Massachusetts's Healthcare AI Laws: The Attorney General's Advisory, Chapter 93A and the Bills Still in Conference

General ones, applied deliberately. Massachusetts has not passed an AI statute of any kind, and the Attorney General has said in writing that she does not need one to act.

The instrument that matters is the Attorney General's April 16, 2024 advisory. Its position is that chapter 93A, the Consumer Protection Act, already prohibits the things people worry about with AI: overstating what a system can do, supplying one that does not work for the purpose advertised, misrepresenting its reliability or safety, and using synthetic audio, video or chatbots to deceive. Chapter 151B already prohibits discrimination, whatever tool produced it. Chapter 93H and 201 CMR 17.00 already require reasonable security for personal information, whoever holds it. The advisory tells developers, suppliers and users, which means vendors and the clinics that deploy them, that these apply now.

Around it sit the sector rules. The Division of Insurance's Bulletin 2024-10 applies the NAIC model to every insurer in the Commonwealth. The wiretap statute, chapter 272, section 99, is one of the strictest in the country and governs every recording. The Board of Registration in Medicine's records regulation governs what a signed note must contain. And the newly amended 211 CMR 52.00 governs prior authorization.

What is pending is more specific: S.2632 on AI in healthcare decision making, H.4616 on prior authorization including automated and AI assisted review, S.264 and S.243 on chatbots, and the data privacy act now in conference. None had passed both chambers by September 2026. So the honest answer for a buyer is that Massachusetts binds you through consumer protection and privacy law today, and will bind you through a health AI statute only if the 2027 session finishes what this one started. The state by state map places it next to Colorado and California, both of which already have what Massachusetts is debating.

That the marketing claims on your vendor's website, the disclosures your agents make and the fairness of your tools are all chapter 93A questions, and that the Attorney General has told you so.

The advisory lists practices it considers unfair or deceptive under chapter 93A, section 2. Four of them land on a provider deploying AI. Falsely advertising the quality, value or usability of AI systems. Supplying an AI system that is defective, unusable or impractical for the purpose advertised. Misrepresenting the reliability, manner of performance, safety or condition of an AI system. And misrepresenting audio or video content of a person for the purpose of deceiving another into a business transaction or into supplying personal information, as in the case of deepfakes, voice cloning or chatbots used to engage in fraud. It adds that AI systems are being deployed in ways that deceive consumers, including chatbots used to surreptitiously collect sensitive personal data.

Read those against a clinic's estate. A patient facing phone agent that presents as a member of staff, or an intake chatbot that collects symptoms without saying it is software, is squarely within the deception the advisory names. A vendor that tells you its scribe is 99 percent accurate with no basis has made a chapter 93A representation to you, and if you repeat it to patients you have made one too. A clinical decision support tool that performs worse for one group is a chapter 151B question if it touches employment and a civil rights question under the advisory's reading generally.

Two practical responses. First, treat vendor claims as warranties and get them in the contract, because the advisory makes a supplier's misrepresentation actionable and your best protection is a written statement you can hold them to. Second, make every patient facing agent identify itself as AI at the start, which is the same control Utah and Texas require and which removes the deception argument entirely. The vendor questions list is built for the first; the AI policy template covers the second.

Close enough to write to. Both were reported from committee in October 2025, both describe controls that California and Washington already require, and neither reached a floor vote.

S.2632, An Act relative to the use of artificial intelligence and other software tools in healthcare decision making (Senators Moore and Eldridge, originally S.46), was reported favourably as a new draft by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on October 16, 2025 and referred to Health Care Financing. Its provisions, from the committee text: an AI tool used by a carrier must not supplant health care provider decision making; must not discriminate in violation of state or federal law including chapter 151B; must be open to inspection for audit or compliance reviews by the Division of Insurance and the Executive Office of Health and Human Services. On the provider side, therapy or psychotherapy may be delivered only by a licensed professional, and AI may provide administrative or supplementary support only where the professional maintains full responsibility and the patient is informed in writing and provides consent. That last provision is the Illinois model, and it would reach an ambient scribe in a behavioural health setting directly.

H.4616, An Act improving the health insurance prior authorization process, is the committee redraft of H.1136 (Representative Decker), reported on October 20, 2025 and referred to Health Care Financing, and at the latest recorded action was with House Ways and Means. It would require carriers to publish a searchable list of services subject to prior authorization, streamline automated approval, protect continuity of care, improve transparency in how utilization review decisions are made including those assisted by AI, and create a task force on prior authorization. Its effective dates were drafted for January 1, 2026 and are now stale.

Also filed: S.264 (Senator Montigny) on protections for consumers interacting with AI chatbots, in Senate Ways and Means; S.243 (Senator Finegold) on chatbot disclosure; H.94 (Representative Paulino) proposing a general chapter 93M on AI accountability; and S.35 on fostering AI responsibility, reported favourably to Senate Ways and Means. The 2023 to 2024 session's H.1974, which would have required licensing board approval before a mental health professional used AI, was not carried forward under that number.

The 2027 session will start from these texts. A practice that adopts the S.2632 position now, licensed human for therapy, written notice and consent for recorded sessions, AI confined to notes and administration, is compliant with Illinois, Nevada and New York's pending bill at the same time and has nothing to undo if Massachusetts passes it.

That nothing is recorded secretly. Massachusetts asks less than a written consent and more than most people assume, and the criminal penalty is real.

Chapter 272, section 99(B)(4) defines interception as to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to the communication. Section 99(C)(1) makes wilful interception punishable by a fine of not more than ten thousand dollars, or imprisonment in state prison for not more than five years or in a house of correction for not more than two and a half years, or both. Section 99(Q) adds a civil action with liquidated damages, punitive damages and fees.

The word that decides the analysis is secretly. The Supreme Judicial Court has read the statute to turn on whether the recording was hidden from a party, so a recording made with the actual knowledge of everyone present is not secret even without a formal consent. The safe and the lawful design are the same one:

• Ambient scribes. The clinician states at the start of the visit that the encounter is being recorded by an AI documentation tool and asks whether that is acceptable. Everyone in the room is covered by the statement, including the accompanying relative. The note records that the statement was made. A signed consent at registration is good practice and useful evidence, but the statement in the room is what defeats secrecy.
• Phone agents. The agent announces recording in its first sentence, before any clinical content, and offers a non recorded route to a human for anyone who objects. A caller who continues after a clear announcement has knowledge, which is the statutory test.
• Vendor audio. Interception includes aiding another to secretly record. A vendor that retains or reuses audio beyond what the patient was told is a risk to the practice as well as to itself. Put retention and training use in the contract.

Massachusetts is in the same group as Washington, Florida and Pennsylvania on this point, and stricter than New York or Texas, both of which allow one party consent. A multi state group should build to the Massachusetts standard everywhere, because it costs one sentence.

Yes, subject to the Division of Insurance's expectations in Bulletin 2024-10 and the new limits in 211 CMR 52.00 on what may be prior authorised at all. There is no statute on AI in utilization review.

Bulletin 2024-10, issued December 9, 2024, reminds all insurers doing business in the Commonwealth that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including AI systems, must comply with all applicable insurance laws and regulations. It sets out the Division's expectations for how insurers will govern the development, acquisition and use of AI, adopts the NAIC principles of fairness, accountability, compliance, transparency and safety, and advises insurers of the documentation the Division may request in an investigation or examination. It is guidance about governance rather than a rule about outcomes, and it does not itself prohibit an AI generated denial.

The amended 211 CMR 52.00, effective June 5, 2026, changes the practical picture more than any AI rule would. For the services the Governor's announcement lists, there is no prior authorization to automate. For those that remain, urgent requests must be answered within 24 hours and approvals for stable chronic conditions honoured for the duration of treatment. The regulation applies to fully insured plans; self funded ERISA plans and Medicare Advantage are outside it. Whether the amended text speaks to automated or AI assisted review could not be confirmed from the published materials in September 2026, and the Division's own information session agenda focused on sections 52.01 and 52.07.

The Massachusetts Medical Society and the American College of Radiology are backing H.4616 to add transparency on AI assisted utilization review by statute. Until that passes, a provider's leverage is the ordinary internal and external review process under chapter 176O and the Office of Patient Protection, and the Division's examination powers under the bulletin. Instrument your prior authorization workflow to record which services are on the exempt list, which requests exceeded 24 hours, and which denials show no individual clinical reasoning, because a documented pattern is what the Division and the Office of Patient Protection act on.

Chapter 93H and 201 CMR 17.00 reach every vendor holding a resident's personal information. The data privacy act would reach the ones outside HIPAA, and it is one conference report from passing.

201 CMR 17.00 requires every person that owns or licenses personal information about a Massachusetts resident to develop, implement and maintain a comprehensive written information security programme with administrative, technical and physical safeguards, including encryption of personal information transmitted across public networks or stored on portable devices, and oversight of third party service providers by contract. A scribe or phone agent vendor holding names with medical or insurance identifiers is within it. Ask for the written programme, not a certificate.

Chapter 93H, section 3 requires a person that knows or has reason to know of a breach to notify the Attorney General, the Director of Consumer Affairs and Business Regulation and the affected residents as soon as practicable and without unreasonable delay, and provides that notice shall not be delayed on grounds that the total number of residents affected is not yet ascertained. There is no fixed day count, which is stricter in practice than the federal 60 days in our HIPAA and AI page. A vendor that maintains but does not own the data must notify the owner as soon as practicable. Put those words in the business associate agreement.

The Massachusetts Data Privacy Act is the pending change. The Senate's S.2619 treats health data as sensitive data, limits collection to what is strictly necessary, requires affirmative consent before transfer, bans the sale of sensitive data, and exempts protected health information processed under HIPAA at the data level rather than exempting covered entities as organisations. The House passed its own version on June 4, 2026, a conference committee was appointed on June 11 and met on July 30, and no report had been filed by September 1, 2026. If it passes, the data your website, marketing tools and non patient interactions generate would be governed by consent for the first time, as it already is in Washington and Nevada. Sorting each vendor's processing into inside the BAA and outside it now is the preparation, and it is the same exercise those states already require.

The same thing it expects of every record, and it has said nothing specific about AI to change that.

The Board has published no policy, advisory or newsletter statement on artificial intelligence, ambient documentation or clinical decision support. Checked September 2026 against its policies, guidelines and publications pages. What applies is 243 CMR 2.07(13), which requires a licensee to maintain a medical record for each patient which is adequate to enable the licensee to provide proper diagnosis and treatment, retained for a minimum of seven years from the date of the last patient encounter. Adequate is judged on the signed record. A scribe draft that records an examination not performed, or omits a medication change discussed, is inadequate whoever drafted it, and inadequate records are among the commonest grounds for Board complaint.

The Board's other instruments reach AI without naming it. 243 CMR 1.03 lists the grounds for discipline, including conduct that undermines public confidence in the integrity of the profession, and the Board's informed consent expectations mean a patient should know when a recording device is in the room and when software rather than the physician produced a communication. The Attorney General's advisory adds the consumer protection layer for anything a patient is told about the tool.

For non physician clinicians, the boards under the Division of Occupational Licensure apply parallel standards, and S.2632 would add an explicit written notice and consent duty for AI in therapy if it passes. The simplest defensible position is to adopt that standard for the whole practice now: the clinician reviews and signs every AI drafted note, the patient is told at the start of the visit, and the practice has a written AI policy the Board can be shown. The scribe checklist sets out the review gate.

Seven items. Massachusetts has no AI statute, so most of this is applying chapter 93A, the wiretap law and the privacy regulation to tools they were not written for, and preparing for the bills that will return in 2027.

1. Make every patient facing agent identify itself as AI at the start. The Attorney General's advisory names chatbots that deceive or surreptitiously collect data as chapter 93A violations. One opening sentence removes the argument.
2. Say the recording out loud, every time. Chapter 272, section 99 turns on secrecy. A stated announcement in the room or at the top of the call, noted in the record, is the control. Do not rely on a registration form alone.
3. Get vendor performance claims into the contract as warranties. The advisory makes a supplier's misrepresentation actionable; a written claim you can enforce is worth more than a marketing page you cannot.
4. Ask every vendor for its 201 CMR 17.00 written information security programme and write chapter 93H's as soon as practicable notice into the business associate agreement.
5. Keep AI out of the therapeutic act in behavioural health and put the written notice in place now. S.2632 would require it; Illinois already does; the Board would expect it anyway.
6. Map the June 5, 2026 prior authorization exemptions into your workflow. Stop submitting requests for services that no longer need them, and log turnaround against the 24 hour urgent standard.
7. Sort each vendor's data into inside the BAA and outside it. The data privacy act, if the conference committee reports it, will govern the outside category by consent.

Massachusetts punishes the organisation that waits for a statute before it treats AI as regulated. The Attorney General has said existing law applies, the wiretap statute is criminal, and the Division of Insurance is already examining AI governance. Building the identification, consent, contract and review controls once, and aligning them with Colorado, California and Texas, is what our AI governance and compliance engagement delivers. The healthcare AI law checker will show which of these duties your deployment already carries, and you can book a scoping call to plan for the 2027 refilings.