AI in healthcare:
the rules, in plain English.

Requires A PCCP lets a manufacturer pre-specify and get FDA authorization for future model changes as part of the original submission — so pre-approved updates don't each need a new submission. A PCCP must describe three things: the planned modifications, the methodology to develop/validate/implement them safely, and an impact assessment of benefits and risks.

Proposes The FDA's first comprehensive, total-product-lifecycle recommendations for AI devices — design, development, validation, transparency, and postmarket performance monitoring. It recommends manufacturers maintain a monitoring plan to catch performance drift after deployment. Still a draft as of July 2026 (comment period closed April 7, 2025).

Clarifies The FDA's January 2026 revision narrows which decision-support software — expressly including AI-enabled CDS — counts as a regulated medical device. Software that informs a clinician who can independently review the basis for its recommendation can qualify as Non-Device CDS, and the FDA now intends enforcement discretion for some single-recommendation tools (such as guideline-based risk scores) that the 2022 guidance pushed toward device status. The FDA walked industry through the changes in a March 11, 2026 town hall.

Status Proposed sweeping certification and interoperability changes (new patient/provider/payer FHIR APIs, public-health data exchange, updated standards). A small TEFCA-related slice was finalized in late 2024; the bulk was formally withdrawn December 29, 2025, citing deregulation and "emerging AI technologies."

Proposes The live ONC AI rulemaking — and it runs the opposite direction. It would remove the HTI-1 AI source-attribute / "model card" and risk-management requirements from the Predictive DSI criterion, arguing there's no published evidence they improved care. Broadly deregulatory (proposes removing 34 of 60 certification criteria). The comment period closed February 27, 2026; the rule is still not finalized as of July 2026, so the HTI-1 model-card requirements remain in force in the meantime.

Status CMS is testing AI/ML-assisted review of prior-authorization requests in Original Medicare (fee-for-service — it does not apply to Medicare Advantage) across six states. The model targets a pre-selected list of services CMS flags as wasteful or fraud-prone (skin and tissue substitutes, electrical nerve-stimulator implants, and knee arthroscopy for knee osteoarthritis, among others). CMS says WISeR does not change Medicare coverage or payment policy — and any non-payment recommendation must come from an appropriately licensed clinician, not the technology alone.

Proposes A major cybersecurity update that would require a technology asset inventory and network map explicitly listing AI software that handles ePHI, and would require the risk analysis to assess — before deploying an AI tool — what ePHI it accesses and where outputs go. Confirms ePHI in AI training data and models is within scope. Not finalized as of July 2026; outcome uncertain amid industry pushback — and the Unified Agenda now carries it as a long-term action with final action projected July 2027 (RIN 0945-AA22), so it is unlikely to bind before then.

Prohibits Unsubstantiated or deceptive AI capability claims ("AI washing"). The September 2024 sweep brought five actions (DoNotPay, Rytr, and others) against companies overhyping or misusing AI. Health-tech AI marketing — diagnostic accuracy, "AI clinician," compliance-automation efficacy — is squarely within this standard.

Prohibits Sharing sensitive health data with advertisers/third parties without consent. The FTC penalized GoodRx ($1.5M, its first Health Breach Notification Rule action), BetterHelp ($7.8M), and Cerebral for leaking medication, mental-health, and telehealth data via tracking tools. Its 2024 HBNR amendments expressly cover health apps not governed by HIPAA, and treat tracker/pixel leaks as reportable breaches.

Was The most sweeping federal AI action to date — directed an HHS AI Task Force, a health-AI assurance strategy, and an AI safety program for clinical errors. Rescinded on Jan 20, 2025; the HHS deliverables it ordered are now superseded.

Directs A national policy to remove barriers to AI leadership; ordered a review/unwinding of EO 14110 actions and mandated the AI Action Plan. The Plan's three pillars — innovation/deregulation, infrastructure, and global influence — promote rapid AI adoption in healthcare and call for regulatory "sandboxes," including for health.

Directs A "OneHHS" approach across CMS, FDA, NIH, CDC — deploy AI aggressively while applying OMB's "high-impact AI" risk-management controls (bias mitigation, monitoring, human oversight), with implementation milestones in 2026.

Requires Prohibits developing/deploying AI with intent to unlawfully discriminate, to manipulate people toward self-harm or crime, for government social scoring, or for unlawful biometric capture. Enforced by the AG (no private lawsuits), with a 60-day cure period and a regulatory sandbox. Healthcare-specific: TRAIGA's disclosure duty is broad (AI used "in relation to a health care service or treatment"); the specific requirement that a provider disclose to patients when AI is used in diagnosis or treatment comes from a separate Texas law, SB 1188 (see below).

Requires One of the first provider-facing AI disclosure laws. People in a regulated occupation (including healthcare providers) must disclose generative-AI use to consumers. A 2025 amendment (SB 226) narrowed proactive disclosure to "high-risk" interactions — which still generally captures use of health data for personalized advice. Created Utah's Office of AI Policy and AI "learning lab."

Prohibits AI systems from using terms or titles (e.g., "doctor," "nurse," "psychologist") in a way that implies care is being provided by a licensed human. Each prohibited use is a separate violation, enforced by the relevant licensing board.

Prohibits Offering — or claiming — that an AI system can provide professional mental/behavioral health care, and bars providers from using AI to deliver care directly to patients (support uses with provider review allowed). Also restricts AI for these services in public schools. Penalty up to $15,000 per violation.

Requires AI "mental health chatbots" must clearly disclose they are AI (before use, after 7 days of non-use, and on request); in-chat advertising must be labeled; and suppliers may not sell or share users' identifiable health information or inputs (limited exceptions).

Requires Licensed practitioners may use AI for diagnosis/treatment only within their scope and only if they review all AI-generated records per Texas Medical Board standards; also prohibits offshoring electronic medical records.

Requires After scaling back its broad AI act, Colorado passed two targeted health laws in mid-2026. HB 26-1139 requires AI coverage decisions to use the patient's individual history, requires a licensed clinician to review medical-necessity denials, mandates disclosure of AI use to regulators, and bars payer reimbursement for AI-delivered psychotherapy. HB 26-1195 restricts AI from conducting therapeutic communication except during live sessions with the provider present, and requires consent for AI session recording.

Requires Spring 2026 added four more states to the mental-health red line. Tennessee (SB 1580, eff. Jul 1, 2026) bars advertising or representing that an AI system is — or can act as — a qualified mental-health professional, with a private right of action under its consumer-protection law. Delaware (HB 191, eff. Apr 23, 2026) says a nonhuman entity, including an AI agent, cannot be licensed as — or use the title of — a nurse, physician, or physician assistant. Idaho (S 1297) and Nebraska (LB 525) enacted near-identical Conversational AI Safety Acts (both eff. Jul 1, 2027): public-facing chatbots must clearly disclose they are AI, follow crisis-response protocols when a user expresses suicidal ideation, and may not claim to provide professional mental or behavioral health care. Colorado joined on May 29, 2026 (HB 26-1263, operator requirements eff. Jan 1, 2027): conversational-AI operators must disclose that outputs are AI-generated, maintain suicidal-ideation and self-harm response protocols, protect minor users (age estimation, no simulated emotional dependence), report annually to the Attorney General — and may not represent a chatbot's output as equivalent to services from a licensed professional.

Prohibits Providing, advertising, or offering therapy or psychotherapy services to the public — including through Internet-based AI — unless the services are provided by a licensed professional; a violation is an unfair trade practice under Maine law. Licensed clinicians may still use AI for administrative and "supplementary" support (therapy notes, anonymized trend analysis, referral research), but only with the client's explicit written consent — the law says consent can't be collected through a general terms-of-use agreement — after disclosing the tool's purpose and how session data is stored, used for training, and deleted. Even then, the AI may not make independent therapeutic decisions, interact with clients in therapeutic communication, or generate treatment plans without the licensee's review. Clients can't be denied care for refusing consent, and client waivers of these protections are void.

Requires Rhode Island enacted two healthcare AI laws that took effect the day they were signed. The Oversight of Artificial Intelligence Technology in Mental Health Care Act bars any person or entity from providing, advertising, or offering therapy or psychotherapy to the public — including through Internet-based AI — unless a licensed professional conducts it. A licensed provider may not let AI make independent therapeutic decisions, determine therapeutic recommendations or treatment plans, or directly engage a client in therapeutic communication without an established relationship. Where AI designed to simulate emotional attachment (or an AI "companion") assists in a recorded or transcribed session, the patient must be told in writing that AI will be used and for what purpose, and must consent — and the statute is explicit that consent cannot be harvested from acceptance of a broad terms-of-use agreement. FDA-cleared AI tools, religious counseling, peer support, and public self-help materials are carved out. Separately, the Use of Artificial Intelligence by Healthcare Providers Notification Act requires any provider or facility that uses AI to document an in-person or telehealth visit to notify the patient and to review the AI-generated documentation for accuracy after the visit.

Requires A separate cluster regulates AI companions — the consumer chatbots people confide in — rather than clinical tools. Connecticut (Public Act 26-15, approved May 27, 2026; the AI-companion sections take effect Jan 1, 2027) requires an evidence-based protocol to detect a user expression indicating risk of suicide, self-harm, or imminent violence and to refer the user to the 988 lifeline and on to treatment "consistent with clinical best practices"; the companion may not claim to be a human being; and for minors it may not offer mental-health services at all unless it is designed to deliver them using clinical best practices and displays, clearly and conspicuously at the start of each interaction, a statement that it is not a licensed mental health professional.

Oregon and Iowa Oregon (SB 1546, approved Mar 31, 2026, effective Jan 1, 2027) requires a suicidal-ideation detection protocol and a referral carrying contact information and a hyperlink for 988 — or a youthline for a user under 25 — restricts simulated emotional dependence and romantic role-play for minors, and gives users a private right of action for the greater of actual damages or $1,000 per violation. Iowa (SF 2417, approved May 2, 2026; by its own terms the act applies July 1, 2027) requires conspicuous AI disclosure to minor account holders and a protocol referring users to a crisis service, and bars an operator from knowingly programming the service to represent that it provides professional psychology or behavioral-health services that would require a license — enforced by the Attorney General at up to $500,000 per operator, with no private right of action.

Hawaii Hawaii (SB 3001 CD1, the Artificial Intelligence Disclosure and Safety Act) is the cluster's first to be in effect: Governor Green signed it as Act 248 on July 14, 2026 (Gov. Msg. No. 1350), and it takes effect on approval. It requires operators of conversational-AI services to clearly disclose that a user is interacting with AI rather than a human; adds safeguards for minors — limits on manipulative engagement techniques and sexually explicit content, plus tools for parents and guardians to manage screen time and account settings; and requires a protocol to respond to a user expressing suicidal ideation or self-harm by directing them to crisis-intervention resources such as suicide hotlines and crisis text lines. Beginning January 1, 2028, operators must file annual reports with the Department of Health's Behavioral Health Administration. It is enforced as an unfair or deceptive trade practice.

Read this one carefully These are operator duties, not provider duties. Connecticut and Oregon both expressly carve out software that assists or supports patient or resident care services in a facility. If you run an AI scribe or a clinical decision-support tool, these four laws are not aimed at you — the ones that are aimed at you are Rhode Island's, Texas SB 1188, and the therapy bans above.

Requires Insurers (including health insurers) maintain a written AI governance program covering risk management, bias/data-quality controls, consumer notice, vendor oversight, and documentation available to regulators. As of early-to-mid 2026, roughly half the states (~24–25) had adopted it via bulletin. It's guidance, not a binding denial-of-care ban.

Requires Three more states put a licensed human between AI and a denial. Alabama (SB 63, signed Apr 16, 2026, effective Oct 1, 2026): a decision to "deny, delay, or modify" a prior-authorization request based on medical necessity "shall always be made by a licensed physician or other health care professional who is competent to evaluate any recommendation or conclusion of artificial intelligence." The plan must also certify annually to the department that its AI does not rely on a group dataset, is applied fairly and equitably, and does not discriminate — and must make prominent written disclosure of its AI use in its utilization-review policies and procedures.

Georgia (SB 444, effective Jan 1, 2027): AI may automate tasks and participate in decision-making, but such systems "shall not issue an adverse determination to a patient until a natural person qualifying as a private review agent or a utilization review entity conducts a utilization review in which a clinical peer participates. In no event shall artificial intelligence … supersede the judgment of such clinical peer."

Utah (SB 319, effective Jan 1, 2027): an insurer must disclose — to the department, to each health care provider in its network, and to each enrollee — if it uses AI to review authorization requests. And an adverse preauthorization determination on clinical or medical necessity must be made by an individual who "exercises independent medical judgment" and "does not rely solely on recommendations from any other source."

Context In 2025, legislators in 36 states introduced 168 AI-and-health bills, part of a record year for AI legislation generally. There is no single clean count of states with enacted healthcare-AI statutes — the honest summary is "dozens of states are legislating; a smaller subset have enacted binding health-AI or insurer-AI laws," and the pace is accelerating.