Connecticut Puts Five AI Conditions on the Carriers Running Its State Employee Health Plan

The five AI conditions Connecticut announced on September 16 did not come from its insurance regulator. They came from the Office of the State Comptroller, which buys and administers the State Employee Health Plan and the Connecticut Partnership Plan, and they reach the carriers running those plans because the carriers agreed to them. Comptroller Sean Scanlon drew the boundary himself, saying he was putting safeguards in place “to protect the 270,000 patients on the plan that I run.” CT Mirror named the four administrators that agreed: Anthem for medical benefits for active employees, Cigna for dental, Aetna for the Medicare Advantage plan for retirees, and Caremark as pharmacy benefits manager. CT Mirror reports the policies take effect January 1, 2027.

The announcement sets out five numbered pillars. Under “Protecting Patients,” no adverse determination “may be made solely by an AI system, and they must always be reviewed by a human.” Under “Protecting Providers while Preserving Contracts,” carriers “cannot use AI or predictive models as the sole basis to downcode claims, reduce provider payments, or alter billing codes without human review,” and “authorized contractual and automated claims processes remain permitted.” “Protecting Privacy” states that member data “must be securely protected, and cannot be used to train, develop or support other AI models.” “Person-to-Person Communication” requires that carriers and providers “must disclose when AI is materially assisting with, directly interacting, or recommending a benefit or health service to a member.” “Transparency Audits and Accuracy” requires AI systems to “follow best practices and be validated against historical data for accuracy, consistency, and fairness,” and adds that carriers “must disclose governance and audit procedures to the Comptroller.”

Much of the coverage, including CT Mirror’s headline and the Hartford Business Journal’s, calls this a set of regulations or rules. The announcement itself uses “policy” and “protections,” and the difference is worth holding onto. No statute changed and no insurance department acted. What exists is a purchaser’s condition on its vendors, and its reach stops at the enrollees of these two public-sector plans. CT Mirror notes separately that about 220,000 Connecticut residents, roughly 6% of the state, get coverage through state-regulated fully insured plans, while the self-funded plans most large employers use are regulated federally. That is a different population reached by a different instrument, and nothing announced on September 16 touches it.

For a carrier the substance still reads like model governance. The terms are a human review gate on adverse determinations, a restriction on secondary use of member data for training, a disclosure duty at the point of member contact that also binds providers, and validation against historical data for accuracy, consistency and fairness. That list would look familiar in a department bulletin. Here it arrives through an account relationship, which leaves the ownership question genuinely open. The announcement does not say whether these systems enter the AI inventory a carrier maintains against the NAIC model bulletin, whether the validation evidence is the same evidence, or who signs a governance and audit disclosure that runs to a plan sponsor rather than to a regulator. Those questions sit across compliance, model risk and claims governance, and the document answers none of them.

Scanlon wants the same terms to travel further. CT Mirror reported that in January he will recommend that lawmakers require all state-regulated plans “to adhere to the same policies.” It quoted him: “There is a national reckoning happening on this right now, and I think there will be an expectation of the legislators that are there next year that they do something about this from their constituents.” That is a stated intention for the 2027 session, which has not begun. CT Mirror also places the announcement beside lawsuits against Humana, UnitedHealth and Cigna over AI and algorithm-based denials of care, and UnitedHealth’s announced $1.5 billion investment in AI across more than 1,000 potential use cases.

The same January 1, 2027 date carries Minnesota’s prior authorization statute, which bars automated processing alone from making an adverse determination without clinician review. One arrives by law and reaches every covered plan in the state as it is offered, sold, issued or renewed on or after that date. The other arrives by agreement and reaches four named administrators. A carrier operating under both will be asked for two records on roughly the same schedule by two parties that are not the same kind of party at all: a state’s insurance law, and a customer. The condition likely to cost the most is the last one, because “validated against historical data” describes a document rather than a decision, and that validation record has to exist before January.