Healthcare AI Laws by State (2026): What to Build

In late 2026, US healthcare AI law is state law. Three rules cover most products: disclose AI to patients (California, Texas, Utah), keep a licensed human on adverse prior-authorization decisions (California plus at least nine more states), and keep AI out of independent therapy (Illinois and others). Build disclosure, human review and audit as configurable features per state.

Congress has not passed a federal healthcare AI law, and a December 2025 executive order did not cancel state ones. Meanwhile states keep legislating: 2026 alone added prior-authorization AI limits in Alabama, Indiana, Utah, Washington, Maryland and Georgia, plus a wave of mental health chatbot laws. This guide lists the laws that matter for product teams, with dates checked on 12 November 2026, and turns them into engineering requirements. It is a technical summary, not legal advice; have counsel confirm how each law applies to you.

Which states regulate healthcare AI in 2026?

California, Texas, Utah, Illinois and Colorado have the most-cited laws, and at least a dozen more states passed healthcare AI bills in 2026 alone. The laws fall into four groups: patient disclosure, prior authorization and utilization review, mental health AI, and general automated decision rules.

Which states require you to disclose AI use to patients?

California and Texas are the main ones for clinical care, and Utah for mental health chatbots. California requires a disclaimer on generative AI clinical messages unless a licensed provider reviewed them. Texas requires providers to tell patients when AI is used in their treatment, by the date of service.

California AB 3030

Since 1 January 2025, a health facility, clinic or physician's office that uses generative AI to write patient communications about clinical information must include a disclaimer and tell the patient how to reach a human. Administrative messages such as scheduling are outside it. If a licensed or certified provider reads and reviews the message before it goes out, the disclaimer rule does not apply (bill text). Product teams usually support both paths: a review queue, and a disclaimer for anything that skips it.

Texas HB 149 and SB 1188

The Texas Medical Liability Trust summarizes the two laws this way: SB 1188, effective 1 September 2025, lets practitioners use AI for diagnostic purposes only within their license, with review of all AI-generated records and disclosure to patients. HB 149 (the Texas Responsible AI Governance Act), effective 1 January 2026, requires providers to disclose AI use in treatment no later than the date of service, in clear plain language. Neither law prescribes the mechanics, so the product has to make disclosure easy and recorded.

Utah

Utah's HB 452, in effect since 7 May 2025, requires mental health chatbots to disclose clearly that they are not human and restricts sharing user data and advertising in conversations. Utah's broader AI Policy Act, enacted in 2024 and amended in 2025, adds disclosure duties for regulated occupations.

Which states limit AI in prior authorization and utilization review?

California led with SB 1120 in 2025, Arizona, Maryland and Nebraska followed, and 2026 added Alabama, Indiana, Utah, Washington, Maryland again and Georgia. The common rule: AI may support the review, but a licensed clinician makes any adverse medical necessity decision using the individual patient's information.

California's Physicians Make Decisions Act (SB 1120) took effect on 1 January 2025. It applies to health plans, disability insurers and the vendors they contract with. Decisions must rest on the enrollee's own records, not solely on a group dataset, and the tools are subject to disclosure and inspection. Arizona's HB 2175, effective in mid-2026, requires a medical director to personally review certain denials; Nebraska's LB 77 says AI cannot be the sole basis to deny, delay or modify care.

The 2026 laws, per a Holland & Knight review:

• Alabama SB 63 (1 October 2026): AI prior authorization decisions must use the patient's history and clinical circumstances; annual certification to the insurance department.
• Indiana HB 1271 (1 July 2026): no AI as the sole basis for downcoding without professional review, and providers may not use AI to submit claims without review. Note that this one reaches providers, not just payers.
• Utah SB 319 (1 January 2027): disclose AI use in prior authorization to regulators, providers and enrollees; clinicians make adverse determinations.
• Washington SB 5395: no sole reliance on AI to deny, delay or limit services; report AI-aided denials.
• Maryland HB 1563 (1 June 2026): quarterly reporting on adverse decisions, including whether AI was used.
• Georgia SB 544 (1 January 2027): AI allowed for administrative tasks and decision support; no AI-issued adverse determination without licensed provider review.

For engineering, this is a human-in-the-loop requirement with evidence. The system must show that a named clinician reviewed the case, what the AI recommended, what data it used, and what the clinician decided. We describe the pattern in human-in-the-loop AI for regulated industries.

What happened to the Colorado AI Act?

It was delayed, then replaced. The original SB 24-205 was pushed from February to June 2026, then repealed and re-enacted in May 2026 as SB 26-189, which regulates automated decision-making technology from 1 January 2027 and largely exempts HIPAA-covered entities.

Per a Lathrop GPM summary, the new law requires developers to give deployers documentation on known harmful uses, training data categories, limitations and human review, and requires deployers to notify consumers before an automated system is used in a consequential decision and to explain adverse outcomes within 30 days. Health care is one of seven covered domains, but HIPAA-covered entities are exempt outside employment decisions, as are FDA-regulated devices. Enforcement is by the Attorney General with no private right of action. For a digital health vendor that is not itself a covered entity, or for any employer using AI in hiring, it still matters.

Which states restrict AI in mental health care?

Illinois has the strictest rule: since August 2025, AI may not make therapeutic decisions or conduct therapeutic communication, with fines up to $10,000 per violation. Utah regulates mental health chatbots, and in 2026 Idaho, Nebraska, Oregon, Tennessee and Maine passed their own limits.

The Illinois Wellness and Oversight for Psychological Resources Act lets licensed professionals use AI for administrative and supplementary support, not for therapy itself. The 2026 laws in the Holland & Knight review add chatbot disclosure and crisis-response duties (Idaho and Nebraska from 1 July 2027, Oregon from 1 January 2027 with a private right of action), a ban on presenting AI as a licensed professional (Tennessee, 1 July 2026), and in Maine, patient consent before ambient listening or AI recording by mental health professionals.

If your product touches behavioral health in any way, treat crisis detection and escalation to a human as a core feature, not an add-on.

Does the federal executive order override state healthcare AI laws?

No. Executive Order 14365, signed on 11 December 2025, set up a Justice Department task force to challenge state AI laws it views as inconsistent with federal policy, but an executive order cannot itself repeal state law. Law firms advise continuing to comply until a court or Congress says otherwise.

As Paul Hastings noted, preemption normally comes from Congress or the courts. Several state healthcare AI laws are also framed as insurance or professional licensing rules, areas where states have traditionally regulated. Build for the state rules; if some are struck down, you turn a flag off.

What should you build to comply across states?

Build five things once and configure them per state: a disclosure engine, human review gates with evidence, a jurisdiction rules table, an audit trail of AI involvement in every decision, and model documentation you can hand to customers and regulators.

• Jurisdiction rules table. Map patient location, provider license state and plan type to the rules that apply. Rules change several times a year, so keep them as data, not code.
• Disclosure engine. Insert the right disclaimer and human-contact path by channel (message, portal, voice) and record that it was shown. Support the California "reviewed by a licensed provider" path as a first-class state.
• Human review gates. For adverse coverage decisions, diagnosis support or clinical messages, require a named, credentialed reviewer before release. Store the AI's recommendation, inputs and the human decision side by side.
• AI involvement audit. For every output, record model, version, prompt template, data used and reviewer. Several 2026 laws require reporting whether AI was used in a denial; you can only report what you logged.
• Model documentation. Intended use, limitations, known failure modes, evaluation results. Colorado's developer duties and health system procurement both ask for it. Our LLM testing guide covers producing the evidence.

None of this replaces HIPAA. The Security Rule and BAA chain still apply underneath; see the HIPAA Security Rule update and AI and our AI agent security checklist.

How BeevR builds this

We build compliance features into healthcare AI products as configuration, not one-off code: a jurisdiction rules table, a disclosure service across channels, review gates with credential checks, and an audit model that records AI involvement for every decision so you can answer a regulator's question with a query. We work with your counsel on the legal interpretation and implement what they decide. The model can run inside your own AWS account under your AWS BAA, and BeevR signs a BAA as your business associate.

We are a senior, founder-led team in Hanoi, rated 5.0 on Clutch, and we built a multi-tenant EHR now live across four US clinics at about 300 patients a day. We work in fixed phases, from $10K per phase, and you own the code from day one. See our healthcare AI agent development and HIPAA-compliant AI agent work.

If you are shipping AI to patients or payers in several states, book a 30-minute call. We will map your features to the rules above and show what needs to be configurable.