New Jersey AI Laws for Healthcare Providers: What Applies in 2026 and What Is Still a Bill

No. As of September 2026 New Jersey has not enacted a statute that regulates the use of artificial intelligence by healthcare providers, and it has not enacted a Colorado style algorithmic discrimination act or a Texas style disclosure duty. We checked the 2024 to 2025 and 2026 to 2027 sessions on the legislature's site and the Attorney General's publications, and the honest summary is that New Jersey regulates AI in healthcare through four older instruments pointed at new technology, plus a queue of pending bills.

That does not make it a light state. The Attorney General's January 2025 guidance on algorithmic discrimination is broader in reach than most enacted AI laws, because it says the Law Against Discrimination already prohibits algorithmic discrimination in places of public accommodation, and it removes the vendor defence. The New Jersey Data Privacy Act reaches your marketing, website and call centre data with a profiling opt out and an assessment duty. The 2025 prior authorization act puts a physician between any automated review and a denial. And the licensing boards' records and telemedicine rules apply to an AI drafted note exactly as they apply to a typed one.

Compare that with the states that have legislated. Colorado regulates consequential decisions and requires human review on request. Texas requires a provider to tell the patient AI was used in relation to treatment. California regulates patient communications and payer denials. New Jersey has, for now, none of those specific duties, which means the compliance work is inference from general law rather than a checklist read off a statute. Our state by state map places New Jersey in the group of states governed by AG guidance and privacy law rather than by an AI act.

It means an AI tool that produces a discriminatory outcome is your Law Against Discrimination problem, not the vendor's, even if you cannot see inside the model.

The Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination was issued on January 9, 2025 by Attorney General Platkin and the Division on Civil Rights alongside a new Civil Rights and Technology Initiative. It is guidance, not a rule, but it states the Division's enforcement position on a statute that already exists. Four points carry over directly to healthcare.

• Places of public accommodation are covered. The guidance names employers, housing providers, places of public accommodation and other LAD covered entities. Hospitals, clinics and medical offices are places of public accommodation under N.J.S.A. 10:5-5(l).
• Health care is one of its own examples. The document opens by listing decisions about who receives certain medical treatments or insurance coverage for that treatment, and its worked example is the population health risk score that under estimated the needs of Black patients because it used past spend as a proxy for need.
• No vendor defence. In the Division's words, a covered entity that engages in algorithmic discrimination may be held liable for violating the LAD even if the covered entity uses a tool it did not develop. It adds that this is so even if the entity does not understand how the tool works.
• Disparate impact counts. The LAD prohibits practices that have a disparate impact on a protected class unless they are justified and no less discriminatory alternative exists. Intent is not required, which is the opposite of the Texas position.

For a practice this reaches scheduling prioritisation, inbox triage that ranks urgency, risk stratification for outreach, no show prediction used to overbook, and any patient facing agent that offers different options to different callers. The defensible posture is the one the guidance describes: know what the tool is used for, test it for disparate outcomes across protected classes before and after deployment, keep the results, and be able to explain a less discriminatory alternative was considered. That is the same evidence a governance programme produces for Colorado, so building it once is not wasted in New Jersey.

Yes, for everything HIPAA does not cover, and the boundary is narrower than most practices assume.

The New Jersey Data Privacy Act, P.L.2023, c.266, codified at N.J.S.A. 56:8-166.4 et seq., took effect on January 15, 2025. It applies to controllers that conduct business in New Jersey or target New Jersey residents and that, in a calendar year, control or process the personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving revenue or a discount from the sale of personal data. A multi site group or a health system's marketing function crosses the first threshold easily.

The health provisions that matter:

• Sensitive data includes data revealing a mental or physical health condition, treatment or diagnosis, sex life or sexual orientation, and genetic or biometric data. Processing it requires the consumer's consent.
• Profiling opt out. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, which the act defines to include access to health care services. Any AI that scores prospective patients for eligibility or financial risk is inside this.
• Data protection assessments are required before processing that presents a heightened risk of harm, which includes processing sensitive data and profiling with a foreseeable risk of unfair treatment.
• Exemptions. Protected health information under HIPAA is exempt, and covered entities and business associates are exempt to the extent they are handling PHI. The exemption follows the data, not the organisation, so a hospital's website analytics, marketing lists, appointment reminder programmes for non patients and call recordings that are not part of the designated record set are all in scope.

Two developments this year changed the enforcement picture. The Division of Consumer Affairs proposed implementing rules at N.J.A.C. 13:45L on June 2, 2025 and they lapsed on June 2, 2026 without adoption, so there is no regulatory gloss on any of these terms. And the guaranteed 30 day cure period ended on July 1, 2026. During that first eighteen months practitioners tracking the Division's cure letters reported that the common triggers were failing to honour Global Privacy Control signals and inaccurate privacy notices. Violations are Consumer Fraud Act violations, up to ten thousand dollars for a first offence and twenty thousand dollars thereafter, with no private right of action.

What to do: map which AI vendors touch non PHI personal data, execute a compliant processor contract with each of them in addition to any BAA, add the profiling opt out to your privacy notice, and write the data protection assessment before the tool goes live. The HIPAA and AI baseline covers the clinical data; the NJDPA covers the rest.

The same thing they expected before: a licensee who is responsible for the record, the consent and the decision. The State Board of Medical Examiners has not published AI specific guidance as of September 2026, and we could not find a position statement on ambient documentation on its site. That absence is not permission. It means the existing rules apply without adaptation.

The rule that governs an AI scribe in New Jersey is N.J.A.C. 13:35-6.5 on the preparation of patient records. It requires a contemporaneous, permanent record for each patient that is accurate and legible, and it requires the licensee to be responsible for the record's content. A draft generated from an ambient recording and filed without the clinician reading it is an unsigned, unverified record, and the licensee, not the vendor, answers for it. The practical requirement is an attestation gate: no AI generated text enters the chart until the clinician has reviewed and authenticated it, and the audit log shows who did so and when.

The legislature may soon give the boards something more specific. A4731, advanced by the Assembly Regulated Professions Committee on May 28, 2026, would direct the Director of the Division of Consumer Affairs to adopt a model policy for licensee use of generative AI within six months of enactment, which each board could then adopt for its profession. If it passes, expect a written policy requirement, a disclosure expectation and a competence expectation to flow to every New Jersey licensee. A related bill, A4733, would prohibit advertising generative AI as capable of practising a regulated profession. Both were pending as of September 2026.

Until then, the most useful national reference is the Federation of State Medical Boards' April 2024 guidance on responsible and ethical incorporation of AI into clinical practice, which New Jersey's board participates in through the Federation. Its expectations on transparency, documentation and accountability are the ones a New Jersey investigator will reach for. A written practice policy, built from our AI policy template for medical practices, is the cheapest way to show you met them.

Two separate bodies of law, and each catches a different part of an AI deployment.

Telemedicine and telehealth. P.L.2017, c.117, at N.J.S.A. 45:1-61 et seq., and the Board of Medical Examiners' implementing rules at N.J.A.C. 13:35-6B, govern any remote encounter. The provider must verify the patient's identity, disclose their own name, credentials and licence, determine and record the patient's originating site, review the medical history and records before an initial encounter, and obtain consent, which the statute allows to be oral, written or digital provided the method is appropriate under the standard of care. Telemedicine, as distinct from telehealth, requires real time two way audio and video for the clinical encounter itself. An AI intake agent that collects history before a video visit is doing part of the record review the provider must own, and an AI that conducts the clinical conversation by voice alone is not telemedicine under these rules. Configure the agent to collect and hand off, not to practise.

Call recording. New Jersey is a one party consent state. N.J.S.A. 2A:156A-4(d) permits a person to intercept a wire, electronic or oral communication where that person is a party to it or one party has given prior consent, unless the purpose is criminal or tortious. On its face a practice can record its own calls and its own visits. Three cautions follow. First, the AI vendor that processes the audio is not a party to the conversation, so the practice's consent must cover the vendor's processing and the contract must confine the vendor to that purpose. Second, a New Jersey clinic calling or seeing a patient located in a two party consent state such as Pennsylvania is bound by that state's rule for that call, which matters in the Delaware Valley. Third, an unauthorised interception is a crime and gives the injured party a civil claim for the greater of actual damages, one hundred dollars a day or one thousand dollars, plus punitive damages and fees.

The clean design is the same one Utah and California push you toward anyway: the AI phone agent identifies itself as an automated assistant in its opening line and states that the call is recorded, the ambient scribe is preceded by a spoken request for consent that is itself captured, and the consent language names the vendor category. If A4730 is enacted, the opening line disclosure becomes a Consumer Fraud Act requirement rather than a best practice, so build it now.

A physician sign off requirement that pre dates the AI debate, a regulator's bulletin on insurer AI, and a failed data bill that will probably return.

The Ensuring Transparency in Prior Authorization Act, P.L.2023, c.296, was signed on January 16, 2024 and took effect on January 1, 2025. Its legislative findings state that prior authorization should use an automated process to minimise burden, so the act is not hostile to automation. But C.17B:30-55.8 provides that any denial of a prior authorization request, or any limitation imposed on the basis of a utilization management determination, shall be made by a physician acting under the clinical direction of a medical director who is licensed in New Jersey and who strictly follows a published medical policy. That physician may not be paid by approval or denial rate. The effect is that an algorithm may approve and may flag, but a denial that reaches you must have a physician's decision behind it. The act also sets response times of 72 hours for urgent and seven calendar days for standard requests, makes chronic condition authorizations valid for 180 days, requires carriers to publish clinical criteria 30 days before use, and, from January 1, 2027, requires pharmacy benefit prior authorization to run through the NCPDP SCRIPT ePA standard.

DOBI Bulletin 25-03, issued February 11, 2025, adopts the NAIC model bulletin on the use of artificial intelligence systems by insurers for every insurer authorised or admitted in New Jersey. It expects a written AI systems programme covering governance, risk management, internal controls and third party vendor oversight, and it tells insurers that decisions made or supported by AI must comply with the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act and market conduct requirements. It is not directly enforceable against a carrier's AI vendor, but it gives you a specific document to cite in an appeal that questions whether an automated review was governed.

What New Jersey does not yet have is a statute like California's SB 1120 or Arizona's HB 2175 that names AI in the utilization review process. S3298 and A3858 in the 2024 to 2025 session would have required medical director review of every utilization management claim and public disclosure of whether a carrier uses an automated utilization management system and how many claims it reviewed. They died at the end of the session in January 2026. We could not confirm a 2026 to 2027 reintroduction on the legislature's site as of September 2026; check before relying on either number.

For a provider the practical consequences are on the appeal side. When a denial arrives, ask in writing for the name and licence of the physician who made the determination under C.17B:30-55.8 and for the published medical policy applied. Pair that with the federal timelines and API requirements in the CMS prior authorization rule. If you are buying prior authorization automation on the provider side, none of this restricts you, but your tool should capture the denial rationale in a form that supports the same specialty physician challenge the act enables.

Six, in the order they would change your operations. Status is as of September 2026 and should be re checked on the legislature's site before any decision that depends on them.

One correction to a common misreading. S4075 (2026), which some trackers list next to health bills, regulates AI based electronic monitoring and automated decision systems in employment and public services. It is a workforce bill, introduced May 4, 2026 and referred to the Senate Labor Committee. It would affect a hospital as an employer, not as a provider.

The healthcare AI law checker tracks these against your deployments, and the 2026 regulation tracker records status changes as they happen.

Seven items, ordered by how quickly each closes a real exposure.

1. Inventory every tool that ranks, scores or routes patients and test it for disparate impact. This is the Law Against Discrimination exposure the Attorney General described in January 2025, and the vendor's assurances are not a defence. Keep the test results and the record of alternatives considered.
2. Gate AI generated documentation behind clinician attestation. N.J.A.C. 13:35-6.5 makes the licensee responsible for the record. No AI draft enters the chart unsigned, and the audit log proves it.
3. Split your data map into PHI and everything else, and treat the second half under the NJDPA. Processor contracts with each AI vendor, a profiling opt out in the privacy notice, honour Global Privacy Control on the website, and a data protection assessment for any sensitive data or profiling use. The cure period is gone as of July 1, 2026.
4. Make every AI phone agent identify itself and announce recording in its first sentence. That satisfies the one party consent rule's spirit, covers the vendor's processing, and pre empts A4730 if it passes. Apply two party consent rules when the patient is in Pennsylvania or another all party state.
5. Precede ambient scribing with a captured spoken consent that names the vendor category. The telehealth statute permits oral consent where appropriate to the standard of care; the same principle serves in the exam room.
6. Write down the appeal script for automated denials. Name and licence of the deciding physician under C.17B:30-55.8, the published medical policy, and the timeline. Cite DOBI Bulletin 25-03 where the review looks unsupervised.
7. Adopt a written AI use policy now, so that when A4731 produces a board policy you are amending rather than starting. The AI policy template covers permitted uses, review duties, disclosure and vendor requirements.

Nothing on this list requires a New Jersey specific product. All of it is the same evidence set a Colorado or California deployment needs, applied to a state where the duties are inferred from general law rather than read off a statute.

Judgment about where general law lands on a specific tool, which is exactly what a vendor cannot sell you.

New Jersey's position is unusual. There is no statute to read, so a vendor can truthfully say there is no New Jersey AI law it fails to comply with. That statement is accurate and useless. The exposure sits in the Law Against Discrimination as the Attorney General has said it will be applied, in a privacy act with no implementing rules and no cure period, in licensing board records rules written before ambient recording existed, and in a set of bills that could become law inside a single session. Mapping a particular scribe, phone agent or triage model onto that requires someone who has read the guidance, knows what the Division's cure letters targeted, and has no commission riding on the answer.

Our AI governance and compliance engagement produces the artefacts this page keeps returning to: the tool inventory with disparate impact testing, the PHI and non PHI data map with NJDPA assessments, the attestation and consent configurations, the payer appeal script, and a written policy drafted so that A4731's model policy can be dropped in. Where you are earlier in the process, an AI readiness audit establishes the inventory first, and vendor selection applies the New Jersey questions before you sign rather than after. We do not take vendor commissions, so the recommendation is the same whichever product survives the review. Book a conversation and bring the contracts you are about to sign.