Regulon.AI — RI-H-7190 · RI H 7190 (Health Insurer AI Transparency)

Summary

Requires health insurers in Rhode Island to disclose to OHIC and DBR how they use artificial intelligence to manage healthcare claims and coverage, including AI model types, training datasets, performance metrics, and governance policies. Mandates that any non-administrative adverse benefit determination where AI made or was a substantial factor in the decision must be reviewed and approved by a provider with the same license status as the ordering professional provider before being finalized; failure to do so results in automatic reversal. Requires insurers to maintain documentation of AI-driven decisions for at least five years and to produce all information to regulators upon request. OHIC/DBR must report annually to the governor and legislative leaders on insurer AI use. Enforcement is through OHIC in collaboration with DBR; no private right of action is created.

Enforcement & Penalties

Enforcement Authority

The Office of the Health Insurance Commissioner (OHIC), in collaboration with the Department of Business Regulation (DBR), is the designated enforcement authority. OHIC/DBR shall promulgate rules and regulations necessary to effectuate the purposes and implementation of the chapter. Enforcement is agency-initiated; no private right of action is created. OHIC/DBR may request all information, including documents and software, that permits enforcement.

Penalties

No specific monetary penalties, civil damages, or fee-shifting provisions are enumerated in the bill. The sole specified remedy for failure to comply with the clinical review requirement in § 27-84-4(a) is reversal of the non-administrative adverse benefit determination. Compliance costs must be borne by the insurer. OHIC/DBR is authorized to promulgate regulations which may include additional enforcement mechanisms.

Who Is Covered

"Insurer" means an insurance company licensed, or required to be licensed, by the State of Rhode Island or other entity subject to the jurisdiction of the commissioner or the jurisdiction of the department of business regulation pursuant to chapter 62 of title 42, that contracts or offers to contract, or enters into an agreement to provide, deliver, arrange for, pay for, or reimburse any of the costs of healthcare services, including, without limitation: a for-profit or nonprofit hospital, medical or dental service corporation or plan, a health maintenance organization, a health insurance company, or any other entity providing a plan of health insurance, accident and sickness insurance, health benefits, or healthcare services including, but not limited to, pharmacy benefit managers.

Compliance Obligations 6 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(1)

Plain Language

Insurers must affirmatively disclose to OHIC and DBR how they use AI to manage claims and coverage. The disclosure is broad: it must cover the types of AI models used, AI's role in decision-making, training datasets, performance metrics, governance and risk management policies, and the specific decisions where AI made or substantially contributed to the outcome. This is a proactive disclosure obligation — insurers must provide this information without waiting for a regulatory request.

Statutory Text

Insurers subject to this chapter shall disclose to the office of the health insurance commissioner ("OHIC") and the department of business regulation ("DBR") how they use artificial intelligence to manage healthcare claims and coverage including, but not limited to, the types of artificial intelligence models used, the role of artificial intelligence in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the decisions on healthcare claims and coverage where artificial intelligence made, or was a substantial factor in making, the decisions.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(2)

Plain Language

Insurers must produce, upon request by OHIC or DBR, all information — including documents and software — needed for enforcement. This is an on-demand production obligation, not a scheduled submission. The scope is notably broad: it covers software itself, not just documentation about the software, meaning regulators may request access to the actual AI tools used in claims processing.

Statutory Text

Insurers shall submit to the office of the health insurance commissioner and the department of business regulation, upon request, all information, including documents and software, that permits enforcement of this chapter.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(3)

Plain Language

Insurers must maintain records of all AI-driven decisions for at least five years. The retention obligation is not limited to adverse determinations — it covers all AI decisions — but specifically calls out adverse benefit determinations where AI made or substantially factored into the decision. Practically, insurers need a records management system that captures and preserves documentation of every claim or coverage decision involving AI, including the AI output, the human review (if any), and the rationale. These records must be producible to OHIC/DBR upon request under § 27-84-3(a)(2).

Statutory Text

Insurers shall maintain documentation of artificial intelligence decisions for at least five (5) years including adverse benefit determinations where artificial intelligence made, or was a substantial factor in making, the adverse benefit determination.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(a)

Plain Language

When AI makes or substantially contributes to a non-administrative adverse benefit determination regarding medically necessary care, a licensed provider with the same license status as the ordering professional must review and approve the determination before it is finalized. The reviewing provider must document their rationale in the enrollee's case record. This is a hard-stop gating requirement — the AI determination cannot go into effect without the human clinical peer sign-off. The penalty for noncompliance is automatic reversal of the adverse determination, giving this provision immediate operational consequences. Note this applies only to non-administrative adverse determinations (those requiring medical judgment), not to administrative denials like eligibility or covered-benefit determinations.

Statutory Text

Any non-administrative adverse benefit determination where an artificial intelligence system made, or was a substantial factor in making, that determination regarding medically necessary care shall be reviewed and approved by a provider with the same license status of the ordering professional provider before being finalized, with documentation of their rationale included in the enrollee's case record. Failure to follow the requirements set forth in this subsection shall result in reversal of the non-administrative adverse determination.

HC-01 Healthcare AI Decision Restrictions · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(b)

Plain Language

Even after the required human clinical peer review under § 27-84-4(a), the resulting adverse determination remains subject to the existing appeals process under Rhode Island's utilization review appeals statute (R.I. Gen. Laws ch. 27-18.9). This provision confirms that clinical peer review does not eliminate the enrollee's existing appeal rights — it is an additional safeguard, not a replacement for the appeals process.

Statutory Text

Appeals of non-administrative adverse benefit determinations made by an artificial intelligence system regarding medically necessary care that has been reviewed and approved by a provider with the same license status of the ordering professional provider shall comply with the appeals process set forth in chapter 18.9 of title 27.

T-03 Training Data Disclosure · T-03.1 T-03.3 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

DBR/OHIC must report to the governor and legislative leaders on how health insurers use AI — initially within 18 months of effective date and annually thereafter. While the report is prepared by DBR/OHIC, the data comes from insurers, so this creates an implicit data-production obligation on insurers to provide the information needed. The report must cover, per insurer: AI model types, AI's role in claim decisions, training data governance and bias mitigation measures, and detailed performance metrics including claim volumes, acceptance/denial rates, reviewer time per claim, appeal rates, and reversal rates. The training data and bias reporting component (subsection iii) effectively requires insurers to disclose data governance practices — suitability of data sources, bias identification, and mitigation — making this a training data transparency obligation as well.

Statutory Text

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.