TwinEthos homeAPI access

Law

Nebraska LB 77 (Ensuring Transparency in Prior Authorization Act)

Nebraska Department of Insurance · Nebraska (US-NE) · 2 provisions encoded · verified against the official source as of 2026-10-03.

Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.

Official text: nebraskalegislature.gov.

Trust and provenance 2 official sources · last verified 3 Oct 2026 · not reviewed by a lawyer · 2 of 2 provisions audit-grade · release 2026.10.03.4

Where this instrument's data comes from, how current it is, and what has and has not been checked. Each provision below has its own panel.

Official sources
Lanes
Binding law — in force 2
Verification
Sources last verified 3 Oct 2026; each provision states how.
Data release
Data release 2026.10.03.4, data as of 3 Oct 2026, schema 0.3.9.
Legal review
None of the 2 provisions has been reviewed by a lawyer; no TwinEthos rule has been legally reviewed yet. Treat each as research to check against the official text; it is not legal advice. Open questions for counsel on them: 2.
Audit standard
2 of 2 provisions audit-grade. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors
2 detectors, all experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify. Each provision lists its detectors' known limits.
Changes
  • 2026.10.03.4 (3 Oct 2026): 2 provisions added

Each data release records which provisions changed; the full list is on Changes.

Binding law — in force

AI may not be the sole basis to deny, delay or modify care; a physician or clinical peer makes adverse determinations (Nebraska LB 77)

Nebraska LB 77, Sec. 12(1) · official text · In force: applies since 1 Jan 2026 · Nebraska (US-NE)

From 2026-01-01, an artificial intelligence-based algorithm shall not be the sole basis of a utilization review agent's decision to deny, delay or modify health care services based in whole or in part on medical necessity (LB 77 sec. 12(1)), and the agent must ensure that all adverse determinations for prior authorization are made by a physician (or, where the requesting provider is not a physician, a clinical peer of that provider) holding a current nonrestricted U.S. licence, with appropriate training, knowledge or expertise, under the clinical direction of a medical director responsible for Nebraska enrollees (sec. 4(1)). Detect automated output that sets a denial, delay or modification without a physician's decision.

Trust and provenance not reviewed by a lawyer · audit-grade · source verified 3 Oct 2026 · release 2026.10.03.4
Lane
Binding law — in force In force: applies since 1 Jan 2026
Official source
Nebraska LB 77, Sec. 12(1) · captured 3 Oct 2026 · anchor hash (SHA-256) 40875d7f8a8a… · 11 more anchors in the data release
Verification
Quoted text found word for word in the captured official document (3 Oct 2026). Source last verified 3 Oct 2026: checked against the captured official document.
Data release
Data release 2026.10.03.4, data as of 3 Oct 2026, schema 0.3.9.
Legal review
Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
Audit standard
Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors

1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

  • Review routing in a separate workflow service or BPM engine
  • Denials applied by a downstream claims system from an exported score
  • The clinical review may live in another module (a workflow engine or a separate review service); confirm the adverse status cannot be reached without it before reporting. Clinician tokens anywhere in the file suppress t…

Who it applies to

  • Duty falls on: insurer, organization
  • Sectors: insurance, healthcare
  • Utilization review agents (any person, company, health carrier or other entity performing utilization review, with the 44-5418(31) exclusions) making prior-authorization and other medical-necessity decisions for Nebraska enrollees. Operative 2026-01-01 (LB 77 sec. 17).
  • Not covered:
    • Not utilization review agents (Neb. Rev. Stat. 44-5418(31)): federal agencies and agents acting for the federal government or the State (to that extent), agencies of the State, internal quality assurance programs not used to allow or deny claims, licensed pharmacists and pharmacies in the practice of pharmacy, workers' compensation utilization review, individuals employed by a certified agent, and ERISA-exempt employee benefit plans
  • Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Route every adverse outcome an AI or algorithm proposes in utilization review to a qualified clinical reviewer, and issue a denial only from that reviewer's recorded decision.

At the point where a model, rules engine or scoring tool returns its result for a prior-authorization, concurrent or retrospective review, the code may auto-approve (where the law allows) or route the case, but any result that would deny, delay, modify or downgrade the request is written as a pending clinical review (status 'pending_clinical_review', a review_queue entry with the tool's output attached as a recommendation), never as the determination. Only a review action by an authenticated reviewer whose role is physician, clinical peer or qualified reviewer, in the same or a similar specialty where the law requires, can set an adverse status; that action records reviewer_id, licence and specialty, the clinical documents opened, the decision and its clinical rationale, and the timestamp, and the adverse-determination notice is generated from it (with the reviewer's signature or attestation where the law requires). Where a law forbids the automated system from making an adverse determination even in part (Texas), the tool's output may only approve, route or support administrative and fraud-detection work; it is not shown to the reviewer as a proposed denial.

Where it goes: 1 application source code, 2 data models, 9 AI output handling, 14 user-facing text.

What this provision adds:

  • The physician or clinical peer holds a current nonrestricted U.S. licence, has the training or expertise to apply the clinical guidelines, and decides under the clinical direction of a medical director responsible for Nebraska enrollees.

Example (Python + OpenAI SDK (prior-authorization service)), before:

result = client.chat.completions.create(model=MODEL, messages=build_pa_prompt(request)).choices[0].message.content
if json.loads(result)['decision'] == 'deny':
    prior_auth.update(request.id, status='denied')
    send_denial_letter(request)

After:

result = json.loads(client.chat.completions.create(
    model=MODEL, messages=build_pa_prompt(request, record=member_clinical_record(request))).choices[0].message.content)
if result['decision'] == 'approve' and AUTO_APPROVE_ALLOWED:
    prior_auth.update(request.id, status='approved', ai_assisted=True)
else:                                   # any non-approval goes to a clinician
    review_queue.enqueue(request.id, queue='pending_clinical_review',
                         specialty=request.specialty, ai_recommendation=result)

@app.post('/reviews/{case_id}/decision')
def record_clinical_decision(case_id: str, body: Decision, reviewer=Depends(licensed_clinical_reviewer)):
    decision = clinical_decisions.create(case_id=case_id, reviewer_id=reviewer.id, licence=reviewer.licence,
                                         specialty=reviewer.specialty, documents_reviewed=body.documents,
                                         outcome=body.outcome, rationale=body.rationale)
    if body.outcome in ('denied', 'downgraded'):
        send_adverse_determination(case_id, decision=decision, signed_by=reviewer)

Control: AI or algorithm denies, delays or downgrades care in utilization review without a licensed clinical reviewer deciding. The same guard addresses 9 items with binding law in 8 jurisdictions. Engineering guidance, not legal advice.

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

Rule id ne-lb77.ai-not-sole-basis-physician-decides · review status: primary source derived

Binding law — in force

Disclose AI use in utilization review to the Department, network providers, enrollees and the public website (Nebraska LB 77)

Nebraska LB 77, Sec. 12(2) · official text · In force: applies since 1 Jan 2026 · Nebraska (US-NE)

From 2026-01-01, a utilization review agent must disclose to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website if artificial intelligence-based algorithms are used or will be used in the utilization review process (LB 77 sec. 12(2)); the Department may audit its automated utilization management system at any time (sec. 12(3)). Detect the absence of the four disclosures.

Trust and provenance not reviewed by a lawyer · audit-grade · source verified 3 Oct 2026 · release 2026.10.03.4
Lane
Binding law — in force In force: applies since 1 Jan 2026
Official source
Nebraska LB 77, Sec. 12(2) · captured 3 Oct 2026 · anchor hash (SHA-256) 8fd2d09bae6b… · 7 more anchors in the data release
Verification
Quoted text found word for word in the captured official document (3 Oct 2026). Source last verified 3 Oct 2026: checked against the captured official document.
Data release
Data release 2026.10.03.4, data as of 3 Oct 2026, schema 0.3.9.
Legal review
Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
Audit standard
Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
Detectors

1 detector (missing artifact), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.

Known limits:

  • Notices sent from a correspondence or provider-portal system outside the repository

Who it applies to

  • Duty falls on: insurer, organization
  • Sectors: insurance, healthcare
  • Utilization review agents (any person, company, health carrier or other entity performing utilization review, with the 44-5418(31) exclusions) making prior-authorization and other medical-necessity decisions for Nebraska enrollees. Operative 2026-01-01 (LB 77 sec. 17).
  • Not covered:
    • Not utilization review agents (Neb. Rev. Stat. 44-5418(31)): federal agencies and agents acting for the federal government or the State (to that extent), agencies of the State, internal quality assurance programs not used to allow or deny claims, licensed pharmacists and pharmacies in the practice of pharmacy, workers' compensation utilization review, individuals employed by a certified agent, and ERISA-exempt employee benefit plans
  • Whether it applies depends on facts outside the code; a person has to decide.

The guard to add

Notify consumers when AI makes or supports their underwriting, rating, or claims decision, and list that model in the insurer's written AIS Program.

In the code path that calls a model for underwriting, rating, premium quoting, or claims decisions, send or render a consumer notice that AI systems are used (in the quote flow, claim acknowledgement, or decision letter) and record that it was delivered. The model is an entry in the insurer's written AIS Program, covering governance, risk-management controls, internal audit, lifecycle management, third-party systems, and an accountable leader, with an owner; keep the inventory entry or a pointer to it in the repository so each decision path is traceable to its program record.

Where it goes: 9 AI output handling, 14 user-facing text, 12 repository artifacts.

What this provision adds:

  • Disclose through four channels: a filing with the Department of Insurance, a notice to each in-network health care provider, a notice to each enrollee, and the public website.

Example (Python + OpenAI SDK), before:

resp = client.chat.completions.create(model=MODEL, messages=claim_msgs)
claim_decision = parse_decision(resp.choices[0].message.content)
claims.update(claim_id, status=claim_decision)

After:

AI_USE_NOTICE = ('An AI system helped evaluate your claim. '
                 'You can ask us how it was used and request review by a claims adjuster.')
resp = client.chat.completions.create(model=MODEL, messages=claim_msgs)
claim_decision = parse_decision(resp.choices[0].message.content)
claims.update(claim_id, status=claim_decision, ais_program_ref='AIS-012')
send_ai_notice(claimant, text=AI_USE_NOTICE)

Control: Insurer AI decision system without a written AIS Program / consumer notice. The same guard addresses 5 items with binding law in 4 jurisdictions. Engineering guidance, not legal advice.

Standards that recommend the same control

Rule id ne-lb77.ai-use-disclosure · review status: primary source derived

Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.