Regulon.AI — OH-HB-579 · OH HB 579 (Health Insurer AI Regulation)

Summary

Requires Ohio health plan issuers to file annual reports with the Superintendent of Insurance disclosing their use of AI-based algorithms in utilization review, including algorithm criteria, training data, outcomes, and human reviewer time data. Prohibits health plan issuers from basing care decisions — including denials, delays, or modifications based on medical necessity — solely on AI outputs. Requires that medical necessity determinations be made by qualified licensed physicians or providers who consider individual clinical circumstances. Grants the Superintendent audit authority over health plan issuers' use of AI algorithms. Applies to health benefit plans issued, amended, or renewed on or after the effective date.

Enforcement & Penalties

Enforcement Authority

Superintendent of Insurance has enforcement authority, including the power to audit a health plan issuer's use of AI-based algorithms at any time and to contract with third parties for audit purposes. No private right of action is created. Enforcement is agency-initiated through regulatory oversight and audit authority.

Penalties

The bill does not specify monetary penalties, statutory damages, or civil remedies. Enforcement is through the Superintendent of Insurance's existing regulatory authority, including audit power. Specific penalty provisions are not enumerated in the bill text.

Who Is Covered

Compliance Obligations 5 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(B)(1)-(2)

Plain Language

Each health plan issuer must file an annual report with the Superintendent of Insurance by March 1, covering network providers, enrollment counts, and — critically — whether the issuer uses AI-based algorithms in utilization review. If AI is used, the report must detail the algorithm criteria, training datasets, the algorithm itself, software outcomes, and data on how much time human reviewers spend examining adverse determinations before signing off. An officer must verify the report's contents. This is a comprehensive AI transparency filing obligation directed at the state insurance regulator.

Statutory Text

(B)(1) Each health plan issuer, annually, on or before the first day of March, shall file a report with the superintendent of insurance covering all of the following information: (a) Each provider in the health plan issuer's network; (b) The number of covered persons enrolled in health benefit plans issued by the health plan issuer in this state in the preceding calendar year; (c) Whether the health plan issuer used, is using, or will use artificial intelligence-based algorithms in utilization review processes for those health benefit plans and, if so, all of the following information: (i) The algorithm criteria; (ii) Data sets used to train the algorithm; (iii) The algorithm itself; (iv) Outcomes of the software in which the algorithm is used; (v) Data on the amount of time a human reviewer spends examining an adverse determination prior to signing off on each such determination. (2) The health plan issuer shall submit the report in a form prescribed by the superintendent. An officer of the health plan issuer shall verify the contents of the report.

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(B)(3)

Plain Language

Both the Superintendent of Insurance and the health plan issuer must publish the annual AI utilization review report on their respective public websites. This creates a dual public disclosure obligation — the regulator posts it and the insurer posts it — ensuring that enrollees, providers, and the public can review the insurer's AI practices in utilization review. This is distinct from the filing obligation itself; the report must be both filed and published.

Statutory Text

(3) The superintendent shall publish a copy of the report on the web site of the department of insurance. The health plan issuer shall publish a copy of the report on the health plan issuer's publicly accessible web site.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(C)(1)-(3)

Plain Language

Health plan issuers are prohibited from basing care decisions — including denials, delays, or modifications on medical necessity grounds — solely on AI outputs. Medical necessity determinations must be made by a licensed physician or qualified provider who considers the treating provider's recommendation, the enrollee's clinical history, and individual circumstances. Physicians participating in utilization review must open and document their review of the individual's clinical records before making a decision. This creates a human-in-the-loop requirement: AI may inform the process, but the final determination must be an individualized, documented decision by a qualified human clinician based on the patient's specific clinical data.

Statutory Text

(C)(1) No health plan issuer shall make a decision regarding the care of a covered person, including the decision to deny, delay, or modify health care services based on medical necessity, based solely on results derived from the use or application of artificial intelligence. (2) A determination of medical necessity under a health benefit plan must meet both of the following requirements: (a) The determination is made by a licensed physician or a provider that is qualified to evaluate the specific clinical issues involved in the requested health care services. (b) The determination takes into consideration the requesting provider's recommendation, the covered person's medical or other clinical history, and individual clinical circumstances. (3) Any physician who participates in a determination of medical necessity or a utilization review process on behalf of a health plan issuer shall open and document the review of the individual clinical records or data prior to making an individualized documented decision.

HC-01 Healthcare AI Decision Restrictions · HC-01.8 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(C)(4)

Plain Language

When an AI-based algorithm is involved in a decision to deny, delay, or modify covered health care services, the health plan issuer must provide a plain-language explanation of the rationale behind the decision. This disclosure accompanies the adverse determination itself and must be understandable to the covered person or provider — not a generic statement that AI was used, but an explanation of the reasoning. This applies regardless of whether the AI was the primary factor or merely one input in the decision.

Statutory Text

(4) Any decision to deny, delay, or modify health care services covered under a health benefit plan in which an artificial intelligence-based algorithm is used shall be accompanied by a plain language explanation of the rationale used in making the decision.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(D)

Plain Language

The Superintendent of Insurance may audit any health plan issuer's use of AI-based algorithms at any time, without advance notice or triggering event. The Superintendent may also engage third-party auditors to conduct these audits. For health plan issuers, this means they must maintain records and documentation of their AI use in a form that can be produced for audit at any time — there is no advance scheduling requirement or cure period before an audit may commence.

Statutory Text

(D) The superintendent may audit a health plan issuer's use of an artificial intelligence-based algorithm at any time and may contract with a third party for the purposes of conducting such an audit.