SB 1120 Physician Oversight: AI Utilization Review Defense

California SB 1120 Physician Oversight Mandates: The 2026 AI Utilization Review Defense Playbook

Merry AI · Thoughtfully curated clinical briefs.

California SB 1120 requires that any denial, delay, or modification of care based on medical necessity be decided by a licensed physician or qualified licensed health care professional, never by an AI algorithm alone. For practice administrators and CMOs, the strongest defense against algorithmic denials is documentation that forces a human reviewer to engage with the individual patient's clinical circumstances, because the statute requires plans to evaluate exactly that record.

This playbook explains the statute's criteria, maps them to cardiology and orthopedic prior authorization scenarios, and gives operational steps for appeals, audit readiness, and documentation economics. For a state-by-state view of related obligations, see the State AI Scribe Rules & Statutory Compliance Hub.

SB 1120 bars AI from making final medical necessity denials in California

The Physicians Make Decisions Act (SB 1120) was signed in September 2024 and took effect January 1, 2025. It applies to health care service plans regulated by the Department of Managed Health Care (DMHC) under the Knox-Keene Act, and to disability insurers regulated by the California Department of Insurance (CDI). Plans and their contracted utilization review organizations may still use AI tools, but those tools cannot replace clinical judgment.

The core prohibition is direct: an AI, algorithm, or other software tool cannot deny, delay, or modify health care services based in whole or in part on medical necessity. That determination must be made by a licensed physician, or a licensed health care professional competent to evaluate the specific clinical issues, after reviewing the requesting provider's recommendation, the enrollee's medical history, and individual clinical circumstances.

AI may screen requests. Only a licensed clinician may deny them.

SB 1120 amends Health and Safety Code 1367.01 and Insurance Code 10123.135

The statute adds enforceable criteria to existing utilization review law. When a plan uses an AI tool for utilization review or utilization management, the tool must satisfy each of the following requirements.

• Individualized clinical basis: Determinations must rely on the enrollee's medical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in the medical record.
• No group-dataset-only decisions: The tool cannot base its determination solely on a group dataset.
• No supplanting of providers: The tool cannot supplant health care provider decision-making.
• Nondiscrimination: Use of the tool cannot discriminate, directly or indirectly, against enrollees in violation of state or federal law.
• Fair and equitable application: The tool must be applied consistent with applicable regulations and guidance.
• Audit access: The tool and its written policies and procedures must be open to inspection for audit or compliance reviews by DMHC or CDI.
• Periodic review: Performance, use, and outcomes must be periodically reviewed and revised to maximize accuracy and reliability.
• Data use limits: Patient data cannot be used beyond its intended and stated purpose, consistent with California and federal privacy law.
• No patient harm: The tool cannot directly or indirectly cause harm to the enrollee.

Existing timeframe rules still apply. Under Section 1367.01, routine prospective and concurrent decisions generally must be made within 5 business days of receiving necessary information, and urgent requests involving an imminent and serious threat to health within 72 hours. Denial communications must include the name and telephone number of the health care professional responsible for the decision. That requirement becomes a practical audit lever under SB 1120.

Practices win SB 1120 disputes by documenting individual clinical circumstances

SB 1120 regulates payers, not providers. Your practice has no direct compliance obligation under the statute. However, the statute's central test (did the decision rest on this patient's individual circumstances?) only works in your favor if your record actually contains those circumstances in specific, retrievable form.

Generic notes invite algorithmic denials. A note reading "patient with CHF, needs cardiac MRI" gives an automated screener nothing beyond a diagnosis code to match against a group dataset. A note that states LVEF trend, NYHA class, GDMT doses and titration history, and the specific clinical question the study will answer gives the licensed reviewer a record they must address on the merits.

The documentation goal is reviewability. Every prior authorization request should allow a human reviewer to answer three questions in under two minutes: what is the patient's specific clinical trajectory, what has already been tried and failed, and what decision depends on the requested service.

Write every note so a licensed reviewer cannot rely on a scorecard.

Clinical indicators, MDM thresholds, and audit defenses differ by diagnosis

The table below maps common high-denial scenarios to the clinical indicators reviewers look for, the 2021 AMA E/M medical decision making (MDM) level typically supported, and the SB 1120 defense position.

Payer criteria vary by plan. Use the indicators above as a documentation floor, then confirm against each plan's published clinical criteria. For cardiology-specific appeal language, see the California SB 1120 Utilization Review Defense resource.

Cardiology prior authorizations require documented LVEF trends and GDMT history

Heart failure requests are frequently screened by automated rules that match diagnosis codes to coverage criteria. An I50.22 code alone tells a screener the patient has chronic systolic heart failure. It does not tell the reviewer that the patient's LVEF declined from 35% to 28% over six months despite maximally tolerated sacubitril/valsartan, or that beta-blocker uptitration stalled at a specific heart rate.

Effective cardiology documentation includes four elements: the quantitative trajectory (LVEF, BNP, weight), the therapy history with doses and reasons for each change, the specific clinical decision pending (device candidacy, ischemic evaluation, or medication change), and the risk of delay. Under SB 1120, a denial that ignores these documented facts is vulnerable on appeal because the statute requires the reviewer to consider individual clinical circumstances.

Quantify the trajectory. Name the decision. State the cost of delay.

Orthopedic arthroplasty requests require a dated conservative therapy timeline

Total knee arthroplasty denials commonly cite insufficient conservative management. For M17.11, the record should list dates and durations for physical therapy, NSAID or analgesic trials, intra-articular injections, activity modification, and weight management, along with the outcome of each.

Imaging and function must align. Document the radiographic grade alongside a validated patient-reported outcome measure and specific functional limitations (for example, inability to walk one block or climb stairs without assistance). When a plan denies based on a generalized threshold that the patient's documented record already meets, the SB 1120 requirement for individualized review supports a strong appeal.

Every adverse determination appeal should demand the reviewer's identity and licensure

California law already requires denial communications to include the name and telephone number of the responsible health care professional. SB 1120 strengthens the value of that information because only a licensed physician or qualified licensed professional may make the determination.

Build a standard appeal workflow around these steps:

1. Verify reviewer identification: Confirm the denial names a licensed clinician and that their specialty is competent to evaluate the specific clinical issue.
2. Request the clinical rationale: Ask which elements of the patient's record were reviewed and which criteria were applied.
3. Ask about AI involvement: Request written confirmation of whether an automated tool contributed to the determination and how a licensed reviewer evaluated its output.
4. Cite individual circumstances: Point to dated, quantitative entries in the record that the denial failed to address.
5. Request peer-to-peer review: Ask for a same-specialty discussion when the reviewer's competence is in question.
6. Escalate to the regulator: If internal appeal fails, enrollees may pursue DMHC Independent Medical Review or the CDI equivalent, and practices can support that process with complete records.

Track denials as audit data. Log the payer, service, reviewer name, turnaround time, and stated rationale for every adverse determination. Patterns such as identical rationale language across unrelated patients or decisions issued faster than plausible human review are worth reporting to DMHC or CDI, which have audit access to plan AI tools under the statute.

Identical denial language across patients signals possible automation. Log it.

California AB 3030 governs provider-side generative AI patient communications

SB 1120 addresses payer AI, but practices using generative AI also face California AB 3030, effective January 1, 2025. AB 3030 requires health facilities, clinics, and physician offices that use generative AI to create patient communications about clinical information to include a disclaimer that the message was AI-generated and instructions for reaching a human health care provider.

The disclosure requirement has an exemption: communications that a licensed or certified health care provider reads and reviews before sending are exempt. Administrative communications such as scheduling and billing are outside its scope. For full details, see California AB 3030 Generative AI Disclosure Requirements.

A physician-reviewed AI scribe workflow aligns with both statutes in principle: the clinician remains the decision-maker and signatory on the record, which mirrors the human-oversight model California now requires of payers.

Merry AI Pro costs 1.3% of one medical assistant's fully loaded labor

Documentation depth carries a cost. Practices that rely on medical assistants or human scribes to capture GDMT histories, conservative therapy timelines, and functional scores pay for that labor. A fully loaded medical assistant (wages, benefits, payroll taxes, and overhead) commonly costs about $48,000 per year.

Merry AI Pro costs $54 per month on annual billing, or $648 per year. Against the $48,000 denominator, that equals approximately 1.3% of one MA's annual labor cost. The comparison is not a staffing recommendation; it frames the cost of producing structured, reviewable documentation for every encounter.

$648 per year versus $48,000 per year: a 1.3% labor ratio.

CPT G2211 complexity capture can recover $15,600 or more annually

HCPCS add-on code G2211 recognizes the inherent complexity of visits where the clinician serves as the continuing focal point for all needed services, or provides ongoing care for a single serious or complex condition. Heart failure and progressive osteoarthritis managed longitudinally are typical examples.

The national Medicare payment is roughly $16 per eligible visit. A practice capturing about 975 eligible visits per year (fewer than 20 per week across a 50-week year) recovers $15,600 or more in annual revenue. Many practices under-capture G2211 because the longitudinal relationship is implied in the clinician's head but never stated in the note.

The same documentation serves both goals. A clear statement of the ongoing care relationship and the linked complex condition supports G2211 billing and strengthens the individualized clinical narrative that SB 1120 requires payer reviewers to consider. Confirm current CMS rules on modifier 25 and same-day service combinations before billing, since CMS has revised them since the code's 2024 activation.

Administrators should implement six SB 1120 readiness controls in 2026

1. Standardize high-denial note templates: Build required fields for LVEF trends, GDMT doses, conservative therapy dates, and functional scores.
2. Require clinician sign-off on all AI drafts: Keep the physician as the documented decision-maker on every note and patient communication.
3. Create a denial log: Capture reviewer name, licensure, specialty, turnaround time, and rationale text for each adverse determination.
4. Adopt an SB 1120 appeal template: Include requests for reviewer identity, AI involvement disclosure, and the specific record elements reviewed.
5. Audit G2211 capture quarterly: Compare eligible longitudinal visits against billed add-on codes.
6. Train staff on AB 3030: Confirm which patient messages require AI disclaimers and which are exempt through clinician review.

Frequently asked questions about SB 1120 and AI utilization review

SB 1120 took effect on January 1, 2025

The law applies to determinations made by DMHC-regulated health care service plans and CDI-regulated disability insurers, including their contracted utilization review entities, from that date forward.

SB 1120 does not prohibit payers from using AI

Plans may use AI tools to support utilization review, provided the tools meet the statute's criteria and a licensed clinician makes any medical necessity denial, delay, or modification.

SB 1120 places no direct compliance duty on physician practices

The statute regulates payers and insurers. Practices benefit indirectly by producing documentation that makes individualized human review both required and effective.

Regulators can inspect payer AI tools under SB 1120

DMHC and CDI have audit and compliance review access to the AI tools and the written policies governing their use, which makes practice-level denial logs useful supporting evidence in complaints.

This brief is informational and does not constitute legal advice. Confirm current statutory text, regulatory guidance, and payer policies with qualified counsel before changing appeal or billing practices.