Duty LXD-4522
Deploys a mental-health chatbot, in Vermont
Document Safe Destruction Act, safe destruction of records containing personal informationsince 5 lines
9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. ) · Read the law's page
- This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
- Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
- An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
- This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
- A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.
Act 156 (H.816), artificial intelligence in the provision of mental health servicessince 3 lines
2026 Vt. Acts & Resolves Act No. 156 (H.816); 18 V.S.A. § 7115; 3 V.S.A. § 129a(a)(30); 26 V.S.A. § 1354(a)(3) · Read the law's page
- Do not provide, advertise, or otherwise offer mental health services to the public, including through the use of artificial intelligence, unless a mental health professional provides them or they are part of an approved institutional review board or privacy board study.
- Mental health services are services provided to diagnose, treat, or address an individual's mental health or behavioral health through therapeutic communications and therapeutic decisions.
- A mental health professional may use artificial intelligence tools that comply with the Health Insurance Portability and Accountability Act of 1996 within the professional's scope of practice only if the professional reviews and approves any mental health services.
Vermont Neurological Rights and AI in Health and Human Services Act (Act 101 / H.814)since 4 lines
2026 Vt. Acts & Resolves Act 101 (H.814); 3 V.S.A. ch. 69 (amending); effective
- Disclose whenever artificial intelligence is used to make or inform a decision affecting an individual in a health or human services context, including clinical care, insurance coverage determinations, or a chatbot substituting for a licensed mental health professional.
- Notify affected individuals when using artificial intelligence to evaluate prior authorizations or coverage.
- Obtain informed consent before collecting neural data through a brain-computer interface.
- Delete neural data within 10 days of the individual revoking consent.