State AI Laws Target Health Insurers' Prior Auth Engines

State legislatures are moving past broad artificial-intelligence governance to regulate one of AI's most direct applications in healthcare: coverage decisions. Four states, Georgia, Iowa, Utah, and Washington, enacted laws this year that let insurers use algorithms for administrative tasks. The laws bar AI from making final medical necessity determinations without a human reviewer.

The analysis, published July 2 by Sheppard Mullin's Healthcare Law Blog, builds on an April survey. The April survey covered a first wave of proposals. The July update shows the pace picking up.

In Georgia, Senate Bill 444, effective Jan. 1, 2027, allows AI in utilization review. The law prohibits an adverse determination until a qualified human reviewer conducts a clinical peer review. It does not require insurers to disclose AI use to members or providers.

Iowa's House File 263, effective July 1, 2026, permits AI for initial prior authorization reviews. The law bars AI from serving as the sole basis for denying or downgrading requests involving medical necessity. Qualified reviewers or clinical peers must make those decisions.

Utah took a different path. Senate Bill 319, effective Jan. 1, 2027, requires independent medical judgment for adverse preauthorization determinations. The law prohibits reliance solely on recommendations from another source, a clause that covers AI-generated recommendations. Utah also requires insurers to disclose AI use to the state Insurance Department and on their public websites.

Washington's Senate Bill 5395, effective June 11, 2026, is the strictest of the four. Only licensed physicians or other licensed health professionals may deny prior authorization requests based on medical necessity. AI cannot be the sole basis for those decisions. Human reviewers must evaluate each enrollee's clinical history and individual circumstances. The law also requires AI systems to operate fairly, comply with privacy laws, undergo periodic review, and remain subject to audit by the state insurance commissioner.

The April analysis documented a first wave of legislative proposals. Indiana enacted restrictions preventing AI from serving as the sole basis for downcoding claims. Alabama adopted disclosure and fairness requirements. Louisiana and New Hampshire considered measures emphasizing physician oversight before those bills failed. Arizona, Maryland, Nebraska, and Texas enacted AI-related health insurance legislation in 2025.

The simple read is that AI in health insurance is getting regulated. Insurers must keep a human in the loop.

The better market read is that the patchwork creates a compliance problem with a hard deadline stack. Washington's law is the template for the strictest approach. Utah's disclosure requirement opens a new liability vector. Insurers must now publicly document which algorithms they use and how. The deadlines mean insurers must overhaul their utilization management tech stacks before mid-2026, the analysis shows.

The direct exposure falls on health insurers: UnitedHealth Group (UNH), Cigna (CI), Elevance Health (ELV), Humana (HUM), and CVS Health (CVS) through its Aetna unit. AI vendors that sell prior authorization and utilization review software to these carriers also face a compliance hurdle: their products must be configurable to meet Washington's audit and fairness standards.

What would reduce the risk: A federal preemption standard would replace the patchwork with a single rule. Vendors already certified against Washington's requirements give insurers a faster path to compliance.

What would make it worse: More states adopting Washington's model. Class action lawsuits based on Utah's disclosure requirement, where plaintiffs argue an undisclosed algorithm caused harm.

Washington's law took effect June 11, 2026. Iowa's follows July 1, 2026. Georgia and Utah go live Jan. 1, 2027.