Binding law — not yet in force or stayed
From 2027-01-01, a carrier, pharmacy benefit manager, private utilization review organization, behavioral health administrative services organization or managed care entity that uses an artificial intelligence system for utilization review must provide written disclosures to the Division, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable, that identify the utilization-review functions for which the system will be used, the points in the process when it is used, the human oversight process (including the qualifications of the reviewer and whether a human must approve an adverse determination) and the process for maintaining audit information sufficient to demonstrate compliance with subsection (3) (C.R.S. 10-16-112.7(4)); the system's or algorithm's criteria and guidelines must comply with other applicable state or federal law on utilization review and coverage ((3)(h)). Detect the absence of the written disclosure record.
co-hb26-1139.ai-use-disclosure-to-regulator · C.R.S. 10-16-112.7(4) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — not yet in force or stayed
From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that the system produces and retains documentation, audit logs and model-governance records in order to demonstrate compliance with 10-16-112.7 and 10-3-1104.9 (C.R.S. 10-16-112.7(3)(e)), and must disclose to the regulator its process for maintaining audit information sufficient to demonstrate compliance with subsection (3) ((4)(d)). Detect AI determinations stored without an audit record, and the absence of model-governance records.
co-hb26-1139.audit-logs-and-model-governance-records · C.R.S. 10-16-112.7(3)(e) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — not yet in force or stayed
From 2027-01-01, a carrier's denial of coverage based in whole or in part on medical necessity shall not be issued solely on the output of an artificial intelligence system without human review and approval of the denial by a licensed clinician, licensed physician or other regulated professional competent to evaluate the specific clinical issues involved in the services the provider requested, and a review of the health benefit plan's terms of coverage for the service (C.R.S. 10-16-112.7(5)(b)). An AI system may still be used to assist with utilization review, including expedited approvals ((5)(a)). Detect model or scoring output that sets a denial without a clinical reviewer's decision.
co-hb26-1139.clinician-approves-medical-necessity-denial · C.R.S. 10-16-112.7(5)(b) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — not yet in force or stayed
From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that the system is not used in any way that discriminates against individuals in violation of other state or federal laws (C.R.S. 10-16-112.7(3)(c)), that it is fairly and equitably applied, including in accordance with applicable regulations and guidance of the federal Department of Health and Human Services ((3)(d)), and that its performance, use and outcomes are periodically reviewed to maximize accuracy and reliability ((3)(f)). Detect the absence of a periodic accuracy, outcome and disparity review.
co-hb26-1139.fair-application-and-periodic-review · C.R.S. 10-16-112.7(3)(c) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — not yet in force or stayed
From 2027-01-01, a carrier, pharmacy benefit manager, private utilization review organization, behavioral health administrative services organization or managed care entity that uses an artificial intelligence system to conduct utilization review must ensure that the system bases its determination, as applicable, on the individual's medical or other clinical history, the individual clinical circumstances as presented by the requesting provider, and other relevant clinical information in the individual's medical or other clinical record (C.R.S. 10-16-112.7(3)(a)), and does not base its determinations solely on group data, without reference to the individual's data ((3)(b)). Detect utilization-review model calls built without the member's clinical record or the provider's submission.
co-hb26-1139.individual-clinical-data-basis · C.R.S. 10-16-112.7(3)(a) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
Binding law — not yet in force or stayed
From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that an individual's health data is not used beyond its intended or stated purpose, consistent with applicable state and federal laws (C.R.S. 10-16-112.7(3)(g)). Detect utilization-review patient data exported to model training or fine-tuning, marketing lists or product analytics.
co-hb26-1139.patient-data-purpose-limit · C.R.S. 10-16-112.7(3)(g) · official source · applies from 2027-01-01 · jurisdictions: US-CO
The guard to add, and how far to trust this rule
