Illinois: AI health laws
6 entries on the map: 5 in force and 1 enacted and not yet in force (main duties begin Jan 1, 2028).
Dates ahead
- Jan 1, 2028SB 3114, Transparency in Downcoding Act (Public Act 104-0568)Payer and utilization review AI
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Company Bulletin 2024-08, The Use of Artificial Intelligence Systems in Insurance
Expects insurers to develop, implement and maintain a written program for the responsible use of AI systems, covering governance, risk management and internal controls and the oversight of third-party AI vendors, to prevent adverse consumer outcomes, and lists the documentation the Department of Insurance may request; the NAIC lists it as Illinois' adoption of its model bulletin.
Physician read. It places no duty on physicians. Since March 2024, health insurers in Illinois are expected to govern the AI systems they use in decisions that affect consumers and to show the Department of Insurance their governance, testing and vendor controls on request.
Notes: Signed by Director Dana Popish Severinghaus. The bulletin states no separate effective date; the issue date is used. It applies to all lines and does not single out health insurers or utilization review; it cites the Illinois Insurance Code's unfair methods of competition and improper claims practices provisions, among others.
HB 2472, Ins-Adverse Determination (Public Act 103-0656)
Requires a health care plan or other utilization review program that uses an algorithmic automated process in utilization review for medical necessity to ensure that only a clinical peer makes any adverse determination based on medical necessity, and requires programs that use algorithmic automated processes to decide on adverse determinations to use objective, evidence-based criteria that meet URAC or NCQA accreditation requirements.
Physician read. Since Jan. 1, 2025, a health care plan or utilization review program that uses an algorithm in medical necessity review must have a clinical peer, a health care professional in the same profession and the same or similar specialty as the provider who typically manages the condition, make any adverse determination based on medical necessity. It places no duty on physicians.
Notes: Status, dates and text come from LegiScan's bill page and its copy of the chaptered act. The act amends, among others, the Managed Care Reform and Patient Rights Act (Sections 10, 45 and 85), the Health Carrier External Review Act and the Prior Authorization Reform Act. The chaptered text has no effective-date section; under 5 ILCS 75/1 a bill passed before June 1 that sets no effective date takes effect Jan. 1 of the following year, and this bill passed both houses in May 2024, so it took effect Jan. 1, 2025, the date LegiScan also gives.
SB 3114, Transparency in Downcoding Act (Public Act 104-0568)
Bars a health care payor from using any policy, algorithm or other automated process, system or tool that bypasses evaluation of the billing professional's information to downcode a claim, requires every downcoding determination to be made or reviewed by a natural person following AMA CPT coding guidelines, and requires notice of the specific reason, the original and revised codes and payment amounts, and a dispute process that allows at least 90 days.
Physician read. From Jan. 1, 2028, a payor that downcodes a claim from a physician, physician assistant or advanced practice registered nurse must have a natural person make or review the decision under CPT guidelines, state the specific reason with the clinical information and coding guidance used, list the original and revised codes and payments, and allow at least 90 days to dispute. Automated tools may flag claims for possible downcoding but may not bypass the billing professional's documentation, and payors may not target professionals who routinely treat patients with complex or chronic conditions.
Notes: Status, dates and text come from LegiScan. The enrolled text does not use the term artificial intelligence; it reaches any algorithm or other automated process, system or tool. Section 10(a) applies the act to policies and contracts for health insurance coverage and to State, employee, county, municipality and school district group health plans issued, amended, delivered or renewed on or after the act's Jan. 1, 2028 effective date. It adds Section 5-5.12g to the Illinois Public Aid Code to bind Medicaid managed care organizations. Disputes go to a qualified person who did not make the original downcode. A tracker lead that listed this law as HB 3568 is wrong: HB 3568 (2025) is an unrelated single-payer bill.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054) (under mental health AI).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Also relevant here: HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054) (under mental health AI).
Mental health AI
AI in therapy and mental health care.
HB 1806, Wellness and Oversight for Psychological Resources Act (Public Act 104-0054)
Bars anyone from providing, advertising or offering therapy or psychotherapy to the public in Illinois, including through internet-based AI, unless a licensed professional conducts it; limits licensed professionals' use of AI to administrative and supplementary support and bars them from letting AI make independent therapeutic decisions, interact therapeutically with clients, generate treatment plans without their review and approval, or detect emotions or mental states; and requires written notice and consent before AI is used on a recorded or transcribed session.
Physician read. Since Aug. 1, 2025, no person or company may offer AI therapy to the public in Illinois, and psychologists, counselors, social workers, marriage and family therapists, psychiatric advanced practice nurses and other licensed therapists may use AI only for administrative and supplementary tasks, with written notice and consent before AI is used on a recorded or transcribed session. The Act's definition of licensed professional excludes physicians; the Department of Financial and Professional Regulation enforces it with civil penalties of up to $10,000 per violation.
Notes: Status, dates and text come from LegiScan; the department's release of Monday, Aug. 4, 2025 says the governor signed the bill the previous Friday. The Act does not apply to religious counseling, peer support, or self-help and educational materials that do not purport to offer therapy. HB 5003 (2026), which would have exempted AI-assisted therapy in qualified research programs, did not leave committee. SB 316 (2025-26), which passed the Senate May 21, 2026 and is pending in the House (separate entry), would add to those exceptions a chatbot that complies with the Artificial Intelligence Companion Model Safety Act and does not provide therapy or psychotherapy services.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
Biometric Information Privacy Act, 740 ILCS 14 (Public Act 95-994)
Requires a private entity to keep a public written policy with a retention schedule and destruction guidelines, to give written notice of the purpose and length of collection and obtain a written release before collecting a biometric identifier or biometric information, and bars selling or profiting from it, with a private right of action for $1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages if greater.
Physician read. The Act excludes information captured from a patient in a health care setting and information collected, used or stored for treatment, payment or operations under HIPAA. Outside those exclusions, a practice that collects fingerprints, face geometry or other biometric identifiers, for example from employees, must give written notice, obtain a written release and follow a public retention and destruction schedule.
Notes: The statute text and its source notes were read on Justia's copy of the 2025 Illinois Compiled Statutes, which cites P.A. 95-994, effective Oct. 3, 2008, for the original sections and P.A. 103-769, effective Aug. 2, 2024, for Sections 10 and 20. The governor's approval date for P.A. 95-994 was not confirmed. The 2024 amendment (SB 2979) is a separate entry.
SB 2979, BIPA-Procedure-Damages (Public Act 103-0769)
Amends the Biometric Information Privacy Act so that a private entity that collects the same person's biometric identifier or information more than once by the same method, or discloses it more than once to the same recipient by the same method, commits a single violation with at most one recovery, and allows the required written release to be given by electronic signature.
Physician read. Since Aug. 2, 2024, a practice or other private entity that repeatedly collects the same person's biometric identifier by the same method without meeting the Act's requirements has committed one violation, with at most one recovery for that person, and the written release the Act requires may be signed electronically.
Notes: Status and dates come from LegiScan, which records the act as effective Aug. 2, 2024, the day the governor approved it. The amended Sections 10 and 20 were read in LegiScan's copy of the chaptered act and on Justia's copy of the statute.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.