State and carrier rules on AI in IME reports
Short version: no state has passed an AI law written for IMEs. Texas, California and New York rules still reach AI use in IME work, because they govern practitioners, medical-legal reports or who shapes an IME opinion. Insurers in 24 states must govern the third-party AI they rely on, which is why carriers are starting to ask IME vendors about it.
Limits: We read each product's help pages, terms and pricing on 2026-11-12 and did not test how any product handles PHI. Plans, prices and laws change, and nothing here is legal advice for your state.
The rules table, as of 2026-11-12
Each row says what the rule requires, what it means for an examiner who uses AI, and where we read it. "Applies to IMEs?" is our reading, not a court's. Where we found no guidance, we say so.
| Rule | In force | What it requires | What it means for AI in IME work | Source, captured |
|---|---|---|---|---|
| Texas SB 1188, Health and Safety Code 183.005 | 2025-09-01 | A practitioner may use AI for diagnostic purposes within license scope, must review all records the AI created, and must disclose the use to patients | If AI helps form a diagnosis in your report, review every AI-made record and disclose. Whether an examinee counts as a "patient" is untested; treat it as yes | capitol.texas.gov, 2026-11-12 |
| Texas SB 1188, Health and Safety Code 183.002 | 2026-01-01 | Electronic health records under a covered entity's control are physically kept in the US, including at third-party and cloud sites | Ask every AI vendor, ours included, where files and model endpoints sit, and get the answer in writing | capitol.texas.gov, 2026-11-12 |
| Texas HB 149 (TRAIGA), Business and Commerce Code 552.051 | 2026-01-01 | A provider using an AI system in a health care service or treatment discloses it to the patient by the date of first service | Same "patient" question as SB 1188. If it applies, a short plain-language notice at intake is the simple way to meet it | meilynx.com summary with statute links, 2026-11-12 |
| California Labor Code 4628(a), (b), (j) | In force | Only the signing physician (nurse tasks aside) may take the history, review and summarize prior records, or draft conclusions of a medical-legal report; the report names each person who performed services; penalty of perjury declaration | The strictest rule on record summaries we found. AI output can organize; you review the records and write the conclusions. We found no DWC ruling on software under 4628 | leginfo.legislature.ca.gov, 2026-11-12 |
| California HSC 1339.75 (AB 3030) | 2025-01-01 | Generative AI messages to patients about clinical information carry a disclaimer unless a licensed provider reviewed them | Rarely triggered: an IME report goes to the requester, not the examinee. Reviewing anything you send an examinee removes the duty | leginfo.legislature.ca.gov, 2026-11-12 |
| California AB 489, Business and Professions Code 4999.9 | 2026-01-01 | An AI system may not imply that its reports or assessments come from a licensed professional | Aimed at AI vendors. A report you sign is yours, and should read that way | meilynx.com summary with statute links, 2026-11-12 |
| New York Workers' Compensation Law 137(6) | In force | No practitioner, supervisor, proprietor, carrier or employer may cause, direct or encourage a report that differs substantially from the examiner's opinion | If an AI draft carries wording you would not have written, change it. The opinion on the page has to be yours | law.justia.com, 2026-11-12 |
| 12 NYCRR 300.2 | In force | The IME report lists all information received and reviewed | A record tool's file index helps build this list. Every listed record still has to be one you reviewed | law.cornell.edu, 2026-11-12 |
| Colorado SB 26-189 | 2027-01-01 | Automated decision law; core duties exempt HIPAA covered entities, which give a general notice of advanced technology use | Nothing to do before 2027. Watch for the notice duty if you examine in Colorado | meilynx.com summary with statute links, 2026-11-12 |
| NAIC Model Bulletin on Use of AI Systems by Insurers | Adopted 2023-12-04; 24 states by 2025-03-18 | Insurers keep a written AI program covering third-party AI systems, with due diligence and, where available, audit rights and cooperation terms in vendor contracts | Carriers in adopting states have a reason to ask IME companies how AI is used on their files, and to add contract terms | content.naic.org, insurereinsure.com, 2026-11-12 |
| FSMB policy on AI in clinical practice | Adopted April 2024 | Guidance to state medical boards: physicians are accountable for their use of AI tools | Your license carries the report, whatever drafted it. Boards in your state may adopt this view | fsmb.org, 2026-11-12 |
| HHS, disclosures for workers' compensation | Guidance | The Privacy Rule does not apply to workers' comp insurers, agencies or employers unless they are otherwise covered entities | The carrier may be outside HIPAA; you are likely inside it. Your BAA duties do not depend on the carrier's status | hhs.gov, 2026-11-12 |
| 45 CFR 164.508(b)(4)(iii) | In force | A covered entity may require an authorization before care done solely to create PHI for a third party | Confirms HIPAA treats the IME report as PHI created for the requester | ecfr.gov, 2026-11-12 |
3 rows cite a secondary summary (meilynx.com) that links each statute. We read the Texas SB 1188 and California texts ourselves; for HB 149, AB 489 and Colorado we rely on that summary and say so.
What carriers and IME companies are likely to ask
We found no carrier that publishes an AI rule for IME vendors. The NAIC bulletin explains why questions are coming anyway: section 4 tells insurers to do due diligence on third-party AI systems and, where they can, to write audit rights and cooperation duties into vendor contracts. An IME company is a vendor. A physician on its panel is a vendor's vendor.
Expect some version of these questions in a panel agreement or a vendor questionnaire, and have answers ready:
- Which AI products touch our files, and under which BAA?
- Where are our files stored and processed, and for how long?
- Does any AI output reach the report without your review?
- Can you show which records you reviewed, and where each cited fact sits?
- Is our data used to train any model?
If you cannot answer the fourth question from your own workflow, that is the gap to close first. Page citations exist for that reason.
Disclosure: what the rules ask and what they do not
No rule we found requires an IME report to state "AI was used". What the rules do require is narrower and easier to meet:
- Texas: tell the patient when AI is used on a diagnosis (SB 1188) or in a health care service (HB 149).
- California workers' comp: name each person who performed services on the report (Labor Code 4628(b)). The statute names persons; it says nothing about software.
- New York: list every record received and reviewed (12 NYCRR 300.2), and sign only an opinion that is yours (WCL 137(6)).
Some examiners add a 1-line methods note saying software organized the records and the examiner reviewed them. That is a judgment call for you and the requester, not a rule we can point to.
How to keep this current
We recheck every row at least every 45 days and date each change. Bills on AI in health care move fast. Maryland, Arizona and Colorado passed utilization review laws in 2025 and 2026 that we left out, because they govern payers' coverage decisions, not examiners. If your state has a rule we missed, email the citation to [email protected] and we add it within 2 business days.