Utah Limits AI Role in Health Insurance Preauthorization

Utah Governor Spencer Cox signed SB 319 into law on March 19, 2026, making Utah the latest state to restrict how health insurers use AI in preauthorization decisions. It became Laws of Utah 2026, Chapter 240, takes effect on January 1, 2027, and adds Utah to a growing list of states that require human clinical judgment for adverse preauthorization determinations.

The bill amends Utah’s health insurance preauthorization statute in several ways. Insurers must now disclose whether they use artificial intelligence in the review process for authorization requests. They must post preauthorization requirements and procedures conspicuously on their websites. For adverse determinations based on clinical or medical necessity, the reviewer must exercise independent medical judgment and cannot rely solely on recommendations from any other source, including AI. That first requirement has a carve-out worth reading closely: the reviewer either has to know the enrollee’s condition or has to consult a specialist who does, and the independent-judgment prong is written to apply only where the reviewer takes the first route. The law also sets maximum timeframes for authorization decisions, seven calendar days in the ordinary case and 72 hours for urgent care, and establishes minimum validity periods for authorizations covering chronic or long-term care conditions.

The Utah approach is similar to laws enacted in Arizona, Georgia, Iowa, Maryland, Nebraska, and Texas, but it adds a disclosure requirement that goes further than some of its neighbors. An insurer that uses artificial intelligence to review authorization requests must say so to the Utah Insurance Department, to every provider in its network, and to every enrollee, and must carry a notice of it on the public website alongside its preauthorization statistics. That creates a new compliance obligation for carriers that may use AI tools for initial triage, document review, or recommendation generation but still rely on a clinician for the final decision.

Utilization management workflows in Utah have to separate AI-assisted analysis from the final adverse determination. The reviewer must be able to demonstrate independent judgment, and the carrier must be able to document that the AI tool was not the sole basis for the denial. The website disclosure and reporting requirements also mean that carriers can no longer treat AI use in preauthorization as a quiet operational detail.

The broader trend is that state legislatures are converging on a common set of expectations for AI in health insurance: disclosure, human review, and limits on fully automated adverse decisions. Carriers operating in multiple states should expect a patchwork of specific requirements rather than a single federal standard. One workflow built around independent clinical review and AI disclosure covers most of what these statutes ask. Each new state law then arrives as a short list of differences against it.

The Utah law also adds a disclosure layer that some neighboring states do not require. Telling the department, the network, and every enrollee where AI sits in the review process means keeping an internal inventory of exactly that, and keeping it current. This is exactly the kind of documentation that the NAIC AI Systems Evaluation Tool asks for in Exhibit A. The inventory needs a named owner, because an outdated list is worse than no list at all.

Stand the preauthorization AI inventory up before the deadline rather than after it, as a maintained list with named owners and dates, since that is both what the department will ask for and what Exhibit A of the evaluation tool expects. Carriers already keeping one for other state regimes mostly need to add Utah as a column rather than start over.