SB 363 requires licensed health care service plans and regulated health insurers to report annually every treatment denial and modification to the appropriate California regulator, with detailed disaggregation by type of care, diagnosis, age, and other demographic categories. Regulators must compare those submissions to Independent Medical Review (IMR) outcomes and identify patterns where IMR overturns or plan reversals indicate incorrect denials or modifications.
When the IMR outcomes reveal a pattern of overturns or reversals in a specific category, the bill authorizes substantial administrative penalties and creates dedicated state accounts to receive those penalties and fund implementation. The measure is designed to increase transparency, give regulators actionable oversight data, and create a concrete enforcement lever tied to IMR findings — while raising compliance and data-quality questions for plans and insurers.
At a Glance
What It Does
SB 363 requires health care service plans and health insurers to submit annual reports listing every treatment denial and modification, disaggregated by care type, diagnosis, age, and available demographic fields. Departments must compare reported denials/modifications to IMR overturns and reversals, and may impose administrative penalties where IMR outcomes show systemic overturn rates.
Who It Affects
Knox‑Keene licensed health care service plans and state‑regulated health insurers; the Department of Managed Health Care (DMHC) and the Department of Insurance (DOI); providers and delegated vendors who supply records; and independent medical review organizations that process IMRs.
Why It Matters
This bill links oversight directly to IMR results rather than only to internal grievance metrics, creating a precedent where external clinical reviews trigger enforcement. That can shift how plans use utilization management, produce new public datasets for researchers and advocates, and introduce new compliance and operational burdens for payers.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB 363 builds two parallel reporting-and-enforcement tracks: one under the Health and Safety Code for health care service plans (DMHC jurisdiction), and one under the Insurance Code for health insurers (DOI jurisdiction). Each track requires the payer to report every treatment denial and every modification of a requested treatment for the prior year.
Reports must separate denials and modifications into two high‑level care types — surgical/medical and behavioral — and into diagnosis categories or subcategories that the departments will coordinate to keep consistent across regulators. Plans and insurers must also provide the total number of claims processed during the prior year.
The bill requires granular reporting on why a denial or modification occurred. Payers pick from enumerated reasons such as medical necessity, investigational/experimental, billing errors, duplicate claims, out‑of‑network provider, insufficient information, ineligibility, and untimely submission, with an "other" option that requires specification.
Reporting must be disaggregated by age and, where available, by demographic categories the departments define. Modifications — not just outright denials — must include the type of modification applied.Once the departments receive annual submissions, they compare a payer’s denials and modifications to IMR activity.
The comparison looks at IMR decisions that overturn denials or at situations where a payer reverses a denial or modification after an IMR is requested, filed, or applied for. For payers with at least a minimum IMR volume, the statute treats a sustained pattern of overturns or reversals in a single category as a violation that triggers administrative penalties.
Penalty amounts are tiered and subject to periodic adjustment by a medical‑care CPI index. The bill also creates separate state accounts to receive penalty revenue and permits those moneys to be used, after appropriation, to offset implementation costs and related fund purposes.The departments must publish analysis and conclusions from these data in their public reporting beginning with the 2028 cycle.
The statute therefore moves enforcement from episodic fines and informal corrections to a data‑driven model: regulators get standardized, category‑level denial data plus IMR outcome comparisons that can justify targeted enforcement and public accountability.
The Five Things You Need to Know
Reports must separate every denial or modification into two care types — surgical/medical and behavioral — and into diagnosis subcategories that DMHC and DOI will align.
First annual reports are due to the departments on or before June 1, 2026; reports must also include the total number of claims processed in the prior year.
A payer with 10 or more IMRs in a year faces a violation if more than 50% of its IMRs in any single reporting category result in overturns or reversals.
Penalties are tiered: minimum $25,000 for a first violation, $50,000–$200,000 for a second, and at least $500,000 for each subsequent violation; amounts will be CPI‑adjusted beginning January 1, 2031 and every five years.
The bill creates two dedicated accounts — a DMHC subaccount and a DOI fund — to receive penalties and permits those moneys, upon appropriation, to cover implementation costs.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
What plans must report and how the data must be structured
This section specifies the reporting obligations for Knox‑Keene licensed health care service plans. Plans must report each denial and modification, classify it by care type (surgical/medical or behavioral), and place it into diagnosis categories the department defines in coordination with DOI. Reports must include age disaggregation and, where available, demographic breakdowns set by the department. For each denial or modification the plan must select a reason from an enumerated list (medical necessity, investigational, billing issues, out‑of‑network, insufficient information, etc.) and provide details when choosing "other." The section also requires an annual count of all claims processed and sets the first submission deadline.
How DMHC compares denials to IMR outcomes and enforces violations
DMHC must compare plan reports to IMR outcomes: successful IMR overturns and reversals that a plan makes after an IMR is requested. The section defines the counting rule broadly — a reversal counts whether the IMR organization issues a decision or the plan reverses after an IMR is filed. It establishes the violation trigger (volume minimum plus a >50% overturn/reversal rate in a single category) and treats each excess IMR as a separate violation. Enforcement tools include tiered administrative penalties and a statutory pathway to combine administrative penalties with other civil or criminal remedies if the director deems it necessary. The statute also authorizes CPI‑indexed adjustments to penalty amounts and creates a specialty subaccount to receive penalty revenue for DMHC‑related uses.
Parallel reporting duties for health insurers
Section 10169.6 mirrors the DMHC reporting requirements for health insurers regulated by DOI. It imposes the same data structure: two care types, diagnosis subcategories aligned with DMHC, age and available demographic disaggregation, enumerated denial reasons, and annual total claims processed. Insurers must submit their first reports by the same deadline. The symmetry is deliberate to produce comparable datasets across the two supervising agencies.
DOI comparison to IMR outcomes, penalties, and fund
DOI must compare insurer reports to IMR overturns and insurer reversals after IMR requests. The violation trigger, counting rules, and penalty structure track the DMHC provisions, including the minimum‑volume rule and per‑excess‑IMR violations. DOI gets a dedicated State Treasury fund to receive penalties and may use appropriated funds to cover implementation costs. The commissioner retains the ability to pursue the administrative penalties alongside other legal remedies.
Public reporting, timing, and cross‑department data alignment
Both departments must include the reported data and analysis of IMR comparisons in their public reports, with the requirement to publish beginning in the 2028 reporting cycle. The bill explicitly requires the departments to coordinate so diagnosis categories and demographic reporting are consistent across DMHC and DOI datasets. Practically, that creates an expectation of shared taxonomy, standardized data formats, and public web publication — all operational tasks the agencies must implement to make the statute’s oversight model work.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Enrollees and insured patients — They gain enhanced transparency and a stronger route to systemic remedies when IMR findings show recurring wrongful denials or inappropriate modifications.
- Consumer advocates and researchers — The standardized, cross‑agency datasets create new evidence for monitoring access, identifying disparate impacts, and supporting policy or enforcement petitions.
- Regulators (DMHC and DOI) — Regulators receive structured, comparable data tied to IMR outcomes that make it easier to detect problem payers and justify targeted enforcement actions.
- Providers who appeal denials — Greater visibility into patterns can strengthen provider arguments during disputes and reduce repetitive denials if enforcement follows.
Who Bears the Cost
- Health care service plans and health insurers — They must build or expand claims‑level reporting systems, map denials to the new taxonomy, supply demographic breakdowns, and face potentially large administrative penalties for identified patterns.
- Smaller plans and regional insurers — Even if they fall below the IMR penalty threshold, these payers still incur fixed compliance costs for reporting without the same economies of scale as large payers.
- State agencies (DMHC and DOI) — Departments must stand up data ingestion, validation, public reporting, and enforcement workflows; although penalty funds can be used upon appropriation, initial implementation will demand staff time and IT effort.
- Providers and delegated vendors — They may face increased requests for records and tighter timelines as payers compile data to support or defend denials, raising administrative overhead.
Key Issues
The Core Tension
SB 363 pits two valid goals against each other: holding payers accountable for repeatedly losing in external medical reviews and making denial patterns transparent, versus preserving payers’ ability to manage care and control costs through utilization management. The statute’s binary threshold and counting rules push enforcement toward certainty, but that same design risks penalizing legitimate clinical judgment, producing gaming around coding and reversal timing, and creating statistical false positives absent careful data governance.
The bill’s enforcement hinge—the combination of a minimum IMR volume and a >50% overturn/reversal rate in a single category—creates statistical and operational challenges. Low absolute IMR counts make percentages unstable; a specialty service with few IMRs could trigger a penalty based on small‑number volatility.
Conversely, high‑volume payers might absorb the noise but still be exposed to large aggregate penalties. The statute does not add smoothing rules or minimum absolute counts beyond the 10‑IMR floor, so payers and regulators will need to negotiate how to treat small‑cell statistical noise.
Data quality and taxonomy will drive outcomes more than policy intent. The departments must align diagnosis categories and demographic fields across separate regulatory systems and ensure consistent coding conventions.
Payers can respond by reclassifying denials into broader or different reason codes (for example, shifting a denial from a clinical medical‑necessity code to an administrative coding reason), which would change reported patterns without changing clinical behavior. The decision to count reversals that occur any time after an IMR is "requested, filed, or applied for" widens the enforcement net but also creates perverse incentives: plans might reverse denials quickly when an IMR is filed to avoid formal IMR decisions but still generate a recorded reversal that counts against them.
That counting rule will require careful operational definitions to avoid mischaracterizing plan responsiveness as evidence of misconduct.
Finally, the statute’s reliance on penalty revenue to fund implementation is pragmatic but uncertain. Penalty proceeds are available only upon appropriation, and aggressive enforcement could produce political and budgetary pushback.
Privacy concerns also arise as the datasets expand demographic disaggregation — agencies must publish conclusions while protecting individual‑level PHI. Those implementation details will determine whether the bill produces meaningful accountability or powerful but blunt incentives with unintended side effects.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.