Law / United States / 
Pennsylvania
H.B. 1925, artificial intelligence disclosure and responsible use by health care facilities, insurers and MA or CHIP managed care plans
Pa. H.B. 1925, 2025-2026 Regular Session
Before the second chamber, dated , as of .
An AI sector rules rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Disclosure, Governance, Reporting, Retention
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Filed with regulator
As of .
Where it has got to
The text described here is Printer's Number 3963, as passed by the House. That print is PN 3963, published .
Locally, this stage is Senate Institutional Sustainability and Innovation Committee.
The stage above is recorded at www.palegis.us.
The House Communications and Technology Committee reported the bill as amended (PN 2403 and then PN 3349) on . The House amended it on second consideration on (PN 3963), re-committed it to Appropriations, and passed it 144-59 on . It was referred to the Senate Institutional Sustainability and Innovation Committee on . The 2025-2026 session runs through .
What it requires
- If you are a health care facility using artificial intelligence models or systems for clinical decision making, disclose that use to patients in plain language, post it on your website, and file an annual compliance statement with the Department of Health.
- Do not let an artificial intelligence model or system supersede a human health care provider's clinical decision making or penalize a provider for exercising independent judgment, review its performance, use and outcomes at least annually, and keep policies, a governance structure and a validation process for it.
- If you are an insurer or an MA or CHIP managed care plan using artificial intelligence in utilization review, disclose that use in plain language to participating network providers and to covered persons or enrollees, post it on your website, and file an annual compliance statement with the regulating department.
- Make sure the model evaluates the individual's own clinical history and circumstances rather than producing an output solely from a group data set, and does not supersede the decision making of the health care provider conducting the utilization review.
- Have a health care provider who participates in utilization review review individual clinical records and document the review before a decision to deny, reduce or terminate benefits is issued or upheld, and do not penalize that provider for exercising independent judgment.
- Retain records of your use of artificial intelligence for the period the regulating department's retention policy sets, not less than five years.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Pennsylvania Department of Health (facilities), Insurance Department (insurers) and Department of Human Services (MA or CHIP managed care plans), with the Office of Attorney General
What it makes you log
Who may demand the log
Regulator
Log retention
A floor of five years, or longer where existing law requires, in the retention policy each department is directed to set.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Each chapter directs its department to set a record retention policy for records of the regulated party's use of artificial intelligence, with retention of not less than five years and at least as long as other law requires; the bill does not list what the records contain.
- Kind
- Explicit
- As of
- Provision
- House Bill 1925, PN 3963, 35 Pa.C.S. § 3505, 40 Pa.C.S. § 5206 and 67 Pa.C.S. § 4106, as proposed
- Trigger
- automated_decisions
What this law does
House Bill 1925 as amended (Printer's Number 3963) passed the Pennsylvania House 144-59 on and was referred to the Senate Institutional Sustainability and Innovation Committee on , and the bill status page records no report from that committee. As passed by the House, a facility that uses artificial intelligence models or systems for clinical decision making must disclose that use to patients in plain language.
The facility must also post that information on its publicly accessible website. A facility may not penalize a health care provider solely for exercising independent judgment that differs from a recommendation or output generated by artificial intelligence. A facility must file an annual artificial intelligence compliance statement with the Department of Health.
An insurer must disclose to a participating network provider and all covered persons in plain language if artificial intelligence models or systems are or will be used in its utilization review process. Before issuing or upholding a decision to deny, reduce or terminate benefits, a health care provider who participates in utilization review on behalf of an insurer must review individual clinical records and document the review.
An insurer must keep records of its use of artificial intelligence in utilization review for not less than five years under a retention policy the Insurance Department sets. A parallel chapter requires an MA or CHIP managed care plan to disclose to participating network providers and enrollees in plain language if artificial intelligence models or systems are used in its utilization review process.
The Department of Health may impose a civil penalty of not more than $10,000 per violation for a knowing or willful violation of the facility chapter. Only the Office of Attorney General may bring an action under the Unfair Trade Practices and Consumer Protection Law for a violation of the facility chapter. As passed, the act provides that it would take effect in one year.
When LexLint raises it
When your app profile says your app handles health records or makes health care decisions.