HB 2537: Patients' Bill of Rights and Responsibilities; Prior Authorization; Artificial Intelligence; Automated Decision Support Tools; Utilization Review; Protected Health Information; Data Protection; Offshoring; Reporting Requirements; Insurance Commissioner

HOUSE OF REPRESENTATIVES	H.B. NO.	2537
THIRTY-THIRD LEGISLATURE, 2026
STATE OF HAWAII

A BILL FOR AN ACT

 

 

relating to the patients' bill of rights.

 

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 

     SECTION 1.  The legislature finds that there is a growing need to ensure Hawaii's residents receive appropriate and timely health care.  The legislature further finds that the existing law protecting patient's rights does not address new and emerging technologies, like the use of artificial intelligence in health care decision making, or a patient's rights in cases where their protected health information has been accessed when a health insurer is the victim of a data breach.

     Accordingly, the purpose of this Act is to update and modernize the State's patients' bill of rights and responsibilities act to increase access to care, reduce administrative burdens, and address emerging technologies.

     SECTION 2.  This Act shall be known and may be cited as the "Hawaii Patients' Bill of Rights of 2025"

     SECTION 3.  Chapter 432E, Hawaii Revised Statutes, is amended by adding six new sections to be appropriately designated and to read as follows:

     "§432E-     Access to timely services.  (a)  An enrollee shall have the right to timely access and referrals to specialist care.

     (b)  A managed care plan shall cover telehealth services for covered benefits at a rate equal to that of an in-person consultation between the patient and a health care provider.

     §432E-     Prior authorization; decision-making; access; reporting.  (a)  A health carrier or its designated utilization review organization shall make a determination on a prior authorization request for an urgent health care service no later than one business day after the request is submitted.

     (b)  A health carrier or its designated utilization review organization shall make a determination on a prior authorization request for a non-urgent health care service no later than three business days after the request is submitted.

     (c)  If a health carrier or its designated utilization review organization makes an adverse determination on a prior authorization request, the health carrier shall furnish the enrollee and the enrollee's provider with the following in writing:

     (1)  A clear rational for the adverse determination, provided in plain language;

     (2)  A timeline for the enrollee or the enrollee's representative to appeal the adverse determination;

     (3)  A form and explanation of the health carrier's complaints and internal appeals procedures and how the enrollee or the enrollee's representative may file an appeal of the adverse determination pursuant to section 432E-5; and

     (4)  A form and explanation of how the enrollee or the enrollee's representative may request an external review of the adverse determination pursuant to section 432E-33.

     (d)  The health carrier shall maintain a webpage and toll-free telephone number to provide enrollees or their representatives with assistance and information on the health carrier's internal appeals process and the external review process.

     (e)  A health carrier shall not establish requirements for prior authorization that unduly burden or impede providers providing health care services in rural or medically underserved areas of the State.

     (f)  Each health carrier shall submit a monthly report to the insurance commissioner that contains the following aggregated and de-identified information:

     (1)  The number of prior authorization requests received by the health carrier or its designated utilization review organization;

     (2)  The rate of approval and denial of prior authorization requests;

     (3)  The median processing time for a prior authorization request;

     (4)  The number of appeals of an adverse determination of a prior authorization request and the rate at which the adverse determination was overturned; and

     (5)  The number of prior authorization determinations that were made using an automated decision support tool.

     (g)  No later than twenty days prior to the regular session of 2028, and each regular session thereafter, the insurance commissioner shall submit a report to the legislature on:

     (1)  The number of prior authorization requests and the median processing time for a prior authorization request, broken down by health carrier;

     (2)  The number of prior authorization denials made in the preceding calendar year, broken down by health carrier;

     (3)  The number of appeals of a prior authorization determination and their outcomes, broken down by health carrier; and

     (4)  The number of prior authorization determinations that were made using an automated decision support tool, broken down by health carrier.

     §432E-     Automated decision support tool; oversight; review; notice.  (a)  A health carrier or utilization review organization that uses an automated decision support tool for the purpose of utilization review shall provide a written disclosure on how the automated decision support tool is used in the utilization review process in each policy, plan, contract, or agreement issued by a health carrier in the State.

     (b)  A health carrier shall notify an enrollee and the enrollee's provider in writing if the use of an automated decision support tool materially contributed to an adverse action, including a denial of a request for prior authorization.

     (c)  If an automated decision support tool materially contributed to an adverse action, the health carrier shall not issue the adverse action until the claim is independently reviewed and approved by a board-certified clinician.  When conducting the independent review of the adverse action, the board-certified clinician shall exercise independent medical judgment and shall not rely solely on recommendations from any other sources, including an automated decision support tool.

     (d)  No later than June 30, 2027, a health carrier shall develop and make available for annual review by the insurance commissioner the following information:

     (1)  The health carrier's governance polices for the use of automated decision support tools;

     (2)  The health carrier or its designated utilization review organization's process for validation and bias testing of the automated decision support tool; and

     (3)  The health carrier's monitoring records of the automated decision support tool.

     (e)  For the purposes of this section, an automated decision support tool shall be deemed to have materially contributed to an adverse action if the health carrier or its designated utilization review organization relied primarily on the automated decision support tool in its utilization review.

     §432E-     Data protection and handling; offshoring; security breaches; notice.  (a)  No later than June 30, 2027, a health carrier shall develop and implement safeguards for protected health information that meet or exceed the privacy requirements under the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and its related regulations under title 45 Code of Federal Regulations parts 160 and 164.

     (b)  No later than June 30, 2027, each health carrier shall, in a form and manner as prescribed the insurance commissioner, submit an attestation for each offshoring contract for services related to protected health information to the insurance commissioner that:

     (1)  The protected health information shall not be shared with any person, entity, or organization other than the one with whom the health carrier enters into a contract; and

     (2)  The offshoring contract contains measures for the handling of protected health information that fully complies with the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and all other applicable federal and state privacy laws, rules, and regulations.

     (c)  If a health carrier or its designated utilization review organization knows or suspects that it is the victim of a data breach, the health carrier shall notify the insurance commissioner and all enrollees in the health carrier's managed care plans of the suspected or known data breach and provide a copy of the health carrier's corrective action plans within seventy-two hours of the time the health carrier or its designated utilization review organization is made aware of the known or suspected data breach.

     §432E-     Network adequacy; reports.  A health carrier shall submit reports on a quarterly basis to the insurance commissioner on the health carrier's network adequacy.  Each quarterly report shall include:

     (1)  Provider ratios broken down by island or region;

     (2)  Wait times;

     (3)  Telehealth utilization; and

     (4)  Referral outcomes.

     §432E-     Provider protections; provider assistance.  (a)  No health carrier shall retaliate against a health care provider who files a complaint against the health carrier with the insurance commissioner, assists an enrollee with filing a complaint with the health carrier pursuant to section 432E-5, or requests an external review of a health carrier's adverse action pursuant to section 432E-33.

     (b)  The insurance commissioner and the department of commerce and consumer affairs shall provide guidance and technical assistance to small and rural practices on navigating health carrier administrative requirements, the appeals and complaints process under section 432E-5, the external review process under section 432E-33, and compliance with this chapter."

     SECTION 4.  Section 432E-1, Hawaii Revised Statutes, is amended by adding five new definitions to be appropriately inserted and to read as follows:

     ""Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from inputs how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments.

     "Automated decision support tool" means any artificial intelligence, algorithmic, software-based, statistical, or data-driven tool, model, or process that autonomously or semi-autonomously generates, recommends, or adjudicates coverage determinations or prior authorization decisions without contemporaneous decision-making by a physician licensed under chapter 453 or advanced practice registered nurse licensed under chapter 457.

     "Offshoring contract" means the contracting of services by a health carrier for claims processing, call center staffing, technical support, or other administrative services to be rendered, in whole or in part, by another party located outside of the United States or its territories.

     "Prior authorization" has the same meaning as defined in section 323D-2.

     "Urgent health care service" means a health care service which, without an expedited prior authorization, could, in the opinion of a physician with knowledge of the enrollee's medical condition:

     (1)  Seriously jeopardize the life or health of the enrollee or the ability of the enrollee to regain maximum function; or

     (2)  Subject the enrollee to severe pain that cannot be adequately managed without the care or treatment that is the subject of the utilization review.

"Urgent health care service" includes mental and behavioral health care services."

     SECTION 5.  Section 432E-1.4, Hawaii Revised Statutes, is amended to read as follows:

     "§432E-1.4  Medical necessity.  (a)  For contractual purposes, a health intervention shall be covered if it is an otherwise covered category of service, not specifically excluded, recommended by the treating licensed health care provider, and determined by the health plan's medical director to be medically necessary as defined in subsection (b).  A health intervention may be medically indicated and not qualify as a covered benefit or meet the definition of medical necessity.  A managed care plan may choose to cover health interventions that do not meet the definition of medical necessity.

     (b)  A health intervention is medically necessary if it is recommended by the treating physician or treating licensed health care provider, is approved by the health plan's medical director or physician designee, and is:

     (1)  For the purpose of treating a medical condition;

     (2)  The most appropriate delivery or level of service, considering potential benefits and harms to the patient;

     (3)  Known to be effective in improving health outcomes; provided that:

          (A)  Effectiveness is determined first by scientific evidence;

          (B)  If no scientific evidence exists, then by professional standards of care; and

          (C)  If no professional standards of care exist or if they exist but are outdated or contradictory, then by expert opinion; and

     (4)  Cost-effective for the medical condition being treated compared to alternative health interventions, including no intervention.  For purposes of this paragraph, cost-effective shall not necessarily mean the lowest price.

     (c)  When the treating licensed health care provider and the health plan's medical director or physician designee do not agree on whether a health intervention is medically necessary, a reviewing body, whether internal to the plan or external, shall give consideration to, but shall not be bound by, the recommendations of the treating licensed health care provider and the health plan's medical director or physician designee.

     (d)  A managed care plan shall not retroactively deny any medically necessary health intervention provided to an enrollee during emergency services.

     [(d)] (e)  For the purposes of this section:

     "Cost-effective" means a health intervention where the benefits and harms relative to the costs represent an economically efficient use of resources for patients with the medical condition being treated through the health intervention; provided that the characteristics of the individual patient shall be determinative when applying this criterion to an individual case.

     "Effective" means a health intervention that may reasonably be expected to produce the intended results and to have expected benefits that outweigh potential harmful effects.

     "Health intervention" means an item or service delivered or undertaken primarily to treat a medical condition or to maintain or restore functional ability.  A health intervention is defined not only by the intervention itself, but also by the medical condition and patient indications for which it is being applied.  New interventions for which clinical trials have not been conducted and effectiveness has not been scientifically established shall be evaluated on the basis of professional standards of care or expert opinion.  For existing interventions, scientific evidence shall be considered first and, to the greatest extent possible, shall be the basis for determinations of medical necessity.  If no scientific evidence is available, professional standards of care shall be considered.  If professional standards of care do not exist or are outdated or contradictory, decisions about existing interventions shall be based on expert opinion.  Giving priority to scientific evidence shall not mean that coverage of existing interventions shall be denied in the absence of conclusive scientific evidence.  Existing interventions may meet the definition of medical necessity in the absence of scientific evidence if there is a strong conviction of effectiveness and benefit expressed through up-to-date and consistent professional standards of care, or in the absence of such standards, convincing expert opinion.

     "Health outcomes" mean outcomes that affect health status as measured by the length or quality of a patient's life, primarily as perceived by the patient.

     "Medical condition" means a disease, illness, injury, genetic or congenital defect, pregnancy, or a biological or psychological condition that lies outside the range of normal, age-appropriate human variation.

     "Physician designee" means a physician or other health care practitioner designated to assist in the decision-making process who has training and credentials at least equal to the treating licensed health care provider.

     "Scientific evidence" means controlled clinical trials that either directly or indirectly demonstrate the effect of the intervention on health outcomes.  If controlled clinical trials are not available, observational studies that demonstrate a causal relationship between the intervention and the health outcomes may be used.  Partially controlled observational studies and uncontrolled clinical series may be suggestive, but do not by themselves demonstrate a causal relationship unless the magnitude of the effect observed exceeds anything that could be explained either by the natural history of the medical condition or potential experimental biases.  Scientific evidence may be found in the following and similar sources:

     (1)  Peer-reviewed scientific studies published in or accepted for publication by medical journals that meet nationally recognized requirements for scientific manuscripts and that submit most of their published articles for review by experts who are not part of the editorial staff;

     (2)  Peer-reviewed literature, biomedical compendia, and other medical literature that meet the criteria of the National Institutes of Health's National Library of Medicine for indexing in Index Medicus, Excerpta Medicus (EMBASE), Medline, and MEDLARS database Health Services Technology Assessment Research (HSTAR);

     (3)  Medical journals recognized by the Secretary of Health and Human Services under section 1861(t)(2) of the Social Security Act, as amended;

     (4)  Standard reference compendia including the American Hospital Formulary Service-Drug Information, American Medical Association Drug Evaluation, American Dental Association Accepted Dental Therapeutics, and United States Pharmacopoeia-Drug Information;

     (5)  Findings, studies, or research conducted by or under the auspices of federal agencies and nationally recognized federal research institutes including but not limited to the Federal Agency for Health Care Policy and Research, National Institutes of Health, National Cancer Institute, National Academy of Sciences, Centers for Medicare and Medicaid Services, Congressional Office of Technology Assessment, and any national board recognized by the National Institutes of Health for the purpose of evaluating the medical value of health services; and

     (6)  Peer-reviewed abstracts accepted for presentation at major medical association meetings.

     "Treat" means to prevent, diagnose, detect, provide medical care, or palliate.

     "Treating licensed health care provider" means a licensed health care provider who has personally evaluated the patient."

     SECTION 6.  Section 432E-7, Hawaii Revised Statutes, is amended to read as follows:

     "§432E-7  Information to enrollees.  (a)  The managed care plan shall provide in plain language to its enrollees upon enrollment and thereafter upon request the following information:

     (1)  A list of participating providers which shall be updated on a [regular] quarterly basis indicating, at a minimum, their specialty and whether the provider is accepting new patients;

     (2)  A complete description of benefits, exclusions, services, and copayments;

     (3)  A statement on enrollee's rights, responsibilities, and obligations;

     (4)  An explanation of the referral process, if any;

     (5)  Where services or benefits may be obtained;

     (6)  Information on complaints and appeals procedures[; and], including a step-by-step explanation of the appeal and external review process; and

     (7)  The telephone number of the insurance division.

This information shall be provided to prospective enrollees upon request."

     SECTION 7.  Section 432E-8, Hawaii Revised Statutes, is amended to read as follows:

     "[[]§432E-8[]]  Enforcement.  (a)  All remedies, penalties, and proceedings in articles 2 and 13 of chapter 431 made applicable hereby to managed care plans shall be invoked and enforced solely and exclusively by the commissioner.

     (b)  In addition to any remedy, penalty, or proceeding invoked pursuant to subsection (a), the commissioner may:

     (1)  Audit, investigate, or impose penalties on a health carrier;

     (2)  Require a health carrier to provide restitution;

     (3)  Revoke a managed care plan's accreditation; or

     (4)  Pursue injunctive relief against a health carrier for a violation of this chapter.

     (c)  The commissioner shall prepare and make public an annual report of any enforcement actions taken against a health carrier or managed care plan pursuant to this section."

     SECTION 8.  If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

     SECTION 9.  Statutory material to be repealed is bracketed and stricken.  New statutory material is underscored.

     SECTION 10.  This Act shall take effect on July 1, 2026.

 

INTRODUCED BY:	_____________________________

 

 

Report Title:

Patients' Bill of Rights and Responsibilities; Prior Authorization; Artificial Intelligence; Automated Decision Support Tools; Utilization Review; Protected Health Information; Data Protection; Offshoring; Reporting Requirements; Insurance Commissioner

 

Description:

Establishes patient rights with respect to timely access to specialists and referrals and prior authorization determination timelines.  Establishes certain requirements for health carriers for prior authorization determinations.  Establishes certain requirements for the use of automated decision support tools for claims determinations and utilization review.  Requires health carriers to establish certain safeguards for protected health information.  Establishes certain reporting requirements for network adequacy.  Establishes certain provider protections.  Expands the Insurance Commissioner's enforcement authority.

 

 

 

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.