Regulon — OK-SB-1967 · OK SB 1967 (Healthcare AI Utilization Review)

Summary

Oklahoma SB 1967 regulates the use of artificial intelligence tools in healthcare utilization review. It requires utilization review organizations, disability insurers, and specialized health insurers that use AI tools to ensure those tools base determinations on individual enrollee clinical data rather than solely on group datasets, do not supplant provider decision-making, do not discriminate, and comply with HIPAA. The bill prohibits AI tools from denying, delaying, or modifying health care services based on medical necessity — such determinations must be made by a licensed physician or competent health care professional who reviews individual clinical circumstances. Health benefit plans must notify enrollees about AI tool usage on their websites, and AI tools must be open to inspection by the Insurance Commissioner. Violations carry fines up to $10,000 per willful violation, with aggregate annual caps of $500,000 for health benefit plans and $100,000 for clinical peer reviewers.

Enforcement & Penalties

Enforcement Authority

Oklahoma Insurance Commissioner. Enforcement is agency-initiated. The Commissioner has authority to impose penalties for violations and may promulgate rules and regulations pursuant to the act. The act is open to inspection for audit or compliance review by the Commissioner. No private right of action is created.

Penalties

Violations are subject to: (1) suspension or revocation of a license; (2) refusal to issue a new license for up to one year; or (3) a fine of up to $10,000 per willful violation. Aggregate penalties may not exceed $500,000 per calendar year for a health benefit plan or $100,000 per calendar year for a clinical peer reviewer. Penalties are in addition to any other remedies or penalties under applicable state or federal law.

Who Is Covered

What Is Covered

"Artificial intelligence tool" means a tool that uses an artificial intelligence or algorithm for the purpose of utilization review based in whole or in part on medical necessity;

Compliance Obligations 11 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.3 · Deployer · Healthcare

36 O.S. § 6567(A)(1)-(2)

Plain Language

Utilization review organizations, disability insurers, and specialized health insurers using AI tools must ensure those tools base their determinations on individualized enrollee clinical data — including medical history, clinical circumstances presented by the requesting provider, and other relevant clinical record information. The AI tool may not base its determination solely on a group dataset. This applies both to entities that directly use AI tools and those that contract with third parties that use AI tools.

Statutory Text

A. A utilization review organization, disability insurer, or specialized health insurer that uses an artificial intelligence tool or contracts with or otherwise works through an entity that uses an artificial intelligence tool shall ensure that the artificial intelligence tool: 1. Bases its determination on the following information, as applicable: a. an enrollee's medical or other clinical history, b. individual clinical circumstances as presented by the requesting provider, and c. other relevant clinical information contained in the enrollee's medical or other clinical record; 2. Does not base its determination solely on a group dataset;

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

36 O.S. § 6567(B)

Plain Language

AI tools are categorically prohibited from denying, delaying, or modifying health care services based on medical necessity — whether in whole or in part. All medical necessity determinations must be made exclusively by a licensed physician or a licensed health care professional who is competent in the specific clinical issues involved. That human reviewer must consider the requesting provider's recommendation, the enrollee's medical and clinical history, and individual circumstances. This is a complete prohibition on AI-driven adverse determinations, not merely a human-in-the-loop requirement.

Statutory Text

B. The artificial intelligence tool shall not deny, delay, or modify health care services based, in whole or in part, on medical necessity. A determination of medical necessity shall be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved in the health care services requested by the provider, by reviewing and considering the requesting provider's recommendation, the enrollee's medical or other clinical history, and individual circumstances.

HC-01 Healthcare AI Decision Restrictions · HC-01.5 · Deployer · Healthcare

36 O.S. § 6567(A)(5)

Plain Language

AI tools used in utilization review must not use patient data beyond the tool's intended and stated purpose. This obligation explicitly ties to HIPAA compliance and reinforces that patient data collected for utilization review purposes may not be repurposed for other uses. Covered entities must ensure their AI tool vendors and contractors also comply with this limitation.

Statutory Text

5. Does not use patient data beyond its intended and stated purpose consistent with the federal Health Insurance Portability and Accountability Act of 1996, P.L. No. 104-191, as applicable;

HC-01 Healthcare AI Decision Restrictions · HC-01.4 · Deployer · Healthcare

36 O.S. § 6567(A)(10)

Plain Language

Covered entities must ensure that AI tools used in utilization review are subject to periodic performance review and revision to maximize accuracy and reliability. This is an ongoing operational obligation — not a one-time pre-deployment check. The statute does not specify the review interval, leaving this to the entity's discretion or future Commissioner rulemaking.

Statutory Text

10. Requires performance use and outcomes to be periodically reviewed and revised to maximize accuracy and reliability.

HC-01 Healthcare AI Decision Restrictions · HC-01.6 · Deployer · Healthcare

36 O.S. § 6567(C)

Plain Language

All health benefit plans in Oklahoma must disclose on their publicly accessible website whether or not they use AI tools in the utilization review process. This is a blanket disclosure obligation that applies regardless of whether AI is actually used — the plan must affirmatively state whether AI tools are used or not used. The notification must be posted on the plan's website, making it a standing disclosure rather than a per-claim communication.

Statutory Text

C. Any health benefit plan in this state shall notify enrollees and insureds about the use or lack of use of artificial intelligence tools in the utilization review process on the accessible Internet website of such health benefit plan.

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Deployer · Healthcare

36 O.S. § 6567(A)(8)-(9)

Plain Language

AI tools used in utilization review must be open to inspection by the Oklahoma Insurance Commissioner for audit or compliance review purposes. Additionally, the entity's written policies and procedures must contain disclosures about the use and oversight of the AI tool. Together, these provisions create both a regulatory inspection right and a documentation obligation — the entity must maintain written policies describing AI tool usage and oversight, and must make the AI tool itself available for Commissioner inspection.

Statutory Text

8. Is open to inspection for audit or compliance review by the Insurance Commissioner; 9. Contains disclosures pertaining to the use and oversight of the artificial intelligence tool in the written policies and procedures;

H-02 Non-Discrimination & Bias Assessment · Deployer · Healthcare

36 O.S. § 6567(A)(4)

Plain Language

AI tools used in utilization review must not discriminate against enrollees in violation of state or federal law. This is a general non-discrimination pass-through provision requiring that AI tools comply with existing anti-discrimination law in the healthcare context. While it creates no new protected classes or testing obligations beyond existing law, it makes clear that AI-driven discrimination constitutes a violation of the utilization review act itself, exposing entities to the act's penalty provisions in addition to existing anti-discrimination remedies.

Statutory Text

4. Does not discriminate against enrollees in violation of state and federal law;

Other · Deployer · Healthcare

36 O.S. § 6567(A)(3)

Plain Language

AI tools used in utilization review must not supplant health care provider decision-making. This is a broad constraint ensuring that AI recommendations remain advisory and that clinical judgment remains with human providers. Unlike the Section B prohibition on AI-driven adverse determinations (which specifically addresses denials, delays, and modifications based on medical necessity), this is a general prohibition on AI replacing provider decision-making authority in any utilization review context.

Statutory Text

3. Does not supplant health care provider decision-making;

Other · Deployer · Healthcare

36 O.S. § 6567(A)(6)

Plain Language

AI tools used in utilization review must not cause harm to enrollees. This is a broad, general safety obligation that goes beyond the specific prohibition on adverse medical necessity determinations. It could encompass harms from incorrect clinical recommendations, data breaches, delayed processing, or other AI-driven outcomes that negatively affect enrollees. The provision's generality may make enforcement fact-intensive, but it establishes a baseline expectation that AI tools in healthcare must not harm the people whose care they evaluate.

Statutory Text

6. Does not cause harm to the enrollee;

Other · Deployer · Healthcare

36 O.S. § 6567(A)(7)

Plain Language

AI tools used in utilization review must comply with all applicable regulations and guidance from the federal Department of Health and Human Services. This is a compliance pass-through that incorporates existing and future federal healthcare AI guidance by reference. It creates no new substantive obligation beyond existing federal requirements, but it makes non-compliance with HHS regulations a violation of the Oklahoma utilization review act — thereby exposing entities to state-level penalties in addition to any federal enforcement.

Statutory Text

7. Is applied in accordance with any applicable regulations and guidance issued by the federal Department of Health and Human Services;

H-01 Human Oversight of Automated Decisions · H-01.6 · Professional · Healthcare

36 O.S. § 6567(D)

Plain Language

When a health benefit plan uses AI tools as an initial step in utilization review, a clinical peer reviewer must independently open, review, and document the individual clinical records or data before issuing any adverse determination. This is a mandatory human-in-the-loop requirement — the clinical peer reviewer cannot simply ratify the AI output but must affirmatively review the underlying clinical records. The documentation requirement ensures an audit trail demonstrating that human review occurred before any adverse action was taken.

Statutory Text

D. A clinical peer reviewer who participates in a utilization review process for a health benefit plan that initially uses artificial intelligence tools for a utilization review shall open and document the utilization review of the individual clinical records or data prior to issuing an adverse determination.