Regulon — RI-S-2010 · RI S 2010 (Health Insurer AI Transparency)

Summary

Regulates the use of artificial intelligence by health insurers in Rhode Island for managing healthcare claims and coverage decisions. Requires insurers to disclose to OHIC and DBR how they use AI in claims and coverage management, including model types, training datasets, performance metrics, and governance policies. Mandates that any non-administrative adverse benefit determination where AI made or was a substantial factor in the decision must be reviewed and approved by a provider with the same license status as the ordering provider before finalization; failure to do so results in automatic reversal. Requires insurers to maintain AI decision documentation for at least five years. OHIC/DBR must produce annual reports to state leadership on insurer AI use. Enforcement is through OHIC and DBR rulemaking authority; no private right of action is created.

Enforcement & Penalties

Enforcement Authority

The Office of the Health Insurance Commissioner (OHIC), in collaboration with the Department of Business Regulation (DBR), has enforcement authority. OHIC and DBR are empowered to promulgate rules and regulations necessary to effectuate the chapter. Enforcement is agency-initiated; insurers must submit all information, documents, and software upon request to permit enforcement. No private right of action is created.

Penalties

The statute does not specify monetary penalties, civil penalties, or damages. The sole specified remedy for failure to comply with the clinical review requirement in § 27-84-4(a) is reversal of the non-administrative adverse benefit determination. The total cost of compliance is borne by the insurer. OHIC and DBR may promulgate additional enforcement rules and regulations.

Who Is Covered

"Insurer" means an insurance company licensed, or required to be licensed, by the State of Rhode Island or other entity subject to the jurisdiction of the commissioner or the jurisdiction of the department of business regulation pursuant to chapter 62 of title 42, that contracts or offers to contract, or enters into an agreement to provide, deliver, arrange for, pay for, or reimburse any of the costs of healthcare services, including, without limitation: a for-profit or nonprofit hospital, medical or dental service corporation or plan, a health maintenance organization, a health insurance company, or any other entity providing a plan of health insurance, accident and sickness insurance, health benefits, or healthcare services including, but not limited to, pharmacy benefit managers.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 · Deployer · Healthcare

R.I. Gen. Laws § 27-84-3(a)(1)

Plain Language

Insurers must proactively disclose to OHIC and DBR how they use AI to manage healthcare claims and coverage. The disclosure must cover at minimum: the types of AI models used, the role AI plays in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the specific claims and coverage decisions where AI made or substantially contributed to the outcome. This is a comprehensive transparency obligation to the regulator — not a one-time filing but a disclosure of the insurer's overall AI use practices.

Statutory Text

Insurers subject to this chapter shall disclose to the office of the health insurance commissioner ("OHIC") and the department of business regulation ("DBR") how they use artificial intelligence to manage healthcare claims and coverage including, but not limited to, the types of artificial intelligence models used, the role of artificial intelligence in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the decisions on healthcare claims and coverage where artificial intelligence made, or was a substantial factor in making, the decisions.

R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · Healthcare

R.I. Gen. Laws § 27-84-3(a)(2)

Plain Language

Upon request from OHIC or DBR, insurers must produce all information — including documents and software — necessary to enforce the chapter. This is notably broad: it encompasses not just documentation but the AI software itself, meaning regulators can demand access to the actual AI tools used in claims and coverage management. Insurers should maintain their AI systems and associated documentation in a state of readiness for production at any time.

Statutory Text

Insurers shall submit to the office of the health insurance commissioner and the department of business regulation, upon request, all information, including documents and software, that permits enforcement of this chapter.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · Healthcare

R.I. Gen. Laws § 27-84-3(a)(3)

Plain Language

Insurers must retain documentation of all AI-driven decisions for at least five years. This expressly includes adverse benefit determinations where AI made or was a substantial factor in the decision. The retention obligation is broad — it covers all AI decisions, not just adverse ones — and the five-year minimum is among the longer retention periods seen in state AI legislation. Insurers should ensure their documentation systems capture both the AI output and the decision context for every claim and coverage determination involving AI.

Statutory Text

Insurers shall maintain documentation of artificial intelligence decisions for at least five (5) years including adverse benefit determinations where artificial intelligence made, or was a substantial factor in making, the adverse benefit determination.

HC-01 Healthcare AI Decision Restrictions · HC-01.1 HC-01.2 · Deployer · Healthcare

R.I. Gen. Laws § 27-84-4(a)

Plain Language

When AI makes or substantially contributes to a non-administrative adverse benefit determination involving medically necessary care, a licensed provider with the same license status as the ordering provider must review and approve the determination before it is finalized. The reviewing provider must document their rationale in the enrollee's case record. This is a mandatory human-in-the-loop requirement — the AI determination cannot take effect without affirmative human clinical review. The penalty for non-compliance is automatic reversal of the adverse determination, creating a strong structural incentive for compliance. This applies only to non-administrative determinations (those involving medical judgment or clinical criteria), not to administrative determinations like eligibility or covered-benefit questions.

Statutory Text

Any non-administrative adverse benefit determination where an artificial intelligence system made, or was a substantial factor in making, that determination regarding medically necessary care shall be reviewed and approved by a provider with the same license status of the ordering professional provider before being finalized, with documentation of their rationale included in the enrollee's case record. Failure to follow the requirements set forth in this subsection shall result in reversal of the non-administrative adverse determination.

Other · Healthcare

R.I. Gen. Laws § 27-84-4(b)

Plain Language

Appeals of AI-driven non-administrative adverse benefit determinations that have been properly reviewed by a same-license-status provider must follow the existing appeals process under R.I. Gen. Laws chapter 27-18.9. This provision creates no new obligation — it confirms that the standard health insurance appeals framework applies to AI-influenced determinations. Insurers already subject to chapter 18.9 need not establish a separate AI-specific appeals process.

Statutory Text

Appeals of non-administrative adverse benefit determinations made by an artificial intelligence system regarding medically necessary care that has been reviewed and approved by a provider with the same license status of the ordering professional provider shall comply with the appeals process set forth in chapter 18.9 of title 27.

T-03 Training Data Disclosure · T-03.1 · DeployerGovernment · Healthcare

R.I. Gen. Laws § 27-84-3(b)(1)-(2)

Plain Language

OHIC/DBR must produce an initial report to the governor, senate president, and speaker of the house within 18 months of the act's effective date, and annually thereafter, on how health insurers use AI to manage claims and coverage. While this provision is directed at the regulators, it creates a derivative compliance obligation for insurers: the report must include, for each insurer, the types of AI models used, AI's role in decision-making, training data governance measures (including bias assessment and mitigation), and detailed performance metrics such as claim acceptance/denial rates, reviewer time per claim, appeal rates, and denial reversal rates. Insurers must be prepared to produce all of this information to OHIC/DBR on an ongoing basis to support the annual report.

Statutory Text

(1) DBR/OHIC shall provide an initial report to the governor, the senate president and the speaker of the house on the use of artificial intelligence by health insurers within eighteen (18) months of the effective date of this chapter and annually thereafter. (2) The annual report shall state how health insurers use artificial intelligence to manage claims and coverage. The report shall state, for each insurer: (i) The types of artificial intelligence models used; (ii) The role of artificial intelligence in the decision-making process to approve or deny healthcare claims or coverage whenever artificial intelligence is used to make, or is a substantial factor in making, a decision on healthcare claims or coverage; (iii) Information regarding training, testing, and risk management including data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; and (iv) Performance metrics including: number of claims; percentage of claims accepted and denied; the average time claim reviewers and medical professional reviewers spend on each claim and on denials of claims; percentage of claims appealed; and percentage of denials reversed.

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Government · Healthcare

R.I. Gen. Laws § 27-84-5(a)

Plain Language

OHIC and DBR are jointly empowered to promulgate rules and regulations to implement the chapter. While this is primarily a rulemaking delegation, it has practical compliance significance: insurers should anticipate that OHIC/DBR will issue implementing regulations that may add specificity to the disclosure, documentation, and clinical review requirements. Insurers should monitor OHIC/DBR rulemaking proceedings and be prepared to comply with additional requirements beyond the statutory text.

Statutory Text

OHIC, in collaboration with DBR, shall promulgate rules and regulations that may be necessary to effectuate the purposes and implementation of this chapter.