A plain-English reference to the enacted and pending laws governing AI use in healthcare — what each one does, when it takes effect, and who enforces it. Because of telehealth, the law that applies to an encounter is generally the law of the state where the patient is physically located.
Facts on this page were verified against primary and secondary sources between July 7 and July 17, 2026, and are reviewed on a recurring weekly schedule.
Nondiscrimination rules for health programs receiving federal financial assistance. The § 92.210(b)–(c) duty — make reasonable efforts to identify and mitigate discrimination risk from patient-care decision-support tools, including AI — took effect May 1, 2025.
Current posture: HHS OCR announced on May 13, 2025 that it is not currently enforcing § 92.210(b)–(c). Non-enforcement is not repeal: the rule remains in the CFR, the general § 1557 nondiscrimination duty and its private right of action remain, and parallel state-law duties are unaffected.
Not AI-specific, but HIPAA governs all protected health information processed by AI tools. A Business Associate Agreement is required before any vendor — including an AI vendor — processes PHI, and the Security Rule risk analysis must cover AI systems.
Where an AI vendor processes Part 2 substance-use-disorder records, a Qualified Service Organization Agreement and the required consents apply.
Diagnostic or therapeutic AI can be a regulated medical device. More than 1,350 AI-enabled devices have been authorized, and predetermined change control plan (PCCP) guidance governs post-clearance model updates.
The 2026 National Health Care Fraud Takedown (announced June 2026) charged 455 defendants in connection with over $6.5 billion in alleged fraud. DOJ and CMS now use near-real-time data analytics to identify suspect billing and intercept payments — which means sloppy or undocumented AI-assisted coding and billing gets caught faster. AI billing is not itself a charged offense category; the documentation supporting each claim is what matters.
Standardized AI exclusion endorsements entered the market for 2026 renewals, and major carriers filed through 2026. Malpractice and CGL policies may exclude AI-related claims absent documented governance — which makes documented AI governance a renewal conversation, not a hypothetical.
The Texas Responsible Artificial Intelligence Governance Act requires providers using AI in care or treatment to disclose it to patients and prohibits manipulative or discriminatory uses. Enforcement is by the Attorney General only, with tiered civil penalties up to $200,000 per uncurable violation; there is no private right of action. Companion law SB 1188 (effective September 1, 2025) requires disclosure of AI used in a diagnostic capacity and adds health-records data-location provisions.
AB 3030 (effective January 1, 2025): practices using generative AI for patient clinical communications must include a disclaimer that the message was AI-generated plus instructions to reach a human provider — exempt when a licensed provider reviews the message first. AB 489 (effective January 1, 2026): AI systems and chatbots may not imply that care or advice comes from a licensed human — no licensed titles, license numbers, or clinical post-nominals; enforced through licensing boards as unlicensed-practice and discipline matters. SB 1120 (effective January 1, 2025): in health-plan utilization review, a licensed physician — not an algorithm alone — must make medical-necessity determinations.
Colorado repealed and reenacted its AI Act as SB 26-189 (signed May 14, 2026; effective January 1, 2027) — an automated-decision-technology disclosure-and-rights framework that largely exempts HIPAA-covered clinical AI use for providers operating from a Colorado location (the exemption has limits and does not cover employment-related AI decisions). The substantive healthcare obligations are HB 26-1195 (AI in psychotherapy; effective August 12, 2026) and HB 26-1139 (AI in health-insurance coverage decisions; effective January 1, 2027).
The Wellness and Oversight for Psychological Resources Act bars AI from providing therapy or making independent therapeutic decisions without oversight by a licensed professional.
A developer or deployer may not advertise or represent an AI system as — or as able to act as — a qualified mental-health professional. Notable as the first behavioral-health AI law with a private right of action.
Prohibits representing AI as able to provide mental or behavioral-health care as a professional, with additional restrictions in school settings.
Consumer-protection-style AI disclosure obligations (effective May 1, 2024), with HB 452 adding mental-health chatbot rules.
Licensed mental-health professionals may use AI only for administrative and limited supplementary tasks — AI may not be used for therapeutic communications, treatment decisions, or independent patient interaction. Patient consent is required before using ambient-listening or AI recording tools.
Not an AI statute, but it reaches every ambient AI scribe: Florida requires all-party consent to record a conversation. An AI scribe records the encounter, so specific patient consent is required before it runs.
| Jurisdiction | Measure | Status |
|---|---|---|
| New York | S7263/S7263A — AI chatbot impersonation of licensed professionals | Pending — not passed. Advanced to third reading March 4, 2026; amended May 26, 2026; recommitted to the Senate Rules Committee June 5, 2026. Would bar chatbot impersonation of licensed professionals, with liability not disclaimable via an AI-disclosure notice, and AG civil penalties up to $15,000/day. |
| New York | RAISE Act | Enacted — frontier-model safety law, effective January 1, 2027. Not the chatbot-impersonation bill. |
| Missouri | SB 1019 — behavioral-health AI | Effective August 28, 2026 (signature verification in progress). |
| Vermont | Act 156 (H.816) | Signed June 17, 2026, effective immediately; operative provisions under review. |
| Rhode Island | H 7349 / S 2197 | Enacted June 22, 2026; effective date to confirm. |
| Idaho | SB 1297 — Conversational AI Safety Act | Effective July 1, 2027. |
| Nebraska | LB 525 — Conversational AI Safety Act | Effective July 1, 2027. |