Limitations on use of artificial intelligence by health benefit plan providers
AL AI Prior Authorization Law
Artificial intelligence · Health
Regulates insurers that use AI to decide medical-necessity prior authorization requests. AI determinations must rest on the individual enrollee's medical history and clinical circumstances, not group datasets, and any denial, delay, or modification must be made by a licensed clinician. Plans must disclose their AI use and keep patient data used by AI within its stated purpose consistent with HIPAA. The effective date is October 1, 2026.
- Where
- Alabama
- Citation
- Ala. Code § 27-1-17.2 (Act 2026-589, SB63)
- Status
- Enacted, not yet in force
- In force since
- 2026-10-01
- Enforced by
- Alabama Department of Insurance
- People can sue
- No
- Penalties
- After notice and a hearing, the Department may impose a corrective plan; for repeat violations amounting to a general business practice it may impose administrative fines of up to $5,000 or suspend or revoke the certificate of authority.
- Applies to
- Health benefit plan providers (insurers, HMOs, nonprofit health care service plans, agricultural organization health plans) and their internal or contracted utilization review entities
- Applies to comprehensive health benefit plans; excludes limited-benefit lines such as dental-only, Medicare supplement, long-term care, and disability income
What a privacy notice must say
- Make prominent written disclosures of AI use in utilization review in policies and procedures, and review AI outcomes periodically for accuracy.Ala. Code § 27-1-17.2(c)(1)-(2) · From 2026-10-01
Practices it requires
- Base AI medical-necessity determinations on the enrollee's medical history, individual clinical circumstances, and medical record, and certify annually that the AI does not rely on group datasets and does not discriminate.Ala. Code § 27-1-17.2(b)(1)-(2) · Only if: Uses AI for prior authorization · From 2026-10-01
- Any denial, delay, or modification of prior authorization based on medical necessity must be made by a licensed physician or other competent health care professional.Ala. Code § 27-1-17.2(b)(3) · From 2026-10-01
- Ensure patient data used by AI in utilization review is not used beyond its intended and stated purpose, consistent with HIPAA.Ala. Code § 27-1-17.2(c)(3) · From 2026-10-01
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective date October 1, 2026 is from ALISON (section header and bill record for SB63, 2026RS).
Research reference, not legal advice.