How to Comply with the Utah Artificial Intelligence Privacy Act
If your organization has not updated its policies to comply with Utah’s Artificial Intelligence Policy Act (the “Act”), now is the time. As we noted in a prior blog post, this law took effect on May 1st. While it imposes certain AI-related disclosure obligations on businesses and individuals as a whole, the obligations for regulated occupations (which include those licensed by the Utah Division of Professional Licensing, such as clinical services provided by a licensed healthcare provider, including a physician or nurse), are stricter.
What Does the Act Require?
The Act requires that licensed providers “prominently disclose when…interacting with a generative artificial intelligence” in the provision of regulated services (i.e., the practice of medicine or nursing). The provider must make the disclosure verbally at the beginning of the conversation and electronically prior to a written exchange. The Act describes generative AI as an artificial system trained on data that communicates via text, audio, or visuals and generates unscripted outputs similar to a human with limited or zero human supervision. This definition is vague and stakeholders are awaiting clarity as to which communication technologies constitute generative AI under the Act. For example, whether or not all automated chatbots constitute generative AI may be up for debate. Non-regulated businesses and individuals are subject to a less stringent standard – it is acceptable for a person to communicate with their deployed generative AI without prior disclosure. However, if a person inquires whether he/she is communicating with a person or AI, then such non-regulated business/individuals must clearly and conspicuously disclose that the communications are with generative AI.
How Is It Enforced?
In addition to enforcement powers available to the Division of Consumer Protection, individuals who violate the Act may be administratively fined $2,500 per violation and potentially sued in court. In a lawsuit, providers may be subject to an additional $2,500 penalty for each violation. Providers who violate any administrative or court orders may be subject to an additional civil penalty of $5,000 per violation. Further, providers can’t push liability onto the generative AI (or its manufacturer) as a defense by blaming it for providers’ violations of the Act.
Office of AI Policy
The Act also establishes the Office of Artificial Intelligence Policy to encourage the development of AI technologies by creating and overseeing an artificial intelligence learning laboratory program, in addition to consulting with stakeholders about regulatory changes in this sphere. The Office will accept participants for its learning laboratory program which allows for regulatory mitigation during AI testing and development periods. Regulatory mitigation may include reduced penalties under the Act. Such programs may last up to 12 months, which may be extended one time for an additional 12-month period.
Be Ready
Providers using generative AI in Utah should ensure that they have appropriate policies, procedures and disclosures in place to comply with the Act. While the Act clearly applies to licensed providers physically located in Utah, Utah-licensed clinicians providing telehealth services to Utah patients (even if the provider is not physically located in Utah) must also comply. Therefore, any telehealth provider with a presence in Utah that is using generative AI should evaluate whether it is subject to the Act.
