Alabama’s SB 63 took effect on October 1, 2026. It covers health plans regulated by the state that use artificial intelligence on prior authorization requests. Under the law, a decision to “deny, delay, or modify” a request for medical-necessity reasons must “always be made by a licensed physician or other health care professional.” The AI must also weigh the patient’s own medical history and clinical details, not just group data. Insurers must disclose their AI use and certify their tools to the state every year. The catch: it covers prior authorization only, and it doesn’t reach every plan.
Alabama is one of several states putting guardrails on insurer AI. For patients who feel a computer said “no,” this law gives a clearer standard to point to. For billing teams, it raises the value of a complete prior authorization request.
Key takeaways
- Effective date: October 1, 2026 (Section 2 of the enrolled act).
- A licensed physician or other qualified professional must make any medical-necessity denial, delay or change of a prior authorization request.
- AI determinations must be based on the patient’s medical history, the clinical facts the provider sends, and other information in the medical record.
- Insurers must make a “prominent written disclosure” of their AI use in their utilization review policies.
- Enforcement runs through the Alabama Department of Insurance. Fines are capped at $5,000 for repeat violations that show a “general business pattern.”
How this article was checked: every requirement below comes from the enrolled text of Alabama SB 63 on the Alabama Legislature’s website. Federal Medicare Advantage rules come from a CMS FAQ memo. Last reviewed 7 October 2026. This is educational content, not legal advice.
Table of Contents
What Alabama SB 63 requires
The enrolled bill is short. Here is what it requires of a “health benefit plan provider” that uses AI to make medical-necessity determinations on prior authorization requests:
| Requirement | What the law says (paraphrased, with key words quoted) |
|---|---|
| Individual review | Base determinations on the enrollee’s medical history, clinical circumstances presented by the requesting provider, and other clinical information in the medical record |
| Human decision on denials | A decision to “deny, delay, or modify” a request based on medical necessity “shall always be made by a licensed physician or other health care professional” competent to evaluate the AI’s output |
| Annual certification | Certify to the Department of Insurance each year that the AI does not “rely on a group dataset,” is fairly applied, and does not discriminate |
| Disclosure | Make “prominent written disclosure” of AI use in utilization review in its policies and procedures |
| Ongoing review | Review the AI’s use and outcomes periodically for accuracy and reliability |
| Data limits | Don’t use patient data beyond its intended purpose, consistent with HIPAA |
| Enforcement | The department can send a notice (30 days to respond), hold a hearing, impose a corrective plan, and for repeat pattern violations fine up to $5,000 or suspend or revoke a license |
The law also tells the department to write rules to enforce it.
Who it covers, and who it doesn’t
This is where patients need to read carefully.
Covered: health plans “issued, delivered, or renewed” in Alabama. The law names insurers, HMOs, nonprofit health care service plans and certain agricultural-organization plans. It also covers their internal utilization review units and any outside company doing utilization review for them.
Expressly excluded: accident-only, specified-disease, hospital indemnity, dental-only, Medicare supplement, long-term care, disability income and similar limited-benefit policies.
Likely not covered, based on how state insurance law usually works:
- Self-funded employer plans. Many large employers pay claims themselves and hire an insurer only to run the plan. Those plans are generally governed by federal law (ERISA), not state insurance codes. Your plan documents or HR office can tell you whether your plan is “self-funded” or “fully insured.”
- Medicare Advantage plans. These follow federal CMS rules. CMS has already said, in a 2024 FAQ memo, that an algorithm deciding coverage “based on a larger data set instead of the individual patient’s medical history” would not comply with Medicare Advantage rules.
Only prior authorization. The law defines utilization review as decisions on prior authorization requests. It doesn’t, on its face, cover denials of claims after care is given. That includes automated downcoding or a post-service medical-necessity denial.
How Alabama compares with Colorado
Alabama isn’t alone. Colorado’s HB26-1139, signed June 2, 2026, takes effect January 1, 2027. It is broader in some ways:
| Point | Alabama SB 63 | Colorado HB26-1139 |
|---|---|---|
| Effective | Oct. 1, 2026 | Jan. 1, 2027 |
| Scope | AI used on prior authorization medical-necessity decisions | AI used for utilization review by carriers, PBMs, private review organizations and certain state program entities |
| Human review | Licensed physician or other qualified professional makes denial, delay or modification decisions | Medical-necessity denials can’t rest solely on AI output without review by a licensed clinician or other competent professional |
| Group data | AI may not rely on a group dataset | AI may not base decisions solely on group data |
| Disclosure | Written disclosure in the plan’s policies; annual certification to the state | Disclosure to regulators of where and how AI is used and how humans oversee denials |
What this means for patients in Alabama
- Find out what kind of plan you have. Look for “fully insured” or “self-funded” in your plan documents, or ask HR. The law most clearly helps people with fully insured or individual plans.
- Ask for the reason and the reviewer. When a prior authorization is denied, ask your doctor’s office for the denial letter. Ask the plan what clinical criteria it used and what kind of professional made the decision. The law doesn’t spell out a right to that information, but asking creates a record.
- Appeal, and ask for speed if you need it. The law doesn’t replace your normal appeal rights. Our guide on what to do when prior authorization is denied covers peer-to-peer reviews and expedited appeals.
- Complain if the denial looks automated. If a denial ignores your history or reads like a form letter, you can file a complaint with the Alabama Department of Insurance. The department can act when it has “reasonable grounds” to believe a plan made adverse decisions without considering the enrollee’s history and circumstances.
What this means for billing teams and providers
The law requires AI decisions to rest on the clinical circumstances “presented by the requesting health care provider.” So the quality of your request matters more than ever.
- Send a complete clinical picture with every request. Include history, failed treatments, imaging and the treating physician’s reasoning. Our prior authorization checklist for surgical procedures lists what to attach.
- Write to the payer’s criteria. Tie the notes to the plan’s published criteria. See what payers actually look for in medical necessity documentation.
- Track suspicious patterns by payer. Look for identical denial language, denials issued minutes after submission, or denials that ignore attached records. Keep a log by payer and service. A documented pattern makes a regulator complaint much stronger.
- Don’t let a denial become a CO-197. If care goes ahead without approval, the claim will likely come back with CO-197 (precertification absent). If the plan later denies for necessity, you may see CO-50. Fix the authorization first when you can.
The limits worth knowing
The fines are small for a large insurer: up to $5,000, and only for repeat violations showing a business pattern. Compliance rests largely on the insurer’s own attestation, which the law says can rely on “internal policies, procedures, and third-party vendors.” The department hasn’t yet published its rules. So the law’s real force will depend on how actively the department enforces it and on complaints from patients and providers.
FAQ
When did Alabama’s AI prior authorization law take effect?
October 1, 2026, according to Section 2 of the enrolled bill.
Does Alabama ban insurers from using AI?
No. Insurers can still use AI on prior authorization requests. But a licensed physician or other qualified professional must make any medical-necessity denial, delay or change. The AI must also consider the individual patient’s information.
Does the law apply to my employer’s health plan?
It applies to plans issued, delivered or renewed in Alabama. Self-funded employer plans are generally governed by federal ERISA law instead of state insurance law. Ask your HR office whether your plan is fully insured or self-funded.
Does it cover Medicare Advantage?
Medicare Advantage plans follow federal CMS rules. CMS has said MA plans can’t use an algorithm to make coverage decisions based on group data instead of the individual patient’s history, the physician’s recommendations or clinical notes.
Does it cover claim denials after I’ve had the care?
On its face, no. The law defines utilization review as decisions on prior authorization requests, so post-service claim denials fall outside it.
Sources
- Alabama Legislature, SB 63 (2026 Regular Session), enrolled act.
- Colorado General Assembly, HB26-1139 Use of Artificial Intelligence in Health Care.
- CMS, Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F), Feb. 6, 2024.
- Alabama Department of Insurance, File a Complaint.
Manikandan J is a CPC (AAPC) and CRCR (HFMA) certified medical billing professional with billing and RCM experience at athenahealth, Omega Healthcare, UnitedHealthcare, Blue Cross Blue Shield and Access Healthcare. He writes Medical Billing 101’s guides on denial codes, appeals and patient billing help for US billers, providers and insured patients.
