When California’s Physicians Make Decisions Act took effect on January 1, 2025, it was the first law of its kind in the country: a flat requirement that a licensed physician, not an algorithm, must sign off before an insurer can deny, delay or modify medically necessary care. Nearly two years later, that single state law has become the template for a rapidly expanding patchwork of state rules governing how insurers can use artificial intelligence in coverage decisions.
What California’s law actually requires
Senate Bill 1120 requires that when California health plans and disability insurers use AI or algorithmic tools in utilization review, those tools must rely on a specific patient’s individual medical history and clinical circumstances rather than generalized population datasets, and the final determination on medical necessity must be made by a licensed physician or other qualified healthcare professional competent to evaluate the clinical issue at hand. The law also imposes decision deadlines, five business days for standard requests, 72 hours for urgent ones and 30 days for retrospective reviews, and gives the Department of Managed Health Care and the Insurance Commissioner discretion to levy administrative penalties against insurers that violate it.
The backdrop: a wave of anger at algorithmic denials
SB 1120 didn’t emerge in a vacuum. It followed a string of high-profile controversies over insurers’ use of predictive algorithms to deny claims, including litigation over UnitedHealth’s nH Predict tool, which plaintiffs allege was used to cut off Medicare Advantage patients’ rehabilitation coverage based on statistical predictions rather than individualized clinical review. Those cases, combined with investigative reporting and congressional scrutiny of AI-driven claim denials, gave California lawmakers a politically potent argument: that patients were having care decisions made by software trained on population averages rather than doctors looking at their actual charts.
Other states are now writing their own versions
According to a tracker maintained by Holland & Knight, state lawmakers have passed roughly 14 new laws this year alone regulating AI in healthcare, and insurance-specific AI bills have proliferated even faster, with one industry count putting the 2026 total at 173 bills introduced across 37 states. The approaches diverge in how far they go. Legislation in Montana has explicitly adopted SB 1120’s human-oversight framework. New York and Pennsylvania are pursuing a lighter-touch, disclosure-first model that would simply require payers to tell patients and providers when AI is involved in utilization review, without necessarily restricting its use. Rhode Island, Texas and Connecticut have introduced bills that go further than disclosure, aiming to prohibit AI from being the basis for an adverse coverage determination outright. Minnesota has gone furthest of all, with a proposal that would ban AI from utilization review entirely, a notably stricter stance than any law currently in effect.
Insurers warn of a fractured rulebook
Trade groups representing health insurers have raised consistent concerns as this legislative wave builds: a 50-state patchwork of differing disclosure rules, review timelines and definitions of “AI” creates enormous compliance complexity for national payers operating across state lines, potentially slowing exactly the kind of efficient claims processing that proponents say AI tools were meant to enable. Insurers also argue that properly supervised algorithmic tools can speed up routine approvals and free up physician time for genuinely complex cases, and that blanket restrictions risk treating all AI use as equivalent to the opaque, poorly validated models that drew criticism in the first place.
Patient advocates see overdue guardrails
Patient and physician advocacy groups take the opposite view, arguing that without laws like SB 1120, patients have no way of knowing whether a denial letter reflects a doctor’s clinical judgment or a statistical model’s prediction, and no mechanism to challenge the latter. They point to the volume of litigation and regulatory attention directed at AI claim-denial tools over the past two years as evidence that voluntary industry safeguards were insufficient, and argue that requiring physician sign-off restores a basic due-process protection that existed before insurers began deploying predictive software at scale.
What’s next
With California’s Department of Managed Health Care now two years into overseeing SB 1120 and a dozen-plus states actively drafting their own versions, legal trackers expect 2027 legislative sessions to bring even more bills, alongside the first real test of how aggressively state regulators will enforce the human-review requirements already on the books. Absent a federal standard, the state-by-state approach looks set to keep expanding, leaving national insurers to build compliance systems that can flex to whichever state’s rules apply to a given patient’s claim.
Photo: Mikhail Nilov / PEXELS via Pexels
