California SB 1120 healthcare AI compliance guide
California SB 1120 limits how health care service plans and disability insurers use AI, algorithms, or software tools in utilization review and management. Stacksona may help preserve review records for agent-assisted workflows, but clinical decision-making, medical-necessity determinations, plan operations, and regulatory compliance require qualified healthcare and legal processes.
Direct answer
California SB 1120 limits how health care service plans and disability insurers use AI, algorithms, or software tools in utilization review and management. Stacksona may help preserve review records for agent-assisted workflows, but clinical decision-making, medical-necessity determinations, plan operations, and regulatory compliance require qualified healthcare and legal processes.
Source: California Legislative Information SB 1120 chaptered bill; California Medical Association SB 1120 overview
Regulatory summary
SB 1120, Physicians Make Decisions Act, health care coverage utilization review applies in California with status: Chaptered in 2024; operative requirements for health plan AI use in utilization review. The practical compliance question is whether the organization, system, decision, and use case fit the covered scope.
Relevant sectors and businesses
These broad categories may need to review the guide when AI agents support covered or sensitive decisions.
Who may be affected
- California health care service plans and specialized plans.
- Disability insurers and specialized health insurers.
- Vendors or delegated entities using AI, algorithms, or software tools for utilization review or utilization management on behalf of covered plans or insurers.
Covered technology
- AI, algorithmic, or software tools used for utilization review or utilization management.
- Tools that assist prospective, concurrent, or retrospective review of covered healthcare services.
- Workflow agents that prepare, route, summarize, or recommend coverage determinations.
Covered decisions
- Medical necessity and coverage determinations in utilization review.
- Authorization, denial, delay, modification, or payment-review workflows.
- Clinical-review support where a software output may influence plan action.
Main requirements
- Ensure tools base determinations on individual clinical history and other required information.
- Do not substitute an AI or software tool for required healthcare-professional judgment.
- Apply tools fairly and equitably and avoid unlawful discrimination.
- Maintain audit, compliance, and disclosure practices for tool use.
Human-review implications
The law emphasizes that a qualified licensed healthcare professional must make decisions requiring clinical judgment. A meaningful review workflow should make the tool output visible, preserve the reviewer decision, and avoid letting the system act as the final clinical decision-maker.
Record requirement: Keep records showing reviewer identity, clinical context presented, tool output, decision rationale, timestamps, and final utilization-review outcome.
Self-assessment questions
- Does the workflow involve a covered organization, consumer, patient, employee, applicant, or similarly protected person?
- Does software make, recommend, or materially influence a decision?
- Can the action be paused before execution for qualified human review?
- What evidence would prove what the reviewer saw and decided?
Practical workflow example
- A utilization-management agent drafts a recommended authorization outcome.
- The request is routed to a qualified reviewer before a denial, delay, or modification is issued.
- The reviewer sees patient-specific context, clinical criteria, tool rationale, and limitations.
- Stacksona records the reviewer decision and whether the downstream plan action executed.
When Stacksona may be relevant
Stacksona is relevant when a regulated or sensitive AI-agent action needs an approval step, reviewer context, and a decision record before the action runs.
Requirement-to-capability table
| Compliance need | Stacksona capability |
|---|---|
| Identify a proposed action | Show what the agent wants to do before execution. |
| Pause and route for review | Send covered actions to the right reviewer or team. |
| Preserve reviewer evidence | Store approval, rejection, comments, timestamps, and outcome. |
| Export a decision record | Help teams share records with legal, risk, operations, or compliance. |
When Stacksona is not the complete solution
Stacksona does not replace legal advice, policy design, required notices, impact assessments, model validation, clinical judgment, anti-discrimination testing, vendor management, or full regulatory reporting.
Pending questions or rulemaking
- Monitor Department of Managed Health Care, Department of Insurance, and legislative guidance on audits, disclosures, vendor oversight, and implementation expectations.
Official sources
Update history
- 2026-07-14: Initial Stacksona guide published for healthcare AI utilization-review workflows.
Informational disclaimer
This guide is for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. Consult qualified counsel for advice about your obligations.
Use this guide to plan AI approval controls
When a compliance review points to human oversight, Stacksona can help teams test the approval path before an AI agent sends a message, changes a record, exports data, or triggers another sensitive action.