An Act amending Titles 35 (Health and Safety) and 40 (Insurance) of the Pennsylvania Consolidated Statutes, providing for artificial intelligence in facilities, for artificial intelligence use by insurers and for artificial intelligence use by MA or CHIP managed care plans; imposing duties on the Department of Health, the Insurance Department and the Department of Human Services; and imposing penalties.

PRINTER'S NO. 1376
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 1113
Session of
2026
INTRODUCED BY PISCIOTTANO, COLLETT, HAYWOOD, FONTANA, HUGHES,
TARTAGLIONE, COSTA, VOGEL, SANTARSIERO AND CAPPELLETTI,
JANUARY 9, 2026
REFERRED TO INSTITUTIONAL SUSTAINABILITY AND INNOVATION,
JANUARY 9, 2026
AN ACT
Amending Titles 35 (Health and Safety) and 40 (Insurance) of the
Pennsylvania Consolidated Statutes, providing for artificial
intelligence in facilities, for artificial intelligence use
by insurers and for artificial intelligence use by MA or CHIP
managed care plans; imposing duties on the Department of
Health, the Insurance Department and the Department of Human
Services; and imposing penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Title 35 of the Pennsylvania Consolidated
Statutes is amended by adding a chapter to read:
CHAPTER 35
ARTIFICIAL INTELLIGENCE IN FACILITIES
Sec.
3501. Definitions.
3502. Disclosure.
3503. Responsible use.
3504. Artificial intelligence compliance statements.
3505. Reports.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
3506. Retention of records.
3507. Oversight.
3508. Third-party vendor.
3509. Exemption.
3510. Enforcement and penalties.
3511. Plan of correction.
3512. Administrative procedures.
3513. Regulations and guidance.
§ 3501. Definitions.
The following words and phrases when used in this chapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Artificial intelligence" or "AI." A machine-based system
that can, for a given set of human-defined objectives, make
predictions, recommendations or decisions influencing real or
virtual environments that use machine-based and human-based
inputs to perceive real and virtual environments, abstract the
perceptions into models through analysis in an automated manner
and use model inference to formulate options for information or
action. The term includes generative artificial intelligence
which is the class of models that emulate the structure and
characteristics of input data in order to generate derived
synthetic content which includes information such as images,
videos, audio clips and text that has been significantly
modified or generated by algorithms, including by artificial
intelligence.
"Artificial-intelligence-based algorithms." The programming
and data sets that inform an artificial intelligence system.
"Clinical decision making." A patient-centered problem-
solving process focused on a health care provider's direct
20260SB1113PN1376 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
patient care involving gathering information, diagnosing and
planning treatments.
"Department." The Department of Health of the Commonwealth.
"Facility." A health care setting or institution providing
health care services, including:
(1) A general, special, psychiatric or rehabilitation
hospital.
(2) An ambulatory surgical facility.
(3) A cancer treatment center.
(4) A birth center.
(5) An inpatient, outpatient or residential drug and
alcohol treatment facility.
(6) A facility licensed by the Department of Human
Services' Office of Mental Health and Substance Abuse
Services.
(7) A laboratory, imaging, diagnostic or other
outpatient medical service or testing facility.
(8) A health care provider office or clinic that is
owned by or employs a Commonwealth-licensed physician,
physician assistant or nurse practitioner.
"Health care provider." As follows:
(1) A facility or individual who is licensed, certified
or otherwise regulated to provide health care services under
the laws of this Commonwealth.
(2) The term does not include an individual providing
emergency services under a licensed emergency medical
services agency as defined in section 8103 (relating to
definitions).
§ 3502. Disclosure.
(a) Artificial-intelligence-based algorithms.--A facility
20260SB1113PN1376 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
shall disclose to patients of the facility if artificial-
intelligence-based algorithms are or will be used for clinical
decision making or other similar tasks. The disclosure shall be:
(1) Provided in all related written communications.
(2) Posted on the publicly accessible Internet website
of the facility.
(b) Communications.--
(1) A facility that uses artificial intelligence to
generate written or verbal patient communications pertaining
to patient clinical information shall include:
(i) A clear and conspicuous disclaimer that
indicates that the communication was generated by
artificial intelligence.
(ii) Clear instructions on how the patient may
contact a human health care provider or relevant employee
of the facility with questions.
(2) The requirements under paragraph (1) shall not apply
to communications that:
(i) only pertain to administrative matters,
including appointment scheduling, billing or other
clerical or business matters; or
(ii) have been individually read and reviewed by a
human health care provider.
(c) Nature and frequency.--The department shall determine
the nature and frequency of disclosure requirements to the
patient. The department may request input from facilities and
health care providers or their representatives in making the
determination.
§ 3503. Responsible use.
(a) Compliance generally.--The criteria for the artificial-
20260SB1113PN1376 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
intelligence-based algorithms must comply with this chapter and
applicable Federal and State law.
(b) Requirements for artificial-intelligence-based
algorithms.--For each instance in which a facility uses
artificial-intelligence-based algorithms for clinical decision
making, the facility shall comply with the following:
(1) The artificial-intelligence-based algorithms must
not supersede health care provider clinical decision making.
(2) The artificial-intelligence-based algorithms and
training data sets must not directly or indirectly
discriminate against patients in violation of Federal or
State law.
(3) The artificial-intelligence-based algorithms must be
fairly and equitably applied, including in accordance with
any applicable regulations and or guidance issued by the
United States Department of Health and Human Services.
(4) The use of the artificial-intelligence-based
algorithms must be disclosed in accordance with section 3502
(relating to disclosure).
(5) The performance, use and outcomes of the artificial-
intelligence-based algorithms must be periodically reviewed
and revised to maximize accuracy and reliability.
(6) Patient data must not be used beyond the intended
and stated purpose of the artificial-intelligence-based
algorithms, consistent with the laws of this Commonwealth and
42 U.S.C. Ch. 7 Subch. XI Part C (relating to administrative
simplification), as applicable.
(7) The artificial-intelligence-based algorithms must
not create foreseeable, material risks of harm to the
patient.
20260SB1113PN1376 - 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
§ 3504. Artificial intelligence compliance statements.
(a) Compliance statement required.--A facility using
artificial-intelligence-based algorithms for clinical decision
making shall annually file with the department in the form and
manner prescribed by the department an artificial intelligence
compliance statement.
(b) Contents.--A compliance statement must:
(1) Summarize the function and scope of artificial-
intelligence-based algorithms used for clinical decision
making.
(2) Provide a logic or decision tree of artificial-
intelligence-based algorithms used for clinical decision
making.
(3) Provide a description of each training data set used
by artificial-intelligence-based algorithms for clinical
decision making, including the source of the data.
(4) Attest that the artificial-intelligence-based
algorithms and the training data sets comply with section
3503 (relating to responsible use) and provide evidence of
the compliance.
(5) Describe the process of the facility for overseeing
and validating the performance and compliance of the
artificial-intelligence-based algorithms in accordance with
section 3503.
§ 3505. Reports.
(a) Annual report required.--No later than one year after
the effective date of this subsection and each year thereafter,
the department shall compile the information from the most
recent annual compliance statements under section 3504 (relating
to artificial intelligence compliance statements) and issue a
20260SB1113PN1376 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
report containing the compiled information, along with any other
applicable findings and recommendations. The information in the
report shall be aggregated and deidentified.
(b) Posting.--The department shall post each report under
this section on the publicly accessible Internet website of the
department.
§ 3506. Retention of records.
The department shall establish a record retention policy and
determine the amount of time a facility shall retain records
related to artificial-intelligence algorithms. The department
may request input from facilities and health care providers or
their representatives in making the determination under this
section.
§ 3507. Oversight.
The department may request additional information and
evidence from a facility regarding the items provided under
sections 3502 (relating to disclosure), 3503 (relating to
responsible use) and 3504 (relating to artificial intelligence
compliance statements) that are necessary to ensure compliance
with this chapter.
§ 3508. Third-party vendor.
A contractor, subcontractor or other third-party vendor that
sells, leases, subscribes or otherwise supplies artificial-
intelligence-based algorithms or services based on artificial-
intelligence-based algorithms to the facility shall be subject
to this chapter. The department shall develop regulations or
guidance regarding the responsibility of a contractor,
subcontractor or other third-party vendor that sells, leases,
subscribes or otherwise supplies artificial-intelligence-based
algorithms or services based on artificial-intelligence-based
20260SB1113PN1376 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
algorithms to the facility. The department may request input
from facilities, third-party vendors and health care providers
or their representatives in making this determination.
§ 3509. Exemption.
This chapter shall not apply to validated, static decision-
support tools or tools used for administration, scheduling,
scribe applications or clinical calculators.
§ 3510. Enforcement and penalties.
(a) Civil penalties.--
(1) Subject to paragraph (2), the department may impose
a civil penalty not exceeding $5,000 for a violation of this
chapter. For purposes of this paragraph, each instance of
nondisclosure shall constitute a separate violation of this
chapter.
(2) The following apply to limitations on civil
penalties under this subsection:
(i) A civil penalty imposed against a facility may
not exceed $500,000 in the aggregate during a single
calendar year.
(ii) A civil penalty imposed against any other
person may not exceed $100,000 in the aggregate during a
single calendar year.
(b) Injunction.--The department may maintain an action in
the name of the Commonwealth for an injunction to prohibit any
activity that violates the provisions of this chapter.
(c) Nonexclusive remedies.--The enforcement remedies and
penalties imposed under this chapter are in addition to any
other remedies or penalties that may be imposed under any other
applicable law of this Commonwealth, including the act of July
19, 1979 (P.L.130, No.48), known as the Health Care Facilities
20260SB1113PN1376 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Act.
§ 3511. Plan of correction.
(a) Authorization.--The department may require a facility to
develop and adhere to a plan of correction approved by the
department. The department may impose a plan of correction in
lieu of fines.
(b) Compliance.--The department shall monitor compliance
with the plan of correction under this section.
(c) Availability.--The plan of correction shall, upon
request, be made available to patients of the facility.
§ 3512. Administrative procedures.
(a) Applicable procedures.--This chapter shall be subject to
2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
Commonwealth agencies).
(b) Appeal.--A party against whom penalties are assessed in
an administrative action may appeal to Commonwealth Court as
provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
review of Commonwealth agency action).
§ 3513. Regulations and guidance.
The department shall promulgate regulations or guidance
necessary to implement, administer and enforce this chapter. The
department shall review regulations or guidance every three
years to ensure compliance with Federal law or Federal agency
guidance.
Section 2. Title 40 is amended by adding chapters to read:
CHAPTER 52
ARTIFICIAL INTELLIGENCE USE BY INSURERS
Sec.
5201. Definitions.
5202. Disclosure.
20260SB1113PN1376 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
5203. Responsible use.
5204. Artificial intelligence compliance statements.
5205. Health care provider requirements.
5206. Reports.
5207. Retention of records.
5208. Oversight.
5209. Third-party vendor.
5210. Exemption.
5211. Enforcement and penalties.
5212. Plan of correction.
5213. Administrative procedures.
5214. Regulations and guidance.
§ 5201. Definitions.
The following words and phrases when used in this chapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Artificial intelligence" or "AI." A machine-based system
that can, for a given set of human-defined objectives, make
predictions, recommendations or decisions influencing real or
virtual environments that use machine-based and human-based
inputs to perceive real and virtual environments, abstract the
perceptions into models through analysis in an automated manner
and use model inference to formulate options for information or
action. The term includes generative artificial intelligence
which is the class of models that emulate the structure and
characteristics of input data in order to generate derived
synthetic content which includes information such as images,
videos, audio clips and text that has been significantly
modified or generated by algorithms, including by artificial
intelligence.
20260SB1113PN1376 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
"Artificial-intelligence-based algorithms." The programming
and data sets that inform an artificial intelligence system.
"Covered person." A policyholder, subscriber or other
individual who is entitled to receive health care services under
a health insurance policy.
"Department." The Insurance Department of the Commonwealth.
"Health care provider." As follows:
(1) A facility or individual who is licensed, certified
or otherwise regulated to provide health care services under
the laws of this Commonwealth.
(2) The term does not include an individual providing
emergency services under a licensed emergency medical
services agency as defined in 35 Pa.C.S. § 8103 (relating to
definitions).
"Health care service." Any covered treatment, admission,
procedure or other services, including behavioral health,
prescribed or otherwise provided or proposed to be provided by a
health care provider to a covered person for the diagnosis,
prevention, treatment, cure or relief of a health condition,
illness, injury or disease under the terms of a health insurance
policy.
"Health insurance policy." As follows:
(1) A policy, subscriber contract, certificate or plan
issued by an insurer that provides medical or health care
coverage.
(2) The term does not include:
(i) An accident only policy.
(ii) A credit only policy.
(iii) A long-term care or disability income policy.
(iv) A specified disease policy.
20260SB1113PN1376 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(v) A Medicare supplement policy.
(vi) A TRICARE policy, including a Civilian Health
and Medical Program of the Uniformed Services (CHAMPUS)
supplement policy.
(vii) A fixed indemnity policy.
(viii) A hospital indemnity policy.
(ix) A workers' compensation policy.
(x) An automobile medical payment policy under 75
Pa.C.S. (relating to vehicles).
(xi) A homeowner's insurance policy.
"Insurer." As follows:
(1) An entity licensed by the department that offers,
issues or renews an individual or group health insurance
policy that is offered or governed under any of the
following:
(i) Chapter 61 (relating to hospital plan
corporations) or 63 (relating to professional health
services plan corporations).
(ii) The act of May 17, 1921 (P.L.682, No.284),
known as The Insurance Company Law of 1921, including
section 630 and Article XXIV thereof.
(iii) The act of December 29, 1972 (P.L.1701,
No.364), known as the Health Maintenance Organization
Act.
(2) The term does not include an entity operating as an
MA or CHIP managed care plan.
"Participating network provider." A health care provider
that has entered into a contractual or operating relationship
with an insurer to participate in one or more designated
networks of the insurer and to provide health care services to
20260SB1113PN1376 - 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
covered persons under the terms of the insurer's administrative
policy.
"Prior authorization request." As defined under section 2102
of The Insurance Company Law of 1921.
"Utilization review." As defined under section 2102 of The
Insurance Company Law of 1921.
§ 5202. Disclosure.
(a) Artificial-intelligence-based algorithms.--An insurer
shall disclose to a participating network provider and all
covered persons if artificial-intelligence-based algorithms are
or will be used in the utilization review process of the
insurer.
(b) Posting.--An insurer shall post the information about
the use of artificial-intelligence-based algorithms in the
utilization review process of the insurer on the publicly
accessible Internet website of the insurer.
(c) Nature and frequency.--The department shall determine
the nature and frequency of disclosure requirements to covered
persons. The department may request input from insurers or their
representatives in making this determination.
§ 5203. Responsible use.
(a) Compliance generally.--The criteria for the artificial-
intelligence-based algorithms must comply with this chapter and
applicable Federal and State law.
(b) Requirements for artificial-intelligence-based
algorithms.--For each instance in which an insurer uses
artificial-intelligence-based algorithms in the utilization
review process regarding a covered person, the insurer shall
comply with the following:
(1) The artificial-intelligence-based algorithms must
20260SB1113PN1376 - 13 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
base a determination on all of the following:
(i) The medical or other clinical history of the
covered person.
(ii) Individual clinical or nonclinical
circumstances as presented by the requesting health care
provider.
(iii) Other relevant clinical or nonclinical
information contained in the medical or other clinical
record of the covered person.
(2) The artificial-intelligence-based algorithms must
not base a determination solely on a group data set.
(3) The artificial-intelligence-based algorithms must
not supersede decision making of the health care provider
conducting the utilization review.
(4) The artificial-intelligence-based algorithms and
training data sets must not directly or indirectly
discriminate against covered persons in violation of Federal
or State law.
(5) The artificial-intelligence-based algorithms must be
fairly and equitably applied, including in accordance with
any applicable regulations or guidance issued by the United
States Department of Health and Human Services.
(6) The use of the artificial-intelligence-based
algorithms must be disclosed in accordance with section 5202
(relating to disclosure).
(7) The performance, use and outcomes of the artificial-
intelligence-based algorithms must be periodically reviewed
and revised to maximize accuracy and reliability.
(8) The data of the covered person must not be used
beyond the intended and stated purpose of the artificial-
20260SB1113PN1376 - 14 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
intelligence-based algorithms, consistent with Commonwealth
law and 42 U.S.C. Ch. 7, Subch. XI Part C (relating to
administrative simplification), as applicable.
(9) The artificial-intelligence-based algorithms must
not create foreseeable, material risks of harm to the covered
person.
§ 5204. Artificial intelligence compliance statements.
(a) Compliance statement required.--An insurer using
artificial-intelligence-based algorithms in the utilization
review process shall annually file with the department in the
form and manner prescribed by the department an artificial
intelligence compliance statement.
(b) Contents.--A compliance statement must:
(1) Summarize the function and scope of the artificial-
intelligence-based algorithms used for utilization review.
(2) Provide a logic or decision tree of artificial-
intelligence-based algorithms used for utilization review.
(3) Provide a description of each training data set used
by artificial-intelligence-based algorithms for utilization
review, including the source of the data.
(4) Attest that the artificial-intelligence-based
algorithms and the training data sets comply with section
5203 (relating to responsible use) and provide evidence of
the compliance.
(5) Describe the process of the insurer for overseeing
and validating the performance and compliance of the
artificial-intelligence-based algorithms in accordance with
section 5203.
§ 5205. Health care provider requirements.
Prior to issuing or upholding a decision to deny, reduce or
20260SB1113PN1376 - 15 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
terminate benefits for a health care service, including a
decision to deny a prior authorization request, a health care
provider who participates in utilization review on behalf of an
insurer shall:
(1) Review individual clinical records and other
relevant information.
(2) Document the review under paragraph (1).
(3) Based on the review under paragraph (1), exercise
judgment independent of any recommendations by the
artificial-intelligence-based algorithms.
§ 5206. Reports.
(a) Annual report required.--No later than one year after
the effective date of this subsection, and annually thereafter,
the department shall compile the information from the most
recent annual compliance statements under section 5204 (relating
to artificial intelligence compliance statements) and issue a
report to the General Assembly containing the compiled
information, along with any other applicable findings and
recommendations. The information in the report shall be
aggregated and deidentified.
(b) Posting.--The department shall post each report under
this section on the publicly accessible Internet website of the
department.
§ 5207. Retention of records.
The department shall establish a record retention policy and
determine the amount of time an insurer shall retain records.
The department may request input from insurers or their
representatives in making this determination.
§ 5208. Oversight.
The department may request additional information and
20260SB1113PN1376 - 16 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
evidence from an insurer regarding the items provided under
sections 5202 (relating to disclosure), 5203 (relating to
responsible use) and 5204 (relating to artificial intelligence
compliance statements) that are necessary to ensure compliance
with this chapter.
§ 5209. Third-party vendor.
A contractor, subcontractor or other third-party vendor that
sells, leases, subscribes or otherwise supplies artificial-
intelligence-based algorithms or services based on artificial-
intelligence-based algorithms to the insurer services shall be
subject to this chapter. The department shall develop
regulations or guidelines regarding the responsibility of a
contractor, subcontractor or other third-party vendor that
sells, leases, subscribes or otherwise supplies artificial-
intelligence-based algorithms or services based on artificial-
intelligence-based algorithms to the insurer. The department may
request input from insurers, third-party vendors and health care
providers or their representatives in making this determination.
§ 5210. Exemption.
This chapter shall not apply to artificial-intelligence-based
algorithms used for administrative, scheduling or other purposes
not pertaining to the insurer's decision to deny, reduce or
terminate benefits.
§ 5211. Enforcement and penalties.
(a) Civil penalties.--
(1) Subject to paragraph (2), the department may impose
a civil penalty not exceeding $5,000 for a violation of this
chapter. For purposes of this paragraph, each instance of
nondisclosure shall constitute a separate violation of this
chapter.
20260SB1113PN1376 - 17 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(2) The following apply to limitations on civil
penalties under this subsection:
(i) A civil penalty imposed against an insurer may
not exceed $500,000 in the aggregate during a single
calendar year.
(ii) A civil penalty imposed against any other
person may not exceed $100,000 in the aggregate during a
single calendar year.
(b) Unfair Insurance Practices Act.--
(1) An insurer shall be subject to the act of July 22,
1974 (P.L.589, No.205), known as the Unfair Insurance
Practices Act.
(2) A violation of any provision of this chapter shall
be deemed to be a violation of the Unfair Insurance Practices
Act.
(c) Injunction.--The department may maintain an action in
the name of the Commonwealth for an injunction to prohibit any
activity that violates the provisions of this chapter.
(d) Effect on enrollment.--The department may issue an order
temporarily prohibiting an insurer that violates this chapter
from enrolling new covered persons.
(e) Nonexclusive remedies.--The enforcement remedies and
penalties imposed under this chapter are in addition to any
other remedies or penalties that may be imposed under any other
applicable law of this Commonwealth, including:
(1) The Unfair Insurance Practices Act.
(2) The act of December 18, 1996 (P.L.1066, No.159),
known as the Accident and Health Filing Reform Act.
(3) The act of June 25, 1997 (P.L.295, No.29), known as
the Pennsylvania Health Care Insurance Portability Act.
20260SB1113PN1376 - 18 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
§ 5212. Plan of correction.
(a) Authorization.--The department may require an insurer to
develop and adhere to a plan of correction approved by the
department. The department may impose a plan of correction in
lieu of fines.
(b) Compliance.--The department shall monitor compliance
with the plan of correction under this section.
(c) Availability.--The plan of correction shall, upon
request, be made available to covered persons of the insurer.
§ 5213. Administrative procedures.
(a) Applicable procedures.--This chapter shall be subject to
2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
Commonwealth agencies).
(b) Appeal.--A party against whom penalties are assessed in
an administrative action may appeal to Commonwealth Court as
provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
review of Commonwealth agency action).
§ 5214. Regulations and guidance.
The department shall promulgate regulations or guidance
necessary to implement, administer and enforce this chapter. The
department shall review regulations or guidance every three
years to ensure compliance with Federal law or Federal agency
guidance.
CHAPTER 53
ARTIFICIAL INTELLIGENCE USE BY MA OR CHIP
MANAGED CARE PLANS
Sec.
5301. Definitions.
5302. Disclosure.
5303. Responsible use.
20260SB1113PN1376 - 19 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
5304. Artificial intelligence compliance statements.
5305. Health care provider requirements.
5306. Reports.
5307. Retention of records.
5308. Oversight.
5309. Third-party vendor.
5310. Exemption.
5311. Enforcement and penalties.
5312. Plan of correction.
5313. Administrative procedures.
5314. Regulations and guidance.
§ 5301. Definitions.
The following words and phrases when used in this chapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Agreement with the department." As follows:
(1) An agreement between an MA or CHIP managed care plan
and the department to manage the purchase and provision of
services.
(2) The term includes a county or multicounty agreement
with the department for behavioral health services.
"Artificial intelligence" or "AI." A machine-based system
that can, for a given set of human-defined objectives, make
predictions, recommendations or decisions influencing real or
virtual environments that use machine-based and human-based
inputs to perceive real and virtual environments, abstract the
perceptions into models through analysis in an automated manner
and use model inference to formulate options for information or
action. The term includes generative artificial intelligence
which is the class of models that emulate the structure and
20260SB1113PN1376 - 20 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
characteristics of input data in order to generate derived
synthetic content which includes information such as images,
videos, audio clips and text that has been significantly
modified or generated by algorithms, including by artificial
intelligence.
"Artificial-intelligence-based algorithms." The programming
and data sets that inform an artificial intelligence system.
"Department." The Department of Human Services of the
Commonwealth.
"Enrollee." An individual who is entitled to receive health
care services under an agreement with the department.
"Facility." A health care setting or institution providing
health care services, including:
(1) A general, special, psychiatric or rehabilitation
hospital.
(2) An ambulatory surgical facility.
(3) A cancer treatment center.
(4) A birth center.
(5) An inpatient, outpatient or residential drug and
alcohol treatment facility.
(6) A facility licensed by the department's Office of
Mental Health and Substance Abuse Services.
(7) A laboratory, imaging, diagnostic or other
outpatient medical service or testing facility.
(8) A health care provider office or clinic that is
owned by or employs a Commonwealth-licensed physician,
physician assistant or nurse practitioner.
"Health care provider." As follows:
(1) A facility or individual who is licensed, certified
or otherwise regulated to provide health care services under
20260SB1113PN1376 - 21 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
the laws of this Commonwealth.
(2) The term does not include an individual providing
emergency services under a licensed emergency medical
services agency as defined in 35 Pa.C.S. § 8103 (relating to
definitions).
"Health care service." Any covered treatment, admission,
procedure or other services, including behavioral health,
prescribed or otherwise provided or proposed to be provided by a
health care provider to a covered person for the diagnosis,
prevention, treatment, cure or relief of a health condition,
illness, injury or disease under the terms of a health insurance
policy or agreement with the department.
"Medical Assistance or Children's Health Insurance Program
managed care plan" or "MA or CHIP managed care plan." As
defined under section 2102 of the act of May 17, 1921 (P.L.682,
No.284), known as The Insurance Company Law of 1921.
"Participating network provider." A health care provider
that has entered into a contractual or operating relationship
with an MA or CHIP managed care plan to participate in one or
more designated networks of the MA or CHIP managed care plan and
to provide health care services to enrollees under the terms of
the or an agreement with the department.
"Prior authorization request." As defined under section 2102
of The Insurance Company Law of 1921.
"Utilization review." As defined under section 2102 of The
Insurance Company Law of 1921.
§ 5302. Disclosure.
(a) Artificial-intelligence-based algorithms.--An MA or CHIP
managed care plan shall disclose to a participating network
provider and all enrollees if artificial-intelligence-based
20260SB1113PN1376 - 22 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
algorithms are or will be used in the utilization review process
of the MA or CHIP managed care plan.
(b) Posting.--An MA or CHIP managed care plan shall post the
information about the use of artificial-intelligence-based
algorithms in the utilization review process of the MA or CHIP
managed care plan on the publicly accessible Internet website of
the MA or CHIP managed care plan.
(c) Nature and frequency.--The department shall determine
the nature and frequency of disclosure requirements to
enrollees. The department may request input from MA or CHIP
managed care plans or their representatives in making this
determination.
§ 5303. Responsible use.
(a) Compliance generally.--The criteria for the artificial-
intelligence-based algorithms must comply with this chapter and
applicable Federal and State law.
(b) Requirements for artificial-intelligence-based
algorithms.--For each instance in which a MA or CHIP managed
care plan uses artificial-intelligence-based algorithms in the
utilization review process regarding an enrollee, the MA or CHIP
managed care plan shall comply with the following:
(1) The artificial-intelligence-based algorithms must
base a determination on all of the following:
(i) The medical or other clinical history of the
enrollee.
(ii) Individual clinical or nonclinical
circumstances as presented by the requesting health care
provider.
(iii) Other relevant clinical or nonclinical
information contained in the medical or other clinical
20260SB1113PN1376 - 23 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
record of the enrollee.
(2) The artificial-intelligence-based algorithms must
not base a determination solely on a group data set.
(3) The artificial-intelligence-based algorithms must
not supersede decision making of the health care provider
conducting the utilization review.
(4) The artificial-intelligence-based algorithms and
training data sets must not directly or indirectly
discriminate against the enrollees in violation of Federal or
State law.
(5) The artificial-intelligence-based algorithms must be
fairly and equitably applied, including in accordance with
any applicable regulations and guidance issued by the United
States Department of Health and Human Services.
(6) The use of the artificial-intelligence-based
algorithms must be disclosed in accordance with section 5302
(relating to disclosure).
(7) The performance, use and outcomes of the artificial-
intelligence-based algorithms must be periodically reviewed
and revised to maximize accuracy and reliability.
(8) The data of the covered person or enrollees must not
be used beyond the intended and stated purpose of the
artificial-intelligence-based algorithms, consistent with the
laws of this Commonwealth and the Health Insurance
Portability and Accountability Act of 1996 (Public Law 104-
191, 110 Stat. 1936), as applicable.
(9) The artificial-intelligence-based algorithms must
not create foreseeable, material risks of harm to the
enrollee.
§ 5304. Artificial intelligence compliance statements.
20260SB1113PN1376 - 24 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(a) Compliance statement required.--An MA or CHIP managed
care plan using artificial-intelligence-based algorithms in the
utilization review process shall annually file with the
department, in the form and manner prescribed by the department,
an artificial intelligence compliance statement.
(b) Contents.--A compliance statement must:
(1) Summarize the function and scope of the artificial-
intelligence-based algorithms used for utilization review.
(2) Provide a logic or decision tree of artificial-
intelligence-based algorithms used for utilization review.
(3) Provide a description of each training data set used
by artificial-intelligence-based algorithms for utilization
review, including the source of the data.
(4) Attest that the artificial-intelligence-based
algorithms and the training data sets comply with section
5303 (relating to responsible use) and provide evidence of
the compliance.
(5) Describe the process of the MA or CHIP managed care
plan for overseeing and validating the performance and
compliance of the artificial-intelligence-based algorithms in
accordance with section 5303.
§ 5305. Health care provider requirements.
Prior to issuing or upholding a decision to deny, reduce or
terminate benefits for a health care service, including a
decision to deny a prior authorization request, a health care
provider who participates in utilization review on behalf of an
MA or CHIP managed care plan shall:
(1) Review individual clinical records and other
relevant information.
(2) Document the review under paragraph (1).
20260SB1113PN1376 - 25 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(3) Based on the review under paragraph (1), exercise
judgment independent of any recommendations by the
artificial-intelligence-based algorithms.
§ 5306. Reports.
(a) Annual report required.--No later than one year after
the effective date of this subsection, and annually thereafter,
the department shall compile the information from the most
recent annual compliance statements under section 5304 (relating
to artificial intelligence compliance statements) and issue a
report to the General Assembly containing the compiled
information, along with any other applicable findings and
recommendations. The information in the report shall be
aggregated and deidentified.
(b) Posting.--The department shall post each report under
this section on the publicly accessible Internet website of the
department.
§ 5307. Retention of records.
The department shall establish a record retention policy and
determine the amount of time an MA or CHIP managed care plan
shall retain records. The department may request input from an
MA or CHIP managed care plan or their representative to make
this determination.
§ 5308. Oversight.
The department may request additional information and
evidence from an MA or CHIP managed care plan regarding the
items provided under section 5302 (relating to disclosure), 5303
(relating to responsible use) and 5304 (relating to artificial
intelligence compliance statements) that are necessary to ensure
compliance with this chapter.
§ 5309. Third-party vendor.
20260SB1113PN1376 - 26 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
A contractor, subcontractor or other third-party vendor that
sells, leases, subscribes or otherwise supplies artificial-
intelligence-based algorithms or services based on artificial-
intelligence-based algorithms to the MA or CHIP managed care
plan shall be subject to this chapter. The department shall
develop regulations or guidelines regarding the responsibility
of a contractor, subcontractor or other third-party vendor that
sells, leases, subscribes or otherwise supplies artificial-
intelligence-based algorithms or services based on artificial-
intelligence-based algorithms to the insurer or MA or CHIP
managed care plan. The department may request input from
insurers, third-party vendors and health care providers or their
representatives in making this determination.
§ 5310. Exemption.
This chapter shall not apply to artificial-intelligence-based
algorithms used for administrative, scheduling or other purposes
not pertaining to the decision to deny, reduce or terminate
benefits.
§ 5311. Enforcement and penalties.
(a) Civil penalties.--
(1) Subject to paragraph (2), the department may impose
a civil penalty not exceeding $5,000 for a violation of this
chapter. For purposes of this paragraph, each instance of
nondisclosure shall constitute a separate violation of this
chapter.
(2) The following apply to limitations on civil
penalties under this subsection:
(i) A civil penalty imposed against an insurer may
not exceed $500,000 in the aggregate during a single
calendar year.
20260SB1113PN1376 - 27 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(ii) A civil penalty imposed against any other
person may not exceed $100,000 in the aggregate during a
single calendar year.
(b) Unfair Insurance Practices Act.--
(1) An MA or CHIP managed care plan shall be subject to
the act of July 22, 1974 (P.L.589, No.205), known as the
Unfair Insurance Practices Act.
(2) A violation of any provision of this chapter shall
be deemed to be a violation of the Unfair Insurance Practices
Act.
(c) Injunction.--The department may maintain an action in
the name of the Commonwealth for an injunction to prohibit any
activity that violates the provisions of this chapter.
(d) Effect on enrollment.--The department may issue an order
temporarily prohibiting an MA or CHIP managed care plan that
violates this chapter from enrolling new enrollees.
§ 5312. Plan of correction.
(a) Authorization.--The department may require an MA or CHIP
managed care plan to develop and adhere to a plan of correction
approved by the department. The department may impose a plan of
correction in lieu of fines.
(b) Compliance.--The department shall monitor compliance
with the plan of correction under this section.
(c) Availability.--The plan of correction shall, upon
request, be made available to enrollees of the insurer or MA or
CHIP managed care plan.
§ 5313. Administrative procedures.
(a) Applicable procedures.--This chapter shall be subject to
2 Pa.C.S. Ch. 5 Subch. A (relating to practice and procedure of
Commonwealth agencies).
20260SB1113PN1376 - 28 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(b) Appeal.--A party against whom penalties are assessed in
an administrative action may appeal to Commonwealth Court as
provided in 2 Pa.C.S. Ch. 7 Subch. A (relating to judicial
review of Commonwealth agency action).
§ 5314. Regulations and guidance.
The department shall promulgate regulations or guidance
necessary to implement, administer and enforce this chapter. The
department shall review regulations or guidance every three
years to ensure compliance with Federal law or Federal agency
guidance.
Section 3. This act shall take effect in one year.
20260SB1113PN1376 - 29 -
1
2
3
4
5
6
7
8
9
10
11