Virginia AI Laws for Healthcare: What Survived the HB 2094 Veto

No. Virginia has no statute of general application that regulates the development or deployment of AI, and none aimed at AI in clinical care.

That is not for lack of trying. HB 2094 passed both chambers in early 2025. It defined a high risk AI system as one that is a substantial factor in a consequential decision, and consequential decisions included the provision or denial of health care services. Deployers would have owed a duty of reasonable care against algorithmic discrimination, an impact assessment before deployment and on material change, pre decision notice to the consumer, and after an adverse decision a statement of the principal reasons, a chance to correct data and an appeal with human review. The Attorney General would have enforced it with civil penalties. Governor Youngkin vetoed it on March 24, 2025 and the veto was sustained on April 2, 2025.

The 2026 session then carried the successor bills to 2027 rather than passing them, as set out in the What changed section above. So the honest answer for a Virginia practice manager or CMIO in September 2026 is that the AI specific duties you see in Colorado, Texas and California have no Virginia counterpart. A vendor telling you its product is Virginia AI Act compliant is describing nothing.

What you have instead is a set of older laws that reach AI deployments because they reach the underlying activity: prior authorization, personal data, health records, recording and the practice of medicine. The rest of this page walks through each of them, then gives the checklist for this year. If you operate in several states, our state by state map and the healthcare AI law checker put Virginia next to the states that did legislate.

It makes a fully automated denial unlawful without ever saying the words artificial intelligence.

HB 481, effective July 1, 2026, amended section 38.2-3407.15:2 so that no carrier shall make an adverse determination of a prior authorization request for prescription drugs unless that determination has been reviewed and approved by a licensed physician or, if a licensed physician is not available, a licensed pharmacist. It amended section 38.2-3407.15:8 in parallel for health care services: review and approval by a licensed physician, or in mental health by a licensed mental health provider and in dental by a licensed dentist where a physician is unavailable. The current code text of both sections, which carry a January 1, 2027 effective date for their full API based electronic prior authorization requirements, contains that language and no reference to AI.

Read against payer practice, this is the same outcome that California's SB 1120 reaches by name. An algorithm can triage, score, draft and recommend. A licensed human must review and approve before a Virginia enrollee receives a denial. Two limits matter. First, the statute regulates carriers licensed in Virginia under title 38.2; self funded ERISA plans, Medicare Advantage and Medicaid managed care follow their own rules, including the CMS interoperability and prior authorization final rule. Second, it does not require the carrier to tell you an AI tool was used. SB 500 would have added that disclosure to the enrollee and the provider, together with 24 hour and five day decision windows and a gold card exemption for providers with high approval rates. Its AI language is not in the enacted code as of September 2026, and we could not confirm its final disposition on lis.virginia.gov, so treat it as not law.

For the provider side, section 38.2-3407.15:2 has required carriers since July 1, 2025 to run an online prior authorization process that links to e-prescribing and EHR systems and can approve requests that need no clinical review. That is the channel prior authorization automation should be built against, rather than portal scraping or fax. Ask your vendor which Virginia carriers it reaches through that process and which still require manual work.

Not the ones that sign a business associate agreement with you. Possibly the ones that do not, and that is where the exposure sits.

The VCDPA, Code of Virginia sections 59.1-575 to 59.1-585, has applied since January 1, 2023 to persons conducting business in Virginia that control or process personal data of at least 100,000 consumers a year, or 25,000 consumers while deriving over half of gross revenue from selling personal data. Section 59.1-576 then exempts a covered entity or business associate governed by the HIPAA privacy, security and breach notification rules at the entity level, and separately exempts protected health information, health records under title 32.1, HIPAA de-identified data, patient safety work product and human subjects research data at the data level. A hospital, practice or scribe vendor operating under a BAA is outside the Act for that work.

The gaps are practical rather than theoretical.

• Vendors that never become business associates. A consumer facing symptom checker, a wellness app you recommend, a recruitment screening tool, a marketing analytics platform or a chatbot on a public website that collects health information before any patient relationship exists is processing personal data, and under section 59.1-575 personal data revealing mental or physical health diagnosis is sensitive data. Section 59.1-578 requires consent before processing sensitive data.
• Profiling and significant decisions. The Act defines profiling to include automated processing to predict a person's health, and gives consumers an opt out from profiling in furtherance of decisions that produce legal or similarly significant effects, a list that expressly includes health care services. An AI tool that scores non patients, for example for outreach or eligibility, sits inside that language.
• Data protection assessments. Section 59.1-580 requires a controller to conduct and document a data protection assessment for processing sensitive data and for profiling that presents a reasonably foreseeable risk of unfair treatment or other substantial injury. The Attorney General can demand it.

Enforcement under section 59.1-584 is by the Attorney General alone, with 30 days written notice and cure, then up to 7,500 dollars per violation. There is no private right of action. The Act has been amended in 2022, 2024 and 2025; the 2025 amendment, chapter 703, is listed on law.lis.virginia.gov as effective September 1, 2026, so check the current text of any section you rely on. For the vendor questions that flush this out before signature, use the questions to ask AI vendors and read the HIPAA and AI page, because in Virginia HIPAA is still doing most of the work.

A state law duty of confidentiality that attaches to every licensed professional, not only to HIPAA covered entities, and a records standard that an AI scribe has to meet.

Section 32.1-127.1:03 states that no health care entity may disclose an individual's health records except as the section permits. A health care entity is defined to include every health care provider licensed by a Department of Health Professions board, health plans and clearinghouses. A health record is any written, printed or electronically recorded material maintained by a health care entity in the course of providing health services, together with confidential communications acquired in treatment. Disclosure for treatment, payment and health care operations is permitted, which is how an ambient scribe vendor acting on your behalf fits, but the statute is the reason a Virginia licensee cannot rely on a HIPAA gap. A cash only practice, a small counselling office that does not transact electronically, or a clinician using a personal AI tool outside the organisation's contracts is still bound.

The Board of Medicine's records regulation, 18VAC85-20-26, requires practitioners to maintain timely, accurate, legible and complete patient records, to comply with section 32.1-127.1:03, and to keep records for at least six years after the last patient encounter, longer for minors. Two consequences for AI medical scribes follow. The signed note is the practitioner's record and the practitioner is answerable for its accuracy, so a draft must be reviewed before it is filed. And the six year retention applies to the record you keep, not to the vendor's audio or transcript, so decide in the contract whether audio is retained, for how long and who can produce it in a complaint or a malpractice claim.

The Board had published no guidance document on AI as of September 2026. Its guidance document list includes 85-5 on medical records questions and 85-12 on telemedicine, and the Board of Nursing publishes 90-64 for nurse practitioners. Absent AI guidance, the Board will assess AI assisted documentation exactly as it assesses any other documentation: through the record and the licensee's signature on it. A written practice AI policy that says who reviews AI output, how and before what point is the evidence you will want if a record is ever questioned.

Less than in California, and more than nothing.

Recording. Section 19.2-62 makes it lawful to intercept a wire, electronic or oral communication where the person is a party to it or one party has given prior consent. Virginia is a one party consent state, and a violation is a Class 6 felony. Because the practice is a party to its own calls and visits, an AI phone agent recording inbound calls or an ambient scribe capturing a visit does not need the patient's consent under Virginia criminal law. Three reasons to obtain it anyway: callers in all party consent states such as Maryland, Pennsylvania and California are protected by their own law when they call you; the Board of Medicine's telemedicine guidance expects express consent before patient identifiable information is forwarded to a third party; and patients who discover recording after the fact complain to boards, not to statute books.

Telemedicine. Virginia has no statute defining telemedicine consent for clinicians. Section 38.2-3418.16 defines telemedicine services for coverage purposes and excludes audio only telephone, email, fax and online questionnaires on their own. Board of Medicine guidance document 85-12, revised October 28, 2018, fills the gap. It expects documented informed consent that identifies the practitioner and credentials, lists the activities permitted through telemedicine, describes security measures and residual privacy risk, and includes a requirement for express patient consent to forward patient identifiable information to a third party. It also expects written policies naming the health care personnel, in addition to the practitioner, who will process messages, and requires copies of patient practitioner electronic communications to be kept in the record.

Map that onto AI. An AI intake or triage agent handling patient messages is personnel who process messages in the sense of 85-12 and belongs in the written policy. A scribe vendor is a third party receiving patient identifiable information and belongs in the consent. A telehealth platform that transcribes visits needs the transcript, or a note derived from it, in the record. None of this is onerous. All of it is missing from most vendor onboarding packs, which is why an independent check of the consent and policy set before go live is worth more in Virginia than a legal opinion on a statute that does not exist.

No, and it is still worth reading.

Executive Order 30 of January 18, 2024, Implementation of Standards for the Safe Use of Artificial Intelligence Across the Commonwealth, directed the Virginia IT Agency to set standards for AI use by state government. The result is an Artificial Intelligence Standard and an AI Utilization Policy covering existing and new uses, stand alone, embedded and generative AI. Agencies register each AI use in the Commonwealth's technology portfolio and need approval from the agency IT resource, information security officer, agency head and cabinet secretary before deployment. The agency publishes bias assessment, vendor evaluation and incident response templates. The scope statement is Commonwealth agencies and suppliers.

Three situations pull a private organisation in. If you are a supplier to a state agency, a state teaching hospital or a Medicaid programme, your product is subject to the standard through the contract. If you are a vendor selling to Virginia's public universities, a separate higher education registration process applies. And if you are a private health system negotiating with a vendor that also sells to the Commonwealth, the vendor has already produced the bias assessment and inventory entries the state demanded, so ask for them.

The 2026 session added HB 797 and SB 384, which set up an AI safety advisory function under the Virginia IT Agency to evaluate frameworks for independent verification of AI model safety and credibility, and HB 580, which added AI fraud and abuse programmes to the Division of Consumer Counsel in the Attorney General's office. Neither imposes duties on a provider. Both indicate where Virginia guidance, if any comes before 2027, will be published. The federal baseline in HIPAA and AI and the NIST AI Risk Management Framework the state standard draws on remain the documents to build to.

Four measures were carried to the 2027 session and one was promised but not filed in a form we could confirm. Build for the parts that cost nothing to have early; do not build for the rest.

Two of these are worth acting on now because the action is free. If you run a behavioural health service, adopt the SB 269 posture voluntarily: AI for scheduling, documentation and admin, no AI delivering therapy or counselling without a licensed provider in control of the session. That is already the rule in Colorado and Utah and it is the direction of every board in the country. And if you receive prior authorization denials, start recording whether the carrier disclosed AI involvement, because SB 500 style disclosure is the next step after HB 481 and your data will be the evidence for it.

Do not build an HB 2094 impact assessment programme on the assumption the bill returns in the same form. The federal pressure that stalled the 2026 bills has not lifted, the 2027 text will differ, and the artefacts you would need, an inventory, a risk assessment per system and a human review path, are the same ones Colorado already requires if you operate there. Build those once for the state that binds you and Virginia is covered when it legislates.

Seven items, ordered by how soon each one can hurt you.

1. Put every AI vendor into one of two boxes: business associate or VCDPA controller. A BAA takes the vendor and the data outside the Consumer Data Protection Act. A vendor with no BAA that touches health related data of Virginia residents needs consent for sensitive data, a data protection assessment and an opt out route under sections 59.1-578 and 59.1-580. Marketing, recruitment and public website chatbots are the usual misses.
2. Gate AI drafted notes behind clinician review and signature. 18VAC85-20-26 makes the practitioner responsible for timely, accurate and complete records. Configure the scribe so no draft files unsigned, and write the review step into policy.
3. Update telemedicine and visit consent for third parties. Guidance document 85-12 expects express consent before patient identifiable information goes to a third party. Name the scribe and any AI agent category in the consent and in the written policy that lists who processes messages.
4. Announce recording on calls even though Virginia is one party consent. Section 19.2-62 protects you in Virginia; it does not protect you from a Maryland or Pennsylvania caller's law, and an announced recording avoids the board complaint.
5. Decide audio and transcript retention in the contract. Your record must be kept six years. Decide separately whether the vendor keeps audio at all, for how long, and how it is produced in a complaint or claim.
6. Log AI involvement in every prior authorization denial you receive. HB 481 requires a licensed physician or named fallback to have approved the denial from July 1, 2026. Where a denial looks automated, request the reviewer's identity and credential in the appeal and report patterns to the Bureau of Insurance.
7. Hold vendors to the Commonwealth's own AI standard. Ask for the bias assessment, inventory entry and incident response plan the Virginia IT Agency requires of state suppliers. A vendor that sells to the state has them; one that does not should be able to produce equivalents.

Virginia's position is unusual: it is one veto and one carried over session away from a Colorado style regime, and in the meantime its obligations are scattered across insurance, privacy, records and criminal law rather than collected in one place. That scattering is where practices fail, because no single owner sees all of it. Our AI governance and compliance engagement builds the inventory, the vendor classification and the consent and policy set once, mapped to Virginia today and to the 2027 bills as they move. It usually starts with an AI readiness audit of what is already running. Book a call if you would rather have that done before the next session opens than after.