Reference · Healthcare

State Healthcare AI Laws: Texas, California, Colorado, Explained

Patient disclosure, practitioner review, where records are kept, and AI in utilization review

Last reviewed October 11, 2026

At a glance

Texas: SB 1188 in effect 1 September 2025, with U.S. record storage from 1 January 2026; HB 149 in effect 1 January 2026
California: AB 3030 and SB 1120 in effect 1 January 2025; AB 489 in effect 1 January 2026
Colorado: HB 26-1139 and SB 26-189 take effect 1 January 2027
Guidance: Joint Commission and CHAI, Responsible Use of AI in Healthcare (17 September 2025), with a voluntary certification since 1 June 2026

Texas, California and Colorado have enacted laws that reach the AI tools providers and payers already run: telling patients when AI is involved, having a practitioner review what AI produced, keeping records in the United States, and keeping a clinician in utilization review decisions. Most of the duties are in force; Colorado's start on 1 January 2027.

The Joint Commission and the Coalition for Health AI added non-binding guidance in September 2025 that reads as the governance program these laws assume.

Two federal rules reach the same tools. A certified health IT developer supplies HTI-1 source attributes for each predictive intervention, and a provider or plan that receives HHS funding has duties for Section 1557 decision support tools that use protected-class inputs. The evidence a provider or payer keeps for all of them is set out in AI compliance for healthcare providers and payers.

Texas: a practitioner who uses AI for diagnosis reviews the records and tells patients

Under SB 1188, a health care practitioner may use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient's medical record, on three conditions: the practitioner acts within the scope of their license, the use is not otherwise restricted or prohibited by state or federal law, and the practitioner reviews all records created with AI consistent with Texas Medical Board medical records standards.Texas SB 1188 · Sec. 183.005(a) The practitioner must disclose the use of that technology to patients; the statute sets no timing or format.Texas SB 1188 · Sec. 183.005(b)

The same act requires electronic health records under a covered entity's control to be physically maintained in the United States or a U.S. territory, including records held by a third-party, subcontracted or cloud computing facility.Texas SB 1188 · Sec. 183.002(a) That requirement applies to storage on or after 1 January 2026, whatever the date the record was prepared.Texas SB 1188 · SECTION 2(b) Any algorithm or decision assistance tool in the EHR that helps a practitioner make treatment decisions has to include the patient's biological sex as recorded in a separate field the act requires.Texas SB 1188 · Sec. 183.007(a)

The attorney general can seek civil penalties of up to $5,000 per negligent violation and $25,000 per knowing or intentional violation, each per year, and up to $250,000 where protected health information was knowingly used for financial gain. A licensing agency may discipline a covered entity that violates the chapter three or more times.Texas SB 1188 · Secs. 183.010, 183.011 SB 1188 took effect on 1 September 2025.Texas Legislature

Texas: patients are told about AI in their care no later than the first service

The Texas Responsible Artificial Intelligence Governance Act, HB 149, took effect on 1 January 2026.Texas Legislature If an AI system is used in relation to a health care service or treatment, the provider must give the disclosure to the patient or their personal representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency.Texas HB 149 · Sec. 552.051(f)

The disclosure must be clear and conspicuous, written in plain language and free of dark patterns. A hyperlink to a separate web page is allowed, and the disclosure is required even when a reasonable consumer would find the AI obvious.Texas HB 149 · Sec. 552.051(c) to (e) Subsection (f) places the duty on the provider of the service or treatment while referring to the disclosure subsection (b) requires of governmental agencies, so a private provider that gives the notice meets either reading.

On a complaint, the attorney general can demand documentation of an AI system: its purpose and intended use, the data used to train it, its inputs and outputs, the metrics used to evaluate it, its known limitations, and the post-deployment monitoring and safeguards around it.Texas HB 149 · Sec. 552.103(b) The attorney general enforces the chapter, with no private right of action, and must first give 60 days' written notice in which a violation can be cured. Penalties run from $10,000 to $12,000 for a curable violation, $80,000 to $200,000 for an uncurable one, and $2,000 to $40,000 for each day a violation continues.Texas HB 149 · Secs. 552.101, 552.104, 552.105

California: AI-written patient messages carry a disclaimer unless a clinician reviewed them

AB 3030 added Health and Safety Code section 1339.75, in effect since 1 January 2025. A health facility, clinic, physician's office or group practice office that uses generative AI to generate written or verbal patient communications about patient clinical information must include a disclaimer that the communication was AI-generated, placed according to the medium, and clear instructions for reaching a human health care provider.HSC 1339.75 · (a)

The requirements do not apply when a human licensed or certified health care provider has read and reviewed the communication.HSC 1339.75 · (b) Patient clinical information excludes administrative matters such as appointment scheduling and billing.HSC 1339.75 · (c) Facilities and clinics answer to their licensing provisions, and physicians to the Medical Board of California or the Osteopathic Medical Board of California.HSC 1339.75 · (d)

Communication	Where the disclaimer goes
Written, physical or digital (letters, emails, other occasional messages)	Prominently at the beginning of each communication
Continuous online interaction (chat, including chat-based telehealth)	Prominently displayed throughout the interaction
Audio	Spoken at the start and at the end of the interaction
Video	Prominently displayed throughout the interaction

Source: California Health and Safety Code section 1339.75(a)(1), added by AB 3030 (Chapter 848, Statutes of 2024), effective 1 January 2025. Health and Safety Code 1339.75 (California Legislative Information)

California: medical necessity decisions in utilization review stay with clinicians

SB 1120, in effect since 1 January 2025, sets conditions for health plans and insurers that use AI, algorithms or other software tools for utilization review or management based on medical necessity, directly or through a contractor. The tool bases its determination on the enrollee's medical or other clinical history, the individual clinical circumstances the requesting provider presents and other relevant clinical information in the record, never solely on a group dataset. It does not supplant health care provider decision-making, it is open to inspection for audit by the regulator, and its performance, use and outcomes are reviewed periodically.California SB 1120 · HSC 1367.01(k)(1)

The tool may not deny, delay or modify health care services based in whole or in part on medical necessity. That determination is made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues, after reviewing the requesting provider's recommendation and the enrollee's history and circumstances.California SB 1120 · HSC 1367.01(k)(2) Insurance Code section 10123.135(j) applies the same rules to disability insurers that cover hospital, medical or surgical expenses.California SB 1120

AB 489, in effect since 1 January 2026, prohibits terms in the advertising or functionality of an AI system that indicate or imply its care, advice, reports or assessments come from a licensed health care professional. Each use is a separate violation, and the health care licensing boards enforce it.California AB 489 · B&P Code 4999.9

Colorado: from 2027, payers' AI must use the individual's own clinical record

HB 26-1139 was signed on 2 June 2026 and takes effect on 1 January 2027, applying to actions taken on or after that date.Colorado HB 26-1139 · Section 4 It reaches carriers that use AI in utilization review, pharmacy benefit managers and private utilization review organizations working for them, and behavioral health administrative services organizations and managed care entities reviewing mental or behavioral health services.Colorado HB 26-1139 · 10-16-112.7(2)

The AI system has to base its determination on the individual's medical or clinical history, the individual clinical circumstances the requesting provider presents, and other relevant clinical information in the record, never solely on group data. It must be applied fairly, reviewed periodically for accuracy and reliability, and produce and retain documentation, audit logs and model-governance records that demonstrate compliance.Colorado HB 26-1139 · 10-16-112.7(3) Each organization discloses in writing to its regulator where AI is used in utilization review, the human oversight process and how audit information is kept.Colorado HB 26-1139 · 10-16-112.7(4)

A carrier's denial based in whole or in part on medical necessity cannot be issued solely on an AI system's output without review and approval by a licensed clinician, licensed physician or other competent regulated professional. Psychotherapy delivered directly to an individual by an AI system is not covered, by commercial plans or by Medicaid and the Children's Basic Health Plan.Colorado HB 26-1139 · 10-16-112.7(5), (6); 25.5-1-209

Colorado's automated decision-making law exempts HIPAA covered entities from its core duties

SB 26-189, signed on 14 May 2026, repeals and reenacts the artificial intelligence provisions Colorado enacted in 2024 as a law on automated decision-making technology in consequential decisions. Its substantive provisions take effect on 1 January 2027 and apply to decisions made on or after that date.Colorado SB 26-189 · Sections 1, 5 Health-care services are one of the covered domains.Colorado SB 26-189 · 6-1-1701(6)

Its core duties do not apply to a HIPAA covered entity doing business in Colorado, or to the entity's business associates for services rendered to it, except for employment decisions. For a health care provider the exemption holds only when it operates from a location within Colorado. Covered entities must give patients a general notice of their use of advanced technologies, and must make specific disclosures when such technology determines eligibility for financial assistance.Colorado SB 26-189 · 6-1-1708(3) Insurers subject to Colorado's existing law on insurers' use of algorithms and predictive models are deemed to meet the act in the practice of insurance.Colorado SB 26-189 · 6-1-1708(1)

Both Colorado laws are readiness items until 1 January 2027. HB 26-1139 asks payers for audit logs and model-governance records, which take longer to produce than the policies that describe them.

The Joint Commission and CHAI set out seven elements of responsible use

The Joint Commission and the Coalition for Health AI released their Guidance on the Responsible Use of AI in Healthcare on 17 September 2025.Joint Commission It is non-binding guidance for organizations governing their own use of AI and is not an accreditation standard. Its seven elements:

AI policies and governance structures.
Patient privacy and transparency.
Data security and data use protections.
Ongoing quality monitoring.
Voluntary, blinded reporting of AI safety-related events.
Risk and bias assessment.
Education and training.

CHAI published governance playbooks on 27 May 2026.CHAI On 1 June 2026 the Joint Commission launched a voluntary Responsible Use of AI in Healthcare certification for organizations, which does not certify individual AI products and does not require Joint Commission accreditation.Joint Commission

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Patient disclosure (TX Sec. 183.005(b), TX Sec. 552.051(f), CA HSC 1339.75)	Tell patients when AI is used in their care or wrote their message, on every channel, by the first service	The approved disclosure text, the channels it reaches, and the configuration history showing it stayed in place
Practitioner review (TX Sec. 183.005(a)(3), CA HSC 1339.75(b))	Review AI-created records and AI-written messages before they stand	Review records tied to each AI output: who reviewed, when, and what changed
Records location (TX Sec. 183.002)	Keep EHR data, including what AI services receive, in the United States	Vendor and model endpoint locations confirmed in writing
AI system documentation (TX Sec. 552.103(b))	Describe each AI system's purpose, training data, inputs, outputs, metrics, limitations and monitoring	A current description per AI system, ready for a civil investigative demand
Utilization review (CA SB 1120, CO HB 26-1139)	Base AI determinations on the individual's record and keep medical necessity denials with a clinician	Per-decision records naming the clinician, plus the audit logs and model-governance records Colorado requires
Governance (Joint Commission and CHAI, voluntary)	Policies, privacy, security, monitoring, safety event reporting, bias assessment, training	The governance charter, the monitoring plan, the reporting pathway and the training record

Key dates

Timeline, drawn to scale

State healthcare AI laws by effective date

In effect as of October 11, 2026UpcomingColorado duties begin

Dates from the Texas Legislature, California Legislative Information and the Colorado General Assembly. Status as of October 11, 2026.

1 January 2025California AB 3030 (patient communications) and SB 1120 (utilization review) take effect.
1 September 2025Texas SB 1188 takes effect.
17 September 2025Joint Commission and CHAI publish the Guidance on the Responsible Use of AI in Healthcare.
1 January 2026Texas HB 149 takes effect; SB 1188's U.S. storage requirement applies; California AB 489 takes effect.
14 May 2026Colorado SB 26-189 signed.
1 June 2026Joint Commission launches its voluntary Responsible Use of AI in Healthcare certification.
2 June 2026Colorado HB 26-1139 signed.
1 January 2027Colorado HB 26-1139 and SB 26-189 take effect.

Sources cited

Common gaps

Where the state duties most often go unmet in practice.

A disclosure that lives in one template. The portal reply carries it; the SMS channel and the phone script do not. A template change removes it and nobody notices.
Review as a habit with no record. Clinicians do read AI drafts. When an investigator asks for evidence that a reviewed message was exempt, the review has no name or timestamp.
An AI service hosted outside the United States. Texas requires EHR data to be physically maintained in the country, including at third-party and cloud facilities.Texas SB 1188 · Sec. 183.002(a) A model endpoint in another region is a data-location question few contracts answer.
Assuming Colorado's automated decision-making law covers the hospital. A HIPAA covered entity doing business in Colorado is exempt from its core duties and still owes patients a general notice. Payers have HB 26-1139 to meet either way.
Colorado treated as a 2027 problem. Audit logs, model-governance records and regulator disclosures need systems and process that take longer than the time left.

In practice

How Meilynx maps to the state laws and the guidance →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.