California SB 1120: Utilization Review Defense Guide

California SB 1120 Utilization Review Defense for Denied Outpatient Procedures: The 2026 Specialist Playbook

Merry AI · Thoughtfully curated clinical briefs.

California SB 1120 requires that any denial, delay, or modification of an outpatient procedure based on medical necessity be made by a licensed physician or other licensed health care professional competent in the specific clinical issue. An algorithm or AI tool alone cannot make that determination. Your defense is a documented, patient-specific clinical record that forces the plan's human reviewer to engage with your individual findings rather than a population-level scorecard.

This playbook gives outpatient specialists the statutory citations, documentation thresholds, appeal sequence, and audit-ready language needed to overturn algorithm-driven denials in 2026. It focuses on orthopedic and musculoskeletal examples. The same framework applies to cardiology, gastroenterology, pain management, and other procedural specialties.

SB 1120 took effect January 1, 2025, and governs California-regulated plan utilization review

The Physicians Make Decisions Act (SB 1120, Becker) amended Health and Safety Code Section 1367.01 for health care service plans regulated by the Department of Managed Health Care (DMHC). It also amended Insurance Code Section 10123.135 for disability insurers regulated by the California Department of Insurance (CDI). It applies to commercial HMOs, PPOs licensed under Knox-Keene, and Medi-Cal managed care plans holding a Knox-Keene license.

The statute does not reach self-funded ERISA employer plans, which are governed by federal law. Medicare Advantage plans are primarily governed by federal CMS rules. Verify the payer's regulator before you build your appeal, because the escalation pathway (DMHC, CDI, or CMS) depends on it. Our State AI Scribe Rules & Statutory Compliance Hub maps payer types to their governing regulators.

SB 1120 imposes seven enforceable conditions on plan AI tools

When a plan uses an artificial intelligence, algorithm, or other software tool for utilization review, the statute requires the following:

• Individualized clinical basis: Determinations must rest on the enrollee's medical or clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant information in the medical record.
• No group-only datasets: The tool cannot base its determination solely on a group dataset.
• No supplanting of providers: The tool cannot replace health care provider decision-making.
• No discrimination: The tool cannot discriminate directly or indirectly against enrollees in violation of state or federal law, and it must be applied fairly and equitably.
• Open to regulatory inspection: The tool, including its written policies and procedures, must be open to audit and compliance review by the DMHC or CDI.
• Periodic review required: Performance, use, and outcomes must be periodically reviewed and revised to maximize accuracy and reliability.
• No harm and limited data use: Patient data cannot be used beyond its intended and stated purpose, and the tool cannot directly or indirectly cause harm to the enrollee.

Core rule: Only a competent licensed clinician may deny for medical necessity.

California law sets fixed decision deadlines that create leverage when plans miss them

Section 1367.01 sets the clock. Routine prospective and concurrent decisions must be made within 5 business days of receiving the information reasonably necessary to decide, and never later than 14 calendar days from the request. Urgent requests, where the standard timeline could seriously jeopardize the enrollee's life, health, or ability to regain maximum function, require a decision within 72 hours.

Decisions must reach the provider within 24 hours of being made. Written notice must reach the enrollee within 2 business days for prospective and concurrent review. If the plan needs more information, it must notify you of exactly what is required and the anticipated decision date. Log every timestamp. A missed deadline is a documented compliance failure you can cite in a DMHC complaint.

Denial letters must name the reviewer and state clinical reasons

Every California denial letter must include a clear and concise explanation of the reasons for the decision. It must also describe the criteria or guidelines used and state the clinical reasons for any medical necessity determination. The letter must give the name and direct telephone number of the health care professional responsible for the decision. A letter missing any of these elements is defective on its face.

Medicare Advantage denials follow parallel federal individualized-review rules

For Medicare Advantage patients, cite CMS-4201-F, which requires MA organizations to base medical necessity decisions on the individual patient's circumstances rather than an algorithm alone. Cite it alongside the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F). Beginning in 2026, impacted payers must issue standard prior authorization decisions within 7 calendar days and expedited decisions within 72 hours, and must provide a specific reason for denials. The FHIR-based Prior Authorization API requirement follows in 2027.

Algorithm denials fail SB 1120 when your note documents individual clinical circumstances

Most outpatient procedure denials share one pattern: a criteria engine flags a missing data element, such as weeks of conservative therapy or an imaging grade, and generates a denial. SB 1120 shifts the burden. The plan must show that a competent human reviewed your patient's specific circumstances. Your note must make those circumstances impossible to overlook.

The strongest defensive notes contain five elements: objective functional limitation with a validated score, documented failure of specific conservative treatments with dates, imaging findings correlated to the exam, patient-specific risk factors that alter the standard pathway, and an explicit shared decision-making statement. When these elements sit in a structured assessment and plan, a reviewer who denies anyway has created a record of disregarding individualized data.

Rotator cuff repair denials hinge on tear chronicity and functional loss

For a patient with M75.121 (ICD-10-CM), complete rotator cuff tear or rupture of the right shoulder not specified as traumatic, plans frequently deny arthroscopic repair (CPT 29827) by citing an absence of 6 to 12 weeks of physical therapy. Rebut by documenting MRI-confirmed full-thickness tear size and retraction. Add the measured strength deficit (for example, 3/5 external rotation), the ASES or QuickDASH score, occupational demands, and the risk of tear progression and fatty infiltration with delayed repair in a younger, active patient.

Knee osteoarthritis procedure denials hinge on documented conservative failure

For a patient with M17.11 (ICD-10-CM), unilateral primary osteoarthritis of the right knee, outpatient total knee arthroplasty (CPT 27447), genicular nerve radiofrequency ablation (CPT 64624), and intra-articular injections are common denial targets. Document the Kellgren-Lawrence grade from weight-bearing radiographs and the KOOS JR or WOMAC score. List each failed modality with dates: NSAIDs, structured physical therapy, weight management, bracing, and corticosteroid injection response duration. Record comorbidities that contraindicate further conservative escalation, such as NSAID intolerance due to CKD.

Audit tip: Dates and validated scores defeat checkbox-style conservative therapy denials.

MDM documentation thresholds determine both appeal strength and E/M reimbursement

The same documentation that defends a procedure authorization also supports the visit level. Under the AMA 2021 office E/M guidelines, a decision regarding elective major surgery with identified patient or procedure risk factors satisfies high risk. Without identified risk factors, it satisfies moderate risk. Recording those risk factors explicitly strengthens your UR position and your coding at the same time.

CPT G2211 capture recovers $15,600 or more in annual specialist revenue

HCPCS G2211 compensates the longitudinal complexity of being the continuing focal point for a patient's care or ongoing care of a single serious or complex condition. Specialists managing chronic osteoarthritis, rotator cuff disease, or other progressive musculoskeletal conditions frequently qualify. At roughly $16 per qualifying visit nationally, a practice capturing about 975 eligible visits per year (fewer than 20 per week) recovers $15,600 or more annually.

G2211 is not payable when the office E/M is reported with modifier 25 for a same-day procedure, except for the limited preventive service exceptions CMS adopted for 2025. Your note must state the longitudinal relationship explicitly. A phrase such as "I am managing this patient's progressive right knee osteoarthritis as the continuing focal point of musculoskeletal care" provides that support. That same statement reinforces your standing as the treating physician during peer-to-peer review.

Revenue rule: State the longitudinal relationship in every qualifying chronic-condition note.

A five-step appeal sequence overturns most algorithm-driven outpatient denials

Step 1: Audit the denial letter against statutory content requirements

Check the letter for the clinical reasons, the named criteria or guideline, and the reviewing professional's name and direct phone number. Document any missing element in writing. Request the full criteria set the plan applied; Health and Safety Code Section 1363.5 requires plans to disclose their utilization review criteria for a specific procedure upon request.

Step 2: Request a peer-to-peer with a competent reviewer

Ask the plan to confirm that the reviewing clinician is competent to evaluate the specific clinical issues involved, as Section 1367.01 requires. For an orthopedic procedure, request a reviewer with musculoskeletal surgical expertise. Record the reviewer's name, credentials, call time, and every clinical point raised.

Step 3: Submit a structured written appeal citing SB 1120

Your appeal letter should state directly that the determination appears to rest on group-level criteria rather than the individual clinical circumstances documented in the record, contrary to Health and Safety Code Section 1367.01 (or Insurance Code Section 10123.135). Then list each individualized finding with its date and source. Attach the supporting note, imaging report, and validated outcome scores.

Step 4: File a grievance and track plan response deadlines

California plans must resolve standard grievances within 30 calendar days. Grievances involving an imminent and serious threat to health require resolution within 3 calendar days. Calendar both deadlines on the day of filing.

Step 5: Escalate to DMHC Independent Medical Review

If the plan upholds the denial or misses its deadline, the patient may request Independent Medical Review (IMR) through the DMHC or CDI. IMR decisions are made by independent physician reviewers and are binding on the plan. Help your patient file by supplying the complete clinical record and your appeal correspondence. For CDI-regulated insurers, the equivalent IMR runs through the Department of Insurance.

Escalation fact: IMR decisions favoring the patient are binding on California plans.

Specialty-specific templates for cardiology procedures appear in our California SB 1120 Utilization Review Defense guide. It covers stress testing, echocardiography, and ambulatory monitoring denials.

Your own AI documentation tools must satisfy California disclosure law

Using an AI scribe to build defensible notes is lawful and increasingly standard, but California imposes its own obligations on providers. AB 3030, effective January 1, 2025, requires a disclaimer and clear instructions for reaching a human clinician when generative AI produces patient clinical communications. Communications reviewed by a licensed provider before sending are exempt. Full requirements are detailed in our guide to California AB 3030 Generative AI Disclosure Requirements.

Physician attestation is the anchor. An AI-drafted note that you review, edit, and sign is your clinical judgment, which is exactly the human decision-making SB 1120 protects. That attestation makes your record stronger than the unreviewed algorithmic output a plan may have relied on.

Merry AI Pro costs 1.3 percent of one medical assistant's annual labor

A fully loaded medical assistant in California costs approximately $48,000 per year, including wages, benefits, payroll taxes, and overhead. Merry AI Pro costs $54 per month on annual billing, or $648 per year. That is 1.3 percent of the MA labor denominator.

Merry AI generates structured notes that capture validated outcome scores, dated conservative treatment histories, explicit risk factor statements, and longitudinal care language. These are the exact elements that defeat SB 1120 denials and support G2211 capture. Recovering $15,600 or more in G2211 revenue against a $648 annual subscription produces a return exceeding 24 to 1 before counting overturned procedure denials.

Frequently cited SB 1120 facts for outpatient specialists

SB 1120 does not ban plan use of AI

Plans may still use algorithms to approve requests or to triage them. The statute prohibits AI from serving as the final decision-maker on denials, delays, or modifications based on medical necessity.

SB 1120 does not govern self-funded ERISA plans

Self-funded employer plans fall under federal ERISA jurisdiction. For these patients, use the plan's internal appeal process and the federal external review procedures under the Affordable Care Act.

Regulators can audit plan AI tools directly

The DMHC and CDI may inspect a plan's AI tools, policies, and procedures for compliance. Documented patterns of non-individualized denials submitted through complaints give regulators grounds to investigate.

Individualized documentation is the specialist's primary defense

Every element of SB 1120 rewards notes that capture patient-specific history, objective findings, and attested clinical reasoning. Build those elements into every procedural consultation, and each future denial becomes a statutory compliance question for the plan to answer.