Oregon AI Laws for Healthcare Providers: HB 2748, the OCPA and What Applies in 2026

Not a general one, and that is the first thing to get straight before buying anything. Oregon has no equivalent of the Colorado AI Act, no equivalent of Texas TRAIGA, and no statute on AI in utilization review. The Department of Justice said as much in its December 24, 2024 guidance: Oregon will apply the laws it already has, the Unlawful Trade Practices Act, the Consumer Privacy Act and the Equality Act, to AI developers and deployers.

What Oregon does have is a set of narrow, specific rules that land on a clinic in different places:

• HB 2748 (2025), chapter 378, Oregon Laws 2025. From January 1, 2026 a nonhuman entity, including an AI agent, may not use the titles nurse, registered nurse, licensed practical nurse, advanced practice registered nurse, nurse practitioner, clinical nurse specialist, certified registered nurse anesthetist, certified medication aide or certified nursing assistant, or their abbreviations.
• The Oregon Consumer Privacy Act, ORS 646A.570 to 646A.589. In force since July 1, 2024, extended to nonprofits on July 1, 2025, and enforced without a cure period since January 1, 2026. It treats data revealing a mental or physical condition or diagnosis as sensitive data requiring consent, and it defines a decision about health care services as one with legal or similarly significant effects for the purpose of profiling opt outs.
• The Oregon Medical Board Statement of Philosophy on AI, adopted April 4, 2024, which is how the Board will frame a complaint about AI assisted care.
• ORS 165.540, which governs recording of conversations and calls, and is the statute an ambient scribe or an AI phone agent triggers first.
• SB 1546 (2026), on AI companions, operative January 1, 2027, which matters to behavioural health deployments.

Everything else is federal. The HIPAA baseline and the CMS prior authorization rule do more work in Oregon than any state statute, which is the opposite of the position in California or Colorado. Our state AI law map shows where Oregon sits relative to its neighbours.

Calling itself a nurse. That is the whole statute, and it is more relevant to procurement than it sounds.

HB 2748 was introduced on January 13, 2025 by Representative Travis Nelson, a registered nurse, after a vendor advertised an AI product performing nursing tasks at a per hour price. It passed the House on March 4, 2025, was signed on July 25, 2025 as chapter 378, Oregon Laws 2025, and took effect on January 1, 2026. It adds a section to the Nurse Practice Act, ORS 678.010 to 678.410, providing that a nonhuman entity, including an artificial intelligence agent, may not use the protected nursing titles or their abbreviations. Existing law already restricted those titles to licensed individuals; the bill closes the gap for software.

Three practical consequences for an Oregon organisation.

• Vendor persona names. Several AI phone agent and patient engagement products ship with a default persona described as a virtual nurse or a nurse assistant. In Oregon that configuration is now unlawful on its face. Rename it before go live, and put the restriction in the contract so the vendor cannot reintroduce it in an update.
• Care management outreach. Automated calls that say this is your care team nurse checking in, or texts signed by a nursing title when generated and sent by a model without a licensed nurse behind them, fall inside the prohibition. The statute does not turn on whether a nurse reviewed the script.
• Physician titles are not covered. HB 2748 amends the Nurse Practice Act only. Whether an AI agent may describe itself as a doctor is governed by the Medical Practice Act's existing title provisions and the Unlawful Trade Practices Act, not by HB 2748. Do not read the bill as a general ban on clinical titles, and do not read its silence as permission.

Enforcement runs through the Oregon State Board of Nursing as the administrator of the Nurse Practice Act. We checked the enrolled text for the prohibition in September 2026; confirm the specific sanction for a nonhuman entity against chapter 378 before quoting a penalty figure internally. The Board's Fall 2024 Sentinel article, AI in Healthcare: A Powerful Tool, but Not a Replacement for Human Expertise, tells you how it thinks: AI complements a nurse's assessment and judgment and does not replace them.

Accountability, literacy and no complacency. The Board's Statement of Philosophy on Artificial/Augmented Intelligence, adopted April 4, 2024, is not an administrative rule, but statements of philosophy are how the Board signals the standard it will apply when a complaint arrives.

The statement makes four points that translate directly into an ambient scribe or clinical decision support deployment.

1. The licensee remains responsible for the care provided. There is no shared liability with a vendor in a Board proceeding. A note generated by a scribe and signed by the physician is the physician's note.
2. Basic AI literacy is expected. Licensees should be able to understand the technology and how to use it, explain its capabilities and limitations, assess the quality of its outputs, and identify and guard against bias in AI algorithms. That is a training requirement in all but name, and it belongs in onboarding for any AI tool, not in a policy binder.
3. Guard against complacency. Licensees must not compromise their own medical decision making by becoming overly reliant on AI. Operationally that means review is real, not a click through, and the organisation can show it: edit rates, time in note before signature, and a sample audit programme.
4. Tech fluency is part of the standard of care. The Board recommends clinicians become fluent in relevant AI tools to keep pace with the increasing standard of care. That cuts both ways: it protects a clinician who uses a validated tool well and exposes one who ignores it or uses it badly.

The Board has not published a rule on AI documentation, consent for AI use or disclosure to patients as of September 2026. Its telemedicine position adds the general rule that telemedicine is a delivery tool rather than a separate form of medicine and that the same standard of care applies. For documentation, the baseline is the medical records rule at OAR 847-012-0000, which requires legible, accurate and complete records; a hallucinated medication or an unedited template is a records violation before it is an AI problem. Our AI policy template for medical practices is written to satisfy exactly these four expectations.

Through the shape of its HIPAA exemption. Unlike most state privacy laws, the OCPA does not exempt covered entities. ORS 646A.572 exempts protected health information that a covered entity or business associate processes under HIPAA. That is a data level carve out. Everything a health organisation holds that is not PHI, and every vendor relationship that is not a business associate relationship, is potentially inside the Act.

Scope and dates first. The OCPA applies to a person doing business in Oregon that controls or processes the personal data of 100,000 or more consumers, or 25,000 or more consumers while deriving 25 percent or more of revenue from selling personal data. It took effect on July 1, 2024. Nonprofits came in on July 1, 2025, which brought most of Oregon's hospital systems, federally qualified health centres and community mental health programmes into scope for their non PHI data. The thirty day right to cure expired on January 1, 2026. Public bodies, including Oregon Health and Science University, are excluded.

Four provisions matter to AI deployments, and the Department of Justice's December 2024 guidance flags each of them.

• Sensitive data consent. ORS 646A.570 defines sensitive data to include data revealing a mental or physical condition or diagnosis, genetic or biometric data, and precise geolocation within 1,750 feet. Processing it requires consent. A symptom checker on the public website, a wellness app, or a marketing model built on appointment history is processing sensitive data outside the HIPAA exemption if the data was not collected as PHI.
• Training data. The guidance states that using personal data to train AI must be disclosed in the privacy notice under ORS 646A.578, that sensitive data cannot be used for training without explicit consent, and that a controller cannot legitimise secondary use by quietly editing its notice. Ask every vendor, in writing, whether Oregon consumer data trains their models.
• Profiling opt out. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and ORS 646A.570 lists health care services among those decisions. An eligibility, financial assistance or outreach prioritisation model built on non PHI data is exactly that.
• Data protection assessments. ORS 646A.586 requires an assessment before profiling or processing sensitive data. The guidance says feeding consumer data into AI models likely poses heightened risk. Keep the assessment; the Attorney General can request it.

HB 2008 added two flat prohibitions from January 1, 2026: no sale of precise geolocation data and no sale of personal data of a consumer under 16. Check that patient portal analytics and any location based marketing vendor are not sharing in a way the Act counts as a sale. Penalties are up to seven thousand five hundred dollars per violation, enforced exclusively by the Attorney General. Our healthcare AI law checker walks through which of your data flows sit inside and outside the exemption.

Oregon's rule is unusual and it splits by channel, so the answer for a scribe is different from the answer for a phone agent.

ORS 165.540(1)(c) makes it unlawful to obtain or attempt to obtain the whole or any part of a conversation by means of any device if not all participants in the conversation are specifically informed that their conversation is being obtained. A conversation means an in person, oral communication. An ambient scribe in an exam room is obtaining a conversation. Every participant, the patient, any family member present, an interpreter and the clinician, must be specifically informed. A poster in the waiting room does not specifically inform anyone. A line in the consent to treat signed at the first visit does not specifically inform the family member who came to the third visit. The reliable design is a verbal statement at the start of each recorded encounter, logged in the note, with the scribe not started until it is given.

ORS 165.540(1)(a) sets a different rule for telecommunications: obtaining a telephone call is unlawful unless consent is given by at least one participant. An AI phone agent operated by the clinic is, in effect, a participant acting with the clinic's consent, so a one party rule is technically satisfied. Do not build to that. The call may reach a patient in Washington or California, both of which are all party consent states, and the Unlawful Trade Practices Act and the DOJ guidance treat an undisclosed AI voice as a potential misrepresentation. Announce the recording and the AI at the top of every call.

Violation of ORS 165.540(1) is a Class A misdemeanour and ORS 133.739 provides a civil action for the person recorded. The exceptions in ORS 165.540(5) and (6), which cover matters such as public meetings, law enforcement and felonies in progress, do not help a clinical deployment.

Telehealth adds the Medical Board's requirement that a physician hold an Oregon licence or a telemedicine licence when the patient is in Oregon, and its expectation of informed consent covering the limitations of the medium. Neither addresses AI directly. The operational rule that satisfies all of it is simple: one scripted disclosure that covers recording, the presence of AI and how to reach a human, delivered at the start of every recorded or automated interaction and stored as evidence. That single script also satisfies the Utah and Texas disclosure duties and California's AB 3030 placement rules, which is why we build it once.

Not specifically, as of September 2026, and the one attempt so far failed.

HB 4054 (2026) would have amended ORS 743B.423 to require insurers to tell a provider when artificial intelligence was used to downcode a claim and to offer an appeal. It was heard in the Joint Committee on Information Management and Technology on February 6, 2026 and did not receive a floor vote before the session adjourned on March 9, 2026. Its status is dead for the 2026 session; expect a successor in 2027. Oregon has not enacted anything like Arizona's HB 2175 or Maryland's HB 820, both of which require a physician to review AI assisted denials, and it has not adopted the NAIC model bulletin on insurer use of AI as far as we could confirm on the Division of Financial Regulation's site.

What does apply is technology neutral and still useful.

• ORS 743B.420 sets the prior authorization framework for health benefit plans, including timelines and the requirement that criteria be available to providers.
• ORS 743B.423 requires insurers that conduct utilization review to file an annual summary of their utilization review policies with DCBS and to document procedures for monitoring them. An AI driven review process is a utilization review policy and belongs in that filing.
• HB 3134 (2025) moved the insurer aggregate prior authorization data report to January 31 each year, with DCBS publishing anonymised aggregates by March 1, and barred separate prior authorization for a related procedure found during an authorised surgery. DFR opened rulemaking on the reporting requirement in October 2025.
• The federal CMS rule, CMS-0057-F, imposes the decision timelines, denial reason requirements and FHIR prior authorization APIs on Medicare Advantage, Medicaid managed care and exchange plans regardless of state law. For Oregon Health Plan, the Oregon Health Authority updated its prior authorization processing timeframe and reporting guidance for coordinated care organisations on March 31, 2026, with the CCO API requirements due January 1, 2027.

For a provider, the practical position is that prior authorization automation on your side of the transaction is governed by HIPAA, your payer contracts and the CMS APIs, not by Oregon statute. On the payer side, a denial you suspect was produced by an algorithm without clinical review is challenged through the appeal and external review rights in ORS 743B.250 and following, and through the utilization review filing, not through an AI specific law. Our CMS prior authorization rule page covers the federal timelines that bind Oregon plans.

Only if you run something that behaves like a companion, and behavioural health engagement tools sometimes do.

SB 1546 (2026) was signed on March 31, 2026 and takes effect on January 1, 2027. It regulates operators of artificial intelligence companions, defined around systems that simulate a sustained human like relationship or companionship and retain contextual information across interactions to personalise engagement. Operators must clearly disclose that the user is interacting with AI wherever a reasonable person might believe otherwise, implement evidence based protocols for detecting suicidal or self harm ideation and refer users to the 988 Suicide and Crisis Lifeline and, for users under 25, YouthLine, apply additional protections for minors including break reminders and a bar on sexually explicit content, avoid engagement maximising reward loops and emotional manipulation, and publish annual reports. Enforcement is by a private right of action: actual or statutory damages of one thousand dollars per violation, injunctive relief and attorney fees.

We did not confirm on a primary source whether the enrolled text exempts licensed health care providers, HIPAA covered entities or clinical tools operated under a clinician's supervision. Treat that as open until you have read the chapter law, and assume the following exposure map in the meantime.

For a behavioural health organisation the safe reading is that any conversational tool that keeps a persona and a memory across sessions should already meet the crisis detection and disclosure requirements, because they are clinically sensible regardless of whether the statute reaches you.

Seven items, ordered by how quickly each closes a live exposure.

1. Audit every AI persona for nursing titles. HB 2748 has been operative since January 1, 2026. Search vendor configurations, IVR scripts, chatbot names, outreach templates and email signatures for nurse, RN, LPN, NP, CNA and the rest. Rename, and write the prohibition into the vendor contract.
2. Script the recording and AI disclosure and log it. For in person scribes, specifically inform every participant at the start of every recorded encounter under ORS 165.540(1)(c). For phone agents, announce recording and AI at the top of the call even though Oregon's telephone rule is one party, because your patients cross state lines.
3. Map your non PHI data against the OCPA. Website and app analytics, marketing, wellness programmes, community outreach and any consumer facing tool sit outside the HIPAA exemption. If you are a nonprofit you have been in scope since July 1, 2025 and the cure period is gone. Confirm consent for sensitive data, the profiling opt out for health care service decisions, and a data protection assessment for each AI system that touches this data.
4. Put the training data question to every vendor in writing. The DOJ guidance treats undisclosed training on personal data as an OCPA problem and undisclosed limitations as an Unlawful Trade Practices Act problem. Get the answer before signature, and the disclosure into your privacy notice.
5. Train clinicians to the Medical Board's four expectations. Literacy, ability to explain limitations, output quality assessment, bias awareness. Record attendance. Set an edit rate and sign off audit for the scribe and keep the results.
6. Check behavioural health tools against SB 1546 before January 1, 2027. Anything with a persistent persona and memory needs the crisis protocol and the disclosure in place, and a legal read on whether an exemption applies.
7. Watch two things for 2027. A successor to HB 4054 on payer AI, and any OCPA rulemaking or enforcement action from the Department of Justice, which now acts without a cure period.

Oregon is a light state on paper and an easy state to trip in, because the rules that bind you are scattered across a nursing statute, a privacy act, a wiretap provision and a licensing board's philosophy rather than collected in one AI law. The healthcare AI law checker is built to catch that spread.

Mostly the map. Because Oregon has no single AI statute, the vendor's compliance page will typically say HIPAA compliant and stop. It will not say whether the product's default persona breaches HB 2748, whether its recording flow specifically informs every participant under ORS 165.540, whether its analytics or model training pull your non PHI data into the OCPA, or whether its behavioural health module drifts into SB 1546 territory. Those are four different statutes with four different enforcers and none of them is a HIPAA question.

An independent advisor with no vendor commissions reads the deployment against all of them at once, and against the federal layer, then writes the disclosure script, the consent flow, the vendor contract clauses and the clinician training so that they also satisfy California, Colorado and Texas if your patients or your vendors cross those lines. That is what our AI governance and compliance engagement delivers, and for organisations still choosing a product it is folded into vendor selection. If you are about to sign an Oregon deployment, book a conversation before the persona name and the recording script are locked in the contract.