Law / United States / 
California
Artificial Intelligence in Health Care Utilization Review (SB 1120)
In force since .
An AI sector rules rule binding private bodies.
- Obligation class
- Governance, Prohibition
As of .
What it requires
- If you are a health care service plan (including a specialized plan) or a disability insurer (including a specialized health insurer) that uses an artificial intelligence, algorithm, or other software tool for utilization review or utilization management functions based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that does, ensure the tool bases its determination on the enrollee's or insured's medical or other clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in their record, and not solely on a group dataset
- Ensure the tool does not supplant health care provider decisionmaking, does not discriminate directly or indirectly against enrollees or insureds in violation of state or federal law, does not directly or indirectly cause them harm, and is fairly and equitably applied, including in accordance with applicable federal Department of Health and Human Services regulations and guidance
- Do not let the tool deny, delay, or modify health care services based, in whole or in part, on medical necessity; leave that determination to a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved
- Keep the tool open to inspection for audit or compliance reviews, review and revise its performance, use, and outcomes periodically to maximize accuracy and reliability, and describe its use and oversight in your written utilization review policies and procedures
- Use patient data only for the tool's intended and stated purpose, consistent with the Confidentiality of Medical Information Act and the federal Health Insurance Portability and Accountability Act, as applicable
- Comply with applicable federal rules and guidance issued by the federal Department of Health and Human Services on the use of artificial intelligence, algorithm, or other software tools
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A willful violation of the Knox-Keene Health Care Service Plan Act chapter that contains Section 1367.01 is punishable on conviction by a fine of up to $20,000, imprisonment, or both (Health and Safety Code Section 1390(a)).
Who enforces it
Enforcement body
The Director of the Department of Managed Health Care for a health care service plan, which may assess administrative penalties by order for each failure, and the Insurance Commissioner for a disability insurer; the State Department of Health Care Services may also inspect a plan's tool for audit or compliance reviews.
What this law does
SB 1120 was chaptered on as Chapter 879 of the Statutes of 2024. Health and Safety Code Section 1367.01, as amended by SB 1120, is effective per the code's own history note. Insurance Code Section 10123.135, as amended by SB 1120, is effective per the code's own history note.
A health care service plan, including a specialized health care service plan, that uses an artificial intelligence, algorithm, or other software tool for utilization review or utilization management functions based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that does, must comply with Section 1367.01 and ensure that the tool meets the conditions of subdivision (k).
The tool must base its determination on the enrollee's medical or other clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in the enrollee's record, and must not base its determination solely on a group dataset.
The tool must not supplant health care provider decisionmaking, must not discriminate, directly or indirectly, against enrollees in violation of state or federal law, and must be fairly and equitably applied, including in accordance with applicable regulations and guidance of the federal Department of Health and Human Services.
The tool must be open to inspection for audit or compliance reviews, its performance, use, and outcomes must be periodically reviewed and revised to maximize accuracy and reliability, and disclosures about its use and oversight must appear in the plan's written policies and procedures.
Patient data must not be used beyond its intended and stated purpose, consistent with the Confidentiality of Medical Information Act and the federal Health Insurance Portability and Accountability Act, as applicable, and the tool must not directly or indirectly cause harm to the enrollee.
The tool must not deny, delay, or modify health care services based, in whole or in part, on medical necessity, and a determination of medical necessity may be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved.
Artificial intelligence means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. The subdivision applies to utilization review or utilization management functions that prospectively, retrospectively, or concurrently review requests for covered health care services.
Section 1367.01 itself binds a health care service plan and any entity with which it contracts for services that include utilization review or utilization management functions. A disability insurer, including a specialized health insurer, that uses such a tool, or contracts with or otherwise works through an entity that does, must comply with Insurance Code Section 10123.135 and ensure that the tool meets the parallel conditions of subdivision (j).
If the director determines that a health care service plan has failed to meet any other requirement of Section 1367.01, the director may assess administrative penalties by order for each failure. A person who willfully violates a provision of the chapter that contains Section 1367.01 is punishable on conviction by a fine of not more than $20,000, imprisonment, or both.
When LexLint raises it
When your app profile says your app handles health records or is an insurer.