RELATING TO THE PATIENTS' BILL OF RIGHTS.

HB2537

HOUSE OF REPRESENTATIVES

H.B. NO.

2537

THIRTY-THIRD LEGISLATURE, 2026

STATE OF HAWAII

A BILL FOR AN ACT

relating
to the patients' bill of rights
.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

����
SECTION 1.
�
The legislature finds that there is a growing
need to ensure Hawaii's residents receive appropriate and timely health care.
�
The legislature further finds that the
existing law protecting patient's rights does not address new and emerging
technologies, like the use of artificial intelligence in health care decision
making, or a patient's rights in cases where their protected health information
has been accessed when a health insurer is the victim of a data breach.

����
Accordingly, the purpose of this Act
is to update and modernize the State's patients' bill of rights and
responsibilities act to increase access to care, reduce administrative burdens,
and address emerging technologies.

����
SECTION 2.
�
This Act shall be known and may be cited as
the "Hawaii Patients' Bill of Rights of 2025"

����
SECTION 3.
�
Chapter 432E, Hawaii Revised Statutes, is
amended by adding six new sections to be appropriately designated and to read
as follows:

����
"
�432E-
�
Access
to timely services.
�
(a)
�
An enrollee shall have the right to timely access and referrals to
specialist care.

����
(b)
�
A
managed care plan shall cover telehealth services for covered benefits at a
rate equal to that of an in-person consultation between the patient and a
health care provider.

����
�432E-
�
Prior authorization; decision-making;
access; reporting.
�
(a)
�
A health carrier or its designated
utilization review organization shall make a determination on a prior
authorization request for an urgent health care service no later than one
business day after the request is submitted.

����
(b)
�
A health carrier or its designated
utilization review organization shall make a determination on a prior
authorization request for a non-urgent health care service no later than three
business days after the request is submitted.

����
(c)
�
If a health carrier or its designated
utilization review organization makes an adverse determination on a prior
authorization request, the health carrier shall furnish the enrollee and the
enrollee's provider with the following in writing:

����
(1)
�
A clear
rational for the adverse determination, provided in plain language;

����
(2)
�
A timeline for
the enrollee or the enrollee's representative to appeal the adverse
determination;

����
(3)
�
A form and
explanation of the health carrier's complaints and internal appeals procedures
and how the enrollee or the enrollee's representative may file an appeal of the
adverse determination pursuant to section 432E-5; and

����
(4)
�
A form and
explanation of how the enrollee or the enrollee's representative may request an
external review of the adverse determination pursuant to section 432E-33.

����
(d)
�
The health carrier shall maintain a webpage
and toll-free telephone number to provide enrollees or their representatives
with assistance and information on the health carrier's internal appeals
process and the external review process.

����
(e)
�
A health carrier shall not establish
requirements for prior authorization that unduly burden or impede providers
providing health care services in rural or medically underserved areas of the
State.

����
(f)
�
Each health carrier shall submit a monthly
report to the insurance commissioner that contains the following aggregated and
de-identified information:

����
(1)
�
The number of
prior authorization requests received by the health carrier or
its
designated utilization review organization
;

����
(2)
�
The rate of
approval and denial of prior authorization requests;

����
(3)
�
The median
processing time for a prior authorization request;

����
(4)
�
The number of
appeals of an adverse determination of a prior authorization request and the
rate at which the adverse determination was overturned; and

����
(5)
�
The number of
prior authorization determinations that were made using an automated decision
support tool.

����
(g)
�
No later than twenty days prior to the
regular session of 2028, and each regular session thereafter, the insurance
commissioner shall submit a report to the legislature on:

����
(1)
�
The number of
prior authorization requests and the median processing time for a prior
authorization request, broken down by health carrier;

����
(2)
�
The number of
prior authorization denials made in the preceding calendar year, broken down by
health carrier;

����
(3)
�
The number of
appeals of a prior authorization determination and their outcomes, broken down
by health carrier; and

����
(4)
�
The number of
prior authorization determinations that were made using an automated decision
support tool, broken down by health carrier.

����
�432E-
�
Automated decision support tool;
oversight; review; notice.
�
(a)
�
A health carrier or utilization review
organization that uses
an automated
decision support tool for the purpose of utilization review shall provide a
written disclosure on how the automated decision support tool is used in the
utilization review process in each policy, plan, contract, or agreement issued
by a health carrier in the State.

����
(b)
�
A health carrier shall notify an enrollee and
the enrollee's provider in writing if the use of an automated decision support
tool materially contributed to an adverse action, including a denial of a
request for prior authorization.

����
(c)
�
If an automated decision support tool
materially contributed to an adverse action, the health carrier shall not issue
the adverse action until the claim is independently reviewed and approved by a
board-certified clinician.
�
When
conducting the independent review of the adverse action, the board-certified
clinician shall exercise independent medical judgment and shall not rely solely
on recommendations from any other sources, including an automated decision
support tool.

����
(d)
�
No later than June 30, 2027, a health carrier
shall develop and make available for annual review by the insurance
commissioner the following information:

����
(1)
�
The health
carrier's governance polices for the use of automated decision support tools;

����
(2)
�
The health
carrier or its designated utilization review organization's process for validation
and bias testing of the automated decision support tool; and

����
(3)
�
The health
carrier's monitoring records of the automated decision support tool.

����
(e)
�
For the purposes of this section, an
automated decision support tool shall be deemed to have materially contributed
to an adverse action if the health carrier or its designated utilization review
organization relied primarily on the automated decision support tool in its
utilization review.

����
�432E-
�
Data protection and handling; offshoring;
security breaches; notice.
�

(a)
�
No later than June 30,
2027, a health carrier shall develop and implement safeguards for protected
health information that meet or exceed the privacy requirements under the
federal Health Insurance Portability and Accountability
Act of
1996, P.L. 104-191, and its related regulations
under title 45 Code of Federal
Regulations parts 160 and 164.

����
(b)
�
No later than June 30, 2027, each health
carrier shall, in a form and manner as prescribed the insurance commissioner,
submit an attestation for each offshoring contract for services related to
protected health information to the insurance commissioner that:

����
(1)
�
T
he protected health
information shall not be shared with any person, entity, or organization other
than the one with whom the health carrier enters into a contract; and

����
(2)
�
The offshoring contract contains measures
for the handling of protected health information that fully complies with the
Health
Insurance Portability and Accountability Act of 1996, P.L. 104-191, and all
other applicable federal and state privacy laws, rules, and regulations
.

����
(c)
�
If a health carrier or its designated
utilization review organization knows or suspects that it is the victim of a
data breach, the health carrier shall notify the insurance commissioner and all
enrollees in the health carrier's managed care plans of the suspected or known
data breach and provide a copy of the health carrier's corrective action plans
within seventy-two hours of the time the health carrier or its designated
utilization review organization is made aware of the known or suspected data
breach.

����
�432E-
�
Network adequacy; reports.
�
A health carrier shall submit reports on a
quarterly basis to the insurance commissioner on the health carrier's network
adequacy.
�
Each quarterly report shall
include:

����
(1)
�
Provider ratios
broken down by island or region;

����
(2)
�
Wait times;

����
(3)
�
Telehealth
utilization; and

����
(4)
�
Referral
outcomes.

����
�432E-
�
Provider protections; provider
assistance.
�
(a)
�
No health carrier shall retaliate against a
health care provider who files a complaint against the health carrier with the
insurance commissioner, assists an enrollee with filing a complaint with the
health carrier pursuant to section 432E-5, or requests an external review of a
health carrier's adverse action pursuant to section 432E-33.

����
(b)
�

The insurance commissioner and the department of commerce and consumer
affairs shall provide guidance and technical assistance to small and rural
practices on navigating health carrier administrative requirements, the appeals
and complaints process under section 432E-5, the external review process under
section 432E-33, and compliance with this chapter.
"

����
SECTION 4.
�
Section 432E-1, Hawaii Revised Statutes, is
amended by adding five new definitions to be appropriately inserted and to read
as follows:

����
"
"Artificial
intelligence" means an engineered or machine-based system that varies in
its level of autonomy and that can, for explicit or implicit objectives, infer
from inputs how to generate outputs, including content, decisions, predictions,
and recommendations, that can influence physical or virtual environments.

����
"Automated decision support
tool" means any artificial intelligence, algorithmic, software-based,
statistical, or data-driven tool, model, or process that autonomously or
semi-autonomously generates, recommends, or adjudicates coverage determinations
or prior authorization decisions without contemporaneous decision-making by a
physician licensed under chapter 453 or advanced practice registered nurse
licensed under chapter 457.

����
"Offshoring
contract" means the contracting of services by a health carrier for claims
processing, call center staffing, technical support, or other administrative
services to be rendered, in whole or in part, by another party located outside
of the United States or its territories.

����
"Prior
authorization" has the same meaning as defined in section 323D-2.

����
"Urgent
health care service" means a health care service which
,
without an
expedited prior authorization,
could,

in the opinion of a physician with knowledge of the enrollee's medical
condition:

����
(1)
�
S
eriously jeopardize the life or health
of the enrollee or the ability of the enrollee to regain maximum function; or

����
(2)
�
S
ubject the enrollee to severe pain that
cannot be adequately managed without the care or treatment that is the subject
of the utilization review.

"Urgent
health care service" includes mental and behavioral health care services.
"

����
SECTION
5
.
�
Section
432E-1.4, Hawaii Revised Statutes, is amended to read as follows:

����
"
�432E-1.4
�
Medical necessity.
�
(a)
�

For contractual purposes, a health intervention shall be covered if it
is an otherwise covered category of service, not specifically excluded,
recommended by the treating licensed health care provider, and determined by
the health plan's medical director to be medically necessary as defined in
subsection (b).
�
A health intervention
may be medically indicated and not qualify as a covered benefit or meet the
definition of medical necessity.
�
A
managed care plan may choose to cover health interventions that do not meet the
definition of medical necessity.

����
(b)
�

A health intervention is medically necessary if it is recommended by the
treating physician or treating licensed health care provider, is approved by
the health plan's medical director or physician designee, and is:

����
(1)
�
For the purpose of
treating a medical condition;

����
(2)
�
The most
appropriate delivery or level of service, considering potential benefits and
harms to the patient;

����
(3)
�
Known to be
effective in improving health outcomes; provided that:

���������
(A)
�
Effectiveness is
determined first by scientific evidence;

���������
(B)
�
If no scientific
evidence exists, then by professional standards of care; and

���������
(C)
�
If no professional
standards of care exist or if they exist but are outdated or contradictory,
then by expert opinion; and

����
(4)
�
Cost-effective for
the medical condition being treated compared to alternative health
interventions, including no intervention.
�

For purposes of this paragraph, cost-effective shall not necessarily
mean the lowest price.

����
(c)
�

When the treating licensed health care provider and the health plan's
medical director or physician designee do not agree on whether a health
intervention is medically necessary, a reviewing body, whether internal to the
plan or external, shall give consideration to, but shall not be bound by, the
recommendations of the treating licensed health care provider and the health
plan's medical director or physician designee.

����
(d)
�
A managed care plan shall not retroactively
deny any medically necessary health intervention provided to an enrollee during
emergency services.

����
[
(d)
]
(e)
�
For the purposes of this section:

����
"Cost-effective" means a
health intervention where the benefits and harms relative to the costs
represent an economically efficient use of resources for patients with the
medical condition being treated through the health intervention; provided that
the characteristics of the individual patient shall be determinative when
applying this criterion to an individual case.

����
"Effective" means a health
intervention that may reasonably be expected to produce the intended results
and to have expected benefits that outweigh potential harmful effects.

����
"Health intervention"
means an item or service delivered or undertaken primarily to treat a medical
condition or to maintain or restore functional ability.
�
A health intervention is defined not only by
the intervention itself, but also by the medical condition and patient
indications for which it is being applied.
�

New interventions for which clinical trials have not been conducted and
effectiveness has not been scientifically established shall be evaluated on the
basis of professional standards of care or expert opinion.
�
For existing interventions, scientific
evidence shall be considered first and, to the greatest extent possible, shall
be the basis for determinations of medical necessity.
�
If no scientific evidence is available,
professional standards of care shall be considered.
�
If professional standards of care do not
exist or are outdated or contradictory, decisions about existing interventions
shall be based on expert opinion.
�
Giving
priority to scientific evidence shall not mean that coverage of existing
interventions shall be denied in the absence of conclusive scientific
evidence.
�
Existing interventions may
meet the definition of medical necessity in the absence of scientific evidence
if there is a strong conviction of effectiveness and benefit expressed through
up-to-date and consistent professional standards of care, or in the absence of
such standards, convincing expert opinion.

����
"Health outcomes" mean
outcomes that affect health status as measured by the length or quality of a
patient's life, primarily as perceived by the patient.

����
"Medical condition" means
a disease, illness, injury, genetic or congenital defect, pregnancy, or a
biological or psychological condition that lies outside the range of normal,
age-appropriate human variation.

����
"Physician designee" means
a physician or other health care practitioner designated to assist in the
decision-making process who has training and credentials at least equal to the
treating licensed health care provider.

����
"Scientific evidence"
means controlled clinical trials that either directly or indirectly demonstrate
the effect of the intervention on health outcomes.
�
If controlled clinical trials are not
available, observational studies that demonstrate a causal relationship between
the intervention and the health outcomes may be used.
�
Partially controlled observational studies
and uncontrolled clinical series may be suggestive, but do not by themselves
demonstrate a causal relationship unless the magnitude of the effect observed
exceeds anything that could be explained either by the natural history of the
medical condition or potential experimental biases.
�
Scientific evidence may be found in the
following and similar sources:

����
(1)
�
Peer-reviewed
scientific studies published in or accepted for publication by medical journals
that meet nationally recognized requirements for scientific manuscripts and
that submit most of their published articles for review by experts who are not
part of the editorial staff;

����
(2)
�
Peer-reviewed
literature, biomedical compendia, and other medical literature that meet the
criteria of the National Institutes of Health's National Library of Medicine
for indexing in Index Medicus, Excerpta Medicus (EMBASE), Medline, and MEDLARS
database Health Services Technology Assessment Research (HSTAR);

����
(3)
�
Medical journals
recognized by the Secretary of Health and Human Services under section
1861(t)(2) of the Social Security Act, as amended;

����
(4)
�
Standard reference
compendia including the American Hospital Formulary Service-Drug Information,
American Medical Association Drug Evaluation, American Dental Association
Accepted Dental Therapeutics, and United States Pharmacopoeia-Drug Information;

����
(5)
�
Findings, studies,
or research conducted by or under the auspices of federal agencies and
nationally recognized federal research institutes including but not limited to
the Federal Agency for Health Care Policy and Research, National Institutes of
Health, National Cancer Institute, National Academy of Sciences,
Centers
for Medicare and Medicaid Services,
Congressional Office of Technology
Assessment, and any national board recognized by the National Institutes of
Health for the purpose of evaluating the medical value of health services; and

����
(6)
�
Peer-reviewed
abstracts accepted for presentation at major medical association meetings.

����
"Treat" means to prevent,
diagnose, detect, provide medical care, or palliate.

����
"Treating licensed health care
provider" means a licensed health care provider who has personally
evaluated the patient."

����
SECTION
6
.
�
Section 432E-7,
Hawaii Revised Statutes, is amended to read as follows:

����
"
�432E-7
�
Information to
enrollees.
�
(a)
�
The managed care plan shall provide
in
plain language
to its enrollees upon enrollment and thereafter upon request
the following information:

����
(1)
�
A list of
participating providers which shall be updated on a [
regular
]
quarterly

basis indicating, at a minimum, their specialty and whether the provider is
accepting new patients;

����
(2)
�
A complete
description of benefits,
exclusions,
services, and copayments;

����
(3)
�
A statement on
enrollee's rights, responsibilities, and obligations;

����
(4)
�
An explanation of
the referral process, if any;

����
(5)
�
Where services or
benefits may be obtained;

����
(6)
�
Information on
complaints and appeals procedures[
; and
]
, including a step-by-step
explanation of the appeal and external review process; and

����
(7)
�
The telephone
number of the insurance division.

This information shall be provided to prospective
enrollees upon request."

����
SECTION
7
.
�
Section 432E-8,
Hawaii Revised Statutes, is amended to read as follows:

����
"
[
[
]�432E-8[
]
]
�

Enforcement.
�
(a)
�
All remedies, penalties, and proceedings in
articles 2 and 13 of chapter 431 made applicable hereby to managed care plans
shall be invoked and enforced solely and exclusively by the commissioner.

����
(b)
�
In addition to any remedy, penalty, or
proceeding invoked pursuant to subsection (a), the commissioner may:

����
(1)
�
Audit,
investigate, or impose penalties on a health carrier;

����
(2)
�
Require a health
carrier to provide restitution;

����
(3)
�
Revoke a
managed care plan's accreditation; or

����
(4)
�
Pursue
injunctive relief against a health carrier for a violation of this chapter.

����
(c)
�
The commissioner shall prepare and make
public an annual report of any enforcement actions taken against a health
carrier or managed care plan pursuant to this section.
"

����
SECTION 8.
�
If any provision of this Act, or the
application thereof to any person or circumstance, is held invalid, the
invalidity does not affect other provisions or applications of the Act that can
be given effect without the invalid provision or application, and to this end
the provisions of this Act are severable.

����
SECTION 9.
�
Statutory material to be repealed is
bracketed and stricken.
�
New statutory
material is underscored.

����
SECTION 10.
�
This Act shall take effect on July 1, 2026.

INTRODUCED BY:

_____________________________

Report Title:

Patients'
Bill of Rights and Responsibilities; Prior Authorization; Artificial
Intelligence; Automated Decision Support Tools; Utilization Review; Protected
Health Information; Data Protection; Offshoring; Reporting Requirements;
Insurance Commissioner

Description:

Establishes
patient rights with respect to timely access to specialists and referrals and
prior authorization determination timelines.
�

Establishes certain requirements for health carriers for prior
authorization determinations.
�

Establishes certain requirements for the use of automated decision
support tools for claims determinations and utilization review.
�
Requires health carriers to establish certain
safeguards for protected health information.
�

Establishes certain reporting requirements for network adequacy.
�
Establishes certain provider
protections.
�
Expands the Insurance
Commissioner's enforcement authority.

The summary description
of legislation appearing on this page is for informational purposes only and is
not legislation or evidence of legislative intent.