Delaware: AI health laws
2 entries on the map: 2 in force.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Domestic and Foreign Bulletin No. 148, The Use of Artificial Intelligence Systems in Insurance
Reminds insurers that decisions made or supported by AI systems must comply with Delaware insurance law, including the unfair trade practices and unfair claims settlement practices laws, and expects a written AI systems program with governance, risk management and internal audit controls, oversight of third-party AI vendors and documentation that the department may request in investigations or market conduct examinations.
Physician read. It places no duty on physicians. Since Feb. 5, 2025, insurance carriers in Delaware, including health insurers, that use AI systems in decisions affecting consumers, such as claim administration and payment, are expected to keep a written AI systems program, and the Department of Insurance may request information and documentation about it.
Notes: Delaware's version of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers; the NAIC's Aug. 31, 2026 map lists it as adopted Feb. 5, 2025. Signed by Insurance Commissioner Trinidad Navarro and addressed to all insurance carriers doing business in Delaware. It cites the Unfair Trade Practices Act (18 Del. C. ch. 23), including the unfair claims settlement practices provisions (section 2304(16)), the Corporate Governance Annual Disclosure Act (18 Del. C. ch. 85) and its regulation, and the rate making laws (18 Del. C. chs. 25 and 26). It covers the insurance life cycle, including claim administration and payment, and does not mention health insurance or utilization review by name. The bulletin states that it is effective immediately and remains in effect unless withdrawn or superseded. The Department's bulletins page lists it as Domestic/Foreign Insurers Bulletin No. 148; the bulletin itself is headed Domestic and Foreign Bulletin No. 148.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Nothing in this category was found in the review of Sept 29, 2026.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
Nothing in this category was found in the review of Sept 29, 2026.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
HB 154, Delaware Personal Data Privacy Act (84 Del. Laws, c. 197)
Requires consent before processing sensitive data, which includes data revealing a mental or physical health condition or diagnosis (including pregnancy), genetic or biometric data and precise geolocation, lets consumers opt out of targeted advertising, sale of their data and profiling in furtherance of solely automated decisions with legal or similarly significant effects, including decisions on health care services, and requires data protection assessments for high-risk processing by controllers of data on at least 100,000 consumers.
Physician read. Protected health information under HIPAA is exempt, but covered entities are not exempt as entities: a practice or other organization, including a nonprofit, that meets the thresholds must follow the act for personal data that is not protected health information. Since Jan. 1, 2025, such organizations need a consumer's consent to process data revealing a mental or physical health condition or diagnosis and must honor opt-outs from profiling in furtherance of solely automated decisions about health care services; amendments effective Jan. 1, 2027 lower the thresholds and add neural data to sensitive data.
Notes: Passed the House June 8, 2023 (33-5) and the Senate, with an amendment, June 29, 2023 (15-5); the House passed it again June 30, 2023 (37-3), and the governor signed it Sept. 11, 2023. Its effective-date clause provides that if enacted on or before Jan. 1, 2024 it takes effect Jan. 1, 2025. Codified at Title 6, Chapter 12D of the Delaware Code. The HIPAA exemption is data-level: protected health information is exempt, but covered entities and business associates are not listed among exempt entities, and the only nonprofits exempt as entities are those dedicated exclusively to preventing and addressing insurance crime; personal data of victims of or witnesses to abuse, trafficking and similar crimes collected by nonprofits serving them is exempt. The Department of Justice had to offer a 60-day cure period through Dec. 31, 2025. The Delaware Code shows sections amended by 85 Del. Laws, c. 463, effective Jan. 1, 2027: coverage extends to controllers of data on 10,000 consumers (or 5,000 with more than 20% of gross revenue from sales); sensitive data expands to health condition, diagnosis, treatment or status, neural data, financial account numbers and government identification numbers; processing sensitive data requires consent and must be reasonably necessary and proportionate; the profiling opt-out covers automated decisions that are not solely automated; the data protection assessment threshold drops to 50,000 consumers; and impact assessments are added for profiling in automated decisions. The bill enacted as chapter 463 could not be identified. Bill history is from LegiScan.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.