Insurance Code § 10123.135

(a)Every disability insurer, or an entity with which it contracts for services that include utilization review or utilization management functions, that covers hospital, medical, or surgical expenses and that prospectively, retrospectively, or concurrently reviews and approves, modifies, delays, or denies, based in whole or in part on medical necessity, requests by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds, or that delegates these functions to medical groups or independent practice associations or to other contracting providers, shall comply with this section.

(b)A disability insurer that is subject to this section, or

any entity with which an insurer contracts for services that include

utilization review or utilization management functions, shall have written policies and procedures establishing the process by which the insurer prospectively, retrospectively, or concurrently reviews and approves, modifies, delays, or denies, based in whole or in part on medical necessity, requests by providers of health care services for insureds. These policies and procedures shall ensure that decisions based on the medical necessity of proposed health care services are consistent with criteria or guidelines that are supported by clinical principles and processes. These criteria and guidelines shall be developed pursuant to subdivision (f). These policies and procedures, and a description of the process by which an insurer, or an entity with which an insurer contracts for services that include utilization review or utilization management functions, reviews and approves, modifies,

delays, or denies requests by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds, shall be filed with the commissioner, and shall be disclosed by the insurer to insureds and providers upon request, and by the insurer to the public upon request.

(c)If the number of insureds covered under health benefit plans in this state that are issued by an insurer subject to this section constitute at least 50 percent of the number of insureds covered under health benefit plans issued nationwide by that insurer, the insurer shall employ or designate a medical director who holds an unrestricted license to practice medicine in this state issued pursuant to Section 2050 of the Business and Professions Code or the Osteopathic Initiative Act, or the insurer may employ a clinical director licensed

in California whose scope of practice under California law includes the right to independently perform all those services covered by the insurer. The medical director or clinical director shall ensure that the process by which the insurer reviews and approves, modifies, delays, or denies, based in whole or in part on medical necessity, requests by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds, complies with the requirements of this section. Nothing in this subdivision shall be construed as restricting the existing authority of the Medical Board of California.

(d)If an insurer subject to this section, or individuals under contract to the insurer to review requests by providers, approve the provider’s request pursuant to subdivision (b), the decision shall be communicated to the

provider pursuant to subdivision (h).

(e)An individual, other than a licensed physician or a licensed health care professional who is competent to evaluate the specific clinical issues involved in the health care services requested by the provider, may not deny or modify requests for authorization of health care services for an insured for reasons of medical necessity. The decision of the physician or other health care provider shall be communicated to the provider and the insured pursuant to subdivision (h).

(f)(1) An insurer shall disclose, or provide for the disclosure, to the commissioner and to network providers, the process the insurer, its contracting provider groups, or any entity with which it contracts for services that include utilization review or

utilization management functions, uses to authorize, delay, modify, or deny health care services under the benefits provided by the insurance contract, including coverage for subacute care, transitional inpatient care, or care provided in skilled nursing facilities. An insurer shall also disclose those processes to policyholders or persons designated by a policyholder, or to any other person or organization, upon request.

(2)The criteria or guidelines used by an insurer, or an entity with which an insurer contracts for utilization review or utilization management functions, to determine whether to authorize, modify, delay, or deny health care services, shall comply with all of the following:

(A)Be developed with involvement from actively practicing health care

providers.

(B)Be consistent with sound clinical principles and processes.

(C)Be evaluated, and updated if necessary, at least annually.

(D)If used as the basis of a decision to modify, delay, or deny services in a specified case under review, be disclosed to the provider and the policyholder in that specified case.

(E)Be available to the public upon request. An insurer shall only be required to disclose the criteria or guidelines for the specific procedures or conditions requested. An insurer may charge reasonable fees to cover administrative expenses related to disclosing criteria or guidelines pursuant to this paragraph that are limited to copying and postage

costs. The insurer may also make the criteria or guidelines available through electronic communication means.

(3)The disclosure required by subparagraph (E) of paragraph (2) shall be accompanied by the following notice: “The materials provided to you are guidelines used by this insurer to authorize, modify, or deny health care benefits for persons with similar illnesses or conditions. Specific care and treatment may vary depending on individual need and the benefits covered under your insurance contract.”

(g)If an insurer subject to this section requests medical information from providers in order to determine whether to approve, modify, or deny requests for authorization, the insurer shall request only the information reasonably necessary to make the determination.

(h)In determining whether to approve, modify, or deny requests by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds, based in whole or in part on medical necessity, every insurer subject to this section shall meet the following requirements:

(1)Decisions to approve, modify, or deny, based on medical necessity, requests by providers prior to, or concurrent with, the provision of health care services to insureds that do not meet the requirements for the time period for review required by paragraph (2), shall be made in a timely fashion appropriate for the nature of the insured’s condition, not to exceed five business days from the insurer’s receipt of the information reasonably necessary and requested by the insurer to make

the determination. In cases where the review is retrospective, the decision shall be communicated to the individual who received services, or to the individual’s designee, within 30 days of the receipt of information that is reasonably necessary to make this determination, and shall be communicated to the provider in a manner that is consistent with current law. For purposes of this section, retrospective reviews shall be for care rendered on or after January 1, 2000.

(2)When the insured’s condition is such that the insured faces an imminent and serious threat to the insured’s health, including, but not limited to, the potential loss of life, limb, or other major bodily function, or the normal timeframe for the decisionmaking process, as described in paragraph (1), would be detrimental to the insured’s life or health or could jeopardize

the insured’s ability to regain maximum function, decisions to approve, modify, or deny requests by providers prior to, or concurrent with, the provision of health care services to insureds shall be made in a timely fashion, appropriate for the nature of the insured’s condition, but not to exceed 72 hours or, if shorter, the period of time required under Section 2719 of the federal Public Health Service Act (42 U.S.C. Sec. 300gg-19) and any subsequent rules or regulations issued thereunder, after the insurer’s receipt of the information reasonably necessary and requested by the insurer to make the determination.

(3)Decisions to approve, modify, or deny requests by providers for authorization prior to, or concurrent with, the provision of health care services to insureds shall be communicated to the requesting provider within 24 hours of the

decision. Except for concurrent review decisions pertaining to care that is underway, which shall be communicated to the insured’s treating provider within 24 hours, decisions resulting in denial, delay, or modification of all or part of the requested health care service shall be communicated to the insured in writing within two business days of the decision. In the case of concurrent review, care shall not be discontinued until the insured’s treating provider has been notified of the insurer’s decision and a care plan has been agreed upon by the treating provider that is appropriate for the medical needs of that patient.

(4)Communications regarding decisions to approve requests by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds shall specify the specific health care service

approved. Responses regarding decisions to deny, delay, or modify health care services requested by providers prior to, retrospectively, or concurrent with the provision of health care services to insureds shall be communicated to insureds in writing, and to providers initially by telephone or facsimile, except with regard to decisions rendered retrospectively, and then in writing, and shall include a clear and concise explanation of the reasons for the insurer’s decision, a description of the criteria or guidelines used, and the clinical reasons for the decisions regarding medical necessity. Any written communication to a physician or other health care provider of a denial, delay, or modification or a request shall include the name and telephone number of the health care professional responsible for the denial, delay, or modification. The telephone number provided shall be a direct number or an

extension, to allow the physician or health care provider easily to contact the professional responsible for the denial, delay, or modification. Responses shall also include information as to how the provider or the insured may file an appeal with the insurer or seek department review under the unfair practices provisions of Article 6.5 (commencing with Section 790) of Chapter 1 of Part 2 of Division 1 and the regulations adopted thereunder.

(5)If the insurer cannot make a decision to approve, modify, or deny the request for authorization within the timeframes specified in paragraph (1) or (2) because the insurer is not in receipt of all of the information reasonably necessary and requested, or because the insurer requires consultation by an expert reviewer, or because the insurer has asked that an additional examination or test be

performed upon the insured, provided that the examination or test is reasonable and consistent with good medical practice, the insurer shall, immediately upon the expiration of the timeframe specified in paragraph (1) or (2), or as soon as the insurer becomes aware that it will not meet the timeframe, whichever occurs first, notify the provider and the insured, in writing, that the insurer cannot make a decision to approve, modify, or deny the request for authorization within the required timeframe, and specify the information requested but not received, or the expert reviewer to be consulted, or the additional examinations or tests required. The insurer shall also notify the provider and enrollee of the anticipated date on which a decision may be rendered. Upon receipt of all information reasonably necessary and requested by the insurer, the insurer shall approve, modify, or deny the request for authorization

within the timeframes specified in paragraph (1) or (2), whichever applies.

(6)If the commissioner determines that an insurer has failed to meet any of the timeframes in this section, or has failed to meet any other requirement of this section, the commissioner may assess, by order, administrative penalties for each failure. A proceeding for the issuance of an order assessing administrative penalties shall be subject to appropriate notice to, and an opportunity for a hearing with regard to, the person affected. The administrative penalties shall not be deemed an exclusive remedy for the commissioner. These penalties shall be paid to the Insurance Fund.

(i)Every insurer subject to this section shall maintain telephone access for providers to request authorization for health care services.

(j)(1) A disability insurer, including a specialized health insurer that uses an artificial intelligence, algorithm, or other software tool for the purpose of utilization review or utilization management functions, based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that uses an artificial intelligence, algorithm, or other software tool for the purpose of utilization review or utilization management functions, based in whole or in part on medical necessity, shall comply with this section and shall ensure all of the following:

(A) The artificial intelligence, algorithm, or other software tool bases its determination on the following information, as applicable:

(i)An insured’s medical or other clinical history.

(ii) Individual clinical circumstances as presented by the requesting provider.

(iii) Other relevant clinical information contained in the insured’s medical or other clinical record.

(B) The artificial intelligence, algorithm, or other software tool does not base its determination solely on a group dataset.

(C) The artificial intelligence, algorithm, or other software tool’s criteria and guidelines complies with this chapter and applicable state and federal law.

(D) The artificial intelligence, algorithm, or other software tool does not

supplant health care provider decisionmaking.

(E) The use of the artificial intelligence, algorithm, or other software tool does not discriminate, directly or indirectly, against insureds in violation of state or federal law.

(F) The artificial intelligence, algorithm, or other software tool is fairly and equitably applied, including in accordance with any applicable regulations and guidance issued by the federal Department of Health and Human Services.

(G) The artificial intelligence, algorithm, or other software tool is open to inspection for audit or compliance reviews by the department pursuant to applicable state and federal law.

(H) Disclosures

pertaining to the use and oversight of the artificial intelligence, algorithm, or other software tool are contained in the written policies and procedures, as required by subdivision (b).

(I) The artificial intelligence, algorithm, or other software tool’s performance, use, and outcomes are periodically reviewed and revised to maximize accuracy and reliability.

(J) Patient data is not used beyond its intended and stated purpose, consistent with the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), as applicable.

(K) The artificial intelligence, algorithm,

or other software tool does not directly or indirectly cause harm to the insured.

(2)Notwithstanding paragraph (1), the artificial intelligence, algorithm, or other software tool shall not deny, delay, or modify health care services based, in whole or in part, on medical necessity. A determination of medical necessity shall be made only by a licensed physician or licensed health care professional competent to evaluate the specific clinical issues involved in the health care services requested by the provider, as provided in subdivision (e), by reviewing and

considering the requesting provider’s recommendation, the insured’s medical or other clinical history, as applicable, and individual clinical circumstances.

(3)For purposes of this subdivision, “artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

(4)This subdivision shall apply to utilization review or utilization management functions that prospectively, retrospectively, or concurrently review requests for covered health care services.

(5)A disability insurer subject to this subdivision shall comply with

applicable federal rules and guidance issued by the federal Department of Health and Human Services regarding the use of artificial intelligence, algorithm, or other software tools. The department may issue guidance to implement this paragraph within one year of the adoption of federal rules or the issuance of guidance by the federal Department of Health and Human Services regarding the use of artificial intelligence, algorithm, or other software tools. Such guidance shall not be subject to the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code).

(6)For purposes of implementing this subdivision, the department may enter into exclusive or nonexclusive contracts, or amend existing contracts, on a bid or negotiated basis. Contracts entered into or amended

pursuant to this subdivision shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services.

(k)Nothing in this section shall cause a disability insurer to be defined as a health care provider for purposes of any provision of law, including, but not limited to, Section 6146 of the Business and Professions Code, Sections 3333.1 and 3333.2 of the Civil Code, and Sections 340.5, 364, 425.13, 667.7, and 1295 of the Code of Civil Procedure.