As of November 3, 2026, the public record of US enforcement against health AI products is four state actions: a Texas settlement with a hospital AI vendor over its accuracy claims (2024), an open Texas investigation into chatbots sold as mental health tools (2025), a Pennsylvania lawsuit against a chatbot that claimed to be a licensed psychiatrist (2026), and eight state lawsuits against OpenAI, announced together in October 2026, that cite dangerous medical advice among the harms. Two California laws add new ways to bring the next one. None of the four came from the FDA, the FTC or HHS.
Last checked: November 3, 2026, against each regulator's own release, complaint or the statute text. Our broader AI enforcement tracker covers other sectors.
The tracker
| Date | Regulator | Target | Law used | Status on Nov 3, 2026 | Official source |
|---|---|---|---|---|---|
| Sep 18, 2024 | Texas Attorney General | Pieces Technologies (clinical summaries for hospitals) | Deceptive claims: "false and misleading statements about the accuracy and safety" of the products (no AI statute) | Settled. Pieces agreed to disclose its products' real accuracy and to make sure hospital staff know how far to rely on them | Texas AG release |
| Aug 18, 2025 | Texas Attorney General | Meta AI Studio, Character.AI | Texas consumer protection law: marketing as mental health tools, privacy misrepresentations | Civil Investigative Demands issued; no outcome in a Texas AG release we could find | Texas AG release |
| May 1, 2026 (announced May 5) | Pennsylvania Department of State | Character Technologies (Character.AI) | Medical Practice Act: unauthorized practice of medicine | Pending; no ruling as of our October 31 check. Company filed Chapter 11 on October 12, 2026 | Governor's release, complaint |
| Oct 14, 2026 | Iowa Attorney General, with separate suits by Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana. The Arkansas and Montana releases list Kansas among the states that sued; the Kansas AG's own site has no release | OpenAI (ChatGPT) | Iowa Consumer Fraud Act and each state's own law; the complaint theory is safety claims, with medical advice among the harms | Filed, each in its own state court | Iowa AG release, Arkansas AG release, Montana DOJ release |
Two of these, Pieces and Pennsylvania, are the only health-tagged entries among the 30 cases in our general tracker. That says more about how new this is than about how safe health AI is.
Theory 1: an accuracy number you can't back up
Screenshot: Texas Attorney General release, texasattorneygeneral.gov. Captured November 3, 2026.
Pieces sold generative AI that summarized patients' condition and treatment for hospital staff, with data from at least four major Texas hospitals flowing to it in real time. Its marketing claimed a "severe hallucination rate" of "<1 per 100,000." The Attorney General's office found those metrics "were likely inaccurate and may have deceived hospitals." There was no new AI law involved. It was an ordinary deceptive-claims case where the claim happened to be a model metric.
The settlement asks for two things any health AI vendor can copy: disclose the real accuracy, and make sure the clinicians using the tool "understand the extent to which they should or should not rely on its products." Ken Paxton's line was aimed at the buyers too: "Hospitals and other healthcare entities must consider whether AI products are appropriate and train their employees accordingly."
The check: for every accuracy, error or hallucination figure in your sales deck, website or RFP answers, keep the test that produced it, the dataset, the date and the definition of the metric. If you can't produce those, take the number down. If you buy clinical AI, ask the vendor for the same file. Our HTI-5 vendor questions cover what certified EHR vendors will stop having to tell you after December 28.
Theory 2: a bot that implies a license
Screenshot: Pennsylvania Governor's newsroom, pa.gov. Captured November 3, 2026.
Pennsylvania's case does not depend on whether the chatbot's advice was good or bad. The Department of State found Character.AI characters claiming to be licensed medical professionals, including psychiatrists, and "in one instance, a chatbot falsely stated it was licensed in Pennsylvania and provided an invalid license number." The claim is that this is the unauthorized practice of medicine under the state's Medical Practice Act. The release notes that the platform lets users "create and deploy custom AI 'characters' that can present themselves as professionals," so the persona did not have to come from the company itself.
California wrote the same theory into statute. AB 489 (Chapter 615, approved October 11, 2025) makes the state's title-protection rules for health professions "enforceable against a person or entity who develops or deploys" an AI system that uses those terms "in the advertising or functionality." The health profession's licensing board enforces it, can seek an injunction, and each use of a prohibited term counts as a separate violation.
Screenshot: AB 489 bill text, leginfo.legislature.ca.gov. Captured November 3, 2026.
The check: search your bot prompts, persona names, UI copy and marketing for "Dr.", "nurse", "therapist", "psychiatrist", "licensed", "clinician" and similar titles, and for phrasing that suggests a human professional is behind an answer. If users can build their own personas, block those words in persona names and descriptions. This is the cheapest of the three checks and the one with the clearest statute behind it.
Theory 3: a chatbot sold as safe while it gives medical advice
The October 14 suits against OpenAI are not health-AI cases in the narrow sense. ChatGPT is a general chatbot, and the states' main complaints are about children and self-harm. Medical advice is in the theory, though. Iowa Attorney General Brenna Bird: "OpenAI claims ChatGPT is safe while it's giving dangerous medical advice, encouraging people to hurt others, and coaching people to commit suicide." The legal hook is the Iowa Consumer Fraud Act, which is about the gap between what a company says about safety and what the product does. Our state AG chatbot lawsuit tracker follows these cases one state at a time.
Texas used the same idea a year earlier against Meta AI Studio and Character.AI, adding a privacy angle: the chatbots "assert confidentiality," while their terms "reveal that user interactions are logged, tracked, and exploited for targeted advertising and algorithmic development."
The check: put your safety and privacy claims next to your terms of service and your actual data flows. If the homepage says "private" or "confidential" and the terms allow training or ad use, regulators have already shown they will read both.
Laws that widen the list from 2027
California AB 1979 (Chapter 854, approved September 30, 2026) takes effect January 1, 2027. A business that offers a "health care chatbot" to consumers for managing their health information or for diagnosis or treatment is treated as a provider of health care under the state's Confidentiality of Medical Information Act, with that law's confidentiality duties and remedies. We cover who is in scope in our AB 1979 explainer.
At the federal level, HHS's anti-discrimination rule for patient care decision support tools (45 CFR 92.210) still stands after the HTI-5 deregulation; we have not found an HHS enforcement action under it, and none is in this table.
What we could not confirm
We did not search FDA warning letters, HHS Office for Civil Rights resolution agreements or state medical board disciplinary orders for AI-related cases; a regulator action that only appears there is not in this table. We could not confirm the current docket status of the Pennsylvania case beyond our October 31 check, or whether the automatic stay from Character Technologies' October 12 bankruptcy filing (Case No. 26-11603, D. Del.) has affected it; our Character.AI bankruptcy checklist tracks that case. The Texas releases are the last public documents we found for both Texas matters.
Our take
The pattern is plain enough to act on. Regulators are not waiting for health AI laws; they are using deception, licensing and consumer-fraud statutes that already apply to any business. For a small health AI company, the three checks above take an afternoon and cover every theory used so far. For a clinic buying AI, the Pieces settlement is the one to read: Texas expected the hospitals, not only the vendor, to question the accuracy claim. Our HIPAA guide for healthcare AI startups covers the federal privacy side that none of these cases touched.
We will add rows as new actions are announced, with the date we checked each one.
Related Reading
- California AB 1979: Health Chatbots Come Under the CMIA
- HTI-5 Drops AI Model Cards: 31 Questions for Your EHR Vendor
- State AG AI Chatbot Lawsuits Tracker
- AI Governance for Healthcare Startups: HIPAA and HITECH
- NIST Solopreneur Cybersecurity Guide (CSWP 50): AI Checks
- EN 18286 Harmonised Standard: What It Covers, Free Copies
