Whatever you think of it, Artificial Intelligence (“AI”) is here to stay, and few people or industries remain untouched by it. Healthcare is no exception.
AI’s use in healthcare continues to expand. Many of us have received messages from our physicians’ office disclosing that they were drafted with AI assistance. AI can deliver real efficiencies in healthcare. Manually entering data into electronic health records is time-consuming. AI scribing software can dramatically cut that time, freeing providers to focus on clinical work rather than paperwork. However those gains must not come at the expense of compliance.
That is easier said than done because the rules governing AI continue to evolve. Particularly striking is the divergence between federal and state approaches to AI regulation. Although comprehensive AI bills remain rare, more than 40 states have passed some form of AI legislation, while the federal government has moved in the opposite direction.
In a series of Executive Orders (“EOs”) issued since January 2025, the Trump Administration has made its position clear: when it comes to AI regulation, less is more. The Administration overturned President Biden’s EO 14110, which called for responsible development, government oversight, and regulation[i]. EO 14365 went further by calling for a national standard rather than “50 discordant State [standards].”[ii] It also attacked specific state laws, including Colorado’s Senate Bill (“SB”) 24-205, which was passed but never took effect. Later EOs have taken the same hands-off approach.
Still, the federal government’s hands-off approach does not mean healthcare providers are off the hook. Although the Health Insurance Portability and Accountability Act (“HIPAA”) predates generative AI, experts agree that HIPAA applies to AI use by covered entities and their business associates. If you use, or plan to use, AI in a manner that involves uploading protected health information, make sure a business associate agreement covers that use.
Nor has EO 14365 slowed the states. At least three—California, Colorado, and Texas—have passed laws that either directly target AI in healthcare or otherwise affect healthcare entities using AI.
California
California has enacted three laws impacting healthcare providers. Assembly Bill (“AB”) 3030, regulating provider use of AI to write patient messages, took effect in January 2025[iii]. AB 1979[iv] will require health facilities and physician offices to preserve clinicians’ independent judgment when AI output informs patient care. SB 503[v] will require developers and deployers of AI clinical decision-support tools to identify and mitigate the risk of bias, including bias based on protected-class status. Both laws take effect on January 1, 2027.
Colorado
Colorado’s 2024 comprehensive AI law, SB 24-205, fizzled, but two newer laws affect healthcare providers in the state. House Bill (“HB”) 26-1195[vi], aimed at mental health providers, took effect on August 12, 2026. SB 26-189[vii] takes effect on January 1, 2027, and will require providers using automated decision-making technology (“ADMT”) to give patients general notice regarding how they are using ADMT and specific disclosures whenever ADMT is used to determine patient eligibility for financial assistance.
Texas
SB 1188[viii], which requires providers to review AI-generated medical records, took effect on September 1, 2025. HB 149[ix], the Texas Responsible Artificial Intelligence Governance Act (“TRAIGA”), took effect on January 1, 2026. Although a general AI law, TRAIGA requires providers to inform patients or their representatives that AI was used in diagnosis or treatment.
So what does all this mean for healthcare providers? As they adopt AI, providers must keep track of both the federal and state laws governing its use. The Trump Administration will surely challenge some of these state laws, but the momentum is unlikely to stop. Maryland and Missouri have already enacted healthcare-related AI laws, and Pennsylvania has similar bills pending. The Administration’s hands-off approach will also likely be tested now that Democrats have won both the House and Senate. Incoming Democrats are already drafting AI legislation, so providers should expect the federal rules to keep shifting. One thing is certain amid the uncertainty (or perhaps more accurately, the uncertainty amid the certainty): more states are likely to follow, so providers must remain vigilant as AI becomes part of their practices.
[i] https://www.federalregister.gov/documents/2023/11/01/2023-24283/safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence; https://www.federalregister.gov/documents/2025/01/28/2025-01901/initial-rescissions-of-harmful-executive-orders-and-actions. See also, https://www.federalregister.gov/documents/2025/01/31/2025-02172/removing-barriers-to-american-leadership-in-artificial-intelligence.
[ii] https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence
[iii] https://calmatters.digitaldemocracy.org/bills/ca_202320240ab3030
[iv] https://calmatters.digitaldemocracy.org/bills/ca_202520260ab1979
[v] https://calmatters.digitaldemocracy.org/bills/ca_202520260sb503
[vi] https://leg.colorado.gov/bills/hb26-1195
[vii] https://leg.colorado.gov/bills/sb26-189
[viii] https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188E.htm
[ix] https://capitol.texas.gov/tlodocs/89R/analysis/html/HB00149S.htm
