Regulon.AI — OK-SB-1967 · OK SB 1967 (Healthcare AI Utilization Review)

Summary

Oklahoma SB 1967 regulates the use of artificial intelligence tools in healthcare utilization review. It requires utilization review organizations, disability insurers, and specialized health insurers that use AI tools to ensure those tools base determinations on individualized enrollee clinical data rather than solely on group datasets, do not supplant provider decision-making, do not discriminate, and comply with HIPAA. The bill prohibits AI tools from denying, delaying, or modifying health care services based on medical necessity — such determinations must be made by a licensed physician or competent health care professional who reviews individual clinical circumstances. Health benefit plans must notify enrollees about AI tool usage on their website and submit AI tools to the Insurance Commissioner for inspection. Violations are enforced by the Insurance Commissioner through license actions and fines of up to $10,000 per willful violation, subject to annual aggregate caps.

Enforcement & Penalties

Enforcement Authority

Oklahoma Insurance Commissioner. Enforcement is agency-initiated. The Commissioner has authority to impose penalties on health benefit plans and clinical peer reviewers for violations. The Commissioner may also promulgate rules and regulations pursuant to the act. No private right of action is created.

Penalties

Penalties include suspension or revocation of a license, refusal to issue a new license for up to one year, and fines of up to $10,000 per willful violation. Aggregate penalties may not exceed $500,000 per calendar year for a health benefit plan or $100,000 per calendar year for a clinical peer reviewer. Penalties are in addition to any other remedies or penalties under applicable state or federal law.

Who Is Covered

What Is Covered

"Artificial intelligence tool" means a tool that uses an artificial intelligence or algorithm for the purpose of utilization review based in whole or in part on medical necessity;

Compliance Obligations 8 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.3 · Deployer · Healthcare

36 O.S. § 6567(A)(1)-(2)

Plain Language

Utilization review organizations, disability insurers, and specialized health insurers that use AI tools — whether directly or through contracted entities — must ensure those tools base their determinations on individualized enrollee clinical data, including the enrollee's medical history, individual clinical circumstances as presented by the requesting provider, and other relevant clinical information from the enrollee's records. The AI tool may not base its determination solely on a group dataset. This requirement applies to the entity using the AI tool even if a third party actually operates the tool.

Statutory Text

A. A utilization review organization, disability insurer, or specialized health insurer that uses an artificial intelligence tool or contracts with or otherwise works through an entity that uses an artificial intelligence tool shall ensure that the artificial intelligence tool: 1. Bases its determination on the following information, as applicable: a. an enrollee's medical or other clinical history, b. individual clinical circumstances as presented by the requesting provider, and c. other relevant clinical information contained in the enrollee's medical or other clinical record; 2. Does not base its determination solely on a group dataset;

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

36 O.S. § 6567(B)

Plain Language

AI tools are categorically prohibited from denying, delaying, or modifying health care services based in whole or in part on medical necessity. All medical necessity determinations must be made by a licensed physician or a licensed health care professional who is competent to evaluate the specific clinical issues at hand. That professional must review and consider the requesting provider's recommendation, the enrollee's medical or clinical history, and individual circumstances. This is a complete prohibition on AI-driven adverse medical necessity determinations — not a human-in-the-loop requirement, but an outright bar on the AI making the determination at all.

Statutory Text

B. The artificial intelligence tool shall not deny, delay, or modify health care services based, in whole or in part, on medical necessity. A determination of medical necessity shall be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved in the health care services requested by the provider, by reviewing and considering the requesting provider's recommendation, the enrollee's medical or other clinical history, and individual circumstances.

HC-01 Healthcare AI Decision Restrictions · HC-01.5 · Deployer · Healthcare

36 O.S. § 6567(A)(5)

Plain Language

Utilization review organizations, disability insurers, and specialized health insurers must ensure that AI tools used in utilization review do not use patient data beyond the tool's intended and stated purpose, consistent with HIPAA. This reinforces existing HIPAA use limitations in the specific context of AI-driven utilization review, ensuring that patient data fed into AI tools is not repurposed for secondary uses.

Statutory Text

5. Does not use patient data beyond its intended and stated purpose consistent with the federal Health Insurance Portability and Accountability Act of 1996, P.L. No. 104-191, as applicable;

HC-01 Healthcare AI Decision Restrictions · HC-01.4 · Deployer · Healthcare

36 O.S. § 6567(A)(10)

Plain Language

Covered entities must ensure that AI tools used in utilization review are subject to periodic review of their performance, use patterns, and outcomes, and must revise the tools as necessary to maximize accuracy and reliability. This is an ongoing operational obligation — not a one-time pre-deployment check — requiring continued monitoring and improvement of AI tool performance in live deployment.

Statutory Text

10. Requires performance use and outcomes to be periodically reviewed and revised to maximize accuracy and reliability.

HC-01 Healthcare AI Decision Restrictions · HC-01.6 · Deployer · Healthcare

36 O.S. § 6567(C)

Plain Language

Every health benefit plan in Oklahoma must disclose on its accessible website whether it does or does not use AI tools in its utilization review process. This is a public-facing disclosure obligation applicable to all health benefit plans — not only those that use AI — since plans must also disclose the lack of AI tool use. The disclosure must be posted on the plan's website.

Statutory Text

C. Any health benefit plan in this state shall notify enrollees and insureds about the use or lack of use of artificial intelligence tools in the utilization review process on the accessible Internet website of such health benefit plan.

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Deployer · Healthcare

36 O.S. § 6567(A)(8)-(9)

Plain Language

Covered entities must ensure that their AI tools are open to inspection by the Insurance Commissioner for audit or compliance review purposes. Additionally, the entity's written policies and procedures must contain disclosures about the use and oversight of AI tools. These two requirements together create a regulatory transparency obligation — the AI tool must be auditable by the Commissioner, and internal governance documentation must address how the tool is used and overseen.

Statutory Text

8. Is open to inspection for audit or compliance review by the Insurance Commissioner; 9. Contains disclosures pertaining to the use and oversight of the artificial intelligence tool in the written policies and procedures;

HC-01 Healthcare AI Decision Restrictions · Deployer · Healthcare

36 O.S. § 6567(A)(3)-(4), (6)-(7)

Plain Language

Covered entities must ensure that AI tools used in utilization review do not supplant health care provider decision-making, do not discriminate against enrollees in violation of state or federal law, do not cause harm to enrollees, and are applied in accordance with applicable HHS regulations and guidance. The non-supplanting requirement reinforces that the AI tool is a support mechanism — it cannot replace the provider's clinical judgment. The discrimination prohibition incorporates existing state and federal non-discrimination standards. The no-harm and HHS compliance requirements create broad guardrails around AI tool deployment in utilization review.

Statutory Text

3. Does not supplant health care provider decision-making; 4. Does not discriminate against enrollees in violation of state and federal law; 6. Does not cause harm to the enrollee; 7. Is applied in accordance with any applicable regulations and guidance issued by the federal Department of Health and Human Services;

H-01 Human Oversight of Automated Decisions · H-01.6 · Professional · Healthcare

36 O.S. § 6567(D)

Plain Language

When a health benefit plan initially uses AI tools in a utilization review, any clinical peer reviewer involved in that process must personally open and review the individual enrollee's clinical records or data before issuing an adverse determination. The reviewer must also document that this review occurred. This creates a mandatory human-review-before-adverse-action requirement specifically for AI-assisted utilization reviews, ensuring that no adverse determination issues without a documented human review of individualized clinical data.

Statutory Text

D. A clinical peer reviewer who participates in a utilization review process for a health benefit plan that initially uses artificial intelligence tools for a utilization review shall open and document the utilization review of the individual clinical records or data prior to issuing an adverse determination.