A busy year for healthcare laws
State lawmakers took on artificial intelligence (AI) in a big way in 2026. They proposed more AI bills than ever before, many aimed at how care requests are reviewed. At the same time, states kept tightening rules for prior authorization (PA) and for the clinicians who make review decisions. For health plans, that means more new requirements to track.
Medical Review Institute of America (MRIoA) hosted its Fall 2026 Regulatory Roundtable to help organizations get ready for what’s ahead. Aja Leichliter, MRIoA’s vice president and chief compliance officer, led the session. She has more than 20 years of experience in healthcare, including 18 at MRIoA. Here are her key takeaways on what health plans and other organizations need to know before new laws take effect January 1, 2027.
Three trends shaped 2026
- AI rules are growing fast. States began looking at AI in 2024, and activity picked up in 2025. In 2026, the number of proposed bills jumped. Only a few became law, but the volume shows where states are headed.
- Prior authorization is still the busiest area. States keep adding PA rules or fine-tuning the ones they have. Many set new turnaround times or shorten existing ones. More bills also target specific conditions, such as behavioral health, substance use disorders, cancer, and HIV.
- Reviewer rules are holding steady. States still pass rules on reviewer qualifications and specialty matching. But fewer bills called for same-state reviewers. None of the same-state bills MRIoA tracked became law in 2026, a first in a couple of years.
With little federal action on AI so far, states are filling the gap with their own safeguards. Leichliter expects the focus to keep shifting from where a reviewer is licensed to whether a qualified person makes the final call.
The rest of the session covered 16 states with new laws that take effect January 1, 2027. Prior authorization shows up in nearly all of them.
AI must support people, not replace them
Five states passed AI laws that take effect January 1, 2027. These laws share three themes:
- If AI is used in utilization review or PA, it must consider the patient’s own medical history and clinical situation. Each decision must fit that patient.
- A clinical peer must review any adverse determination, meaning a decision not to approve the requested care.
- People should stay in the loop at every step of the process.
Some proposals went further. One bill would have required physicians to sign a statement confirming they reviewed the patient’s records and the evidence-based criteria. They also would have had to record how much time they spent on each case. The bill did not pass, but it shows how far some states are willing to go.
Most rules today require human review only for adverse determinations. Leichliter said more states want the same for approvals, and she expects accrediting bodies to follow. Her advice: plan now for how you would meet that standard, with or without AI.
What about vendors that use AI? Three steps can help organizations hold vendors to the same standards:
- Build AI safeguards into vendor contracts.
- Monitor and audit vendors on a regular schedule.
- Work with vendors that hold an AI accreditation. URAC now offers one, and MRIoA is in the process of earning it.
Will the federal government step in? Leichliter doesn’t expect to see that soon. CMS is testing AI in prior authorization through its WISeR Model, a pilot in traditional Medicare. So far, there are few signs of major federal rules on AI oversight. For now, states are setting the pace.
Prior authorization keeps changing
PA remains the largest category of new state laws. The changes fall into four areas.
Rules for certain conditions. More states now set PA rules for specific conditions or treatments, such as mental health and cancer. Some limit or ban PA for these services. Others require plans to provide adequate coverage for them.
New programs and faster turnaround times. Six states passed broader PA laws. Some create PA programs for the first time, while others shorten the time plans have to respond. Common targets include:
- Standard requests: 3 to 5 business days
- Urgent requests: 24 to 72 hours
Pharmacy requests often have even shorter timelines by design. Leichliter expects turnaround times to keep shrinking as more organizations use AI tools to support their PA process.
Gold carding. Some states let providers skip PA for a service if at least 90% of their requests for it are approved. These providers earn a “gold card” for that service.
More transparency. New laws require plans to report approval and denial rates to their state department of insurance. Plans must also post a list of services that need PA and give patients and providers at least 60 days’ notice before that list changes.
Together, these laws share one goal: make PA smoother so patients get the right care at the right time.
Reviewer qualifications and specialty matching
New laws stress two points: a physician must make adverse determinations, and that physician must be qualified for the specific service under review.
Another growing trend involves requests from non-physicians, such as nurse practitioners and other allied health providers. Some states now require peer review for these requests as well.
No new same-state reviewer laws passed in 2026. However, a recently introduced federal bill would require same-state licensed reviewers for all Medicare Advantage reviews. It has not yet cleared its first committee, and Leichliter sees little chance it will pass. If it did, it would affect Medicare Advantage plans nationwide, so it is worth thinking now about how your organization would meet that requirement.
Questions from attendees
When a person is covered by two plans, which rules apply? If the primary and secondary plans fall under different requirements, follow whichever are strictest. That way, every rule that applies is met.
Do these state laws apply to ERISA plans? Generally, no. Most of the state laws discussed, including the specialty match rules for physician reviewers, apply to fully insured commercial plans. Self-funded ERISA plans typically fall outside their scope.
Do the new laws treat children and adults differently? Not so far. The rules focus on conditions and treatments, not age.
What comes next
Across AI, PA, and reviewer rules, one message stands out: a qualified person should make the final clinical call. That has always been how MRIoA works. Our network of more than 700 physician specialists covers more than 150 specialties and is licensed in all 50 states. Technology supports our review process, and a physician reviewer backs every determination.
Regulations will keep changing. Our compliance team tracks more than 200 sources to help clients stay ahead of new laws. The next Regulatory Roundtable is planned for May 2027 and will cover laws that take effect in July 2027.
Want the full details? Watch the session recording or download the slides, which include state-by-state details for all 16 states. To talk through what these changes mean for your review program, email info@mrioa.com, or reach out to your MRIoA customer success representative.
This summary is for general information only and is not legal advice. Please talk with your legal counsel about the laws discussed here.
