What 1 state can teach the other 49 about regulating healthcare AI

Utah has been modeling state-level regulation since 2024, when it passed its Artificial Intelligence Policy Act into law. With that, the framers set up the state’s Office of Artificial Intelligence Policy and gave this new body authority to run a “regulatory sandbox.” 

The sandbox setup lets companies test AI systems under relaxed rules but with close government supervision. 

“Rather than restricting AI upfront, the sandbox gives the state a way to evaluate how these tools perform in practice,” explains Hodan Omaar, a senior policy manager at the Center for Data Innovation (CDI). In the process, the state gets to “build regulation around evidence rather than assumptions.” 

Utah isn’t the only state to adopt a sandbox model for AI oversight. Still, the CDI, a nonprofit think tank based in the nation’s capital, thinks enough of the Utah iteration that on March 20 it published Omaar’s Beehive State drilldown. 

Among the strengths she sees are these four. 

1. The sandbox approach maximizes the chance that beneficial tools actually reach patients. 

Broad restrictions don’t just block bad AI, they block good AI too, Omaar points out. 

“If a state were to bar clinicians from using AI to support treatment decisions, that wouldn’t distinguish between a poorly validated chatbot and a rigorously tested clinical decision support tool,” she writes. “Utah’s sandbox creates a path for companies to demonstrate what their tools can do under real conditions, meaning promising tools get a chance to prove themselves rather than getting swept up in categorical prohibitions written before anyone has seen them work.”

2. Utah’s sandbox helps the state regulate more intelligently over time.

How? By giving  regulators a chance to learn before creating new rules. 

“Experience makes it easier to write regulations that target actual failure points rather than imagined ones,” Omaar states, “and to identify where within a workflow AI introduces genuine clinical risk and where it doesn’t, rather than treating an entire application area like prescription renewals as safe or dangerous wholesale.” 

3. Instead of avoiding liability questions by banning the technology outright, the sandbox addresses them directly.

It does so by defining responsibility in advance. This allows clinicians to participate without risking their licenses while ensuring patients remain protected if something goes wrong. 

“Outside of a supervised pilot,” Omaar adds, “a pharmacist who relies on an AI-generated refill authorization could risk violating scope-of-practice rules, because most pharmacy laws assume that a physician personally approves every prescription renewal.”

4. Running a sandbox stress-tests the regulatory framework itself. 

Testing an alternative workflow under supervision allows the state to see which steps meaningfully protect patient safety and which simply add delay, Omaar observes.  

“That insight is valuable not just for governing AI,” she underscores, “but also for improving healthcare processes more broadly and identifying where regulation can better support efficient, high-quality care.” 

More: 

“Utah’s sandbox shows that responsible AI governance is not about prohibiting new tools but about creating a process to evaluate them. States that build systems for supervised experimentation will be better positioned to protect patients while improving care. Those who rely on restrictions alone will struggle to do either.”

The piece is posted here.