SB 2281: DOH; Health Care Providers; Artificial Intelligence; Patient Interaction; Consequential Decisions; Disclosure; Notice; Oversight; Performance Evaluations; Recordkeeping; Rules

A BILL FOR AN ACT

RELATING TO THE USE OF ARTIFICIAL INTELLIGENCE IN HEALTH CARE.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  Chapter 321, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

"Part     .  ARTIFICIAL INTELLIGENCE IN HEALTH CARE

     §321-    Definitions.  As used in this part:

     "Artificial intelligence" or "artificial intelligence system" means any engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

     "Authorized representative" means:

     (1)  An agent, a guardian, or a surrogate of the patient; or

     (2)  A person who is given a written individual instruction or power of attorney for health care in the patient's advance health-care directive pursuant to chapter 327E.

For the purposes of this definition, "advance health-care directive", "agent", "guardian", "power of attorney for health care", and "surrogate" have the same meanings as defined in section 327E-2.

     "Consequential decision" means a decision that has a significant effect on the physical or mental health of a patient.

     "Department" means the department of health.

     "Health care provider" and "health care service" have the same meanings as those terms are defined in section 323D-2.

     "Health information" and "individually identifiable health information" have the same meanings as those terms are defined in section 323B‑2.

     "Patient" means a person who is under the observation and care of or otherwise receiving health care services from a health care provider.

     "Personal data" means any information that is linked or could be reasonably linkable to an identified or identifiable natural person.  "Personal data" does not include de-identified data or publicly available information.

     "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

     "Remote communication" means communication through means by which a person who is not physically present in the same location as a health care provider may communicate with the health care provider on a substantially simultaneous basis.  "Remote communication" includes telecommunication, videoconference, and electronic communication, including internet-based communication and electronic transmission.

     "Substantial factor" means a factor that:

     (1)  Assists in making a consequential decision;

     (2)  Is capable of altering the outcome of a consequential decision; and

     (3)  Is generated by an artificial intelligence system.  "Substantial factor" includes any use of an artificial intelligence system to generate any content, decision, prediction, or recommendation concerning a patient that is used as a basis to make a consequential decision concerning the patient.

     §321-    Patient interaction; disclosure.  (a)  Any health care provider that uses or makes available for use an artificial intelligence system intended to interact with patients by means of remote communication shall disclose to the patient or the patient's authorized representative, as applicable, that the person is interacting with artificial intelligence.

     (b)  The disclosure shall be made before or at the time of the interaction; provided that in the case of an emergency, the disclosure shall be made as soon as reasonably possible.

     (c)  The disclosure shall be clear and conspicuous, and include:

     (1)  A disclaimer that:

          (A)  The communication was generated by artificial intelligence; or

          (B)  The communication was generated by artificial intelligence and reviewed by a health care provider who is a natural person or a natural person retained by the health care provider; and

     (2)  Clear instructions on how the patient can directly contact a health care provider who is a natural person, an employee of the health care provider, or other appropriate natural person.

     §321-    Consequential decisions; notice; statement; opt-out; corrections; appeal.  (a)  Before using an artificial intelligence system to make, or be a substantial factor in making, a consequential decision, a health care provider shall provide the patient or the patient's authorized representative, as applicable, with a written notice that:

     (1)  Informs the recipient that the health care provider will be using an artificial intelligence system to make, or be a substantial factor in making, the consequential decision;

     (2)  Discloses the purpose of the artificial intelligence system and the nature of the consequential decision;

     (3)  Describes the artificial intelligence system in plain language; and

     (4)  Allows the patient to opt out of the processing of the patient's individually identifiable health information or other personal data for purposes of profiling in furtherance of decisions that have legal or similarly significant effects concerning the patient.

     (b)  Any health care provider that used an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall provide the patient or the patient's authorized representative, as applicable, with:

     (1)  A written statement that describes the consequential decision and the principal reasons for the consequential decision, including:

          (A)  The degree to which, and manner in which, the artificial intelligence system contributed to the consequential decision;

          (B)  The type of data that was processed by the artificial intelligence system in making the consequential decision; and

          (C)  The sources of the data described in paragraph (B);

     (2)  An opportunity to correct any incorrect health information or personal data that the artificial intelligence system processed in making, or as a substantial factor in making, the consequential decision; and

     (3)  An opportunity to appeal the consequential decision, including allowing, to the extent technically feasible, human review of all information relating to the consequential decision; provided that this paragraph shall not apply if providing the opportunity for appeal is not in the best interest of the patient, including in instances in which any delay might pose a risk to the life or safety of the patient.

     (c)  The notice and statement required pursuant to subsections (a) and (b), respectively, shall be provided directly to the patient or the patient's authorized representative, as applicable; provided that if the health care provider is unable to comply with this requirement, the health care provider shall provide the notice or statement in a manner that is reasonably calculated to ensure that the patient or the patient's authorized representative, as applicable, receives the notice or statement.

     §321-    Consequential decisions; review and validation by qualified oversight personnel.  (a)  Any health care provider that uses an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall maintain an artificial intelligence oversight personnel.

     (b)  The artificial intelligence oversight personnel:

     (1)  Shall be a natural person;

     (2)  Shall have the qualifications, experience, and expertise necessary to effectively evaluate outputs, including but not limited to any information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by artificial intelligence systems in the field of health care; and

     (3)  May be retained by contracting with a third-party.

     (c)  The artificial intelligence oversight personnel shall:

     (1)  Monitor the artificial intelligence systems used by the health care provider; and

     (2)  Before the health care provider uses an output generated by an artificial intelligence system to make, or be a substantial factor in making, a consequential decision:

          (A)  Review and evaluate the output; and

          (B)  Validate or override the output.

     §321-    Monitoring; performance evaluation; record keeping.  Any health care provider that uses an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall:

     (1)  Monitor the usage of artificial intelligence systems to make, or be a substantial factor in making, consequential decisions;

     (2)  Conduct regular performance evaluations of the artificial intelligence systems, including the assessment of:

          (A)  Potential biases;

          (B)  Risks to the safety and rights of patients, including the confidentiality of personal data; and

          (C)  Mitigation strategies for any identified risks;

     (3)  Implement procedures to address any deficiencies identified through the monitoring or performance evaluations, including the suspension or recalibration of any artificial intelligence system; and

     (4)  Maintain:

          (A)  An updated inventory of the artificial intelligence systems;

          (B)  Documentation on the system design, intended use, and training data of the artificial intelligence systems;

          (C)  Record of the monitoring, performance evaluations, and oversight activities; and

          (D)  Documentation of findings and actions taken to address any deficiencies identified through the monitoring or performance evaluations.

     §321-    Rules.  The department of health, in coordination with the department of business, economic development, and tourism, shall adopt rules pursuant to chapter 91 to implement this part.  The rules shall include but not be limited to the qualifications, experience, and expertise required for an artificial intelligence oversight personnel and the frequency of regular performance evaluations of artificial intelligence systems required to be performed by certain health care providers."

     SECTION 2.  This Act shall take effect on January 30, 2050; provided that section 1 shall take effect on July 1, 2028.

Report Title:

DOH; Health Care Providers; Artificial Intelligence; Patient Interaction; Consequential Decisions; Disclosure; Notice; Oversight; Performance Evaluations; Recordkeeping; Rules

Description:

Requires health care providers using artificial intelligence (AI) in patient interactions to disclose to the patient that the patient is interacting with artificial intelligence.  Requires health care providers using AI in making consequential decisions relating to the patient to provide certain notice and statements to the patient; maintain a qualified AI oversight personnel who shall be a natural person that reviews, evaluates, and validates or overrides AI outputs; monitor and conduct regular performance evaluations of their AI systems; implement procedures to address identified deficiencies; and maintain certain records.  Requires the Department of Health to adopt rules.  Implementation effective 7/1/2028.  Effective 1/30/2050.  (SD1)

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

A BILL FOR AN ACT

relating to The use of artificial intelligence in health care.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  Chapter 321, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

"Part     .  ARTIFICIAL INTELLIGENCE IN HEALTH CARE

     §321-    Definitions.  For the purposes of this part:

     "Artificial intelligence" or "artificial intelligence system" means any engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

     "Authorized representative" means:

     (1)  An agent, a guardian, or a surrogate of the patient; or

     (2)  A person who is given a written individual instruction or power of attorney for health care in the patient's advance health-care directive pursuant to chapter 327E.

For the purposes of this definition, "advance health-care directive", "agent", "guardian", "power of attorney for health care", and "surrogate" have the same meanings as defined in section 327E-2.

     "Consequential decision" means a decision that has a significant effect on the physical or mental health of a patient or a material legal or similarly significant effect on the provision or denial to any patient of, or the cost or terms of, health care services.

     "Department" means the department of health.

     "Health care provider" and "health care service" have the same meanings as defined in section 323D-2.

     "Health information" and "individually identifiable health information" have the same meanings as defined in section 323B‑2.

     "Patient" means a person who is under the observation and care of or otherwise receiving health care services from a health care provider.

     "Personal data" means any information that is linked or could be reasonably linkable to an identified or identifiable natural person.  "Personal data" does not include de-identified data or publicly available information.

     "Profiling" means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

     "Remote communication" means communication through means by which a person who is not physically present in the same location as a health care provider may communicate with the health care provider on a substantially simultaneous basis.  "Remote communication" includes telecommunication, videoconference, and electronic communication, including internet-based communication and electronic transmission.

     "Substantial factor" means a factor that:

     (1)  Assists in making a consequential decision;

     (2)  Is capable of altering the outcome of a consequential decision; and

     (3)  Is generated by an artificial intelligence system.  "Substantial factor" includes any use of an artificial intelligence system to generate any content, decision, prediction, or recommendation concerning a patient that is used as a basis to make a consequential decision concerning the patient.

     §321-    Health care providers; artificial intelligence; patient interaction; disclosure.  (a)  Any health care provider that uses or makes available for use an artificial intelligence system intended to interact with patients by means of remote communication shall disclose to the patient or the patient's authorized representative, as applicable, that the person is interacting with artificial intelligence.

     (b)  The disclosure shall be made before or at the time of the interaction; provided that in the case of an emergency, the disclosure shall be made as soon as reasonably possible.

     (c)  The disclosure shall be clear and conspicuous, and include:

     (1)  A disclaimer that:

          (A)  The communication was generated by artificial intelligence; or

          (B)  The communication was generated by artificial intelligence and reviewed by a health care provider who is a natural person or a natural person retained by the health care provider; and

     (2)  Clear instructions on how the patient can directly contact a health care provider who is a natural person, an employee of the health care provider, or other appropriate natural person.

     §321-    Health care providers; artificial intelligence; consequential decisions; notice; statement; opt-out; corrections; appeal.  (a)  Before using an artificial intelligence system to make, or be a substantial factor in making, a consequential decision, a health care provider shall provide the patient or the patient's authorized representative, as applicable, with a written notice that:

     (1)  Informs the recipient that the health care provider will be using an artificial intelligence system to make, or be a substantial factor in making, the consequential decision;

     (2)  Discloses the purpose of the artificial intelligence system and the nature of the consequential decision;

     (3)  Describes the artificial intelligence system in plain language; and

     (4)  Allows the patient to opt out of the processing of the patient's individually identifiable health information or other personal data for purposes of profiling in furtherance of decisions that have legal or similarly significant effects concerning the patient.

     (b)  Any health care provider that used an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall provide the patient or the patient's authorized representative, as applicable with:

     (1)  A written statement that describes the consequential decision and the principal reasons for the consequential decision, including:

          (A)  The degree to which, and manner in which, the artificial intelligence system contributed to the consequential decision;

          (B)  The type of data that was processed by the artificial intelligence system in making the consequential decision; and

          (C)  The sources of the data described in paragraph (B);

     (2)  An opportunity to correct any incorrect health information or personal data that the artificial intelligence system processed in making, or as a substantial factor in making, the consequential decision; and

     (3)  An opportunity to appeal the consequential decision, including allowing, to the extent technically feasible, human review of all information relating to the consequential decision; provided that this paragraph shall not apply if providing the opportunity for appeal is not in the best interest of the patient, including in instances in which any delay might pose a risk to the life or safety of the patient.

     (c)  The notice and statement required pursuant to subsections (a) and (b), respectively, shall be provided directly to the patient or the patient's authorized representative, as applicable; provided that if the health care provider is unable to comply with this requirement, the health care provider shall provide the notice or statement in a manner that is reasonably calculated to ensure that the patient or the patient's authorized representative, as applicable, receives the notice or statement.

     §321-    Health care providers; artificial intelligence; consequential decisions; review and validation by qualified oversight personnel.  (a)  Any health care provider that uses an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall maintain an artificial intelligence oversight personnel.

     (b)  The artificial intelligence oversight personnel:

     (1)  Shall be a natural person;

     (2)  Shall have the qualifications, experience, and expertise necessary to effectively evaluate outputs, including but not limited to any information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions, generated by artificial intelligence systems in the field of health care; and

     (3)  May be retained by contracting with a third-party.

     (c)  The artificial intelligence oversight personnel shall:

     (1)  Monitor the artificial intelligence systems used by the health care provider; and

     (2)  Before the health care provider uses an output generated by an artificial intelligence system to make, or be a substantial factor in making, a consequential decision:

          (A)  Review and evaluate the output; and

          (B)  Validate or override the output.

     §321-    Health care providers; artificial intelligence; consequential decisions; monitoring; performance evaluation; record keeping.  Any health care provider that uses an artificial intelligence system to make, or be a substantial factor in making, a consequential decision shall:

     (1)  Monitor the usage of artificial intelligence systems to make, or be a substantial factor in making, consequential decisions;

     (2)  Conduct regular performance evaluations of the artificial intelligence systems, including the assessment of:

          (A)  Potential biases in training data;

          (B)  Risks to the safety and rights of patients, including the confidentiality of personal data; and

          (C)  Mitigation strategies for any identified risks;

     (3)  Implement procedures to address any deficiencies identified through the monitoring or performance evaluations, including the suspension or recalibration of any artificial intelligence system; and

     (4)  Maintain:

          (A)  An updated inventory of the artificial intelligence systems;

          (B)  Documentation on the system design, intended use, and training data of the artificial intelligence systems;

          (C)  Record of the monitoring, performance evaluations, and oversight activities;

          (D)  Documentation of findings and actions taken to address any deficiencies identified through the monitoring or performance evaluations.

     §321-    Reports to the department.  Any health care provider who uses an artificial intelligence system pursuant to this part shall submit an annual report to the department relating to the health care provider's compliance with this part.

     §321-    Rules.  The department of health, in coordination with the department of business, economic development, and tourism, shall adopt rules pursuant to chapter 91 to implement this part.  The rules shall include but not be limited to the qualifications, experience, and expertise required for an artificial intelligence oversight personnel and the frequency of regular performance evaluations of artificial intelligence systems required to be performed by certain health care providers."

     SECTION 2.  This Act shall take effect upon its approval.

Report Title:

DOH; Health Care Providers; Artificial Intelligence; Patient Interaction; Consequential Decisions; Disclosure; Notice; Oversight; Performance Evaluations; Recordkeeping; Reports; Rules

Description:

Requires health care providers using artificial intelligence (AI) in patient interactions to disclose to the patient that the patient is interacting with artificial intelligence.  Requires health care providers using AI in making consequential decisions relating to the patient to provide certain notice and statements to the patient; maintain a qualified AI oversight personnel who shall be a natural person that reviews, evaluates, and validates or overrides AI outputs; monitor and conduct regular performance evaluations of their AI systems; implement procedures to address identified deficiencies; and maintain certain records.  Requires certain health care providers using AI to submit annual reports to the Department of Health.  Requires the Department to adopt rules.

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

STAND. COM. REP. NO. 2357

Honolulu, Hawaii

RE:     S.B. No. 2281

        S.D. 1

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Third State Legislature

Regular Session of 2026

State of Hawaii

Sir:

     Your Committees on Health and Human Services and Labor and Technology, to which was referred S.B. No. 2281 entitled:

"A BILL FOR AN ACT RELATING TO THE USE OF ARTIFICIAL INTELLIGENCE IN HEALTH CARE,"

beg leave to report as follows:

     The purpose and intent of this measure is to:

     (1)  Require health care providers using artificial intelligence (AI) in patient interactions to disclose to the patient that the patient is interacting with AI;

     (2)  Require health care providers using AI in making consequential decisions relating to the patient to:

          (A)  Provide certain notice and statements to the patient;

          (B)  Maintain a qualified AI oversight personnel who shall be a natural person that reviews, evaluates, and validates or overrides AI outputs;

          (C)  Monitor and conduct regular performance evaluations of their AI systems;

          (D)  Implement procedures to address identified deficiencies; and

          (E)  Maintain certain records;

     (3)  Require certain health care providers using AI to submit annual reports to the Department of Health; and

     (4)  Require the Department of Health to adopt rules.

     Your Committees received testimony in support of this measure from the State Health Planning and Development Agency and four individuals.

     Your Committees received comments on this measure from the Department of Health, Hawaii Medical Association, Healthcare Association of Hawaii, Hawaiʻi Pacific Health, ATA Action, and TechNet.

     Your Committees find that the State has an important opportunity to proactively establish guardrails for the use of artificial intelligence in health care.  Your Committees further find that as AI capabilities evolve rapidly, statutory framework that emphasizes disclosure, oversight, and patient rights are prudent. This measure establishes protections that appropriately center transparency, patient awareness, and human oversight as AI tools become more common in clinical and administrative settings.

Your Committees have amended this measure by:

     (1)  Deleting language to clarify that "consequential decision" means a decision that has a significant effect on the physical or mental health of a patient;

     (2)  Deleting language to clarify that the required regular performance evaluations of the AI systems shall include assessment of potential biases beyond those in training data;

     (3)  Deleting language that would have required any health care provider who uses an AI system to submit an annual report to the Department of Health relating to the health care provider's compliance;

     (4)  Inserting an implementation date of July 1, 2028;

     (5)  Inserting an effective date of January 30, 2050, to encourage further discussion; and

     (6)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

     As affirmed by the records of votes of the members of your Committees on Health and Human Services and Labor and Technology that are attached to this report, your Committees are in accord with the intent and purpose of S.B. No. 2281, as amended herein, and recommend that it pass Second Reading in the form attached hereto as S.B. No. 2281, S.D. 1, and be referred to your Committees on Commerce and Consumer Protection and Ways and Means.

Respectfully submitted on behalf of the members of the Committees on Health and Human Services and Labor and Technology,