Law / United States / 
Indiana
Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)
In force since .
An AI risk obligations rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- Do not use an automated process, system, or tool, including artificial intelligence, as the sole basis to downcode a health benefits claim based on medical necessity, unless an employee or contractor has first reviewed the covered individual's medical recordNIST AI RMFMAP 3.5
- Disclose, in an easily accessible and readable manner, whenever artificial intelligence is used to make an adverse determination on a prior authorization request or to downcode a claimNIST AI RMFMEASURE 2.8
- This chapter does not reach claims under the Medicaid program or a Medicaid managed care organization
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
1 more
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Section 9(a) requires an employee or contractor to review the covered individual's medical record before an automated tool may be the sole basis for a downcode; section 9(c) requires the insurer to disclose when artificial intelligence is used to make an adverse determination or to downcode a claim; and section 11 requires the insurer to notify the provider of the specific reason, the clinical criteria and the original and revised codes and payment amounts whenever a claim is downcoded. Each of these is a point-in-time disclosure or process condition tied to the claim transaction itself; no section of this chapter requires the insurer to keep, document or later produce a record of the review or the disclosure, and none gives a regulator, court or auditor a route to demand one.
- Kind
- None
- As of
What this law does
A new Indiana Code chapter on downcoding of health benefits claims bars a health insurer, HMO, or dental preferred-provider plan from using an automated process, system, or tool, including artificial intelligence, as the sole basis to downcode a claim based on medical necessity, without a covered individual's medical record first being reviewed by an insurer employee or contractor; it likewise bars a provider from submitting a claim through such an automated tool without human review.
The insurer must disclose, in an easily accessible and readable manner, whenever artificial intelligence is used to make an adverse determination on a prior authorization request or to downcode a claim. The chapter does not apply to the Medicaid program or a Medicaid managed care organization. Enacted as House Enrolled Act 1271, it took effect under the act's own effective-date clause.
When LexLint raises it
When your app profile says your app makes health care decisions or makes insurance decisions.
Back to the example · Lint your app
Page updated .