Six States Restrict AI Claim Denials as ABA Audits Tighten

Where the 2026 Denials Come From

Between March 4 and May 5, six states enacted laws restricting how health insurers may use artificial intelligence in coverage decisions. The nine-week run targets a question that now sits inside every ABA revenue cycle: whether an algorithm can decide medical necessity.

The machinery those laws regulate is already standard equipment. In a National Association of Insurance Commissioners survey published in May 2025, 84% of 93 responding health insurers reported using AI or machine learning. Among carriers selling individual major medical coverage, 71% used or were exploring the technology for utilization management and 68% for prior authorization.

Denials climbed alongside adoption. In the American Medical Association’s 2025 survey of 1,000 practicing physicians, released May 13, 74% said denials have increased over the past five years, and six in 10 said they are concerned AI will push denial rates higher still. Physicians in the survey completed an average of 40 prior authorization requests a week. Nearly one in three said requests are often or always denied.

The human review that is supposed to stand behind those denials is thin. Roughly 60 insurers pledged in June 2025, after engagement from the Trump administration, to have every medical-necessity denial reviewed by a licensed, qualified clinician. In the AMA survey, 24% of physicians said that review consistently happens. Among physicians who participate in peer-to-peer reviews, 16% said the plan’s reviewer often or always holds the right qualifications.

“Physician trust in voluntary insurer pledges is deeply eroded after years of unfulfilled promises.” – Bobby Mukkamala, M.D., President, American Medical Association (2026)

ABA sits where this machinery runs hardest. Internal Optum strategy documents obtained by ProPublica in December 2024 described “rigorous” clinical reviews of ABA medical necessity and an “approach to authorizing less units than requested” across the company’s Medicaid plans. The documents focused on high-cost states including Arizona, Nebraska, Tennessee, Virginia, New Jersey, Indiana and Louisiana.

The audit side is automating too. Billing and compliance vendors serving ABA practices, among them Theralytics, Brellium and The Missing Piece, have told clients over the past year that payers now run automated claims analysis that benchmarks utilization against regional norms, flags outlier billing patterns and scores treatment-plan documentation for medical-necessity gaps before a human auditor opens the file.

State Medicaid programs are tightening in parallel. Indiana, where ABA spending peaked at $611 million in 2023, adopted working-group recommendations in November 2025 calling for tighter utilization controls and clearer medical-necessity standards, then imposed a reimbursement phasedown and a 4,000-hour lifetime cap on April 1, 2026, the Indiana Capital Chronicle reported.

Six Statehouses in Nine Weeks

California moved first. SB 1120, the Physicians Make Decisions Act, took effect January 1, 2025, and bars plans from denying, delaying or modifying care on medical-necessity grounds unless a licensed physician or another clinician competent to evaluate the case makes the call. Illinois HB 2472 took effect the same day: a plan may run an “algorithmic automated process” during utilization review, but only a clinical peer may issue an adverse medical-necessity determination. Texas followed with SB 815, effective September 1, 2025, which prohibits utilization review agents from using an automated decision system to make an adverse determination and lets the insurance commissioner audit those systems at any time.

The 2026 class went further, faster. According to a May 26 Holland & Knight review of enacted legislation:

Indiana (March 4): HB 1271 bars insurers from downcoding a claim on AI output alone, without a professional’s review of the medical record, and bars providers from submitting AI-prepared claims without human review. Effective July 1, 2026.

Utah (March 19): SB 319 requires insurers to disclose AI use in prior authorization to the state insurance department, providers and enrollees, and requires reviewers to exercise independent medical judgment rather than follow AI recommendations. Effective January 1, 2027.

Washington (March 26): SB 5395 prohibits sole reliance on AI to deny, delay or limit care, reserves adverse determinations for licensed or qualified professionals, and requires carriers to report how many denials were made with AI assistance.

Alabama (April 17): SB 63 requires AI-assisted prior authorization decisions to rest on the individual’s medical history and clinical circumstances, with annual certification that the tools do not rely on group datasets. Effective October 1, 2026.

Maryland (April 28): HB 1563 requires quarterly reports on adverse determinations, the services involved and whether AI or other software was used, and lets the commissioner investigate denial spikes. Effective June 1, 2026.

Georgia (May 5): SB 544 permits AI to automate tasks and support decisions but bars any adverse determination without a licensed provider’s review and approval. Effective January 1, 2027.

A KFF brief published May 6 found the statutes converge on a short list of requirements: human review of denials, individualized clinical grounds for any AI determination, disclosure of AI use, periodic accuracy review, privacy limits on patient data, auditability and anti-discrimination language. KFF also counted at least 25 states that have issued insurance-regulator guidance built on the NAIC’s 2023 model bulletin. Holland & Knight reduced the whole body of law to one principle:

“AI may be used to assist and streamline insurance operations, but a health insurer cannot rely upon it as the sole basis for denying care.” – Holland & Knight client alert (May 2026)

MACPAC Takes the Question to Congress

Medicaid, the payer that drives ABA volume in much of the country, got its own push in May. The Medicaid and CHIP Payment and Access Commission voted May 7 to send four recommendations to Congress in its June 2026 report, the commission’s first on automation in prior authorization.

The first asks CMS to clarify that existing managed care regulation, 42 CFR 438.210(b)(3), already requires an individual with appropriate expertise to review and authorize every decision to deny a service or approve less than requested, “including those proposed by automated systems,” and that adverse determinations may not be made by automation tools alone. The second would amend fee-for-service rules so that medical-necessity denials are made by someone with expertise in the enrollee’s medical, behavioral health or long-term services and supports needs. The third and fourth address visibility: CMS guidance on using external quality review and annual managed care reporting to oversee plans’ automation, and state contract amendments requiring plans to disclose how they use it, including testing and oversight protocols.

The disclosure recommendations respond to a measurable gap. Only 7 of 38 states responding to KFF’s annual Medicaid budget survey require their managed care organizations to disclose AI use in prior authorization. The Congressional Budget Office scored all four recommendations as having no effect on direct spending.

CMS is meanwhile running the experiment in the other direction. Its WISeR model is testing AI-assisted prior authorization for selected services in traditional Medicare across six states, with technology vendors administering the reviews.

The Rules Reach the Clinic Too

A second set of laws aims at providers’ own use of AI, where the question is not whether an algorithm can deny care but whether it can deliver it. Illinois signed the Wellness and Oversight for Psychological Resources Act in August 2025, barring AI from providing therapy or making treatment decisions in licensed behavioral health care. Nevada’s AB 406, effective July 1, 2025, bars providers from using AI in direct patient care while allowing administrative support with human review of the output.

Maine’s LD 2082, signed April 13 as Public Law Chapter 687, draws the 2026 version of the line. Licensed mental health professionals may use AI for scheduling, billing and, with documented client consent, record-keeping and analysis of session notes. They may not use it to make treatment decisions, generate therapeutic communications or interact independently with clients, and ambient-listening tools require consent before recording.

Arizona’s Board of Behavioral Health Examiners adopted rules in November 2025 requiring its licensees, beginning January 1, 2027, to obtain and document informed consent before delivering any service in which AI is used to provide, record or document clinical services. AI-drafted session notes and ambient scribes fall inside that definition.

How far each statute reaches into ABA depends on state licensure lines; Maine’s law binds licensed mental health professionals, and Arizona’s rules bind that board’s licensees. The direction across all four states is uniform, though. AI may assist, document and draft. It may not decide. Vermont and California are considering similar bills, according to Holland & Knight.

Washington Could Unbuild the Wall

All of it now depends on what Washington does next. A National Policy Framework for Artificial Intelligence, released by the White House in March, recommends federal legislation preempting what it calls cumbersome state AI laws. It follows a December 2025 executive order that created a Department of Justice task force to challenge state AI statutes in court, and a failed attempt to write a 10-year moratorium on state AI regulation into the 2025 budget reconciliation law.

The framework says any federal legislation should preserve traditional state powers to protect consumers. Which side of that line a utilization review statute falls on is exactly what a preemption fight would decide, KFF notes. ERISA already keeps state insurance law, AI provisions included, away from self-funded employer plans, which cover most workers with job-based coverage.

For now the calendar runs in the states’ favor. Maryland’s AI-flagged denial reporting begins June 1. Indiana’s downcoding ban takes effect July 1, Alabama’s certification requirement October 1, and the Utah, Georgia and Arizona rules January 1, 2027. MACPAC’s recommendations reach Congress this month.

AT A GLANCE

SOURCES & REFERENCES