What applies to a physician in Illinois

Applies to: Insurers, employers, direct-to-consumer genetic and biomarker testing companies, health information exchanges, and providers and facilities that handle genetic or biomarker testing information

Binds providers and facilities in a health information exchange, physicians included: disclosure and an opt-out at a patient's first genetic or biomarker testing encounter.

Applies to: Private entities that collect, capture, possess or store biometric identifiers or biometric information

Binds private entities collecting biometrics; patient data captured in a health care setting or used for HIPAA treatment, payment or operations is excluded, but staff biometrics such as time clocks are covered.

Applies to: HIPAA covered entities and business associates that use tracking technologies on websites or mobile apps

HHS guidance for HIPAA covered entities: tracking technologies on patient portals and apps may not send PHI to vendors without a business associate agreement or patient authorization.

Applies to: Private entities subject to the Biometric Information Privacy Act

Amends BIPA for all private entities, so it reaches practices and hospitals for staff and other non-patient biometrics; patient data captured in a health care setting stays excluded.

Applies to: Covered entities under Section 1557 that use patient care decision support tools

OCR guidance on 45 CFR 92.210 for Section 1557 covered entities, such as practices and hospitals; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Covered entities under Section 1557 of the Affordable Care Act: health programs and activities receiving HHS federal financial assistance, HHS-administered programs and ACA Exchanges

Binds Section 1557 covered entities, such as practices and hospitals receiving HHS funds, on decision support tools; it changes no coverage, payment or licensure decision reaching physicians.

Applies to: Any individual, corporation or entity offering therapy or psychotherapy in Illinois, and licensed therapy professionals

Section 20 bars any individual, corporation or entity, practices and hospitals included, from offering AI therapy; 'licensed professional' excludes physicians, so the Act's AI-use limits do not reach them.

Applies to: HIPAA covered entities and the vendors that handle PHI for them

HHS guidance for HIPAA covered entities: a vendor's AI chatbot handling PHI on a patient portal is a business associate, so the practice or hospital needs a business associate agreement first.

Applies to: HIPAA covered entities and business associates

Proposed rule binding HIPAA covered entities and business associates: asset inventory, network map, ePHI encryption and multifactor authentication, with ePHI in AI training data protected.

Applies to: Anyone who makes an AI chatbot publicly available to consumers

Would bind anyone who makes an AI chatbot publicly available to consumers, which reaches a practice's or hospital's patient-facing chatbot.

Applies to: Businesses in Illinois that collect or process personal data of 100,000 or more consumers (excluding payment-only data), or of 25,000 or more while deriving over 25 percent of gross revenue from selling personal data; small businesses are exempt except from a limit on selling sensitive data

Would bind businesses over 100,000 Illinois consumers; PHI-only exemption, so practices and hospitals would be covered for other data, though the thresholds and small-business exemption leave out most practices.

Applies to: Medicare Advantage organizations

Binds Medicare Advantage plans only: medical necessity decisions rest on the enrollee's own circumstances, and a qualified professional reviews adverse decisions before issue.

Applies to: Medicare Advantage organizations and Medicare-Medicaid Plans

Applies to Medicare Advantage organizations and Medicare-Medicaid Plans only: AI alone may not deny an admission, downgrade to observation or end post-acute care, and decisions rest on the patient's own circumstances.

Applies to: Health care plans and other utilization review programs under the Managed Care Reform and Patient Rights Act

Binds health care plans and UR programs only: when algorithms are used in medical necessity review, only a clinical peer may make an adverse determination.

Applies to: Physicians and other practitioners billing the Medicare physician fee schedule

Fee schedule codes G0552 to G0554 let clinicians bill for FDA-cleared digital mental health treatment devices; a payment option, not a duty.

Applies to: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated Exchanges

Binds MA, Medicaid, CHIP and Exchange payers only: prior authorization deadlines, specific denial reasons and a prior authorization API; no AI rule, listed for prior authorization.

Applies to: Medicare Part B-enrolled organizations that join the model, other than suppliers of durable medical equipment, prosthetics, orthotics and supplies and laboratory suppliers; their Original Medicare patients; and clinicians who co-manage those patients

Voluntary CMS model: participating organizations and co-managing clinicians gain new billing options; no duty unless an organization joins.

Applies to: Health care payors: group health plan sponsors, health insurance issuers and Medicaid managed care organizations

Binds payors only: a natural person must make or review each downcode under CPT guidelines, with notice and a 90-day dispute, and automated tools may not bypass the billing professional's documentation.

Applies to: Physicians and other practitioners paid under the Medicare physician fee schedule

Proposed fee schedule pricing for 10 software analysis codes, paid to whoever bills the fee schedule; a payment change, not a duty.

Applies to: Medicare Advantage organizations; CMS and ONC for a report to Congress

Would bind Medicare Advantage plans only: electronic prior authorization and annual reports on requests approved or denied with AI or other decision technology.

Applies to: Health insurance issuers under the Department of Insurance's jurisdiction, including HMOs, dental service plan corporations, limited health service organizations and health services plan corporations

Would bind health insurers only: no denial, reduction or termination of coverage solely on AI output, with clinical peer review of adverse determinations.