Regulon — OH-HB-579 · OH HB 579 (Health Insurer AI Regulation)

Summary

Ohio HB 579 regulates the use of artificial intelligence by health plan issuers in utilization review and medical necessity determinations. It prohibits health plan issuers from making care decisions — including denials, delays, or modifications of health care services based on medical necessity — based solely on AI results. Medical necessity determinations must be made by a licensed physician or qualified provider who considers the treating provider's recommendation and the individual patient's clinical history. The bill requires annual reporting to the superintendent of insurance on AI algorithm use in utilization review, including algorithm criteria, training data sets, outcomes, and human reviewer time data. The superintendent may audit AI algorithm use at any time.

Enforcement & Penalties

Enforcement Authority

Ohio Superintendent of Insurance. Enforcement is agency-initiated. The superintendent may audit a health plan issuer's use of AI-based algorithms at any time and may contract with a third party to conduct such audits. No private right of action is created by this section.

Penalties

The bill does not specify civil penalties, damages, or other monetary remedies. Enforcement is through the superintendent's existing regulatory authority over health plan issuers, including audit power. Remedies would be governed by the superintendent's general enforcement powers under Ohio insurance law.

Who Is Covered

Compliance Obligations 6 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(B)(1)-(2)

Plain Language

Health plan issuers must file an annual report with the superintendent of insurance by March 1 each year. The report must cover: the issuer's network providers, enrollment counts for the preceding year, and — if AI algorithms are used in utilization review — detailed information including the algorithm criteria, training data sets, the algorithm itself, software outcomes, and data on human reviewer time spent on each adverse determination before sign-off. The report must be submitted in a form prescribed by the superintendent and verified by an officer of the health plan issuer. This is a proactive, scheduled submission — not triggered by request.

Statutory Text

(B)(1) Each health plan issuer, annually, on or before the first day of March, shall file a report with the superintendent of insurance covering all of the following information: (a) Each provider in the health plan issuer's network; (b) The number of covered persons enrolled in health benefit plans issued by the health plan issuer in this state in the preceding calendar year; (c) Whether the health plan issuer used, is using, or will use artificial intelligence-based algorithms in utilization review processes for those health benefit plans and, if so, all of the following information: (i) The algorithm criteria; (ii) Data sets used to train the algorithm; (iii) The algorithm itself; (iv) Outcomes of the software in which the algorithm is used; (v) Data on the amount of time a human reviewer spends examining an adverse determination prior to signing off on each such determination. (2) The health plan issuer shall submit the report in a form prescribed by the superintendent. An officer of the health plan issuer shall verify the contents of the report.

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(B)(3)

Plain Language

Both the superintendent and the health plan issuer must publish the annual AI utilization review report on their respective websites. The superintendent publishes on the department of insurance website; the health plan issuer publishes on its own publicly accessible website. This creates a dual public disclosure obligation, ensuring public access to information about AI use in utilization review processes.

Statutory Text

(3) The superintendent shall publish a copy of the report on the web site of the department of insurance. The health plan issuer shall publish a copy of the report on the health plan issuer's publicly accessible web site.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(C)(1)

Plain Language

Health plan issuers are prohibited from making any care decision about a covered person — including denials, delays, or modifications of health care services based on medical necessity — when that decision is based solely on AI-generated results. AI may inform the decision, but it cannot be the sole basis. A qualified human must independently make or affirm the determination. This is a hard prohibition with no exceptions or safe harbors.

Statutory Text

(C)(1) No health plan issuer shall make a decision regarding the care of a covered person, including the decision to deny, delay, or modify health care services based on medical necessity, based solely on results derived from the use or application of artificial intelligence.

HC-01 Healthcare AI Decision Restrictions · HC-01.2 HC-01.3 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(C)(2)-(3)

Plain Language

Medical necessity determinations must be made by a licensed physician or a clinically qualified provider who evaluates the specific clinical issues at hand. The determination must account for the treating provider's recommendation, the patient's medical and clinical history, and individual clinical circumstances — meaning group-level or algorithmic outputs alone are insufficient. Additionally, any physician involved in medical necessity or utilization review must actually open and review the individual's clinical records and document that review before issuing a decision. This creates both a qualified-reviewer requirement and a documented individualized-review requirement.

Statutory Text

(2) A determination of medical necessity under a health benefit plan must meet both of the following requirements: (a) The determination is made by a licensed physician or a provider that is qualified to evaluate the specific clinical issues involved in the requested health care services. (b) The determination takes into consideration the requesting provider's recommendation, the covered person's medical or other clinical history, and individual clinical circumstances. (3) Any physician who participates in a determination of medical necessity or a utilization review process on behalf of a health plan issuer shall open and document the review of the individual clinical records or data prior to making an individualized documented decision.

HC-01 Healthcare AI Decision Restrictions · HC-01.8 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(C)(4)

Plain Language

When a health plan issuer denies, delays, or modifies covered health care services and an AI-based algorithm was used in the decision, the decision must include a plain language explanation of the rationale. This is a disclosure-at-the-point-of-adverse-determination obligation — the explanation must accompany the decision itself, not be available only on request. The requirement applies to all AI-assisted adverse decisions, not just those based solely on AI.

Statutory Text

(4) Any decision to deny, delay, or modify health care services covered under a health benefit plan in which an artificial intelligence-based algorithm is used shall be accompanied by a plain language explanation of the rationale used in making the decision.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · Healthcare

Ohio Rev. Code § 3902.80(D)

Plain Language

The superintendent of insurance has authority to audit any health plan issuer's use of AI-based algorithms at any time, with no advance notice requirement specified. The superintendent may also engage third-party auditors. For health plan issuers, this means they must maintain their AI systems, documentation, and records in a state of audit readiness at all times. While this provision primarily grants authority to the superintendent, it imposes a practical obligation on issuers to be prepared to produce documentation on demand.

Statutory Text

(D) The superintendent may audit a health plan issuer's use of an artificial intelligence-based algorithm at any time and may contract with a third party for the purposes of conducting such an audit.