The Pennsylvania House has passed HB 1925, a bill that would regulate AI use by health facilities, insurers and Medicaid/CHIP managed care plans

Key takeaways

• HB 1925 is a bill. It passed the House 144-59 on 30 September 2026 and has not been reported out of the Senate committee.
• Facilities would have to disclose clinical AI use in plain language and label AI-generated personalized patient communications.
• AI would not be allowed to supersede a human provider's clinical decision, and providers could not be penalized solely for differing from AI output.
• Insurers and MA or CHIP managed care plans would face parallel duties for AI in utilization review, enforced by the Insurance Department and the Department of Human Services.

Is Pennsylvania HB 1925 law, and where does it stand?

No. The General Assembly page shows the bill introduced in the House and referred to the Communications and Technology Committee on 6 October 2025. It was reported as amended on 5 May 2026, amended on second consideration on 29 September 2026, and re-committed to Appropriations the same day. Appropriations re-reported it on 30 September 2026, and the House passed it on third consideration and final passage the same day, 144-59. The Senate referred it to the Institutional Sustainability and Innovation Committee on 14 October 2026, and the page lists committee report, third consideration and executive action in the Senate as milestones not yet reached.

Everything below describes the text as amended on 29 September 2026. The Senate could change it, so none of these duties apply to anyone today. For comparison, Pennsylvania has other AI measures in motion; our article on Pennsylvania HB 2006 covers a separate bill on companion chatbots.

What would HB 1925 require of hospitals and other facilities?

The Title 35 chapter would apply to a "facility", which the bill defines to include hospitals, ambulatory surgical facilities, cancer treatment centers, birth centers, skilled nursing homes, treatment facilities, testing facilities and provider offices or clinics owned by or employing a Commonwealth-licensed provider. Disclosure comes first. The bill says "A facility shall disclose to patients of the facility in plain language if artificial intelligence models or systems are or will be used for clinical decision making." The amended text has the facility post that information on its public website and inform patients in the general consent for treatment or another written form before or at the time of service. The disclosure need only be given once during an episode of care.

A facility that uses AI to generate personalized written or verbal communications about an individual patient's clinical information would have to include a clear and conspicuous plain-language disclaimer that AI generated it, plus instructions on how to reach a human provider or employee. The disclaimer would not apply to purely administrative communications or to communications that a human provider has individually read, reviewed and approved.

On clinical judgment, the bill says AI for clinical decision making "must not supersede clinical decision making made by a human health care provider." A facility could not penalize a provider solely for exercising independent judgment that differs from an AI recommendation or output. The same section lists requirements on discrimination, equitable application, performance review, patient-data use and foreseeable material risk of harm. A facility would also need written policies and procedures, a governance structure (a parent company's structure can satisfy this) and a process to validate and monitor its compliance, and would file an annual AI compliance statement with the Department of Health. The chapter would not apply to validated, static decision-support tools or tools used for administration, scheduling, scribe applications or clinical calculators.

What would it require of insurers and Medicaid or CHIP managed care plans?

The Title 40 chapter covers insurers, and the Title 67 chapter covers MA or CHIP managed care plans, in both cases for AI used in the utilization review process. Each would have to disclose that use in plain language to participating network providers and covered persons (enrollees, for plans) and post it on its website. Each would have to meet responsible-use requirements, including that the AI system evaluate the individual's clinical history and circumstances, not produce an output solely from a group data set, and not supersede the decision making of the health care provider conducting the review.

The bill adds a human step. Before a health care provider who participates in utilization review on behalf of the insurer or plan issues or upholds a decision to deny, reduce or terminate benefits for a health care service, including a prior authorization denial, that provider would have to review individual clinical records, document the review, and exercise judgment independent of any AI recommendation. An insurer or plan could not penalize such a provider solely for exercising independent judgment in refusing to issue or overturning a decision to deny, reduce or terminate benefits that was generated by artificial intelligence. The Title 40 and Title 67 chapters would not apply to AI models or systems used for administrative, scheduling or other purposes not pertaining to the decision to deny, reduce or terminate benefits. Insurers and plans would also file annual AI compliance statements and set up governance and vendor-review processes. The Title 40 chapter lets self-insured ERISA health plans opt in. Our Georgia SB 444 article and California SB 1120 article cover comparable approaches elsewhere.

How would HB 1925 be enforced, and when would it start?

Each chapter names a department: Health for facilities, the Insurance Department for insurers, and the Department of Human Services for MA or CHIP plans. The amended text would let the department impose civil penalties of not more than $10,000 per knowing or willful violation and $5,000 per negligent violation. A first-time negligent violation by an entity found to have made a good-faith effort to comply would carry up to $1,000 or, at the department's discretion, a plan of correction. Each instance of nondisclosure counts as a separate violation, and aggregate penalties on one entity in a calendar year are capped at $100,000 in the amended text.

A violation would also be treated as an unfair or deceptive act under the state consumer protection law, with the Attorney General holding exclusive authority to sue, and each department could seek an injunction. The Insurance Department and the Department of Human Services could temporarily bar a violating insurer or plan from enrolling new members. Penalties can be appealed to Commonwealth Court. Records would be kept for at least five years under a department policy. Section 4 says "This act shall take effect in one year", and the bill text does not itself state the date from which that year is counted.

What should facilities, payers and vendors do now?

Nothing is required yet. The steps below are optional groundwork, and the Senate may change the structure.

• List every AI tool that touches clinical decisions, patient messages or utilization review, including AI inside software already licensed.
• Mark which outputs a licensed clinician currently reviews before they reach a patient or drive a denial, and whether that review is documented.
• Check vendor contracts for who could be asked to support disclosure, records and compliance statements; the bill lets facilities and payers require vendors to comply by contract.
• Follow the Senate Institutional Sustainability and Innovation Committee page for amendments, since the text above is the 29 September 2026 version.

Which dates and penalty figures does the bill state?

The table lists the dates on the General Assembly page and the figures in the amended text of printer's number 3963. All of it concerns a bill that has not been enacted.

What we did not verify

What we opened: the General Assembly bill information page for HB 1925 and the full text of printer's number 3963 (HTML and PDF), on 2026-10-25. We read amendment markings in the PDF to separate inserted from deleted text.

What we did not open: the House fiscal note, the co-sponsorship memo, the earlier printer's numbers 2403 and 3349, the House Journal remarks, any Senate version, or any regulation of the three departments. We did not check how the bill interacts with federal law, HIPAA or existing Pennsylvania insurance statutes beyond what the bill itself cites. The HTML text page header displayed a different bill number from the bill body, so we relied on the bill body and the PDF.

What we refuse to claim: that HB 1925 will pass the Senate, that any duty applies now, the cost of compliance, or how any department would interpret the terms. The bill leaves several details, such as record retention periods, to department determinations.

Related briefings

• AI Regulation News hub
• North America AI regulation tracker
• Maryland HB 1563 on insurer AI adverse determination reporting
• Georgia SB 444 on AI and health insurance human review
• California SB 1120 on AI and utilization review
• Arizona HB 2175 on AI claim denials and medical director review