AI rules for hospitals, health systems, and physician groups in 2026

Which AI rules apply to hospitals and health systems in 2026?

As of October 2026, no federal statute regulates AI in hospitals as such. A hospital’s binding AI duties come from existing law applied to AI: Section 1557 for clinical algorithms, HIPAA for vendors that see patient data, FDA device law for the software itself, and a growing set of state laws on patient disclosure, diagnosis, and therapy.

Some duties land on the hospital directly. Others, such as health IT certification and FDA clearance, land on the vendor and reach the hospital through procurement.

The EU AI Act matters to a U.S. health system mainly when it develops or licenses a tool for the EU market. For most hospitals it is a vendor question.

What does Section 1557 require of clinical algorithms, and is it still in force?

A covered entity must not discriminate on the basis of race, color, national origin, sex, age, or disability through its use of patient care decision support tools. It has an ongoing duty to make reasonable efforts to identify tools that use input variables measuring those characteristics, and to make reasonable efforts to mitigate the risk of discrimination from each tool it identifies (45 CFR 92.210). The rule reaches flowcharts and clinical calculators as well as machine learning.

The vacatur was narrow. A federal court in Tennessee v. Kennedy vacated parts of the 2024 rule on October 22, 2025, to the extent they expanded the definition of sex discrimination to include gender identity. HHS’s June 2, 2026 notice implementing that ruling states that the other provisions of the rule remain in force. Section 92.210 is not among the provisions the notice lists as vacated, and it remained in the eCFR as of October 15, 2026.

OCR’s January 10, 2025 Dear Colleague letter, as summarized by Baker Donelson, said that OCR may weigh factors such as the entity’s size and resources, the information available at the time, whether the tool was used as the developer intended, and whether the entity has a process for evaluating its tools. Those factors apply to whether an entity made reasonable efforts to identify risk. The letter predates the change of administration. Treat it as a guide to what an investigator may ask, not as a safe harbor.

The record is the defense. An inventory, a rationale for each protected-characteristic input, and the chosen mitigation carry more weight than a vendor’s assurance.

What must an AI vendor contract cover under HIPAA?

An AI vendor that creates, receives, maintains, or transmits PHI on the hospital’s behalf is a business associate, and the hospital needs a business associate agreement with the elements in 45 CFR 164.504(e) before the vendor gets access. HHS has said a cloud provider storing or processing electronic PHI is a business associate even if it holds only encrypted data and has no key. The same logic applies to an ambient scribe or a note summarization service.

• No PHI goes into a consumer AI tool that does not offer a BAA
• The BAA limits the vendor’s use of PHI, including for training models for other customers
• The minimum necessary standard applies to what is sent to the model
• The Security Rule risk analysis covers the AI system and its data flows
• Subcontractors of the vendor sign their own BAAs
• If the hospital is a covered entity under Texas SB 1188, the contract confirms that electronic health records under its control, including records a vendor stores in the cloud, are physically maintained in the United States or a U.S. territory, as SB 1188 requires for storage on or after January 1, 2026

What should a hospital ask an AI vendor about FDA status and transparency?

Ask two questions before go-live: is this software a regulated device, and what does the developer disclose about how it was built and tested.

Software is not a device if it meets all four statutory criteria for clinical decision support (21 U.S.C. 360j(o)(1)(E)). The fourth criterion decides most cases: the software must let a health care professional independently review the basis for the recommendation, so the professional does not rely primarily on it. FDA’s current CDS guidance says it does not consider software intended for a critical, time-sensitive task or decision to meet that criterion. Ask that question directly about any real-time alert.

For authorized devices, ask whether the product has a predetermined change control plan, which FDA finalized guidance on in December 2024. Without one, a retrained model can require a new submission.

For certified EHR modules, HTI-1 requires developers that supply predictive decision support interventions to make source attribute information available to users, including intended use, target population, known risks, training data, and validation. HTI-5 would remove that requirement. Write the documentation duty into the contract so it survives either outcome.

Which state laws govern AI in patient communications and care?

As of October 2026, these four laws in three states set the duties a hospital or physician group is most likely to meet in daily operations. Each is triggered by a different use.

• California AB 3030. A health facility, clinic, physician’s office, or group practice office that uses generative AI to generate written or verbal patient communications about clinical information must include a disclaimer that the communication was generated by AI and clear instructions for reaching a human. Placement depends on the medium: at the beginning of letters and emails, throughout chat and video, and at the start and end of audio. The requirements do not apply if a licensed or certified health care provider read and reviewed the communication. Scheduling, billing, and other administrative messages are outside the law.
• Texas SB 1188. A health care practitioner may use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on the medical record, only if the practitioner acts within the scope of the license, the use is not otherwise restricted by law, and the practitioner reviews all records created with AI consistent with Texas Medical Board standards. The practitioner must disclose the use to patients. The Attorney General may seek civil penalties of up to $5,000 per negligent violation and up to $25,000 per knowing or intentional violation in a single year, and up to $250,000 where a covered entity knowingly or intentionally used PHI for financial gain.
• Texas HB 149. Providers must disclose AI use in a service or treatment to the patient or personal representative by the date it is first provided, or, in an emergency, as soon as reasonably possible.
• Illinois HB 1806. AI may not make independent therapeutic decisions, interact directly with clients in therapeutic communication, generate therapeutic recommendations or treatment plans without the licensed professional’s review and approval, or detect emotions or mental states. Where a session is recorded or transcribed and AI provides supplementary support, the patient must be told in writing that AI will be used and for what purpose, and must consent. After a hearing, IDFPR may impose civil penalties of up to $10,000 per violation.

Colorado’s SB 26-189 applies to consequential decisions made on or after January 1, 2027. A federal court order in X.AI LLC v. Weiser bars Colorado’s Attorney General from enforcing SB 26-189, including by investigation, for violations occurring on or before 14 days after the court rules on xAI’s preliminary injunction motion; xAI had not filed that motion as of October 21, 2026. The law exempts HIPAA covered entities, and their business associates for services rendered to them, from C.R.S. 6-1-1701 to 6-1-1706 except for decisions about employment. A health care provider gets that exemption only if it operates from a location in Colorado. Those covered entities must still give patients a general notice of advanced technology use and make specific disclosures when ADMT determines eligibility for financial assistance (C.R.S. 6-1-1708(3)). FDA-regulated medical devices are exempt (6-1-1708(4)).

Nevada’s AB 406, effective July 1, 2025, bars, with certain exceptions, offering an AI system programmed to provide a service that would be professional mental or behavioral health care if a person provided it. It also bars a provider of mental and behavioral health care from using AI in providing that care directly to a patient. AI for administrative support is allowed, including scheduling, billing, and managing records and session notes. The provider must independently review AI-generated billing records and session notes.

For behavioral health service lines, Illinois and Nevada are the states to plan around. An ambient scribe in a recorded or transcribed Illinois therapy session needs written notice and consent, even when the clinician reviews every note. In Nevada, AI must stay in administrative support, and the clinician must independently review AI-organized session notes.

How do WISeR and payer AI rules affect provider prior authorization?

Payer AI rules give a hospital leverage in denials and appeals, and in six states a new Medicare workflow.

Under CMS’s WISeR Model, providers in New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington who furnish listed services, such as skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis, may submit a prior authorization request or have the claim go through medical review before payment. Participating companies use technologies including AI and machine learning, alongside human clinical review. CMS states that all recommendations for non-payment are determined by appropriately licensed clinicians.

In Medicare Advantage, CMS’s February 6, 2024 FAQ says a plan may use an algorithm to assist coverage determinations but must base medical necessity decisions on the individual patient’s circumstances. In California, SB 1120 requires the plan’s AI tool to base its determination on the enrollee’s own clinical history and record, not solely on a group dataset. The tool itself may not deny, delay, or modify care based on medical necessity. The law bars anyone other than a licensed physician or competent licensed health care professional from denying or modifying care for medical necessity. Section 1367.01 also reaches entities a plan contracts with for utilization review, and plans that delegate those functions to medical groups or independent practice associations. A physician group with delegated utilization management should read it as its own rule.

Are Joint Commission and CHAI standards binding?

No. The Joint Commission and the Coalition for Health AI released their Responsible Use of AI in Healthcare guidance on September 17, 2025. Robinson+Cole lists its seven elements: AI policies and governance structures, patient privacy and transparency, data security and data use protections, ongoing quality monitoring, voluntary reporting, risk and bias assessment, and education and training. The guidance is not binding.

On June 1, 2026, the Joint Commission launched a voluntary Responsible Use of AI in Healthcare certification that builds on that guidance. It assesses an organization’s governance and processes; it does not validate or certify individual AI products.

The practical value is overlap. Several of the seven elements, such as patient privacy, data security, and risk and bias assessment, describe work Section 1557 and HIPAA already require. Adopting the guidance satisfies none of those duties by itself.

What should a health system do in the first 90 days?

• Build one inventory of AI and algorithmic tools, including EHR-embedded models, ambient scribes, patient messaging tools, and clinical calculators
• Classify each tool: regulated device, non-device CDS, administrative, or patient-facing
• Complete the 92.210 record: protected-characteristic inputs, rationale, mitigation, and an owner for re-review
• Confirm a BAA is in place for every AI vendor that touches PHI, with limits on model training
• Add AB 3030 disclaimers or a documented clinician review step to generative AI patient messages in California
• Write Texas patient disclosure language for AI used in diagnosis, service, or treatment, and confirm U.S. storage of electronic health records covered by Texas SB 1188
• For Illinois behavioral health services, add written AI notice and consent to any recorded or transcribed session
• In Nevada, limit AI in behavioral health care to administrative support and document clinician review of AI-generated notes and billing records
• Put model documentation and change notice duties into health IT and AI contracts, independent of HTI-5
• In WISeR states, map the listed services and decide between prior authorization and pre-payment review

Where to read more: the health care AI guide covers FDA, HIPAA, Section 1557, and state law in more depth. The state AI laws guide covers Texas HB 149 and Colorado SB 26-189 beyond health care, and the governance frameworks guide maps NIST and ISO programs onto these duties.

This page is general information as of October 2026, not legal advice. Confirm requirements with counsel or the relevant regulator before relying on them.