Regulon.AI — RI-S-2010 · RI S 2010 (AI Health Insurer Transparency)

Summary

Regulates the use of artificial intelligence by health insurers in Rhode Island for non-administrative claims and coverage management. Requires insurers to disclose to OHIC and DBR how they use AI in healthcare claims and coverage decisions, including AI model types, training datasets, performance metrics, and governance policies, and to maintain documentation of AI decisions for at least five years. Mandates that any non-administrative adverse benefit determination where AI made or substantially contributed to the decision must be reviewed and approved by a provider with the same license status as the ordering provider before being finalized; failure to do so results in automatic reversal. OHIC and DBR must report annually to the governor and legislature on insurer AI use. Enforcement is solely through OHIC/DBR; no private right of action is created.

Enforcement & Penalties

Enforcement Authority

The Office of the Health Insurance Commissioner (OHIC), in collaboration with the Department of Business Regulation (DBR), is the enforcement authority. OHIC and DBR are empowered to promulgate rules and regulations to effectuate the chapter and may request all information, documents, and software from insurers necessary for enforcement. No private right of action is created. Enforcement is agency-initiated.

Penalties

The statute does not specify monetary penalties, civil penalties, or damages. The sole express remedy for failure to comply with the clinical review requirement in § 27-84-4(a) is reversal of the non-administrative adverse benefit determination. Compliance costs are borne entirely by the insurer. OHIC and DBR have rulemaking authority and may establish additional remedies through regulation.

Who Is Covered

"Insurer" means an insurance company licensed, or required to be licensed, by the State of Rhode Island or other entity subject to the jurisdiction of the commissioner or the jurisdiction of the department of business regulation pursuant to chapter 62 of title 42, that contracts or offers to contract, or enters into an agreement to provide, deliver, arrange for, pay for, or reimburse any of the costs of healthcare services, including, without limitation: a for-profit or nonprofit hospital, medical or dental service corporation or plan, a health maintenance organization, a health insurance company, or any other entity providing a plan of health insurance, accident and sickness insurance, health benefits, or healthcare services including, but not limited to, pharmacy benefit managers.

Compliance Obligations 6 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(1)

Plain Language

Insurers must proactively disclose to OHIC and DBR how they use AI to manage healthcare claims and coverage. The disclosure must cover, at minimum: types of AI models used, AI's role in decision-making, training datasets, performance metrics, governance and risk management policies, and which claims and coverage decisions AI made or substantially influenced. This is a broad, affirmative disclosure obligation — not merely responsive to a regulator request — and the 'including, but not limited to' language means the enumerated categories are a floor, not a ceiling.

Statutory Text

Insurers subject to this chapter shall disclose to the office of the health insurance commissioner ("OHIC") and the department of business regulation ("DBR") how they use artificial intelligence to manage healthcare claims and coverage including, but not limited to, the types of artificial intelligence models used, the role of artificial intelligence in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the decisions on healthcare claims and coverage where artificial intelligence made, or was a substantial factor in making, the decisions.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(2)

Plain Language

Insurers must produce to OHIC and DBR, upon request, all information — including documents and software — necessary for enforcement of this chapter. This is a broad on-demand production obligation with no stated time limit for response. Notably, it encompasses software itself, not just documentation about software, which could require making AI tools available for regulator inspection or testing.

Statutory Text

Insurers shall submit to the office of the health insurance commissioner and the department of business regulation, upon request, all information, including documents and software, that permits enforcement of this chapter.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(a)(3)

Plain Language

Insurers must maintain documentation of all AI decisions — including but not limited to adverse benefit determinations where AI made or substantially contributed to the determination — for at least five years. This encompasses both administrative and non-administrative adverse benefit determinations. The retention period is notably longer than the two- to three-year periods seen in many other AI governance statutes. Records must be maintained in a form that supports production to OHIC/DBR upon request under § 27-84-3(a)(2).

Statutory Text

Insurers shall maintain documentation of artificial intelligence decisions for at least five (5) years including adverse benefit determinations where artificial intelligence made, or was a substantial factor in making, the adverse benefit determination.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(a)

Plain Language

When AI makes or substantially contributes to a non-administrative adverse benefit determination regarding medically necessary care, a licensed provider with the same license status as the ordering provider must review and approve the determination before it is finalized. The reviewing provider must document their rationale in the enrollee's case record. This is a hard gating requirement — not merely a recommendation or audit-trail obligation. The automatic reversal remedy for non-compliance is self-executing: if the insurer fails to obtain the required clinical peer review, the adverse determination is reversed as a matter of law, regardless of its clinical merit. This is one of the strongest enforcement mechanisms in the statute.

Statutory Text

Any non-administrative adverse benefit determination where an artificial intelligence system made, or was a substantial factor in making, that determination regarding medically necessary care shall be reviewed and approved by a provider with the same license status of the ordering professional provider before being finalized, with documentation of their rationale included in the enrollee's case record. Failure to follow the requirements set forth in this subsection shall result in reversal of the non-administrative adverse determination.

HC-01 Healthcare AI Decision Restrictions · Deployer · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-4(b)

Plain Language

When a non-administrative adverse benefit determination involving AI has been properly reviewed and approved by a same-license-status provider under § 27-84-4(a), appeals of that determination must follow the existing appeals process in R.I. Gen. Laws Chapter 27-18.9. This provision does not create a new appeals process — it confirms that properly reviewed AI-assisted adverse determinations are subject to the same appeals framework that applies to all adverse benefit determinations in Rhode Island.

Statutory Text

Appeals of non-administrative adverse benefit determinations made by an artificial intelligence system regarding medically necessary care that has been reviewed and approved by a provider with the same license status of the ordering professional provider shall comply with the appeals process set forth in chapter 18.9 of title 27.

T-03 Training Data Disclosure · T-03.1 · Government · HealthcareFinancial Services

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

DBR and OHIC must compile and submit to the governor, senate president, and speaker of the house a report on insurer AI use within 18 months of the effective date and annually thereafter. For each insurer, the report must cover: AI model types, AI's role in claims and coverage decisions, training data governance measures (including suitability of data sources, possible biases, and mitigation), and performance metrics (claims counts, acceptance/denial rates, average reviewer time per claim and denial, appeal rates, and denial reversal rates). While this section imposes the reporting obligation on DBR/OHIC rather than on insurers directly, it effectively requires insurers to furnish all the enumerated information to the regulators — the proactive disclosure obligation in § 27-84-3(a)(1) and the on-request production obligation in § 27-84-3(a)(2) are the mechanisms by which insurers supply this data. The training data governance disclosure (including bias assessment) is a notable data transparency requirement.

Statutory Text

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.