Statutory Core: Two Coupled Obligations for California Multi-Specialty Groups
Under California AB 3030 and SB 1120, a multi-specialty organization faces two distinct but interlocking duties that most compliance programs mistakenly treat as a single generic "AI policy." AB 3030, codified at Health & Safety Code §1339.75, governs how generative AI touches patient-facing clinical communication. SB 1120, the Physicians Make Decisions Act, governs how AI, algorithms, and software may participate in medical-necessity determinations. The first is a disclosure and documentation-engineering problem; the second is a clinical-rationale specification. Treating them together, but implementing them separately, is the correct posture for cardiology, orthopedics, oncology, endocrinology, and every downstream service line sharing a common EHR.
AB 3030 applies to health facilities, clinics, physicians' offices, and group practices that use generative AI to create written or verbal patient communications involving clinical information. The statute defines "patient clinical information" as material relating to a patient's health status and care, and it deliberately excludes administrative content—scheduling, billing, appointment reminders, and other clerical matters. That scope distinction is the first design decision in any deployment: a portal message confirming a Tuesday appointment is untouched, while an AI-drafted visit summary discussing imaging findings, a diagnostic explanation, or a treatment-plan letter falls squarely within the statute.
SB 1120 prohibits an algorithm, AI, or software tool from denying, delaying, or modifying health care services based, in whole or in part, on medical necessity. The determination must instead be made by a licensed physician or qualified provider with expertise in the specific clinical issue, using the patient's medical history, individual clinical circumstances, and other relevant record information. Although the statutory duty formally binds insurers and plans, the operational leverage for a provider group sits in documentation quality—both to satisfy the payer's mandated human reviewer and to contest any denial that behaves like an automated score. For statutory-code context and the underlying evidence base clinicians cite in these rationales, the National Library of Medicine archive at https://www.ncbi.nlm.nih.gov/pmc/ remains the authoritative reference layer.
AB 3030 Disclosure Design Across Communication Modalities
When generative AI produces a communication containing clinical information, AB 3030 requires two elements together: a clear disclaimer stating the communication was generated by AI, and instructions for contacting a human health care provider or appropriate staff member. The statute is unusually specific about placement, and that specificity must be encoded into your communication layer rather than left to individual clinician discretion.
For written communications such as letters, emails, and portal messages, the disclosure must appear prominently at the beginning of each communication. For continuous online interactions—chat-based telehealth or triage chatbots—the disclosure must be displayed prominently throughout the interaction, not merely once at intake. For audio communications, including scripted post-operative instruction calls, a verbal disclaimer is required at both the start and the end of the interaction. For video communications, a visual disclaimer must persist throughout the encounter. A multi-specialty group cannot maintain four inconsistent implementations; it needs one centralized disclosure engine that renders the correct modality-specific pattern automatically.
The most consequential interpretive point is that disclosure must persist inside the record itself. Compliance commentary is consistent that an AI-generated clinical note released to a portal must embed the disclosure within the body of the signed note, so it survives PDF export, printing, HIE transmission, CCD exports, and record-request fulfillment. This converts AB 3030 from a messaging-banner exercise into a documentation-engineering discipline. We write the disclosure as structured text at the moment of signature rather than injecting it only at the portal display layer, because downstream interfaces routinely strip presentation-only elements.
The Human-Review Exemption and How to Earn It
AB 3030 exempts any AI-generated communication that is read and reviewed by a licensed or certified provider before dissemination. This exemption is the primary tool for reducing disclosure overhead in high-trust specialties—but it is only defensible when review is genuine. The failure mode is treating a default signature as review. Our internal standard requires the clinician to open the draft, materially read it, and either edit or affirmatively approve the clinical content. For oncology treatment-explanation letters or complex cardiology results discussions, we route drafts through mandatory clinician editing so the exemption applies rather than relying on an attached disclaimer.
SB 1120 and the Physician-Attested Rationale Specification
For every service that is prior-authorization-relevant—a heart-failure medication, an advanced imaging study, a spine intervention, a course of rehabilitation—the encounter note should function as a medical-necessity specification. That means an explicit link between diagnosis, severity, the requested service, and the objective clinical evidence supporting it. SB 1120 guidance emphasizes that review cannot be one-size-fits-all; it must reflect the individual patient's circumstances, which is precisely the information a structured note can supply and an algorithm cannot manufacture.
Structured, machine-readable fields carry the weight of this requirement across specialties. Cardiology captures left ventricular ejection fraction, NYHA class, and prior therapies. Orthopedics and physical medicine capture range-of-motion measurements, functional scores, and imaging correlates. Oncology captures staging and documented prior-line failures. Endocrinology captures A1c trajectory and prior medication trials. When these fields export cleanly to the payer's prior-authorization interface via X12 or FHIR, the plan's mandated human reviewer receives exactly the individualized clinical information SB 1120 obligates them to consider, and your appeal—if needed—already contains the physician-attested rationale.
Comparative Architecture: Manual, Generic AI, and Compliance-Native
The distance between these three approaches is easiest to see when each obligation is mapped against implementation reality. The table below contrasts traditional manual charting, a standard generic AI scribe, and the Merry AI compliance architecture across the statutory dimensions that actually generate liability.
| Compliance Dimension | Manual Charting | Standard Generic AI Scribe | Merry AI Compliance Architecture |
|---|---|---|---|
| AB 3030 disclosure placement | Not applicable, but no AI-detection audit trail | Website banner or absent; not embedded in note body | Disclosure written as structured text at signature; persists through export and HIE |
| Human-review exemption | Inherent but undocumented | No structured review event captured | Captures reviewer identity, timestamp, and edit-versus-approve flag as auditable metadata |
| SB 1120 rationale capture | Free-text, inconsistent across clinicians | Narrative only; objective metrics often omitted | Specialty structured fields (LVEF, ROM, staging) plus physician attestation prompt |
| Source audio / transcript retention | None | Often retained for model training (discovery exposure) | RAM session buffer only; shredded at generation, HIPAA §164.312 aligned |
| Decision-support separation | Not applicable | Blurs advisory ranking with output | Algorithmic flags logged as advisory only; final decision clinician-recorded |
| Audit defensibility | Labor-intensive, retrospective | Fragmented across vendor logs | Unified lifecycle log for disclosure, review, rationale, and shredding |
Physician Attestation and Appeal Alignment
Each specialty rationale template terminates in a physician statement attesting to medical necessity based on the documented findings, and appeal letters explicitly reference the licensed physician's expertise in the specific clinical issue. Maintaining audit logs of which physician endorsed a contested rationale, and when, creates the human-review chain that displaces a purely algorithmic denial narrative. Standardized templates for cardiology, orthopedics, and oncology are published in the Scribing Template Directory, where disclosure language and attestation prompts can be validated before deployment.
Software Configuration and Governance for Sustained Compliance
Operationalizing both statutes requires centralized configuration rather than clinician-by-clinician workarounds. The EHR and communication layer must detect and tag any AI-generated or AI-drafted content, pass that tag into the disclosure engine to trigger the correct modality-specific pattern, and enforce role-based controls that let licensed clinicians mark drafts as reviewed and approved. Export integrity checks confirm that embedded disclosures survive CCD, HL7, PDF, and printed outputs. On the SB 1120 side, structured clinical fields must export to prior-authorization platforms, internal UM denials must be physician-signed with a structured rationale, and any algorithmic triage must be logged as advisory only.
Governance closes the loop through auditing and training. AB 3030 audits sample AI-generated notes released to portal, telehealth transcripts, and chat logs to confirm disclosures are present where required, human-review flags are correctly applied, and administrative messages are properly excluded. SB 1120 audits review denial and appeal cases to confirm reliance on clinician-reviewed history and individualized circumstances. Clinician education covers when disclosures appear, how to perform defensible review, and how to craft rationales anchored to LVEF, ROM, and comparable metrics. To pressure-test your current AB 3030 disclosure placement and SB 1120 rationale capture against these standards, Book a 15-Minute Workflow Audit with our clinical informatics team.
