What healthcare practices need to know about AI

A growing share of prior-authorization and coverage decisions now runs through AI. In 2026 a wave of states moved to govern it, and the through-line is blunt: a health plan can use AI to help, but it can't let AI be the one that says no.

Washington is the clearest example. Under SB 5395, effective June 11, 2026, artificial intelligence may not be the sole basis to deny, delay, or modify care, and a determination of medical necessity must be made by a licensed physician or other licensed health professional acting within their scope. Carriers must also begin reporting aggregate prior-authorization data — including AI-assisted denials — to the state by October 1, 2026. Maryland's HB 1563, effective June 1, 2026, takes the transparency route: insurers must report to the Insurance Commissioner each quarter how many adverse decisions they issued, for what services, and whether AI or other software was used — and the Commissioner can investigate spikes, especially in emergency-department denials.

They aren't alone. Georgia (SB 444) and Utah (SB 319), both effective January 1, 2027, let insurers use AI in prior authorization but bar an AI-issued denial without a licensed professional's review (Georgia) and require disclosure of AI use plus independent professional judgment (Utah). Iowa’s HF 2635 lets a utilization review organization use AI for the initial review of a prior-authorization request but bars AI as the sole basis for a decision to deny, delay, or downgrade a medical-necessity request; for requests made on or after January 1, 2027, a denial or downgrade must be made by a same-specialty physician or clinical peer who signs a written statement of the specific reasons. Indiana (HB 1271, effective July 1, 2026) bars AI as the sole basis to downcode a claim without professional review — and, notably, also bars providers from using AI to submit claims without a clinician's or biller's review. Alabama (SB 63, effective October 1, 2026) makes insurers certify annually that their AI doesn't rely on group datasets, doesn't discriminate, and is monitored for accuracy. The federal backdrop is CMS's guardrails for Medicare Advantage, which require AI prior-authorization tools to weigh the patient's individual clinical circumstances rather than a group dataset.

These laws regulate health plans, not your practice — but the standard they're writing down is the same one that governs your AI use under malpractice law and Section 1557: AI can assist, but a qualified human has to make the call, the tool has to be monitored, and the decision has to be documented. When a payer leans on AI to deny your patient's care, several of these laws now give you a basis to insist that a licensed reviewer — not an algorithm — signed the denial.

And the same logic runs back toward you. The defensible position for any AI a practice uses — scribing, coding, decision support — is human review of the output, periodic checks that the tool still performs, and a record showing both. An AI Governance Shield™ assessment documents exactly those controls, so the human-in-the-loop standard regulators are now writing into law is something your practice can actually show.

This article is general information, not legal advice; laws vary by state and change frequently, and the laws above take effect on different dates. Confirm your state's rule with counsel.

AI medical scribes are everywhere now — they listen to the visit and draft the note. What most practices don't realize: recording a patient encounter without consent isn't just a privacy issue. In roughly a dozen states it can be a crime.

About a dozen states require all parties to consent before a conversation is recorded — including California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington (a few others vary by call type). Penalties range from civil damages to criminal charges. In Florida, recording a conversation without consent can be a third-degree felony — up to five years and a $5,000 fine (Fla. Stat. § 934.03). An ambient AI scribe records the encounter, so using one without specific patient consent can put the provider on the wrong side of that line.

This isn't theoretical. Patients have filed putative class actions against health systems over AI-scribe recording without consent — including Saucedo v. Sharp HealthCare (San Diego Superior Court, Nov. 2025) and, in 2026, suits against Sutter Health and MemorialCare over a widely used ambient scribe — alleging violations of state medical-confidentiality and invasion-of-privacy laws and the Federal Wiretap Act. These are filed complaints, not rulings; the claims have not been decided.

And the part that surprises practices most: the liability lands on you, not the vendor. A vendor's terms — and even FDA clearance for other AI tools — don't transfer the risk. Under malpractice law, HIPAA, and these recording statutes, the practice and the clinician carry it.

The law actually rewards governance. California, for example, exempts AI-generated patient communications from its AI-disclaimer mandate when a licensed provider reviews them (Cal. Health & Safety Code § 1339.75) — a statutory recognition that human review is what makes AI use defensible.

What actually protects you isn't avoiding AI — it's governing it. For an ambient scribe: (1) specific, documented patient consent to record (not buried in a general treatment consent), (2) a provider review-and-edit step before the note is signed, and (3) a BAA covering the audio and transcript. The practices that can show those three things — with an audit trail — are positioned to defend the tool.

An AI Governance Shield™ assessment produces exactly that: a documented, independently verified record of your AI governance — including consent capture and an audit trail — so if a patient, a regulator, or your malpractice carrier ever asks, you have the answer on file.

This article is general information, not legal advice; recording laws and AI regulation vary by state and change frequently. Confirm your state's rule with counsel.

Practices are handing coding and documentation to AI — autonomous coders, ambient tools that suggest codes, risk-adjustment engines. The pitch is speed and revenue. The risk that comes with it is federal, and it doesn't transfer to the vendor.

The False Claims Act (31 U.S.C. § 3729) imposes liability on anyone who "knowingly presents, or causes to be presented, a false or fraudulent claim for payment." When an AI tool produces a code the documentation doesn't support and that claim goes to Medicare or Medicaid, the practice that submits it owns the exposure — civil penalties (currently adjusted to roughly $14,308–$28,619 per claim) plus treble damages. "The AI did it" is not a defense; the statute turns on what you submitted.

This is an active enforcement priority. The Department of Justice reported a record $6.8 billion in False Claims Act recoveries in FY2025, stood up a dedicated fraud-enforcement division, and has flagged AI-driven EHR and coding manipulation as a focus. In January 2026, Kaiser Permanente paid $556 million to resolve Medicare Advantage risk-adjustment coding allegations — the kind of chart-mining that AI coding tools are built to automate.

And this one is federal, which matters right now: even as Washington moves to preempt some state AI laws, the False Claims Act is untouched by that fight. The exposure doesn't go away.

What defends you is the same thing across every regime — human review and an audit trail. Codes validated against the underlying documentation, a sign-off step before claims go out, and periodic audits comparing AI output to the record. An AI Governance Shield™ assessment documents exactly those controls for AI-assisted coding, so if a payer, an auditor, or the government ever asks, your oversight is already on the record.

This article is general information, not legal advice. Penalty amounts are inflation-adjusted and change; confirm current figures and your obligations with counsel.