Over the last few years, state legislatures have begun to consider, and ultimately enact, laws governing the use of artificial intelligence (“AI”) in health insurance determinations, including prior authorizations and utilization review. In a previous analysis, we summarized legislation from the first quarter of 2026 in six states limiting the use of AI in health insurance decisions. Here, we continue our review of this growing trend.
Georgia
Effective January 1, 2027, Georgia Senate Bill 444[1] expressly authorizes the use of AI systems and other software tools to automate tasks, reduce administrative burdens, participate in decision-making processes, and perform other lawful functions. However, the bill provides that AI may not issue an adverse determination to a patient until a natural person qualified as a private review agent or a utilization review entity conducts a utilization review in which a clinical peer participates. Additionally, an AI system must not supersede the judgment of that clinical peer — a restriction similar to the approach taken by Pennsylvania and described in our previous summary.
Private review agents and utilization review entities may use AI systems, provided those systems are incorporated into a utilization review plan that complies with Georgia law. Notably, the bill does not impose explicit disclosure obligations on insurers with respect to members or providers.
Iowa
Iowa House File 2635,[2] effective July 1, 2026, permits utilization review organizations to use AI in prior authorizations. Specifically, a utilization review organization may use an AI-based algorithm or system for the initial review of a prior authorization request. However, for a prior authorization request for a health care service based on medical necessity, AI may not be the sole basis for a decision to deny, delay, or downgrade the request. Denials or downgrades must be made by a qualified reviewer or a clinical peer, depending on the requesting provider, and consultations and appeals must also involve qualified reviewers or clinical peers who satisfy state specialty and experience requirements.
Under the new law, utilization review organizations must provide written explanations for denials or downgrades, including the reasons and criteria relied upon and an explanation of the appeals process. In addition, the organization must furnish the requesting health care provider, but not the covered person, with a written attestation regarding the qualifications of the reviewing clinical peer or qualified reviewer. House File 2635 imposes no AI-specific reporting or disclosure requirements.
Utah
On March 19, 2026, the Utah legislature enacted Senate Bill 319,[3] which, as of January 1, 2027, will limit the role of AI in health insurance determinations. The bill does not prohibit the use of AI in utilization management but amends the state’s health care preauthorization statute to require that individuals making an adverse preauthorization determination based on clinical or medical necessity exercise independent medical judgment. Importantly, the bill prohibits reliance solely on “recommendations from any other source[4]," which would include AI-generated recommendations.
Also, effective January 1, 2027, Senate Bill 319 will require insurers to disclose to the Utah Insurance Department any use of AI in their authorization request review process. Insurers will also be required to post conspicuously on their websites, in detail and in easily understandable language, all preauthorization requirements, including their use of AI in the review process.
Washington
Effective June 11, 2026, Washington takes one of the most comprehensive approaches to limiting AI in prior authorization, governing AI use by health carriers, health care benefit managers, and public employee health plans.
Under Senate Bill 5395,[5] only a licensed physician or licensed health professional acting within their scope of practice may deny a prior authorization request based on medical necessity, and insurers must not rely solely on AI to make such denial decisions. A human reviewer must evaluate the specific clinical issues by reviewing: (1) the requesting provider's recommendation; (2) the enrollee's medical or clinical history; and (3) the enrollee's individual clinical circumstances.
Where a carrier uses AI in prior authorization involving medical necessity, the AI review criteria must include the enrollee's individual medical history and clinical circumstances, and not solely group data. Washington imposes additional parameters, requiring that AI also operate in compliance with applicable law, be used in a fair and nondiscriminatory manner, and be subject to audit by the state’s insurance commissioner and periodic review for accuracy and outcomes. Furthermore, AI must use patient data only for its intended purpose in accordance with applicable privacy laws, including HIPAA.
Senate Bill 5395 also imposes disclosure and reporting obligations. If a denial is issued, the carrier must disclose the credentials, board certifications, and areas of specialty of the provider who exercised clinical oversight to both the health plan enrollee and the requesting or referring provider — a broader disclosure obligation than Iowa's, which runs only to the requesting health care provider. Unlike Iowa, however, Washington’s credential disclosure requirement applies only to denials and does not extend to downgrades. Carriers must publicly post any adjustments to prior authorization policies on their websites. Beginning with annual reporting, carriers must also report to Washington’s insurance commissioner the percentage of total prior authorization denials that were aided by AI.
Updates
In addition to the new legislation discussed above, we continue to monitor bills noted in our previous summary. Pennsylvania House Bill 1925[6] remains with the legislature, having been "laid on the table” as of May 5, 2026, and Oklahoma House Bill 3675[7] also remains pending. On the other hand, we note that bills in both New Hampshire (House Bill 1406[8]) and Louisiana (Senate Bill 246[9]) have died.
FOOTNOTES
[1] S.B. 319, 2026 Gen. Sess. (Ut. 2026).
[2] H.F. 2635, 91st Gen. Assemb. (Iowa 2026).
[3] S.B. 319, 2026 Gen. Sess (Ut. 2026).
[4] Utah Code Ann. § 31A-22-650
[5] S.B. 5395, 69th Leg., Reg. Sess. (Wash. 2026).
[6] H.B. 1925, 2025–2026 Sess. (Pa. 2025).
[7] H.B. 3675, 60th Leg., 2d Reg. Sess. (Okla. 2026).
[8] H.B. 1406, 2026 Gen. Ct. (N.H. 2026).
[9] S.B. 246, 2026 Reg. Sess. (La. 2026), withdrawn by the Louisiana Senate on May 28, 2026.