Handles health records, in Pennsylvania

35 P.S. §§ 7601 to 7612 (Act 148 of 1990) · Read the law's page

• Do not perform an HIV-related test without first obtaining the subject's informed documented consent, preceded by an explanation of the test including its purpose, potential uses, limitations and the meaning of its results, except as section 6 provides for the involuntary testing of a source patient. A health care provider may offer opt-out testing if the subject is informed that the subject will be tested unless the subject refuses, and must document the informed consent and whether the subject declined.
• If you provide a health or social service, or obtain confidential HIV-related information under a release, do not disclose it, and do not be compelled to disclose it, except to the persons section 7(a) lists, such as the subject, the physician who ordered the test, a person named in the subject's written consent, and an insurer to the extent necessary to reimburse providers or pay a claim.
• If you receive confidential HIV-related information under the act, do not disclose it to another person except as the act authorizes.
• Make a written consent to disclosure contain the nine required elements, including the signature of the subject, the date, a statement that the consent is subject to revocation, and its expiration; do not disclose on an expired, deficient, revoked or materially false consent; and accompany each consented disclosure with the written statement section 7(e) requires.

Pa. H.B. 1925, 2025-2026 Regular Session · Read the law's page

• If you are a health care facility using artificial intelligence models or systems for clinical decision making, disclose that use to patients in plain language, post it on your website, and file an annual compliance statement with the Department of Health.
• Do not let an artificial intelligence model or system supersede a human health care provider's clinical decision making or penalize a provider for exercising independent judgment, review its performance, use and outcomes at least annually, and keep policies, a governance structure and a validation process for it.
• If you are an insurer or an MA or CHIP managed care plan using artificial intelligence in utilization review, disclose that use in plain language to participating network providers and to covered persons or enrollees, post it on your website, and file an annual compliance statement with the regulating department.
• Make sure the model evaluates the individual's own clinical history and circumstances rather than producing an output solely from a group data set, and does not supersede the decision making of the health care provider conducting the utilization review.
• Have a health care provider who participates in utilization review review individual clinical records and document the review before a decision to deny, reduce or terminate benefits is issued or upheld, and do not penalize that provider for exercising independent judgment.
• Retain records of your use of artificial intelligence for the period the regulating department's retention policy sets, not less than five years.