AI in Insurance: Navigating the State-Level Regulatory Maze

The quick adoption of artificial intelligence in healthcare, especially for insurance claims, has created a messy and fragmented regulatory picture across the U.S. AI promises to be more efficient and accurate, but the risk of biased algorithms, black-box decisions, and flat-out wrong denials has lawmakers in statehouses and D.C. scrambling to respond, though not in a coordinated way. If you’re a buyer, part of a health plan compliance team, or a policymaker, you need to get a handle on this evolving patchwork to deal with the current environment and see what’s coming next.

The State-Level Scramble: A Patchwork of Protections

With no real federal framework for AI in claims, states are jumping in to fill the void. They’re enacting their own laws based on local concerns, which has led to a jumble of different rules instead of a single national standard. This is creating a headache for insurers and AI developers trying to keep up.

Florida’s Human Sign-Off Mandate

Florida is very clear with its demand for human oversight. A new law, Florida’s HB 527/SB 202, says AI can’t be the only reason an insurance claim is denied Florida HB 527/SB 202 legislative text. This legislation requires that a person has to physically review and sign off on any denial, no matter what an AI recommends. This rule is a direct response to fears about “robot-denials,” keeping a human being in the decision-making loop. For any health plan in Florida, this means that AI can do the prep work and flag things, but a human agent holds the final authority and is on the hook for a denial.

Arizona’s Independent Review Imperative

Arizona’s HB 2175 takes a different but just as important approach. The law demands that providers independently review claims and prior-authorization requests before an insurer can deny them Arizona HB 2175 legislative text. The text explicitly forbids relying solely on any other source, which is a clear reference to AI systems. This setup forces a clinical judgment call to remain the most important factor, stopping an AI’s output from being the final word on a patient’s access to care. For your compliance team, this means you need a rock-solid internal process for this independent clinical review, ensuring your AI tools are treated as decision-support assistants, not autonomous judges.

Maryland’s Contextual AI Requirement

Maryland’s HB 820 is more focused on the quality of how AI is used in utilization review. This law says that if you use AI for UR, it must consider a patient’s full story, their medical history, personal situation, and other relevant clinical details, in its decision Maryland HB 820 legislative text. This is meant to combat the risk of an AI making a bad call based on limited or out-of-context data, which we know can lead to improper denials. The goal is to push AI to be more patient-focused by integrating the nuances of an individual’s health. In practice, this means any AI system used in Maryland has to be designed to be good at pulling in and effectively weighing all kinds of different clinical inputs.

The Pending Federal Layer: H.R. 3514 and Medicare Advantage

While states are acting, a federal bill, H.R. 3514, has been making serious progress. Having already advanced through key House committees, this bill is the first major federal effort to force transparency and accountability on AI in prior authorization, and it’s aimed squarely at Medicare Advantage plans. If it becomes law, it would make MA plans that use AI for prior auth report a ton of statistics to the Centers for Medicare & Medicaid Services (CMS). The reporting under H.R. 3514 would probably cover approval and denial rates, the kinds of services being reviewed, and maybe even how the AI is affecting patient outcomes. This shows Washington is getting serious about understanding AI’s real-world impact, especially in programs serving vulnerable people. If you’re on a compliance team, consider this your heads-up: expect federal regulators to start demanding granular data on your AI’s performance, which will require much more sophisticated tracking and reporting capabilities than you likely have now. Even though it’s not law yet, the initiative points to where things are headed.

Distinguishing Enacted Law from Pending Legislation

It’s critical to know the difference between state laws already on the books and a pending federal bill. The laws in Florida, Arizona, and Maryland are active and enforceable right now, demanding immediate compliance. They are the messy, evolving, multi-state regulatory reality that insurers and providers must deal with today. These laws impose concrete operational requirements, human sign-offs, independent reviews, complete data inclusion, that directly affect how you can deploy AI. H.R. 3514, on the other hand, is still just a bill. It shows a clear policy direction and hints at future work, but it doesn’t have the force of law. Could that change? Absolutely. But confusing a pending bill with enacted law will lead you to waste resources and misunderstand your current compliance duties. Industry leaders need to track both streams carefully, because the federal field could shift fast, adding another layer of regulation on top of the existing state mandates. The National Association of Insurance Commissioners (NAIC) is watching all this and advocating for a more harmonized approach, but fragmentation is the reality for now.

The Imperative for Responsible AI: Beyond Compliance

All these different regulatory responses point to the fundamental challenge: how do we use AI’s potential in healthcare while controlling its risks? The incidents documented by the AI Health Risk Monitor, from bad drug interaction advice to missed diagnoses, show that we need clinically validated AI. An unguarded AI, operating without strong oversight, poses a significant health risk. Responsible AI is transparent, its decisions are explainable, and it’s subject to continuous validation. It integrates human expertise at critical points, as mandated by Florida and Arizona, and it considers a patient’s full clinical picture, as required by Maryland. For health plans and technology providers, just meeting the letter of these diverse laws is the absolute minimum baseline. The real work is embedding responsible AI principles into product design and daily operations. This means developing AI with built-in mechanisms for human review, ensuring algorithms are trained on diverse and representative data to minimize bias, and having clear pathways for auditing and correcting the AI when it drifts. The goal is to ensure AI genuinely improves patient care and access, instead of creating new barriers or risks.

Conclusion

The current state-by-state regulatory situation for AI in insurance claims is dynamic and frankly, a mess. Florida, Arizona, and Maryland have each set their own requirements, but they reflect a shared belief in the need for human oversight, independent clinical review, and complete data integration when AI is involved in healthcare decisions. At the same time, federal initiatives like H.R. 3514 signal a future with more transparency and accountability, especially for programs like Medicare Advantage. For everyone involved, understanding the specific mandates and the difference between enacted law and pending bills is paramount. Working through this field effectively means you have to be compliant with today’s rules while also proactively committing to developing and deploying responsible, clinically validated AI that puts patient safety and equitable access first.