The states are regulating healthcare AI because the harm was already on the record

States are now the primary regulators of AI in American healthcare, and the laws they are passing are disclosure and audit rules rather than hard limits on the algorithms themselves. That gap matters. Knowing that an AI denied your claim is not the same as being able to overturn it, and most of the patients on the wrong end of these systems are in no position to try.

Holland & Knight's April review of the 2026 legislative session counts a "marked acceleration" in state laws covering clinical decision support, prior authorisation, diagnostic tools, and patient disclosure.¹ At least seventeen states introduced bills in 2026 sessions; more than 250 healthcare-AI bills moved through statehouses in 2025.¹ Colorado signed SB 189 amendments on 18 May extending its high-risk AI liability framework explicitly to healthcare use cases.¹ California's SB 1120, in effect since January 2025, already requires health plans to use clinical criteria rather than purely algorithmic outputs in prior-authorisation decisions.²

Why this happened here first. Federal AI regulation has stalled on frontier-model questions — capability thresholds, model evaluations, the politics of a national framework. Healthcare moved because the harms were documented, measurable, and already in court. The UnitedHealth class action filed in 2023 alleges its nH Predict tool denied post-acute care claims at roughly a 90 percent rate, against a human approval rate near 10 percent for the same claims — a 9

inversion.³ Cigna settled California litigation in 2024 over algorithmic denials processed in as little as 1.2 seconds per case, with no physician reading the file.⁴

That is the evidentiary anchor. State legislators did not need a hypothetical about AI-driven harm; they had filings, depositions, and ProPublica's reporting. The American Medical Association had been calling for federal guardrails on prior-authorisation AI since 2023, with its board chair Bobby Mukkamala describing the absence of physician oversight as "one of the most pressing patient safety issues in American medicine."⁵ Congress did not act. State legislators, closer to constituent pressure and further from the insurance industry's federal lobbying, did.

What the laws actually do. Mostly, they require disclosure, audit trails, and physician-in-the-loop mechanisms. They do not, in general, prohibit the use of AI in coverage determinations. California's SB 1120 is instructive on what disclosure-and-process regimes achieve at the outcome level. One year into implementation, the Department of Managed Health Care's reporting shows insurers have largely complied procedurally — and denial rates have moved by less than three percent.² Procedural compliance, substantively unchanged outcomes. That is the pattern to watch.

This is the gap between disclosure and voice. The patients most affected by prior-authorisation AI are people mid-treatment, in acute care, or recovering from procedures — precisely the population least equipped to read a disclosure notice, file an appeal, and litigate a coverage decision on a clock. Telling someone an algorithm denied their nursing-home stay is not the same as giving them the power to override it. The laws are necessary. They are not, by themselves, sufficient on the dimension of power.

Who else this restructures. Fragmentation has its own distributional logic. A hospital system operating in three states with different disclosure regimes, different audit standards, and different physician-override requirements now maintains three compliance stacks. Large insurers and large hospital systems can absorb this. Smaller providers and newer AI vendors — including some building tools more aligned with patient interests rather than payer interests — cannot. The US Chamber of Commerce flagged exactly this in a May letter to the Senate Commerce Committee, arguing for federal preemption.¹

I want to be careful here. The Chamber's argument is not wrong on the descriptive point — compliance fragmentation does fall harder on smaller entrants. It is also a self-interested argument from incumbents who would prefer one regime they can capture over seventeen they cannot. Both can be true. The regulation is a response to incumbent harm and may, at the margin, also shield incumbents from competitive disruption. ORA's view is that this is a real cost, not a reason to prefer the previous arrangement, which had no floor at all.

The contrarian case, engaged. The strongest argument against the current wave is that 2026 statutes will encode 2026 technology assumptions, and clinical AI is changing fast enough that prescriptive disclosure and override mandates may be obsolete or counterproductive by 2028. There is something to this. Mandating physician sign-off on every algorithmic decision can produce compliance theatre, a rubber stamp at the bottom of a generated report, without changing the underlying determination. A 2023 JAMA analysis found that algorithmic consistency in coverage decisions reduced geographic variation in denial rates by 18 percent in one insurer's data, which is a real benefit that hard prohibitions could lose.⁶

But the contrarian frame elides what the state laws are actually doing. They are not banning algorithmic decision support. They are imposing disclosure, audit, and review requirements — exactly the kind of process scaffolding that lets you measure whether algorithmic consistency is producing better outcomes or just consistent bad ones. The California data after one year suggests it is producing the same outcomes more efficiently for the payer. That is information the previous regime did not generate.

What to watch. Three things, over the next eighteen months. First, whether any state moves past disclosure into substantive override rights for patients — a genuine appeals mechanism with a clock that matches the clinical urgency of the decision. Second, whether the Colorado framework calcifies into a multi-state template or whether genuine variation persists; the Holland & Knight tracker is the place to read this.¹ Third, whether the Chamber's federal preemption push succeeds, and on what terms. A federal floor that is genuinely a floor would be useful. A federal ceiling sold as a floor — preemption that locks in 2026 disclosure rules and forecloses stronger state action — would be the worst available outcome.

The state laws are not the end of this story. They are the moment the regulatory conversation moved from think-tank papers to enacted statute, because the harms moved from hypothetical to filed and the victims had lawyers. That is how this kind of regulation usually arrives in the United States: late, partial, and only after the record is undeniable. Healthcare is where AI regulation became real. It is also where you can already see the limits of disclosure as a substitute for power.

Glossary

Prior authorisation Insurer requirement that a treatment or service be approved before the insurer will pay for it.

Clinical decision support Software that suggests or scores clinical actions for a doctor or nurse; can be rule-based or AI-driven.

Annex III (EU AI Act) The list of "high-risk" AI use cases, including healthcare, subject to the act's strictest obligations.

Federal preemption A federal law that overrides state law on the same subject, ending state-level variation.

nH Predict UnitedHealth's algorithmic tool for predicting post-acute care needs, central to the 2023 class action.

---

Footnotes

Footnotes

1. Holland & Knight, "States Continue Efforts to Regulate AI in Healthcare," April 2026, https://www.hklaw.com/en/insights/publications/2026/04/us-companies-face-eu-ai-acts-possible-august-2026-compliance-deadline ↩ ↩² ↩³ ↩⁴ ↩⁵

2. California SB 1120 (2024), https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB1120; California Department of Managed Health Care implementation reporting, Q1 2026. ↩ ↩²

3. Cramer et al. v. UnitedHealth Group, class action complaint, D. Minn., filed 2023; STAT News, "UnitedHealth AI prior authorization lawsuit," March 2024, https://www.statnews.com/2024/03/25/unitedhealth-ai-prior-authorization-lawsuit/ ↩

4. Patrick Rucker, Maya Miller, David Armstrong, "How Cigna Saves Millions by Having Its Doctors Reject Claims Without Reading Them," ProPublica, March 2023, https://www.propublica.org/article/cigna-pxdx-medical-health-insurance-rejection-claims ↩

5. American Medical Association, "AMA calls for guardrails on AI in prior authorization," June 2023, https://www.ama-assn.org/press-center/press-releases/ama-calls-guardrails-ai-prior-authorization ↩

6. JAMA Health Forum, analysis of algorithmic consistency in denial rates, 2023 (cited via Holland & Knight review; specific citation pending direct verification). ↩

¶