Reference · Healthcare
State Healthcare AI Laws: Texas, California, Colorado, Explained
Disclosure, practitioner review, records, and utilization review
Three states have enacted healthcare-specific AI duties that reach the generative-AI tools providers and payers actually run: Texas on practitioner review, disclosure, and medical records; California on disclaimers for AI-generated patient communications; and Colorado on utilization review and clinician review of denials, effective in 2027. The Joint Commission and the Coalition for Health AI added voluntary responsible-use guidance in September 2025.
Texas — SB 1188 (in force 1 September 2025) and HB 149 (1 January 2026)
- SB 1188: a practitioner may use AI for diagnostic purposes only if the practitioner reviews all AI-generated records consistent with medical-records standards and discloses the use to the patient; electronic health records must be physically maintained in the United States.
- HB 149 (TRAIGA) §552.001: a provider of health care services in which the patient interacts with an AI system must disclose that fact no later than the date of the service, or as soon as reasonably possible in an emergency.
California — AB 3030 (in force 1 January 2025)
- Health facilities, clinics, physician offices, and group practices that use generative AI to produce written or verbal patient communications about clinical information must include a disclaimer that the communication was AI-generated and instructions for reaching a human provider (Health and Safety Code §1339.75).
- Communications read and reviewed by a licensed or certified health care provider are exempt.
Colorado — HB 26-1139 (signed 2 June 2026; effective 1 January 2027)
- AI used in utilization review must consider the individual's medical history and clinical circumstances, not rely solely on generalized data.
- Medical-necessity denials involving AI must be reviewed by a qualified human clinician before they take effect.
- Insurers may not reimburse psychotherapy delivered directly by an AI system.
- Colorado SB 26-189, the automated decision-making statute, also takes effect on 1 January 2027 and reaches consequential decisions including health care; its employment provisions are covered on the HR / Employment AI pages.
Joint Commission / CHAI — Responsible Use of AI in Healthcare (September 2025, voluntary)
Seven elements: AI policies and governance structures; patient privacy and transparency; data security and data-use protections; ongoing quality monitoring; voluntary, blinded reporting of AI safety-related events; risk and bias assessment; and education and training. The guidance does not affect accreditation.
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| Patient disclosure (TX HB 149, CA AB 3030) | Tell the patient when they interact with or receive AI-generated communication | The approved disclosure text, the channels it reaches, and proof the configuration carrying it did not change |
| Practitioner review (TX SB 1188, CA exemption, CO 2027) | A practitioner reviews AI-generated records and AI-involved denials before they take effect | Review records tied to the AI output |
| Records and location (TX SB 1188) | AI-assisted records meet medical-records standards; EHRs stay in the United States | A retained AI record; vendor data-location confirmations |
| Governance (RUAIH, voluntary) | Policies, privacy, security, monitoring, safety reporting, bias assessment, education | The charter, the monitoring plan, the reporting pathway, the training record |
Key dates
- 1 January 2025California AB 3030 takes effect.
- 1 September 2025Texas SB 1188 takes effect.
- September 2025Joint Commission and CHAI publish the Responsible Use of AI in Healthcare guidance.
- 1 January 2026Texas HB 149 (TRAIGA) takes effect.
- 2 June 2026Colorado HB 26-1139 signed.
- 1 January 2027Colorado HB 26-1139 and SB 26-189 take effect.
Primary sources
Common gaps
Where the state duties most often go unmet in practice.
- A disclosure that lives in one template. The portal reply carries it; the SMS channel and the phone script do not. A template change removes it and nobody notices.
- Review as a habit, not a record. Clinicians do review AI drafts. When Texas asks for evidence, the habit has no timestamp.
- An AI vendor outside the United States. Texas requires EHRs to stay in the country. A model endpoint in another region is a data-location question few contracts answer.
- Colorado deferred to 2027. The utilization-review and denial-review duties need process changes that take longer than the time left.
Related
Last reviewed September 5, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.