same bar using advanced practice registered nurse and APRN in place of advanced registered nurse practitioner and ARNP.
HB 2225, Regulating Artificial Intelligence Companion Chatbots
Requires operators of AI companion chatbots to disclose that the chatbot is artificially generated and not human at the start of an interaction and at least every three hours (at least hourly when the operator knows the user is a minor or the chatbot is directed to minors), to keep and publish a protocol for detecting and addressing suicidal ideation and self-harm, including eating disorders, that refers users to a suicide hotline or crisis text line, and to prevent sexually explicit content and manipulative engagement techniques with minors.
Physician read. It places no duty on physicians. From Jan. 1, 2027, companion chatbots available to patients in Washington must state that they are not human and must refer users who express suicidal ideation or self-harm to crisis services, and violations are enforceable under the Consumer Protection Act.
Notes: Requested by Gov. Bob Ferguson; approved March 24, 2026, and filed March 25, 2026. The law excludes business bots that do not sustain a relationship, limited game bots, voice assistants without relationship continuity and curriculum tools used in schools. Violations are unfair or deceptive acts under the Consumer Protection Act (chapter 19.86 RCW); law firm summaries describe the resulting private right of action. Operators must publicly disclose their protocol and, on their websites, the number of crisis referral notifications issued in the preceding calendar year. The minors' protections apply when the operator knows the user is a minor or the chatbot is directed to minors.
Mental health AI
AI in therapy and mental health care.
Also relevant here: HB 2225, Regulating Artificial Intelligence Companion Chatbots (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
HB 1493, Concerning Biometric Identifiers
Bars enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent or providing a mechanism to prevent the subsequent use of the identifier for a commercial purpose, limits selling or disclosing enrolled identifiers, and limits retention to what is reasonably necessary.
Physician read. Since July 23, 2017, anyone who enrolls fingerprints, voiceprints, iris or retina patterns or similar biometric identifiers in a database for a commercial purpose must first provide notice, obtain consent or provide a mechanism to prevent later commercial use; the definition excludes photographs, video or audio recordings and information collected, used or stored for health care treatment, payment or operations under HIPAA. Only the attorney general enforces it.
Notes: Chapter 299, Laws of 2017, codified at chapter 19.375 RCW. RCW 19.375.020(2) says the exact notice and type of consent required are context-dependent. Enforced solely by the attorney general under the Consumer Protection Act (RCW 19.375.030); there is no private right of action. Biometric data is also consumer health data under the My Health My Data Act (2023), which carries its own consent rules and private right of action.
HB 1155, My Health My Data Act
Requires a consumer health data privacy policy, separate consent before collecting or sharing consumer health data, including biometric data and health data inferred by algorithms or machine learning, a signed authorization before selling it, and rights to access and delete it, and bars geofencing around entities that provide in-person health care services.
Physician read. HIPAA protected health information is exempt, but consumer health data collected outside HIPAA, for example by health apps, wellness services or websites, has required separate consent before collection or sharing since March 31, 2024 (June 30, 2024 for small businesses). Since July 23, 2023, no one may use a geofence around an in-person health care provider to identify or track people seeking care, collect their health data or send them health-related messages or ads, and violations are enforceable by the attorney general and by private suit under the Consumer Protection Act.
Notes: Chapter 191, Laws of 2023. The bill page lists July 23, 2023 as the effective date; the Attorney General applies section 10 (geofencing) to all persons from that date and sections 4 through 9 to regulated entities from March 31, 2024 and to small businesses from June 30, 2024. Violations are per se violations of the Consumer Protection Act. The RCW chapter shows no amendments since 2023.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.