Can AI Deny Your Health Insurance Claim? State Rules for 2026

13 states now regulate artificial intelligence in health-plan utilization review, and they do not all answer it the same way. 11 require a qualified human to make the denial. Two others — Indiana and Utah — let AI drive it and instead require the insurer to disclose that it did. In the other 37 states, no law addresses AI in that decision at all.

The laws do not cover the plans many patients are actually on. A self-funded employer plan sits outside state insurance regulation entirely, and Medicare Advantage answers to federal standards rather than state ones: a Nebraskan on a commercial plan gets the protection of the state's new law, and the same Nebraskan on Medicare Advantage does not. Only five of the 14 laws require an insurer to disclose that it uses AI at all, and the disclosure does not always reach the patient — in Maryland it goes to the state regulator alone. The largest AI-assisted prior authorization program now running is Medicare's own: a pilot in traditional fee-for-service Medicare, launched on 1 January 2026, that no state law reaches, and in which the companies doing the reviewing are paid a share of the spending they avert.

Which states have a law

13 states have passed 14 of these laws; Illinois enacted two. As of August 30, 2026, 8 are in force — California and Illinois came first, on 1 January 2025, followed by Texas, Maryland, Nebraska, Washington, Indiana and Iowa. The other 6 are signed and waiting: Alabama's takes effect this October, Colorado's, Georgia's, Minnesota's and Utah's on 1 January 2027, and Illinois's second law a year after that.

The colour on the map is what the law does to the denial decision, not how recently it passed. Texas is the only state where an automated system may not issue an adverse determination at all. Ten states require a named clinician to make it — including Nebraska and Minnesota, whose AI clauses are often reported as mere “sole basis” rules but sit inside statutes that already require a physician. Indiana and Utah let AI make the call and require the insurer to say so. Faded states have passed a law that has not taken effect yet; click any state to jump to its row.

The rule most of them converge on

Washington states it most plainly. Under E2SSB 5395, in force since June 2026:

Artificial intelligence shall not be the sole means used to deny, delay, or modify health care services. Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity.

Approve by machine, deny by human. Texas goes further and bars an automated system from making an adverse determination “wholly or partly”. California and Alabama require the determination come from a licensed clinician who can actually evaluate the tool's conclusion. Illinois requires a clinical peer. Georgia says the software may never “supersede the judgment of such clinical peer.”

Nebraska adds something none of the others do, and it is the most interesting provision in the whole set. Section 13 of LB 77 bars a “utilization review agent” from being “compensated based on its volume of denials,” and bars it from tying any incentive or penalty for an individual reviewer to how many denials that reviewer issues or upholds. The term is not about software: a utilization review agent is the company that performs the review, and the individual reviewers are its staff. Software cannot be paid. The firm that deploys it can, and that is the money the section is aimed at — the financial structure around the decision, rather than the tool used to reach it.

What your insurer says about it

Nebraska is, as of August 30, 2026, the only state whose law in force makes a health plan say on its own public website if it uses AI to review your care — Utah's equivalent duty starts in January 2027. LB 77 §12(2) requires disclosure “to the department, to each health care provider in its network, to each enrollee, and on its public website.” That duty switched on 1 January 2026, which means there is now something checkable.

We checked the 7 carriers writing Nebraska commercial or marketplace business, where the duty plainly applies, in August 2026. 4 publish a statement. 3 say nothing either way.

The disclosures that do exist describe the same architecture the statutes draw. Aetna: “AI may be used to auto-approve claims that meet required criteria… Aetna never uses AI to deny care for medical reasons.” UnitedHealthcare: “AI does not make clinical decisions to deny coverage. Every clinical denial is reviewed by a qualified medical professional.” Ambetter: “AI-based algorithms may be used to assist in approving certain health care service requests. These tools are not used to make denial decisions and are not the only factor considered in any review.”

These disclosures exist because a law required them

Aetna publishes its notice on a page that serves 23 states through a dropdown. Select Nebraska and a heading appears: “Notice about the use of artificial intelligence (AI) in utilization management.” Select California, Texas, Washington, Massachusetts or Arkansas and it is not there — including three states that regulate AI in utilization review but do not require a website posting. Aetna's own Washington section explains the logic for a different rule: “Washington law requires us to post info on our website that identifies each HCBM we contract with.” The page carries what each state compels, and nothing else.

And Ambetter dated its Nebraska notice 18 December 2025 — two weeks before LB 77 took effect — using the statute's own words back to it: it does not use AI “as the sole basis to deny, delay, or modify health care service requests.”

The same companies disclosed in the state that asked and not in the states that did not. What their practices are elsewhere, these pages do not say — which is the argument for disclosure mandates, and unusually clean evidence for a policy question.

Why silence tells you nothing

Here is the flaw in how these laws are built. LB 77 is conditional: a review agent must disclose if AI-based algorithms are used. A plan that does not use AI has nothing to post. So when 3 of 7 Nebraska carriers say nothing, you cannot tell whether they use no AI or simply published no notice — and neither can the Department of Insurance, without asking.

Blue Cross and Blue Shield of Nebraska illustrates the gap precisely. It has a page titled “AI Use Disclosure.” It covers the company's chatbot, and says nothing about utilization review. That may be entirely accurate and entirely compliant. It also tells a patient nothing about whether an algorithm touched their prior authorization.

Utah fixed this on paper. Its SB 319, effective January 2027, requires the notice be posted “in a conspicuous location accessible by the general public” — the word “conspicuous” doing work that Nebraska's statute leaves undone. Today, finding these notices means knowing that Aetna's sits behind a state dropdown, Cigna's behind an accordion on a compliance page, and UnitedHealthcare's on a page called “required state notices.”

The federal rules are thinner than you would guess

Most national coverage of this topic implies a federal backstop. There is much less than that.

For Medicare Advantage, CMS has said an algorithm that decides coverage from a population data set rather than the individual patient does not comply with 42 CFR 422.101(c), and that a predicted length of stay cannot itself terminate coverage. Those are real constraints. But CMS proposed broader AI guardrails in the CY2026 Medicare Advantage rule and did not finalize them. What exists is narrower than the state laws above.

And the direction of preemption is the opposite of what most people assume. Under 42 CFR 422.402, federal standards supersede state ones for Medicare Advantage plans. So a Nebraskan on a commercial plan is covered by LB 77; the same person on Medicare Advantage is not. Self-funded employer plans sit outside state insurance regulation too.

Congress has passed no statute on AI in utilization review. The one federal attempt at broader guardrails, proposed in the CY2026 Medicare Advantage rule, was never finalized. That absence is what produced the patchwork: a Texan on a commercial plan cannot have an algorithm deny her claim even in part, a patient in 37 states has no rule at all, and a Nebraskan is covered on a commercial plan but not on Medicare Advantage. Whether a human being has to stand behind your denial depends on your zip code and on which plan you happen to have.

Medicare is running the largest AI prior authorization program in the country

CMS launched the WISeR Model — Wasteful and Inappropriate Service Reduction — on 1 January 2026 in New Jersey, Ohio, Oklahoma, Texas, Arizona and Washington, with prior authorization applying to services delivered from 15 January. It brings prior authorization to traditional Medicare for a set of services including skin and tissue substitutes, electrical nerve stimulators and epidural steroid injections for pain, and CMS contracts with vendors using AI and machine learning to run the reviews.

Two of those six states — Texas and Washington — have their own laws about AI in utilization review, and neither applies here. (Arizona requires a medical director to review a medical-necessity denial personally, but its law says nothing about AI at all.) WISeR is traditional Medicare, and state insurance codes do not reach it.

Now recall Nebraska's §13, which bars paying a review agent based on denial volume. WISeR pays its participants a cut of what they stop Medicare spending. CMS's own model page says they “receive a percentage of the expenditures associated with averted wasteful, inappropriate care as a result of their reviews.” The percentage is 25. Under the WISeR Participant Guide, a company earns 25% of the average Medicare spending for that service in that region, less a discount for the denials Medicare's own contractors would have made anyway, multiplied by a quality score that never falls below 90%. There is no cap. Payments, in CMS's words, “are calculated from requests that did not result in a paid claim.”

Nebraska bars pay tied to the volume of denials; WISeR pays a share of averted spending. Not identical, but the same idea — the reviewer earns more the less care is approved. A state legislature prohibited it for the plans it regulates. The federal pilot is built on it, and a Nebraskan on traditional Medicare gets the federal version, because their state's law stops at the Medicare line.

WISeR also skipped a step. CMS published it as a notice rather than a rule, with no comment period. In May 2026, at the request of four senators, the Government Accountability Office concluded that the notice is a rule for purposes of the Congressional Review Act, and therefore had to be submitted to Congress before it could take effect. It had not been. CMS submitted it on 9 June 2026, conceding the procedure, which opened a window for Congress to strike the rule down by simple majority. The Senate tried on 16 July 2026 and the motion failed 46 to 50. The White House had argued that day that WISeR is a “limited test program” aimed at services where up to two-thirds of what Medicare spent on them “may have been fraudulent, wasteful, or abused” — an estimate published with no methodology, though even taken at face value it does not conflict with anything here. A program can target real fraud and still sit outside the rules that protect the patient it denies. The model is scheduled to run to the end of 2031.

CMS says determinations come within three calendar days, two where delay could jeopardize the patient, and that “non-affirmations will require the review of a human clinician and cannot be performed solely by technology.” What that looks like on the ground is contested. In an April 2026 letter to the Secretary of Health and Human Services, Senator Maria Cantwell of Washington — whose state is one of the six, and who opposes the model — wrote that providers there report waiting 15 to 20 days for determinations, “most often denials issued without any clear justification.” Those are providers' accounts relayed by a senator, not measured data, and there is no published CMS figure to set against them.

Whether WISeR denies care wrongly is unknown and will take years of data to establish. What is knowable now is that a program placing an algorithm between a patient and a procedure sits outside every protection this page has described.

What to actually do about it

The useful question is not whether AI touched your claim. By every disclosure now on the record, and by law in 11 states, a human is supposed to make the denial. The useful questions are whether one actually did, and who.

• Ask who made the decision, by name. If your coverage is through an employer or the marketplace, federal law entitles you — on written request tied to your denial — to the name of the medical expert whose advice the plan obtained, whether or not it relied on that advice: 29 CFR 2560.503-1(h)(3)(iv). The Labor Department has said handing over the review company's name, or the expert's qualifications, does not satisfy it. This is also the one handle that reaches a self-funded employer plan, which no state law above can touch. Ask for the specialty as well, but know that the name is the part you are owed. Medicare Advantage and Medicaid managed-care plans must use a licensed, expertise-matched reviewer and are required to tell you nothing about who that was.
• Ask for the criteria. Several of these statutes require the determination rest on your own clinical history rather than a group dataset. Ask what specifically in your record supported the denial.
• Check your state's row above, then look for your carrier's AI notice — start at its legal, compliance or “state notices” page and look for a state selector.
• Appeal. Whatever produced the denial, the appeal path is the same, and appeals succeed often enough to be worth the effort. Our guide to appealing a medical bill and our prior authorization guide walk through it.

If you are looking at a bill rather than a denial, our analysis of insurer prior authorization denial rates shows how much the numbers vary between plans in the same state.

Sources

Every law above was read against the enrolled or chaptered text on the state's own legislature or revisor site; each bill number links to it. We did this because the secondary lists disagree with each other and with the statutes — most often because AI language was written into a bill and struck by amendment before passage, which a bill's title and status never show.

3 bills commonly listed as AI utilization-review laws are not, and we left them out:

• Arizona HB 2175: Enacted (Chapter 165, effective 1 July 2026) but contains no AI language at all — a full-text search for “artificial”, “algorithm” and “automat” returns nothing. It requires a medical director to individually review a medical-necessity denial without relying solely on any other source.
• Florida SB 794: Never enacted — it died in committee on 16 June 2025. Its text also addressed insurance claims generally rather than health-plan utilization review.
• Illinois HB 35: Passed the House and stalled in Senate Executive Committee. Illinois does have two AI utilization-review laws, but they are HB 2472 and SB 3114 — not this one.