Pennsylvania's Healthcare AI Laws: The Character.AI Suit, HB 1925 and What Already Applies

Old ones, applied aggressively. Pennsylvania has enacted two AI statutes, both criminal and neither about healthcare, and has nonetheless produced the most direct state enforcement action against a health AI product in the country.

The enacted AI laws are Act 125 of 2024, extending the intimate image and child sexual abuse material offences to AI generated content, and Act 35 of 2025, creating digital forgery. Everything else is general law. The Medical Practice Act and its sister practice acts prohibit unlicensed practice and holding oneself out as licensed, which is how the Department of State reached Character.AI. The Wiretapping and Electronic Surveillance Control Act requires all party consent to record. Act 146 of 2022 governs who may deny a prior authorization and how fast a plan must answer. Insurance Department Notice 2024-04 governs how insurers must run AI. 49 Pa. Code 16.95 governs the record a physician signs. Act 151 of 2022 made medical information a breach notification category. And Executive Order 2023-19 governs generative AI in state agencies, which reaches state owned facilities and vendors to them.

Pending are the bills that would speak directly to a clinic: HB 1925 and SB 1113 on AI in facilities and utilization review, HB 2100 on mental health chatbots and therapists' use of AI, SB 1090 and HB 2006 on companion chatbots, HB 78 on consumer data privacy. The session runs to November 30, 2026, so unlike most states the answer could change before the year ends.

Pennsylvania therefore sits between Texas, which legislated lightly, and Colorado, which legislated heavily: it has not legislated, and it enforces. The state by state map shows where that leaves a multi state group, and the healthcare AI law checker maps each deployment to the statutes above.

That in Pennsylvania an AI presenting as a clinician is the unlicensed practice of medicine, that the Department of State will act on complaints, and that a provider's own agents are held to the same test.

The complaint in No. 220 MD 2026, filed May 1, 2026 in Commonwealth Court, is brought by the Department of State and the State Board of Medicine under the Medical Practice Act, 63 P.S. 422.1 to 422.53, relying on the injunction power in section 422.38. A Department investigator selected a character described on Character.AI as a psychiatry doctor. The character said it was licensed in Pennsylvania and supplied a licence number which the Board confirmed was not valid. The complaint records approximately 45,500 user interactions with the character by April 17, 2026. The Department sought a preliminary injunction. The Governor's May 5, 2026 release describes the action as the first from a twelve member Department of State task force evaluating whether AI companion technologies are engaging in unlicensed practice, and points the public to a reporting portal at pa.gov/ReportABot, which states that AI chatbots are no substitute for trained and licensed human professionals.

The legal theory is not novel and that is the point. Holding oneself out as a licensed physician, or practising medicine without a licence, has been unlawful since 1985. The Department's position is that the statute does not care whether the actor is a person or a model, and that the platform operator is the person responsible. That theory reaches a provider in two ways.

• Agent identity. An AI phone agent or intake tool that carries a clinical title, uses a name that implies a licence, or answers a question about whether it is a nurse with anything other than no, is holding itself out. In Pennsylvania that is the same conduct the Department sued over. Give every agent a non clinical identity and an unprompted statement that it is software.
• Supervision. Where a licensed clinician deploys an AI that gives clinical advice, the licensee's own Board is the regulator. The Medical Practice Act's grounds for discipline include unprofessional conduct and aiding unlicensed practice, and 49 Pa. Code 16.95 requires that the record reflect the physician's own evaluation. An AI symptom checker that recommends a course of action with no clinician review is exposure for the practice, not only for the vendor.

The State Board of Medicine has issued no formal AI statement beyond the reporting link on its page. Checked September 2026. The complaint is the statement. For a behavioural health practice the practical rule is the one Illinois and Nevada have written into statute: AI for notes, scheduling and billing, a licensed human for anything therapeutic, and no chatbot that could be mistaken for a clinician. HB 2100 would codify exactly that.

Human clinical judgement over AI in utilization review, an annual compliance statement to the Insurance Department, disclosure to providers and members, and parallel duties for health facilities. Both bills were alive but unpassed in September 2026.

HB 1925 (Representative Venkat, a physician) amends Titles 35, 40 and 67 to provide for artificial intelligence in facilities, for AI use by insurers, and for AI use by Medicaid and CHIP managed care plans, imposing duties on the Departments of Health, Insurance and Human Services. On the insurer side, as summarised by the sponsor and the practitioner press, an insurer may use AI in utilization review but an AI based algorithm may not override the clinical judgement of health care providers; determinations must be grounded in the enrollee's clinical history, the individual clinical and non clinical circumstances identified by the requesting provider, and other relevant information in the medical record; insurers using AI in utilization review must file an annual AI compliance statement with the Insurance Department and disclose the use to providers and covered individuals; and AI must not be used in a way that violates the state's anti discrimination laws. The facility provisions would require disclosure to patients and a human decision maker. The bill was introduced on October 6, 2025, reported as amended from House Communications and Technology on May 5, 2026 by 19 to 7, and laid on the table the same day. A tracker records it removed from the table on June 25, 2026. No floor vote had been recorded when checked in September 2026, and the House's own page could not be loaded to confirm the latest action.

SB 1113 (Senator Pisciottano and nine co-sponsors) is the Senate version, introduced January 9, 2026 and referred to Senate Institutional Sustainability and Innovation, where it sat in September 2026. It adds the power to suspend an insurer's new enrolments for non compliance.

These bills sit on top of Act 146 of 2022, which since January 1, 2024 has required that a prior authorization be denied only after review by or in consultation with a licensed health care provider with appropriate training, knowledge or experience in the same or similar specialty that typically manages the service, with 72 hours for urgent and 15 days for non urgent commercial requests, and that peer to peer reviewers meet the same test. The Insurance Department restated the reviewer requirement in Notice 2024-11 on July 27, 2024. Act 146 does not mention AI, but a denial produced by an algorithm with no qualified reviewer already fails it. For a provider, that is the rule to enforce now: check every adverse determination for a named reviewer in the right specialty, and route failures to appeal and to the Department. Our prior authorization automation page covers how to capture that at intake. If HB 1925 passes, the annual compliance statements and member disclosures will tell you which plans are using AI and where.

A written AI systems programme, governance that reaches the board, vendor due diligence with audit rights, and documentation ready for an examination. It is guidance about governance, not a rule about outcomes, and it is the closest thing Pennsylvania has to an AI regulation.

Notice 2024-04 was published on April 6, 2024 at 54 Pa.B. 1910, making Pennsylvania the eighth state to adopt the NAIC model bulletin. It applies to every insurer holding a certificate of authority or otherwise authorised to do business in the Commonwealth, including HMOs, PPOs and health plans. Its core statement is that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including artificial intelligence systems, must comply with all applicable insurance laws and regulations, and that the Department expects decisions made and actions taken by insurers using AI systems to comply with all applicable federal and state laws.

It then sets out what the Department expects to see: a written AI systems programme designed to mitigate the risk that the insurer's use of an AI system will result in adverse consumer outcomes; governance with senior management accountability to the board across the AI lifecycle; risk management and internal controls including data quality practices, model inventories and validation testing for model drift; and third party vendor management with due diligence and contract terms that include audit rights or entitle the insurer to receive audit reports. In an investigation or market conduct action, an insurer can expect to be asked to respond to an inquiry or provide documentation pertaining to its development, deployment and use of AI systems. The legal basis is the Unfair Insurance Practices Act.

For a provider the value is indirect but real. A plan that cannot produce its AI programme on examination is a plan the Department can act against, and a pattern of denials that looks algorithmic is grounds for a market conduct complaint. Massachusetts, Washington and Illinois have adopted the same model, and Florida has not, so a multi state provider can use the same complaint template in each adopting state.

All party consent before recording, the in person standard of care for anything delivered remotely, and a signed record that accurately, legibly and completely reflects the physician's own evaluation.

Recording. 18 Pa.C.S. 5703 makes it a felony of the third degree to intentionally intercept any wire, electronic or oral communication, and 5704(4) makes interception lawful where all parties to the communication have given prior consent. Pennsylvania has no secrecy qualifier of the kind Massachusetts uses; the consent must be prior and from everyone. An ambient scribe needs consent from the patient and from anyone accompanying them before the recording starts, and a phone agent needs an announcement and consent before clinical content. Consent should be captured in the recording or the note. 18 Pa.C.S. 5725 gives the person recorded a civil action with liquidated damages and fees, so the exposure is not only criminal.

Telemedicine. Act 42 of 2024, signed July 3, 2024 and codified at 40 Pa.C.S. chapter 48, provides that a health care provider delivering services through telemedicine is subject to the same standard of care that would apply in an in person setting, and requires insurers to cover services delivered by telemedicine where that standard is met, for policies filed from March 31, 2025. The Department of State's telemedicine FAQs restate that. There is no express consent provision in Act 42; the Medicaid programme imposes one separately. An autonomous AI interaction is not telemedicine under the Act, because there is no health care provider delivering the service, which matters when a vendor describes its agent as providing care.

Records. 49 Pa. Code 16.95(a) requires a physician to maintain medical records for patients which accurately, legibly and completely reflect the evaluation and treatment of the patient, retained for at least seven years from the last service. The rule judges the signed record. A scribe draft that records an examination not performed, or a plan the physician did not make, is inaccurate and incomplete whoever drafted it. The scribe checklist exists to make the review step auditable.

The breach statute reaches every vendor today. The consumer data privacy act would reach the ones outside HIPAA and had passed one chamber and reached second consideration in the other by September 2026.

The Breach of Personal Information Notification Act, 73 P.S. 2301 et seq., as amended by Act 151 of 2022 with effect from May 2, 2023, defines personal information to include medical information, meaning any individually identifiable information in a record of medical history, treatment or diagnosis created by a health care professional, and health insurance information, meaning a policy or subscriber number with an access code or other medical information that permits misuse of benefits. An entity that maintains, stores or manages computerised data on behalf of another must notify the owner of a breach, and notice to residents must be made without unreasonable delay. Notice to the Attorney General is required for breaches affecting more than 500 residents. A vendor holding scribe transcripts, call recordings or claim data is within it. Write the vendor notice duty into the business associate agreement alongside the federal rule described in our HIPAA and AI page.

Sensitive health records. Mental health records under the Mental Health Procedures Act, 50 P.S. 7111, drug and alcohol treatment records under 71 P.S. 1690.108 and federal 42 CFR Part 2, and HIV related information under the Confidentiality of HIV Related Information Act each require specific written consent for disclosure that a general HIPAA authorisation does not satisfy. An AI vendor that receives those records needs to be within the treatment team or a qualified service organisation, and its contract needs to say so.

HB 78, the consumer data privacy act (Representative Neilson), passed the House 127 to 76 on October 1, 2025, was reported by Senate Consumer Protection and Professional Licensure and re-reported as amended by Communications and Technology on June 24, 2026, and reached second consideration on June 25, 2026. It would require opt in consent before processing sensitive data, exempt HIPAA covered entities and business associates and protected health information, and give the Attorney General exclusive enforcement with no private right of action. Whether health data is enumerated as sensitive in the Senate amended text could not be confirmed from the bill page in September 2026. If it passes before November 30, the data your website, marketing tools and non patient interactions generate will be governed by consent, as it already is in Washington, Nevada and Connecticut.

Only a state operated one, or a vendor to a Commonwealth agency. For everyone else it is the clearest public statement of what Pennsylvania's executive branch regards as responsible use.

Executive Order 2023-19, signed September 20, 2023 and effective immediately, expands and governs the use of generative AI within agencies under the Governor's jurisdiction. It creates a Generative AI Governing Board and sets ten core values: accuracy, adaptability, employee empowerment, equity and fairness, innovation, mission alignment, privacy, proportionality, safety and security, and transparency. Its central sentence is that generative AI cannot and should never replace human creativity, moral judgement or lived experiences. The Office of Administration's generative AI page records the Commonwealth's pilot of ChatGPT Enterprise with about 175 employees from March 2024 to March 2025.

The Department of Human Services, the Department of Health and the state's own facilities are inside it, as are contractors using agency systems. A private practice or health system is not. The order is nonetheless useful to a provider in one way: it is the standard a Department of State investigator, an Insurance Department examiner or a Commonwealth Court judge has been told their own agencies follow, and a governance programme that can show the same values, particularly human judgement, privacy and transparency, is speaking their language. Our AI policy template for medical practices is drafted to that shape.

Seven items. Pennsylvania has no healthcare AI statute, an enforcement agency that has shown it does not need one, and a session that runs to November 30, 2026.

1. Strip every clinical title and licensed sounding name from every agent, and have it say it is software. The Department of State sued over a chatbot that claimed a licence. Yours must never be able to.
2. Obtain prior consent from every party before any recording. 18 Pa.C.S. 5704(4) is the only lawful route for a scribe or phone agent, and 5703 is a felony with a private right of action under 5725.
3. Check every prior authorization denial for a same or similar specialty reviewer. Act 146 has required one since January 1, 2024 and Notice 2024-11 restates it. Appeal denials that cannot show one and report patterns to the Insurance Department.
4. Keep AI out of the therapeutic act in behavioural health. HB 2100 would require it; the Character.AI complaint shows the Department already thinks so.
5. Write the breach notice duty and the Part 2, mental health and HIV consent rules into every vendor contract. Act 151 made medical information a notification category; the special consent statutes predate HIPAA and are stricter.
6. Gate AI notes behind physician review. 49 Pa. Code 16.95 judges the signed record.
7. Watch HB 1925, SB 1113, HB 2100, SB 1090 and HB 78 through November 30, 2026. Any of them could pass in the autumn, and the compliance statements, disclosures and consent duties they carry would start on their effective dates.

Pennsylvania punishes the organisation that assumes an old statute cannot reach a new tool. The Medical Practice Act, the wiretap act and Act 146 all do, and the Department of State has said publicly that it is looking. Building the agent identity, consent, contract and review controls once, and aligning them with Colorado, California and Texas, is what our AI governance and compliance engagement delivers, usually starting from the inventory an AI readiness audit produces. Book a scoping call if any agent in your estate currently answers to a clinical title.