Policies with respect to using and overriding AI/CDSS

(a) In general A covered entity that uses AI/CDSS shall— (1) adopt and adhere to a policy with respect to such usage— (A) that ensures that AI/CDSS outputs are not substituted for the independent judgment of a health care professional employed by, or otherwise engaged in the performance of work for remuneration for, the covered entity while such health care professional is acting in the scope of practice of such health care professional; (B) that allows such a health care professional to override an AI/CDSS output in a timely manner if, at the time of the override, in the judgment of the health care professional acting in the scope of practice of the health care professional, such an override is appropriate for the patient, or as necessary to comply with applicable law, including civil rights law; (C) that allows health care professionals and their representatives to provide feedback on AI/CDSS, including incorrect or biased outputs that require frequent override; and (D) that prohibits the sharing of override data on— (i) a specific health care professional; or (ii) a group of health care professionals when the identity of those professionals can be reasonably inferred; (2) inform health care professionals employed by, or otherwise engaged in the performance of work for remuneration for, the covered entity, and the representatives of such health care professionals, of the policy under paragraph (1), including the presence of AI/CDSS in the workplace and the ability of such health care professionals to override an AI/CDSS output; (3) provide training to such health care professionals on— (A) how to use AI/CDSS; (B) the circumstances where an AI/CDSS override is appropriate; (C) how to override an AI/CDSS output; (D) AI/CDSS development processes and any data or other inputs involved in such processes; and (E) any potential limitations for AI/CDSS, including any potential areas of bias in the AI/CDSS; (4) establish and maintain an AI/CDSS committee that shall— (A) convene upon the date that is later of— (i) the date of the adoption of AI/CDSS at the covered entity; or (ii) 120 days after the date of enactment of this Act; (B) be comprised of at least as many non-managers as managers; (C) include membership of any labor organization, or other authorized representative, of health care professionals employed by, or otherwise engaged in the performance of work for remuneration for, the covered entity; (D) provide consultation to the covered entity in developing policies and practices related to the use of AI/CDSS, including policy required under subparagraphs (A) through (D) of paragraph (1); and (E) meet at least quarterly to— (i) review implementation of policies adopted by the covered entity with respect to AI/CDSS; and (ii) report to the covered entity on findings and suggestions for improvements; and (5) review— (A) all findings and suggestions from the AI/CDSS committee provided under paragraph (4)(E)(ii); and (B) any other feedback from health care professionals employed by, or otherwise engaged in the performance of work for remuneration for, the covered entity on the AI/CDSS technology and the policies of the entity with respect to such technology, including by reviewing any such feedback on patterns of issues with the AI/CDSS, such as incorrect or biased outputs that require frequent override. (b) Data sharing exception The prohibition under subsection (a)(1)(D) shall not apply— (1) in a case in which a covered entity is informing a patient or an authorized representative of a patient about a decision rendered in the administration of the care of such patient; or (2) in a case of a civil, criminal, or administrative action involving medical malpractice, negligence, or violation of any law. (c) Oversight mechanism Nothing in this Act shall prohibit a covered entity from reviewing the performance outcomes of AI/CDSS.