Healthcare AI regulations, tracked and explained for 2026

How the layers stack, and who each one binds

Federal rules mostly regulate a function, not an organisation. HIPAA binds covered entities and, since the Omnibus Rule, business associates directly, which is why a vendor’s own posture is your problem too. HTI-1 binds the developer of certified health IT, reaching a provider only indirectly through the certified EHR requirements CMS programs depend on. The CMS prior authorization rule binds payers, not providers, with one exception: the Electronic Prior Authorization measure inside MIPS. And FDA binds the manufacturer of a device, not the organisation using it; FDA does not regulate the practice of medicine.

State AI statutes work differently: most bind the deployer directly, usually the hospital, clinic or practice putting the tool in front of a patient. Colorado is the exception, exempting HIPAA covered entities from most of its sections except employment decisions. Texas and Utah put a disclosure duty directly on the practitioner. The EU AI Act reverses the usual meaning of the word: its “provider” is the vendor, and its “deployer” is the hospital using the tool. A group operating in several states has to satisfy the strictest rule that reaches it, not average across them.

What a rule does not require

The common misreading runs the other way: teams assume a rule reaches further than it does. HIPAA never mentions artificial intelligence and has no separate AI rule, so a vendor calling itself “HIPAA certified AI” is describing nothing in the regulation; ask instead whether it signs a business associate agreement. FDA authorises specific devices for specific indications, not AI in general, so there is no such thing as an FDA-approved AI vendor. The original 2024 Colorado AI Act never actually took effect: its compliance date was pushed back once, then the statute was repealed and rewritten before that date arrived.

Is your tool a regulated device

Most administrative agents are not FDA-regulated devices. A scribe that drafts a note for clinician review or a phone agent that books appointments has no device intended use. The line moves once a vendor claims the software analyses a medical image or diagnostic signal, or gives a specific recommendation the clinician cannot independently review. Decision support that displays a recommendation with time to weigh it can fall inside the statutory exemption; the same logic firing a time-critical alert generally cannot. If you are unsure which side a tool falls on, the healthcare AI law checker walks through the applicable rules for your situation.