SB1120 This bill, effective January 1, 2025 (the “Bill”), amends existing California law to implement guardrails regarding the use of artificial intelligence tools for utilization management purposes.[1] As explained in a previous Proskauer warning, this bill represents one of the latest attempts by the California Legislature to regulate the use of AI in the healthcare industry.
Summary of bill requirements
This bill addresses utilization management and utilization review (“UM/UR”) requirements for “medical service plans,” “disability insurance companies,” “specialty health insurance companies,” and their policyholders (“covered plans”). I am. Additionally, UM/UR requirements apply to Medi-Cal managed care plans unless federal funding is jeopardized by the rule. In particular, these requirements apply to UM/UR functions regardless of whether the functions occur prospectively, retrospectively, or concurrently.[2]
According to the bill, covered plans that utilize “artificial intelligence, algorithms, or other software tools”[3] UM/UR’s (“AI Tools”) must ensure that the tool’s decisions are based on personalized Registrant information. Specifically, before determining UM/UR, the AI tool considers (i) the enrollee’s medical or other clinical history, (ii) the individual clinical situation presented by the healthcare provider, and (iii) Other clinical information contained in the data must be considered. Registrant’s medical records.[4] Consistent with the above, AI tools utilized for UM/UR purposes must not make decisions based on “group datasets only.”[5]
This bill would limit AI-based medical necessity determinations
The core of this bill is to impose guardrails on the use of AI tools in the managed care industry. However, the bill also explicitly limits the use of AI tools in determining medical necessity. In particular, AI tools cannot be used to “refuse, delay, or modify health care services, in whole or in part, based on medical necessity” or to replace health care provider decision-making. .[6]
The bill emphasizes that “a determination of medical necessity must be made.” only by a board-certified physician or certified health care professional qualified to evaluate the specific clinical issues related to the health care services requested by the health care provider…recommendations of the requesting health care provider and, if applicable, the registrant’s medical history or other Clinical history, and the clinical situation by reviewing and reviewing the personal history. ”[7] The aforementioned requirements are: recent guidance Published by the Centers for Medicare and Medicaid Services (“CMS”), AI and algorithms can assist Medicare Advantage Organizations (“MAOs”) in making coverage decisions, but such decisions may not be reviewed by a physician or other health care provider. We make it clear that we need to MAOs should consult experts with appropriate expertise before making any decisions.
The bill adopts a number of other restrictions and imposes vague requirements on emerging industries.
In addition to the above, the bill provides that AI tools: (i) Must not “discriminate directly or indirectly against registrants.” (ii) must be “fairly and equitably applied”; (iii) must not “directly or indirectly cause harm” to Registrants; (iv) must be disclosed in written policies and procedures; (v) should be periodically reviewed and revised to ensure accuracy and reliability;
While forward-looking and focused on protecting registrants, the aforementioned requirements lack specificity, and we expect further clarity through guidance issued by California regulators.
Finally, the bill stipulates that AI tools “must be compliant with the Confidentiality of Health Information Act and must not use patient data beyond their intended and stated purpose.” [(“CMIA”)]…and the Federal Health Insurance Portability and Accountability Act. [(“HIPAA”)]”[8] At first glance, the aforementioned limitations appear to unnecessarily incorporate CMIA and HIPAA requirements, as compliance with CMIA and HIPAA is already required by law. However, the bill’s prohibition on using patient data “beyond the intended and stated purpose” consistent with these laws creates ambiguity and requires the use of patient data under the California Health Safety and Insurance Act. It opens the door to new enforcement actions.
audit requirements
Notably, although relatively common in the healthcare field given its highly regulated nature, the bill would require that AI tools be used for “audit or compliance review purposes” in accordance with applicable state or federal law. It requires them to be open to inspection.[9]
what it means
This bill is a first step in providing a regulatory framework for payers, contractors, and IT developers who are using or seeking to use AI tools for UM/UR functions. However, more guidance and specificity could be warranted to provide certainty at a time when the industry is highly regulated and competitive.
[1] This bill amends Section 1367.01 of the Health and Safety Code and Section 10123.135 of the Insurance Code.
[2] look Cal. Health and Safety Code § 1367.01(k)(1)(A) (effective January 1, 2025); Cal. I will insure it. Code § 10123.135(j)(4) (effective January 1, 2025).
[3] The bill defines “artificial intelligence” as “artificial intelligence that has varying levels of autonomy and is capable of inferring, for explicit or implicit purposes, how to produce outputs that affect the physical or virtual environment from the inputs it receives. or machine-based systems.” ” look Cal. Insuring Health and Safety Code § 1367.01(k)(3) (effective January 1, 2025) and Cal. Code § 10123.135(j)(3) (effective January 1, 2025). However, it does not define “algorithms” or “other software tools” which can be interpreted broadly.
[4] look Cal. Health and Safety Code § 1367.01(k)(1)(A) (effective January 1, 2025); Cal. I will insure it. Code § 10123.135(j)(1)(A) (effective January 1, 2025).
[5] Cal. Health and Safety Code § 1367.01(k)(1)(B) (effective January 1, 2025). Cal. I will insure it. Code § 10123.135(j)(1)(B) (effective January 1, 2025).
[6] Cal. Health and Safety Code § 1367.01(k)(2) (effective January 1, 2025); Cal. I will insure it. Code § 10123.135(j)(2) (effective January 1, 2025).
[7] Same as above. (emphasis added).
[8] Cal. Health and Safety Code § 1367.01(k)(1)(J) (effective January 1, 2025); Cal. I will insure it. Code § 10123.135(j)(1)(J) (effective January 1, 2025).
[9] look Cal. Health and Safety Code § 1367.01(k)(1)(G) (effective January 1, 2025); Cal. Get insurance. Code § 10123.135(j)(1)(J) (effective January 1, 2025).
