Blog
An Update on AI Regulations for Healthcare
Two things happened in U.S. healthcare AI policy this spring that look opposed but aren't. The federal government moved to deploy AI that can diagnose and prescribe while stripping transparency and testing rules from the tools hospitals already use. At the same time, states are stepping in: Texas, Illinois, Utah, and Colorado all now require the disclosure and oversight Washington just declined to mandate, and four more laws hit on July 1 covering PA/CRNA loan caps, hospital break penalties, PBM reimbursement, and limits on AI in prior-auth denials. The takeaway for AI buyers: deregulation didn't solve the governance problem. It turned it into a 50-state compliance problem, a clinical liability problem, and a trust problem at once. The organizations that built governance into their platform, with audit trails, HITL gates, and approval lifecycles, are the ones who can move fast without creating new risk.
By Deon Metelski
actAVA · Healthcare AI Policy
An Update on AI Regulations for Healthcare
For healthcare organizations evaluating AI deployment right now, this is the regulatory environment they're buying into. Understanding it isn't optional.
Two things happened in American healthcare AI policy this spring that look, at first glance, like they're moving in opposite directions. The Trump administration said it wants to lay the groundwork for AI systems that can diagnose illness and prescribe medicine, and at the same time moved to strip federal transparency and testing requirements from the AI tools hospitals already use. Meanwhile, four states passed laws requiring exactly the kind of disclosure, oversight, and patient notification Washington just decided not to mandate.
Those two stories are the same story. The federal government is stepping back from AI governance in healthcare. The states are stepping in. And every AI vendor, health system, and health plan operating across state lines now has to navigate a patchwork that's only going to get more complex as more states act.
On top of that, July 1 brings four new laws into effect that all push on the same nerve: do more with less. Here's the full picture, and where governed AI agents fit inside it.
What Washington Just Did
The federal pullback: AI physicians and removed guardrails
A Washington Post investigation published June 4, 2026 documented the administration's push to deploy AI doctors capable of diagnosing illness and prescribing medicine. The pitch is an access play: AI physicians serving patients in underserved areas where human physicians aren't available. Organized medicine isn't sold. The consensus response is that AI-driven diagnosis and prescribing, deployed without adequate testing and oversight, adds more risk than it resolves.
Running parallel to that push, HHS Secretary Robert F. Kennedy Jr.'s health IT office proposed rule HHS HIT-5, which would remove two long-standing safeguards from federal health IT certification standards.
The first is user-centered design testing, the requirement that AI health IT products get tested with actual physicians and nurses before deployment. The second is AI transparency ("model card") requirements, the mandate that AI companies disclose how their healthcare tools are developed, trained, and evaluated before clinicians use them.
Healthcare's professional bodies pushed back hard. The American Hospital Association wrote that transparency data "are critical to foster trust in AI tools and ensure patient safety." The American College of Physicians warned that removing these requirements "could undermine clinician trust, increase liability expense, and erode the patient-physician relationship."
The core tension is simple. The administration's logic is that deregulation accelerates deployment and expands access. The clinical community's concern is that the requirements on the chopping block are the exact mechanisms by which clinicians and patients can trust that an AI tool does what it claims. Removing them makes safety harder to verify.
What The States Are Doing
Four states fill the governance vacuum
In 2025, lawmakers in 47 states introduced more than 250 bills regulating AI in healthcare. 33 were signed into law across 21 states. In 2026 the pace picked up. Four states in particular enacted requirements that directly shape how AI gets deployed in clinical and payer settings, and they're pushing in the direction Washington just retreated from.
Texas · TRAIGA, effective January 1, 2026
The Texas Responsible Artificial Intelligence Governance Act sets broad governance requirements, including a mandatory patient notification when AI is used in treatment decisions. Providers have to tell patients when AI plays a role in their care, the same transparency obligation HHS HIT-5 just proposed to eliminate.
Illinois · HB 1806, AI in behavioral health
Illinois enacted disclosure and anti-misrepresentation requirements for healthcare AI broadly, and specifically banned unlicensed individuals from using AI to provide therapy or psychotherapy. As behavioral health AI tools spread, including the between-session support agents digital health companies are now shipping, this law sets a legal floor for what those tools can and can't do in Illinois.
Utah · HB 452, mental health AI disclosure
Utah's law allows AI-powered mental health chatbots but requires them to clearly and conspicuously disclose to every user that they're interacting with an AI system, not a human clinician. For any behavioral health company deploying AI between-session support to Utah patients, that's an active compliance requirement today.
Colorado · the Colorado AI Act to SB 189 (2026)
Colorado passed one of the country's most comprehensive AI governance laws, then revised it significantly in May 2026 with SB 189, which repealed and replaced the original. The revision reflects the ongoing tug-of-war between comprehensive oversight and concerns about regulatory burden, but Colorado's intent to govern high-stakes AI, including healthcare AI, stays intact.
California, though not in the four-state group, is actively contesting the federal direction. Its Attorney General formally challenged the HHS HIT-5 proposal to roll back model card requirements, arguing federal transparency standards are a patient safety matter. Pennsylvania is floating additional healthcare AI rules. The direction of state-level action is clear.
The July 1 Deadline
Four new laws take effect, and where AI agents help
Every July 1 is a compliance deadline for health systems, payers, and pharmacy operators, and 2026 is no exception. Four rules take effect spanning workforce access, hospital labor compliance, pharmacy reimbursement fairness, and the boundaries of AI in clinical decision-making. Each one lands on the same administrative workforce that's already being asked to do more with less.
Federal student loan caps for PA and CRNA programs
The Education Department's Reimagining and Improving Student Education (RISE) rule, carrying out provisions from the Working Families Tax Cuts Act, caps annual federal borrowing at $20,500 for graduate students. PA and certain CRNA pathways count as graduate programs under this framework, dropping their annual federal loan ceiling to $20,500 from the prior professional-program threshold.
Industry groups warn the reclassification could restrict access to PA and advanced practice nursing education, shrinking the pipeline into two of healthcare's most critical workforce segments right when health systems already face advanced practice shortages. Fewer graduates means fewer clinicians available to offload physician workloads downstream.
Washington starts penalizing hospitals for missed meal and rest breaks
Starting July 1, the Washington State Department of Labor and Industries gains authority under SB 5236 to penalize hospitals that exceed thresholds for missed meal and rest periods. Penalties run $5,000 to $20,000 depending on hospital size. The rules require at least one break for a 4-hour shift, two for an 8 to 10-hour shift, and three for a 12-hour shift, and prohibit staff from working more than 5 consecutive hours without a meal period.
The financial exposure is real, and the operational exposure is larger. Hospitals that ran informal break management now face documented liability for patterns that used to go untracked. The penalty scales with size, so large Washington health systems carry the most risk per incident. Compliance takes both accurate break tracking and the scheduling architecture to keep coverage when breaks happen.
Florida tightens PBM rules on reimbursement and appeals
Florida's Drug Prices and Coverage Act, signed March 24, adds two prohibited practices for pharmacy benefit managers. PBMs can't restrict a pharmacy from declining to dispense a drug when reimbursement falls below acquisition cost, and can't reimburse nonaffiliated pharmacies less than affiliated ones for the same drug. The law also requires PBM contracts to allow consolidated administrative appeals for multiple claims sharing the same drug, day supply, and calendar month of service.
The reimbursement parity provision answers PBM spread pricing practices that have disadvantaged independent pharmacies. For hospital-affiliated pharmacies in Florida, the law creates a compliance requirement and a new right: the ability to decline below-cost dispensing and to pursue consolidated appeals at a scale that used to require claim-by-claim work.
Iowa restricts AI as the sole basis for prior-auth denials
Iowa's House File 2635, signed May 13, prohibits utilization review organizations from using an AI-based algorithm as the sole basis for a decision to deny, delay, or downgrade a prior authorization request on medical necessity. It also bars health carriers from penalizing providers for out-of-network referrals, and from enforcing contract amendments without giving providers a negotiation opportunity.
Iowa joins a growing cohort, including Colorado, Illinois, and California, requiring human oversight in AI-driven coverage decisions. The law lets AI assist, recommend, and prepare. It prohibits AI from being the final and sole decision-maker on denials. Payers and review organizations in Iowa running AI-only denial workflows have to redesign them before July 1.
What This Means For AI Strategy
The common thread across all of it
Each of these laws is distinct in scope and subject. They share one underlying pressure: healthcare organizations are being asked to do more compliance, more documentation, more accurate reimbursement tracking, more human oversight of consequential decisions, with a workforce that's simultaneously squeezed by pipeline shortages and staffing costs.
AI agents are the operational infrastructure that makes it possible to meet all four requirements at once without adding headcount to absorb each. The PA shortage creates demand for AI-assisted documentation. Washington's break law creates demand for automated scheduling and monitoring. Florida's PBM provisions create demand for automated claims auditing and consolidated appeals. And Iowa HF 2635 defines the human-AI governance architecture every prior-auth workflow should run regardless of state.
Federal deregulation doesn't mean the governance problem is solved. It means the governance problem just became a 50-state compliance problem, a clinical liability problem, and an organizational trust problem, all at once.
For a health system or health plan operating in multiple states, the practical implication is this: removing federal guardrails fragments the environment for healthcare AI deployment. The absence of a federal floor doesn't stop states from setting their own, and they are. An AI tool deployed without patient notification in Texas is in legal violation. An AI chatbot that doesn't identify itself as AI to Utah mental health patients is non-compliant. An AI behavioral health tool that crosses into therapeutic territory in Illinois without a licensed human in the loop faces explicit statutory risk.
The organizations that get caught are the ones treating AI governance as a federal checkbox, handled once at the product level and never managed again. That model worked, imperfectly, when the regulatory environment was stable. With 47 states actively legislating and the federal floor dropping, it doesn't work at all. Removing federal guardrails splits the regulation into fifty different things in fifty states, with no coherent baseline. That's harder to navigate.
What Governed AI Looks Like From Here
Governance has to come from the platform now
The political logic of deregulation is straightforward: remove barriers, accelerate adoption, expand access. The clinical logic of governance is equally straightforward: without transparency, testing, and documented oversight, clinicians can't trust AI tools, patients can't make informed decisions about their care, and organizations can't defend their decisions when something goes wrong.
Both stay true regardless of what HHS ultimately does with HIT-5. The professional, legal, and reputational pressure for accountability in AI-driven healthcare decisions doesn't vanish because a federal agency decides not to mandate model cards. It shifts: to state law, to institutional policy, to malpractice exposure, and to the platforms health systems and payers run their agents on.
Governance architecture is the foundational requirement in healthcare AI infrastructure. An agent that runs without an audit trail, without documented decision logic, without a human approval gate on consequential decisions, exposes the organization deploying it to every state-level requirement now active in Texas, Illinois, Utah, and Colorado, and to every requirement still in the pipeline in California, Pennsylvania, and the 43 other states that introduced legislation last year.
KORA was built for exactly this environment
KORA's agent workforce, including purpose-built agents for prior authorization, workforce scheduling, clinical documentation, and claims management, runs inside this regulatory environment by design. Governed, auditable, human-in-the-loop where the law requires it, autonomous where it doesn't. Every agent carries a versioned audit log, an approval lifecycle, and the HITL gates that Iowa, Colorado, Illinois, and every state that passes similar legislation in 2026 will require. That's the architecture.
The patients are still there. The clinicians are still there. The liability is still there. The governance has to be there too.
See the healthcare agent library Explore KORAEducation Department RISE rule, Becker's Hospital Review · Washington SB 5236, WA L&I Healthcare Labor Standards · Florida Drug Prices and Coverage Act, Florida Senate SB 697 · Iowa HF 2635, Iowa Legislature · Trump administration pushes for AI physicians, Becker's · 4 states regulating AI in healthcare, Becker's · Inside the Trump-backed push to bring AI doctors into American medicine, Washington Post · Trump and Kennedy Seek To Relax Safeguards for AI Healthcare Tools, KFF Health News · California AG challenges Trump proposal, Becker's · 47 states introduced healthcare AI bills in 2025, Becker's
Written by
Deon Metelski
Chief Product Officer
