AI Regulation Tracker  /  Regulation signed

Iowa HF 2635 bars AI as sole basis for prior-auth denials, requires same-specialty human review

Iowa has enacted rules that stop insurers from letting an algorithm alone deny, delay, or downgrade a medical-necessity request, and that guarantee physicians a documented review by a peer in their own specialty. Most provisions take effect January 1, 2027.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Iowa has written a specific limit on artificial intelligence into its insurance code. House File 2635, enacted in the 2026 session, amends Iowa Code chapter 514F, which governs prior authorization and utilization review, and tells insurers exactly where an algorithm may and may not decide a patient's coverage. Most of the law takes effect January 1, 2027, with a separate electronic-submission requirement following on July 1, 2027.

What the law permits, and what it forbids

The core rule sits in new section 514F.8(2A). It permits a utilization review organization to "use an artificial intelligence-based algorithm or system to provide an initial review of a request for prior authorization." That permission is deliberate. Iowa is not banning AI from the claims process; it is fencing it.

The fence is the exception that follows. For a prior-authorization request based on medical necessity, the organization "shall not use an artificial intelligence-based algorithm or system as the sole basis for the utilization review organization's decision to deny, delay, or downgrade the prior authorization request." An algorithm can screen, sort, and flag. It cannot, by itself, be the reason a medically necessary service is turned down, slowed, or reduced.

A human reviewer, in the right specialty

Iowa does not stop at requiring a human. New section 514F.8A(2)(a) specifies who that human must be. The decision to deny or downgrade has to be made by "a qualified reviewer, if the health care provider requesting prior authorization is a physician," or by "a clinical peer, if the health care provider requesting prior authorization is not a physician."

The definition of "qualified reviewer" is where Iowa adds a same-specialty and written-attestation requirement that several other states do not. Section 514F.8A(1)(j) requires that the reviewing physician "practices in the same or a similar specialty as the health care provider that requested a prior authorization." A cardiologist's request is reviewed by someone practicing cardiology or a similar specialty, not by a generalist reviewer applying a checklist across every field of medicine.

The written attestation

The law also creates a paper trail. Section 514F.8A(2)(b) requires the reviewer to provide a written statement citing the specific reasons for the decision and the coverage or clinical criteria relied on, a written explanation of the appeals process, and a written attestation regarding the reviewer's specialty, board certifications, and expertise. The statute excludes personal identifiable information from that attestation, so the requesting provider learns the reviewer's qualifications without receiving private data about the individual.

For a physician who has fought a denial, this is the operative change. The insurer must now put in writing that the person who said no was qualified in the relevant field. That converts a familiar complaint, that denials come from reviewers outside the specialty, into a documented, enforceable standard.

What it does not do

HF 2635 does not outlaw AI in utilization review, and it does not reach every coverage decision. The sole-basis prohibition is tied to requests based on medical necessity; the law does not rewrite the underlying medical-necessity criteria themselves, nor does it set new penalties in these provisions. It also is forward-looking. The requirements are not in force yet. They begin January 1, 2027, with the electronic-submission piece on July 1, 2027, which gives carriers and utilization review organizations lead time to staff and document the human review step.

The regulated parties are health carriers and utilization review organizations offering the specified plans and contracts in Iowa. Self-funded ERISA plans and federal programs sit outside a state insurance statute's usual reach, so multistate insurers should scope which of their Iowa lines the chapter 514F amendments actually touch before assuming the rules apply across the book.

Iowa's contribution to the national picture is the specialty-match requirement paired with a written attestation. Several states now require human review of AI-driven denials. Iowa is among those insisting that the human hold credentials in the same or a similar specialty and prove it on paper.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.