New California Regulation Of Health Plans' Automated Claims Processing Using Modern Technology, Including AI

California became one of the first states to enact a law that specifically regulates the use of an "artificial intelligence, algorithm, or other software tool" (automated decision-making tool) by HCSPs and disability insurers to analyze medical necessity in their review or management of requests by health care providers related to the provision of health care services to health plan enrollees. The California law is in line with the federal Centers for Medicare and Medicaid Services (CMS) guidance published in February 2024, which clarified that Medicare Advantage organizations may use modern technology (including AI) to assist with coverage decisions as long as human professionals are involved in making determinations based on medical necessity. However, the new California law (SB 1120) goes further than the CMS guidance and is both prescriptive and vague. HCSPs and disability insurers may find the law, which takes effect on January 1, 2025, both flexible and frustrating.

New requirements when using automated decision-making tools

The new California law applies to HCSPs and disability insurers regulated by California's Department of Insurance when they directly use or engage a subcontractor to use certain automated decision-making tools to analyze medical necessity as part of utilization review or management functions. Under the California Health and Safety Code, HCSPs include both in-state and out-of-state plans that solicit or contract with a subscriber or enrollee in California to pay or reimburse costs for health care services.

According to the new California law, HCSPs and disability insurers using automated decision-making tools to analyze medical necessity determinations as part of utilization review or management functions must:

• Base the determination on the insured's or enrollee's medical or clinical history and other individual clinical circumstances as presented by the requesting provider. The determination cannot be based solely on a group dataset.
• Not deny, delay, or modify health care services, based in whole or in part on a medical necessity determination made by an automated decision-making tool. A determination of medical necessity may only be made by a licensed physician or a competent licensed health care professional.
• Ensure the automated decision-making tool does not supplant health care provider decision-making.
• Comply with applicable federal and state laws, including laws related to non-discrimination, patient data use, and AI.
• Apply the automated decision-making tool fairly and equitably.
• Perform periodic internal reviews of the tools regarding their performance, use, and outcomes and revise them "to maximize accuracy and reliability."
• Include disclosures about the use and oversight of the automated decision-making tools in written policies and procedures that are disclosed to providers, enrollees, and the public, upon request, and file them with the regulator for review and approval.

Key potential risks

Compliance with the above obligations may be operationally difficult for health plans and disability insurers, but additional significant risk may arise from other notable aspects of the law. According to the new California law:

• Automated decision-making tools must "not directly or indirectly cause harm to the enrollee." Class action plaintiffs will surely use this broad language in any claims made against regulated entities using software as part of claims processing.
• Regulated HCSPs and disability insurers must comply with applicable "guidance" issued by the Department of Health and Human Services "regarding the use of artificial intelligence, algorithms, or other software tools." Regulated entities will likely challenge the assertion that a state can require companies to comply with any statements made by a federal regulator when that federal regulator lacks the authority or has chosen not to issue actual regulations on the subject.
• The automated decision-making tools are subject to audit or compliance review by the California Departments of Insurance and Health Care Services, including as part of periodic onsite medical surveys. The law does not provide specific guidance on what the audits will involve. Will the regulators expect to review the workings of an AI model?

Failure to comply with SB 1120 may result in administrative penalties paid to the Managed Care Administrative Fines and Penalties Fund, and/or criminal penalties for willful violations.

Considerations for health plans and disability insurers

With only three months to prepare, HCSPs and disability insurers with California subscribers or enrollees should promptly consider whether this new California law applies to them and their business practices. Compliance may take time and involve evaluating whether automated decision-making tools are compliant, updating policy disclosures, implementing processes for evaluating the performance of automated decision-making tools, and preparing for audits. Failure to comply could result in material risk to HCSPs and disability insurers given the regulatory audit rights and broad language protecting enrollees from any direct or indirect harm.

Client Alert 2024-210