Nebraska: AI health laws
4 entries on the map: 3 in force and 1 enacted and not yet in force (main duties begin Jul 1, 2027).
Dates ahead
- Jul 1, 2027LB 525, Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety ActClinical decision and chatbot limits
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Insurance Guidance Document IGD-H1, Use of Artificial Intelligence by Insurers
Sets the Department of Insurance's expectation that insurers using AI systems maintain a written AI systems program covering governance, risk management and internal controls, and standards for third-party AI systems, and lists what the department may request in investigations and examinations.
Physician read. It places no duty on physicians. Since June 11, 2024, insurers in Nebraska, including health insurers, are expected to govern AI systems used in decisions that affect consumers under a written program that the Department of Insurance may examine.
Notes: The NAIC lists IGD-H1 as Nebraska's adoption of the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The document applies to all insurers and does not single out health insurers.
LB 77, Adopt the Ensuring Transparency in Prior Authorization Act and provide for insurance and medicaid coverage of biomarker testing
Bars an AI-based algorithm from being the sole basis of a utilization review agent's decision to deny, delay or modify health care services based in whole or in part on medical necessity, requires the agent to disclose AI use in utilization review to the Department of Insurance, network providers, enrollees and on its public website, and lets the department audit its automated utilization management system.
Physician read. Since Jan. 1, 2026, a utilization review agent cannot deny, delay or modify care on medical necessity grounds on an AI-based algorithm alone, and it must disclose to its network providers, enrollees, the Department of Insurance and the public (on its website) if it uses or will use such algorithms in utilization review. The same act requires that prior authorization denials be made by a physician (or, when the requesting provider is not a physician, a clinical peer) with a current, valid, nonrestricted license and appropriate expertise.
Notes: Passed on final reading May 30, 2025 (46-2-1) and approved by the governor June 4, 2025. Section 17 makes sections 1 to 5 and 7 to 13 of the act, including the AI rule in section 12, operative Jan. 1, 2026; the biomarker testing coverage sections follow later timelines. Section 12 also lets the Department of Insurance audit a utilization review agent's automated utilization management system at any time. The act uses the definition of utilization review agent in Neb. Rev. Stat. 44-5418.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: LB 77, Adopt the Ensuring Transparency in Prior Authorization Act and provide for insurance and medicaid coverage of biomarker testing (under payer and utilization review AI); LB 525, Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
LB 525, Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act
The Conversational Artificial Intelligence Safety Act requires operators of public conversational AI services to disclose that a user is interacting with AI when a reasonable person could be misled (and to minors at the start of a session and every three hours, or by a persistent notice), to adopt a protocol for responding to prompts about suicidal ideation or self-harm, not to represent that the service is designed to provide professional mental or behavioral health care, and to apply added protections for minors.
Physician read. It places no duty on physicians. From July 1, 2027, general chatbots offered to the public in Nebraska must have a protocol for responding to patients' prompts about suicidal ideation or self-harm and may not claim to be designed to provide professional mental or behavioral health care.
Notes: Introduced in 2025 at the governor's request and carried over; passed on final reading April 10, 2026 (49-0-0) and approved by the governor April 14, 2026. Sections 12 to 18 (the chatbot act) become operative July 1, 2027. Minors' protections include limits on sexually explicit content and deceptive claims of being human. Enforced by the attorney general, with civil penalties of at least $1,000 per violation and no more than $500,000 per operator; no private right of action. The Agricultural Data Privacy Act in the same bill is outside the map's scope.
Mental health AI
AI in therapy and mental health care.
Also relevant here: LB 525, Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
LB 1074, Data Privacy Act (Neb. Rev. Stat. 87-1101 to 87-1130)
Gives consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, including decisions on health care services, and requires consent before a controller processes sensitive data, which includes mental or physical health diagnoses.
Physician read. It places no duty on HIPAA covered entities, which the act excludes. Since Jan. 1, 2025, businesses outside HIPAA that process Nebraskans' health diagnosis data, such as health apps, need the consumer's consent, and consumers may opt out of profiling used in decisions on health care services.
Notes: LB 1074 was an omnibus banking and data bill; sections 1 to 30 are the Data Privacy Act. It passed on final reading with an emergency clause April 11, 2024 (47-0-2) and was approved by the governor April 17, 2024. The act's operative-date section could not be checked; the Jan. 1, 2025 operative date rests on the Legislative Fiscal Office's fiscal note of March 26, 2024, which says the Data Privacy Act provisions (LB 1294 as amended by AM 2538, folded into this bill) establish an operational date of Jan. 1, 2025, and on the attorney general's Data Privacy Act page. The exclusion of HIPAA covered entities and business associates in 87-1103 is entity-level. Sensitive data also includes biometric data used to identify a person; section 87-1118 bars a small business, otherwise outside the act, from selling sensitive data without the consumer's prior consent. The definition of decisions with legal or similarly significant effects (87-1102) lists health care services. Enforced by the attorney general.
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.