The Evolving Regulatory Landscape for AI in Healthcare
Healthcare providers face a complex and evolving legal landscape surrounding the use of AI with the provision of healthcare services and the use of protected health Information (PHI).
AI has been expanding into a wide range of healthcare services, medical devices and operations. This expansion presents challenges for healthcare providers to understand the type of AI incorporated in the healthcare service, medical device, or operations solution and to identify the relevant regulatory requirements applicable to that type of AI. An increasing number of state laws and regulations regulate or prohibit certain healthcare specific uses of AI.
Healthcare providers must be mindful of both federal and new state statutes and regulations as they develop their AI governance programs and align with the laws and regulations around the use of AI tools.
The landscape for AI in healthcare is shifting dramatically as state legislators move beyond general guidelines to establish concrete enforcement mechanisms. Several states have implemented legislation to guide the use of AI in healthcare, including the following:
· California, Utah, Nevada, Texas and Illinois are bringing artificial intelligence-related healthcare regulations into sharper focus by limiting how AI is portrayed and what kind of care can be provided with the help of AI.
· California laws prohibit AI systems from implying the presence of licensed medical oversight where none exists and create new compliance considerations by giving the state professional licensing boards direct authority to investigate violations.
· Utah’s law requires physicians to “prominently disclose” when a person is interacting with AI in providing medical advice or services.
· Illinois’ law prohibits the use of AI in providing mental health and therapeutic decision making, unless an individual, corporation, or entity falls under an exemption.
· Nevada’s law prohibits AI providers from utilizing AI systems to provide or claim to provide professional mental or behavioral healthcare.
· Texas laws require providers to disclose AI use in clinical care and maintain oversight of AI-generated medical records.
Many states have also passed laws that make clear that AI is no longer a regulatory gray area. Healthcare providers cannot treat AI like just another software tool. Instead, they must understand when and how disclosure, consent and oversight obligations apply. Doing so will not only avoid fines but also build patient trust at a time when privacy and accountability are paramount.
New state laws and regulations directed to the use of AI tools are generally focused on several key themes:
· Accountability and Transparency: Ensuring patients are aware when AI is being used in their care or interactions. AI tools cannot just make hidden decisions. Providers and payers must be able to explain how AI affects clinical or financial choices.
· Patient Consent and Rights: Many new laws require patient consent before using AI. Practices need to update how they talk with patients and their legal policies to clearly explain AI use and get written consent when needed.
· Oversight by Clinical Experts: Maintaining that human professionals retain ultimate decision-making authority, particularly in medical determinations and insurance coverage denials.
· Data Privacy and Security: Protecting PHI when used with AI systems and ensuring compliance with HIPAA and other privacy regulations.
· Preventing Discrimination: Addressing concerns about algorithmic bias and ensuring fairness in AI's application.
· Specific Applications: Focusing on areas such as utilization review, clinical communications, mental health services and diagnostic tools.
State laws are operating in the context of broader discussions and efforts at the federal level regarding AI regulation, including the interplay with HIPAA regulations. As the field of AI in healthcare continues to evolve, further state and potentially federal legislation is expected.
