California SB 1120: Fighting Denied Prior Authorizations

California SB 1120 Utilization Review Defense for Denied Prior Authorizations

Merry AI · Thoughtfully curated clinical briefs.

Clinically reviewed by Dr. Marcus Vance, MD (Medical Informatics Advisor) · Coding review by Kaif R. (Clinical Informatics Specialist) · Sources: CY 2026 CMS PFS, NCCI Policy Manual.

Under California SB 1120 (effective January 1, 2025), a health plan or insurer cannot deny, delay, or modify a prior authorization based on medical necessity unless a licensed physician or competent health care professional made that decision after reviewing the patient's individual clinical record. Your defense starts by demanding proof of that human review. You then show that your documentation of individual clinical circumstances was ignored or overridden by group-level criteria.

This playbook gives outpatient specialty physicians a repeatable process. It covers the statutory tests, the documentation thresholds that win appeals, a cardiology worked example, and the escalation path to the Department of Managed Health Care (DMHC) Independent Medical Review. For state-by-state AI statutes, see the State AI Scribe Rules & Statutory Compliance Hub.

SB 1120 bars algorithms from making final medical necessity denials in California

SB 1120, the Physicians Make Decisions Act, amended Health and Safety Code Section 1367.01 and Insurance Code Section 10123.135. Plans may still use artificial intelligence, algorithms, or other software tools in utilization review. The statute limits what those tools can decide and how they must be governed.

The core prohibition is direct: an automated tool cannot supplant health care provider decision making. Any adverse determination based in whole or in part on medical necessity must be made by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved.

Key point: a software output is never a lawful final denial under SB 1120.

SB 1120 applies to DMHC plans and CDI insurers, not traditional Medicare

Confirm the payer's regulator first. SB 1120 applies to Knox-Keene health care service plans regulated by DMHC, including Medi-Cal managed care plans. It also applies to disability insurers regulated by the California Department of Insurance (CDI). Self-funded ERISA plans and traditional Medicare fall outside its reach.

Medicare Advantage denials need federal citations instead. Under 42 CFR 422.101(c), MA organizations must base medical necessity determinations on the individual patient's circumstances. CMS's February 2024 guidance states that an algorithm alone cannot satisfy that standard. The arguments run parallel to SB 1120, but the authorities you cite differ.

Every AI-assisted denial must pass five statutory tests under SB 1120

Use these five tests as your appeal checklist. A plan whose process fails any one of them has a statutory compliance problem, separate from the clinical merits of the request.

1. Individualized basis: The tool must consider the enrollee's medical or dental history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in the record. It cannot rely solely on a group dataset.
2. Human final determination: A licensed physician or competent health care professional must make any denial, delay, or modification based on medical necessity.
3. Nondiscrimination and fair application: The tool cannot discriminate, directly or indirectly, against enrollees, and it must be applied fairly and equitably.
4. Auditability: The tool, its policies, and its procedures must be open to inspection by DMHC or CDI, and its performance and outcomes must be reviewed and revised periodically.
5. Data limits: Patient data cannot be used beyond its intended and stated purpose.

A defensible appeal pairs statutory demands with documented MDM evidence

Winning appeals combine two arguments: procedural noncompliance and clinical necessity. Clinical evidence alone often loses to a reviewer applying a generic criteria set. A procedural argument alone invites a fresh denial that is better documented but just as wrong.

1. Identify the responsible reviewer: Section 1367.01(h)(4) requires denial communications to include the name and telephone number of the health care professional responsible for the decision. If either is missing, note it in your appeal.
2. Request the criteria applied: Ask for the specific clinical guideline, its version, and confirmation of whether an automated tool contributed to the determination.
3. Request a peer-to-peer review: Ask for a reviewer in the same or a similar specialty. Record the reviewer's name, specialty, the date, and what they acknowledged.
4. Cite the individual record: Quote the specific findings the denial ignored, such as LVEF values, intolerances, failed therapies, and imaging limitations.
5. Anchor to MDM documentation: Show that your note documents moderate or high complexity medical decision making, with explicit risk reasoning.
6. Set the escalation clock: State that you will file a DMHC complaint and support the patient's Independent Medical Review application if the denial stands.

Always document the peer-to-peer reviewer's name, specialty, and date.

Timeline enforcement matters as much. Under Section 1367.01, standard prior authorization decisions are due within five business days of receiving the information reasonably necessary to decide. Urgent requests are due within 72 hours. A delay is itself an adverse action that SB 1120 reserves for human decision makers.

Heart failure denials hinge on documented LVEF, GDMT history, and imaging limits

Consider a common cardiology scenario. A 58-year-old patient has I50.22 (ICD-10-CM) chronic systolic heart failure and I42.0 (ICD-10-CM) dilated cardiomyopathy. LVEF remains at 30% after more than 90 days of optimized guideline-directed medical therapy (GDMT). The cardiologist orders cardiac MRI (CPT 75561) to assess late gadolinium enhancement before an ICD decision.

The plan denies with a template rationale: "Echocardiogram within 12 months is sufficient for LV function assessment." That rationale is a group-level rule. It does not address the individual circumstances documented in the record.

The defense letter should state four individualized facts. First, the prior transthoracic echo (CPT 93306) was technically limited by poor acoustic windows. Second, the clinical question is myocardial scar burden and etiology, not ejection fraction alone. Third, the result directly changes the primary prevention ICD decision. Fourth, GDMT titration is documented with dates and doses, including any intolerance to sacubitril/valsartan or SGLT2 inhibitors.

Then apply the SB 1120 argument. The denial applied a dataset-level rule without engaging the documented findings. Request written confirmation that a cardiologist, or a physician competent in advanced cardiac imaging, personally reviewed those specific findings. For more cardiology-specific language, see the California SB 1120 Utilization Review Defense guide.

Clinical indicators and MDM thresholds determine which denials are defensible

Use this table to match each common outpatient cardiology denial with the documentation and the statutory defense that answer it.

CPT G2211 captures longitudinal complexity worth $15,600+ annually

The same longitudinal documentation that wins prior authorization appeals also supports CPT G2211, the Medicare visit complexity add-on. G2211 applies when the practitioner is the continuing focal point for a patient's care or provides ongoing care for a single serious or complex condition, such as chronic systolic heart failure.

The revenue math is straightforward. At roughly $16 per eligible claim (the CY 2026 national rate varies with the conversion factor and locality), about 975 eligible Medicare visits per year (roughly 20 per week) produces $15,600+ in annual revenue that many specialty practices currently leave uncaptured.

Under CY 2026 rules, G2211 remains payable with modifier 25 when the same-day service is an annual wellness visit, a vaccine administration, or a Medicare Part B preventive service. Document the longitudinal relationship explicitly in every eligible note.

Longitudinal documentation supports both appeals and G2211 capture.

AI scribe documentation must respect AB 3030 patient disclosure rules

AI-generated clinical notes strengthen appeals because they capture the individualized detail that SB 1120 requires reviewers to evaluate. The physician must still review, edit, and sign each note. Under SB 1120, the plan's tool cannot replace the reviewing physician, and the same principle applies to your own documentation.

Patient-facing communications carry separate obligations. AB 3030 requires a disclaimer and contact instructions when generative AI produces patient clinical communications, unless a licensed provider reads and reviews the message first. Review the specifics in California AB 3030 Generative AI Disclosure Requirements.

AI scribe costs equal 1.3% of a fully loaded MA salary

Appeal preparation is labor intensive. Many practices assign a medical assistant to pull records, draft letters, and track deadlines. A fully loaded MA costs about $48,000 per year once wages, benefits, payroll taxes, and overhead are included.

Merry AI Pro costs $648 per year ($54 per month, billed annually). That equals 1.3% of the $48,000 MA labor denominator. The subscription produces structured, physician-signed notes with the GDMT dates, LVEF values, and MDM reasoning that appeal letters quote directly.

Unresolved denials escalate to DMHC Independent Medical Review

The escalation path is defined. The patient, or the physician as the patient's authorized representative, files an internal grievance with the plan. Plans must resolve standard grievances within 30 days and urgent grievances within 72 hours.

If the denial stands, the patient may apply for Independent Medical Review (IMR) through DMHC, or through CDI for insured products, within six months. Standard IMR decisions are issued within 30 days, and expedited reviews within 3 days. Plans must comply with IMR decisions that overturn a denial.

Submit the complete appeal file to the IMR reviewer. Include the denial letter, your criteria request, the peer-to-peer log, the signed clinical notes, and your SB 1120 compliance objections. Independent physician reviewers evaluate the individual record, which is exactly where well-documented cases prevail.

Frequently asked questions about California SB 1120 utilization review defense

Does SB 1120 ban AI in utilization review?

No, SB 1120 does not ban AI. Plans may use algorithms to screen, triage, or approve requests, but any denial, delay, or modification based on medical necessity must be made by a licensed physician or competent health care professional who reviewed the enrollee's individual clinical circumstances.

Does SB 1120 apply to Medicare Advantage denials?

Generally no. SB 1120 governs DMHC-licensed health plans and CDI-regulated disability insurers, including Medi-Cal managed care plans. Medicare Advantage is federally regulated, but CMS rules similarly require individualized medical necessity determinations, so cite 42 CFR 422.101(c) and the CMS February 2024 FAQ for MA appeals.

What should a physician request after an SB 1120 denial?

Request the name, specialty, and license of the reviewing professional, the clinical criteria applied, and confirmation of whether an algorithm contributed. Health and Safety Code 1367.01 already requires denial letters to identify the responsible professional and a telephone number, enabling a direct peer-to-peer discussion.

How fast must California plans decide prior authorization requests?

Standard prior authorization decisions are due within five business days of receiving necessary information, and urgent requests within 72 hours when delay threatens the patient's life, health, or ability to regain maximum function. Missed deadlines and unexplained delays can be reported to DMHC as complaints.

Can an AI scribe help defend denied prior authorizations?

Yes, when the physician reviews and signs the note. An AI scribe captures LVEF values, GDMT trials, symptom class, and MDM reasoning at the point of care, producing the individualized record SB 1120 requires reviewers to evaluate. Patient-facing generative AI messages still require AB 3030 disclosure.