The Connected Health Initiative has released a proposed framework for state-level oversight of healthcare AI, assigning risk management duties according to the roles of developers, health systems, and clinicians. Under the policy, high-risk AI applications, such as diagnostic tools or algorithms that influence coverage decisions restricting patient access, must include mandatory human review before implementation. The principles also stress that states should avoid duplicative regulations while filling gaps in patient protections.
Brian Scarpelli, executive director of the initiative, pointed out that many AI-related risks are already addressed by existing laws, particularly privacy protections under HIPAA for covered healthcare entities. However, consumer health apps often operate outside these safeguards, leading to inconsistent oversight. The guidelines seek to clarify which parties bear responsibility for different stages of AI deployment. Developers would be tasked with designing systems, conducting rigorous testing, and disclosing known limitations, while health systems would manage procurement and staff training. Clinicians remain accountable for integrating AI tools into care and exercising professional judgment.
Payment structures present another challenge. Current reimbursement models frequently discourage providers from adopting AI, even when it enhances care quality or reduces expenses. The initiative recommends states revise Medicaid and employer-sponsored health benefits to encourage digital health adoption, including outcomes-based payment models that reward efficiency and improved patient results.
State-specific AI regulations could create adoption hurdles, especially for smaller technology companies. A fragmented regulatory environment may impose uneven burdens, particularly on rural healthcare providers already operating with limited resources. The CMS Rural Health Transformation Program, which allocates $50 billion over five years, including $10 billion annually from 2026 through 2030, could help bridge gaps in underserved regions. Yet conflicting state rules risk delaying the deployment of AI tools in areas where they are most needed.
Scarpelli cautioned that inconsistent state requirements could place an undue burden on smaller firms, potentially slowing access to innovative technologies. The framework aims to strike a balance between necessary oversight and practical adoption, ensuring AI reaches patients without erecting unnecessary obstacles. The proposal does not yet specify enforcement mechanisms, leaving states to determine how they will monitor compliance and address violations.
If adopted, the guidelines could set a precedent for how other regions structure AI governance in healthcare.
