Illinois's Healthcare AI Laws: The AI Therapy Ban, BIPA, HB 3773 and the Clinical Peer Rule

More than in any state except California, and unlike California they mostly carry a private right of action or a named regulator with a fine schedule.

The list, in order of how often it bites. The Wellness and Oversight for Psychological Resources Act (HB 1806, Public Act 104-0054, in force since August 1, 2025) restricts AI in therapy and is enforced by IDFPR at up to 10,000 dollars per violation. The Biometric Information Privacy Act (740 ILCS 14) governs voiceprints and face geometry with liquidated damages of 1,000 to 5,000 dollars per person. HB 3773 (Public Act 103-0804, in force since January 1, 2026) makes discriminatory AI in employment, zip code proxies and failure to give notice civil rights violations. 215 ILCS 134/45(i) (in force since January 1, 2025) requires a clinical peer behind every adverse medical necessity determination where a plan uses an algorithm. The Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110), the Genetic Information Privacy Act (410 ILCS 513) and the Personal Information Protection Act (815 ILCS 530) govern what data an AI vendor can receive and what happens when it leaks. The eavesdropping statute (720 ILCS 5/14-2) governs recording. The AI Video Interview Act (820 ILCS 42) governs hiring video analysis.

What Illinois does not have is a general AI act or a rule on AI in clinical documentation for physicians. HB 35, the AI in health insurance bill, died. IDFPR and the State Medical Board have issued no guidance on ambient scribes. The frontier model law, SB 315, binds developers from 2027 and not you.

The shape is therefore the opposite of Texas: Illinois does not ask for a disclosure page and leave the rest to intent, it draws hard lines in specific professions and data types and lets plaintiffs enforce them. The state by state map places it alongside Colorado and California, and the healthcare AI law checker will tell you which of the statutes above your particular deployment touches.

It prohibits AI from doing anything a therapist does in the room, and permits it to do almost everything a therapist does outside it, on condition that the therapist stays responsible and the patient is told in writing when a session is recorded.

The prohibitions, section 20. Subsection (a): an individual, corporation or entity may not provide, advertise or otherwise offer therapy or psychotherapy services, including through the use of internet based artificial intelligence, to the public in Illinois unless the services are conducted by a licensed professional. That is aimed at AI therapy products. Subsection (b) is aimed at clinicians: a licensed professional may not allow AI to make independent therapeutic decisions, directly interact with clients in any form of therapeutic communication, generate therapeutic recommendations or treatment plans without review and approval by the licensed professional, or detect emotions or mental states. The last item is the sleeper. An intake tool that scores a patient's affect from voice or text, or a scribe feature that flags the patient sounded anxious, is detecting emotions or mental states.

Therapeutic communication is defined widely: any verbal, non verbal or written interaction in a clinical or professional setting intended to diagnose, treat or address mental, emotional or behavioural health concerns, expressly including offering emotional support, reassurance or empathy in response to psychological or emotional distress. A between session chatbot that tells a patient it understands how hard this is has crossed the line.

The permissions, sections 10 and 15. A permitted use is the use of AI by a licensed professional to assist in providing administrative support or supplementary support where the licensed professional maintains full responsibility for all interactions, outputs and data use. Administrative support means tasks that do not involve communication: managing appointment scheduling and reminders, processing billing and insurance claims, and drafting general communications related to therapy logistics that do not include therapeutic advice. Supplementary support means tasks that do not involve therapeutic communication and are not administrative: preparing and maintaining client records, including therapy notes; analysing anonymised data to track progress or identify trends, subject to review; and identifying and organising external resources or referrals.

The consent condition, section 15(b). No licensed professional may use AI for supplementary support where the client's session is recorded or transcribed unless the patient or their legally authorised representative is informed in writing that AI will be used and of the specific purpose of the tool, and provides consent. Consent is defined as a clear, explicit affirmative act communicating express, freely given, informed, voluntary, specific and unambiguous written agreement, revocable, and it expressly excludes acceptance of general or broad terms of use. That is the ambient scribe clause. A behavioural health practice running an AI scribe in Illinois needs a specific written consent naming the tool and its purpose, not a line in the intake pack.

Who is a licensed professional. Clinical psychologists, clinical social workers, social workers, professional and clinical professional counsellors, marriage and family therapists, certified alcohol and drug counsellors authorised to provide therapy, music therapists and advanced practice psychiatric nurses, and any other professional authorised to provide therapy, except for a physician. A psychiatrist is outside the Act's definition and therefore outside section 15(b), but is inside the Mental Health and Developmental Disabilities Confidentiality Act, which applies to any therapist, and inside the section 20(a) rule on offering AI therapy to the public. Section 35 excludes religious counselling, peer support and public self help materials. Section 25 routes all records and communications to the Confidentiality Act.

Not for patient audio captured in care. Possibly for staff and for callers who are not patients, and the exposure there is the one Illinois is famous for.

BIPA section 10 defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and then excludes information captured from a patient in a health care setting or information collected, used or stored for health care treatment, payment or operations under HIPAA. A scribe transcribing a visit under a business associate agreement is inside that exclusion. So is a phone agent handling an existing patient's appointment or refill.

Two categories fall outside it. First, employees. A voice authentication feature for clinicians, a face unlock on a shared workstation, or a scribe that builds a speaker profile of the physician is collecting a biometric identifier from a person who is not a patient. Second, non patient callers. A phone agent that creates a voiceprint of a new caller for identification, or a website intake tool that uses face geometry, is collecting from someone the health care exclusion does not describe. The statute does not define voiceprint, and whether a given vendor's speaker diarisation model creates one is a fact question a plaintiff's expert will be happy to argue.

For anything outside the exclusion, section 15 requires, before collection, written notice that a biometric identifier is being collected, written notice of the specific purpose and length of term, and a written release, which in employment may be a release executed as a condition of employment. Section 15(a) requires a public written retention policy with destruction when the purpose is satisfied or within three years of the individual's last interaction, whichever is first. Section 15(c) bars selling or otherwise profiting from biometrics, and section 15(e) requires the reasonable standard of care in the industry.

Damages under section 20 are 1,000 dollars per negligent violation or 5,000 dollars per intentional or reckless one, with fees, and Public Act 103-0769 has since August 2, 2024 made repeated collection from the same person by the same method a single violation, which ended per scan accrual but not per person exposure. A hospital with two thousand staff using voice login without releases is looking at two to ten million dollars before fees.

What to ask a vendor: whether any feature creates a speaker or face template rather than a transcript, for whom, where it is stored, and how it is destroyed. Where the answer is yes for staff, add the release to onboarding and publish the retention policy. The vendor questions list carries the wording.

Do not use AI that discriminates, do not use zip codes as a proxy, and tell employees when AI is used in employment decisions. The first two are outcome tests, which is unusual, and the third has no rule behind it yet.

Public Act 103-0804 added subsection (L) to 775 ILCS 5/2-102, effective January 1, 2026. It is a civil rights violation, with respect to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure or the terms, privileges or conditions of employment, for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes, or to use zip codes as a proxy for protected classes. Separately, it is a violation for an employer to fail to provide notice to an employee that the employer is using artificial intelligence for those purposes.

Three things to notice. The standard is effect, not intent, which is the opposite of Texas and the same as Colorado. Artificial intelligence is defined at 2-101(M) as a machine based system that infers from input how to generate outputs such as predictions, content, recommendations or decisions, and expressly includes generative AI, so a large language model that screens resumes or drafts performance summaries is inside. And the Act tells the Department of Human Rights to adopt rules on the circumstances, timing and means of notice. The Department published proposed rules in May 2026 that would have required the product name, vendor, decisions affected, data categories, positions covered, a contact person and accommodation rights, annually and within 30 days of adopting a new system, and then withdrew them in June 2026. That account comes from the firms tracking the docket; the Department's rules page could not be reached in September 2026 and no adopted rule was found.

Until a rule exists, the safe reading is to give plain written notice now, naming each tool and the decisions it touches, and to keep it updated. The AI Video Interview Act adds specific duties if you analyse recorded interviews: notice before the interview, an explanation of how the AI works and what characteristics it evaluates, consent, deletion within 30 days on request, and demographic reporting to the Department of Commerce if AI alone decides who gets an in person interview. Most health systems already run these tools through HR vendors; the audit trail and the notice are what HB 3773 adds.

Illinois answered the AI denial question in 2024, before most states asked it, and did so by attaching the algorithm to an existing rule rather than writing a new one.

215 ILCS 134/45(i), added by Public Act 103-0656 and in force since January 1, 2025, says that even if a health care plan or other utilization review programme uses an algorithmic automated process in the course of utilization review for medical necessity, the plan shall ensure that only a clinical peer makes any adverse determination based on medical necessity, and that any subsequent appeal is processed as the section requires, including the restriction that only a clinical peer may review an appeal. A clinical peer, under 215 ILCS 134/10, is a health care professional in the same profession and the same or similar specialty as the provider who typically manages the condition or treatment under review. The Healthcare Protection Act, Public Act 103-0650, adds that either a health care professional or an accredited algorithmic automated process, or both, may certify medical necessity, and that an accredited process may refer a case to a clinical peer for a potential adverse determination, but only the clinical peer may make it.

The Department of Insurance's Company Bulletin 2024-08 of March 13, 2024 sits alongside. It adopts the NAIC model and expects every insurer authorised in Illinois to develop, implement and maintain a written programme for the responsible use of AI systems that make or support decisions related to regulated insurance practices, and it defines an adverse consumer outcome as a decision that adversely impacts the consumer in a manner that violates insurance regulatory standards, citing the unfair trade practices and improper claims practices provisions of the Insurance Code.

HB 35 and SB 1425 would have gone further, barring any adverse consumer outcome resulting solely from an AI system and requiring meaningful review by a person with authority to override. HB 35 passed the House 79 to 35 on April 9, 2025 and was re-referred to Senate Assignments in June 2025, where it died. So Illinois's rule is narrower than California's SB 1120 or Washington's E2SSB 5395 but earlier, and it reaches state regulated plans and Medicaid managed care through the Managed Care Reform and Patient Rights Act.

For a provider the operational point is that an adverse determination from an Illinois regulated plan must show a clinical peer, in the same or similar specialty, made it. A denial letter with no reviewer, or a reviewer in the wrong specialty, is defective. Build the check into your prior authorization workflow, and escalate to the Department of Insurance's Office of Consumer Health Insurance where a pattern appears. Self funded ERISA plans and Medicare Advantage are outside the state rule.

Illinois is an all party consent state for surreptitious recording, its mental health confidentiality act is stricter than HIPAA, and its breach statute gives vendors no time at all.

Recording. 720 ILCS 5/14-2(a)(2) makes it an offence to use an eavesdropping device in a surreptitious manner to record any part of a private conversation to which one is a party without the consent of all other parties. Surreptitious means obtained by stealth or deception or executed through secrecy or concealment, and a private conversation is one where a party reasonably expected privacy, expressly including an expectation derived from a privilege. A clinical encounter is privileged. The operative word is surreptitious: a scribe or phone agent that is clearly announced is not recording by stealth, and consent to a clearly announced recording defeats the offence. Announce it, get the answer, note the answer. Section 14-2(a)(5) separately makes it an offence to use or disclose information obtained from an unlawful recording, which is why a vendor's audio retention matters.

Mental health records. The Mental Health and Developmental Disabilities Confidentiality Act, 740 ILCS 110, treats all records and communications made in the course of providing mental health services as confidential, whether or not made in a therapeutic relationship. Section 5 requires any consent to disclosure to be written and to specify the recipient, purpose, nature of the information, expiry date and right to revoke, and section 5(c) says blanket consent to unspecified information is not valid. Section 9 is the vendor pathway: a therapist may disclose without consent to a business associate, an integrated health system, or a person acting under the therapist's supervision and control. So a scribe or analytics vendor under a proper business associate agreement is lawful; a vendor that is not a business associate, or that re-discloses, is not. Section 15 gives any aggrieved person a civil action with fees and section 16 makes a knowing and wilful violation a Class A misdemeanour. The Wellness and Oversight Act's section 25 sends every therapist record into this regime.

Genetic data. The Genetic Information Privacy Act, 410 ILCS 513, permits disclosure of genetic test results only to the subject, to persons named in a specific written authorization, or to an authorised agent or employee of a health facility or provider, with liquidated damages of 2,500 or 15,000 dollars. Feeding genomic results to an AI vendor that is not clearly an authorised agent is a disclosure.

Breach. The Personal Information Protection Act, 815 ILCS 530, includes medical information, health insurance information and biometric data in personal information. Section 10(b) requires a data collector that maintains or stores but does not own the data, which is every AI vendor, to notify the owner immediately following discovery of a breach. Notice to individuals follows in the most expedient time possible and the Attorney General must be told where more than 500 Illinois residents are affected, no later than consumers are. Section 45(b) requires vendor contracts to include a provision requiring reasonable security measures, and section 45(c) treats HIPAA compliance as compliance. Write immediately into the business associate agreement in those words; the federal 60 day clock described in our HIPAA and AI page is not the Illinois standard for a vendor.

Nothing in writing, which means the Medical Practice Act's ordinary standards, plus the Wellness and Oversight Act's rules for the non physician professions IDFPR licenses.

IDFPR has published no guidance on ambient scribes, AI documentation or clinical decision support for physicians. Checked September 2026. Its Office of Innovation leads an internal AI working group, and it issued the August 4, 2025 press release on the Wellness and Oversight Act stating that the Department will have authority to investigate all suspected violations and that confirmed violations will result in a fine of up to 10,000 dollars. No enforcement action under the Act had been published by September 2026. The Illinois State Medical Society has published no scribe guidance either; it supported HB 35.

What governs physicians is the Medical Practice Act, 225 ILCS 60, and the disciplinary grounds in section 22, which include gross negligence, dishonorable or unprofessional conduct and, through the records provisions, failure to maintain adequate records. A signed note that misstates the encounter is inadequate whether a person or a model drafted it. The Telehealth Act, 225 ILCS 150, requires telehealth to be consistent with the standards of care for in person services and with all federal and state privacy laws, and defines telehealth services as the evaluation, diagnosis or interpretation of patient data by a licensed health care professional, which an autonomous AI agent is not. There is no express patient consent to telehealth requirement in the current text.

For the professions the Wellness and Oversight Act covers, the expectations are explicit and written into statute: notes are supplementary support, the professional keeps full responsibility for outputs and data use, the AI never touches therapeutic communication, and recorded or transcribed sessions require specific written consent. Adopting that as the practice wide standard, physicians included, is the simplest defensible position, and the AI policy template for medical practices is drafted to it.

Eight items. Illinois has more live statutes than any state but California, and most of them are enforced by plaintiffs, so the order is by size of exposure.

1. In behavioural health, confine AI to the two permitted lanes and write the consent. Administrative support and supplementary support only. No therapeutic communication, no treatment plans without review, no emotion or mental state detection. Specific written consent naming the tool and its purpose before any recorded or transcribed session, revocable, separate from terms of use.
2. Kill any affect or sentiment feature in a therapy setting. Section 20(b)(4) prohibits detecting emotions or mental states. Vendors ship this as a helpful flag; in Illinois it is a 10,000 dollar violation.
3. Run a BIPA audit on every voice and face feature for staff and non patients. Notice, purpose, term, written release, public retention policy, three year destruction. The patient exclusion does not cover employees.
4. Give written notice of every AI tool used in employment decisions now. HB 3773 is in force without rules. Name the tool, the decisions, and a contact. Check nothing uses zip codes.
5. Announce every recording and capture the answer. 720 ILCS 5/14-2 turns on surreptitious. An announced scribe or phone agent is not surreptitious; an unannounced one is a felony.
6. Put immediately in the vendor breach clause. 815 ILCS 530/10(b) requires a vendor to notify the owner immediately following discovery. Add the section 45(b) security clause and the MHDDCA business associate language.
7. Check every adverse determination for a clinical peer. 215 ILCS 134/45(i) requires one, in the same or similar specialty, wherever an algorithm was used. Appeal denials that cannot show it.
8. Classify any companion style agent now. SB 316 passed the Senate 57 to 0 and will be back. The New York and Washington rules it copies are already in force elsewhere.

Illinois punishes the organisation that reads the HIPAA exclusion in BIPA as a general exemption and the Wellness and Oversight Act as a rule for chatbot companies. Both reach ordinary clinics through their staff, their callers and their scribes. Mapping which of these statutes each deployment touches, drafting the consents and releases, and aligning the programme with Colorado, California and Texas is what our AI governance and compliance engagement does, starting from the inventory an AI readiness audit produces. Book a scoping call if any of items one to three is currently unanswered.