--- title: "Utah Did Not Let AI Prescribe Without a Physician" slug: "utah-ai-prescribing-nolla-stage-gates-audit-trail" author: "ibl.ai Engineering" date: "2026-10-12 11:00:00" category: "Premium" topics: "Utah AI prescribing, Nolla Health, Office of Artificial Intelligence Policy, regulatory mitigation, AI healthcare pilot, clinical AI oversight, stage-gated deployment, healthcare AI audit trail, self-hosted clinical AI" summary: "Utah granted Nolla Health regulatory mitigation, explicitly not an endorsement or approval, for AI-issued first-time topical acne prescriptions. The agreement requires two independent physicians to approve every prescription for the first 100 patients, weekly retrospective review of all cases through 500, and sampling-based review only after 750. This post reads the agreement and corrects the no-physician-review framing." banner: "" thumbnail: "" linkedin: | The story circulating is that Utah authorized AI to issue first-time prescriptions without physician review. The agreement says something more interesting, and it is published. What Utah actually granted Nolla Health is regulatory mitigation: a promise by the Division of Professional Licensing not to bring an enforcement action, for twelve months, within one narrow scope. The document states in its own words that it "is a grant of regulatory mitigation only and does not constitute an endorsement or approval from the State of Utah." Physician review is not removed. It is staged, with patient-count gates: → Stage 1, minimum 4 weeks and 100 patients: the AI submits to staging and an overseeing physician approves every prescription before it reaches a pharmacy. Each one is reviewed by two independent Utah-licensed physicians. → Stage 2, minimum 8 weeks and 500 cumulative patients: the AI submits directly, and a physician retrospectively reviews all cases at least weekly. → Stage 3, minimum 750 cumulative patients: monthly sampling of at least 10% of enrollment, with any adverse event or escalation reviewed in full regardless of sampling. Nolla cannot advance a stage without the Office's prior written approval, and each gate has numeric criteria: 95% or better concordance, zero missed hard stops after QA, zero serious adverse events. Then the part most coverage skipped. Nolla files monthly, quarterly and annual reports to ai@utah.gov, shares de-identified individual-level data with auditors vetted by the Office, and the quarterly reports are made available to the public. So the regulator did not deregulate. It traded enforcement risk for an audit trail, measured in concordance rates and reviewed case counts. Scope stays tight: first-time topical acne prescriptions and renewals for Utah residents 18 and older, with severe or nodulocystic presentations, pregnancy, immunosuppression and severe kidney or liver disease hard-stopped. The lesson for any health system watching this: approval followed the ability to produce evidence. That is an infrastructure property, not a model property. With ibl.ai you own all the code and the data, self-hosted inside your own perimeter, model-agnostic across any LLM, usage-based with no per-seat pricing. #iblai #HealthcareAI #AIGovernance #ClinicalAI #DigitalHealth #AgenticAI --- ## The Short Answer **Utah granted Nolla Health regulatory mitigation, not approval, for AI-issued first-time topical acne prescriptions. The agreement requires two independent physicians to approve every prescription for the first 100 patients, weekly review of all cases through 500, and sampling only after 750. The state bought an audit trail, which is the same control ibl.ai gives you when you own all the code and the data.** The headline version of this story is that a US state removed the physician from first-time prescribing. The agreement is public, and it says otherwise. What Utah did is narrower, better documented, and more useful to anyone deploying clinical AI, because the thing the state asked for was evidence it could read. ## Did Utah authorize AI to prescribe without physician review? No. Review is staged by patient count, and the first stage requires two physicians per prescription. The [agreement](https://commerce.utah.gov/wp-content/uploads/2026/10/RMA-Nolla-Health.pdf) between Utah's Office of Artificial Intelligence Policy, the Division of Professional Licensing, and Magic Health, Inc. with its subsidiary Magic Health Services, LLC, doing business as Nolla Health, sets out three stages.
Stage Minimum Who submits the prescription Physician review
Stage 1 4 weeks, 100 patients AI submits to staging only Every prescription approved before submission, by two independent Utah-licensed physicians
Stage 2 8 weeks, 500 cumulative AI submits directly Retrospective review of all cases, at least weekly
Stage 3 750 cumulative AI submits within approved scope Monthly sampling of at least 10% of enrollment, every adverse event or escalation reviewed in full
Concordance is measured on 100 percent of cases in both Stage 1 and Stage 2. The gate criteria are numeric: **95 percent or better concordance, zero missed hard stops after QA, zero serious adverse events**, and in Stage 1, 100 percent completion of physician pre-review. Crucially, advancement is not automatic. The agreement states that Nolla "shall not commence any succeeding phase without the prior written approval of the Office." Even the baseline that precedes Stage 1 has physicians in the loop: the AI generates recommendations and licensed physicians review, approve and submit, with reported baseline concordance of 95 percent or better over the preceding 12 weeks. So "the AI prescribes and nobody checks" describes no stage of this pilot. The furthest-out stage still samples at least a tenth of enrollment every month, and reads every escalated case in full. ## What exactly did Utah's agreement with Nolla Health permit? A promise not to enforce, inside one narrow scope, for twelve months. The instrument is regulatory mitigation. The Division agrees not to bring an enforcement action for unlicensed or unprofessional conduct, or under the state's telehealth requirements, where Nolla's AI issues first-time topical acne prescriptions or renewals to eligible Utah residents aged 18 and older and transmits them to a Utah-licensed pharmacist. The agreement is unusually direct about what it is not. In its own words, it "is a grant of regulatory mitigation only and does not constitute an endorsement or approval from the State of Utah or any of its political subdivisions." The term runs **twelve months from the Commencement Date**, which the agreement defines as the date Nolla makes the technology available to customers and delivers written notice to the Office. The clock starts on notice, not on signature. Nolla may request no more than two extensions of up to 12 months each. Either party may terminate at any time and for any reason, and on termination Nolla is given 30 days to cease operations in Utah, which the agreement calls the Unwinding Period. Nolla publicly launched under the agreement in early October 2026, at a pilot subscription of **$4.99 per month**, with a compounded formulation shipped from a pharmacy partner at a separate **$49.99** charge. Patients choose generic-to-local-pharmacy or compounded fulfillment, and the agreement notes the AI does not influence that selection. ## What does Utah require Nolla Health to report, and to whom? Monthly, quarterly and annual reports to the state, de-identified case-level data to independent auditors, and the quarterly reports go public. This is the part most coverage skipped, and it is the reason the pilot is interesting rather than alarming. Nolla must submit monthly, quarterly and annual reports to the Office at `ai@utah.gov` for the duration of the agreement, with contents specified in the agreement's Schedule A. Subject to the Office's confidentiality obligations, **the Office makes the quarterly reports available to the public** as submitted. An outside reader gets to watch the concordance rate. Separately, Nolla shares de-identified individual-level pilot data with **third-party auditors vetted by the Office** for external validation on a monthly, quarterly and annual basis, and must meet the minimum sample sizes the statistical protocol requires. Records held by the Office are subject to Utah's Government Records Access and Management Act, so the agreement itself and the required reports sit inside a public-records regime, with the Office classifying the application and reports as protected records only where law permits. ## What can the AI not do under Utah's prescribing pilot? Quite a lot, and the exclusions are written as automatic stops rather than guidance. Eligibility is limited to adults aged 18 or older with mild to moderate acne, with severity determined by AI image assessment across a five-angle capture sequence at intake rather than by patient self-report. Cases scoring above **3.5 on the IGA severity scale** are automatically escalated to the overseeing physician for manual review before any prescription issues. Cases classified as severe or nodulocystic at IGA 4.0 are hard-stopped and the patient is directed to in-person dermatological care. Hard stops also cover pregnancy, intention to become pregnant or breastfeeding, known immunosuppression, severe kidney or liver disease, prior adverse reaction to any formulary medication, any presentation suggesting oral, systemic or isotretinoin-based therapy, a non-Utah delivery address, failed identity verification, and persistent insufficient image quality. The escalation criteria are explicitly constant across all three stages. As the proposal puts it, stage gates govern the oversight level for non-escalated cases only. Scope is bounded by formulary too: the mitigation covers topical acne treatments listed in the agreement's Schedule B, and nothing else. ## Why does an AI prescribing pilot turn on observability rather than model quality? Because the regulator could not evaluate the model, so it evaluated the record instead. Nothing in the agreement asks about architecture, parameter count or benchmark scores. Every obligation it imposes is a reporting or reconstruction obligation: concordance measured on 100 percent of cases, reviewed-case counts, missed hard stops after QA, serious adverse events, data handed to vetted auditors. The proposal matches that shape, describing a system that "includes auditability, traceability, and physician escalation mechanisms throughout the care process." This is the same pattern we traced in [You Cannot Govern a Clinical Model You Cannot Observe](/blog/clinical-ai-governance-observability-hospitals-own-the-stack), and the same reason single-turn benchmarks mislead on clinical agents, covered in [Hospital AI Agents Fail the Actions, Not the Answers](/blog/hospital-ai-agents-single-turn-tests-grade-the-actions). It also runs into a live infrastructure gap. The telemetry standard that would let an operator correlate an agent decision across its memory, model and tool layers is still unreleased, as we documented in [AI Agent Observability Has No Standard to Buy Yet](/blog/agent-observability-fragmenting-stack-own-the-audit-trail). A pilot that must produce weekly 100-percent case review and public quarterly concordance figures cannot treat that as someone else's problem. ## What should a health system take from Utah's AI prescribing agreement? That permission followed the ability to produce evidence, and evidence is an infrastructure property. Nolla did not get further than any competitor because of a better model. It got a twelve-month, narrowly scoped non-enforcement promise because it could commit to staged gates, numeric thresholds, auditor access and public reporting, and be held to them. Any organization wanting to be on the authorized side of that line needs the same capacity: per-decision provenance, retrospective review at a defined sampling rate, escalation that is enforced rather than advised, and exports its auditors can read. Those are properties of the stack you run, and they survive only if you keep them. On ibl.ai you receive the source under a perpetual license and run it inside your own perimeter, so the audit trail, the retention policy and the export format are yours, including in a deployment with no outbound connectivity at all. Utah's agreement is a reminder of which half of the AI question regulators are actually asking. It is not what the model can do. It is what you can show. --- *Sources: the parties, the "regulatory mitigation only and does not constitute an endorsement or approval" language, the scope of non-enforcement, the twelve-month term measured from the Commencement Date, the two-extension limit, the 30-day Unwinding Period, the reporting obligations to ai@utah.gov, the public release of quarterly reports, the OAIP-vetted third-party auditor data sharing, the GRAMA treatment, the Stage 1 to Stage 3 gates with their patient minimums and concordance criteria, the prior-written-approval requirement for stage advancement, the IGA 3.5 escalation and IGA 4.0 hard stop, the eligibility exclusions and the Schedule B formulary limit are all read directly from the [agreement published by the Utah Department of Commerce](https://commerce.utah.gov/wp-content/uploads/2026/10/RMA-Nolla-Health.pdf), which includes Nolla's April 2026 pilot proposal as an exhibit. The October 2026 launch, the $4.99 subscription and the $49.99 compounded-medication charge are from that document and from [Becker's Hospital Review](https://www.beckershospitalreview.com/healthcare-information-technology/ai/utah-approves-1st-ai-pilot-to-issue-initial-prescriptions/). The brief's framing that the AI prescribes "without physician review" is corrected here against the agreement's own stage gates. No signature date is stated: secondary coverage reports one, and the extracted text of the published agreement does not carry it.* ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.