Nevada's Healthcare AI Laws: AB 406, SB 370 and the Recording Rules

Four, and only one of them is an AI statute.

AB 406, Statutes of Nevada 2025, is the headline. Its prohibitions are codified at NRS 433.567, added to NRS at page 1894 of the 2025 session laws. Signed on June 5, 2025 and effective July 1, 2025, it amends NRS chapters 391, 433 and 629 to keep artificial intelligence out of the functions reserved to licensed mental and behavioral health professionals. It is narrow by subject and unusually hard inside that subject: not a disclosure duty, not a risk assessment duty, a prohibition.

The consumer health data provisions at NRS 603A.400 to 603A.550, enacted by SB 370 of 2023 and operative since March 31, 2024, govern health data that sits outside HIPAA. Note that these are 2023 provisions. SB 260 of 2021 is a different law about data brokers and the opt out of sale, and it is often miscited as Nevada's health data statute. It is not.

NRS 603A.010 to 603A.290 impose reasonable security measures and an encryption duty on any data collector holding a Nevada resident's personal information, which is the provision that follows your vendor contracts. NRS 200.620 requires the consent of every party before a telephone or other wire communication is recorded, which is the operative rule for an AI phone agent. And NRS 629 governs health care records, including the five year retention floor in NRS 629.051.

What Nevada does not have is worth stating plainly, because buyers assume it. There is no general high risk AI framework of the Colorado kind. There is no patient facing AI disclosure duty of the Texas kind. There is no statutory restriction on AI in utilization review. The state by state map shows how unusual that combination of one very sharp rule and no general framework is.

Two prohibitions on two different parties, plus a representation ban that catches marketing copy.

• On the developer. An artificial intelligence provider shall not make available for use by a person in Nevada an AI system that is specifically programmed to provide a service or experience to a user that would constitute the practice of professional mental or behavioral health care if provided by a natural person.
• On the clinician. A provider of mental and behavioral health care shall not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient.
• On what anyone may claim. An artificial intelligence provider shall not make, or knowingly cause or programme a system made available in Nevada to make, any representation that explicitly or implicitly indicates that the system is capable of providing professional mental or behavioral health care.

Professional mental or behavioral health care means services relating to the diagnosis, treatment or prevention of mental illness or an emotional or behavioral disorder that a provider typically provides in practice. The reach is therefore defined by scope of practice, not by product category, which is why a general purpose wellness chatbot can fall inside it while a purpose built triage tool that never diagnoses can fall outside.

Read the clinician limb carefully, because it is the one that surprises people. It does not say the AI must not make the decision. It says the provider shall not use an AI system in connection with providing that care directly to a patient. A copilot suggesting an intervention during a session, a model scoring a patient's risk in the moment, a tool drafting a treatment plan for the clinician to accept: on the face of the text those are inside the prohibition, not merely subject to a human review requirement. That is a materially different standard from every other state, and it is the reason a behavioral health deployment cannot be lifted from a primary care rollout.

Enforcement is per violation and personal. The penalty runs to fifteen thousand dollars, and a provider who violates the section is guilty of unprofessional conduct and can be disciplined by their licensing board. There is no cure period of the sort Texas offers.

Yes, and the exception is drafted more usefully than the headlines suggest, but it comes with a condition that changes the workflow.

AB 406 does not prohibit an AI system designed to be used by a provider for administrative support. The permitted list includes scheduling, billing, data analysis, case file organisation, therapy notes, research and idea generation. Therapy notes being named in that list is the single most important detail on this page for anyone buying an ambient scribe: documentation is administrative support, and documentation is allowed.

The condition is independent review. Where AI is used for billing or for notes from patient sessions, the provider must independently review the accuracy of any report, data or other information compiled, summarised, analysed or generated by the system. Three consequences follow.

1. Attestation has to be a gate, not a habit. If a draft note can reach the record without a clinician signing it, the workflow does not meet the statute. Configure the scribe so nothing auto files.
2. Review has to be evidenced. Independent review that leaves no trace is indistinguishable from no review when a board asks. Keep the signature, the timestamp and the identity of the reviewer, and keep them for the five years NRS 629.051 requires of health care records.
3. The line is the session itself. A scribe that listens and writes afterwards is administrative. A scribe that surfaces suggestions to the clinician during the encounter, or speaks to the patient, has moved toward providing care directly to a patient. Turn those features off in Nevada behavioral health and record that you did.

Ask the vendor two questions before signing. Can the assistive and in session features be disabled per site or per specialty, and will that be reflected in the order form rather than in a support ticket? And will the audit log show, per note, who reviewed it and when, exportable without a support request? Most ambient vendors can do the second. Fewer can do the first cleanly, and a national contract that cannot be configured by state is a real problem in Nevada.

No, and the widely repeated claim that Nevada is a two party consent state is only half right. The distinction decides whether your scribe rollout is lawful, so it is worth getting exactly right.

Nevada has two statutes. NRS 200.650 covers in person conversations and makes it unlawful to surreptitiously listen to or record a private conversation unless authorised to do so by one of the persons engaged in the conversation. One party. NRS 200.620 covers telephone and other wire communications and contains no such one party authorisation, and in Lane v. Allstate Insurance Co. the Nevada Supreme Court held that the omission was deliberate and that recording a call requires the consent of all participants. All parties.

So for an ambient scribe in an exam room, the clinician is a party to the conversation and their authorisation satisfies NRS 200.650. The recording is also not surreptitious if the patient is told. Nevada does not force you into the recorded announcement design that Washington requires. Tell the patient anyway: consent is the professional standard, it is what your board will expect, and if you operate in more than one state you are building the announcement regardless.

For an AI phone agent, telehealth over a wire, or a recorded call in the billing office, the answer flips. Every participant must consent, the announcement belongs in the agent's opening line before anything else is captured, and the penalty for getting it wrong is a category D felony under NRS 200.690 plus civil liability. Two practical points: a caller who hangs up during the announcement has not consented and the audio must be discarded, and a warm transfer that brings a third person on to the line needs consent from that person too.

Video adds a third rule. Nevada's video surveillance provisions cover recording in places where a person has a reasonable expectation of privacy, which an examination room plainly is, so a video enabled scribe is a separate consent conversation from an audio one.

Three layers, and the one that catches AI vendors is the least discussed.

Consumer health data. NRS 603A.400 to 603A.550, operative March 31, 2024, apply to a person conducting business in Nevada or targeting Nevada consumers who determines the purpose and means of processing, sharing or selling consumer health data. The duties are a published consumer health data privacy policy, consent before collection, a separate authorization before any sale, access and deletion rights, and a ban on geofencing within one thousand seven hundred and fifty feet of a medical facility to identify or track consumers or to send them health related advertising. Data already covered by HIPAA is exempt, so your scribe operating under a business associate agreement is outside these provisions. What is inside is everything before the treatment relationship starts: the symptom checker on your website, the marketing chatbot, the wellness app, the recording of a caller who never becomes a patient. Nevada has no private right of action here, which makes it materially softer than Washington but not softer than your reputation.

Security of personal information. NRS 603A.210 requires any data collector maintaining records with a Nevada resident's personal information to implement and maintain reasonable security measures to protect them from unauthorised access, acquisition, destruction, use, modification or disclosure. NRS 603A.215 adds an encryption duty when personal information is transferred outside the secure system of the data collector. Read that against how AI vendors actually work: audio leaving the practice for transcription, transcripts moving between subprocessors, prompts and outputs sitting in a vendor's logging pipeline. Ask where each of those hops is encrypted and who holds the keys, and ask which subprocessors sit in the chain, before the contract is signed rather than after a breach.

Health care records. NRS 629.051 requires a custodian of health care records to retain them for five years, and forbids destroying the records of a person under twenty three years of age. AI generated content that becomes part of the record inherits that obligation. If a vendor deletes audio after thirty days but the note derived from it is the record, be clear which artefact is the record and which is transient, and put the answer in the contract. Our vendor question list and the scribe checklist cover the rest of the federal layer, which HIPAA still supplies in full.

No. Checked September 2026.

The Nevada State Board of Medical Examiners, which licenses physicians, physician assistants, respiratory care practitioners, perfusionists, anesthesiologist assistants and genetic counsellors, has published no policy, advisory or position statement on artificial intelligence in documentation or in clinical decision making. Its published newsletters have discussed AI in healthcare in general terms, most recently and briefly, which is commentary rather than guidance and should not be quoted to a surveyor as though it were a standard.

The Nevada State Board of Nursing has likewise published no formal guidance. Its newsletters discuss AI in nursing education and the need for AI to strengthen rather than replace clinical judgement. That is a statement of philosophy, not a rule, and there is no Nevada equivalent of the Washington Medical Commission's draft policy on artificial, assistive and augmented intelligence.

Do not read the absence as permission. Where a board has no AI policy it still has an unprofessional conduct standard, and AB 406 expressly routes violations into it for mental and behavioral health providers. The practical default is the Federation of State Medical Boards position that a clinician remains fully responsible for any output they adopt, and the disciplinary theory in a Nevada case would be the ordinary one: the note was wrong, the clinician signed it, the record is the evidence. Write your internal policy to that standard now, using the practice AI policy template, rather than waiting for a board to publish one. If you want to check which duties actually bind you across the states you operate in, the healthcare AI law checker is the fastest route.

Yes. Nevada tried to stop it and the bill was vetoed, which leaves providers with less protection here than in most neighbouring states.

SB 128 of 2025 prescribed requirements governing the denial of prior authorization requests, including limits on the use of artificial intelligence to deny or modify a request. It passed the Senate 15 to 6 on April 22, 2025 and the Assembly 23 to 16 on May 31, 2025. Governor Lombardo vetoed it on June 10, 2025. His veto message says the bill "unnecessarily micromanages how private insurers and public employee insurance programs use AI, risking the stifling of innovation even when such technology can improve efficiency and lower costs", and that given how new AI is it made more sense to understand its benefits before imposing restrictive measures.

What did pass was AB 463, effective January 1, 2026, which tightens prior authorization response times for Medicaid and managed care organisations. It is a turnaround statute and says nothing about artificial intelligence.

The regulatory backstop is Division of Insurance Bulletin 24-001, adopted on February 23, 2024, which brings the NAIC model bulletin on the use of AI systems by insurers into Nevada. It is not a rule and creates no new cause of action, but it sets the Division's expectation that a carrier maintains a written AI systems programme with governance, risk controls, testing and third party vendor oversight, and it tells carriers which documentation the Division may demand on examination. That is the lever a provider actually has: a denial that cannot be traced to a documented programme and a named clinical reviewer is a complaint the Division will recognise.

So in Nevada, appeal volume is your protection rather than statute. If you are building prior authorization automation on the provider side, that argues for investing in the appeal path rather than only in submission speed, and for keeping the federal CMS interoperability and prior authorization rule timelines as your reference point. Expect the SB 128 provisions to return in February 2027.

Six things, in order of how quickly they pay back.

1. Separate your behavioral health estate from everything else. AB 406 draws its line by scope of practice. Any AI touching a mental or behavioral health encounter needs its own review; a primary care approval does not carry across.
2. Turn off in session assistance in behavioral health. Copilots, live suggestions, risk scores presented during the session and any patient facing conversational feature. Record the configuration decision, the date and who made it.
3. Make attestation a gate on every AI generated note. Nothing auto files. The independent review duty in AB 406 is what a board will test, and the audit log is the only evidence of it.
4. Fix the phone before the exam room. All party consent applies to calls, not to in person encounters. Put the announcement in the agent's first utterance, confirm the audio is discarded when a caller declines, and cover warm transfers.
5. Map which vendor processing is outside your business associate agreement. That is exactly where the consumer health data provisions and the geofencing ban live, and it is usually marketing technology rather than clinical technology.
6. Write the policy to a 2027 standard, not a 2026 one. Nevada does not sit again until February 2027, and a disclosure duty and a payer side AI restriction are both plausible. A NIST aligned programme with an inventory, a review cycle and per system documentation absorbs either without a rebuild.

Nevada rewards a specific kind of discipline. Most of the compliance load is not paperwork, it is configuration: which features are enabled, for which specialty, at which site, with which log. Vendors sell one product and rarely surface those switches during a demo, which is how an organisation ends up with a national contract that quietly breaches a Nevada prohibition in one service line.

That mapping, from statute to specific settings in specific tools, is what our AI governance and compliance engagement produces, and it usually starts with the estate inventory from an AI readiness audit. We take no vendor commissions, so the recommendation to disable a feature you are paying for costs us nothing to make. If you want a view on your Nevada exposure before your next renewal, book a call.