Law / United States / 
Nebraska
Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction
Neb. Rev. Stat. §§ 44-5432 to 44-5444
In force since .
An AI risk obligations rule binding private bodies.
- Criminal exposure
- No
- Obligation class
- Prohibition, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator, Independent third party
What it requires
- Do not let an artificial intelligence-based algorithm be the sole basis of a decision to deny, delay, or modify a health care service based, in whole or in part, on medical necessity.NIST AI RMFMAP 3.5
- Disclose to the Department of Insurance, to each health care provider in your network, to each enrollee, and on your public website whether artificial intelligence-based algorithms are used or will be used in the utilization review process.NIST AI RMFMEASURE 2.8
- Make your automated utilization management system available for audit by the department, which may perform the audit itself or through a third-party entity.NIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Who may demand the log
Regulator, Auditor or notified body
Logging duty
Section 44-5443(3) gives the Department of Insurance, itself or through a contracted third party, power to audit a utilization review agent's automated utilization management system at any time. The section never uses the words log, record, or audit trail, but a system that must stand ready for an audit at any time has to be kept in a state that audit can examine, which is the implicit case. Sections 44-5432 to 44-5444 state no retention period for whatever the audit examines.
- Kind
- Implicit
- As of
- Provision
- Neb. Rev. Stat. § 44-5443(3)
- Trigger
- automated_decisions
What this law does
LB 77 (2025), the Ensuring Transparency in Prior Authorization Act, bars a utilization review agent's artificial intelligence-based algorithm from being the sole basis of a decision to deny, delay, or modify health care services based, in whole or in part, on medical necessity.
The agent must disclose to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website whether artificial intelligence-based algorithms are used or will be used in the utilization review process. The department may audit, itself or through a third-party entity, the agent's automated utilization management system. These provisions became operative on .
When LexLint raises it
When your app profile says your app handles health records, makes health care decisions or makes insurance decisions.
Back to the example · Lint your app
Page updated .