Utah SB 319 — Health Insurance AI Disclosure in Prior Authorization: AI Compliance Requirements
Utah SB 319 (Health Insurance Preauthorization Amendments, 2026 General Session; Chief Sponsor Sen. John D. Johnson, House Sponsor Rep. Katy Hall) amends Utah Code §31A-22-650 to require health insurers to disclose use of artificial intelligence in prior-authorization review and to strengthen preauthorization protections. The bill TAKES EFFECT JANUARY 1, 2027 — it is NOT yet in force. Key duties (effective Jan 1, 2027): (a) post a conspicuous public-website notice that the insurer uses AI in reviewing authorization requests, if applicable; (b) disclose to the Utah Insurance Department, to each network health care provider, and to each enrollee whether the insurer uses AI in authorization review; (c) make standard authorization decisions within seven calendar days and urgent-care decisions within 72 hours of receiving all necessary information; (d) ensure any adverse (clinical/medical-necessity) preauthorization determination is made by an individual who has knowledge of the condition (or consults a specialist), exercises independent medical judgment, and does not rely solely on recommendations from any other source — so AI may assist but cannot be the sole basis for a denial; and (e) refrain from revoking an authorization for care that was approved and rendered (no retroactive denial), absent statutory exceptions (e.g., fraud or materially incorrect provider information). Applies to health insurers/health benefit plans subject to Utah Code Title 31A operating preauthorization in Utah.
Summary of publicly-available regulatory text as of 2026-08-25. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2027
Utah Insurance Department enforcement under existing Title 31A insurance law (SB 319 appropriates no money and adds no new penalty; enforced through the Department's existing authority)
What Your Business Must Do
4 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Adverse Determinations Require Independent Medical Judgment (Not AI Alone)
CriticalEffective January 1, 2027 (not yet in force): an adverse preauthorization determination regarding clinical or medical necessity must be made by an individual who (a) has knowledge of the enrollee's medical condition or disease, or consults with a specialist who does, (b) exercises independent medical judgment, and (c) does not rely solely on recommendations from any other source. AI tools may assist in processing and approving requests, but cannot be the sole basis for a denial. Maintain documentation showing the reviewing individual's independent medical judgment on all adverse determinations.
Deadline: January 1, 2027
Utah Code § 31A-22-650(6)(e)Disclose AI Use in Prior Authorization
High PriorityEffective January 1, 2027 (not yet in force): if your organization uses artificial intelligence (including generative AI) in the process of reviewing an authorization request, you must (1) post a notice of that fact on your website in a conspicuous location accessible by the general public, and (2) disclose that you use AI in authorization review to the Utah Insurance Department, to each health care provider in your network, and to each enrollee. (Note: this AI-use disclosure is a website + department/provider/enrollee notice — it is NOT required to be inserted into individual prior-authorization determination notices.) Document which AI systems are used in prior-auth workflows.
Deadline: January 1, 2027
Utah Code § 31A-22-650(2)(d), (3)No Retroactive Denial of Approved Care
High PriorityEffective January 1, 2027 (not yet in force): once an authorization has been granted (including by AI-assisted processes) and the network provider has rendered the care in accordance with that authorization, the insurer may not revoke the authorization or deny payment — provided the enrollee was eligible and their condition was unchanged on the day of service, the provider submitted an accurate matching claim, and the authorization was not based on fraudulent or materially incorrect provider information. Implement controls to prevent retroactive coverage modifications.
Deadline: January 1, 2027
Utah Code § 31A-22-650Meet Prior-Authorization Decision Timelines
Medium PriorityEffective January 1, 2027 (not yet in force): make and notify the network provider of a decision no later than seven calendar days after receiving all necessary information for a standard request, and no later than 72 hours for an urgent-care-services request. For an urgent request with incomplete information, notify the provider of what is needed within one business day, allow at least two business days for the provider to respond, and decide within two business days of receiving it.
Deadline: January 1, 2027
Utah Code § 31A-22-650Who Does This Apply To?
Applies to health insurers / health benefit plans subject to Utah Code Title 31A that operate prior authorization in Utah, under SB 319 (2026 General Session), which amends Utah Code §31A-22-650 (and §63I-1-231 repeal dates). SB 319 TAKES EFFECT JANUARY 1, 2027 — it is NOT yet in force. In scope as of that date means: (1) post a conspicuous public-website notice that the insurer uses AI in reviewing authorization requests, if applicable, and disclose AI use to the Insurance Department, each network provider, and each enrollee; (2) decide standard requests within seven calendar days and urgent requests within 72 hours of receiving all necessary information; (3) ensure any adverse clinical/medical-necessity determination is made by an individual who has knowledge of the condition (or consults a specialist), exercises independent medical judgment, and does not rely solely on recommendations from any other source (AI may assist but not autonomously deny); and (4) do not revoke an authorization for care that was approved and rendered, absent statutory exceptions (fraud / materially incorrect provider information). Scope is the insurance utilization-management function, not company size; enforced by the Utah Insurance Department under existing Title 31A authority.
Recent Regulatory Guidance
Utah State Legislature — SB 319 Enrolled Bill (2026 General Session)
SB 319 (Health Insurance Preauthorization Amendments) amends Utah Code §31A-22-650 to require insurers to disclose AI use in authorization review (a conspicuous public-website notice plus disclosure to the Insurance Department, each network provider, and each enrollee), to decide standard requests within seven calendar days and urgent requests within 72 hours, to ensure any adverse clinical/medical-necessity determination is made by an individual exercising independent medical judgment who does not rely solely on recommendations from any other source, and to prohibit revoking an authorization for care that was approved and rendered. Section 3 of the enrolled bill sets the effective date at January 1, 2027 — the law is not yet in force.
NAIC Model Bulletin on the Use of AI Systems by Insurers — Utah has NOT adopted it
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. On the NAIC Big Data and Artificial Intelligence (H) Working Group implementation map, status as of April 1, 2026, 25 jurisdictions have adopted the Model Bulletin and 4 more (California, Colorado, New York, Texas) have insurance-specific AI regulation or guidance instead. Utah is in neither group: it has not adopted the Model Bulletin and has issued no insurance-specific AI bulletin. Utah insurers therefore have no state AI-governance-programme bulletin to map to — Utah's AI-in-insurance obligations are statutory, arriving via SB 319 at Utah Code § 31A-22-650 on January 1, 2027, and are narrower than the Model Bulletin: SB 319 governs AI use in prior authorization only, whereas the Model Bulletin would expect a documented AI governance programme across underwriting, pricing, claims, and fraud detection. Insurers operating in both Utah and adopting states should not assume Utah accepts a bulletin-shaped governance filing in lieu of the § 31A-22-650 duties.
Key Case Law & Precedent
Lokken v. UnitedHealth Group (D. Minn., filed 2023)
US District Court, District of Minnesota · 2023Class action alleging UnitedHealth's nH Predict AI tool was used to deny Medicare Advantage coverage in violation of medical-necessity standards. Illustrative federal litigation cited in public discussion of why states are enacting AI-cannot-be-sole-basis-for-denial rules like SB 319. Plaintiffs allege AI overrode clinician judgment in a large share of disputed claims.
Outcome: Cycle 8 (2026-08-22) CORRECTION (same finding already made on florida_government_ai in Cycle 5, left unfixed in this entry until now): the 2025-02-13 ruling PARTIALLY GRANTED the motion to dismiss (unjust-enrichment and bad-faith-insurance claims dismissed; breach-of-contract and implied-covenant-of-good-faith claims allowed to proceed), not decided in 2024. Litigation continues on the surviving claims.
Case referenceFrequently Asked Questions
Does Utah SB 319 — Health Insurance AI Disclosure in Prior Authorization apply to my business?
Utah SB 319 (Health Insurance Preauthorization Amendments, 2026 General Session; Chief Sponsor Sen. John D. Johnson, House Sponsor Rep. Katy Hall) amends Utah Code §31A-22-650 to require health insurers to disclose use of artificial intelligence in… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Utah SB 319 — Health Insurance AI Disclosure in Prior Authorization is: Utah Insurance Department enforcement under existing Title 31A insurance law (SB 319 appropriates no money and adds no new penalty; enforced through the Department's existing authority). Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Utah SB 319 — Health Insurance AI Disclosure in Prior Authorization?
The 4 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://le.utah.gov/Session/2026/bills/static/SB0319.htmlLast updated: 2026-08-25 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan