Regulon — RI-H-7190 · RI H 7190 (AI Use by Health Insurers)

Summary

Regulates the use of artificial intelligence by health insurers in Rhode Island for managing healthcare claims and coverage. Requires insurers to disclose to OHIC and DBR how they use AI in claims and coverage decisions, including model types, training data, performance metrics, and governance policies. Mandates that any non-administrative adverse benefit determination where AI made or substantially contributed to the decision must be reviewed and approved by a provider with the same license status as the ordering provider before being finalized, with failure resulting in automatic reversal. Requires insurers to maintain AI decision documentation for at least five years. OHIC/DBR must publish annual reports to the governor and legislature on insurer AI use. Enforcement is through OHIC and DBR rulemaking authority; no private right of action or specific monetary penalties are established in the statute.

Enforcement & Penalties

Enforcement Authority

The Office of the Health Insurance Commissioner (OHIC), in collaboration with the Department of Business Regulation (DBR), has enforcement authority and rulemaking power to effectuate the purposes and implementation of the chapter. Enforcement is agency-initiated. No private right of action is created. No cure period or safe harbor is specified.

Penalties

The statute does not specify monetary penalties, civil penalties, or damages. The sole specified remedy for failure to comply with the clinical review requirement in § 27-84-4(a) is reversal of the non-administrative adverse benefit determination. The total cost of compliance with the chapter and applicable rules and regulations is borne by the insurer. Additional penalties may be established through OHIC/DBR rulemaking.

Who Is Covered

"Insurer" means an insurance company licensed, or required to be licensed, by the State of Rhode Island or other entity subject to the jurisdiction of the commissioner or the jurisdiction of the department of business regulation pursuant to chapter 62 of title 42, that contracts or offers to contract, or enters into an agreement to provide, deliver, arrange for, pay for, or reimburse any of the costs of healthcare services, including, without limitation: a for-profit or nonprofit hospital, medical or dental service corporation or plan, a health maintenance organization, a health insurance company, or any other entity providing a plan of health insurance, accident and sickness insurance, health benefits, or healthcare services including, but not limited to, pharmacy benefit managers.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(1)

Plain Language

Insurers must proactively disclose to OHIC and DBR comprehensive information about how they use AI in claims and coverage management. This includes the types of AI models used, the role AI plays in decision-making, training datasets, performance metrics, governance and risk management policies, and which specific claims and coverage decisions AI made or substantially influenced. This is a broad regulatory transparency obligation — not a one-time filing but an ongoing disclosure duty covering all AI use in the claims and coverage lifecycle.

Statutory Text

Insurers subject to this chapter shall disclose to the office of the health insurance commissioner ("OHIC") and the department of business regulation ("DBR") how they use artificial intelligence to manage healthcare claims and coverage including, but not limited to, the types of artificial intelligence models used, the role of artificial intelligence in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the decisions on healthcare claims and coverage where artificial intelligence made, or was a substantial factor in making, the decisions.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(2)

Plain Language

Upon request from OHIC or DBR, insurers must produce all information — including documents and software — necessary for the regulators to enforce the chapter. This is an on-demand production obligation, not a scheduled filing. Notably, the scope includes software itself, meaning regulators could request access to or copies of the AI systems used in claims and coverage decisions. Insurers should maintain documentation and system access in a form that can be produced promptly upon request.

Statutory Text

Insurers shall submit to the office of the health insurance commissioner and the department of business regulation, upon request, all information, including documents and software, that permits enforcement of this chapter.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(3)

Plain Language

Insurers must retain documentation of all AI-involved decisions for at least five years. This expressly includes adverse benefit determinations where AI made or was a substantial factor in the decision. The retention obligation covers both administrative and non-administrative adverse determinations. Insurers should ensure their recordkeeping systems capture the AI's role, the decision output, and supporting rationale for every AI-influenced claims and coverage decision, and that records are maintained in a form producible to regulators under § 27-84-3(a)(2).

Statutory Text

Insurers shall maintain documentation of artificial intelligence decisions for at least five (5) years including adverse benefit determinations where artificial intelligence made, or was a substantial factor in making, the adverse benefit determination.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(a)

Plain Language

When AI makes or substantially contributes to a non-administrative adverse benefit determination regarding medically necessary care, a licensed provider with the same license status as the ordering provider must review and approve the determination before it is finalized. The reviewing provider must document their rationale in the enrollee's case record. This is a mandatory human-in-the-loop requirement — AI cannot serve as the sole or final decision-maker for clinical denials. The remedy for non-compliance is automatic reversal of the adverse determination, creating a strong structural incentive for compliance. Note that this applies only to non-administrative determinations (those requiring medical judgment), not to administrative determinations like eligibility or covered-benefit decisions.

Statutory Text

Any non-administrative adverse benefit determination where an artificial intelligence system made, or was a substantial factor in making, that determination regarding medically necessary care shall be reviewed and approved by a provider with the same license status of the ordering professional provider before being finalized, with documentation of their rationale included in the enrollee's case record. Failure to follow the requirements set forth in this subsection shall result in reversal of the non-administrative adverse determination.

Other · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(b)

Plain Language

When an enrollee appeals a non-administrative adverse benefit determination that involved AI and was reviewed by a same-license-status provider, the appeal must follow the existing insurance appeals process under Rhode Island General Laws Chapter 27-18.9. This provision does not create a new obligation — it confirms that the existing appeals framework applies to AI-involved determinations and does not establish a separate or modified appeals process.

Statutory Text

Appeals of non-administrative adverse benefit determinations made by an artificial intelligence system regarding medically necessary care that has been reviewed and approved by a provider with the same license status of the ordering professional provider shall comply with the appeals process set forth in chapter 18.9 of title 27.

T-03 Training Data Disclosure · T-03.1 T-03.3 · DeployerGovernment · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

OHIC and DBR must publish an initial report within 18 months of the chapter's effective date, and annually thereafter, to the governor, senate president, and house speaker. The report must cover, for each insurer: AI model types, the role of AI in claims and coverage decision-making, training data governance and bias mitigation measures, and detailed performance metrics including claim acceptance/denial rates, average review times, appeal rates, and denial reversal rates. While the direct obligation falls on the regulators, this creates an indirect compliance obligation for insurers to supply this information — particularly the training data governance measures, bias analysis, and performance metrics — to OHIC/DBR in a form and on a schedule that enables timely annual reporting. Insurers should anticipate recurring data requests tied to the reporting cycle.

Statutory Text

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.

Other · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-5(a)-(b)

Plain Language

OHIC and DBR are authorized to promulgate rules and regulations to implement the chapter. All costs of compliance — including costs of supplying information, maintaining documentation, and implementing clinical review requirements — must be borne by the insurer, not passed through to enrollees or providers as a separate charge. This is an administrative provision establishing regulatory authority and cost allocation; it does not create a new affirmative compliance obligation for insurers.

Statutory Text

(a) OHIC, in collaboration with DBR, shall promulgate rules and regulations that may be necessary to effectuate the purposes and implementation of this chapter. (b) The total cost of complying with the requirements of this chapter and the applicable rules and regulations shall be borne by the insurer.