Iowa: AI health laws
4 entries on the map: 3 in force and 1 enacted and not yet in force (main duties begin Jul 1, 2027).
Dates ahead
- Jul 1, 2027SF 2417, Conversational Artificial Intelligence Services: Limitations, Required Disclosures, and Civil Penalties (2026 Iowa Acts, Chapter 1068)Clinical decision and chatbot limits
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Iowa Insurance Division Bulletin 24-04, The Use of Artificial Intelligence Systems in Insurance
Sets the Insurance Division's expectation that insurers using AI systems maintain a written AI systems program covering governance, risk management and internal controls, and oversight of third-party AI systems and data, aimed at avoiding adverse consumer outcomes, and lists what the Division may request in investigations and examinations.
Physician read. It places no duty on physicians. Since Nov. 7, 2024, insurers writing in Iowa, including health insurers, are expected to govern AI used in decisions that affect consumers under a written program that the Insurance Division may examine.
Notes: The NAIC lists Bulletin 24-04 as Iowa's adoption of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The bulletin is addressed to all insurance companies writing in Iowa and does not single out health insurers.
HF 2635, Health Carrier Standards of Conduct: Utilization Review Organizations, Use of Artificial Intelligence, and Audits; Prior Authorizations and Certificates of Need (2026 Iowa Acts, Chapter 1087)
Adds Iowa Code 514F.8(2A), which lets a utilization review organization use an AI-based algorithm or system for the initial review of a prior authorization request but bars it from using such a system as the sole basis for a decision to deny, delay or downgrade a request for a service based on medical necessity.
Physician read. Since July 1, 2026, a utilization review organization may use AI to screen a prior authorization request, but for a service requested on medical necessity grounds AI cannot be the sole basis for denying it, delaying it or downgrading it (moving an urgent request to standard review or substituting a lower-level service). The act's other prior authorization changes apply from Jan. 1, 2027, and electronic submission duties from July 1, 2027.
Notes: Section 2 of the act, which adds the AI rule, carries no separate applicability date, so it took effect July 1, 2026 under Iowa Code 3.7(1), which makes an act passed at a regular session effective the first day of July following its passage unless it provides another time; the bill history also lists July 1, 2026 as the effective date. Other sections apply later: new 514F.8A (prior authorization peer review), 514F.8B (exemptions), 514F.8C (audits) and 514F.8D (standards of conduct) from Jan. 1, 2027, and electronic submission of prior authorization requests from July 1, 2027. The act adds a definition of 'downgrade' to 514F.8 but does not define artificial intelligence. Iowa Code 514F.8 defines a health carrier to exclude the Department of Health and Human Services and managed care organizations administering Medicaid and Hawki; the act's Medicaid and Hawki sections address prior authorization exemptions and electronic submission, not AI.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: SF 2417, Conversational Artificial Intelligence Services: Limitations, Required Disclosures, and Civil Penalties (2026 Iowa Acts, Chapter 1068) (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
SF 2417, Conversational Artificial Intelligence Services: Limitations, Required Disclosures, and Civil Penalties (2026 Iowa Acts, Chapter 1068)
Requires operators of public conversational AI services to disclose that a user is talking to AI when a reasonable person would believe they are talking to a human (and, for users the operator knows or is reasonably certain are minors, at the start of each interaction and at least every three hours, or by a persistent disclaimer), to adopt protocols for prompts about suicidal ideation or self-harm that include reasonable efforts to refer users to crisis service providers, not to knowingly and intentionally program the service to make statements that would lead a reasonable person to believe it is designed to provide professional psychology or behavioral health services that require an Iowa license, and to apply added protections for minors.
Physician read. It places no duty on physicians. From July 1, 2027, general chatbots offered to the public in Iowa must have crisis-referral protocols for users who raise suicidal ideation or self-harm and may not be programmed to present themselves as designed to provide licensed psychology or behavioral health services.
Notes: Codified as new Iowa Code chapter 554J. Section 7 provides that the act applies July 1, 2027; the bill history lists July 1, 2026 as the effective date. The professional-services ban covers representations that would lead a reasonable person to believe the service provides services requiring licensure under Iowa Code chapter 154B (psychology) or 154D (mental health professions). Minors' protections include limits on engagement-maximizing rewards, sexual content and claims of sentience, and privacy and parental tools. Enforced by the attorney general: an operator is subject to an injunction and liable for the greater of actual damages or a civil penalty of $1,000 per violation, up to $500,000 per operator; no private right of action.
Mental health AI
AI in therapy and mental health care.
Also relevant here: SF 2417, Conversational Artificial Intelligence Services: Limitations, Required Disclosures, and Civil Penalties (2026 Iowa Acts, Chapter 1068) (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
SF 262, Consumer Data Protection (2023 Iowa Acts, Chapter 17; Iowa Code chapter 715D)
Gives consumers rights to access, delete and obtain a copy of their personal data and to opt out of its sale, and requires controllers to give clear notice and an opportunity to opt out before processing sensitive data, which includes mental or physical health diagnoses and biometric data processed to identify a person.
Physician read. It places no duty on a physician practice that is subject to and complies with HIPAA's rules, which the act exempts along with protected health information. Since Jan. 1, 2025, covered businesses outside HIPAA, such as health apps, must give Iowans notice and a chance to opt out before processing health diagnosis data.
Notes: The act exempts persons who are subject to and comply with the HIPAA privacy, security and breach rules, as well as protected health information. It has no right to correct data and no right to opt out of profiling, and it requires notice and an opportunity to opt out, not opt-in consent, for sensitive data (except children's data under COPPA). The attorney general has exclusive enforcement authority, must first give 90 days' written notice identifying the alleged violations, and may seek civil penalties of up to $7,500 per violation.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.