Iowa House File 2635, enacted into law, regulates the use of AI in healthcare prior authorization processes. Specifically, it prohibits utilization review organizations from using AI as the *sole* basis to deny, delay, or downgrade prior authorization requests when medical necessity is the basis. AI can still be used for initial reviews. The law also establishes strict timelines for audit notifications, determinations, and appeals for utilization review organizations. These provisions are applicable to certain health contracts and audits initiated on or after January 1, 2027. The Commissioner of Insurance is empowered to enforce these provisions, including mandating claim approval with interest for violations of audit rules. This signals a clear move towards human oversight in high-stakes AI applications in healthcare.
Effective date
2027-01-01
Action required
Health carriers and utilization review organizations operating in Iowa must review and update their AI systems and processes for prior authorization and claims audits to ensure compliance with human oversight requirements for medical necessity decisions and strict audit timelines by January 1, 2027.
Binding status
binding
Governing body
Iowa Legislature
Direction
restrictive
Innovation impact
constraining
Enforcement details
Agency
Commissioner of Insurance
Compliance requirements
Prohibited practices
- Using an AI-based algorithm or system as the sole basis for denying, delaying, or downgrading a prior authorization request for a health care service based on medical necessity.
- Imposing financial penalties, reimbursement reductions, administrative fees, or terminating a health care provider’s network participation based on referrals to or affiliation with an out-of-network provider.
- Interfering with a health care provider’s decisions regarding staffing and referrals, except as provided by law.
Audit requirements
- Utilization review organizations must notify health care providers of audit initiation within 15 calendar days.
- Utilization review organizations must complete an audit and issue a determination within 45 calendar days of receiving all requested documentation.
- Utilization review organizations must consider appeals of adverse audit determinations and issue a final determination within 30 calendar days of receiving notice of the appeal.
AI technologies
Affected industries
Affected roles
"A utilization review organization may use an artificial intelligence-based algorithm or system to provide an initial review of a request for prior authorization, except that, for a prior authorization request for a health care service based on medical necessity, a utilization review organization shall not use an artificial intelligence-based algorithm or system as the sole basis for the utilization review organization’s decision to deny, delay, or downgrade the prior authorization request."
Enriched 2026-05-26
Stay informed
Get daily intelligence briefs on this and related regulatory developments.