HB 3647 creates the "Oklahoma Health Care Transparency Initiative" requiring most licensed health care providers in Oklahoma to submit anonymized claims and enrollment data to a state-designated health information exchange starting July 1, 2026. It establishes an Office within the Oklahoma Health Care Authority to oversee the initiative, with limited exemptions for providers facing financial hardship, small practice size, or technological limitations. The law mandates strict confidentiality and privacy protections for patient data, aligning with federal standards like HIPAA, and prohibits misuse of the collected information. This initiative aims to build a centralized database for health care cost and utilization data, primarily affecting hospitals, clinics, and insurers participating in Oklahoma's health care system.
HB 3545 restricts how Oklahoma state agencies can use artificial intelligence, directly affecting all state departments, commissions, and offices. It prohibits AI from manipulating behavior, enabling discriminatory classification, conducting general public surveillance via facial recognition (except for locating missing persons), or creating malicious deepfakes. The bill requires human review and approval for high-risk AI decisions (like benefits or legal rights), mandates disclosure when AI generates content, and requires agencies to inform users they're interacting with AI. Agencies must remove prohibited systems by September 2027, report compliance to the Office of Management and Enterprise Services (OMES), and submit annual reports detailing AI use starting December 2026.
HB 4132 creates liability protection for Oklahoma counties and municipalities if they adopt specific cybersecurity frameworks (NIST, CIS, or ISO standards) and meet compliance requirements. To qualify, local governments must annually certify compliance, maintain detailed security documentation, and undergo independent cybersecurity reviews every three years. This bill directly affects county and municipal operations by reducing legal risk from data breaches when these steps are followed. It does not change existing cybersecurity practices but provides a legal shield for entities that implement recognized standards. The law takes effect November 1, 2026.
SB 546 establishes data privacy rights for Oklahoma residents by requiring businesses that process personal data (referred to as "controllers") to honor consumer requests about their information. It mandates clear privacy notices, prohibits deceptive "dark patterns" for consent, and gives consumers rights to access, correct, or delete their data. The law excludes health data covered by HIPAA, certain nonprofit organizations, and educational institutions. Businesses must respond to requests within specific timeframes and implement data protection measures, with enforcement by the Attorney General.
HB 2769 amends Oklahoma's military code to update the Oklahoma National Guard's structure and personnel rules. It requires the Adjutant General to have at least 8 years of Oklahoma National Guard service (previously 3 years) and sets their pay at Major General level. The bill creates the Oklahoma National Guard CareerTech Assistance Program, which provides education funding through a revolving fund for eligible Guard members pursuing career-focused training. It also adjusts nonjudicial punishment procedures, clarifies Adjutant General authority, and modifies eligibility for retirement benefits. The law directly affects Oklahoma National Guard members, leadership, and administrative staff.
Oklahoma Senate Bill 224 creates the Oklahoma Education and Workforce Efficiency Data System (EDS), a secure platform for state agencies to share de-identified student and workforce data across education and employment systems. It directly affects state agencies like the Oklahoma Department of Education, Workforce Commission, and higher education bodies by enabling data integration for improving educational outcomes and taxpayer return on investment. Key provisions include requiring strict privacy compliance (under FERPA and similar laws), prohibiting collection of sensitive data (religion, medical information), and establishing a Governance Council to oversee data access and vendor selection. The system aims to support evidence-based decisions while ensuring data privacy through formal agreements and anonymization for approved users like researchers.
SB 146 expands mental wellness services provided by Oklahoma's Department of Public Safety to include retirees of public safety personnel (such as police and firefighters), in addition to current employees. It creates a dedicated revolving fund (Section 9102) to finance these services and strengthens privacy protections by prohibiting the sharing of individual mental health data without consent, while allowing aggregate data use for policy improvements (Section 9101). The bill also mandates that all Mental Wellness Division resources operate separately from other department divisions. These changes took effect November 1, 2025, after becoming law without the Governor's signature on May 29, 2025.
HB 2258, the Uniform Electronic Legal Materials Act, requires Oklahoma state agencies to publish key legal documents (like session laws, administrative codes, court decisions, and agency rules) electronically in an official, authenticated format. It mandates that official publishers (such as the Secretary of State and courts) designate electronic records as official, authenticate them to ensure they are unaltered, preserve them securely, and make them permanently accessible to the public. This law directly affects state agencies that produce legal materials, establishing that authenticated electronic versions are legally valid and presumed accurate unless proven otherwise. The bill shifts how Oklahoma makes official legal records available, prioritizing digital access while ensuring reliability and security.
HB 2289 creates the Oklahoma Elected Official and Judicial Security and Privacy Act of 2025, requiring state agencies to remove specific personal details - including home addresses, phone numbers, school locations, and children's information - from public records for elected officials, judges, and their immediate families. Agencies must delete such "covered information" within 72 hours of a request and cannot publicly display it. The law also mandates annual reports to the legislature on security spending and data collection methods related to protecting these individuals. It became law without the Governor’s signature on May 28, 2025.
SB 626, the Security Breach Notification Act, requires businesses to notify Oklahomans when specific personal data used to verify identity (like Social Security numbers or account credentials) is compromised in a security breach. This law directly affects businesses and organizations that collect or store such identifying information, including credit bureaus, healthcare providers, and financial institutions. The key provision clarifies that notifications are mandated only when data enabling authentication of an individual is breached, not for all types of data. The law became effective on May 28, 2025, without the Governor's signature.
