State AI insurance laws give practices new grounds to fight denials and downcodes

Insurers in Alabama, Iowa and Washington can no longer deny care on the strength of an artificial intelligence tool alone. Three more states join them Jan. 1, and Illinois follows in 2028 with a ban on automated downcoding.

At least seven states passed laws this year limiting how health insurers use AI in coverage decisions, according to a July roundup from Becker's Payer Issues. For practice billing teams, the statutes do something more useful than regulate technology. They turn AI-driven denials and algorithmic downcodes into appeal arguments with state law behind them, at least for patients whose coverage the laws reach.

That leverage only pays off if practices appeal in the first place. Taya Gordon, CEO of Atlas & Perpetua Healthcare Consulting, told Physicians Practice in April that the revenue leak she finds most often when she reviews a practice is "probably unmanaged denials," along with claims "just sitting in AR."

In effect now

Washington, SB 5395 (effective June 11, 2026). Only a licensed physician or other health professional may deny a prior authorization request on medical necessity grounds, and AI cannot be the sole basis to deny, delay or modify care, according to a release from sponsor Sen. Tina Orwall, D-Des Moines. The law covers private carriers and the state's public employee health programs.

Iowa, HF 2635 (AI limit effective July 1, 2026). Utilization review organizations may use AI for an initial review of a prior authorization request, but under the enacted text, it cannot be the sole basis to deny, delay or downgrade a medical necessity request. Starting Jan. 1, 2027, those denials and downgrades must come from a reviewer in the same or a similar specialty as the requesting clinician, in a signed written statement.

Alabama, SB 63 (effective Oct. 1, 2026). A decision to deny, reduce or defer a prior authorization must be made by a licensed physician or other qualified health care professional, and AI-assisted decisions must reflect the patient's own medical history and clinical circumstances, according to the bill text. Insurers must disclose AI use in utilization review in writing, to the plan sponsor for group coverage and to the enrollee for individual coverage, and certify annually to the state Department of Insurance that their tools don't rely solely on group data.

Coming Jan. 1, 2027

Colorado, HB 1139. Signed June 2, the law reaches carriers, pharmacy benefit managers, private utilization review organizations and the state's Medicaid program. AI-assisted determinations must rest on the individual patient's clinical history, denials must be reviewed by a licensed clinician and AI tools must be periodically checked for accuracy. Payers also must tell state regulators where they use AI and how humans oversee adverse decisions.

Georgia, SB 444. AI cannot be the sole basis for a private review agent's adverse determination, a qualified clinical peer must approve final denials and AI output cannot override that peer's judgment. Sponsor Sen. Kay Kirkpatrick, R-Marietta, told Georgia Watch there "needs to be a human review of the information before they turn you down."

Utah, SB 319. Insurers must disclose AI use in prior authorization reviews to the state, to each in-network provider and to enrollees, and adverse determinations require independent medical judgment, according to the enrolled bill. Denial notices must list approved and denied billing codes on the first page, nonurgent decisions are due within seven calendar days of a complete request and insurers must publicly post approval, denial and appeal statistics.

Coming Jan. 1, 2028

Illinois, SB 3114. The Transparency in Downcoding Act, championed by Rep. Sharon Chung, D-Bloomington, goes furthest on downcoding. Automated tools may flag a claim, but a person must make or review every downcoding decision. Insurers can't downcode based on diagnosis codes alone or target physicians who treat complex or chronic patients, and they must tell the physician the clinical reason and offer a clear dispute process.

The ERISA gap

Illinois spells out what applies to all of these laws: They don't reach self-insured employer plans, which federal ERISA rules govern. The Illinois act also excludes workers' compensation. Medicare Advantage plans, which follow federal standards, generally sit outside state insurance law as well.

That makes plan type the first question in any appeal built on a state statute. Billing teams should confirm whether the patient's coverage is fully insured or self-funded, often flagged on the card as "administered by" a carrier, before citing a state law the plan can simply ignore.

How to use the laws on appeal

• Ask who decided. Request the name and credentials of the reviewer behind a medical necessity denial. Washington, Alabama, Colorado, Georgia and Iowa all require a licensed or peer human to make or approve the call.
• Ask whether AI was used. Alabama and Utah require disclosure, so a missing or vague answer is itself worth noting in the appeal.
• Cite the statute by number. An appeal letter that names the law and the specific requirement the denial appears to violate is harder to rubber-stamp.
• Track denials by state and plan type. Fast, uniform denials across unrelated patients are a pattern regulators want to see. Alabama's Department of Insurance, for example, can order a corrective plan.
• Start the downcoding file now. Gordon recommends a monthly report comparing the CPT codes a practice billed with the codes it was paid for. "Anytime there's a variance, that means you potentially are being subjected to downcoding by an insurance carrier," she said. That record becomes a baseline when the Illinois law kicks in.

The laws won't stop every bad denial, and an approved prior authorization still doesn't guarantee payment. The next wave lands Jan. 1, when the Colorado, Georgia and Utah laws take effect and Iowa's specialty-matched reviewer rule begins.