Alabama SB 63
AI-generated text. This page was generated using artificial intelligence.
Alabama SB 63 (Act 2026-589)
Alabama
State statute
SB 63 (2026); Act 2026-589[1]
Approved April 16, 2026[1]
October 1, 2026[1]
September 22, 2026
Overview
Alabama SB 63 is Act 2026-589, a law governing health benefit plan providers’ use of artificial intelligence in medical-necessity decisions on requests for prior authorization. Governor Kay Ivey approved it April 16, 2026; it takes effect October 1, 2026.[1]
Scope
The law applies to covered health benefit plan providers and utilization-review contractors. It addresses requests for prior authorization under health benefit plans and excludes the specified limited-benefit policies listed in its definition of a health benefit plan.[2]
Requirements
A provider that uses AI to determine medical necessity for prior authorization must base the decision on the enrollee’s medical history, clinical circumstances presented by the requesting clinician, and other clinical information in the medical record. It must certify annually to the Alabama Department of Insurance that the AI does not rely on a group dataset to make determinations, is applied fairly and equitably, and does not unlawfully discriminate. A decision to deny, delay or modify a prior-authorization request based on medical necessity must be made by a licensed physician or other health professional competent to evaluate the AI recommendation in the enrollee’s circumstances.[2]
Providers must prominently disclose AI use in utilization-review policies and procedures, periodically review the system and its outcomes for accuracy and reliability, and limit patient-data use to the stated purpose consistently with HIPAA. The law allows compliance with certain duties to be established by an authorized representative’s attestation based on reasonable reliance on internal policies, procedures and vendors.[2]
Enforcement
The Department of Insurance may investigate suspected violations, require a response, hold a hearing, and direct a corrective plan. For repeated violations indicating a general business pattern or practice, it may impose an administrative fine of up to $5,000 and suspend or revoke the provider’s certificate of authority. The department must adopt implementing rules.[2]