Massachusetts: AI health laws
4 entries on the map: 1 in force and 3 bills in the legislature.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Bulletin 2024-10, The Use of Artificial Intelligence Systems in Insurance
States that insurers' decisions affecting consumers that are made or supported by AI systems must comply with state insurance and unfair-practice laws, expects each insurer to maintain a written AI systems program covering governance, risk management, internal controls and oversight of third-party AI systems and data, and warns that insurers can expect questions about their AI use in any investigation or market conduct action.
Physician read. It places no duty on physicians. Since Dec. 9, 2024, health insurers licensed in Massachusetts are expected to govern AI systems used in decisions that affect patients, and the Division of Insurance may examine that use.
Notes: Issued by Commissioner of Insurance Michael T. Caljouw; the bulletin carries no signature block. It is addressed to insurers licensed under chapters 175, 152 (sections 25E to 25U), 176, 176A, 176B, 176E, 176F, 176G, 176H and 176P. The NAIC's Aug. 31, 2026 map lists Bulletin 2024-10 as Massachusetts' adoption of the NAIC Model Bulletin; the bulletin follows the model's structure (a written AIS Program) and cites the NAIC's 2020 AI Principles, but its text does not name the model bulletin. The bulletin sets no separate effective date, so the issue date is used. It is the only AI bulletin on the Division's 2024 to 2026 bulletin list.
H.4616, An Act improving the health insurance prior authorization process
Would require carriers to publish prior authorization lists, report approval and denial data and treat complete requests as approved when response deadlines pass, bar an AI-based algorithm or other software tool from being the sole basis for denying, delaying or modifying care, require adverse medical necessity determinations by a licensed physician or competent licensed provider, and require carriers to disclose their AI use to the Division of Insurance, network providers, enrollees and the public.
Physician read. It binds no one yet: the bill has sat in the House Ways and Means Committee since July 29, 2026. If enacted as reported, a carrier could not deny, delay or modify care on medical necessity grounds solely on the basis of an AI algorithm or other software tool, and an adverse medical necessity determination or preauthorization denial would have to be made by a licensed physician or a licensed health care provider competent to evaluate the clinical issues.
Notes: New draft of H.1136, reported favorably by the Joint Committee on Financial Services on Oct. 20, 2025; the Health Care Financing Committee recommended it ought to pass on July 29, 2026, after three reporting-date extensions, and it was referred to House Ways and Means. Section 8 would insert the AI rules as section 12D of chapter 176O: AI tools must base determinations on the enrollee's own clinical history and circumstances rather than group data alone, be open to Division of Insurance audit and be periodically reviewed. As printed, section 14 would make section 8 take effect Jan. 1, 2026, a date already past (with its new section 12C on prior authorization interfaces taking effect Jan. 1, 2027); sections 2 to 7 would also take effect Jan. 1, 2026, sections 9 and 10 on passage and section 11 on April 1, 2027. Under Joint Rule 12A, formal business of the session had to conclude by July 31, 2026, apart from conference reports, appropriation bills and bills returned by the governor, so the bill can pass only in an informal session before the term ends in January 2027.
Also relevant here: S.2632, An Act relative to the use of artificial intelligence and other software tools in healthcare decision-making (under mental health AI).
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: S.2632, An Act relative to the use of artificial intelligence and other software tools in healthcare decision-making (under mental health AI).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Nothing in this category was found in the review of Sept 29, 2026.
Mental health AI
AI in therapy and mental health care.
S.2632, An Act relative to the use of artificial intelligence and other software tools in healthcare decision-making
Would bar offering therapy or psychotherapy to the public, including through AI, unless a licensed professional conducts it, limit licensed professionals' AI use to administrative and supplementary support with written notice and consent before AI is used on recorded or transcribed sessions, and require carriers and utilization review organizations using AI to base determinations on the individual patient's clinical information, with medical necessity determinations made only by a licensed physician or competent licensed health care professional.
Physician read. It binds no one yet: the bill has sat in the Senate Ways and Means Committee since April 2, 2026. Its limits on professionals' AI use would not reach physicians, whom the bill excludes from its definition of licensed professional, but its utilization review section would require medical necessity determinations by a licensed physician or competent licensed health care professional and let insureds sue over violations.
Notes: New draft of S.46 (Sens. Michael O. Moore and James B. Eldridge), reported favorably by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on Oct. 16, 2025 and by the Health Care Financing Committee on April 2, 2026, then referred to Senate Ways and Means. Section 1 would add section 298 to chapter 112 (enforced by the Division of Occupational Licensure, civil penalties up to $10,000 per violation); section 2 would amend chapter 176O, section 12, with a private right of action for insureds (the greater of $5,000 per insured per violation or actual damages, plus other relief). Licensed professionals may not let AI make independent therapeutic decisions, interact with clients in therapeutic communication, generate treatment plans without their review or detect emotions or mental states. Under Joint Rule 12A of the joint rules adopted June 26, 2025, formal business of the second annual session had to conclude by July 31, 2026, and later formal sessions are limited to reports of conference committees formed by that date, appropriation bills and bills returned by the governor, so the bill can pass only in an informal session before the term ends in January 2027. The text sets no effective date.
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
S.2619, An Act establishing the Massachusetts data privacy act (House amendment H.5479)
Would create a comprehensive consumer privacy law that treats health, biometric, genetic, neural and precise geolocation data as sensitive data; the Senate version bans the sale of sensitive data and limits its collection to what is strictly necessary for a product or service the consumer requested, while the House version requires affirmative consent to collect or sell sensitive data and bans the sale of precise geolocation data.
Physician read. It binds no one yet: the Senate and House passed different versions and a conference committee has held the bill since June 2026. Both versions exempt protected health information handled under HIPAA; the House version also exempts HIPAA covered entities and business associates outright, while the Senate version exempts only those that process the data of no more than 60,000 consumers, so a larger HIPAA-covered practice would remain covered for personal data that is not protected health information.
Notes: The Senate passed S.2619 (S.2608 as amended) 40-0 on Sept. 25, 2025. The House substituted H.5472 and passed it 146-0 on June 4, 2026 (text published as H.5479); the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity's earlier House draft was H.4746 (Nov. 17, 2025). The Senate did not concur on June 11, 2026, and conferees were appointed June 11 and June 17, 2026; the bill page showed no later action on Sept. 29, 2026. Joint Rule 12A lets the chambers meet in formal session after July 31 of the second year to take up reports of conference committees formed on or before July 31, so the bill remains alive. Thresholds differ: the Senate text reaches persons that processed the data of 60,000 consumers, or 20,000 with 20 percent of revenue from data sales, or that collected, processed or transferred consumers' reproductive or sexual health data; the House text reaches 100,000 consumers, $100,000 in data-sale revenue, or any processing of sensitive data. The Senate text gives the Attorney General exclusive enforcement authority and states no private right of action; the House text makes a violation an unfair or deceptive practice under chapter 93A and gives the Attorney General exclusive authority to sue controllers and processors other than large data holders (data of more than 2,000,000 consumers or sensitive data of more than 200,000), and states no private right of action. Proposed effective dates differ: Jan. 1, 2027 and June 1, 2027 for the Senate text's two sections; July 1, 2027 for the House text.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.