PubLedge

A mental health chatbot supplier must draft, file with Utah's Division of Consumer Protection, and operationally comply with a fifteen-element written safety policy covering purposes, clinical practices, testing, risk protocols, user reporting, HIPAA posture, and more. Compliance with the filed policy at the time of an alleged violation provides an affirmative defense against §58-1-501(1)-(2) unauthorized-practice actions.

What Counts

• Written policy addressing all fifteen statutory elements (intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance, and foundation-model/training-data/accuracy documentation)
• Policy filed with the Utah Division of Consumer Protection along with the annual fee
• Operational conformance to the filed policy at the time of the challenged conduct

What Does Not Count

• Internal policy that is never filed with DCP
• Filed policy that omits any of the fifteen elements
• Operating materially out of line with the filed policy (defense unavailable)
• Defense asserted against DCP enforcement action (only unauthorized-practice claims qualify)

Implementing Legal Instruments