Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
What Actually Happened in Utah, and Why It Matters
The Utah Division of Professional Licensing (DOPL) entered a regulatory mitigation agreement with Legion Health in early 2025 covering AI-assisted psychiatric medication management. That is not a press release. That is a binding instrument that defines how an AI system can participate in a clinical workflow that has historically been the exclusive territory of a licensed prescriber.
We have worked with state regulators around the country on unrelated facility matters. They do not hand out novel agreements lightly. The fact that Utah moved first, and moved through a mitigation framework rather than a denial or a cease-and-desist, tells you something specific. State regulators are looking for a structured way to say yes to AI-augmented behavioral health, and they want the operator to bring the guardrails to them.
For operators in Florida (AHCA and DCF), New Jersey, Pennsylvania (DDAP and DOH), and Connecticut (DMHAS), this is the first real precedent you can point to in a pre-licensure conversation. It will not transfer cleanly. But it gives you a vocabulary.
What a Regulatory Mitigation Agreement Actually Is
A mitigation agreement is not a license. It is not a waiver in the 1115 demonstration sense either. It is closer to a consent framework: the regulator identifies risks the operator’s model creates, the operator commits in writing to specific controls, and the agreement defines what triggers enforcement if those controls fail.
In Legion’s case, based on the public record and what we have seen in analogous DOPL matters, the controls almost certainly include several non-negotiables. A licensed prescriber of record for every patient. Hard scope limits on what the AI can and cannot do without human sign-off (refills of stable, non-controlled psychotropics is one thing; initiating a new SSRI in an adolescent is another). Documentation requirements that capture the AI’s recommendation and the prescriber’s independent review as distinct events in the chart. Audit trail retention, likely 7 years to align with state medical record rules. Adverse event reporting on a defined timeline, often 10 business days for non-serious and 24 to 72 hours for serious.
The piece operators underestimate is the audit posture. Utah will almost certainly retain the right to pull a sample of charts on demand. If your EMR cannot produce a clean export showing AI recommendation, prescriber review timestamp, and final order as three separate auditable events, you do not have a deployable model. You have a liability.
What Other States Will Likely Require
State-by-state, expect divergence, not harmonization. Florida AHCA will route AI-enabled prescribing questions through both facility licensure and the Board of Medicine, which means two separate review tracks and two separate sets of comments to reconcile. New York OASAS has historically been more cautious on technology-mediated clinical functions and will likely want to see the model run under a research or pilot designation before full deployment. Pennsylvania DDAP will defer some questions to the Department of State on prescriber scope.
Common threads we expect across rulemaking and informal guidance over the next 18 months: prescriber-to-patient ratio caps even when AI is in the loop (do not assume AI lets you stretch a single psychiatrist across 5,000 patients, regulators will push back hard), mandatory disclosure to patients that AI is participating in their care, restrictions on controlled substances regardless of AI involvement (the Ryan Haight Act and state corollaries do not bend), and explicit prohibitions on AI making the final clinical decision on involuntary holds, suicide risk escalation, or pediatric dose changes.
If you are building a pro forma around an AI-augmented service line and you assumed a 40 percent reduction in prescriber FTE cost, cut that assumption in half until you have a signed agreement in hand.
The Compliance Stack You Need Before You Approach a State
Walking into AHCA or OASAS with a pitch deck and a vendor demo is how you get a polite no and a much harder second meeting. The operators who will get to yes are the ones who arrive with the mitigation framework already drafted.
At minimum, you need: a written scope of practice document defining exactly which clinical actions the AI participates in and which it does not; a prescriber oversight protocol with named roles and review timelines; a documentation standard mapped to your EMR’s actual capabilities (not its marketing materials); an adverse event taxonomy and reporting workflow; a patient consent and disclosure script reviewed by counsel in each state; a data governance addendum covering training data, model versioning, and PHI handling under HIPAA and state-specific privacy law; and an internal audit cadence, quarterly at minimum.
That is the package. Without it, you are asking a regulator to do your design work for you, and they will not.
Where AHS Fits, and What We Are Watching Next
This is the work we do. AHS has structured licensure pathways and compliance frameworks for operators across over 30 states, and the AI-augmented service line conversations have moved from hypothetical to active in the last six months. We are currently advising on three matters where the question is not whether to deploy AI in a clinical-adjacent function, but how to scope it in an accreditation ready compliant way.
The team will be at NAATP National in Amelia Island May 4 through 6, where AHS is sponsoring the Women in Leadership Luncheon. Allison, Benjamin, Leah, and Sariah will be on the ground. If you are evaluating an AI-enabled service line and want to talk through feasibility, scope, and which state to approach first, find us there or reach out before the conference.
The Legion precedent is a door opening. It is not a door that stays open for operators who arrive unprepared.
References
- Utah Division of Professional Licensing (DOPL)
- Florida Agency for Health Care Administration (AHCA)
- New York State Office of Addiction Services and Supports (OASAS)
- Pennsylvania Department of Drug and Alcohol Programs (DDAP)
- Substance Abuse and Mental Health Services Administration (SAMHSA)
- DEA: Ryan Haight Online Pharmacy Consumer Protection Act
- Behavioral Health Business