Washington SB 5395 — AI in Health Insurance Prior Authorization: AI Compliance Requirements

Effective June 11, 2026: AI systems may NOT be the sole means to deny, delay, or modify health care services. Any denial of prior authorization must involve review by a licensed physician or health professional working within their scope of practice who evaluates the specific clinical issues. Audit your prior authorization workflows to ensure human oversight at every denial point.

If you use AI for prior authorization or prior-authorization functions based in whole or in part on medical necessity — OR you contract with or otherwise work through an entity that does — RCW 48.43.830(3)(b) requires you to ensure ALL EIGHT of the following, cumulatively: (i) the AI bases its determination on the enrollee's medical or other clinical history including demographic data, and on the individual clinical circumstances as presented by the requesting provider; (ii) the AI does not base its determination solely on a group data set; (iii) the AI's criteria and guidelines comply with chapter 48.43 RCW and applicable state and federal law; (iv) use of the AI does not discriminate, directly or indirectly, against an enrollee in violation of state or federal law; (v) the AI is fairly and equitably applied, including in accordance with applicable regulations and guidance issued by the federal Department of Health and Human Services; (vi) the policies and procedures for using the AI are OPEN TO AUDIT by the Office of the Insurance Commissioner under chapter 48.37 RCW; (vii) the AI's performance, use, and outcomes are periodically reviewed by the carrier to maximize accuracy and reliability; and (viii) patient data is not used beyond its intended and stated purpose, consistent with chapter 70.02 RCW and HIPAA. Note the statute's own definitions: "artificial intelligence" means machine learning and related technologies that use data to train statistical models to perform tasks normally associated with human intelligence or perception, and expressly INCLUDES generative AI. Condition (vi) is the one to prepare for operationally — write the AI prior-authorization policies and procedures down in an auditable form now, because the OIC can call for them under its market-conduct authority.

When issuing prior authorization denial notices to enrollees, include the credentials, board certifications, and specialty areas of the licensed clinician who had clinical oversight of the determination. Update your denial notice templates before June 11, 2026 to include this information.

Once prior authorization is granted and care is provided, carriers may not retrospectively deny coverage or retrospectively modify the approved request to a less intensive service — including on medical-necessity grounds — under the plan's written policies at the time the care was rendered. Only two statutory exceptions exist: (a) the approved prior authorization was based on a material misrepresentation by the provider, facility, or covered person; or (b) the underlying coverage is lawfully rescinded, cancelled, or terminated retrospectively through the date of service. Such retrospective denials are expressly NOT adverse benefit determinations and do not run through the RCW 48.43.530 appeal process: if the enrollee or the requesting provider demonstrates the authorization was valid under the plan's written policies, the carrier must deem it approved and payable, and the enrollee or provider may go straight to an independent review organization under RCW 48.43.535 without engaging in, exhausting, or waiting out the carrier's grievance process. Implement controls to prevent post-care AI-driven coverage modifications.

By OCTOBER 1, 2026, and annually thereafter, a carrier must report to the Insurance Commissioner, for the prior plan year, aggregated and deidentified data on its prior-authorization practices — but ONLY if it wrote at least one percent of the total accident and health insurance premiums written by all companies authorized to offer accident and health insurance in Washington in the most recently available year. The report must give total prior-authorization requests, approvals, and denials, stated SEPARATELY for determinations the carrier made directly and those made by a health care benefit manager (RCW 48.200.020) delegated to decide on its behalf, and must additionally state (i) the percentage of total denials that were aided by artificial intelligence, (ii) the percentage of determinations made after the standard and expedited turnaround times in RCW 48.43.830, and (iii) the total number of nonelectronic standard and nonelectronic expedited requests. It must also include, for each of seven categories (inpatient medical/surgical, outpatient medical/surgical, inpatient MH/SUD, outpatient MH/SUD, durable medical equipment, diabetes supplies and equipment, and prescription drugs), the top-10 codes by request volume, by approval rate, and by rate of initial denial later approved on appeal, plus average determination response time in hours for expedited, standard, and extenuating-circumstances decisions. Instrument your prior-authorization workflow to record, per determination, whether an AI tool contributed to a denial, whether the decision was made by the carrier or a delegated HCBM, and the decision clock — you cannot reconstruct the AI-aided-denial percentage or the HCBM split retroactively. The Commissioner aggregates and deidentifies the data into a standard report by January 1 each year, without naming the submitting carrier.

RCW 48.43.830(6) extends the entire prior-authorization section — turnaround times, the credentials-disclosure duty, the licensed-clinician denial rule, the AI-not-sole-means rule, and the eight AI conditions — to prior-authorization functions carried out by health care benefit managers, as defined in RCW 48.200.020, under DIRECT OR INDIRECT contract with a carrier. Delegating prior authorization to a pharmacy benefit manager, radiology benefit manager, or other HCBM does not move the obligation off the carrier. Separately, RCW 48.43.0161(1)(a) requires the carrier's annual report to state approvals and denials made by a delegated HCBM separately from those the carrier made directly. Practical steps: inventory every HCBM and downstream subcontractor that touches a Washington prior-authorization decision; amend those contracts to pass through the eight RCW 48.43.830(3)(b) conditions and to secure the audit cooperation and data feed you need; and build the reporting split (carrier-direct vs HCBM-delegated) into your data capture before the October 1 report date.

Washington adopted the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers as Technical Assistance Advisory 2024-02 (issued April 22, 2024, filed with the Code Reviser as WSR 24-10-025), addressed to ALL insurers holding a Washington certificate of authority — not only health carriers. READ THE ADVISORY'S OWN STATUS FIRST: by its footnote 1 it is "a policy statement released to advise the public of OIC's current opinions, approaches, and likely courses of action. It is advisory only. RCW 34.05.230(1)." It is not a rule and creates no free-standing penalty; its force is that it tells you how the OIC will read the laws it does enforce. On that footing the OIC "encourages" every authorized insurer to develop, implement and maintain a written AIS Program for the responsible use of AI systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of Adverse Consumer Outcomes. Per Section 3 the AIS Program should: address governance, risk management controls and internal audit; vest responsibility with senior management accountable to the board or a board committee; be proportionate to your actual use of and reliance on AI and to the Degree of Potential Harm to Consumers; cover the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, fraud detection) and the whole AI system life cycle (design, development, validation, implementation, use, ongoing monitoring, updating, retirement); cover third-party-developed AI as well as your own; and include processes for notifying impacted consumers that AI systems are in use. It may sit inside your existing ERM programme and may adopt a third-party framework such as the NIST AI Risk Management Framework 1.0. Section 3's Part 4.0 additionally asks you to address third-party AI and data — due diligence on the vendor, and, where appropriate and available, contract terms giving audit rights or audit reports and requiring the vendor to cooperate with regulatory inquiries.

Section 4 of TAA 2024-02 states plainly that REGARDLESS of whether you have a written AIS Program, in an investigation or market conduct action an insurer "can anticipate to be asked about its development, deployment, and use of AI Systems." Build the evidence file now rather than at examination. The advisory lists what the OIC may request: the written AIS Program itself and documentation evidencing its adoption; the Program's scope, including any AI systems and technologies NOT covered by it; how it is tailored and proportionate to your AI use, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers; the policies, procedures, guidance and training materials for adopting, implementing, monitoring and overseeing it; processes for developing, adopting or acquiring AI systems, including constraints and controls on automation and design; data governance and controls covering data lineage, quality, integrity, bias analysis and minimisation, suitability and Data Currency; management and oversight of Predictive Models, including inventories and descriptions of the models and AI systems used to make or support decisions that can result in Adverse Consumer Outcomes; for any specific model under examination, documentation of compliance with your own AI policies plus information on the data source, provenance and lineage; the techniques, measurements, thresholds and controls used; documentation of validation, testing and auditing, INCLUDING evaluation of Model Drift, with the nature of that testing reflecting whether the system is a Predictive Model or Generative AI; protection of non-public consumer information, including against unauthorised access to the models themselves; and, where third parties are involved, the due diligence performed, the vendor contracts (representations, warranties, data security and privacy, data sourcing, IP rights, confidentiality and disclosure, cooperation with regulators), the audits or confirmation processes performed on vendor compliance, and third-party validation and Model Drift documentation. The OIC expressly allows compliance to be demonstrated through alternative practices that differ from the bulletin — the goal is stated as ensuring insurers know what the OIC expects to be produced, not prescribing a single method.