As a new Indiana task force has started hearings to take a closer look at increased artificial intelligence usage in state government, private industries are also keeping their eye on any potential new laws with the emerging technology.
That includes hospitals and other health care entities.
Brian McGinnis, a Barnes & Thornburg LLP partner and co-chair of the firm’s Data Security & Privacy Practice Group, said AI represents “an incredible challenge” for hospitals and health care entities.
He noted that there is, at the moment, a relative lack of laws and regulations directly targeted to AI use in health care.
McGinnis compared AI to social media, in the sense that, sometimes, the law is slow to adjust to new technologies.
Even so, there are existing laws that regulate AI usage in health care and other industries, regardless of whether they specifically mention the technology.
McGinnis said there are facets of intellectual property law that cover AI inputs, with contract law also dealing with features like terms of service.
“You basically take traditional areas of law and apply it,” McGinnis said.
Scot Ganow, chair of Taft’s Privacy and Data Security group, said AI usage and possible regulations are a hot topic for his firm’s clients, regardless of their industry.
“The law is never going to be fast enough, in any type of technology,” Ganow said, although he stressed that some states will move faster than others to regulate AI usage, whether in health care or other industries.
“It’s a moving target right now as to what those laws require,” Ganow said.
Ganow said attorneys and their clients are still trying to figure out a clear definition of what AI is.
He said his clients are expecting more AI-targeted regulations on the state level in the coming years.
EU’s AI Act, federal guidance
McGinnis said the European Union has been a leader in establishing AI regulation, with its EU AI Act.
According to the EU, the law represents the first-ever legal framework on AI, which addresses the risks of AI and positions Europe to play a leading role globally.
The AI Act (Regulation (EU) 2024/1689) lays down harmonized rules on AI, provides AI developers and deployers with clear requirements and obligations regarding specific uses of AI and seeks to reduce administrative and financial burdens for businesses, in particular small and medium-sized enterprises
McGinnis said he thought the EU law would play a part in guiding new AI regulations internationally, including in the U.S.
He said that within the AI space, it is difficult to come up with specifics for laws to regulate the technology.
“What you’re seeing now are more aspirational guidelines for use of AI,” McGinnis said.
The Federal Trade Commission has issued general guidance on AI usage. The agency announced in February that proposed rule changes would extend protections of a new rule on government and business impersonation.
The agency stated it took the action “in light of surging complaints around impersonation fraud, as well as public outcry about the harms caused to consumers and to impersonated individuals”
“Emerging technology – including AI-generated deepfakes – threatens to turbocharge this scourge, and the FTC is committed to using all of its tools to detect, deter, and halt impersonation fraud,” the commission announced in a released statement.
The commission also announced that it was seeking comment on whether the revised rule should declare it unlawful for a firm, such as an AI platform that creates images, video or text, to provide goods or services that they know or have reason to know is being used to harm consumers through impersonation.
How might Indiana look to regulate AI use?
Ganow noted that there will be a balance with any potential AI regulation in terms of balancing business interests and protecting consumers’ privacy interests.
Indiana has started to move to examine the use of AI in the public sphere.
In March, Gov. Eric Holcomb signed Senate Bill 150 into law. The law established an AI Task Force to study and assess the use of AI technology by state agencies.
The task force, which began its work in July, is composed of 15 members, including legislators.
The Indiana Capital Chronicle reported Tracy Barnes, Indiana’s chief information officer, said there are three “known” uses of generative AI across state government.
First, the Department of Workforce Development’s recommendation engine, which suggests training, education and other employment resources to Hoosiers submitting unemployment insurance claims. It went into production in November 2023.
Barnes’ own Indiana Office of Technology runs the second and third.
Kyle Miller, a partner in Dentons Bingham Greenebaum’s Louisville office, is also admitted to practice law in the Southern District of Indiana.
He said questions about AI usage are coming up routinely with clients in the health care industry, either with hospitals or their vendors.
Miller said only two states have passed legislation to regulate AI: Colorado and Utah.
He said the Utah AI Policy Act is enforced first by the Utah Division of Consumer Protection, and Utah courts may enjoin actions that violate the act and violations of those injunctions can be prosecuted by the Utah Attorney General.
California has had many bills drafted and introduced in its state legislature, Miller said.
“Other states have floated AI legislation, but it doesn’t seem to have gotten much traction,” Miller said, adding that he thinks it’s likely there be some specific AI regulations that follow the Utah model, with disclosure requirements.
Miller said he expects states to take the lead on implementing any new AI laws, as opposed to Congress.
McGinnis said he expects Indiana to be active in considering state laws to regulate AI usage, with the attorney noting a new state privacy law will go into effect in January 2026.
He said he expects Indiana to take a business-friendly approach to any potential new legislation by putting guidelines in place, but not trying to slow innovation.
Any AI law that impacts hospitals will need to address protection of privacy and individuals and also promote transparency, so patients know how their information is being used, McGinnis said.•
