Indiana Just Made Human Review of AI Claim Decisions the Law. A Dozen States Are Doing the Same.

The bill is HB 1271. Indiana enacted it on March 4, 2026, and it added a new chapter to the state code, IC 27-1-52, on the downcoding of health benefits claims. Downcoding is the quiet part of insurance most people outside the industry never think about: a claim comes in for one level of service, and the payer pays it as a cheaper one. Do that with an automated tool at scale, and you can shave real money off what providers collect. Indiana just put rules around exactly how that can happen.

If you run a business and you have been telling yourself AI governance is a next-year problem, this is the week that argument gets harder to make. The law is local, dated, and specific. And Indiana is not alone.

What the Indiana law actually requires

Strip out the statutory language and HB 1271 comes down to a few plain requirements.

An insurer cannot use AI as the sole basis to downcode a claim without a healthcare professional reviewing the beneficiary's medical record. The downcoding has to be clinically justified and transparent. The insurer has to give a clear explanation that includes the reasoning and the coding change. It cannot rest on diagnosis codes alone, and it cannot single out providers who treat complex patients.

There is a disclosure piece too. When AI is used to make an adverse determination on a prior authorization request, or to downcode a claim, the insurer has to disclose that in a way that is easy to find and easy to read.

Here is the part most coverage skips. The law does not only bind insurers. It also prohibits healthcare providers from submitting claims using AI without a review by the provider or a billing professional. Both sides of the transaction now carry the same duty: a person has to check the machine's work before it becomes a decision that affects someone's money or care.

The chapter carries a few other provider protections that tell you what problem the legislature was solving:

• The insurer recoupment window on paid claims shrinks to 180 days from the initial payment date, down from two years. Payers can still audit claims for up to three years, and fraud is carved out.
• Retroactive cuts to CPT-code reimbursement rates are prohibited, and insurers have to give at least 60 days' notice before any prospective rate decrease.
• Providers keep the right to bill for services they actually performed, with at least 180 days to appeal.
• If a payment gets recouped over a coordination-of-benefits error, providers have 90 days to resubmit the claim to the correct insurer.

Medicaid is excluded from the downcoding provisions. And what makes Indiana's law worth a second look is where it reaches. Most 2026 state laws in this area stop at prior authorization, the yes-or-no before treatment. Indiana's runs all the way to the payment-and-coding stage, which is where a lot of the automated dollar decisions actually live.

This is a national pattern, not an Indiana quirk

A Holland & Knight review of 2026 legislation counted a dozen states passing new laws restricting AI in healthcare and health-insurance decisions, plus a late-2025 regulatory action in Arizona. That is thirteen jurisdictions in one roundup, moving in the same direction inside a single year.

Two of them show the shape of the trend.

Alabama's SB 63 targets prior authorization. When an insurer uses AI there, the decision has to rest on the beneficiary's own medical history and clinical circumstances. It cannot lean on group datasets, and the insurer has to certify its practice to the state Department of Insurance every year.

Washington's SB 5395 draws an even brighter line. A health carrier cannot rely solely on AI to deny, delay, or limit healthcare services. A licensed or qualified professional has to make the adverse determination.

Read those three laws next to each other, from three states that do not coordinate their legislatures, and the same sentence keeps showing up. AI can assist. A person has to decide. That is the load-bearing rule, written three different ways.

AI can assist. A person has to decide.

The principle underneath all of it

Notice what these laws are not doing. None of them bans AI in insurance. None tells a payer to rip the tools out. What they regulate is the handoff: the moment a model's output becomes a decision with consequences for a real person.

The rule they land on is one we teach as a discipline. The human is the loop. AI does the fast work, and a qualified human stays accountable for the call. When a dozen legislatures write that same idea into statute in the same year, it stops being a philosophy about how to use AI responsibly. It becomes the floor.

For a leader, that changes the question. It is no longer whether to add a human check to your AI workflows. Some states have now answered that for you in at least one part of your business. The real question is whether you would know which of your workflows already need one.

What this means if you run a business, even outside insurance

You might read all this and think it is a healthcare story. It is bigger than that.

Any process where you point AI at a consequential decision now carries a governance dimension it did not carry a year ago. Claims and coding are the regulated example today. Hiring, lending, pricing, and benefits are the obvious next candidates, because they share the same shape: an automated judgment that changes what happens to a person.

The instinct when a new AI tool shows up is to turn it on and see what it does. That instinct now has a cost in some workflows. Letting the tool run a consequential decision unchecked is becoming a choice that creates legal exposure, not efficiency. The safer path is the one Indiana's law describes almost word for word: a designed process, a human checkpoint at the decision, and a record that shows the person looked.

That is a capability, not a compliance box. It is the difference between a team that can point AI at a real workflow and defend the result, and a team that bought a tool and hoped. In The 7 Levels of AI Proficiency, that jump lives around the middle of the climb, where people stop just prompting and start designing the workflow the AI runs inside, with the human review built in on purpose. The states are now legislating their way toward the same skill we measure.

Getting that discipline right once, before the rules multiply, is cheaper than retrofitting it later under a dozen different state laws that each phrase the requirement a little differently.

The next step

Pick one place in your business where AI already touches a decision that affects a customer, an employee, or a dollar figure. Ask two questions. Does a qualified person review the output before it becomes final? Could you show, later, that they did?

If the answer to either is no, you have found the workflow to fix first. That is the same instinct these thirteen jurisdictions are writing into law, and you do not need a statute to start.

If you want a read on where your team sits on that skill today, The 7 Levels of AI Proficiency assessment takes about ten minutes and shows you the climb from where you are.

Related reading: Level 5: The Captain (Design Thinker).

Sources

1. Holland & Knight: States Continue Efforts to Regulate AI in Healthcare
2. Indiana General Assembly: HB 1271 (2026)
3. National Law Review: State Legislatures Consider Oversight of Artificial Intelligence in Health Insurance
4. APTA Indiana: HB 1271 Announcement

Harrison Painter

Executive AI Advisor. Founder, LaunchReady.ai and AI Law Tracker.

Harrison is an Indiana AI Advisor who helps business owners and executives get their time back by building AI systems that run the work for them. Nearly 20 years in business and author of You Have Already Been Replaced by AI. Creator of The 7 Levels of AI Proficiency.

Connect on LinkedIn