Regulon.AI — CO-HB-1139 · CO HB 1139 (AI in Health Care)

Summary

Regulates the use of AI systems in health-care utilization review and prohibits payment for AI-delivered psychotherapy services. Covers health insurance carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations, and managed care entities that use AI for utilization review. Requires AI systems used in utilization review to base determinations on individual clinical data rather than solely group data, mandates human clinician review and approval of any coverage denial based on medical necessity, and imposes documentation, audit log, and periodic performance review requirements. Requires covered entities to file written disclosures with the applicable state agency identifying how AI is used in utilization review. Prohibits carriers and Medicaid/CHP+ payers from paying for psychotherapy services conducted directly by an AI system. Takes effect January 1, 2027.

Enforcement & Penalties

Enforcement Authority

Enforcement authority is not explicitly specified in this bill. The Division of Insurance, the Department of Human Services, and the Department of Health Care Policy and Financing receive written disclosures from covered entities regarding AI use in utilization review. Existing regulatory authority over carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations, and managed care entities would apply through these respective agencies. No private right of action is created by the bill. No cure period is specified.

Penalties

The bill does not specify statutory damages, civil penalties, or other monetary remedies. Enforcement would rely on existing regulatory authority over carriers and utilization review entities under Colorado insurance and health care law.

Who Is Covered

"BEHAVIORAL HEALTH ADMINISTRATIVE SERVICES ORGANIZATION" MEANS AN ORGANIZATION SELECTED BY THE BEHAVIORAL HEALTH ADMINISTRATION PURSUANT TO SECTION 27-50-402 TO ESTABLISH AND MAINTAIN A NETWORK OF BEHAVIORAL HEATH PROVIDERS.

"MANAGED CARE ENTITY" HAS THE MEANING SET FORTH IN SECTION 25.5-5-403 (4).

"PRIVATE UTILIZATION REVIEW ORGANIZATION" OR "ORGANIZATION" MEANS A PRIVATE UTILIZATION REVIEW ORGANIZATION, AS DEFINED IN SECTION 10-16-112 (1)(a), THAT HAS A CONTRACT WITH OR PERFORMS PRIOR AUTHORIZATION ON BEHALF OF A CARRIER.

Compliance Obligations 10 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.3 · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(a)-(b)

Plain Language

Entities using AI for utilization review must ensure that the AI system bases its determinations on the individual patient's medical or clinical history, clinical circumstances as presented by the requesting provider, and other relevant clinical information in the individual's record. The AI system may not base determinations solely on group-level or aggregate data without reference to the individual's own data. This requires AI tools to incorporate individualized clinical inputs rather than relying on population-level algorithms alone.

Statutory Text

(3) A PERSON DESCRIBED IN SUBSECTION (2) OF THIS SECTION THAT USES AN ARTIFICIAL INTELLIGENCE SYSTEM TO CONDUCT UTILIZATION REVIEW SHALL ENSURE THAT: (a) THE ARTIFICIAL INTELLIGENCE SYSTEM BASES ITS DETERMINATION ON THE FOLLOWING INFORMATION, AS APPLICABLE: (I) AN INDIVIDUAL'S MEDICAL OR OTHER CLINICAL HISTORY; (II) INDIVIDUAL CLINICAL CIRCUMSTANCES AS PRESENTED BY THE REQUESTING PROVIDER; AND (III) OTHER RELEVANT CLINICAL INFORMATION CONTAINED IN THE INDIVIDUAL'S MEDICAL OR OTHER CLINICAL RECORD; (b) THE ARTIFICIAL INTELLIGENCE SYSTEM DOES NOT BASE ITS DETERMINATIONS SOLELY ON GROUP DATA, WITHOUT REFERENCE TO THE INDIVIDUAL'S DATA;

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

C.R.S. § 10-16-112.7(5)(a)-(b)

Plain Language

AI systems may be used to assist with utilization review, including to expedite approvals. However, a carrier may not issue a denial of coverage based in whole or in part on medical necessity solely on an AI system's output. Every such denial must be affirmatively reviewed and approved by a licensed clinician, licensed physician, or other regulated professional who is competent to evaluate the specific clinical issues involved. The human reviewer must also review the health benefit plan's terms of coverage for the service in question. This is a mandatory human-in-the-loop requirement for all adverse medical necessity determinations — the AI may recommend denial, but a qualified human must independently approve it before the denial can issue.

Statutory Text

(5) (a) NOTWITHSTANDING SUBSECTION (3) OF THIS SECTION, AN ARTIFICIAL INTELLIGENCE SYSTEM MAY BE USED TO ASSIST WITH UTILIZATION REVIEW, INCLUDING EXPEDITED APPROVALS. (b) A CARRIER'S DENIAL OF COVERAGE BASED IN WHOLE OR IN PART ON MEDICAL NECESSITY SHALL NOT BE ISSUED SOLELY ON THE OUTPUT OF AN ARTIFICIAL INTELLIGENCE SYSTEM WITHOUT HUMAN REVIEW AND APPROVAL OF THE DENIAL BY A LICENSED CLINICIAN, LICENSED PHYSICIAN, OR OTHER REGULATED PROFESSIONAL THAT IS COMPETENT TO EVALUATE THE SPECIFIC CLINICAL ISSUES INVOLVED IN THE HEALTH-CARE SERVICES REQUESTED BY THE PROVIDER AND A REVIEW OF THE HEALTH BENEFIT PLAN'S TERMS OF COVERAGE FOR THE HEALTH-CARE SERVICE.

HC-01 Healthcare AI Decision Restrictions · HC-01.4 · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(f)

Plain Language

Entities using AI for utilization review must periodically review the AI system's performance, use, and outcomes to maximize accuracy and reliability. The bill does not specify a minimum review cadence, but the obligation is ongoing and not limited to pre-deployment testing. This is a continuing operational requirement to ensure the AI system remains accurate over time.

Statutory Text

(f) THE ARTIFICIAL INTELLIGENCE SYSTEM'S PERFORMANCE, USE, AND OUTCOMES ARE PERIODICALLY REVIEWED TO MAXIMIZE ACCURACY AND RELIABILITY;

HC-01 Healthcare AI Decision Restrictions · HC-01.5 · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(g)

Plain Language

Patient health data used by AI systems in utilization review must not be used beyond its intended or stated purpose. This is a purpose-limitation requirement consistent with HIPAA and applicable state health privacy law. Entities must ensure their AI systems do not repurpose patient clinical data collected for utilization review for other uses such as marketing, training unrelated models, or secondary analytics.

Statutory Text

(g) AN INDIVIDUAL'S HEALTH DATA IS NOT USED BEYOND ITS INTENDED OR STATED PURPOSE, CONSISTENT WITH APPLICABLE STATE AND FEDERAL LAWS;

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(e)

Plain Language

Entities using AI for utilization review must ensure the AI system produces and retains documentation, audit logs, and model-governance records sufficient to demonstrate compliance with the utilization review requirements in this section and with the existing insurance regulatory requirements in section 10-3-1104.9. This is both a contemporaneous documentation obligation and a retention obligation — records must be created as part of ongoing operations and maintained for regulatory inspection.

Statutory Text

(e) THE ARTIFICIAL INTELLIGENCE SYSTEM PRODUCES AND RETAINS DOCUMENTATION, AUDIT LOGS, AND MODEL-GOVERNANCE RECORDS IN ORDER TO DEMONSTRATE COMPLIANCE WITH THIS SECTION AND SECTION 10-3-1104.9;

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · Healthcare

C.R.S. § 10-16-112.7(4)(a)-(d)

Plain Language

Covered entities must provide written disclosures to the applicable state agency — the Division of Insurance, the Department of Human Services, or the Department of Health Care Policy and Financing — identifying: which utilization review functions use AI, at what points in the process AI is used, the human oversight process including reviewer qualifications and whether humans must approve adverse determinations, and the process for maintaining audit records demonstrating compliance. This is a proactive regulatory filing obligation — covered entities must submit the information without waiting to be asked.

Statutory Text

(4) A PERSON DESCRIBED IN SUBSECTION (2) OF THIS SECTION SHALL PROVIDE WRITTEN DISCLOSURES TO THE DIVISION, THE DEPARTMENT OF HUMAN SERVICES, OR THE DEPARTMENT OF HEALTH CARE POLICY AND FINANCING, AS APPLICABLE, THAT IDENTIFY: (a) THE UTILIZATION REVIEW FUNCTIONS FOR WHICH THE ARTIFICIAL INTELLIGENCE SYSTEM WILL BE USED; (b) THE POINTS IN THE UTILIZATION REVIEW PROCESS WHEN THE ARTIFICIAL INTELLIGENCE SYSTEM IS USED; (c) THE HUMAN OVERSIGHT PROCESS, INCLUDING THE QUALIFICATIONS OF THE REVIEWER AND WHETHER THE A HUMAN MUST APPROVE AN ADVERSE DETERMINATION; AND (d) THE PROCESS FOR MAINTAINING AUDIT INFORMATION SUFFICIENT TO DEMONSTRATE COMPLIANCE WITH SUBSECTION (3) OF THIS SECTION.

H-02 Non-Discrimination & Bias Assessment · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(c)-(d)

Plain Language

Entities using AI for utilization review must ensure the AI system does not discriminate against individuals in violation of state or federal law and is fairly and equitably applied, including in accordance with HHS regulations and guidance. While this provision does not mandate a specific bias testing methodology or independent audit, it creates an affirmative obligation to ensure non-discrimination — which in practice requires some form of testing or monitoring to verify compliance. The reference to HHS regulations and guidance incorporates federal non-discrimination standards such as those under Section 1557 of the ACA.

Statutory Text

(c) THE ARTIFICIAL INTELLIGENCE SYSTEM IS NOT USED IN ANY WAY THAT DISCRIMINATES AGAINST INDIVIDUALS IN VIOLATION OF OTHER STATE OR FEDERAL LAWS; (d) THE ARTIFICIAL INTELLIGENCE SYSTEM IS FAIRLY AND EQUITABLY APPLIED, INCLUDING IN ACCORDANCE WITH APPLICABLE REGULATIONS AND GUIDANCE ISSUED BY THE FEDERAL DEPARTMENT OF HEALTH AND HUMAN SERVICES;

HC-01 Healthcare AI Decision Restrictions · Deployer · Healthcare

C.R.S. § 10-16-112.7(3)(h)

Plain Language

AI systems used for utilization review must have criteria and guidelines that comply with all other applicable state and federal utilization review and coverage laws. This ensures that AI-driven utilization review does not circumvent existing legal requirements governing clinical criteria, coverage standards, and review processes that apply to human-conducted utilization review.

Statutory Text

(h) THE ARTIFICIAL INTELLIGENCE SYSTEM'S OR ALGORITHM'S CRITERIA AND GUIDELINES COMPLY WITH OTHER APPLICABLE STATE OR FEDERAL LAWS CONCERNING UTILIZATION REVIEW AND COVERAGE FOR HEALTH-CARE SERVICES.

HC-02 AI in Licensed Professional Practice Restrictions · HC-02.3 · Deployer · Healthcare

C.R.S. § 10-16-112.7(6)(a)-(c)

Plain Language

Health insurance carriers may not provide coverage for psychotherapy services that are provided directly to an individual and conducted by an AI system, for any health benefit plan issued or renewed on or after the effective date. This effectively prohibits insurers from paying for AI-delivered therapy. The prohibition does not apply to billing software, electronic health records, video platforms, or other nontherapeutic tools used incident to services provided by a human provider. Videoconferencing or messaging platforms used to enable supervision or consultation by a licensed professional are also excluded — using Zoom for a licensed therapist's supervision session is not AI-conducted supervision.

Statutory Text

(6) Prohibition on payment for AI-delivered psychotherapy services. (a) A CARRIER OFFERING A HEALTH BENEFIT PLAN ISSUED OR RENEWED IN THE STATE ON OR AFTER THE EFFECTIVE DATE OF THIS SECTION SHALL NOT PROVIDE COVERAGE FOR SERVICES THAT CONSTITUTE PSYCHOTHERAPY SERVICES, AS DEFINED IN SECTION 12-245-202 (14), THAT ARE PROVIDED DIRECTLY TO AN INDIVIDUAL AND THAT ARE CONDUCTED BY AN ARTIFICIAL INTELLIGENCE SYSTEM. (b) SUBSECTION (6)(a) OF THIS SECTION DOES NOT PROHIBIT THE USE OF BILLING SOFTWARE, ELECTRONIC HEALTH RECORDS, VIDEO PLATFORMS, OR OTHER NONTHERAPEUTIC SOFTWARE TOOLS INCIDENT TO SERVICES PROVIDED BY A HUMAN PROVIDER. (c) THE USE OF VIDEOCONFERENCING, MESSAGING PLATFORMS, OR OTHER COMMUNICATIONS SOFTWARE TO ENABLE SUPERVISION OR CONSULTATION BY A LICENSED, REGISTERED, OR CERTIFIED INDIVIDUAL DOES NOT CONSTITUTE SUPERVISION OR CONSULTATION THAT IS CONDUCTED BY AN ARTIFICIAL INTELLIGENCE SYSTEM, AS REFERENCED IN SUBSECTION (6)(a) OF THIS SECTION.

HC-02 AI in Licensed Professional Practice Restrictions · HC-02.3 · Government · Healthcare

C.R.S. § 25.5-1-209

Plain Language

Payers under Colorado Medicaid (the Colorado Medical Assistance Act) and the Children's Basic Health Plan (CHP+) may not pay for psychotherapy services that are provided directly to an individual and conducted by an AI system. This extends the same prohibition that applies to commercial health insurance carriers to public program payers, ensuring that AI-delivered psychotherapy cannot be billed to any payer in the state, public or private.

Statutory Text

A PAYER OF MENTAL OR BEHAVIORAL HEALTH-CARE SERVICES PROVIDED UNDER THE "COLORADO MEDICAL ASSISTANCE ACT", AS SPECIFIED IN ARTICLES 4, 5, AND 6 OF THIS TITLE 25.5, OR THE "CHILDREN'S BASIC HEALTH PLAN ACT", AS SPECIFIED IN ARTICLE 8 OF THIS TITLE 25.5, SHALL NOT PAY FOR SERVICES THAT CONSTITUTE PSYCHOTHERAPY SERVICES, AS DEFINED IN SECTION 12-245-202 (14), THAT ARE PROVIDED DIRECTLY TO AN INDIVIDUAL AND THAT ARE CONDUCTED BY AN ARTIFICIAL INTELLIGENCE SYSTEM, AS THAT TERM IS DEFINED IN SECTION 10-16-112.7 (1)(b).