California SB 1120: UR Defense Documentation Guide

California SB 1120 Utilization Review Defense: Documentation Playbook for Outpatient Specialists

Merry AI · Thoughtfully curated clinical briefs.

Clinically reviewed by Dr. Marcus Vance, MD (Medical Informatics Advisor) · Coding review by Kaif R. (Clinical Informatics Specialist) · Sources: CY 2026 CMS PFS, NCCI Policy Manual.

California SB 1120 requires that any denial, delay, or modification of care based on medical necessity be made by a licensed physician or qualified health care professional who reviews the patient's individual clinical circumstances. An algorithm or AI tool alone cannot make that decision. Outpatient practices defend against improper denials by documenting patient-specific clinical data that a human reviewer must address, then citing the statute in every appeal.

This playbook gives outpatient specialists the statutory language, documentation elements, appeal workflow, and coding benchmarks needed to turn each prior authorization request into a defensible record. For the full statutory landscape across states, see the State AI Scribe Rules & Statutory Compliance Hub.

SB 1120 bars California payers from denying care using only group data

SB 1120, the Physicians Make Decisions Act, was signed in September 2024 and took effect January 1, 2025. It amended Health and Safety Code Section 1367.01 (governing DMHC-licensed health care service plans, including most Medi-Cal managed care plans) and Insurance Code Section 10123.135 (governing CDI-regulated disability insurers). In 2026, it is fully enforceable against every commercial and Medi-Cal managed care plan your California patients carry, excluding self-funded ERISA plans and Medicare Advantage.

The statute targets automated decisioning directly. When a plan uses an artificial intelligence, algorithm, or other software tool for utilization review, the tool must base its determination on the enrollee's medical or clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in the medical record. A determination based solely on a group dataset violates the law.

Core rule: Algorithms may assist utilization review, but they cannot replace physician judgment.

Only a licensed clinician may deny medical necessity under SB 1120

SB 1120 reserves the final medical necessity decision for a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved. That reviewer must consider the requesting provider's recommendation, the enrollee's medical history, and individual clinical circumstances. A cardiology prior authorization denied by a reviewer without relevant competence is open to challenge.

Existing Section 1367.01(h)(4) strengthens your position. Every denial, delay, or modification communication must include the name and telephone number of the health care professional responsible for the decision. If a denial letter lacks this information, document the deficiency and request it in writing before the appeal clock advances.

Decision timelines remain enforceable benchmarks. Routine prior authorization decisions must be made within five business days of receiving the information reasonably necessary to decide. Urgent requests, where standard timing could seriously jeopardize the patient's life, health, or ability to regain maximum function, require a decision within 72 hours.

SB 1120 imposes seven AI guardrails practices can cite in appeals

The statute lists specific obligations that plans using AI tools must meet. Each one becomes a citation point in a written appeal or a DMHC complaint when the denial pattern suggests automated decisioning.

• Individualized basis: Determinations must rest on the enrollee's own clinical history and circumstances.
• No group-only decisions: A tool cannot base its decision solely on a group dataset.
• No supplanting providers: The tool cannot replace health care provider decision-making.
• Nondiscrimination: The tool cannot discriminate directly or indirectly against enrollees.
• Fair and equitable application: The tool must be applied consistently, per HHS guidance.
• Audit access: The tool, its policies, and procedures must be open to DMHC or CDI inspection.
• Periodic review and harm prevention: Performance must be reviewed and revised to maximize accuracy and reliability, and must not cause harm to the enrollee.

Patient data protections also apply. Plans may not use patient data beyond the intended and stated purpose consistent with the Confidentiality of Medical Information Act and HIPAA. For a cardiology-focused breakdown of these obligations, review the California SB 1120 Utilization Review Defense guide.

Defensible notes document individual circumstances that population algorithms cannot see

Algorithmic denials typically fail on the same gap: the request lacks patient-specific detail, so the tool applies a population default. Your note must make the individualized facts impossible to ignore. A reviewer who denies care must then explain why those specific facts do not support necessity, which is the engagement SB 1120 demands.

Consider a heart failure patient with I50.22 (ICD-10-CM), chronic systolic congestive heart failure, secondary to I42.0 (ICD-10-CM), dilated cardiomyopathy. A prior authorization request for sacubitril/valsartan or cardiac MRI should state the LVEF with study date, NYHA class, NT-proBNP trend, current guideline-directed medical therapy with doses, intolerances with dates, and the specific clinical question the service answers.

Name the guideline and deviation. Cite the 2022 AHA/ACC/HFSA Heart Failure Guideline recommendation class, then state in one sentence why this patient falls outside the payer's step-therapy or imaging criteria. Example: "ACE inhibitor discontinued 03/2025 for angioedema; step therapy through ACEi is contraindicated."

Audit rule: Every denial-prone request needs dated, patient-specific objective data.

A five-step workflow converts every denial into a reviewable record

Step one: build the request. Submit the prior authorization with the individualized elements from the table above, the requested CPT or HCPCS code, linked ICD-10-CM codes to the highest specificity, and the guideline citation. Timestamp the submission and save the confirmation.

Step two: interrogate the denial. Confirm the letter names the responsible health care professional and lists a phone number as Section 1367.01(h)(4) requires. Request the reviewer's specialty and the clinical criteria applied. Ask in writing whether an AI or algorithmic tool contributed to the determination.

Step three: request peer-to-peer review. Speak with the reviewing physician and document the call date, reviewer name, specialty, and whether the reviewer addressed your patient-specific facts. A reviewer outside the relevant specialty supports a competence challenge under SB 1120.

Step four: file the grievance. Submit a written appeal citing Health and Safety Code Section 1367.01 as amended by SB 1120, quoting the individualized-review requirement, and attaching the original note. Plans must resolve standard grievances within 30 days and urgent grievances within 72 hours under Section 1368.01.

Step five: escalate to regulators. If the grievance fails, the patient may request Independent Medical Review through DMHC under Section 1374.30, or through CDI for insured products. Practices may also file a provider complaint with DMHC when denial patterns suggest automated decisioning without individualized review.

Federal prior authorization rules add 72-hour and 7-day clocks in 2026

CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) applies to Medicare Advantage, Medicaid, CHIP, and federally facilitated exchange plans. Beginning January 1, 2026, impacted payers must issue expedited decisions within 72 hours and standard decisions within 7 calendar days, and must provide a specific reason for every denial.

FHIR-based Prior Authorization APIs are required by January 2027. Practices that structure notes with discrete, codable data (LVEF values, medication lists, ICD-10-CM codes) will transmit cleaner requests through these APIs. Medicare Advantage plans, which SB 1120 does not govern, must still conduct individualized medical necessity review under 42 CFR 422.101(b)(6).

G2211 complexity capture recovers $15,600+ per clinician annually

HCPCS G2211 pays an add-on for visits where the clinician serves as the continuing focal point for all needed services or provides ongoing care for a single serious or complex condition. Heart failure management qualifies when the record shows a longitudinal relationship. Under the CY 2026 PFS, the national payment is approximately $16 per claim.

Specialists who document longitudinal intent capture roughly 975 eligible visits per year, about four to five per clinic day, producing $15,600+ in recovered annual revenue per clinician. The same longitudinal documentation that supports G2211 also supplies the medical history SB 1120 reviewers must consider.

Modifier 25 restrictions still apply. Since CY 2025, G2211 is payable with a modifier 25 E/M only when the same-day service is an annual wellness visit, vaccine administration, or a Medicare Part B preventive service. Otherwise, G2211 is not payable on an E/M billed with modifier 25.

Coding rule: Document the ongoing relationship explicitly to support G2211 on audit.

Manual documentation costs $48,000 per MA versus $648 for Merry AI Pro

A fully loaded medical assistant handling prior authorization packets, chart abstraction, and appeal assembly costs approximately $48,000 per year including wages, benefits, and payroll taxes. Merry AI Pro costs $54 per month billed annually, or $648 per year, equal to 1.3% of that labor cost.

Merry AI structures each encounter into discrete clinical indicators (objective values, dated intolerances, guideline-concordant therapy, MDM elements) that map to the defense table above. The physician reviews and signs every note, preserving the human attestation that both payer reviewers and California regulators expect.

AB 3030 governs AI patient communications, not physician-signed clinical notes

California AB 3030, also effective January 1, 2025, requires health facilities, clinics, and physician offices using generative AI to create patient communications containing clinical information to include a disclaimer and instructions for reaching a human provider. Communications read and reviewed by a licensed provider are exempt.

Ambient scribe notes reviewed by the treating physician are not patient communications under AB 3030. Portal messages or appeal update letters drafted by AI and sent without review trigger the disclaimer. Review the full requirements in California AB 3030 Generative AI Disclosure Requirements.

Frequently asked questions about California SB 1120 utilization review defense

Does California SB 1120 apply to Medicare Advantage plans?

No, SB 1120 governs DMHC-licensed health care service plans, including most Medi-Cal managed care plans, and CDI-regulated disability insurers. Medicare Advantage follows federal rules, but 42 CFR 422.101(b)(6) similarly requires individualized medical necessity review, so the same patient-specific documentation defends denials across both payer types.

When did SB 1120 take effect?

SB 1120 took effect January 1, 2025, after Governor Newsom signed it in September 2024. It amended Health and Safety Code Section 1367.01 and Insurance Code Section 10123.135. In 2026, the statute is fully enforceable, and DMHC and CDI may inspect plan algorithms during audits.

What should an outpatient specialist document to defend against algorithmic denials?

Document patient-specific objective data, failed or contraindicated prior therapies with dates, the guideline supporting the request, and why population-based criteria do not fit this patient. This record forces the licensed physician reviewer to engage with individual clinical circumstances, which SB 1120 explicitly requires before any medical necessity denial.

Can I bill G2211 on a visit involving prior authorization work?

Yes, if the visit reflects a longitudinal relationship serving as the continuing focal point for a serious or complex condition such as heart failure. Prior authorization work does not disqualify G2211, but it cannot be appended to an E/M billed with modifier 25 unless paired with preventive services or vaccines.

Does an AI scribe create AB 3030 disclosure obligations?

Ambient AI scribe notes reviewed by a licensed physician fall outside AB 3030's disclaimer requirement. The law targets generative AI patient communications containing clinical information. If AI drafts portal messages or letters sent without provider review, the practice must include a disclaimer and instructions for reaching a human clinician.