Governor Newsom signed California Senate Bill 1120 (SB 1120) in September 2024, introducing significant reforms to how health plans and disability insurers use artificial intelligence (“AI”) in utilization review (“UR”) decisions. This new legislation modifies Section 1367.01 of California’s Knox-Keene Health Care Service Plan Act of 1975 (pertaining to health care service plans) and Insurance Code § 10123.135 (pertaining to disability insurers).
UR and utilization management (“UM”) refer to the processes used by health plans and insurers to determine the medical necessity of a healthcare service, treatment, or equipment. Existing California law mandates health care service plans and disability insurers to implement UR policies governing the approvals, modifications, delays, or denials of health care services before, after, or at the time services are rendered. SB 1120 expands the scope of California’s current laws to include the use of AI by health care service plans, disability insurers, and their contractors in UR or UM related decisions.
Key Components of SB 1120
The bill mandates that health care service plans, disability insurers, including specialized plans, and such entities’ third-party contractors, that use AI or other AI-based tools for UR/UM medical necessity decisions comply with the following:
- Criteria for AI-Based Determinations: AI systems must make decisions based on a combination of the enrollee’s medical history, individual clinical circumstances, and other relevant medical records. The legislation prohibits decisions based solely on group datasets.
- Non-Displacement of Human Judgment: Entities subject to SB 1120 cannot use AI to replace the decision-making role of licensed physicians or other healthcare professionals. While AI can support the review process, final determinations about medical necessity must be made by licensed physicians or healthcare professionals who are “competent to evaluate the specific clinical issues involved in the health care services requested by the provider.”
- Transparency and Compliance: The law requires health care service plans and disability insurers to maintain clear policies and procedures that establish how the plans or insurers review, approve, or deny providers’ requests for health care services based on medical necessity. This requirement includes making AI processes available for audits and compliance reviews, as well as ensuring that plans and insurers use patient data in accordance with privacy laws like HIPAA. Entities covered under the new law must also disclose the use of AI tools to their patients and providers upon request.
- Prohibition of Discrimination: AI platforms and tools must be applied “fairly and equitably.” The legislation does not provide detailed guidance on the criteria for the fair and equitable application of AI, which creates challenges for compliance and may lead to disputes. Additionally, the bill explicitly requires that AI-based reviews must neither directly nor indirectly discriminate against any enrollee. Compliance with state and federal anti-discrimination laws is crucial for health plans using AI.
- Periodic Review and Adjustment: Health care service plans, disability insurers, and their respective contractors performing UR/UM functions must regularly evaluate and update the performance of AI systems to ensure accuracy and effectiveness in decision-making processes.
Entities and Conduct Subject to SB 1120
SB 1120’s requirements apply not only to health care service plans regulated under the Knox-Keene Health Care Service Plan Act and disability insurers regulated by California’s Department of Insurance that cover hospital, medical, or surgical expenses, but also to third-party contractors that deploy AI technologies to assist with UR and UM functions. For example, if a health plan contracts with an AI company to assist in these UR/UM functions, the AI tools used by the company must comply SB 1120’s requirements, including its fairness, equity, and non-discrimination stipulations.
For the purposes of SB 1120, “AI” means “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” Willful violations of the new law constitute a crime.
Practical Impacts on UR/UM with AI
The law’s requirements for enhanced regulatory oversight are likely to increase administrative burdens on covered health plans, insurers, and their contractors that provide AI services, as they must ensure compliance through detailed documentation and disclosures. To the extent health plans are contracting UR/UM functions to AI-using vendors, the parties will need to navigate how compliance responsibility will be contractually allocated, and the vagaries of the law (e.g., ensuring AI is used “fairly and equitably”) may make this challenging.
Additionally, SB 1120 entrenches human decision-making as mandatory for UR, and firmly positions AI as a decision-support tool rather than a decision-maker. By mandating that licensed healthcare professionals make final determinations about medical necessity, health care service plans and disability, insurers cannot supplant human clinical judgment with technology.
Finally, SB 1120 seeks to make the decision-making process more transparent and understandable for patients. This aspect of the bill may enhance patient trust in AI-assisted healthcare, permitting them to gain clearer insights into how decisions are made. On the other hand, patients’ ability to request human review could increase the number of cases where AI recommendations are re-examined.
The new law will take effect January 1, 2025.
