United States - Utah - AI Mental Health Regulation (HB 452)

Overview

Utah House Bill 452, officially titled "Artificial Intelligence Amendments," establishes a comprehensive regulatory framework for mental health chatbots utilizing artificial intelligence technology within the state of Utah. Enacted in 2025, this legislation is a significant step by the state to proactively address the ethical and privacy challenges posed by AI in sensitive applications such as mental health support. The bill aims to safeguard users by ensuring transparency regarding AI interaction, protecting personal health information from unauthorized use, and setting clear boundaries for advertising practices within the mental health AI sector. It introduces new provisions under the Utah Code, specifically establishing Chapter 72a, "Artificial Intelligence Applications Relating to Mental Health," to govern these technologies. This legislative effort reflects Utah's forward-thinking approach to regulating emerging AI technologies, building upon its existing Artificial Intelligence Policy Act (UAIPA) which was enacted in 2024. HB 452 defines key terms, outlines responsibilities and requirements for suppliers of mental health chatbots, and grants robust enforcement authority to the Utah Division of Consumer Protection to uphold these standards, thereby fostering a balance between technological innovation and consumer protection in a critical area of public health.

Definitions

The law meticulously defines several critical terms to clarify its scope, application, and the entities it regulates. These definitions are crucial for understanding the obligations imposed by the legislation:

• Artificial intelligence (AI) and Artificial intelligence technology: These terms are defined as having the same meaning as specified in Section 13-72-101 of the Utah Code. This linkage ensures consistency with Utah's broader AI regulatory framework.
• Mental health chatbot: This is a core definition, referring to AI technology that (1) uses generative AI to engage in interactive conversations with a user, simulating communications one would have with a licensed mental health therapist, and (2) a supplier represents, or a reasonable person would believe, can or will provide mental health therapy or help a user manage or treat mental health conditions. Crucially, the definition explicitly excludes AI technology that only provides scripted output, such as guided meditations or mindfulness exercises, thereby narrowing the scope to interactive, therapy-simulating AI.
• Supplier: This term is defined by reference to Section 13-11-3 of the Utah Code, which pertains to the Utah Consumer Sales Practices Act. Generally, a supplier includes a seller, lessor, assignor, offeror, broker, or other person who regularly solicits, engages in, or enforces consumer transactions, whether or not they deal directly with the consumer. This broad definition aims to capture various entities involved in providing mental health chatbots.
• Utah user: An individual located in the state of Utah at the time they access or use a mental health chatbot. This definition establishes the jurisdictional scope of the law.
• Personal data: This term is defined as having the same meaning as in Section 63A-19-101 of the Utah Code, aligning with the state's general data privacy statutes.
• Individually identifiable health information: This refers to health information that can be linked to a specific individual, forming the basis for the law's stringent privacy protections.
• User input: This encompasses any content, data, or information provided by a Utah user to a mental health chatbot.

Governance and Institutional Framework

The primary governmental body responsible for the enforcement and oversight of Utah HB 452 is the Utah Division of Consumer Protection, which operates under the Utah Department of Commerce. The Division's authority is established in Section 13-2-1 of the Utah Code. This agency is explicitly empowered by HB 452 to investigate potential violations of the law, impose administrative fines, and initiate legal actions in court to ensure compliance by suppliers of mental health chatbots. The choice of the Division of Consumer Protection highlights the state's perspective that the use of AI in mental health chatbots falls under the purview of consumer protection, emphasizing the need to protect individuals from deceptive practices, privacy breaches, and other harms. The law also mandates a proactive regulatory approach by requiring suppliers to develop, maintain, and file specific policies for their mental health chatbots with the Division, thereby establishing a mechanism for initial review and ongoing oversight of their operational frameworks and compliance efforts. This institutional framework ensures that there is a dedicated state agency with the necessary powers to enforce the provisions of this critical legislation and respond to the evolving landscape of AI in healthcare.

Key Focus Areas

• Protections for Users: The law establishes robust and essential protections for users of mental health chatbots, recognizing the highly sensitive nature of mental health data. A supplier of a mental health chatbot is strictly prohibited from selling to or sharing with any third party any individually identifiable health information of a Utah user or any user input provided by a Utah user. This fundamental prohibition is designed to prevent the unauthorized dissemination and monetization of highly personal and confidential health-related data. However, the law provides limited, carefully delineated exceptions. Individually identifiable health information may be shared if it is specifically requested by a healthcare provider with the explicit consent of the Utah user, or if it is provided to a health plan of a Utah user upon the user's request. Furthermore, any sharing of information must be in compliance with other specific subsections of the law, particularly aligning with federal regulations such as the Health Insurance Portability and Accountability Act (HIPAA). This ensures that while privacy is paramount, necessary and consented-to information sharing for legitimate healthcare purposes can still occur under strict conditions. The law also clarifies that it does not prohibit a mental health chatbot from recommending that a Utah user seek counseling, therapy, or other assistance from a licensed professional, including a specific licensed professional, ensuring that the chatbot can still guide users towards human care when appropriate.
• Advertising Restrictions: HB 452 imposes significant restrictions on advertising practices by mental health chatbot suppliers to prevent manipulative or exploitative commercial activities in a vulnerable context. Suppliers are expressly prohibited from using a mental health chatbot to advertise a specific product or service to a Utah user in a conversation between the user and the chatbot, unless stringent disclosure requirements are met. Specifically, the mental health chatbot must clearly and conspicuously identify the communication as an advertisement and clearly and conspicuously disclose to the Utah user any sponsorship, business affiliation, or agreement the supplier has with a third party to promote, advertise, or recommend the product or service. Beyond this, the law broadly prohibits suppliers from using a user's input to (1) determine whether to display advertisements to the user (unless the advertisement is for the mental health chatbot itself), (2) customize how advertisements are presented, or (3) determine a product, service, or category to advertise to the user. These provisions are designed to prevent targeted advertising based on sensitive mental health discussions, thereby protecting users from potentially coercive or inappropriate commercial solicitations.
• Disclosure Requirements: Transparency is a fundamental pillar of this legislation, aimed at managing user expectations and ensuring informed consent. A supplier of a mental health chatbot is legally obligated to ensure that the chatbot clearly and conspicuously discloses to a Utah user that the mental health chatbot is an artificial intelligence technology and not a human. This disclosure is not a one-time requirement but must be made at several critical junctures to ensure continuous awareness: (1) before the user accesses any features of the mental health chatbot, (2) at the beginning of any interaction with the user if the user has not accessed the mental health chatbot within the previous seven days, and (3) if the user explicitly asks or prompts the chatbot whether AI is being used. These repeated and prominent disclosure requirements are intended to prevent users from mistakenly believing they are interacting with a human therapist, addressing the ethical implications of AI impersonation and maintaining clarity in the therapeutic relationship.
• Policy Requirements: To foster responsible development and deployment of mental health chatbots, the law mandates that suppliers create, maintain, and implement a comprehensive policy for their AI mental health chatbots. This policy must then be filed with the Utah Division of Consumer Protection. While the full specifics of the policy's content are detailed in the official legislative text, they generally encompass critical aspects such as the chatbot's intended purpose, its known limitations, the safety protocols integrated into its design and operation, the types of training data used, compliance with federal health privacy regulations, user data collection and sharing practices, and ongoing efforts to ensure accuracy, reliability, fairness, and safety. Furthermore, the policy should outline the involvement of licensed mental health professionals in the chatbot's development, validation, and oversight. This requirement promotes a structured approach to AI governance, encouraging suppliers to think through the ethical, safety, and privacy implications of their technology and document their commitment to responsible practices.
• Rebuttable Presumption: The legislation introduces a significant legal provision by creating a rebuttable presumption for suppliers who comply with the established policy requirements. This means that if a supplier can demonstrate that they have successfully created, maintained, and implemented a comprehensive policy for their mental health chatbot that meets all the statutory requirements and has duly filed this policy with the Utah Division of Consumer Protection, this compliance may serve as an affirmative defense against certain violations of the law. This provision provides a strong incentive for proactive compliance and responsible innovation. By offering a potential legal safe harbor for those who adhere to best practices, the law seeks to reduce the regulatory burden on compliant actors while still maintaining robust consumer protections. It encourages transparency and accountability in the development and operation of mental health AI.

Implementation Framework

Utah HB 452 was enacted as part of the 2025 General Session of the Utah Legislature and became legally effective on May 7, 2025. The bill introduces new sections to the Utah Code, specifically under Title 13, Chapter 72a, which is titled "Artificial Intelligence Applications Relating to Mental Health." This immediate effectiveness from May 7, 2025, meant that all suppliers of mental health chatbots operating within the state of Utah were required to be in full compliance with its provisions from that date forward. The legislative process involved its introduction, passage through both the House and Senate, and subsequent signing by the Governor. Upon its effective date, the Utah Division of Consumer Protection was fully vested with the authority and responsibility for the ongoing enforcement and oversight of these new regulations. Businesses developing or deploying mental health AI solutions targeting Utah users needed to swiftly adapt their practices, update their disclosures, review their data handling protocols, and establish or refine their internal policies to align with the new legal requirements. The new code sections provide the legal framework for the ongoing regulation and oversight of these technologies within the state.

Monitoring and Evaluation

Compliance with the provisions of Utah HB 452 is primarily monitored and enforced by the Utah Division of Consumer Protection. The Division is equipped with the authority to conduct investigations into potential violations, which may arise from various sources such as user complaints, proactive market surveillance by the Division, or audits of supplier practices. The requirement for suppliers to develop, maintain, and file their comprehensive mental health chatbot policies with the Division serves as a crucial mechanism for initial regulatory review and ongoing oversight. These filed policies provide the Division with a documented framework of a supplier's commitment to responsible AI practices, which can be evaluated against statutory requirements. While the bill text does not explicitly detail a formal, periodic, or comprehensive evaluation process for the law's overall effectiveness or impact, the Division's continuous enforcement actions, investigations, and responses to complaints function as a form of ongoing monitoring. This allows the state to address non-compliance as it arises and potentially adapt its enforcement strategies in response to evolving technological landscapes and market practices. The Division's role is therefore central to ensuring the sustained adherence to the law's provisions and protecting Utah users.

Penalties, Liability, and Appeals

Violations of Utah HB 452 can lead to significant legal and financial consequences for non-compliant suppliers. The Utah Division of Consumer Protection is empowered to impose administrative fines of up to $2,500 for each individual violation of the law. This per-violation penalty structure means that for systemic non-compliance or repeated infractions, the cumulative fines could escalate rapidly, serving as a substantial deterrent. Beyond administrative fines, the Division also has the authority to pursue court actions against non-compliant suppliers. Such court actions could result in a broader range of remedies, including disgorgement of any profits gained through illegal practices, recovery of attorneys' fees and investigation costs incurred by the state, and other equitable or legal relief deemed appropriate by the court. This comprehensive penalty framework underscores the seriousness with which Utah treats violations of consumer protection and privacy in the AI mental health space. Critically, the law provides for an affirmative defense for suppliers. A supplier may avoid liability for certain violations if they can demonstrate that they have created, maintained, and implemented a comprehensive policy for their mental health chatbot that meets all the specific requirements outlined in the law, and that this policy has been duly filed with the Utah Division of Consumer Protection. This provision encourages proactive compliance and robust internal governance, offering a pathway to mitigate legal risk for responsible actors. The law also clarifies that its provisions do not bar the Division from bringing actions against suppliers under other relevant sections of the Utah Code, ensuring that existing consumer protection laws can still be applied concurrently.

Relationship to Other Instruments

Utah HB 452 is not a standalone piece of legislation but is strategically integrated into Utah's broader legal and regulatory landscape concerning artificial intelligence and data privacy. It forms a key part of a multi-pronged legislative effort by Utah to regulate AI, particularly building upon and expanding the scope of the Utah Artificial Intelligence Policy Act (UAIPA). The UAIPA, which was enacted in 2024, established foundational requirements for disclosures related to consumer interactions with generative AI, with heightened obligations for regulated professions, including licensed healthcare professionals. HB 452 specifically complements the UAIPA by targeting the unique and sensitive domain of mental health chatbots, introducing more granular and stringent requirements tailored to this specific application of AI. This demonstrates a layered regulatory approach, where a general AI policy is supplemented by sector-specific legislation where particular risks or vulnerabilities exist. Furthermore, the provisions within HB 452 concerning the protection of individually identifiable health information and the conditions for sharing such data are designed to be in compliance with the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a crucial federal law that sets national standards for protecting sensitive patient health information. By aligning with HIPAA, Utah HB 452 ensures a consistent and robust approach to health data privacy, harmonizing state-level AI regulations with established federal privacy standards in the healthcare sector and preventing conflicting obligations for entities operating across jurisdictions.

International Alignment

The search results do not explicitly detail any specific alignment of Utah HB 452 with international standards or regulations. As a state-level law within the United States, its primary focus is on addressing the unique regulatory needs and protecting citizens within Utah's specific jurisdiction. However, the underlying principles and objectives embedded within HB 452 are broadly consistent with emerging global trends and discussions in AI governance. The emphasis on transparency (e.g., disclosing AI interaction), data protection (e.g., prohibitions on selling/sharing sensitive health data), and consumer safeguarding (e.g., restrictions on targeted advertising, mechanisms for accountability) are common themes in evolving AI regulatory frameworks worldwide, such as the EU AI Act and various national strategies. While not explicitly international, the law reflects a global consensus on the importance of ethical AI development and deployment, particularly in sensitive sectors like healthcare and mental health. The focus on responsible innovation through policy requirements and a rebuttable presumption also aligns with efforts in other jurisdictions to foster trust in AI technologies while mitigating potential harms. Therefore, while not directly aligned with specific international instruments, the spirit and intent of HB 452 resonate with broader global efforts to establish responsible AI governance.

Implementation Timeline

Compliance Checklist

Sources and References