HB 1925 — An Act amending Titles 35 (Health and Safety), 40 (Insurance) and 67 (Public Welfare) of the Pennsylvania Consolidated Statutes, providing for artificial intelligence in facilities, for artificial intelligence use by insurers and for artificial intelligence use by MA or CHIP managed care plans; imposing duties on the Department of Health, the Insurance Department and the Department of Human Services; and imposing penalties.

PRINTER'S NO.   2403

                     THE GENERAL ASSEMBLY OF PENNSYLVANIA



                          HOUSE BILL
                          No. 1925
                                                 Session of
                                                   2025

     INTRODUCED BY VENKAT, HOGAN, KHAN, KOSIEROWSKI, SCOTT, HILL-
        EVANS, FREEMAN, RIVERA, HANBIDGE, HADDOCK, SANCHEZ, MAYES,
        HOWARD, GUZMAN, DONAHUE, GILLEN, GREEN, WAXMAN, PROBST,
        PIELLI, McNEILL, BOROWSKI AND SHUSTERMAN, OCTOBER 6, 2025

     REFERRED TO COMMITTEE ON COMMUNICATIONS AND TECHNOLOGY,
        OCTOBER 6, 2025


                                      AN ACT
 1   Amending Titles 35 (Health and Safety) and 40 (Insurance) of the
 2      Pennsylvania Consolidated Statutes, providing for artificial
 3      intelligence in facilities, for artificial intelligence use
 4      by insurers and for artificial intelligence use by MA or CHIP
 5      managed care plans; imposing duties on the Department of
 6      Health, the Insurance Department and the Department of Human
 7      Services; and imposing penalties.
 8      The General Assembly of the Commonwealth of Pennsylvania
 9   hereby enacts as follows:
10      Section 1.      Title 35 of the Pennsylvania Consolidated
11   Statutes is amended by adding a chapter to read:
12                                  CHAPTER 35
13                   ARTIFICIAL INTELLIGENCE IN FACILITIES
14   Sec.
15   3501.   Definitions.
16   3502.   Disclosure.
17   3503.   Responsible use.
18   3504.   Artificial intelligence compliance statements.
19   3505.   Reports.
 1   3506.   Retention of records.
 2   3507.   Oversight.
 3   3508.   Third-party vendor.
 4   3509.   Exemption.
 5   3510.   Enforcement and penalties.
 6   3511.   Plan of correction.
 7   3512.   Administrative procedures.
 8   3513.   Regulations and guidance.
 9   § 3501.   Definitions.
10      The following words and phrases when used in this chapter
11   shall have the meanings given to them in this section unless the
12   context clearly indicates otherwise:
13      "Artificial intelligence" or "AI."      A machine-based system
14   that can, for a given set of human-defined objectives, make
15   predictions, recommendations or decisions influencing real or
16   virtual environments that use machine-based and human-based
17   inputs to perceive real and virtual environments, abstract the
18   perceptions into models through analysis in an automated manner
19   and use model inference to formulate options for information or
20   action. The term includes generative artificial intelligence
21   which is the class of models that emulate the structure and
22   characteristics of input data in order to generate derived
23   synthetic content which includes information such as images,
24   videos, audio clips and text that has been significantly
25   modified or generated by algorithms, including by artificial
26   intelligence.
27      "Artificial intelligence-based algorithms."      The programming
28   and data sets that inform an artificial intelligence system.
29      "Clinical decision making."      A patient-centered problem-
30   solving process focused on a health care provider's direct

20250HB1925PN2403                    - 2 -
 1   patient care involving gathering information, diagnosing and
 2   planning treatments.
 3      "Department."     The Department of Health of the Commonwealth.
 4      "Facility."     A health care setting or institution providing
 5   health care services, including:
 6             (1)   A general, special, psychiatric or rehabilitation
 7      hospital.
 8             (2)   An ambulatory surgical facility.
 9             (3)   A cancer treatment center.
10             (4)   A birth center.
11             (5)   An inpatient, outpatient or residential drug and
12      alcohol treatment facility.
13             (6)   A facility licensed by the Department of Human
14      Services' Office of Mental Health and Substance Abuse
15      Services.
16             (7)   A laboratory, imaging, diagnostic or other
17      outpatient medical service or testing facility.
18             (8)   A health care provider office or clinic that is
19      owned by or employs a Commonwealth-licensed physician,
20      physician assistant or nurse practitioner.
21      "Health care provider."        As follows:
22             (1)   A facility or individual who is licensed, certified
23      or otherwise regulated to provide health care services under
24      the laws of this Commonwealth.
25             (2)   The term does not include an individual providing
26      emergency services under a licensed emergency medical
27      services agency as defined in section 8103 (relating to
28      definitions).
29   § 3502.    Disclosure.
30      (a)    Duty to disclose.--A facility shall disclose to patients

20250HB1925PN2403                       - 3 -
 1   of the facility if artificial intelligence-based algorithms are
 2   or will be used for clinical decision making or other similar
 3   tasks. The disclosure shall be:
 4             (1)   Provided in all related written communications.
 5             (2)   Posted on the publicly accessible Internet website
 6      of the facility.
 7      (b)    Communications.--
 8             (1)   A facility that uses artificial intelligence to
 9      generate written or verbal patient communications pertaining
10      to patient clinical information shall include:
11                   (i)    A clear and conspicuous disclaimer that
12             indicates that the communication was generated by
13             artificial intelligence.
14                   (ii)    Clear instructions on how the patient may
15             contact a human health care provider or relevant employee
16             of the facility with questions.
17             (2)   The requirements under paragraph (1) shall not apply
18      to communications that:
19                   (i)    only pertain to administrative matters,
20             including appointment scheduling, billing or other
21             clerical or business matters; or
22                   (ii)    have been individually read and reviewed by a
23             human health care provider.
24      (c)    Nature and frequency.--The department shall determine
25   the nature and frequency of disclosure requirements to the
26   patient. The department may request input from facilities and
27   health care providers or their representatives in making the
28   determination.
29   § 3503.    Responsible use.
30      (a)    Compliance generally.--The criteria for the artificial

20250HB1925PN2403                        - 4 -
 1   intelligence-based algorithms must comply with this chapter and
 2   applicable Federal and State law.
 3      (b)   Requirements for artificial intelligence-based
 4   algorithms.--For each instance in which a facility uses
 5   artificial intelligence-based algorithms for clinical decision
 6   making, the facility shall comply with the following:
 7            (1)   The artificial intelligence-based algorithms must
 8      not supersede health care provider clinical decision making.
 9            (2)   The artificial intelligence-based algorithms and
10      training data sets must not directly or indirectly
11      discriminate against patients in violation of Federal or
12      State law.
13            (3)   The artificial intelligence-based algorithms must be
14      fairly and equitably applied, including in accordance with
15      any applicable regulations and or guidance issued by the
16      United States Department of Health and Human Services.
17            (4)   The use of the artificial intelligence-based
18      algorithms must be disclosed in accordance with section 3502
19      (relating to disclosure).
20            (5)   The performance, use and outcomes of the artificial
21      intelligence-based algorithms must be periodically reviewed
22      and revised to maximize accuracy and reliability.
23            (6)   Patient data must not be used beyond the intended
24      and stated purpose of the artificial intelligence-based
25      algorithms, consistent with the laws of this Commonwealth and
26      42 U.S.C. Ch. 7 Subch. XI Part C (relating to administrative
27      simplification), as applicable.
28            (7)   The artificial intelligence-based algorithms must
29      not create foreseeable, material risks of harm to the
30      patient.

20250HB1925PN2403                    - 5 -
 1   § 3504.    Artificial intelligence compliance statements.
 2      (a)    Compliance statement required.--A facility using
 3   artificial intelligence-based algorithms for clinical decision
 4   making shall annually file with the department in the form and
 5   manner prescribed by the department an artificial intelligence
 6   compliance statement.
 7      (b)    Contents.--Each compliance statement must:
 8             (1)   Summarize the function and scope of artificial
 9      intelligence-based algorithms used for clinical decision
10      making.
11             (2)   Provide a logic or decision tree of artificial
12      intelligence-based algorithms used for clinical decision
13      making.
14             (3)   Provide a description of each training data set used
15      by artificial intelligence-based algorithms for clinical
16      decision making, including the source of the data.
17             (4)   Attest that the artificial intelligence-based
18      algorithms and the training data sets comply with section
19      3503 (relating to responsible use) and provide evidence of
20      the compliance.
21             (5)   Describe the process of the facility for overseeing
22      and validating the performance and compliance of the
23      artificial intelligence-based algorithms in accordance with
24      section 3503.
25   § 3505.    Reports.
26      (a)    Annual report required.--No later than one year after
27   the effective date of this chapter and each year thereafter, the
28   department shall compile the information from the most recent
29   annual compliance statements under section 3504 (relating to
30   artificial intelligence compliance statements) and issue a

20250HB1925PN2403                     - 6 -
 1   report containing the compiled information, along with any other
 2   applicable findings and recommendations. The information in the
 3   report shall be aggregated and deidentified.
 4      (b)     Posting.--The department shall post each report under
 5   this section on the publicly accessible Internet website of the
 6   department.
 7   § 3506.    Retention of records.
 8      The department shall establish a record retention policy and
 9   determine the amount of time a facility shall retain records
10   related to artificial-intelligence algorithms. The department
11   may request input from facilities and health care providers or
12   their representatives in making the determination under this
13   section.
14   § 3507.    Oversight.
15      The department may request additional information and
16   evidence from a facility regarding the items provided under
17   sections 3502 (relating to disclosure), 3503 (relating to
18   responsible use) and 3504 (relating to artificial intelligence
19   compliance statements) that are necessary to ensure compliance
20   with this chapter.
21   § 3508.    Third-party vendor.
22      A contractor, subcontractor or other third-party vendor that
23   sells, leases, subscribes or otherwise supplies artificial
24   intelligence-based algorithms or services based on artificial
25   intelligence-based algorithms to the facility shall be subject
26   to this chapter. The department shall develop regulations or
27   guidance regarding the responsibility of a contractor,
28   subcontractor or other third-party vendor that sells, leases,
29   subscribes or otherwise supplies artificial intelligence-based
30   algorithms or services based on artificial intelligence-based

20250HB1925PN2403                     - 7 -
 1   algorithms to the facility. The department may request input
 2   from facilities, third-party vendors and health care providers
 3   or their representatives in making this determination.
 4   § 3509.    Exemption.
 5      This chapter shall not apply to validated, static decision-
 6   support tools or tools used for administration, scheduling,
 7   scribe applications or clinical calculators.
 8   § 3510.    Enforcement and penalties.
 9      (a)    Civil penalties.--
10             (1)   Subject to paragraph (2), the department may impose
11      a civil penalty not exceeding $5,000 for a violation of this
12      chapter. For purposes of this paragraph, each instance of
13      nondisclosure shall constitute a separate violation of this
14      chapter.
15             (2)   The following apply to limitations on civil
16      penalties under this subsection:
17                   (i)    A civil penalty imposed against a facility may
18             not exceed $500,000 in the aggregate during a single
19             calendar year.
20                   (ii)   A civil penalty imposed against any other
21             person may not exceed $100,000 in the aggregate during a
22             single calendar year.
23      (b)    Injunction.--The department may maintain an action in
24   the name of the Commonwealth for an injunction to prohibit any
25   activity that violates the provisions of this chapter.
26      (c)    Nonexclusive remedies.--The enforcement remedies and
27   penalties imposed under this chapter are in addition to any
28   other remedies or penalties that may be imposed under any other
29   applicable law of this Commonwealth, including the act of July
30   19, 1979 (P.L.130, No.48), known as the Health Care Facilities

20250HB1925PN2403                        - 8 -
 1   Act.
 2   § 3511.    Plan of correction.
 3      (a)    Authorization.--The department may require a facility to
 4   develop and adhere to a plan of correction approved by the
 5   department. The department may impose a plan of correction in
 6   lieu of fines.
 7      (b)    Compliance.--The department shall monitor compliance
 8   with the plan of correction under this section.
 9      (c)    Availability.--The plan of correction shall, upon
10   request, be made available to patients of the facility.
11   § 3512.    Administrative procedures.
12      (a)    Applicable procedures.--This chapter shall be subject to
13   2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
14   Commonwealth agencies).
15      (b)    Appeal.--A party against whom penalties are assessed in
16   an administrative action may appeal to Commonwealth Court as
17   provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
18   review of Commonwealth agency action).
19   § 3513.    Regulations and guidance.
20      The department shall promulgate regulations or guidance
21   necessary to implement, administer and enforce this chapter. The
22   department shall review regulations or guidance every three
23   years to ensure compliance with Federal law or Federal agency
24   guidance.
25      Section 2.    Title 40 is amended by adding chapters to read:
26                                CHAPTER 52
27                 ARTIFICIAL INTELLIGENCE USE BY INSURERS
28   Sec.
29   5201.    Definitions.
30   5202.    Disclosure.

20250HB1925PN2403                     - 9 -
 1   5203.   Responsible use.
 2   5204.   Artificial intelligence compliance statements.
 3   5205.   Health care provider requirements.
 4   5206.   Reports.
 5   5207.   Retention of records.
 6   5208.   Oversight.
 7   5209.   Third-party vendor.
 8   5210.   Exemption.
 9   5211.   Enforcement and penalties.
10   5212.   Plan of correction.
11   5213.   Administrative procedures.
12   5214.   Regulations and guidance.
13   § 5201.   Definitions.
14      The following words and phrases when used in this chapter
15   shall have the meanings given to them in this section unless the
16   context clearly indicates otherwise:
17      "Artificial intelligence" or "AI."    A machine-based system
18   that can, for a given set of human-defined objectives, make
19   predictions, recommendations or decisions influencing real or
20   virtual environments that use machine-based and human-based
21   inputs to perceive real and virtual environments, abstract the
22   perceptions into models through analysis in an automated manner
23   and use model inference to formulate options for information or
24   action. The term includes generative artificial intelligence
25   which is the class of models that emulate the structure and
26   characteristics of input data in order to generate derived
27   synthetic content which includes information such as images,
28   videos, audio clips and text that has been significantly
29   modified or generated by algorithms, including by artificial
30   intelligence.

20250HB1925PN2403                    - 10 -
 1      "Artificial intelligence-based algorithms."        The programming
 2   and data sets that inform an artificial intelligence system.
 3      "Covered person."        A policyholder, subscriber or other
 4   individual who is entitled to receive health care services under
 5   a health insurance policy.
 6      "Department."        The Insurance Department of the Commonwealth.
 7      "Health care provider."        As follows:
 8             (1)   A facility or individual who is licensed, certified
 9      or otherwise regulated to provide health care services under
10      the laws of this Commonwealth.
11             (2)   The term does not include an individual providing
12      emergency services under a licensed emergency medical
13      services agency as defined in 35 Pa.C.S. § 8103 (relating to
14      definitions).
15      "Health care service."        Any covered treatment, admission,
16   procedure or other services, including behavioral health,
17   prescribed or otherwise provided or proposed to be provided by a
18   health care provider to a covered person for the diagnosis,
19   prevention, treatment, cure or relief of a health condition,
20   illness, injury or disease under the terms of a health insurance
21   policy.
22      "Health insurance policy."         As follows:
23             (1)   A policy, subscriber contract, certificate or plan
24      issued by an insurer that provides medical or health care
25      coverage.
26             (2)   The term does not include:
27                   (i)    An accident only policy.
28                   (ii)    A credit only policy.
29                   (iii)    A long-term care or disability income policy.
30                   (iv)    A specified disease policy.

20250HB1925PN2403                        - 11 -
 1                 (v)    A Medicare supplement policy.
 2                 (vi)    A TRICARE policy, including a Civilian Health
 3          and Medical Program of the Uniformed Services (CHAMPUS)
 4          supplement policy.
 5                 (vii)    A fixed indemnity policy.
 6                 (viii)    A hospital indemnity policy.
 7                 (ix)    A workers' compensation policy.
 8                 (x)    An automobile medical payment policy under 75
 9          Pa.C.S. (relating to vehicles).
10                 (xi)    A homeowner's insurance policy.
11      "Insurer."       As follows:
12          (1)    An entity licensed by the department that offers,
13      issues or renews an individual or group health insurance
14      policy that is offered or governed under any of the
15      following:
16                 (i)    Chapter 61 (relating to hospital plan
17          corporations) or 63 (relating to professional health
18          services plan corporations).
19                 (ii)    The act of May 17, 1921 (P.L.682, No.284),
20          known as The Insurance Company Law of 1921, including
21          section 630 and Article XXIV thereof.
22                 (iii)    The act of December 29, 1972 (P.L.1701,
23          No.364), known as the Health Maintenance Organization
24          Act.
25          (2)    The term does not include an entity operating as an
26      MA or CHIP managed care plan.
27      "Participating network provider."       A health care provider
28   that has entered into a contractual or operating relationship
29   with an insurer to participate in one or more designated
30   networks of the insurer and to provide health care services to

20250HB1925PN2403                      - 12 -
 1   covered persons under the terms of the insurer's administrative
 2   policy.
 3      "Prior authorization request."         As defined under section 2102
 4   of The Insurance Company Law of 1921.
 5      "Utilization review."      As defined under section 2102 of The
 6   Insurance Company Law of 1921.
 7   § 5202.    Disclosure.
 8      (a)    Duty to disclose.--An insurer shall disclose to a
 9   participating network provider and all covered persons if
10   artificial intelligence-based algorithms are or will be used in
11   the utilization review process of the insurer.
12      (b)    Posting.--An insurer shall post the information about
13   the use of artificial intelligence-based algorithms in the
14   utilization review process of the insurer on the publicly
15   accessible Internet website of the insurer.
16      (c)    Nature and frequency.--The department shall determine
17   the nature and frequency of disclosure requirements to covered
18   persons. The department may request input from insurers or their
19   representatives in making this determination.
20   § 5203.    Responsible use.
21      (a)    Compliance generally.--The criteria for the artificial
22   intelligence-based algorithms must comply with this chapter and
23   applicable Federal and State law.
24      (b)    Requirements for artificial intelligence-based
25   algorithms.--For each instance in which an insurer uses
26   artificial intelligence-based algorithms in the utilization
27   review process regarding a covered person, the insurer shall
28   comply with the following:
29             (1)   The artificial intelligence-based algorithms must
30      base a determination on all of the following:

20250HB1925PN2403                     - 13 -
 1              (i)    The medical or other clinical history of the
 2        covered person.
 3              (ii)    Individual clinical or nonclinical
 4        circumstances as presented by the requesting health care
 5        provider.
 6              (iii)    Other relevant clinical or nonclinical
 7        information contained in the medical or other clinical
 8        record of the covered person.
 9        (2)   The artificial intelligence-based algorithms must
10    not base a determination solely on a group data set.
11        (3)   The artificial intelligence-based algorithms must
12    not supersede decision making of the health care provider
13    conducting the utilization review.
14        (4)   The artificial intelligence-based algorithms and
15    training data sets must not directly or indirectly
16    discriminate against covered persons in violation of Federal
17    or State law.
18        (5)   The artificial intelligence-based algorithms must be
19    fairly and equitably applied, including in accordance with
20    any applicable regulations or guidance issued by the United
21    States Department of Health and Human Services.
22        (6)   The use of the artificial intelligence-based
23    algorithms must be disclosed in accordance with section 5202
24    (relating to disclosure).
25        (7)   The performance, use and outcomes of the artificial
26    intelligence-based algorithms must be periodically reviewed
27    and revised to maximize accuracy and reliability.
28        (8)   The data of the covered person must not be used
29    beyond the intended and stated purpose of the artificial
30    intelligence-based algorithms, consistent with Commonwealth

20250HB1925PN2403                   - 14 -
 1      law and 42 U.S.C. Ch. 7, Subch. XI Part C (relating to
 2      administrative simplification), as applicable.
 3             (9)   The artificial intelligence-based algorithms must
 4      not create foreseeable, material risks of harm to the covered
 5      person.
 6   § 5204.    Artificial intelligence compliance statements.
 7      (a)    Compliance statement required.--An insurer using
 8   artificial intelligence-based algorithms in the utilization
 9   review process shall annually file with the department in the
10   form and manner prescribed by the department an artificial
11   intelligence compliance statement.
12      (b)    Contents.--Each compliance statement must:
13             (1)   Summarize the function and scope of the artificial
14      intelligence-based algorithms used for utilization review.
15             (2)   Provide a logic or decision tree of artificial
16      intelligence-based algorithms used for utilization review.
17             (3)   Provide a description of each training data set used
18      by artificial intelligence-based algorithms for utilization
19      review, including the source of the data.
20             (4)   Attest that the artificial intelligence-based
21      algorithms and the training data sets comply with section
22      5203 (relating to responsible use) and provide evidence of
23      the compliance.
24             (5)   Describe the process of the insurer for overseeing
25      and validating the performance and compliance of the
26      artificial intelligence-based algorithms in accordance with
27      section 5203.
28   § 5205.    Health care provider requirements.
29      Prior to issuing or upholding a decision to deny, reduce or
30   terminate benefits for a health care service, including a

20250HB1925PN2403                     - 15 -
 1   decision to deny a prior authorization request, a health care
 2   provider who participates in utilization review on behalf of an
 3   insurer shall:
 4             (1)   Review individual clinical records and other
 5      relevant information.
 6             (2)   Document the review under paragraph (1).
 7             (3)   Based on the review under paragraph (1), exercise
 8      judgment independent of any recommendations by the artificial
 9      intelligence-based algorithms.
10   § 5206.    Reports.
11      (a)    Annual report required.--No later than one year after
12   the effective date of this chapter, and annually thereafter, the
13   department shall compile the information from the most recent
14   annual compliance statements under section 5204 (relating to
15   artificial intelligence compliance statements) and issue a
16   report to the General Assembly containing the compiled
17   information, along with any other applicable findings and
18   recommendations. The information in the report shall be
19   aggregated and deidentified.
20      (b)    Posting.--The department shall post each report under
21   this section on the publicly accessible Internet website of the
22   department.
23   § 5207.    Retention of records.
24      The department shall establish a record retention policy and
25   determine the amount of time an insurer shall retain records.
26   The department may request input from insurers or their
27   representatives in making this determination.
28   § 5208.    Oversight.
29      The department may request additional information and
30   evidence from an insurer regarding the items provided under

20250HB1925PN2403                     - 16 -
 1   sections 5202 (relating to disclosure), 5203 (relating to
 2   responsible use) and 5204 (relating to artificial intelligence
 3   compliance statements) that are necessary to ensure compliance
 4   with this chapter.
 5   § 5209.    Third-party vendor.
 6      A contractor, subcontractor or other third-party vendor that
 7   sells, leases, subscribes or otherwise supplies artificial
 8   intelligence-based algorithms or services based on artificial
 9   intelligence-based algorithms to the insurer services shall be
10   subject to this chapter. The department shall develop
11   regulations or guidelines regarding the responsibility of a
12   contractor, subcontractor or other third-party vendor that
13   sells, leases, subscribes or otherwise supplies artificial
14   intelligence-based algorithms or services based on artificial
15   intelligence-based algorithms to the insurer. The department may
16   request input from insurers, third-party vendors and health care
17   providers or their representatives in making this determination.
18   § 5210.    Exemption.
19      This chapter shall not apply to artificial intelligence-based
20   algorithms used for administrative, scheduling or other purposes
21   not pertaining to the insurer's decision to deny, reduce or
22   terminate benefits.
23   § 5211.    Enforcement and penalties.
24      (a)    Civil penalties.--
25             (1)   Subject to paragraph (2), the department may impose
26      a civil penalty not exceeding $5,000 for a violation of this
27      chapter. For purposes of this paragraph, each instance of
28      nondisclosure shall constitute a separate violation of this
29      chapter.
30             (2)   The following apply to limitations on civil

20250HB1925PN2403                     - 17 -
 1      penalties under this subsection:
 2                   (i)    A civil penalty imposed against an insurer may
 3             not exceed $500,000 in the aggregate during a single
 4             calendar year.
 5                   (ii)   A civil penalty imposed against any other
 6             person may not exceed $100,000 in the aggregate during a
 7             single calendar year.
 8      (b)    Unfair Insurance Practices Act.--
 9             (1)   An insurer shall be subject to the act of July 22,
10      1974 (P.L.589, No.205), known as the Unfair Insurance
11      Practices Act.
12             (2)   A violation of any provision of this chapter shall
13      be deemed to be a violation of the Unfair Insurance Practices
14      Act.
15      (c)    Injunction.--The department may maintain an action in
16   the name of the Commonwealth for an injunction to prohibit any
17   activity that violates the provisions of this chapter.
18      (d)    Effect on enrollment.--The department may issue an order
19   temporarily prohibiting an insurer that violates this chapter
20   from enrolling new covered persons.
21      (e)    Nonexclusive remedies.--The enforcement remedies and
22   penalties imposed under this chapter are in addition to any
23   other remedies or penalties that may be imposed under any other
24   applicable law of this Commonwealth, including:
25             (1)   The Unfair Insurance Practices Act.
26             (2)   The act of December 18, 1996 (P.L.1066, No.159),
27      known as the Accident and Health Filing Reform Act.
28             (3)   The act of June 25, 1997 (P.L.295, No.29), known as
29      the Pennsylvania Health Care Insurance Portability Act.
30   § 5212.    Plan of correction.

20250HB1925PN2403                        - 18 -
 1      (a)    Authorization.--The department may require an insurer to
 2   develop and adhere to a plan of correction approved by the
 3   department. The department may impose a plan of correction in
 4   lieu of fines.
 5      (b)    Compliance.--The department shall monitor compliance
 6   with the plan of correction under this section.
 7      (c)    Availability.--The plan of correction shall, upon
 8   request, be made available to covered persons of the insurer.
 9   § 5213.    Administrative procedures.
10      (a)    Applicable procedures.--This chapter shall be subject to
11   2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
12   Commonwealth agencies).
13      (b)    Appeal.--A party against whom penalties are assessed in
14   an administrative action may appeal to Commonwealth Court as
15   provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
16   review of Commonwealth agency action).
17   § 5214.    Regulations and guidance.
18      The department shall promulgate regulations or guidance
19   necessary to implement, administer and enforce this chapter. The
20   department shall review regulations or guidance every three
21   years to ensure compliance with Federal law or Federal agency
22   guidance.
23                                 CHAPTER 53
24                  ARTIFICIAL INTELLIGENCE USE BY MA OR CHIP
25                               MANAGED CARE PLANS
26   Sec.
27   5301.    Definitions.
28   5302.    Disclosure.
29   5303.    Responsible use.
30   5304.    Artificial intelligence compliance statements.

20250HB1925PN2403                    - 19 -
 1   5305.   Health care provider requirements.
 2   5306.   Reports.
 3   5307.   Retention of records.
 4   5308.   Oversight.
 5   5309.   Third-party vendor.
 6   5310.   Exemption.
 7   5311.   Enforcement and penalties.
 8   5312.   Plan of correction.
 9   5313.   Administrative procedures.
10   5314.   Regulations and guidance.
11   § 5301. Definitions.
12      The following words and phrases when used in this chapter
13   shall have the meanings given to them in this section unless the
14   context clearly indicates otherwise:
15      "Agreement with the department."      As follows:
16           (1)    An agreement between an MA or CHIP managed care plan
17      and the department to manage the purchase and provision of
18      services.
19           (2)    The term includes a county or multicounty agreement
20      with the department for behavioral health services.
21      "Artificial intelligence" or "AI."      A machine-based system
22   that can, for a given set of human-defined objectives, make
23   predictions, recommendations or decisions influencing real or
24   virtual environments that use machine-based and human-based
25   inputs to perceive real and virtual environments, abstract the
26   perceptions into models through analysis in an automated manner
27   and use model inference to formulate options for information or
28   action. The term includes generative artificial intelligence
29   which is the class of models that emulate the structure and
30   characteristics of input data in order to generate derived

20250HB1925PN2403                    - 20 -
 1   synthetic content which includes information such as images,
 2   videos, audio clips and text that has been significantly
 3   modified or generated by algorithms, including by artificial
 4   intelligence.
 5      "Artificial intelligence-based algorithms."    The programming
 6   and data sets that inform an artificial intelligence system.
 7      "Department."    The Department of Human Services of the
 8   Commonwealth.
 9      "Enrollee."    An individual who is entitled to receive health
10   care services under an agreement with the department.
11      "Facility."    A health care setting or institution providing
12   health care services, including:
13          (1)     A general, special, psychiatric or rehabilitation
14      hospital.
15          (2)     An ambulatory surgical facility.
16          (3)     A cancer treatment center.
17          (4)     A birth center.
18          (5)     An inpatient, outpatient or residential drug and
19      alcohol treatment facility.
20          (6)     A facility licensed by the department's Office of
21      Mental Health and Substance Abuse Services.
22          (7)     A laboratory, imaging, diagnostic or other
23      outpatient medical service or testing facility.
24          (8)     A health care provider office or clinic that is
25      owned by or employs a Commonwealth-licensed physician,
26      physician assistant or nurse practitioner.
27      "Health care provider."       As follows:
28          (1)     A facility or individual who is licensed, certified
29      or otherwise regulated to provide health care services under
30      the laws of this Commonwealth.

20250HB1925PN2403                      - 21 -
 1             (2)   The term does not include an individual providing
 2      emergency services under a licensed emergency medical
 3      services agency as defined in 35 Pa.C.S. § 8103 (relating to
 4      definitions).
 5      "Health care service."     Any covered treatment, admission,
 6   procedure or other services, including behavioral health,
 7   prescribed or otherwise provided or proposed to be provided by a
 8   health care provider to a covered person for the diagnosis,
 9   prevention, treatment, cure or relief of a health condition,
10   illness, injury or disease under the terms of a health insurance
11   policy or agreement with the department.
12      "Medical Assistance or Children's Health Insurance Program
13   managed care plan" or "MA or CHIP managed care plan."        As
14   defined under section 2102 of the act of May 17, 1921 (P.L.682,
15   No.284), known as The Insurance Company Law of 1921.
16      "Participating network provider."        A health care provider
17   that has entered into a contractual or operating relationship
18   with an MA or CHIP managed care plan to participate in one or
19   more designated networks of the MA or CHIP managed care plan and
20   to provide health care services to enrollees under the terms of
21   the or an agreement with the department.
22      "Prior authorization request."         As defined under section 2102
23   of The Insurance Company Law of 1921.
24      "Utilization review."     As defined under section 2102 of The
25   Insurance Company Law of 1921.
26   § 5302.    Disclosure.
27      (a)    Duty to disclose.--An MA or CHIP managed care plan shall
28   disclose to a participating network provider and all enrollees
29   if artificial intelligence-based algorithms are or will be used
30   in the utilization review process of the MA or CHIP managed care

20250HB1925PN2403                     - 22 -
 1   plan.
 2      (b)    Posting.--An MA or CHIP managed care plan shall post the
 3   information about the use of artificial intelligence-based
 4   algorithms in the utilization review process of the MA or CHIP
 5   managed care plan on the publicly accessible Internet website of
 6   the MA or CHIP managed care plan.
 7      (c)    Nature and frequency.--The department shall determine
 8   the nature and frequency of disclosure requirements to
 9   enrollees. The department may request input from MA or CHIP
10   managed care plans or their representatives in making this
11   determination.
12   § 5303.    Responsible use.
13      (a)    Compliance generally.--The criteria for the artificial
14   intelligence-based algorithms must comply with this chapter and
15   applicable Federal and State law.
16      (b)    Requirements for artificial intelligence-based
17   algorithms.--For each instance in which a MA or CHIP managed
18   care plan uses artificial intelligence-based algorithms in the
19   utilization review process regarding an enrollee, the MA or CHIP
20   managed care plan shall comply with the following:
21             (1)   The artificial intelligence-based algorithms must
22      base a determination on all of the following:
23                   (i)    The medical or other clinical history of the
24             enrollee.
25                   (ii)    Individual clinical or nonclinical
26             circumstances as presented by the requesting health care
27             provider.
28                   (iii)    Other relevant clinical or nonclinical
29             information contained in the medical or other clinical
30             record of the enrollee.

20250HB1925PN2403                        - 23 -
 1             (2)   The artificial intelligence-based algorithms must
 2      not base a determination solely on a group data set.
 3             (3)   The artificial intelligence-based algorithms must
 4      not supersede decision making of the health care provider
 5      conducting the utilization review.
 6             (4)   The artificial intelligence-based algorithms and
 7      training data sets must not directly or indirectly
 8      discriminate against the enrollees in violation of Federal or
 9      State law.
10             (5)   The artificial intelligence-based algorithms must be
11      fairly and equitably applied, including in accordance with
12      any applicable regulations and guidance issued by the United
13      States Department of Health and Human Services.
14             (6)   The use of the artificial intelligence-based
15      algorithms must be disclosed in accordance with section 5302
16      (relating to disclosure).
17             (7)   The performance, use and outcomes of the artificial
18      intelligence-based algorithms must be periodically reviewed
19      and revised to maximize accuracy and reliability.
20             (8)   The data of the covered person or enrollees must not
21      be used beyond the intended and stated purpose of the
22      artificial intelligence-based algorithms, consistent with the
23      laws of this Commonwealth and the Health Insurance
24      Portability and Accountability Act of 1996 (Public Law 104-
25      191, 110 Stat. 1936), as applicable.
26             (9)   The artificial intelligence-based algorithms must
27      not create foreseeable, material risks of harm to the
28      enrollee.
29   § 5304.    Artificial intelligence compliance statements.
30      (a)    Compliance statement required.--An MA or CHIP managed

20250HB1925PN2403                     - 24 -
 1   care plan using artificial intelligence-based algorithms in the
 2   utilization review process shall annually file with the
 3   department, in the form and manner prescribed by the department,
 4   an artificial intelligence compliance statement.
 5      (b)    Contents.--Each compliance statement must:
 6             (1)   Summarize the function and scope of the artificial
 7      intelligence-based algorithms used for utilization review.
 8             (2)   Provide a logic or decision tree of artificial
 9      intelligence-based algorithms used for utilization review.
10             (3)   Provide a description of each training data set used
11      by artificial intelligence-based algorithms for utilization
12      review, including the source of the data.
13             (4)   Attest that the artificial intelligence-based
14      algorithms and the training data sets comply with section
15      5303 (relating to responsible use) and provide evidence of
16      the compliance.
17             (5)   Describe the process of the MA or CHIP managed care
18      plan for overseeing and validating the performance and
19      compliance of the artificial intelligence-based algorithms in
20      accordance with section 5303.
21   § 5305.    Health care provider requirements.
22      Prior to issuing or upholding a decision to deny, reduce or
23   terminate benefits for a health care service, including a
24   decision to deny a prior authorization request, a health care
25   provider who participates in utilization review on behalf of an
26   MA or CHIP managed care plan shall:
27             (1)   Review individual clinical records and other
28      relevant information.
29             (2)   Document the review under paragraph (1).
30             (3)   Based on the review under paragraph (1), exercise

20250HB1925PN2403                     - 25 -
 1      judgment independent of any recommendations by the artificial
 2      intelligence-based algorithms.
 3   § 5306.   Reports.
 4      (a)    Annual report required.--No later than one year after
 5   the effective date of this chapter, and annually thereafter, the
 6   department shall compile the information from the most recent
 7   annual compliance statements under section 5304 (relating to
 8   artificial intelligence compliance statements) and issue a
 9   report to the General Assembly containing the compiled
10   information, along with any other applicable findings and
11   recommendations. The information in the report shall be
12   aggregated and deidentified.
13      (b)    Posting.--The department shall post each report under
14   this section on the publicly accessible Internet website of the
15   department.
16   § 5307.   Retention of records.
17      The department shall establish a record retention policy and
18   determine the amount of time an MA or CHIP managed care plan
19   shall retain records. The department may request input from an
20   MA or CHIP managed care plan or their representative to make
21   this determination.
22   § 5308.   Oversight.
23      The department may request additional information and
24   evidence from an MA or CHIP managed care plan regarding the
25   items provided under section 5302 (relating to disclosure), 5303
26   (relating to responsible use) and 5304 (relating to artificial
27   intelligence compliance statements) that are necessary to ensure
28   compliance with this chapter.
29   § 5309.   Third-party vendor.
30      A contractor, subcontractor or other third-party vendor that

20250HB1925PN2403                    - 26 -
 1   sells, leases, subscribes or otherwise supplies artificial
 2   intelligence-based algorithms or services based on artificial
 3   intelligence-based algorithms to the MA or CHIP managed care
 4   plan shall be subject to this chapter. The department shall
 5   develop regulations or guidelines regarding the responsibility
 6   of a contractor, subcontractor or other third-party vendor that
 7   sells, leases, subscribes or otherwise supplies artificial
 8   intelligence-based algorithms or services based on artificial
 9   intelligence-based algorithms to the insurer or MA or CHIP
10   managed care plan. The department may request input from
11   insurers, third-party vendors and health care providers or their
12   representatives in making this determination.
13   § 5310.    Exemption.
14      This chapter shall not apply to artificial intelligence-based
15   algorithms used for administrative, scheduling or other purposes
16   not pertaining to the decision to deny, reduce or terminate
17   benefits.
18   § 5311.    Enforcement and penalties.
19      (a)    Civil penalties.--
20             (1)   Subject to paragraph (2), the department may impose
21      a civil penalty not exceeding $5,000 for a violation of this
22      chapter. For purposes of this paragraph, each instance of
23      nondisclosure shall constitute a separate violation of this
24      chapter.
25             (2)   The following apply to limitations on civil
26      penalties under this subsection:
27                   (i)    A civil penalty imposed against an insurer may
28             not exceed $500,000 in the aggregate during a single
29             calendar year.
30                   (ii)   A civil penalty imposed against any other

20250HB1925PN2403                        - 27 -
 1             person may not exceed $100,000 in the aggregate during a
 2             single calendar year.
 3      (b)    Unfair Insurance Practices Act.--
 4             (1)   An MA or CHIP managed care plan shall be subject to
 5      the act of July 22, 1974 (P.L.589, No.205), known as the
 6      Unfair Insurance Practices Act.
 7             (2)   A violation of any provision of this chapter shall
 8      be deemed to be a violation of the Unfair Insurance Practices
 9      Act.
10      (c)    Injunction.--The department may maintain an action in
11   the name of the Commonwealth for an injunction to prohibit any
12   activity that violates the provisions of this chapter.
13      (d)    Effect on enrollment.--The department may issue an order
14   temporarily prohibiting an MA or CHIP managed care plan that
15   violates this chapter from enrolling new enrollees.
16   § 5312.    Plan of correction.
17      (a)    Authorization.--The department may require an MA or CHIP
18   managed care plan to develop and adhere to a plan of correction
19   approved by the department. The department may impose a plan of
20   correction in lieu of fines.
21      (b)    Compliance.--The department shall monitor compliance
22   with the plan of correction under this section.
23      (c)    Availability.--The plan of correction shall, upon
24   request, be made available to enrollees of the insurer or MA or
25   CHIP managed care plan.
26   § 5313.    Administrative procedures.
27      (a)    Applicable procedures.--This chapter shall be subject to
28   2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
29   Commonwealth agencies).
30      (b)    Appeal.--A party against whom penalties are assessed in

20250HB1925PN2403                      - 28 -
 1   an administrative action may appeal to Commonwealth Court as
 2   provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
 3   review of Commonwealth agency action).
 4   § 5314.   Regulations and guidance.
 5      The department shall promulgate regulations or guidance
 6   necessary to implement, administer and enforce this chapter. The
 7   department shall review regulations or guidance every three
 8   years to ensure compliance with Federal law or Federal agency
 9   guidance.
10      Section 3.   This act shall take effect in one year.




20250HB1925PN2403                  - 29 -