PubLedge

Filing is a condition of an affirmative defense, not a free-standing mandate. A mental health chatbot supplier has an affirmative defense against §58-1-501(1)-(2) unauthorized-practice actions if it shows that it created, maintained, and implemented a written policy meeting §58-60-118(3), including the fifteen procedure elements in (3)(c)(i)-(xv); maintains the development and implementation documentation required by (2)(b); filed the policy with Utah's Division of Consumer Protection; and complied with the filed policy at the time of the alleged violation.

What Counts

• Written policy stating the chatbot's intended purposes, abilities, and limitations and describing all fifteen procedure elements in §58-60-118(3)(c) (therapist involvement, clinical best practices, pre-release and ongoing testing, foreseeable-harm identification, user reporting, risk-of-harm protocols, mitigation actions, real-time acute-risk protocols, regular safety reviews, safe-use instructions, AI-awareness, purpose and limitation awareness, safety over engagement or profit, non-discrimination, and HIPAA and consumer-protection compliance)
• Separate documentation of foundation models, training data, federal health privacy compliance, user data practices, and accuracy, reliability, fairness, and safety efforts (§58-60-118(2)(b))
• Policy filed with the Utah Division of Consumer Protection along with the required fee (the division may also impose an annual filing fee)
• Operational conformance to the filed policy at the time of the challenged conduct

What Does Not Count

• Internal policy that is never filed with DCP
• Filed policy that omits any of the fifteen elements
• Operating materially out of line with the filed policy (defense unavailable)
• Defense asserted against DCP enforcement action (only unauthorized-practice claims qualify)

Associated records (including proposals)