California SB 1120: Physician Review Rules for AI UM Denials

California SB 1120 Physician Review Requirements for AI Utilization Management Denials: The 2026 Clinical Playbook

Merry AI · Thoughtfully curated clinical briefs.

Clinically reviewed by Dr. Marcus Vance, MD (Medical Informatics Advisor) · Coding review by Kaif R. (Clinical Informatics Specialist) · Sources: CY 2026 CMS PFS, NCCI Policy Manual.

California SB 1120 requires that any denial, delay, or modification of care based on medical necessity be made by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issue, never by an artificial intelligence, algorithm, or software tool acting alone. The law also requires that any AI tool used in utilization review or utilization management base its output on the individual enrollee's medical history and clinical circumstances as presented by the requesting provider, not solely on a group dataset.

For practice administrators and CMOs, this changes the denial fight. SB 1120 (the Physicians Make Decisions Act, effective January 1, 2025) amended Health and Safety Code Section 1367.01 and Insurance Code Section 10123.135. It gives your clinicians an enforceable expectation of individualized, human-made adverse determinations. This playbook shows how to document, appeal, and audit-proof against algorithm-driven denials in 2026. It is operational guidance, not legal advice.

SB 1120 bars California plans from letting algorithms issue final medical necessity denials

The statute applies to health care service plans licensed by the Department of Managed Health Care (DMHC), disability insurers regulated by the California Department of Insurance (CDI), and any entity those plans contract with to perform utilization review. Medi-Cal managed care plans operating under Knox-Keene licensure are included. Self-funded ERISA plans generally fall outside state jurisdiction, which matters when you triage which denials to escalate under state law.

The core prohibition is narrow but powerful. AI may assist with intake, triage, and approvals. It may not supplant health care provider decision-making. When the outcome is adverse (a denial, a delay, or a modification of the requested service), a licensed clinician must review the requesting provider's recommendation, the patient's medical history, and the individual clinical circumstances before the determination is issued.

Key rule: AI may approve care; only licensed clinicians may deny it.

Track all state-level variations through the State AI Scribe Rules & Statutory Compliance Hub, because several states introduced SB 1120-style bills in 2025 and 2026 sessions, and multistate groups face overlapping requirements.

Eight statutory guardrails govern every AI tool used in California utilization review

SB 1120 lists specific conditions an AI, algorithm, or software tool must satisfy before a plan may use it in utilization review. Your appeal letters should map the denial against each one.

• Individualized clinical basis: Determinations rest on the enrollee's medical history, the provider's recommendation, and clinical information in the record.
• No group-only reliance: The tool may not base decisions solely on a group dataset.
• No supplanting clinicians: The tool cannot replace provider decision-making.
• Nondiscrimination: Use must not discriminate directly or indirectly against enrollees, consistent with state and federal law.
• Fair and equitable application: The tool must be applied consistently, including under applicable HHS regulations and guidance.
• Open to inspection: The tool and its written policies must be available for audit and compliance review by DMHC or CDI.
• Periodic review: Performance, use, and outcomes must be reviewed and revised to maximize accuracy and reliability.
• Data limits and harm avoidance: Patient data may not be used beyond its stated purpose, and the tool may not directly or indirectly cause harm to the enrollee.

Federal rules now reinforce this standard. The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) requires impacted payers, including Medicare Advantage and Medi-Cal managed care, to return standard prior authorization decisions within 7 calendar days and expedited decisions within 72 hours beginning in 2026, with a specific reason for every denial. FHIR-based Prior Authorization APIs follow in January 2027. Separately, CMS-4201-F requires Medicare Advantage plans to base medical necessity determinations on the individual patient's circumstances rather than an algorithm alone.

State timelines require standard decisions in 5 business days, urgent in 72 hours

Existing Section 1367.01 timelines still apply, and SB 1120 ties them to the human reviewer. Prospective and concurrent decisions must be made within 5 business days of receiving information reasonably necessary to decide. Urgent requests (an imminent and serious threat to health) require a decision within 72 hours. Retrospective decisions must be made within 30 days.

Denial communications must name the responsible reviewer. Written decisions must include a clear explanation of the clinical reasons, the criteria or guidelines used, and the name and telephone number of the health care professional responsible for the determination. A denial letter lacking a named, credentialed clinician is your first appeal ground.

Audit flag: No named reviewer in the letter signals a likely SB 1120 violation.

Practices win SB 1120 appeals by documenting individualized circumstances, not template language

An algorithm matches criteria; a reviewing physician must weigh the patient in front of you. Your documentation should make generic criteria matching visibly inadequate. Every prior authorization packet should state why this patient differs from the population default.

Cardiology example: chronic systolic heart failure, I50.22

A patient coded as I50.22 (ICD-10-CM), chronic systolic (congestive) heart failure, is referred for cardiac MRI or device evaluation. An automated tool flags "recent echocardiogram on file" and recommends denial. The defensible note documents current LVEF with date and modality, NYHA class, GDMT agents with doses and titration dates, intolerance history, and the specific clinical question the MRI answers (for example, infiltrative cardiomyopathy suspicion that echo cannot resolve).

Cardiology groups facing repeat denials should use the California SB 1120 Utilization Review Defense template set, which maps device and imaging criteria (including CMS NCD 20.4 thresholds of LVEF at or below 35% after at least 3 months of optimized GDMT) to required individualized findings.

Orthopedic example: unilateral primary osteoarthritis, right knee, M17.11

A total knee arthroplasty request for M17.11 (ICD-10-CM), unilateral primary osteoarthritis of the right knee, is modified to "additional physical therapy." The rebuttal documents Kellgren-Lawrence grade from weight-bearing films, validated functional scores (KOOS JR or WOMAC), dated failures of NSAIDs, injections, and supervised therapy, and comorbidities that make prolonged conservative care unsafe. The appeal then asks the reviewer to explain which individual findings were considered.

Comparison table: clinical indicators, MDM thresholds, and audit defenses by scenario

Use this table during pre-submission chart review. Each row pairs the payer's likely algorithmic trigger with the documentation that forces individualized physician review.

A seven-step denial response protocol for practice administrators

Standardize your denial workflow so every adverse determination receives the same SB 1120 analysis within 48 hours of receipt.

1. Log the denial and timeline: Record receipt date and verify the 5-business-day or 72-hour clock was met.
2. Confirm the named reviewer: Check that the letter identifies a licensed clinician and phone number.
3. Request written criteria: Ask for the guideline or clinical criteria used, which plans must disclose.
4. Test for individualized reasoning: Identify whether the rationale cites any patient-specific finding.
5. Schedule peer-to-peer review: Ask for a reviewer in the same or similar specialty.
6. File the written appeal: Cite Section 1367.01 as amended and attach dated objective findings.
7. Escalate when unresolved: Support the patient's grievance, DMHC complaint, or Independent Medical Review.

Benchmark: Track overturn rates by payer to document patterned algorithmic denials.

Ambient documentation must satisfy AB 3030 while strengthening SB 1120 appeals

AI-generated notes help appeals only when they capture specific, dated clinical detail. Ambient scribes record the reasoning clinicians verbalize (failed therapies, functional limits, risk discussions) that often never reaches a templated note. That detail is exactly what SB 1120 requires reviewers to consider.

Patient-facing outputs carry separate obligations. When generative AI produces patient communications about clinical information, California law requires a disclaimer and instructions for reaching a human provider unless a licensed clinician reviews the message first. Review the full requirements in California AB 3030 Generative AI Disclosure Requirements.

G2211 complexity capture recovers $15,600+ annually from the same documentation

The documentation that defeats denials also supports HCPCS G2211, the visit complexity add-on for longitudinal care of a single serious or complex condition. Heart failure management under I50.22 and ongoing osteoarthritis management under M17.11 are classic longitudinal relationships. At roughly $16 per eligible visit, capturing 20 additional qualifying visits per week across 48 working weeks recovers $15,600+ per clinician annually.

CMS permits G2211 with modifier 25 when the E/M visit occurs on the same day as an annual wellness visit, vaccine administration, or Medicare Part B preventive service. It remains non-billable when the same-day modifier 25 E/M is paired with a procedure. Documentation must show the continuing, longitudinal nature of the relationship, not a one-time consult.

Merry AI Pro costs 1.3% of a fully loaded medical assistant

A fully loaded medical assistant costs approximately $48,000 per year including wages, benefits, payroll taxes, and training. Merry AI Pro costs $54 per month on annual billing, or $648 per year, which equals 1.3% of that labor denominator. The comparison is not replacement; it is reallocation of MA hours from chart abstraction and appeal assembly to patient-facing work.

Combined with G2211 recovery and fewer lost authorizations, the return calculation for a single clinician becomes straightforward: $648 in software cost against $15,600+ in recovered complexity revenue, before counting overturned denials.

ROI anchor: $648 per year against $15,600+ in recovered G2211 revenue.

Frequently asked questions about California SB 1120 physician review requirements

Does SB 1120 apply to physician practices or only health plans?

SB 1120 applies to California health care service plans regulated by the DMHC and disability insurers regulated by the Department of Insurance, including contracted entities performing utilization review. Physician practices are not regulated parties, but they gain enforceable rights to individualized review, written denial rationale, and a licensed clinical decision-maker.

Can a health plan still use AI to approve prior authorization requests?

Yes. SB 1120 restricts adverse determinations, not approvals. Plans may use algorithms to triage requests and auto-approve care that meets criteria. Any denial, delay, or modification based on medical necessity must be made by a licensed physician or qualified health care professional competent in the specific clinical issue.

How should a practice respond to a suspected algorithm-generated denial?

Request the written criteria and the name and credentials of the reviewing clinician, then demand peer-to-peer review. Cite Health and Safety Code Section 1367.01 as amended by SB 1120. If the rationale ignores individual clinical documentation, file a grievance and support the patient's DMHC Independent Medical Review request.

Does AI-generated patient communication create AB 3030 obligations for my practice?

AB 3030 applies when generative AI produces patient communications about clinical information. Messages reviewed and signed by a licensed clinician fall under the human-review exemption. Unreviewed AI-generated patient messages require a disclaimer and instructions for reaching a human provider, whether delivered in writing, audio, or video.

What documentation most often overturns AI-driven cardiology or orthopedic denials?

Specific, dated objective findings defeat generic criteria matching. For I50.22, document current LVEF, NYHA class, and GDMT titration history. For M17.11, document Kellgren-Lawrence grade, functional scores, and dated conservative therapy failures. Reviewers must consider these individual circumstances under SB 1120, so omissions in their rationale become appeal grounds.