Utah's legislature passed a bill about artificial intelligence in health insurance by a vote of 69 to 1 in the House and 28 to 0 in the Senate, and the near-unanimity has a simple explanation. Senate Bill 319 bans nothing. It allows insurers to use artificial intelligence and generative artificial intelligence in utilization management, takes the trouble to define both terms, and then regulates something narrower: the person who signs an adverse determination. Under the bill, a denial resting on clinical or medical necessity has to be made by an individual exercising independent medical judgment, and that individual may not rely solely on recommendations from any other source. The enrolled text took effect January 1, 2027, pushed back from the May 2026 date in the version introduced in February.
The second half of the law is a disclosure requirement with four audiences. An insurer that uses AI in preauthorization has to tell the Utah Insurance Department, tell every provider in its network, tell each enrollee, and post the fact conspicuously on its own public website. Read together, the two provisions describe a theory of regulation that most states have now settled into: the algorithm may run, the human signature is mandatory, and the disclosure is the only part that lets anyone outside the company check whether the signature meant anything.
The AI provisions are the smallest part of the law
The provisions that will change how a Utah clinic operates are the operational ones, and they have nothing to do with algorithms. Insurers must decide a standard preauthorization request within seven calendar days and an urgent one within 72 hours. An authorization that is granted has to stay valid for at least 12 months for chronic or long-term drugs, devices, and services, and at least six months for outpatient care. Once an insurer approves a service and the patient receives it, the insurer generally may not revoke the authorization or deny payment afterward. A denial has to explain the clinical rationale, name the criteria applied, list the relevant billing codes, and estimate the patient's cost-sharing.
Then there is the reporting. Insurers have to publish their preauthorization requirements, their approval and denial rates, the clinical criteria they use, and their appeal statistics, and they report to the Insurance Department annually. The Utah Academy of Family Physicians reads that posting requirement as the part of the law most likely to change physician behavior, because a clinic that can see an insurer's denial pattern in advance can aim its documentation at the criterion that keeps generating the denials.
The validity periods and the retroactive-denial limit are the provisions with the most immediate effect on a clinic's books, because they convert an approved authorization into something closer to a contract term than a permission slip. The smaller effect is on the administrative load. Prior authorization itself survives the bill untouched, so a Utah practice still files the same requests against the same criteria, and the family physicians' association was explicit that the workload is reduced rather than eliminated.
The disclosure duty lands on top of all of that and inherits its force from it. A sentence on a website saying that AI is used somewhere in the review process is close to meaningless on its own. A sentence on a website saying that AI is used, published by an insurer that also has to publish how often it denies and how often it is reversed, is a different document. Both requirements sit in the same bill, and they work as a pair.
Independent medical judgment is the phrase worth watching
Utah's adverse-determination standard is short enough to quote. The reviewer "may not rely solely on recommendations from any other source." The legislature did not write the word algorithm into that sentence, and that was deliberate: the same clause reaches a nurse reviewer's recommendation, a vendor's clinical guideline, and a model's output without naming any of them. The statute adds that the reviewer must know the enrollee's condition or consult a specialist who does.
The distinction between that language and a plain human-in-the-loop requirement is where states are splitting. Oklahoma's proposal would require human review without requiring independent human judgment, which sounds like a drafting nicety until you picture the workflow it permits: a reviewer working a queue of automated recommendations, agreeing with each one, at a volume no one could sustain by reading the file. A signature obtained that way satisfies a human-review rule and defeats the point of Utah's.
The alternative drafting approach, visible in the other state laws, regulates the reviewer's inputs instead of the reviewer's independence. A statute can list what the person deciding must consider, which is what Washington did, or it can prohibit the person deciding from leaning on a single outside recommendation, which is what Utah did. The second is harder to verify from a piece of paper and easier to write around the peculiar fact pattern of a model whose output arrives looking like a colleague's advice. The first is easier to audit and easier to satisfy by reciting the checklist.
Enforcement is the open question. The law gives the Insurance Department a disclosure to collect and reporting to receive, and it gives an enrollee a denial notice with the criteria and the rationale, which is raw material for an appeal. What it does not supply is an accuracy standard for whatever model an insurer licenses, an audit right over the model itself, or a right for a patient to be told in the denial notice that AI participated in the review. The disclosure lives on the website, not in the envelope.
Seven states have now written some version of this
Utah is not early. A July analysis from Sheppard Mullin counts four states that enacted new laws this year, on top of a first wave documented in April. The National Association of Independent Review Organizations puts the running total at seven: Alabama, Colorado, Georgia, Illinois, Iowa, Utah, and Washington.
The differences among them are of degree rather than direction. Georgia's Senate Bill 444, also effective January 1, 2027, lets AI automate tasks and participate in decisions but forbids it from issuing an adverse determination until a person conducts a utilization review with a clinical peer, and blocks AI from superseding that peer's judgment. Georgia does not require telling members or providers that AI was used. Iowa's House File 2635, effective since July 1, allows AI on the initial review only and bars it from being the sole basis for denying, delaying, or downgrading a medical-necessity request, with a written attestation to the requesting provider about reviewer qualifications.
Washington's Senate Bill 5395, effective June 11, is the strictest of the group. Only a licensed physician or other licensed health professional acting within scope may deny on medical-necessity grounds, and that reviewer has to weigh the provider's recommendation, the enrollee's clinical history, and the enrollee's individual circumstances rather than group data alone. The law adds fairness and privacy requirements, periodic accuracy reviews, and an audit right for the insurance commissioner. Utah's law requires independent judgment and public disclosure but stops short of restricting who may make the decision.
Above the states, the federal floor has moved too. The Department of Health and Human Services and CMS pledged in June 2025 that medical professionals would review all clinical denials, and the agency's WISER utilization-review pilot, live since January, allows AI to flag cases while requiring a qualified clinician to affirm before a non-affirmation determination issues.
What the Senate found when it asked for the documents
The reason legislatures are writing any of this is a 54-page staff report the Senate Permanent Subcommittee on Investigations released in October 2024, after collecting more than 280,000 pages from UnitedHealthcare, Humana, and CVS. The report found that UnitedHealthcare's prior authorization denial rate for post-acute care rose from 10.9 percent in 2020 to 22.7 percent in 2022, that its skilled nursing denial rate increased ninefold between 2019 and 2022, and that in 2022 UnitedHealthcare and CVS denied post-acute requests at roughly three times their overall denial rates while Humana's rate was more than sixteen times higher. The increases coincided with the spread of nH Predict, a length-of-stay prediction tool built by UnitedHealth's NaviHealth subsidiary. The subcommittee reported that CVS deployed a Post-Acute Analytics program that initially projected $10 million to $15 million in three-year savings and was later forecast at $77.3 million. All three insurers disputed the report's characterization.
A related lawsuit, Estate of Lokken v. UnitedHealth Group, alleges that the algorithm carried an error rate near 90 percent on appealed denials and that case managers were pressed to follow its length-of-stay predictions over clinical objections. UnitedHealth has said the suit lacks merit. During the same period the American Medical Association surveyed physicians and found that 61 percent feared payers' use of unregulated AI was increasing prior authorization denials. Bruce A. Scott, the AMA's president at the time, described insurers as using automated systems to produce "systematic batch denials with little or no human review."
The appeal is the only place the standard gets tested
An "independent medical judgment" clause is not self-enforcing. Nothing in the statute sends an inspector to watch a nurse reviewer read a file, and the Insurance Department's authority runs through the disclosures and the reports it receives rather than through the individual decision. The mechanism that turns the clause into something observable is the one the bill rebuilt: the denial notice. A notice that has to name the criteria, the clinical rationale, and the billing codes gives the person appealing a specific claim to attack, and the insurer has to answer with a record.
Multiply that across a book of business and the posted statistics become the enforcement tool that the disclosure alone is not. An insurer whose denial rate runs far above its peers, or whose appeal reversals run far above its own, becomes visible to the Insurance Department, to the lawyers who handle coverage disputes, and to the trade press. The external review organizations that decide appeals after an insurer upholds its own denial sit one layer further out, and their trade group reads the newer state laws as confirming a division of labor: software accelerates the work, people own the decision.
That is a decentralized way to police a technical standard, and it depends on the published numbers being comparable across insurers, which depends in turn on the Insurance Department defining what gets counted. The bill gives the department the reporting obligation and leaves the counting rules to it.
What January 1 changes for a patient in Utah
The practical effect arrives in stages. From January 1, a Utah enrollee whose request is denied should receive a notice naming the clinical criteria, the rationale, and the billing codes, and a chronic-condition authorization should last a year rather than a quarter. If the denial rests on medical necessity, the decision was supposed to have been made by someone exercising independent judgment rather than relaying a recommendation, and the insurer was supposed to have posted whether AI participates in its review at all. An appeal is the moment that claim gets tested, because the denial notice and the posted policy are the two documents a reviewer can be held to.
What the law leaves untouched is the harder question the Senate report raised. Nothing in Senate Bill 319 requires an insurer to show that its model is accurate, and nothing sets a threshold at which an error rate becomes a compliance problem. The disclosure obligation is real, and so is the reporting. Neither one is a ceiling on how the algorithm gets used. Utah answered the question of who signs. It deferred the question of whether the answer that person signs is right.
Primary sources
- Utah Senate Bill 319, Health Insurance Preauthorization Amendments, 2026 General Session, for the sponsorship by Sen. John D. Johnson and floor sponsor Rep. Katy Hall, the 69 to 1 House vote, the 28 to 0 Senate vote, the March 19, 2026 signing, the definitions of artificial intelligence and generative artificial intelligence, the disclosure obligations, the independent medical judgment standard, the seven-day and 72-hour decision deadlines, the 12-month and six-month authorization validity periods, the limit on retroactive revocation, and the January 1, 2027 effective date.
- Utah Code Section 31A-22-650 (Chapter 240, 2026 General Session) for the statutory text of the adverse determination standard and the annual reporting requirements.
- Sheppard Mullin Healthcare Law Blog, "Additional States Continue Legislative Trend with New Laws Limiting Use of Artificial Intelligence in Health Insurance Determinations," July 2, 2026, for the Georgia Senate Bill 444, Iowa House File 2635, and Washington Senate Bill 5395 provisions and for the April 2026 survey covering Pennsylvania, Oklahoma, Indiana, Alabama, Louisiana, and New Hampshire.
- U.S. Senate Permanent Subcommittee on Investigations, "Refusal of Recovery: How Medicare Advantage Insurers Have Denied Patients Access to Post-Acute Care," Oct. 17, 2024, for the 280,000 pages produced, the post-acute denial rate increase, the ninefold skilled nursing increase, the threefold and sixteenfold comparisons, and the CVS savings projection, as reported by Healthcare Dive and STAT News.
- American Medical Association press release, Feb. 24, 2025, for the 61 percent survey figure and the statement by then-president Bruce A. Scott.
- Utah Academy of Family Physicians, "Utah SB 319: Health Insurance Prior Authorization Amendments," March 6, 2026, for the provider-side reading of the validity periods, the public posting requirements, and the denial notice contents.
- National Association of Independent Review Organizations, policy update on state regulation of artificial intelligence, for the seven-state list of enacted laws.