Law / United States / 
Maryland
HB 820 / Ch. 747 (2025), Artificial Intelligence in Health Insurance Utilization Review
Md. Code Ann., Ins. §15-10B-05.1
In force since .
An AI risk obligations rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Self, Regulator
- Where the report goes
- Produced on request
What it requires
- Base any determination an AI, algorithm, or other software tool makes in utilization review on the enrollee's own medical or clinical history, individual clinical circumstances, or other relevant clinical information in the enrollee's record, never solely on a group dataset.NIST AI RMFMAP 2.3
- Keep a health care provider in the determination process; the tool may not replace that role.NIST AI RMFMAP 3.5
- Ensure the tool is fairly and equitably applied and does not result in unfair discrimination or directly or indirectly cause harm to an enrollee.NIST AI RMFMEASURE 2.11
- Make the tool available for audit or compliance review by the Insurance Commissioner, and review its performance, use, and outcomes at least quarterly.NIST AI RMFMEASURE 2.4NIST AI RMFGOVERN 1.1
- The tool may not itself deny, delay, or modify health care services.NIST AI RMFMAP 3.3
- This applies to carriers, and to pharmacy benefits managers or private review agents that conduct utilization review on a carrier's behalf.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis, Human involvement, Output reference
Logging duty
Section 15-10B-05.1 requires the utilization-review tool to stay open to inspection for audit or compliance review by the Insurance Commissioner, requires written policies and procedures describing how the tool is used and overseen to be filed in the utilization plan, and requires the tool's performance, use, and outcomes to be reviewed and revised at least quarterly. The section never uses the words logs, records, or audit trail, but a quarterly review of performance and outcomes, and an inspection the Commissioner can conduct at any time, cannot happen without something kept between reviews to inspect. The section states no period the material must be kept for and names nobody besides the Commissioner who may see it.
- Kind
- Implicit
- As of
- Provision
- §15-10B-05.1(c)(7) to (9)
- Trigger
- automated_decisions
What this law does
Effective , a carrier, pharmacy benefits manager, or private review agent that uses artificial intelligence, an algorithm, or other software tool to conduct utilization review must base its determinations on the enrollee's own medical or clinical history and individual clinical circumstances rather than a group dataset alone, keep a health care provider in the determination process, ensure fair and non-discriminatory application, and make the tool available for audit by the Insurance Commissioner.
The tool may not directly or indirectly cause harm to an enrollee, and it may not itself deny, delay, or modify health care services. A companion reporting section requires carriers to disclose to the Commissioner, case by case, whether AI, an algorithm, or other software tool was used in each adverse coverage decision.
When LexLint raises it
When your app profile says your app handles health records or is an insurer.
Back to the example · Lint your app
Page updated .