IA, US · AI law tracker
SF 562 — IA, US
SF 562 is an AI governance legislation from IA, currently introduced. Iowa SF 562 restricts health carriers from using AI to deny, delay, or modify health services [2]. AIGI tracks 2 primary-source updates on this bill; the most recent was published on 2025-03-06.
Status & timeline
- Regulatory stage
- introduced
- Bill status
- introduced
- Authority / governing body
- Iowa Legislature
- Chamber
- senate
- Document type
- legislation
Next deadline: No fixed deadline — bill introduced.
Subscriber only
Full obligation matrix
| Actor | Obligation | Deadline | Source |
|---|---|---|---|
| deployer | Ensure AI/algorithm bases determination on covered person’s medical/clinical history, individual clinical circumstances, and other relevant clinical information. | — | — |
| deployer | Ensure AI/algorithm criteria and guidelines comply with Iowa Chapter 514F and applicable state and federal law. | — | — |
| deployer | Ensure AI/algorithm does not supplant health care provider decision making. | — | — |
| deployer | Ensure AI/algorithm use does not discriminate, directly or indirectly, against covered persons in violation of state or federal law. | — | — |
| deployer | Ensure AI/algorithm is fairly and equitably applied, including in accordance with any applicable regulations and guidance issued by the federal department of health and human services. | — | — |
| deployer | Ensure AI/algorithm is open to inspection for audit or compliance reviews by the Iowa insurance division and the federal department of health and human services. | — | — |
| deployer | Maintain written policies and procedures containing disclosures pertaining to the use and oversight of the AI/algorithm. | — | — |
| deployer | Periodically review and revise the AI/algorithm’s performance, use, and outcomes to maximize accuracy and reliability. | — | — |
| deployer | Ensure patient data is not used beyond its intended and stated purpose, consistent with HIPAA. | — | — |
| deployer | Ensure AI/algorithm does not directly or indirectly cause harm to a covered person. | — | — |
| deployer | Ensure AI/algorithm shall not deny, delay, or modify health care services based, in whole or in part, on medical necessity. | — | — |
| deployer | Ensure a determination of medical necessity is made only by a health care provider competent to evaluate the specific clinical issues. | — | — |
| agency | Respond to urgent prior authorization requests within forty-eight hours after receipt. | — | — |
| agency | Respond to nonurgent prior authorization requests within ten calendar days after receipt. | — | — |
| agency | Respond to nonurgent prior authorization requests within fifteen calendar days if there are complex or unique circumstances or unusually high volume. | — | — |
| agency | Notify the health care provider of, or make available to the health care provider, a receipt for the prior authorization request within twenty-four hours after receipt. | — | — |
| agency | At least annually, review all health care services for which prior authorization is required and eliminate requirements for services routinely approved without justification. | — | — |
Subscriber only
Enforcement risk score
25
/ 100
Announced regulation; enforcement footprint still forming.
Subscriber only
Role-based compliance checklist
- compliance_officer Review current and planned AI/algorithm use in utilization review for compliance with data basis, legal compliance, non-discrimination, and fair application requirements.
- general_counsel Ensure all AI/algorithm criteria and guidelines comply with Iowa Chapter 514F, other state, and federal laws.
- chief_ai_officer Implement technical safeguards and process changes to ensure AI/algorithms do not supplant human clinical decision-making for medical necessity determinations.
- risk_manager Establish procedures for periodic review and revision of AI/algorithm performance, use, and outcomes to maximize accuracy and reliability and prevent harm.
- privacy_officer Verify patient data usage within AI/algorithm systems aligns with HIPAA and specified purposes.
- compliance_officer Develop and maintain written policies and procedures detailing the use and oversight of AI/algorithms, including required disclosures.
- compliance_officer Prepare for potential audits and compliance reviews by the Iowa insurance division and federal HHS regarding AI/algorithm use.
- product_manager Adjust prior authorization processes to meet new response time requirements (48 hours urgent, 10/15 days nonurgent) and 24-hour receipt notification.
- compliance_officer Establish an annual review process for all prior authorization requirements to eliminate those that do not demonstrate sufficient benefit.
Subscriber only
Vendor impact assessment
- Vendor risk class
- high
- Procurement categories
- healthcare_ai, security_tooling, other
Vendors providing AI, algorithms, or other software tools for utilization review in healthcare will face stringent requirements regarding human oversight, non-discrimination, data privacy, auditability, and performance validation. Health carriers will need to conduct thorough due diligence to ensure vendor compliance and integrate vendor systems with their own compliance frameworks.
Sample vendor questions
- Does your AI/algorithm system ensure that medical necessity determinations are exclusively made by human healthcare providers and cannot be overridden by the AI?
- How does your AI/algorithm prevent direct or indirect discrimination against covered persons, and what audit trails are available to demonstrate fair and equitable application?
- What processes are in place for periodic review, revision, and validation of the AI/algorithm's performance, accuracy, and reliability?
- Can your system provide comprehensive disclosures of its use and oversight in a format suitable for our written policies and procedures?
- How is patient data handled to ensure it is not used beyond its intended and stated purpose, in compliance with HIPAA and relevant state laws?
- Are your systems designed to be open to inspection for audit or compliance reviews by regulatory bodies such as state insurance divisions and federal HHS?
- What mechanisms are embedded to prevent the AI/algorithm from directly or indirectly causing harm to covered persons, and how are potential harms identified and mitigated?
Intelligence briefs (2)
legislation introduced 3/6/2025
Iowa SF 562 Restricts AI Use in Health Carrier Utilization Review
Iowa SF 562 restricts health carriers from using AI to deny, delay, or modify health services [2].
This development places direct deployer obligations on health carriers regarding AI use in medical necessity determinations.
Deadline: No fixed deadline — bill introduced.
Primary source →legislation introduced 3/6/2025
Iowa Bill Regulates AI Use in Health Carrier Utilization Review
Iowa SF 562 prohibits AI from independently denying or delaying health services in utilization review, reserving such decisions for human providers [3].
This development establishes a human-in-the-loop requirement for AI in health care utilization review, defining deployer obligations and signalling regulatory focus on AI system classification.
Deadline: No fixed deadline — effective upon legislative enactment.
Primary source →Frequently asked questions
- What is SF 562?
- Iowa Senate File 562 introduces new requirements for health carriers utilizing artificial intelligence, algorithms, or other software tools in utilization review processes based on medical necessity [1]. The bill specifies that these tools must base determinations on clinical history and individual circumstances, while also prohibiting them from denying, delaying, or modifying health care services [2]. It mandates fair application, auditability, and documented policies for AI use in this context. Primary source →
- Why does SF 562 matter?
- This development places direct deployer obligations on health carriers regarding AI use in medical necessity determinations. Primary source →
- Who does SF 562 affect?
- Health carriers and utilization review organizations operating in Iowa are directly affected. This includes any entity contracting with a health carrier for utilization review that employs artificial intelligence, algorithms, or other software tools in medical necessity determinations. The implications extend to legal, compliance, and operational functions responsible for designing, deploying, and overseeing AI systems in healthcare services. Primary source →
- What are the key dates for SF 562?
- No fixed deadline — bill introduced. Primary source →
- What is the current status of SF 562?
- As of the last published update, SF 562 is at the "introduced" stage, with bill status "introduced". Primary source →
- Where can I find the primary source for SF 562?
- The primary source for the most recent update is at https://www.legis.iowa.gov/publications/search/document?fq=id:1524251&q=algorithmic. AIGI publishes the full citation chain plus every approved brief on this bill. Primary source →
Related
Stay informed