Virginia: AI health laws
9 entries on the map: 6 in force and 3 bills in the legislature.
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Administrative Letter 2024-01, The Use of Artificial Intelligence Systems
Tells insurers that decisions and actions affecting consumers that are made or supported by AI systems must comply with insurance law, including the laws on unfair trade practices, unfair claim settlement practices and unfair discrimination, and sets expectations for a written AI systems program covering governance, risk management, internal controls and third-party AI systems, which the Bureau of Insurance may review in investigations and market conduct examinations.
Physician read. It places no duty on physicians. Since July 22, 2024, the Bureau of Insurance has told insurers, including health insurers, that claim and coverage decisions made or supported by AI must comply with the unfair claim settlement practice and unfair discrimination laws.
Notes: Virginia's version of the NAIC Model Bulletin: it follows the model's four sections (introduction and authority, definitions, regulatory guidance and expectations, regulatory oversight and examination), and the NAIC's adoption map lists it as adopted July 22, 2024. Signed by Commissioner of Insurance Scott A. White. The letter states no separate effective date; the issue date is used.
SB 586, Health carriers; use of artificial intelligence, disclosures
As passed by the Senate, would require each health carrier to disclose to the Bureau of Insurance its use of AI to manage claims and coverage, including underlying algorithms, data used and resulting determinations, submit information, documents and software on request, keep documentation of AI decisions for at least three years, and notify enrollees and health care providers when AI has been used to issue an adverse determination, with a clear and timely process to appeal it.
Physician read. It binds no one yet. If enacted as passed by the Senate, a carrier would have to tell the physician as well as the patient when AI was used to issue an adverse determination and offer a clear and timely appeal process.
Notes: The Senate Commerce and Labor Committee reported a substitute 9-6 on Feb. 2, 2026. On Feb. 6, 2026, the Senate passed the bill 22-18, agreed to reconsider, and passed it again 23-16 (LegiScan history). On Feb. 23, 2026, the House Communications, Technology and Innovation Committee continued it to the 2027 session by voice vote, so it carries over; LegiScan codes it as dead at the end of the 2026 session. The Senate substitute adds a subdivision to Va. Code § 38.2-3407.15 (carrier business practices) and has no separate effective date clause. The introduced bill would have barred carriers from relying exclusively on AI or automated decision tools to deny, reduce or alter coverage or claims for medically necessary care, required review of adverse determinations by physicians or other licensed health care professionals in the appropriate specialties, allowed expedited external review and set civil penalties of up to $50,000 per violation; the Senate substitute dropped those provisions, and the Cardinal News summary matches the introduced version. LegiScan is the source for status and text.
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
Also relevant here: SB 269, Mental health service providers; definitions, use of artificial intelligence system, civil penalty (under mental health AI); SB 586, Health carriers; use of artificial intelligence, disclosures (under payer and utilization review AI); SB 796, Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
HB 2154, Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant
Requires the Board of Health's regulations to make each hospital, nursing home and certified nursing facility establish and implement policies to ensure the permissible access to and use of an intelligent personal assistant, a device and software application that uses natural language processing and artificial intelligence, provided by a patient receiving inpatient services, and requires those policies to protect health information under HIPAA.
Physician read. It places no direct duty on physicians. Hospitals, nursing homes and certified nursing facilities must have policies that ensure inpatients' permissible access to and use of their own intelligent personal assistants, such as digital or virtual assistants, and that protect health information under HIPAA; the duty took effect in the statute July 1, 2021, in the nursing facility rule Nov. 11, 2021, and in the hospital rule May 22, 2025.
Notes: Enacted in the 2021 Special Session I as Chapter 219, approved March 18, 2021, effective July 1, 2021; the statute (Va. Code § 32.1-127 B 29) itself requires the policies to protect health information under HIPAA. The nursing facility rule, 12VAC5-371-140 G, took effect Nov. 11, 2021 (exempt final action, Virginia Register Vol. 38, Iss. 4, Oct. 11, 2021). The hospital rule was added to 12VAC5-410-230 by a State Board of Health fast-track action published in Vol. 41, Iss. 17 (April 7, 2025) with an effective date of May 22, 2025; the Administrative Code histories of 12VAC5-410-10 and 12VAC5-410-280, amended by the same action, list it with that date, and a second fast-track action (Vol. 42, Iss. 18, April 20, 2026, effective June 4, 2026) printed the provision as existing text re-lettered from K to J. The Administrative Code history of 12VAC5-410-230 itself lists only the 2026 action. A notice of intended regulatory action (Vol. 41, Iss. 20, May 19, 2025) proposes replacing 12VAC5-410 with new chapters 12VAC5-413 and 12VAC5-415.
SB 796, Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty
As passed by the Senate, would require every chatbot operator serving Virginia users to show users of all ages a static, persistent disclosure that the chatbot is not human, with pop-up notices at login, every 30 minutes of sustained use, when the user asks and when the chatbot is asked for medical, financial, legal or other licensed advice, and would require operators with 500,000 or more monthly active users to identify and reduce users' emotional dependence, keep chatbots from falsely claiming to be human, give a crisis message when a user expresses suicidal thoughts, intent to self-harm or signs of an acute mental health crisis, make reasonable efforts within 24 hours to notify emergency services or law enforcement of an imminent risk of death or serious physical injury, and report covered incidents to the Attorney General within 15 days.
Physician read. It binds no one yet. As passed by the Senate, any person or entity offering a chatbot to users in Virginia, which could include a medical practice, would have to disclose that the chatbot is not human, including by pop-up when a user asks it for medical advice; only operators with 500,000 or more monthly active users would carry the crisis-response and incident-reporting duties, and clinician-supervised clinical tools not offered to the general public would be excluded from them.
Notes: The Senate General Laws and Technology Committee reported a substitute 14-0 on Feb. 11, 2026. The Senate engrossed a floor substitute on Feb. 16, reconsidered the engrossment on Feb. 17, agreed to a floor amendment and passed the bill 39-1 the same day; LegiScan labels the text as the engrossed version. On March 2, 2026, a House committee substitute was offered and the House Communications, Technology and Innovation Committee continued the bill to the 2027 session, so it carries over. The Senate text would add a chapter headed Artificial Intelligence Chatbots and Minors Act (§§ 59.1-614 through 59.1-618), with Attorney General civil penalties of up to $50,000 per violation and a civil action for any person harmed or the parent or guardian of a harmed minor; a covered harm means death, a suicide attempt, self-harm requiring medical attention, a psychiatric emergency resulting in urgent medical treatment, or a serious physical injury requiring medical attention. LegiScan codes the bill as dead at the end of the 2026 session; LegiScan is the source for status and text.
Also relevant here: SB 269, Mental health service providers; definitions, use of artificial intelligence system, civil penalty (under mental health AI).
Mental health AI
AI in therapy and mental health care.
SB 269, Mental health service providers; definitions, use of artificial intelligence system, civil penalty
As passed by the Senate, would let a mental health service provider use an AI system to assist in providing therapy or counseling services only while keeping full responsibility for all interactions, outputs and data use; bar AI from making independent therapeutic decisions, engaging in therapeutic communication with clients without provider oversight, or generating recommendations, making diagnoses or implementing treatment plans without the licensed professional's review, oversight and approval; require, when a session is recorded or transcribed, disclosure at the initial appointment of the AI's use and specific purpose and the patient's written or digital consent; and bar any person or business entity from offering therapy or counseling services to the public, including through AI, unless a mental health service provider conducts them, with civil penalties up to $10,000.
Physician read. It binds no one yet. If enacted as passed by the Senate, a physician or other mental health service provider (the Va. Code § 54.1-2400.1 definition lists physicians) using AI in therapy or counseling would need the patient's written or digital consent, after disclosure of the AI's use and purpose, for a recorded or transcribed session, and AI could not diagnose or implement a treatment plan without the provider's review, oversight and approval.
Notes: Would add Va. Code § 54.1-2400.1:1. The Senate General Laws and Technology Committee reported a substitute 15-0 on Jan. 28, 2026, and the Senate passed it 39-0 on Feb. 3, 2026. On March 2, 2026, the House Communications, Technology and Innovation Committee continued it to the 2027 session, so it carries over. The bill defines mental health service provider by reference to Va. Code § 54.1-2400.1, whose list includes physicians, physician assistants, nurses, psychologists, professional counselors, marriage and family therapists, social workers and peer recovery specialists, so its limits would apply to a physician who uses AI in providing therapy or counseling services. Religious counseling, peer support and self-help or educational materials are exempt; records and communications would be confidential under Va. Code § 32.1-127.1:03. The companion House bill, HB 668, was left in committee. LegiScan codes SB 269 as dead at the end of the 2026 session; LegiScan is the source for status and text.
Also relevant here: SB 796, Artificial Intelligence Companion Chatbots and Minors Act; established, enforcement, civil penalty (under clinical decision and chatbot limits).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
HB 2307 and SB 1392, Consumer Data Protection Act
Gives consumers rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects, requires consent to process sensitive data, including a mental or physical health diagnosis, genetic or biometric data and precise geolocation, and requires data protection assessments for sensitive data and for profiling that poses foreseeable risks.
Physician read. It places no duty on a practice that is a HIPAA covered entity, and protected health information is exempt. Since Jan. 1, 2023, health apps and other businesses above the thresholds need a Virginia consumer's consent to process data revealing a mental or physical health diagnosis.
Notes: Enacted in the 2021 Special Session I as Chapters 35 (HB 2307) and 36 (SB 1392), both approved March 2, 2021. Amendments that add minors' and precise-geolocation provisions have their own entries (HB 707 and SB 361 of 2024, SB 854 of 2025, SB 338 of 2026); the 2022 amendments (Chapters 423, 451 and 452) did not add health, biometric, minors' or profiling provisions.
HB 707 and SB 361, Consumer Data Protection Act; protections for children
Bars covered controllers, without a parent's consent obtained under the federal Children's Online Privacy Protection Act, from processing a known child's personal data for targeted advertising, sale or profiling in furtherance of decisions with legal or similarly significant effects, and from collecting a child's precise geolocation data unless reasonably necessary for the online service and signaled to the child throughout collection, and adds children's data to data protection assessments for online services directed to children.
Physician read. It places no duty on a practice that is a HIPAA covered entity. Since Jan. 1, 2025, apps and online services covered by the act need a parent's COPPA consent before using a known child's data for targeted advertising, sale or profiling.
Notes: Chapters 840 (HB 707) and 844 (SB 361) of the 2024 Acts of Assembly, approved May 17, 2024, after the General Assembly rejected the Governor's recommendations on April 17, 2024. The act defines a child as a person younger than 13. The provisions are in Va. Code § 59.1-578 F and § 59.1-580.
SB 754, Consumer Protection Act; prohibited practices, etc., reproductive or sexual health information
Makes it a prohibited practice under the Virginia Consumer Protection Act to obtain, disclose, sell or disseminate personally identifiable reproductive or sexual health information without the consumer's consent, defining that information to include data derived or extrapolated from non-health information, including inferred or algorithmic data.
Physician read. Since July 1, 2025, a supplier that, in connection with a consumer transaction, obtains, discloses, sells or disseminates a consumer's personally identifiable reproductive or sexual health information without consent commits a prohibited practice under the Consumer Protection Act. That act has no HIPAA exemption, but it excludes aspects of a transaction authorized under state or federal law.
Notes: Chapter 591 of the 2025 Acts of Assembly. The lead listed it as a 2024 law; the bill was prefiled Dec. 5, 2024, for the 2025 session and approved March 24, 2025. LegiScan's history gives July 1, 2025 as the effective date, the regular date for laws enacted at a regular session (Va. Const. art. IV, § 13). It amends the Consumer Protection Act (Va. Code §§ 59.1-198 and 59.1-200), not the Consumer Data Protection Act, so the Consumer Data Protection Act's HIPAA exemptions do not apply to it; the Consumer Protection Act's definition of supplier includes a professional who engages in consumer transactions, and its general exclusion for aspects of a transaction authorized under state or federal law (§ 59.1-199) applies.
SB 338, Consumer Data Protection Act; data controller responsibilities, precise geolocation data
Bars covered controllers from selling or offering for sale precise geolocation data concerning a consumer, meaning location data accurate to within a radius of 1,750 feet.
Physician read. It places no duty on a practice that is a HIPAA covered entity. Since July 1, 2026, apps and other businesses covered by the act cannot sell a Virginia consumer's precise geolocation data.
Notes: Chapter 820 of the 2026 Acts of Assembly, approved April 13, 2026. The chaptered text has no effective date clause, so the July 1 date for laws enacted at a regular session applies (Va. Const. art. IV, § 13), as LegiScan's history also shows. The 1,750-foot radius comes from the act's existing definition of precise geolocation data (Va. Code § 59.1-575). Before this amendment, precise geolocation data was already sensitive data that required consent to process.
Also relevant here: HB 2154, Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant (under clinical decision and chatbot limits).
Federal law also applies in every state: see federal law and policy.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.