States Move to Regulate AI in Health Care as Federal Framework Emerges
Health care organizations face a fragmented regulatory environment as states pass AI-specific laws while the federal government signals intent to preempt certain state rules. The Trump administration issued Executive Order 14365 on December 11, 2025, directing federal agencies to identify and challenge state laws affecting AI development, creating tension between state and national approaches.
Currently, no comprehensive federal law governs AI use in health care. States are filling this gap with targeted regulations covering clinical, administrative, and operational applications. California, Colorado, Delaware, Illinois, Kentucky, Nevada, New York, Rhode Island, Texas, and Utah have all enacted or proposed AI-specific rules for health care.
State-Level Requirements
California's attorney general issued guidance requiring health care providers to comply with existing state laws when deploying AI. This includes health consumer protection statutes, anti-discrimination rules, patient privacy laws, and professional licensing requirements. The guidance treats AI as subject to technology-neutral regulations rather than creating separate standards.
Colorado passed the Consumer Protection from Automated Decision-Making Technology Act, which restricts how automated systems make consequential decisions. Delaware regulates professional titles and practice standards. Illinois restricts AI use in therapy and psychotherapy services. Kentucky and Rhode Island both regulate AI applications in eye assessments.
Nevada limits AI in mental and behavioral care. New York specifically addresses AI companions. Texas and Utah have enacted additional restrictions, though details remain limited in available guidance.
What Health Care Organizations Should Know
Providers cannot rely solely on federal frameworks. Every state maintains technology-neutral laws covering health, consumer protection, privacy, and professional practice that apply to AI systems. A provider operating across multiple states must track requirements in each jurisdiction.
Legal teams should audit existing state laws-not just AI-specific statutes-to identify compliance obligations. Consumer protection laws, licensing rules, anti-discrimination statutes, and privacy requirements all constrain how AI can be deployed in clinical and administrative settings.
The gap between state regulation and federal policy remains unsettled. Organizations should monitor federal actions while maintaining compliance with current state rules.
Your membership also unlocks:
