Regulon — VA-SB-586 · VA SB 586 (Health Carrier AI Disclosures)

2026-01-14 introduced Prefiled and ordered printed; Offered 01-14-2026 26100849D

2026-01-14 committee referral Referred to Committee on Commerce and Labor

2026-02-02 Senate committee offered Senate committee offered

2026-02-02 Reported from Commerce and Labor with substitute (9-Y 6-N) Reported from Commerce and Labor with substitute (9-Y 6-N)

2026-02-03 amendment Committee substitute printed 26106800D-S1

2026-02-04 Rules suspended Rules suspended

2026-02-04 Constitutional reading dispensed Block Vote (on 1st reading) (40-Y 0-N 0-A) Constitutional reading dispensed Block Vote (on 1st reading) (40-Y 0-N 0-A)

2026-02-04 Passed by for the day Block Vote (Voice Vote) Passed by for the day Block Vote (Voice Vote)

2026-02-05 amendment Committee substitute agreed to (Voice Vote)

2026-02-05 amendment Engrossed by Senate committee substitute (Voice Vote)

2026-02-05 Read second time Read second time

2026-02-06 chamber passage Read third time and passed Senate (22-Y 18-N 0-A)

2026-02-06 chamber passage Read third time and passed Senate (23-Y 16-N 0-A)

2026-02-06 Reconsideration of passage agreed to by Senate Reconsideration of passage agreed to by Senate

2026-02-12 committee referral Referred to Committee on Communications, Technology and Innovation

2026-02-12 Placed on Calendar Placed on Calendar

2026-02-12 Read first time Read first time

2026-02-23 Continued to next session in Communications, Technology and Innovation (Voice Vote) Continued to next session in Communications, Technology and Innovation (Voice Vote)

Summary

Amends Virginia's existing health carrier fair business practices statute to add AI-specific obligations for health insurance carriers. Carriers that use AI to manage insurance claims and coverage must publicly disclose their AI use — including underlying algorithms, data used, and resulting determinations — to the Bureau of Insurance. Carriers must maintain AI decision documentation for at least three years, submit information to the Bureau upon request, and provide notice to enrollees and providers when AI has been used to issue an adverse determination, along with a clear and timely appeal process. Enforcement is through the State Corporation Commission's existing jurisdiction, plus a private right of action for providers who suffer loss, with treble damages available for gross negligence and willful conduct.

Enforcement & Penalties

Enforcement Authority

The State Corporation Commission (the Commission) has jurisdiction to determine if a carrier has violated the standards set forth in subsection B, including subdivision B 15, by failing to include requisite provisions in provider contracts or failing to implement minimum fair business standards. The Commission may promulgate rules and regulations to implement the section. The Commission does not adjudicate individual controversies. Providers may initiate a private action to recover actual damages for a carrier's violation. The Bureau of Insurance receives disclosures and may request documents and software necessary for enforcement.

Penalties

A provider who suffers loss as a result of a carrier's violation may recover actual damages. If the trier of fact finds the violation resulted from gross negligence and willful conduct, damages may be increased up to three times actual damages sustained. Reasonable attorney fees and court costs may also be awarded. Each claim paid or processed in violation constitutes a separate violation.

Who Is Covered

"Carrier," "enrollee," and "provider" shall have the meanings set forth in § 38.2-3407.10; however, a "carrier" shall also include any person required to be licensed under this title which offers or operates a managed care health insurance plan subject to Chapter 58 (§ 38.2-5800 et seq.) or which provides or arranges for the provision of health care services, health plans, networks or provider panels which are subject to regulation as the business of insurance under this title.

Compliance Obligations 3 obligations · click obligation ID to open requirement page

HC-01 Healthcare AI Decision Restrictions · HC-01.7 · Deployer · HealthcareFinancial Services

§ 38.2-3407.15(B)(15)(i)-(ii)

Plain Language

Health carriers that use AI to manage insurance claims and coverage must publicly disclose to the Bureau of Insurance the details of that AI use, including the underlying algorithms, data used, and resulting determinations. Additionally, carriers must submit to the Bureau upon request all information — including documents and software — necessary for enforcement. This creates both an affirmative proactive disclosure obligation and a responsive production obligation to the regulator.

Statutory Text

Each carrier shall (i) publicly disclose, if applicable, to the Bureau the carrier's use of AI to manage insurance claims and coverage, including in underlying algorithms, data used, and resulting determinations; (ii) submit to the Bureau, upon request, all information, including documents and software, necessary for enforcement of this subdivision;

G-01 AI Governance Program & Documentation · G-01.3 · Deployer · HealthcareFinancial Services

§ 38.2-3407.15(B)(15)(iii)

Plain Language

Health carriers must maintain documentation of all AI-driven decisions related to insurance claims and coverage management for at least three years. This is a standalone recordkeeping obligation — carriers need a system capable of logging and retaining records of each AI decision, including adverse determinations, for the full retention period. The three-year window runs from the date of the decision.

Statutory Text

Each carrier shall ... (iii) maintain documentation of AI decisions for at least three years;

HC-01 Healthcare AI Decision Restrictions · HC-01.6 HC-01.8 · Deployer · HealthcareFinancial Services

§ 38.2-3407.15(B)(15)(iv)

Plain Language

When a health carrier uses AI to issue an adverse determination (e.g., a claim denial, coverage modification, or prior authorization denial), the carrier must notify both the affected enrollee and the health care provider that AI was used in making that determination. In addition, the carrier must provide a clear and timely appeal process for the adverse determination. This imposes two distinct obligations on the same triggering event: (1) disclosure that AI was involved, and (2) a functional appeal mechanism. The statute does not specify exactly what the notice must contain beyond the AI involvement disclosure, nor does it define the timeline for 'timely,' which the Commission may clarify by regulation.

Statutory Text

Each carrier shall ... (iv) provide notice to enrollees and health care providers when AI has been used to issue an adverse determination and provide a clear and timely process for appealing the determination.