HB 1925 — An Act amending Titles 35 (Health and Safety), 40 (Insurance) and 67 (Public Welfare) of the Pennsylvania Consolidated Statutes, providing for artificial intelligence in facilities, for artificial intelligence use by insurers and for artificial intelligence use by MA or CHIP managed care plans; imposing duties on the Department of Health, the Insurance Department and the Department of Human Services; and imposing penalties.

(3)(5) The artificialperformance, intelligence-baseduse algorithmsand <--outcomes INTELLIGENCEof MODELthe ORartificial SYSTEMintelligence-based algorithms must be fairlyperiodically andreviewed equitably <-- applied, including in accordance with any applicable regulations and orrevised guidanceto issuedmaximize byaccuracy the United States <-- Department of Health and Humanreliability. Services.

(4)(6) ThePatient usedata ofmust thenot artificialbe intelligence-basedused <--beyond algorithmsthe INTELLIGENCEintended MODELand ORstated SYSTEMpurpose mustof bethe disclosedartificial inintelligence-based <--algorithms, accordanceconsistent with sectionthe 3502laws (relatingof tothis disclosure).Commonwealth and 42 U.S.C.

(5) The performance, use and outcomes of the artificial intelligence-based algorithms INTELLIGENCE MODEL OR SYSTEM <-- must be periodically reviewed and revised AT LEAST QUARTERLY <-- to maximize accuracy and reliability.

(6) Patient data must not be used beyond the intended and stated purpose of the artificial intelligence-based <-- algorithms INTELLIGENCE MODEL OR SYSTEM, consistent with the <-- laws of this Commonwealth and 42 U.S.C.

XI Part C (relating to administrative simplification), as applicable.,applicable. EXCEPT AS PERMITTED BY THE PATIENT THROUGH <-- INFORMED CONSENT, AS OTHERWISE AUTHORIZED UNDER APPLICABLE FEDERAL OR STATE LAW OR FOR USE OF DE-IDENTIFIED OR AGGREGATED PATIENT DATA FOR RESEARCH, DEVELOPMENT OR 20250HB1925PN3349 - 6 - IMPROVEMENT OF ARTIFICIAL INTELLIGENCE-BASED ALGORITHMS.

(7) The artificial intelligence-based algorithms <-- INTELLIGENCE MODELS OR SYSTEMS must not create foreseeable, <-- material risks of harm to the patient.

(C)20250HB1925PN2403 INTERNAL- GOVERNANCE.--A5 FACILITY- USING§ ARTIFICIAL3504. <-- INTELLIGENCE MODELS OR SYSTEMS FOR CLINICAL DECISION MAKING SHALL ESTABLISH AND MAINTAIN THE FOLLOWING:

(1) POLICIES AND PROCEDURES FOR IMPLEMENTING, USING AND MONITORING THE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS.

(2) A GOVERNANCE STRUCTURE TO MANAGE RESPONSIBLE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS WITHIN THE FACILITY.

(3) A REASONABLE PROCESS TO VALIDATE AND MONITOR THE FACILITY'S COMPLIANCE WITH THE REQUIREMENTS OF SUBSECTIONS (A) AND (B).

§ 3504.

(a) Compliance statement required.--A facility using <-- artificial intelligence-based algorithms INTELLIGENCE MODELS OR <-- SYSTEMS for clinical decision making shall annually file with the department in the form and manner prescribed by the department an artificial intelligence compliance statement.

<-- ATTESTING THAT THE FACILITY'S USE OF ARTIFICIAL INTELLIGENCE <-- MODELS OR SYSTEMS IS IN COMPLIANCE WITH SECTION 3503 (RELATING TO RESPONSIBLE USE).

<-- (1) Summarize the function and scope of artificial intelligence-based algorithms used for clinical decision making.

(2) Provide a logic or decision tree of artificial 20250HB1925PN3349 - 7 - intelligence-based algorithms used for clinical decision making.

(a) Annual report required.--No later than one year after the effective date of this chapter and each year thereafter, the department shall compile the information from the most recent annual compliance statements under section 3504 (relating to artificial intelligence compliance statements) and issue a 20250HB1925PN2403 - 6 - report containing the compiled information, along with any other applicable findings and recommendations.

§The 3505.department shall establish a record retention policy and determine the amount of time a facility shall retain records related to artificial-intelligence algorithms.

RETENTIONThe OFdepartment RECORDS.may request input from facilities and health care providers or their representatives in making the determination under this section.

<--§ The3507. department shall establish a record retention policy and determine the amount of time a facility shall retain records related to artificial-intelligence algorithms.

The department <-- 20250HB1925PN3349 - 8 - may IN ACCORDANCE WITH THE FOLLOWING:

<-- (1) THE POLICY SHALL NOT BE LESS THAN FIVE YEARS AND AT LEAST AS LONG AS REQUIRED UNDER EXISTING LAW.

(2) THE DEPARTMENT MAY request input from facilities and health care providers or their representatives in making the determination under this section.

(3) A RECORD RETENTION POLICY SHALL NOT BE IMPLEMENTED <-- IN CONFLICT WITH EXISTING LAW.

§ 3507 3506.

<--The (A)department DEPARTMENTALmay DUTY.--THErequest DEPARTMENTadditional SHALLinformation ENSUREand <--evidence COMPLIANCEfrom WITHa THISfacility CHAPTER.regarding the items provided under sections 3502 (relating to disclosure), 3503 (relating to responsible use) and 3504 (relating to artificial intelligence compliance statements) that are necessary to ensure compliance with this chapter.

(B) INFORMATION.--The department may request additional information and evidence from a facility regarding the items provided under sections 3502 (relating to disclosure), 3503 (relating to responsible use) and 3504 (relating to artificial intelligence compliance statements) that are necessary to ensure compliance with this chapter.

<-- A contractor, subcontractor or other third-party vendor that sells, leases, subscribes or otherwise supplies artificial intelligence-based algorithms or services based on artificial intelligence-based algorithms to the facility shall be subject to this chapter.

The department shall develop regulations or guidance regarding the responsibility of a contractor, subcontractor or other third-party vendor that sells, leases, subscribes or otherwise supplies artificial intelligence-based algorithms or services based on artificial intelligence-based 20250HB1925PN2403 - 7 - algorithms to the facility.

20250HB1925PN3349§ -3509. 9 - (C) CONFIDENTIALITY.--DOCUMENTS SUBMITTED UNDER THIS SECTION <-- SHALL REMAIN CONFIDENTIAL AND NOT PUBLICLY ACCESSIBLE UNDER THE ACT OF FEBRUARY 14, 2008 (P.L.6, NO.3), KNOWN AS THE RIGHT-TO- KNOW LAW.

§ 3507.

THIRD-PARTY VENDOR.

A FACILITY UTILIZING A THIRD-PARTY VENDOR FOR THE DEVELOPMENT OR DEPLOYMENT OF ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS FOR CLINICAL DECISION MAKING OR PRODUCTS OR SERVICES FOR CLINICAL DECISION MAKING THAT RELY ON ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS SHALL ESTABLISH INTERNAL REVIEW AND GOVERNANCE PROCESSES TO ENSURE COMPLIANCE WITH THE REQUIREMENTS UNDER SECTIONS 3502 (RELATING TO DISCLOSURE), 3503 (RELATING TO RESPONSIBLE USE) AND 3504 (RELATING TO ARTIFICIAL INTELLIGENCE COMPLIANCE STATEMENTS).

§ 3509 3508.

<-- This chapter shall not apply to validated, static decision- support tools or tools used for administration, scheduling, scribe applications or clinical calculators.

§ 35103510. 3509.

<-- (a) Civil penalties.-- (1) Subject to paragraph (2), the department may impose <-- a civil penalty not exceeding $5,000 for a violation of this chapter.

20250HB1925PN3349 - 10 - (ii) A civil penalty imposed against any other person may not exceed $100,000 in the aggregate during a single calendar year.

(1)(b) SUBJECTInjunction.--The TOdepartment PARAGRAPHSmay (2),maintain (3)an ANDaction (4),in THEthe <--name DEPARTMENTof MAYthe IMPOSECommonwealth Afor CIVILan PENALTYinjunction ASto FOLLOWSprohibit FORany Aactivity VIOLATIONthat OFviolates THISthe CHAPTER:provisions of this chapter.

(I)(c) FORNonexclusive Aremedies.--The KNOWINGenforcement ORremedies WILLFULand VIOLATION,penalties Aimposed CIVILunder PENALTYthis OFchapter NOTare MOREin THANaddition $10,000to PERany VIOLATION.other remedies or penalties that may be imposed under any other applicable law of this Commonwealth, including the act of July 19, 1979 (P.L.130, No.48), known as the Health Care Facilities 20250HB1925PN2403 - 8 - Act.

(II)§ EXCEPT3511. AS PROVIDED UNDER SUBPARAGRAPH (III), FOR A NEGLIGENT VIOLATION, A CIVIL PENALTY OF NOT MORE THAN $5,000 PER VIOLATION.

(III) FOR A FIRST-TIME NEGLIGENT VIOLATION BY AN ENTITY THAT THE DEPARTMENT DETERMINES HAS MADE A GOOD- FAITH EFFORT TO COMPLY WITH THIS CHAPTER, A CIVIL PENALTY OF NOT MORE THAN $1,000 PER VIOLATION OR, AT THE DEPARTMENT'S DISCRETION, A PLAN OF CORRECTION UNDER SECTION 3510 (RELATING TO PLAN OF CORRECTION) IN LIEU OF A PENALTY.

(2) FOR THE PURPOSES OF PARAGRAPH (1), EACH INSTANCE OF NONDISCLOSURE SHALL CONSTITUTE A SEPARATE VIOLATION OF THIS CHAPTER.

(3) IN DETERMINING THE AMOUNT OF A CIVIL PENALTY, THE DEPARTMENT SHALL CONSIDER:

(I) THE NATURE AND SERIOUSNESS OF THE VIOLATION.

(II) WHETHER THE VIOLATION HAS RESULTED IN PATIENT HARM.

(III) THE VIOLATOR'S HISTORY OF COMPLIANCE.

(IV) ANY GOOD-FAITH EFFORTS BY THE VIOLATOR TO COMPLY.

(V) THE VIOLATOR'S SIZE AND FINANCIAL RESOURCES.

20250HB1925PN3349 - 11 - (4) THE AGGREGATE AMOUNT OF CIVIL PENALTIES IMPOSED ON A SINGLE ENTITY UNDER THIS SUBSECTION DURING A SINGLE CALENDAR YEAR SHALL NOT EXCEED $250,000.

(B) ACTIONS.--A VIOLATION OF ANY PROVISION OF THIS CHAPTER SHALL BE DEEMED TO BE AN UNFAIR OR DECEPTIVE ACT OR PRACTICE IN VIOLATION OF THE ACT OF DECEMBER 17, 1968 (P.L.1224, NO.387), KNOWN AS THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW.

THE OFFICE OF ATTORNEY GENERAL SHALL HAVE EXCLUSIVE AUTHORITY TO BRING AN ACTION UNDER THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW FOR A VIOLATION OF ANY PROVISION OF THIS CHAPTER.

(b) (C) Injunction.--The department may maintain an action <-- in the name of the Commonwealth for an injunction to prohibit any activity that violates the provisions of this chapter.

(c) (D) Nonexclusive remedies.--The enforcement remedies and <-- penalties imposed under this chapter are in addition to any other remedies or penalties that may be imposed under any other applicable law of this Commonwealth FEDERAL OR STATE LAW, <-- including the act of July 19, 1979 (P.L.130, No.48), known as the Health Care Facilities Act., OR THE HEALTH INSURANCE <-- PORTABILITY OR ACCOUNTABILITY ACT OF 1996 (PUBLIC LAW 104-191, 110 STAT.

1936) AS AMENDED BY THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT (PUBLIC LAW 111-5, 123 STAT.

226-279 AND 467-496).

§ 3511 3510.

<-- (a) Authorization.--The department may require a facility to develop and adhere to a plan of correction approved by the department.

OR(b) INCompliance.--The ADDITIONdepartment TOshall CIVILmonitor PENALTIEScompliance IMPOSEDwith UNDERthe <--plan SECTIONof 3509correction (RELATINGunder TOthis ENFORCEMENTsection. AND PENALTIES).

(b)(c) Compliance.--TheAvailability.--The departmentplan shallof monitorcorrection complianceshall, 20250HB1925PN3349upon -request, 12be -made withavailable theto planpatients of correctionthe underfacility. this section.

(c)§ Availability.--The3512. plan of correction shall, upon <-- request, be made available to patients of the facility UPON <-- REQUEST.

§ 3512 3511.

<-- (a) Applicable procedures.--This chapter shall be subject to 2 Pa.C.S.

§ 35133513. 3512.

<-- The department shall promulgate regulations or guidance necessary to implement, administer and enforce this chapter.

The <--department INshall ACCORDANCEreview WITHregulations THEor FOLLOWING:guidance every three years to ensure compliance with Federal law or Federal agency guidance.

<-- (1) THE DEPARTMENT SHALL CONSULT WITH THE INSURANCE DEPARTMENT AND THE DEPARTMENT OF HUMAN SERVICES WHEN DEVELOPING REGULATIONS AND GUIDANCE TO ENSURE CONFORMITY ACROSS REGULATIONS AND GUIDANCE PROMULGATED BY THE THREE DEPARTMENTS.

(2) THE department shall review regulations or guidance every three years to ensure compliance with Federal law or Federal agency guidance.

20250HB1925PN334920250HB1925PN2403 - 139 - 5203.

<--5207. 5207 5206.

<--5208. 5208 5207.

<--5209. 5209 5208.

<--5210. 5210 5209.

<--5211. 5211 5210.

<--5212. 5212 5211.

<--5213. 5213 5212.

<--5214. 5214 5213.

<-- § 5201.

"Artificial intelligence" or "AI." INTELLIGENCE." A machine-machine-based <-- based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments that use machine-based and human-based inputs to perceive real and virtual environments, abstract the perceptions into models through analysis in an automated manner and use model inference to formulate options for information or action.

20250HB1925PN334920250HB1925PN2403 - 1410 - "Artificial intelligence-based algorithms." The programming and data sets that inform an artificial intelligence system.

"Covered person." A policyholder, subscriber or other <-- individual who is entitled to receive health care services under a health insurance policy.

"ARTIFICIAL INTELLIGENCE MODEL." A CONCEPTUAL OR <-- MATHEMATICAL REPRESENTATION OF ABSTRACTED PHENOMENA CAPTURED AS A SYSTEM OF EVENTS, FEATURES OR PROCESSES.

"ARTIFICIAL INTELLIGENCE SYSTEM." A FULLY OPERATIONAL ARTIFICIAL INTELLIGENCE APPLICATION OR SCENARIO IN WHICH ARTIFICIAL INTELLIGENCE IS DEPLOYED, INCLUDING THE MODEL, TECHNICAL INFRASTRUCTURE AND PERSONNEL IN THE WORKFLOW.

"COVERED PERSON." AS DEFINED UNDER SECTION 2102 OF THE ACT OF MAY 17, 1921 (P.L.682, NO.284), KNOWN AS THE INSURANCE COMPANY LAW OF 1921.

"FACILITY." A HEALTH CARE SETTING OR INSTITUTION PROVIDING <-- HEALTH CARE SERVICES, INCLUDING:

(1) A GENERAL, SPECIAL, PSYCHIATRIC OR REHABILITATION HOSPITAL.

(2) AN AMBULATORY SURGICAL FACILITY.

(3) A CANCER TREATMENT CENTER.

(4) A BIRTH CENTER.

(5) A SKILLED NURSING CENTER.

(6) AN INPATIENT, OUTPATIENT OR RESIDENTIAL DRUG AND ALCOHOL TREATMENT FACILITY.

(7) A FACILITY LICENSED BY THE DEPARTMENT OF HUMAN SERVICES' OFFICE OF MENTAL HEALTH AND SUBSTANCE ABUSES SERVICES.

(8) A LABORATORY, IMAGING, DIAGNOSTIC OR OTHER 20250HB1925PN3349 - 15 - OUTPATIENT MEDICAL SERVICE OR TESTING FACILITY.

(9) A HEALTH CARE PROVIDER OFFICE OR CLINIC THAT IS OWNED BY OR EMPLOYS A COMMONWEALTH-LICENSED HEALTH CARE PROVIDER.

(2) THEThe TERMterm INCLUDESdoes ANnot INDIVIDUALinclude: OR GROUP HEALTH <-- INSURANCE POLICY, CONTRACT OR PLAN THAT PROVIDES DENTAL OR VISION COVERAGE THROUGH A PROVIDER NETWORK.

(2) The (3) EXCEPT AS PROVIDED IN PARAGRAPH (2), THE <-- term does not include:

20250HB1925PN3349 - 16 - (iii) A long-term care or disability income policy.

20250HB1925PN2403 - 11 - (v) A Medicare supplement policy.

<-- (1) An entity licensed by the department that offers, issues or renews an individual or group health insurance policy that is offered or governed under any of the following:

"INSURER.""Participating ASnetwork DEFINEDprovider." UNDERA SECTIONhealth 635.8care OFprovider THEthat INSURANCEhas <--entered COMPANYinto LAWa OFcontractual 1921.or operating relationship with an insurer to participate in one or more designated networks of the insurer and to provide health care services to 20250HB1925PN2403 - 12 - covered persons under the terms of the insurer's administrative policy.

20250HB1925PN3349 - 17 - "Participating network provider." A health care provider that has entered into a contractual or operating relationship with an insurer to participate in one or more designated networks of the insurer and to provide health care services to covered persons under the terms of the insurer's administrative policy.

"THIRD-PARTY VENDOR." A PERSON OR ENTITY THAT MAKES AN <-- ARTIFICIAL INTELLIGENCE-BASED ALGORITHM, PRODUCT OR SERVICE COMMERCIALLY AVAILABLE, WHETHER BY SALE, LICENSE OR OTHER OFFERING, FOR USE BY AN INSURER.

(a) Duty to disclose.--An insurer shall disclose to a participating network provider and all covered persons IN PLAIN <-- LANGUAGE if artificial intelligence-based algorithms <-- INTELLIGENCE MODELS OR SYSTEMS are or will be used in the <-- utilization review process of the insurer.

(b) Posting.--An insurer shall post the information about the use of artificial intelligence-based algorithms INTELLIGENCE <-- MODELS OR SYSTEMS in the utilization review process of the <-- insurer IN PLAIN LANGUAGE on the publicly accessible Internet <-- website of the insurer.

(c) Nature and frequency.--The department shall determine the nature and frequency of disclosure requirements REQUIRED <-- UNDER THIS SECTION to covered persons.

20250HB1925PN3349 - 18 - § 5203.

(a) Compliance generally.--The criteria for the artificial <-- intelligence-based algorithms USE OF ARTIFICIAL INTELLIGENCE <-- MODEL SYSTEMS IN THE UTILIZATION PROCESS must comply with this chapter and applicable Federal and State law.

(b) Requirements for artificial intelligence-based <--algorithms.--For algorithms INTELLIGENCE.--For each instance in which an insurer <-- uses AN artificial intelligence-based algorithms INTELLIGENCE <-- MODEL OR SYSTEM in the utilization review process regarding a covered person, the insurer shall comply with the following:

(1) The artificial intelligence-based algorithms must <-- base a determination on all of the following:

INTELLIGENCE20250HB1925PN2403 <--- MODEL13 OR- SYSTEM(i) MUSTThe EVALUATE:medical or other clinical history of the covered person.

(i) The medical or other clinical history of the covered person.

(2) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM USED IN THE UTILIZATION REVIEW <-- PROCESS must not base a determination solely PRODUCE AN <-- OUTPUT SOLELY BASED on a group data set.

(3) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must not supersede decision <-- making of the health care provider conducting the utilization review.

(4) The artificial intelligence-based algorithms and <-- 20250HB1925PN3349 - 19 - training data sets INTELLIGENCE MODEL OR SYSTEM must not <-- directly or indirectly discriminate against covered persons in violation of Federal or State law.

(5) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must be fairly and equitably <-- applied, including in accordance with any applicable regulations or guidance issued by the United States <-- Department of Health and Human Services.

(6) The use of the artificial intelligence-based <-- algorithms INTELLIGENCE MODEL OR SYSTEM must be disclosed in <-- accordance with section 5202 (relating to disclosure).

(7) The performance, use and outcomes of the artificial intelligence-based algorithms INTELLIGENCE MODEL OR SYSTEM <-- must be periodically reviewed and revised AT LEAST QUARTERLY <-- to maximize accuracy and reliability.

(8) The data of the covered person must not be used beyond the intended and stated purpose of the artificial intelligence-based algorithms, INTELLIGENCEconsistent MODELwith ORCommonwealth SYSTEM,20250HB1925PN2403 <--- EXCEPT14 AS- PERMITTED BY THE COVERED PATIENT THROUGH INFORMED CONSENT AS OTHERWISE AUTHORIZED UNDER APPLICABLE FEDERAL OR STATE LAW, OR FOR THE USE OF DE-IDENTIFIED OR AGGREGATE COVERED PERSON DATA FOR RESEARCH, DEVELOPMENT OR IMPROVEMENT OF ARTIFICIAL INTELLIGENCE-BASED ALGORITHMS, consistent with Commonwealth law and 42 U.S.C.

(9) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must not create foreseeable, <-- material risks of harm to the covered person.

(C) INTERNAL GOVERNANCE.--AN INSURER USING ARTIFICIAL <-- INTELLIGENCE MODELS OR SYSTEMS IN THE UTILIZATION REVIEW PROCESS 20250HB1925PN3349 - 20 - SHALL ESTABLISH AND MAINTAIN THE FOLLOWING:

(1) POLICIES AND PROCEDURES FOR IMPLEMENTING, USING AND MONITORING THE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS.

(2) A GOVERNANCE STRUCTURE TO MANAGE RESPONSIBLE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS WITHIN THE INSURER.

(3) A REASONABLE PROCESS TO VALIDATE AND MONITOR THE INSURER'S COMPLIANCE WITH THE REQUIREMENTS OF SUBSECTIONS (A) AND (B).

<-- (a) Compliance statement required.--An insurer using artificial intelligence-based algorithms in the utilization review process shall annually file with the department in the form and manner prescribed by the department an artificial intelligence compliance statement.

(5) Describe the process of the insurer for overseeing and validating the performance and compliance of the 20250HB1925PN3349 - 21 - artificial intelligence-based algorithms in accordance with section 5203.

§ 5204.

ARTIFICIAL INTELLIGENCE COMPLIANCE STATEMENTS.

<-- AN INSURER USING ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS IN THE UTILIZATION REVIEW PROCESS SHALL ANNUALLY FILE WITH THE DEPARTMENT IN THE FORM AND MANNER PRESCRIBED BY THE DEPARTMENT AN ARTIFICIAL INTELLIGENCE COMPLIANCE STATEMENT ATTESTING THAT THE INSURER'S USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS IS IN COMPLIANCE WITH SECTION 5203 (RELATING TO RESPONSIBLE USE).

Prior to issuing or upholding a decision to deny, reduce or terminate benefits for a health care service, including a 20250HB1925PN2403 - 15 - decision to deny a prior authorization request, a health care provider who participates in utilization review on behalf of an insurer shall:

(3) Based on the review under paragraph (1), exercise judgment independent of any recommendations by the artificial <-- intelligence-based algorithms.

(a) Annual report required.--No later than one year after the effective date of this chapter, and annually thereafter, the department shall compile the information from the most recent annual compliance statements under section 5204 (relating to artificial intelligence compliance statements) and issue a report to the General Assembly containing the compiled information, along with any other applicable findings and 20250HB1925PN3349 - 22 - recommendations.

ARTIFICIAL§ INTELLIGENCE.5207.

AN INSURER MAY NOT PENALIZE <-- A HEALTH CARE PROVIDER WHO PARTICIPATES IN UTILIZATION REVIEW ON BEHALF OF AN INSURER SOLELY FOR EXERCISING INDEPENDENT JUDGMENT IN REFUSING TO ISSUE OR OVERTURNING A DECISION TO DENY, REDUCE OR TERMINATE BENEFITS FOR A HEALTH CARE SERVICE GENERATED BY ARTIFICIAL INTELLIGENCE.

§ 5207 5206.

<-- The department shall establish a record retention policy and determine the amount of time an insurer shall retain records.

<-- The department may request input from insurers or their representatives in making this determination.

RELATED§ TO5208. ITS USE <-- OF ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS IN THE UTILIZATION REVIEW PROCESS.

THE FOLLOWING SHALL APPLY:

(1) RECORDS SHALL BE RETAINED NOT LESS THAN FIVE YEARS AND AT LEAST AS LONG AS REQUIRED UNDER OTHER EXISTING LAW.

(2) THE DEPARTMENT MAY REQUEST INPUT FROM INSURERS OR THEIR REPRESENTATIVES IN MAKING THIS DETERMINATION.

(3) ANY RECORD RETENTION POLICY SHALL NOT BE IN CONFLICT WITH EXISTING LAW.

§ 5208 5207.

<--The (A)department COMPLIANCE.--THEmay DEPARTMENTrequest SHALLadditional ENSUREinformation COMPLIANCEand WITHevidence <--from THISan CHAPTER.insurer regarding the items provided under 20250HB1925PN2403 - 16 - sections 5202 (relating to disclosure), 5203 (relating to responsible use) and 5204 (relating to artificial intelligence compliance statements) that are necessary to ensure compliance with this chapter.

(B) INVESTIGATION.--The department may INVESTIGATE POTENTIAL <-- VIOLATIONS OF THIS CHAPTER AND request additional information and evidence from an insurer regarding the items provided under sections 5202 (relating to disclosure), 5203 (relating to 20250HB1925PN3349 - 23 - responsible use) and, 5204 (relating to artificial intelligence <-- compliance statements) AND 5205 (RELATING TO HEALTH CARE <-- PROVIDER REQUIREMENTS) that are necessary to ensure compliance with this chapter.

<-- A contractor, subcontractor or other third-party vendor that sells, leases, subscribes or otherwise supplies artificial intelligence-based algorithms or services based on artificial intelligence-based algorithms to the insurer services shall be subject to this chapter.

(C)§ CONFIDENTIALITY.--DOCUMENTS5210. SUBMITTED TO THE DEPARTMENT <-- UNDER THIS SUBSECTION SHALL REMAIN CONFIDENTIAL AND SHALL NOT BE ACCESSIBLE FOR INSPECTIONS AND DUPLICATION IN ACCORDANCE WITH THE ACT OF FEBRUARY 14, 2008 (P.L.6, NO.3), KNOWN AS THE RIGHT- TO-KNOW LAW.

(D) SELF-INSURED PLANS.--SELF-INSURED HEALTH BENEFIT PLANS SUBJECT TO THE EMPLOYEE RETIREMENT INCOME SECURITY ACT OF 1974 (PUBLIC LAW 93-406, 29 U.S.C.

§ 1001 ET SEQ.) MAY OPT INTO THE REQUIREMENTS OF THIS CHAPTER.

§ 5208.

THIRD-PARTY VENDOR.

AN INSURER UTILIZING A THIRD-PARTY VENDOR FOR THE DEVELOPMENT OR DEPLOYMENT OF ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS FOR USE IN THE UTILIZATION REVIEW PROCESS, OR PRODUCTS OR SERVICES 20250HB1925PN3349 - 24 - FOR THE UTILIZATION REVIEW PROCESS THAT RELY ON ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS, SHALL ESTABLISH INTERNAL REVIEW AND GOVERNANCE PROCESSES TO ENSURE COMPLIANCE WITH REQUIREMENTS UNDER SECTIONS 5202 (RELATING TO DISCLOSURE), 5203 (RELATING TO RESPONSIBLE USE), 5204 (RELATING TO ARTIFICIAL INTELLIGENCE COMPLIANCE STATEMENTS) AND 5205 (RELATING TO HEALTH CARE PROVIDER REQUIREMENTS).

§ 5210 5209.

<-- This chapter shall not apply to artificial intelligence-based algorithms used for administrative, scheduling or other purposes not pertaining to the insurer's decision to deny, reduce or terminate benefits.

§ 52115211. 5210.

<-- (a) Civil penalties.-- (1) Subject to paragraph (2), the department may impose <-- a civil penalty not exceeding $5,000 for a violation of this chapter.

(2) The following apply to limitations on civil 20250HB1925PN2403 - 17 - penalties under this subsection:

(b) Unfair Insurance Practices Act.-- (1) An insurer shall be subject to the act of July 22, 1974 (P.L.589, No.205), known as the Unfair Insurance 20250HB1925PN3349 - 25 - Practices Act.

(1) SUBJECT TO PARAGRAPHS (2), (3) AND (4), THE <-- DEPARTMENT MAY IMPOSE A CIVIL PENALTY AS FOLLOWS FOR A VIOLATION OF THIS CHAPTER:

(I) FOR A KNOWING OR WILLFUL VIOLATION, A CIVIL PENALTY OF NOT MORE THAN $10,000 PER VIOLATION.

(II) EXCEPT AS PROVIDED UNDER SUBPARAGRAPH (III) FOR A NEGLIGENT VIOLATION, A CIVIL PENALTY OF NOT MORE THAN $5,000 PER VIOLATION.

(III) FOR A FIRST-TIME NEGLIGENT VIOLATION BY AN ENTITY THAT THE DEPARTMENT DETERMINES HAS MADE A GOOD- FAITH EFFORT TO COMPLY WITH THIS CHAPTER, A CIVIL PENALTY OF NOT MORE THAN $1,000 PER VIOLATION OR, AT THE DEPARTMENT'S DISCRETION, A PLAN OF CORRECTION UNDER SECTION 5211 (RELATING TO PLAN OF CORRECTION) IN LIEU OF A PENALTY.

(2) FOR THE PURPOSES OF PARAGRAPH (1), EACH INSTANCE OF NONDISCLOSURE SHALL CONSTITUTE A SEPARATE VIOLATION OF THIS CHAPTER.

(3) IN DETERMINING THE AMOUNT OF A CIVIL PENALTY, THE DEPARTMENT SHALL CONSIDER:

(I) THE NATURE AND SERIOUSNESS OF THE VIOLATION.

(II) WHETHER THE VIOLATION HAS RESULTED IN PATIENT HARM.

(III) THE VIOLATOR'S HISTORY OF COMPLIANCE.

(IV) ANY GOOD-FAITH EFFORTS BY THE VIOLATOR TO COMPLY.

20250HB1925PN3349 - 26 - (V) THE VIOLATOR'S SIZE AND FINANCIAL RESOURCES.

(4) THE AGGREGATE AMOUNT OF CIVIL PENALTIES IMPOSED ON A SINGLE ENTITY UNDER THIS SUBSECTION DURING A SINGLE CALENDAR YEAR SHALL NOT EXCEED $250,000.

(B) ACTIONS.--A VIOLATION OF ANY PROVISION OF THIS CHAPTER SHALL BE DEEMED TO BE AN UNFAIR OR DECEPTIVE ACT OR PRACTICE IN VIOLATION OF THE ACT OF DECEMBER 17, 1968 (P.L.1224, NO.387), KNOWN AS THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW.

THE OFFICE OF ATTORNEY GENERAL SHALL HAVE EXCLUSIVE AUTHORITY TO BRING AN ACTION UNDER THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW FOR A VIOLATION OF ANY PROVISION OF THIS CHAPTER.

(e) Nonexclusive remedies.--The enforcement remedies and penalties imposed under this chapter are in addition to any other remedies or penalties that may be imposed under any other applicable FEDERAL OR STATE law of this Commonwealth, including:

<-- (1) The ACT OF JULY 22, 1974 (P.L.589, NO.205), KNOWN AS <-- THE Unfair Insurance Practices Act.

(4)§ THE5212. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY <-- ACT OF 1996 (PUBLIC LAW 104-191, 110 STAT.

1936), AS AMENDED BY THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND 20250HB1925PN3349 - 27 - CLINICAL HEALTH ACT (PUBLIC LAW 111-5, 123 STAT.

226-279 AND 467-496).

§ 5212 5211.

<--20250HB1925PN2403 - 18 - (a) Authorization.--The department may require an insurer to develop and adhere to a plan of correction approved by the department.

The department may impose a plan of correction in lieu of finesfines. OR IN ADDITION TO CIVIL PENALTIES IMPOSED UNDER <-- SECTION 5210 (RELATING TO ENFORCEMENT AND PENALTIES).

(c) Availability.--The plan of correction shall, upon <-- request, be made available to covered persons of the insurer,insurer. <-- UPON REQUEST.

§ 52135213. 5212.

<-- (a) Applicable procedures.--This chapter shall be subject to 2 Pa.C.S.

§ 52145214. 5213.

<-- The department shall promulgate regulations or guidance necessary to implement, administer and enforce this chapter.

The <-- department shall review regulations or guidance every three years to ensure compliance with Federal law or Federal agency guidance.

INCHAPTER ACCORDANCE53 WITHARTIFICIAL THEINTELLIGENCE FOLLOWING:USE BY MA OR CHIP MANAGED CARE PLANS Sec.

<--5301. (1) THE DEPARTMENT SHALL CONSULT WITH THE DEPARTMENT OF HEALTH AND THE DEPARTMENT OF HUMAN SERVICES WHEN DEVELOPING REGULATIONS AND GUIDANCE TO ACHIEVE CONFORMITY ACROSS 20250HB1925PN3349 - 28 - REGULATIONS AND GUIDANCE PROMULGATED BY THE THREE DEPARTMENTS.

(2) THE DEPARTMENT SHALL REVIEW REGULATIONS OR GUIDANCE EVERY THREE YEARS TO ENSURE COMPLIANCE WITH FEDERAL LAW OR FEDERAL AGENCY GUIDANCE.

SECTION 3.

TITLE 67 IS AMENDED BY ADDING A CHAPTER TO READ:

CHAPTER 53 41 <-- ARTIFICIAL INTELLIGENCE USE BY MA OR CHIP MANAGED CARE PLANS Sec.

5301 4101.

<--5302. 5302 4102.

<--5303. 5303 4103.

<--5304. 5304 4104.

<--20250HB1925PN2403 5305- 4105.19 - 5305.

<-- 5306.

<--5307. 5307 4106.

<--5308. 5308 4107.

<--5309. 5309 4108.

<--5310. 5310 4109.

<--5311. 5311 4110.

<--5312. 5312 4111.

<--5313. 5313 4112.

<--5314. 5314 4113.

<-- § 53015301. 4101.

<-- The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise:

(1) An agreement between an MA or CHIP managed care plan 20250HB1925PN3349 - 29 - and the department to manage the purchase and provision of services.

"Artificial intelligence" or "AI." INTELLIGENCE." A machine-machine-based <-- based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments that use machine-based and human-based inputs to perceive real and virtual environments, abstract the perceptions into models through analysis in an automated manner and use model inference to formulate options for information or action.

The term includes generative artificial intelligence which is the class of models that emulate the structure and characteristics of input data in order to generate derived 20250HB1925PN2403 - 20 - synthetic content which includes information such as images, videos, audio clips and text that has been significantly modified or generated by algorithms, including by artificial intelligence.

"ARTIFICIAL INTELLIGENCE MODEL." A CONCEPTUAL OR <-- MATHEMATICAL REPRESENTATION OF ABSTRACTED PHENOMENA CAPTURED AS A SYSTEM OF EVENTS, FEATURES OR PROCESSES.

"ARTIFICIAL INTELLIGENCE SYSTEM." A FULLY OPERATIONAL ARTIFICIAL INTELLIGENCE APPLICATION OR SCENARIO IN WHICH ARTIFICIAL INTELLIGENCE IS DEPLOYED, INCLUDING THE MODEL, TECHNICAL INFRASTRUCTURE AND PERSONNEL IN THE WORKFLOW.

"Enrollee." An individual who is entitled to receive health 20250HB1925PN3349 - 30 - care services under an agreement with the department.

(5) AAn SKILLEDinpatient, NURSINGoutpatient CENTER.or residential drug and alcohol treatment facility.

<--(6) (5)A (6)facility Anlicensed inpatient,by outpatientthe ordepartment's residentialOffice drugof andMental <--Health alcoholand treatmentSubstance facility.Abuse Services.

(6) (7) A facilitylaboratory, licensedimaging, bydiagnostic theor department'sother Officeoutpatient <--medical ofservice Mentalor Healthtesting andfacility. Substance Abuse Services.

(7) (8) A laboratory,health imaging,care diagnosticprovider office or otherclinic <--that outpatientis medicalowned serviceby or testingemploys facility.a Commonwealth-licensed physician, physician assistant or nurse practitioner.

(8) (9) A health care provider office or clinic that is <-- owned by or employs a Commonwealth-licensed physician, <-- physician assistant or nurse practitioner HEALTH CARE <-- PROVIDER.

20250HB1925PN2403 - 21 - (2) The term does not include an individual providing emergency services under a licensed emergency medical services agency as defined in 35 Pa.C.S.

"Health care service." Any covered treatment, admission, procedure or other services, including behavioral health, prescribed or otherwise provided or proposed to be provided by a 20250HB1925PN3349 - 31 - health care provider to a covered person for the diagnosis, prevention, treatment, cure or relief of a health condition, illness, injury or disease under the terms of a health insurance policy or agreement with the department.

"THIRD-PARTY VENDOR." A PERSON OR ENTITY THAT MAKES AN <-- ARTIFICIAL INTELLIGENCE-BASED ALGORITHM, PRODUCT OR SERVICE COMMERCIALLY AVAILABLE, WHETHER BY SALE, LICENSE OR OTHER OFFERING, FOR USE BY AN MA OR CHIP MANAGED CARE PLAN.

§ 53025302. 4102.

<-- (a) Duty to disclose.--An MA or CHIP managed care plan shall disclose to a participating network provider and all enrollees IN PLAIN LANGUAGE if artificial intelligence-based algorithms <-- INTELLIGENCE MODELS OR SYSTEMS are or will be used in the <-- utilization review process of the MA or CHIP managed care 20250HB1925PN2403 - 22 - plan.

(b) Posting.--An MA or CHIP managed care plan shall post the information about the use of artificial intelligence-based <-- 20250HB1925PN3349 - 32 - algorithms INTELLIGENCE MODELS OR SYSTEMS in the utilization <-- review process of the MA or CHIP managed care plan IN PLAIN <-- LANGUAGE on the publicly accessible Internet website of the MA or CHIP managed care plan.

(c) Nature and frequency.--The department shall determine the nature and frequency of disclosure requirements REQUIRED <-- UNDER THIS SECTION to enrollees.

§ 53035303. 4103.

<-- (a) Compliance generally.--The criteria for USE OF the <-- artificial intelligence-based algorithms INTELLIGENCE MODELS OR <-- SYSTEMS IN THE UTILIZATION REVIEW PROCESS must comply with this chapter and applicable Federal and State law.

(b) Requirements for artificial intelligence-based <--algorithms.--For algorithms INTELLIGENCE.--For each instance in which a MA or <-- CHIP managed care plan uses AN artificial intelligence-based <-- algorithms INTELLIGENCE MODEL OR SYSTEM in the utilization <-- review process regarding an enrollee, the MA or CHIP managed care plan shall comply with the following:

(1) The artificial intelligence-based algorithms must <-- base a determination on all of the followingfollowing: INTELLIGENCE <-- MODEL OR SYSTEM USED IN THE UTILIZATION REVIEW PROCESS MUST EVALUATE:

(iii) Other relevant clinical or nonclinical 20250HB1925PN3349 - 33 - information contained in the medical or other clinical record of the enrollee.

20250HB1925PN2403 - 23 - (2) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM USED IN THE UTILIZATION REVIEW <-- PROCESS must not base a determination PRODUCE AN OUTPUT <-- solely BASED on a group data set.

<-- (3) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must not supersede decision <-- making of the health care provider conducting the utilization review.

(4) The artificial intelligence-based algorithms and <-- training data sets INTELLIGENCE MODEL OR SYSTEM must not <-- directly or indirectly discriminate against the enrollees in violation of Federal or State law.

(5) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must be fairly and equitably <-- applied, including in accordance with any applicable regulations and guidance issued by the United States <-- Department of Health and Human Services.

(6) The use of the artificial intelligence-based <-- algorithms INTELLIGENCE MODEL OR SYSTEM must be disclosed in <-- accordance with section 5302 4102 (relating to disclosure).

<-- (7) The performance, use and outcomes of the artificial intelligence-based algorithms INTELLIGENCE MODEL OR SYSTEM <-- must be periodically reviewed AT LEAST QUARTERLY and revised <-- to maximize accuracy and reliability.

(8) The data of the covered person or enrollees must not <-- be used beyond the intended and stated purpose of the artificial intelligence-based algorithms, INTELLIGENCE MODEL <-- OR SYSTEM EXCEPT AS PERMITTED BY THE ENROLLEE THROUGH 20250HB1925PN3349 - 34 - INFORMED CONSENT, AS OTHERWISE AUTHORIZED UNDER APPLICABLE FEDERAL AND STATE LAW, OR AGGREGATE ENROLLEE DATA FOR USE OF DE-IDENTIFIABLE OR AGGREGATE ENROLLEE DATA FOR RESEARCH, DEVELOPMENT OR IMPROVEMENT OF ARTIFICIAL INTELLIGENCE, consistent with the laws of this Commonwealth and the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191,104- 191, 110 Stat.

(9) The artificial intelligence-based algorithms <-- INTELLIGENCE MODEL OR SYSTEM must not create foreseeable, <-- material risks of harm to the enrollee.

(C)§ INTERNAL5304. GOVERNANCE.--AN MA OR CHIP MANAGED CARE PLAN <-- USING ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS IN THE UTILIZATION REVIEW PROCESS SHALL ESTABLISH AND MAINTAIN THE FOLLOWING:

(1) POLICIES AND PROCEDURES FOR IMPLEMENTING, USING AND MONITORING THE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS.

(2) A GOVERNANCE STRUCTURE TO MANAGE RESPONSIBLE USE OF THE ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS WITHIN THE MA OR CHIP MANAGED CARE.

(3) REASONABLE PROCESS TO VALIDATE AND MONITOR THE MA OR CHIP MANAGED CARE PLAN COMPLIANCE WITH THE REQUIREMENTS OF SUBSECTIONS (A) AND (B).

§ 5304 4104.

<-- (a) Compliance statement required.--An MA or CHIP managed <--20250HB1925PN2403 - 24 - care plan using artificial intelligence-based algorithms <-- INTELLIGENCE MODELS OR SYSTEMS in the utilization review process <-- shall annually file with the department, in the form and manner prescribed by the department, an artificial intelligence compliance statement.

<-- 20250HB1925PN3349 - 35 - (b) Contents.--Each compliance statement must:

ATTESTING§ THAT5305. THE MA OR CHIP <-- MANGED CARE PLAN IS IN COMPLIANCE WITH SECTION 4103 (RELATING TO RESPONSIBLE USE).

§ 5305 4105.

<-- Prior to issuing or upholding a decision to deny, reduce or terminate benefits for a health care service, including a decision to deny a prior authorization request, a health care provider who participates in utilization review on behalf of an MA or CHIP managed care plan shall:

(3) Based on the review under paragraph (1), exercise 20250HB1925PN2403 - 25 - judgment independent of any recommendations by the artificial <-- intelligence-based algorithms.

20250HB1925PN3349 - 36 - § 5306.

BY§ ARTIFICIAL5307. INTELLIGENCE.

AN MA OR CHIP MANAGED <-- CARE PLAN MAY NOT PENALIZE A HEALTH CARE PROVIDER WHO PARTICIPATES IN UTILIZATION REVIEW ON BEHALF OF AN MA OR CHIP MANAGED CARE PLAN SOLELY FOR EXERCISING INDEPENDENT JUDGING IN REFUSING TO ISSUE OR OVERTURNING A DECISION TO DENY, REDUCE OR TERMINATE BENEFITS FOR A HEALTH CARE SERVICE GENERATED BY ARTIFICIAL INTELLIGENCE.

§ 5307 4106.

<-- The department shall establish a record retention policy and determine the amount of time an MA or CHIP managed care plan shall retain records.

The department may request input from an <-- MA or CHIP managed care plan or their representative to make this determination.

RELATING§ TO5308. THE USE OF ARTIFICIAL <-- INTELLIGENCE MODELS OR SYSTEMS IN THE UTILIZATION REVIEW PROCESS IN ACCORDANCE WITH THE FOLLOWING:

(1) RETENTION SHALL BE AT LEAST FIVE YEARS AND AS LONG AS REQUIRED UNDER EXISTING LAW.

(2) THE DEPARTMENT MAY REQUEST INPUT FROM AN MA OR CHIP 20250HB1925PN3349 - 37 - MANAGED CARE PLAN OR THEIR REPRESENTATIVE TO MAKE THIS DETERMINATION.

(3) A RECORD RETENTION POLICY SHALL NOT BE IMPLEMENTED IN CONFLICT WITH EXISTING LAW.

§ 5308 4107.

<--The (A)department COMPLIANCE.--THEmay DEPARTMENTrequest SHALLadditional ENSUREinformation COMPLIANCEand WITHevidence <--from THISan CHAPTER.MA or CHIP managed care plan regarding the items provided under section 5302 (relating to disclosure), 5303 (relating to responsible use) and 5304 (relating to artificial intelligence compliance statements) that are necessary to ensure compliance with this chapter.

(B) INFORMATION.--The department may INVESTIGATE POTENTIAL <-- VIOLATIONS OF THIS CHAPTER AND MAY request additional information and evidence from an MA or CHIP managed care plan regarding the items provided under section 5302 4102 (relating <-- to disclosure), 5303 4103 (relating to responsible use) and <-- 5304, 4104 (relating to artificial intelligence compliance <-- statements) AND 4105 (RELATING TO HEALTH CARE PROVIDER <-- REQUIREMENTS) that are necessary to ensure compliance with this chapter.

<-- A contractor, subcontractor or other third-party vendor that 20250HB1925PN2403 - 26 - sells, leases, subscribes or otherwise supplies artificial intelligence-based algorithms or services based on artificial intelligence-based algorithms to the MA or CHIP managed care plan shall be subject to this chapter.

20250HB1925PN3349 - 38 - § 5310.

(C)This CONFIDENTIALITY.--DOCUMENTSchapter SUBMITTEDshall TOnot THEapply DEPARTMENTto <--artificial UNDERintelligence-based THISalgorithms SECTIONused SHALLfor REMAINadministrative, CONFIDENTIALscheduling ANDor SHALLother NOTpurposes BEnot ACCESSIBLEpertaining UNDERto THEthe ACTdecision OFto FEBRUARYdeny, 14,reduce 2008or (P.L.6,terminate NO.3),benefits. KNOWN AS THE RIGHT-TO-KNOW LAW.

§ 4108.5311.

THIRD-PARTY VENDOR.

AN MA OR CHIP MANAGED CARE PLAN UTILIZING A THIRD-PARTY VENDOR FOR THE DEVELOPMENT OR DEPLOYMENT OF ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS FOR USE IN THE UTILIZATION REVIEW PROCESS, OR PRODUCTS OR SERVICES FOR THE UTILIZATION REVIEW PROCESS THAT RELY ON ARTIFICIAL INTELLIGENCE MODELS OR SYSTEMS, SHALL ESTABLISH INTERNAL REVIEW AND GOVERNANCE PROCESSES TO ENSURE COMPLIANCE WITH REQUIREMENTS UNDER SECTIONS 4102 (RELATING TO DISCLOSURE), 4103 (RELATING TO RESPONSIBLE USE), 4104 (RELATING TO ARTIFICIAL INTELLIGENCE COMPLIANCE STATEMENTS) AND 4105 (RELATING TO HEALTH CARE PROVIDER REQUIREMENTS).

§ 4109.

EXEMPTION.

This chapter shall not apply to artificial intelligence-based <-- algorithms INTELLIGENCE MODELS OR SYSTEMS used for <-- administrative, scheduling or other purposes not pertaining to the decision to deny, reduce or terminate benefits.

§ 5311 4110.

<-- (a) Civil penalties.-- (1) Subject to paragraph (2), the department may impose <-- a civil penalty not exceeding $5,000 for a violation of this chapter.

20250HB1925PN3349 - 39 - (i) A civil penalty imposed against an insurer may not exceed $500,000 in the aggregate during a single calendar year.

(ii) A civil penalty imposed against any other 20250HB1925PN2403 - 27 - person may not exceed $100,000 in the aggregate during a single calendar year.

(1)(c) SUBJECTInjunction.--The TOdepartment PARAGRAPHSmay (2),maintain (3)an ANDaction (4),in THEthe <--name DEPARTMENTof MAYthe IMPOSECommonwealth Afor CIVILan PENALTYinjunction ASto FOLLOWSprohibit FORany Aactivity VIOLATIONthat OFviolates THISthe CHAPTER:provisions of this chapter.

(I)(d) FOREffect Aon KNOWINGenrollment.--The ORdepartment WILLFULmay VIOLATION,issue Aan CIVILorder PENALTYtemporarily OFprohibiting NOTan MOREMA THANor $10,000CHIP PERmanaged VIOLATION.care plan that violates this chapter from enrolling new enrollees.

(II)§ EXCEPT5312. AS PROVIDED UNDER SUBPARAGRAPH (III) FOR A NEGLIGENT VIOLATION, A CIVIL PENALTY OF NOT MORE THAN $5,000 PER VIOLATION.

(III) FOR A FIRST-TIME, NEGLIGENT VIOLATION BY AN ENTITY THAT THE DEPARTMENT DETERMINES HAS MADE A GOOD- FAITH EFFORT TO COMPLY WITH THIS CHAPTER, A CIVIL PENALTY OF NOT MORE THAN $1,000 PER VIOLATION OR, AT THE DEPARTMENT'S DISCRETION, A PLAN OF CORRECTION UNDER SECTION 4111 (RELATING TO PLAN OF CORRECTION) IN LIEU OF A PENALTY.

(2) FOR PURPOSES OF PARAGRAPH (1), EACH INSTANCE OF NONDISCLOSURE SHALL CONSTITUTE A SEPARATE VIOLATION OF THIS 20250HB1925PN3349 - 40 - CHAPTER.

(3) IN DETERMINING THE AMOUNT OF A CIVIL PENALTY, THE DEPARTMENT SHALL CONSIDER:

(I) THE NATURE AND SERIOUSNESS OF THE VIOLATION.

(II) WHETHER THE VIOLATION HAS RESULTED IN PATIENT HARM.

(III) THE VIOLATOR'S HISTORY OF COMPLIANCE.

(IV) ANY GOOD-FAITH EFFORTS BY THE VIOLATOR TO COMPLY.

(V) THE VIOLATOR'S SIZE AND FINANCIAL RESOURCES.

(4) THE AGGREGATE AMOUNT OF CIVIL PENALTIES IMPOSED ON A SINGLE ENTITY UNDER THIS SUBSECTION DURING A SINGLE CALENDAR YEAR SHALL NOT EXCEED $250,000.

(B) DEPARTMENT ENFORCEMENT.--A VIOLATION OF ANY PROVISION OF THIS CHAPTER SHALL BE DEEMED TO BE A VIOLATION OF THE MA OR CHIP MANAGED CARE PLAN'S AGREEMENT WITH THE DEPARTMENT AND SHALL BE SUBJECT TO ENFORCEMENT PROCEEDINGS UNDER REGULATIONS PROMULGATED BY THE DEPARTMENT.

(C) ACTIONS.--A VIOLATION OF ANY PROVISION OF THIS CHAPTER SHALL BE DEEMED TO BE AN UNFAIR OR DECEPTIVE ACT OR PRACTICE IN VIOLATION OF THE ACT OF DECEMBER 17, 1968 (P.L.1224, NO.387), KNOWN AS THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW.

THE OFFICE OF ATTORNEY GENERAL SHALL HAVE EXCLUSIVE AUTHORITY TO BRING AN ACTION UNDER THE UNFAIR TRADE PRACTICES AND CONSUMER PROTECTION LAW FOR A VIOLATION OF ANY PROVISION OF THIS CHAPTER.

(c) (D) Injunction.--The department may maintain an action <-- in the name of the Commonwealth for an injunction to prohibit any activity that violates the provisions of this chapter.

(d) (E) Effect on enrollment.--The department may issue an <-- order temporarily prohibiting an MA or CHIP managed care plan 20250HB1925PN3349 - 41 - that violates this chapter from enrolling new enrollees.

(F) NONEXCLUSIVE REMEDIES.--THE ENFORCEMENT REMEDIES AND <-- PENALTIES IMPOSED UNDER THIS CHAPTER ARE IN ADDITION TO ANY OTHER REMEDIES OR PENALTIES THAT MAY BE IMPOSED UNDER ANY OTHER APPLICABLE FEDERAL LAW OR LAW OF THIS COMMONWEALTH, INCLUDING THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (PUBLIC LAW 104-191, 110 STAT.

1936), AS AMENDED BY THE HEALTH INFORMATION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT (PUBLIC LAW 111-5, 123 STAT.

226-279 AND 467-496).

§ 5312 4111.

<-- (a) Authorization.--The department may require an MA or CHIP managed care plan to develop and adhere to a plan of correction approved by the department.

OR IN ADDITION TO CIVIL PENALTIES <-- IMPOSED UNDER SECTION 4110 (RELATING TO ENFORCEMENT AND PENALTIES).

(c) Availability.--The plan of correction shall, upon <-- request, be made available to enrollees of the insurer or MA or CHIP managed care planplan. UPON REQUEST.

<-- § 53135313. 4112.

<-- (a) Applicable procedures.--This chapter shall be subject to 2 Pa.C.S.

(b) Appeal.--A party against whom penalties are assessed in 20250HB1925PN2403 - 28 - an administrative action may appeal to Commonwealth Court as provided in 2 Pa.C.S.

§ 53145314. 4113.

<-- 20250HB1925PN3349 - 42 - The department shall promulgate regulations or guidance necessary to implement, administer and enforce this chapter.

THE <-- DEPARTMENT SHALL CONSULT WITH THE INSURANCE DEPARTMENT AND THE DEPARTMENT OF HEALTH WHEN DEVELOPING REGULATIONS AND GUIDANCE TO ACHIEVE CONFORMITY ACROSS REGULATIONS AND GUIDANCE PROMULGATED BY THE THREE DEPARTMENTS.

Section 33. 4.

<--20250HB1925PN2403 20250HB1925PN3349 - 4329 -