AI Healthcare Regulations in Indiana: 2024–2025 Guide

Quick Answer: Is AI in Healthcare Regulated in Indiana?

Yes, but not through a single statute. As of mid-2025, Indiana has not enacted a standalone AI transparency or algorithmic accountability law specific to healthcare. Instead, a layered framework built from federal device law, state professional licensing rules, health data statutes, and Medicaid program requirements applies. Every hospital, health system, digital health startup, and clinician deploying AI tools in Indiana operates within these layers simultaneously.

Regulatory Layers:

Layer 1: Federal FDA oversight. The FDA regulates AI and machine learning tools that meet the definition of Software as a Medical Device (SaMD) under the same pathways used for physical devices: 510(k) clearance, De Novo classification, or Premarket Approval (PMA). The FDA's AI/ML-Based Software as a Medical Device Action Plan (January 2021) remains the foundational federal framework, and the agency continues to update its approach through the Digital Health Center of Excellence.

Layer 2: Indiana state licensing and scope of practice. The Indiana Professional Licensing Agency (IPLA) and the Indiana Department of Health (IDOH) regulate the people and facilities that use AI tools. Indiana Code Title 25 (Professions and Occupations) governs physician, nursing, and allied health licensure. Indiana Code Title 16 (Health) gives IDOH authority over licensed healthcare facilities. Neither statute mentions AI by name, but both create accountability structures that apply when a clinician or facility uses an AI tool in patient care.

Layer 3: Payer and Medicaid rules. Indiana's Medicaid managed care program, administered through contracted MCOs, is subject to federal CMS rules on automated prior authorization and algorithmic decision-making. These rules are tightening at the federal level and filtering into state MCO contracts.

This page is written for Indiana hospitals and health systems, digital health vendors seeking to deploy in Indiana, clinicians incorporating AI tools into practice, and compliance officers who need a practical map of current obligations.

Indiana State Statutes That Directly Affect AI Healthcare Tools

Health Data and Patient Records

Indiana Code § 16-39-5 governs patient access to and correction of medical records. AI systems trained on Indiana patient records or generating medical record outputs must align with patient rights to inspect and correct information. Training AI models with patient data without appropriate authorization creates exposure under this section.

Indiana Consumer Data Protection Act (IC 24-15)

The Indiana Consumer Data Protection Act (ICDPA), IC 24-15-1 et seq., takes effect January 1, 2026. Health data receives heightened treatment under the ICDPA, but exemptions are significant for AI vendors. Data covered by HIPAA and held by a HIPAA-covered entity or business associate is exempt from the ICDPA. However, this exemption does not extend to all health-adjacent data an AI vendor might collect. If a digital health app or AI tool collects health data outside a HIPAA-covered relationship, the ICDPA applies. De-identified data used for AI model training may fall outside the statute, but vendors must verify the ICDPA's definition of de-identification is met, not merely assumed, without legal review.

Medical Practice Act and Physician Responsibility

Indiana Code § 25-22.5-1-1.1 defines the practice of medicine in Indiana. Indiana law does not permit a physician to delegate medical judgment to an algorithm. A clinician who acts on an AI-generated recommendation without independent clinical evaluation remains fully responsible for that decision under the Medical Practice Act. Grounds for discipline under IC § 25-22.5-8-3 include unprofessional conduct, which licensing boards could interpret to include uncritical reliance on an unvalidated AI tool.

Telehealth

Indiana Code § 25-1-9.5 governs telehealth practice in Indiana. AI-assisted telehealth encounters, such as chatbot triage tools that precede a synchronous visit, are not explicitly addressed in the statute. However, a licensed provider remains responsible for clinical decisions. Consult IPLA for current interpretive guidance on AI-assisted telehealth workflows.

Facility Licensure

Indiana Administrative Code 410 IAC 15 sets hospital licensing standards administered by IDOH. As of mid-2025, IDOH has not issued a formal bulletin or administrative letter specifically addressing AI tool use in licensed facilities. Consult IDOH's Office of Healthcare Facility Standards for current interpretive positions, as facility surveyors may evaluate AI tool governance as part of quality and patient safety reviews even without explicit AI-specific rules.

2024–2025 Legislative Activity

The Indiana General Assembly's 2024 session did not produce a bill specifically addressing AI in healthcare, algorithmic bias in clinical settings, or automated prior authorization. Monitor the Indiana General Assembly bill tracker (iga.in.gov) for the 2025 session, as AI-related legislation has been introduced in multiple states and Indiana may follow. No Indiana HEA or SEA specifically targeting healthcare AI had been enacted as of the research date for this page.

Federal FDA Oversight of AI Medical Devices: What Indiana Providers Must Know

The Three Authorization Pathways

FDA-regulated AI/ML SaMD must clear one of three premarket pathways before commercial distribution in Indiana or any other state:

Fees and timelines vary and change annually. Use FDA's official fee schedule at fda.gov for current figures.

CDS Exemption Under the 21st Century Cures Act

Section 3060 of the 21st Century Cures Act created an exemption from FDA device regulation for certain Clinical Decision Support (CDS) software. To qualify, a CDS tool must meet all four criteria: it displays, analyzes, or prints medical information; it supports or provides recommendations to a clinician; the clinician can independently review the basis for the recommendation; and it is not intended to replace clinical judgment. FDA's September 2022 guidance on Clinical Decision Support Software explains how the agency applies this four-factor test. Tools that fail any factor, particularly the "independently reviewable basis" criterion, revert to SaMD status and require premarket authorization.

What the Evidence Shows About FDA-Authorized AI Devices

A cross-sectional analysis of FDA-authorized oncology AI/ML devices found significant variation in the clinical evidence standards applied across authorized products (Litt H et al., Journal of Cancer Policy, 2026, PMID 42025919). Indiana oncology programs procuring AI diagnostic tools should review the specific authorization record for each device, not rely on FDA clearance alone as a proxy for clinical validity.

Similarly, research on orthopedic AI/ML devices found that few FDA-approved tools have peer-reviewed validation studies or EU MDR equivalents (Bracken A et al., Clinical Orthopaedics and Related Research, 2025, PMID 41915013). For Indiana orthopedic practices and hospitals, this finding is a direct procurement signal: FDA clearance is a regulatory floor, not a clinical validation ceiling.

Vendor Questions Indiana Providers Should Ask

Before deploying any AI tool in a clinical setting, ask the vendor:

• What is the FDA authorization status: 510(k), De Novo, PMA, or CDS-exempt? Provide the K-number or De Novo number.
• If claiming CDS exemption, provide a written analysis of how the tool meets all four statutory criteria.
• What post-market surveillance data exists, and does the vendor have a Predetermined Change Control Plan on file with FDA?
• Has the tool been validated on patient populations demographically similar to Indiana's patient mix?
• What indemnification does the vendor provide if an FDA enforcement action affects the product?

Post-market surveillance obligations under FDA 21 CFR Part 820 and the agency's Predetermined Change Control Plan framework mean an AI tool's regulatory status can change after deployment. Indiana providers should require contractual notification if a vendor's FDA status changes.

What Changed Recently: Indiana and Federal AI Healthcare Regulatory Activity (2024–2025)

Indiana Consumer Data Protection Act (Effective January 1, 2026)

The ICDPA (IC 24-15) is the most significant near-term compliance deadline for Indiana AI healthcare vendors. Health data provisions require that sensitive data, including data revealing health conditions, receive heightened protection. AI vendors who are not HIPAA business associates but who handle health-adjacent data from Indiana consumers must complete contract reviews, data mapping, and privacy notice updates before January 1, 2026.

Federal Executive Order and HHS Response

White House Executive Order 14110 on Safe, Secure, and Trustworthy AI (October 30, 2023) directed HHS to develop AI safety guidance for healthcare. HHS responded through its Office of the Chief Technology Officer with AI strategy documents emphasizing transparency, bias testing, and accountability in AI tools used in Medicare and Medicaid programs. Indiana providers participating in Medicare and Medicaid should treat HHS AI guidance as operationally relevant even where it is not yet codified in regulation.

CMS Automated Prior Authorization Rules

CMS-4201-F, the Medicaid managed care final rule (2024), includes provisions addressing automated prior authorization and algorithmic decision-making. Indiana's Medicaid managed care program operates through contracted MCOs. Whether Indiana's current MCO contracts include AI transparency or algorithm audit requirements is not publicly confirmed as of this writing. Consult the Indiana Family and Social Services Administration (FSSA) for current MCO contract terms. Research examining MCO procurement across 32 states found systematic overemphasis of technology and equity performance claims that may not reflect actual tool performance (Basu S et al., Inquiry, 2026, PMID 42012014). Indiana health systems contracting with MCOs should scrutinize AI-related performance representations in those contracts.

ONC HTI-1 Final Rule

The ONC Health Data, Technology, and Interoperability: Clinical Decision Support, Algorithms, Predictive Analytics, and Artificial Intelligence Final Rule (HTI-1), published at 89 Fed. Reg. 1192 (January 9, 2024), requires certified EHR technology to meet new standards for decision support interventions, including predictive algorithms. Indiana-based EHR users and covered entities using ONC-certified technology must comply with HTI-1 requirements on the schedule ONC established. Consult ONC directly for current compliance dates applicable to your certification edition.

Compliance Comparison: Key Requirements by AI Use Case in Indiana

Liability and Malpractice

Indiana's Medical Malpractice Act (IC 34-18-1 et seq.) governs malpractice claims against Indiana providers. The aggregate damages cap under IC § 34-18-14-3 is $1.8 million as of 2025 (verify current cap with Indiana Department of Insurance, as the cap has been subject to periodic adjustment). AI tool use does not create a separate liability category; the clinician remains the responsible party. An AI-generated recommendation that a physician follows without independent clinical judgment does not transfer liability to the vendor under current Indiana tort law.

Patient Disclosure

Indiana law does not currently require providers to affirmatively inform patients that AI was used in their diagnosis or treatment planning. Indiana Code § 16-39-5 gives patients rights to their records, and IC § 16-36-1 governs informed consent, but neither statute as currently written mandates AI-specific disclosure. This area is evolving. Document AI tool use in the medical record regardless, both for defensibility and because disclosure requirements may change.

Procurement Red Flags

In AI vendor contracts, Indiana health systems should flag: absence of FDA clearance documentation or written CDS exemption analysis; no indemnification for FDA enforcement actions; no bias audit provisions or demographic validation data; change-of-control clauses that could affect FDA authorization; and vague data use provisions that could conflict with ICDPA requirements.

Licensing, Scope of Practice, and Liability for Indiana Clinicians Using AI

Physician Discipline Risk

The Indiana Medical Licensing Board has authority under IC § 25-22.5-8-3 to discipline physicians for unprofessional conduct. Using an AI diagnostic tool that lacks FDA clearance, or acting on AI output without independent clinical review, could support a disciplinary complaint. The standard is not whether AI was used, but whether the physician exercised appropriate professional judgment.

Nursing and APRN Scope of Practice

Indiana State Board of Nursing rules under 848 IAC 1 define scope of practice for RNs and APRNs. An RN acting independently on an AI-generated clinical recommendation, without physician oversight where required, risks a scope-of-practice violation. APRNs with prescriptive authority operate under their own scope rules. Consult IPLA for current interpretive guidance on AI tool use within nursing scope.

Informed Consent

Indiana Code § 16-36-1 governs informed consent. The statute does not mandate AI-specific disclosure. However, if AI significantly shapes a clinical recommendation, disclosing its use may be prudent for risk management, even if not legally required.

Joint Commission Standards

Joint Commission Standard LD.04.03.13 addresses clinical decision support oversight and requires hospitals to have governance processes for CDS tools. Indiana hospitals accredited by the Joint Commission should ensure their AI governance policies satisfy this standard. Surveyors are increasingly asking about AI tool oversight during accreditation reviews.

Documentation Best Practices

When an AI tool informs a clinical decision, document: the name and version of the tool used, that the clinician independently reviewed the basis for the AI recommendation, the clinician's own clinical reasoning, and