AI medical record review in life underwriting: what the rules require

AI medical record review is allowed in life underwriting: no statute or regulation forbids a life insurer from using software to read an applicant's attending physician statement and medical records. What the rules do is set conditions. Regulators expect the insurer to govern the AI it uses, to test it, to stay accountable for decisions it supports and to explain adverse decisions with their sources. The applicant's authorization limits what may be read and why, and some states bar particular information, such as genetic test results, from underwriting altogether. Botminds' APS Summarization was designed inside those conditions: its agents read, index, chart, compare and suggest, every statement carries its page, and the rating and the signature stay with the underwriter. This guide takes the rules one at a time, for life underwriting; reading medical records for an injury claim is a different job, covered in AI medical record summaries for injury claims.

Is AI medical record review allowed in insurance?

Yes. The regulators' position is that existing law applies to decisions whoever or whatever supports them, and that insurers need controls proportionate to the risk. The NAIC's model bulletin, adopted in December 2023, expects every insurer to keep a written program for the responsible use of AI systems that make or support decisions in regulated insurance practices, which takes in underwriting (what the NAIC AI bulletin requires). Life insurers already use such systems in underwriting: in the NAIC's survey of 161 life insurers, underwriting accounted for 34% of the AI and machine-learning models in use (NAIC life insurer AI/ML survey).

Reading an APS is one of the lower-risk uses, if it is built that way. The bulletin asks insurers to scale controls to the nature of the decisions the AI supports, the potential harm to consumers, how far humans are involved in the final decision, how explainable the outcome is to the consumer, and how much the insurer relies on third parties. A tool that writes cited summaries and never decides scores well on the third and fourth; a tool that recommends a class does not.

Does the NAIC AI bulletin apply to life underwriting?

Where a state has adopted it, yes, and it applies to all lines including life. As of 8 October 2026 the NAIC's map lists 29 adopting jurisdictions, among them the District of Columbia and Puerto Rico, the most recent being North Dakota on 5 October 2026 (NAIC adoption map). The map lists California, Colorado, New York and Texas separately, for their own insurance-specific rules. What the bulletin requires, section by section, is the subject of our sister guide on NAIC AI bulletin requirements; here are the parts that bite on medical record review.

Validation comes first. Among the controls the bulletin expects is validating, testing and retesting a system's outputs once it is in use, to see whether they hold up beyond the cases it was built on, and it names comparison against expert review as one way to do it. For an APS tool, that is a test on decided cases against your nurses' abstracts, laid out in pilot it on 40 of your closed cases. Then vendors: the bulletin expects due diligence so that decisions a vendor's system supports meet the legal standards imposed on the insurer itself, and contract terms that give audit rights and require cooperation with regulators.

What does New York Circular Letter 7 require of AI that reads medical records?

Oversight, transparency to the applicant, and specific reasons with sources when the decision is adverse. The circular's definition of an AI system covers one used, wholly or partly, to supplement traditional life or health underwriting or pricing, which an APS summariser does. The circular's data rules mostly concern external consumer data; it states that MIB reports and prescription drug data are not external data in its sense. But its AI-system expectations apply to the tool reading the records.

Three of those expectations matter most. The insurer's notice to the applicant should say whether it uses AI systems in underwriting or pricing. After an adverse decision, the reasons should include the information the decision was based on and its source. And the insurer cannot hide behind a vendor: the circular says the proprietary nature of a vendor's algorithm does not excuse a lack of specificity in an adverse decision. The circular's governance side, from inventories to board oversight, is covered in New York Circular Letter No. 7 and the AI inventory.

An adverse decision must name its source. A summary that cites every page is the only kind of AI output that makes that easy.

What the applicant's authorization lets the AI read

The file the doctor sent, for the purpose the authorization describes, and a little less than the whole chart. HIPAA requires every authorization to carry "A description of each purpose of the requested use or disclosure", and the insurer that receives records under it should use them for that purpose. Reading an APS with software does not change the purpose; using the same records to train a model for unrelated uses could, and is a question for the privacy office before it is one for the data team. Who HIPAA binds, and what the authorization must say, is set out in HIPAA authorization for life insurance.

One category is outside the ordinary authorization. HIPAA requires a separate authorization for psychotherapy notes, and says that such an authorization "may only be combined with another authorization for a use or disclosure of psychotherapy notes". A general APS authorization therefore does not bring them in, and a tool should treat any page that looks like one as something for a person to look at, not something to index. In the solution, mental health indexing is a setting the sample carrier left off, and unreadable or unexpected pages go to a person.

Can genetic test results be used in life underwriting?

In some states no, absent a diagnosis, and an AI reading the APS has to respect that. Florida's statute says that "In the absence of a diagnosis of a condition related to genetic information, health insurers, life insurers, and long-term care insurers authorized to transact insurance in this state may not cancel, limit, or deny coverage, or establish differentials in premium rates, based on such information." The same section keeps the medical record open: a life insurer may access it as part of an application exam and may consider a diagnosis in it, even one made from a genetic test.

For a tool, that becomes a setting, not a hope. A genetic test result with no diagnosis should not appear in the summary that a Florida underwriter rates from; a diagnosis should, with its page. Because the impairments indexed are carrier settings in APS Summarization, a carrier writing in Florida can define what the index carries for that state and version the change. Other states have their own versions of this rule; the principle carries, the wording does not, and the carrier's counsel should map each.

Settings: what the agents look for, which ranges they chart, and who decides

Who is accountable when AI misreads a record?

The insurer, always, and inside it the people who signed. Neither the NAIC bulletin nor New York's circular lets a carrier pass responsibility to a vendor or a model; New York expects senior management and the board to own the overall outcomes of AI use, with day-to-day work delegated. In practice accountability attaches to whoever makes the decision on the file, which is why the design question is where the human sits and what the human can check.

In APS Summarization the agents' limits are part of the product, not of a policy document. They state no rating or class, order nothing and contact nobody. A difference from the application is written as what was answered and what the records show, never as misrepresentation, because materiality is a legal judgement made later by people. A flag can be dismissed only with a reason, which stays in the case activity.

How do regulators test AI underwriting for discrimination?

New York describes the most detailed method. Insurers should assess whether AI produces disproportionate adverse effects for protected classes, then whether there is a legitimate justification, then whether a less discriminatory alternative exists, documenting each step; the circular lists metrics including adverse impact ratios and denial odds ratios. Colorado has its own quantitative testing rules for life insurers, set out in our sister guide on Colorado life insurance quantitative testing.

A summariser that does not score or decide is not the model those tests are written for, but its output feeds decisions, so two checks still apply. Consistency: the same facts should produce the same summary whoever's file it is, which is why the solution runs on fixed, versioned settings rather than free prompts. And content: the index should carry clinical facts, not proxies, and the carrier should be able to show what it carries.

Adverse decisions must be explained with their sources

State insurance privacy laws already require reasons for adverse decisions, and AI does not dilute that. In Virginia an adverse underwriting decision includes, for life insurance, "an offer to insure at higher than standard rates, or with limitations, exceptions or benefits other than those applied for". On request the insurer must supply the specific reasons, the specific items of information behind them and the names of the institutional sources, with medical-record information going to the applicant or a designated medical professional (Va. Code § 38.2-610).

That obligation is far easier to meet when every statement in the medical summary already carries its page. On the fictional sample case the decision was Standard rather than the Preferred Plus requested, subject to an amendment; the two differences behind the amendment, and every finding in the summary, name the page and the provider they came from.

The decision: proposed by the underwriter, agreed by the medical director

AI medical record review tools: what the rules imply you should ask

Translate each rule into a question a vendor, or your own team, must answer with evidence. The list below is what an examiner reading your AI program would want to see answered for a tool that reads medical records.

The full sample case, with the settings, the summary and the signed decision, is on the APS Summarization page.

Questions people ask

Can insurers use AI on medical records?

Yes, subject to the authorization the applicant signed, state insurance privacy law and the regulators' AI expectations. The NAIC's model bulletin, adopted by 29 jurisdictions as of 8 October 2026, expects a written program, validation and vendor due diligence for AI that supports decisions.

Does the NAIC AI bulletin cover a tool that only summarises?

It covers AI systems that make or support decisions related to regulated insurance practices, and a summary an underwriter rates from supports an underwriting decision. Controls can be lighter where humans make the final decision and the output is explainable.

Does New York let insurers use AI in life underwriting?

Yes. Circular Letter No. 7 of 2024 sets expectations rather than a ban: governance and oversight, testing for unfair discrimination, notice that AI is used, and specific reasons with sources for adverse decisions, including where a vendor's system was used.

Can an AI summary mention a genetic test?

It depends on the state. Florida bars life insurers from using genetic information absent a diagnosis, while allowing them to consider a diagnosis in the medical record even if a genetic test led to it. A tool should let the carrier exclude genetic test results from what it indexes.

Who signs the decision when AI reads the records?

The underwriter, within their authority, and on referred cases the medical director. In APS Summarization the agents state no rating or class, and signing is blocked while any citation cannot be found on its page.