AI Regulation Tracker / State law

Washington SB 5395 bars AI as the sole basis to deny prior-authorization care, effective June 11

Washington now prohibits health carriers, benefit managers, and public-employee plans from letting artificial intelligence be the only means of denying, delaying, or modifying care. A licensed clinician must make any medical-necessity denial.

By Anthony Guerriero · Reviewed by The Leveraged Years Editorial Desk · Published July 7, 2026 · Last updated July 7, 2026

Washington SB 5395 bars AI as the sole basis to deny prior-authorization care, effective June 11 regulation briefing

The Leveraged Years AI Regulation Tracker

Regulatory Briefing

Bindingness: Binding Law
Scope: Washington State. Health insurance carriers, managed care organizations, contracted health-care benefit managers, and Public Employees Benefits Board (PEBB) plans, and the clinicians and health-tech vendors that serve them.
What Changed: Senate Bill 5395 amends Washington law on prior authorization to provide that an artificial intelligence, algorithm, or related software tool shall not be the sole means used to deny, delay, or modify health care services. A determination of medical necessity may be made only by a licensed physician or a licensed health professional working within their scope of practice. Covered carriers must report to the insurance commissioner the percentage of prior-authorization denials that were aided by AI tools and algorithms.
Who This Affects: Health carriers and managed care organizations regulated in Washington, the health-care benefit managers they contract with, PEBB plans covering public employees, the utilization-review physicians who must sign denials, and the vendors that build or license prior-authorization software.
Current Status: In Force. Signed into law in March 2026; effective June 11, 2026.
Effective Date: June 11, 2026.
Primary Source: Washington Legislature, Senate Bill 5395 (2025-26), https://wa-law.org/bill/2025-26/sb/5395/1/
Secondary Analysis: Washington Senate Democrats, "Orwall bill to improve prior authorization transparency signed into law," https://senatedemocrats.wa.gov/orwall/2026/03/25/orwall-bill-to-improve-prior-authorization-transparency-signed-into-law/
Workflow Impact: Automated prior-authorization pipelines may still triage and approve requests, but any adverse medical-necessity decision must pass through a licensed clinician who reviews the individual case, and the organization must be able to count how often AI contributed to a denial.
Operational Next Step: Map every path by which a prior-authorization request can be denied, delayed, or modified, and confirm each adverse path terminates in a documented human clinical review before the decision reaches the enrollee.
Last Verified: July 7, 2026

Washington has made it unlawful for a health plan to let software issue the final "no." Senate Bill 5395, which took effect June 11, 2026, provides that an artificial intelligence, algorithm, or related software tool "shall not be the sole means used to deny, delay, or modify health care services." When a request is turned down on medical-necessity grounds, a licensed human must own that decision. The law reaches private health carriers, managed care organizations, the health-care benefit managers those carriers contract with, and the Public Employees Benefits Board plans that cover state and local government workers.

The measure was sponsored by Senator Tina Orwall and signed into law in March 2026. In the statement announcing the signing, Orwall said that "when it comes to denying care, only physicians should have the power to make these determinations because they've taken an oath to do no harm, and that's something AI systems simply cannot do." The bill passed against a national backdrop of scrutiny over algorithmic claim denials, and it converts what many carriers already treat as best practice into a statutory floor.

What the law actually requires

The operative rule is narrow and specific. AI, an algorithm, or a related software tool cannot be the only thing standing between an enrollee and a denial, delay, or modification of care. The statute pairs that prohibition with an affirmative assignment of authority: "a determination of medical necessity shall be made only by a licensed physician or a licensed health professional working within their scope of practice." That clinician cannot rubber-stamp a machine output. The text directs the reviewer to weigh the requesting provider's recommendation, the enrollee's medical and clinical history, and the individual clinical circumstances of the case.

SB 5395 does not stop at the human-review requirement. Where AI tools are used at all in these determinations, the law sets conditions on how they operate. Determinations must be based on an individual enrollee's own data rather than solely on a group dataset. The tools must comply with applicable law, must not discriminate against enrollees, and must be subject to periodic review of their performance. Patient data fed into these systems is restricted to the stated purpose. In other words, the statute governs not only who makes the final call but how the automated layer beneath that call may behave.

The transparency and reporting piece

The second half of the law is about measurement. Covered carriers must report to the Washington Office of the Insurance Commissioner the volume of prior-authorization activity, including total requests, approvals, and denials, along with "the percentage of total denials that were aided by artificial intelligence tools and algorithms." The public framing, per the sponsor's office, is that the insurance commissioner will use this data to publish trends on prior authorization across the market. For a compliance officer, the reporting duty has a practical edge: a carrier cannot report a number it does not track, so systems have to be instrumented to flag when an AI tool contributed to an adverse decision. Firms should confirm the exact filing cadence and thresholds directly against the enacted text and any commissioner guidance, because reporting frequency and the definition of a covered carrier are the kind of details that get refined in implementation.

What the law does not do

It is worth being precise about the limits, because overreading this statute is easy. SB 5395 does not ban artificial intelligence from prior authorization. Automated systems may still receive, triage, and approve requests, and the law explicitly contemplates AI processing claims so long as a licensed provider reviews any decision to deny care on medical-necessity grounds. It is not a guarantee that a given service will be covered; a licensed reviewer remains free to deny a request, provided the denial rests on that reviewer's own clinical judgment rather than an unexamined algorithmic score. And it does not, by its terms, create a private lawsuit for an individual enrollee. Enforcement runs through the insurance commissioner's existing authority over the carriers the office regulates. The change is procedural and structural: it dictates who must be in the loop and what must be disclosed, not what the answer has to be.

Why it matters beyond Washington

For a national insurer or a benefit manager with a multistate book, the Washington rule is another entry in a widening patchwork. California, Texas, and other states have moved on AI in utilization review and claims decisions, and the common thread is a demand for human accountability at the point of denial plus visibility into how often automation drove the outcome. A carrier that builds one clean process, licensed clinical sign-off on every adverse medical-necessity determination, individualized review of the patient record, and an audit trail that records the AI system's role, is positioned to satisfy Washington today and to absorb similar requirements as they land elsewhere. Health-tech vendors selling prior-authorization software into Washington will face the same expectation by extension, because their carrier customers now need products that can enforce human review and produce the denial-level AI metrics the state wants to see.

Frequently Asked Questions

What exactly did Washington SB 5395 change?

It made it a legal requirement that an AI tool, algorithm, or related software cannot be the sole means used to deny, delay, or modify health care services in Washington. Any medical-necessity denial must be made by a licensed physician or licensed health professional acting within their scope, and covered carriers must report to the insurance commissioner the percentage of prior-authorization denials that AI tools helped produce. It took effect June 11, 2026.

Who is affected by the law?

Health insurance carriers and managed care organizations regulated in Washington, the health-care benefit managers they contract with, and Public Employees Benefits Board (PEBB) plans covering public employees. The utilization-review clinicians who sign denials and the health-tech vendors that supply prior-authorization software are affected in practice, because carriers must now route adverse decisions through a licensed human and measure AI's role.

Does SB 5395 ban insurers from using AI in prior authorization?

No. AI systems may still receive, triage, and approve requests, and may assist in the process. What the law prohibits is letting AI be the only basis for a denial, delay, or modification of care. A licensed clinician must make the medical-necessity determination, weighing the requesting provider's recommendation and the enrollee's individual clinical circumstances.

What has to be reported to the state, and when?

Covered carriers must report prior-authorization data to the Washington Office of the Insurance Commissioner, including total requests, approvals, denials, and the percentage of denials that were aided by AI tools and algorithms. Filing cadence and the threshold for which carriers must report should be confirmed against the enacted text and any commissioner guidance, since those implementation details can be refined.

What is the single most important compliance step right now?

Trace every path that can produce a denial, delay, or modification and confirm each adverse path ends in a documented review by a licensed clinician who examined the individual patient record. In parallel, verify that systems can flag and count when an AI tool contributed to a denial, so the carrier can meet the reporting duty.