EveryAILaw.com

Requirements at a glance

This regulation imposes 13 specific requirements for Human Oversight across 1 provision:

• Licensed clinical decision maker — A medical-necessity determination must be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved. The decision maker must review and consider the requesting provider's recommendation, the enrollee's or insured's medical or other clinical history as applicable, and individual clinical circumstances (§ 1367.01(k)(2); Ins. Code § 10123.135(j)(2))
• Tool may not make adverse medical-necessity decision — The artificial intelligence, algorithm, or other software tool shall not deny, delay, or modify health care services based in whole or part on medical necessity (§ 1367.01(k)(2); Ins. Code § 10123.135(j)(2))
• Clinical basis and no group-only basis — As applicable, the tool must base its determination on the enrollee's or insured's medical or clinical history, individual clinical circumstances presented by the requesting provider, and other relevant clinical-record information; it does not base its determination solely on a group dataset
• Legal criteria and non-supplanting — Tool criteria and guidelines must comply with the governing code and applicable state and federal law, and the tool must not supplant health care provider decision-making
• Nondiscrimination and equitable application — Tool use must not directly or indirectly discriminate in violation of state or federal law and must be fairly and equitably applied, including under applicable federal Department of Health and Human Services regulations and guidance
• Auditability and written oversight — The tool must be open to inspection for audit or compliance review; disclosures about its use and oversight must appear in the required written policies and procedures
• Performance review — Tool performance, use, and outcomes must be periodically reviewed and revised to maximize accuracy and reliability
• Patient-data purpose limit — Patient data may not be used beyond its intended and stated purpose, consistent with the Confidentiality of Medical Information Act and HIPAA as applicable
• No direct or indirect harm — The tool does not directly or indirectly cause harm to the enrollee or insured
• Covered review timing — The AI-specific subdivision applies to utilization review or utilization management functions that prospectively, retrospectively, or concurrently review covered-service requests
• Federal guidance — Covered plans and disability insurers must comply with applicable federal Department of Health and Human Services rules and guidance on AI, algorithms, or other software tools
• Medi-Cal managed care qualification, plans only — Health and Safety Code § 1367.01(k) applies to a Medi-Cal managed care plan only to the extent the State Department of Health Care Services obtains necessary federal approvals and federal financial participation is not otherwise jeopardized (§ 1367.01(k)(7)); the parallel Insurance Code section has no such clause
• Religious-care exception, plans only — Health and Safety Code § 1367.01 does not apply to decisions for the care or treatment of the sick who depend on prayer or spiritual means for healing in the practice of religion described by § 1270(a) (§ 1367.01(m)); the parallel Insurance Code section has no such clause