(1) As used in this section:
(a) "Mental health chatbot" means the same as that term is defined in Section 13-72a-101.
(b) "Supplier" means the same as that term is defined in Section 13-11-3.
(2) It is an affirmative defense to liability in an action brought under Subsection 58-1-501(1) or Subsection 58-1-501(2) if the supplier demonstrates that the supplier:
(a) created, maintained, and implemented a policy that meets the requirements of Subsection (3);
(b) maintains documentation regarding the development and implementation of the mental health chatbot that describes:
(i) foundation models used in development;
(ii) training data used;
(iii) compliance with federal health privacy regulations;
(iv) user data collection and sharing practices; and
(v) ongoing efforts to ensure accuracy, reliability, fairness, and safety;
(c) filed the policy with the division as described in Subsection (4); and
(d) complied with all requirements of the filed policy at the time of the alleged violation.
(3) A policy described in Subsection (2)(a) must:
(a) be in writing;
(b) clearly state:
(i) the intended purposes of the mental health chatbot; and
(ii) the abilities and limitations of the mental health chatbot; and
(c) describe the procedures by which the supplier:
(i) ensures that licensed mental health therapists are involved in the development and review process;
(ii) ensures the mental health chatbot is developed and monitored in a manner consistent with clinical best practices;
(iii) conducts testing, prior to making the mental health chatbot publicly available and regularly thereafter, to ensure that the output of the mental health chatbot poses no greater risk to a user than that posed to an individual in therapy with a licensed mental health therapist;
(iv) identifies reasonably foreseeable adverse outcomes to, and potentially harmful interactions with, users that could result from using the mental health chatbot;
(v) provides a mechanism for a user to report any potentially harmful interactions from use of the mental health chatbot;
(vi) implements protocols to assess and respond to risk of harm to users or other individuals;
(vii) details actions taken to prevent or mitigate any such adverse outcomes or potentially harmful interactions;
(viii) implements protocols to respond in real time to acute risk of physical harm;
(ix) reasonably ensures regular, objective reviews of safety, accuracy, and efficacy, which may include internal or external audits;
(x) provides users any necessary instructions on the safe use of the mental health chatbot;
(xi) ensures users understand they are interacting with artificial intelligence;
(xii) ensures users understand the intended purpose, capabilities, and limitations of the mental health chatbot;
(xiii) prioritizes user mental health and safety over engagement metrics or profit;
(xiv) implements measures to prevent discriminatory treatment of users; and
(xv) ensures compliance with the security and privacy provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A, C, and E, as if the supplier were a covered entity, and applicable consumer protection requirements, including Sections 13-72a-201, 13-72a-202, and 13-72a-203.
(4) To file a policy with the division under this section, a supplier of a mental health chatbot:
(a) shall provide to the division:
(i) the name and address of the supplier;
(ii) the name of the mental health chatbot supplied by the supplier;
(iii) the written policy described in Subsection (3); and
(iv) a fee set in accordance with Section 63J-1-504;
(b) shall file in a manner established by the division; and
(c) may provide to the division:
(i) any revisions to a policy filed under this section; or
(ii) any other documentation the supplier elects to provide.
(5) The division:
(a) shall provide a means for a supplier of a mental health chatbot to file under this section; and
(b) may impose an annual filing fee set in accordance with Section 63J-1-504.
(6) The affirmative defense described in this section applies only in an administrative or civil action alleging a violation of:
(a) Subsection 58-1-501(1); or
(b) Subsection 58-1-501(2).
(7) Nothing in this section shall be construed to:
(a) bar the division from bringing an action under Subsection 58-1-501(1) or Subsection 58-1-501(2) against the supplier of a mental health chatbot; or
(b) recognize a mental health chatbot as a licensed mental health therapist.