IA, US · AI law tracker
HF 2635 — IA, US
HF 2635 is an AI governance legislation from IA, currently introduced. The bill introduces specific limitations on the use of AI in healthcare prior authorization decisions, effective January 1, 2027 [1]. AIGI tracks 2 primary-source updates on this bill; the most recent was published on 2026-02-19.
Status & timeline
- Regulatory stage
- introduced
- Bill status
- introduced
- Authority / governing body
- Iowa Legislature
- Chamber
- house
- Document type
- legislation
Next deadline: January 1, 2027 — for contracts, policies, or plans delivered, issued for delivery, continued, or renewed, and for audits initiated.
Subscriber only
Full obligation matrix
| Actor | Obligation | Deadline | Source |
|---|---|---|---|
| deployer | Shall not use an artificial intelligence-based algorithm or system as the sole basis for the decision to deny, delay, or downgrade a prior authorization request for a health care service based on medical necessity. | 2027-01-01 | — |
| deployer | Shall notify the health care provider that submitted the claim of the initiation of the audit no later than fifteen calendar days after the date the utilization review organization selects the claim for audit. | 2027-01-01 | — |
| deployer | Shall complete an audit of a claim and issue a determination on the claim to the health care provider no later than forty-five calendar days after the date the utilization review organization receives all requested documentation regarding the claim from the health care provider. | 2027-01-01 | — |
| deployer | Shall consider an appeal of an adverse determination and issue a final determination on the claim that is the subject of the appeal no later than thirty calendar days after the date the utilization review organization receives notice of the appeal. | 2027-01-01 | — |
| deployer | If found in violation by the commissioner, the claim shall be approved by the utilization review organization and promptly paid, including interest at the rate of ten percent per annum. | Promptly | — |
| other | May appeal an adverse audit determination no later than thirty calendar days after the date the health care provider receives the audit determination. | 30 days after receipt of determination | — |
| other | May opt-in to receive electronic delivery of notices and audit determinations from a utilization review organization. | — | — |
| deployer | Shall not impose on a health care provider, directly or indirectly, any financial penalty, reimbursement reduction, or administrative fee, or terminate a health care provider’s participation in the health carrier’s network, based on the health care provider’s referral to, or affiliation with, an out-of-network health care provider. | 2027-01-01 | — |
| deployer | Shall not interfere with, or participate in any capacity in, a health care provider’s decisions regarding staffing and referrals, except as otherwise provided by law. | 2027-01-01 | — |
| agency | May adopt rules pursuant to chapter 17A to administer and enforce the section on utilization review organization audits. | — | — |
Subscriber only
Enforcement risk score
Enforcement actions have been filed against named organizations under this or analogous rules.
Subscriber only
Role-based compliance checklist
- chief_ai_officer Review all AI-based algorithms/systems used for prior authorization requests based on medical necessity to ensure they are not the sole basis for denial, delay, or downgrade decisions. (2027-01-01)
- compliance_officer Update internal policies and training for utilization review organizations to reflect new audit notification (15 days), completion (45 days), and appeal (30 days) timelines. (2027-01-01)
- general_counsel Review and update health carrier contracts and policies to eliminate clauses that impose penalties or interfere with providers based on out-of-network referrals or staffing decisions. (2027-01-01)
- hr_director Ensure health carrier practices do not interfere with health care provider staffing decisions. (2027-01-01)
- compliance_officer Monitor the Iowa Commissioner of Insurance for any new rules adopted to administer and enforce these sections. (Ongoing)
Subscriber only
Vendor impact assessment
- Vendor risk class
- high
- Procurement categories
- healthcare_ai, security_tooling, infrastructure
Vendors providing AI solutions for utilization review, particularly those involved in prior authorization, must demonstrate that their systems incorporate robust human oversight and do not function as the sole decision-maker for adverse medical necessity determinations. Software for claims processing and audits must also support the new timeline requirements.
Sample vendor questions
- Does your AI solution for prior authorizations ever make a denial, delay, or downgrade decision based solely on the AI output for medical necessity requests?
- What human oversight mechanisms are built into your AI-driven prior authorization systems?
- How does your system facilitate compliance with the 15-day audit notification, 45-day audit determination, and 30-day appeal determination timelines?
- Can your system support an opt-in for electronic delivery of audit notices and determinations?
Intelligence briefs (2)
Iowa HF 2635 Restricts AI Use in Healthcare Prior Authorizations
The bill introduces specific limitations on the use of AI in healthcare prior authorization decisions, effective January 1, 2027 [1].
This legislation introduces specific deployer obligations for AI systems in a high-risk healthcare context, signaling increasing sector-specific regulatory focus.
Deadline: January 1, 2027 — for contracts, policies, or plans delivered, issued for delivery, continued, or renewed, and for audits initiated.
Primary source →Iowa Restricts AI as Sole Basis for Health Prior Authorization Denials
Iowa now prohibits AI-based algorithms as the sole basis for denying, delaying, or downgrading prior authorization requests for medical necessity [2].
This directly establishes a deployer-oversight obligation for AI in healthcare prior authorization within Iowa, impacting risk management frameworks.
Deadline: The AI restriction regarding prior authorizations is effective immediately. Audit provisions, including notification and determination timelines, apply to contracts, policies, or plans delivered, issued for delivery, continued, or renewed in Iowa on or after January 1, 2027, and to audits initiated on or after that date [3].
Primary source →Frequently asked questions
- What is HF 2635?
- Iowa House File 2635 (HF 2635) has been introduced, stipulating that utilization review organizations may use AI for initial prior authorization reviews but not as the sole basis for denying, delaying, or downgrading requests based on medical necessity [1]. The bill also establishes new audit procedures and timelines for these organizations, alongside standards of conduct for health carriers [2]. These provisions are set to apply to relevant contracts and audits initiated on or after January 1, 2027 [2]. Primary source →
- Why does HF 2635 matter?
- This legislation introduces specific deployer obligations for AI systems in a high-risk healthcare context, signaling increasing sector-specific regulatory focus. Primary source →
- Who does HF 2635 affect?
- Utilization review organizations, health carriers, and healthcare providers operating in Iowa are within scope. The provisions specifically affect AI systems used in prior authorization workflows for medical necessity determinations and audit processes for third-party payment provider contracts. This includes individual or group accident and sickness insurance, hospital or medical service contracts, and health maintenance organization contracts. Primary source →
- What are the key dates for HF 2635?
- January 1, 2027 — for contracts, policies, or plans delivered, issued for delivery, continued, or renewed, and for audits initiated. Primary source →
- What is the current status of HF 2635?
- As of the last published update, HF 2635 is at the "introduced" stage, with bill status "introduced". Primary source →
- Where can I find the primary source for HF 2635?
- The primary source for the most recent update is at https://www.legis.iowa.gov/publications/search/document?fq=id:1602076&q=artificial+intelligence. AIGI publishes the full citation chain plus every approved brief on this bill. Primary source →
Related
Stay informed