Last reviewed: October 2026
TL;DR — Key Takeaways
- A business that arranges or pays for enrollees’ care in return for a prepaid or periodic charge paid by or for them is a health care service plan.
- Do not do business as a plan in California without a license in effect or an exemption.
- Providing all the care yourself for a recurring fee does not, on its own, keep a membership practice outside the Act.
- If you rely on an exemption, or an exception from a definition, you must prove it in a proceeding under the Act.
- Under contracts entered into, amended or renewed on or after July 1, 2019, a person who assumes global risk must obtain a plan license unless exempt.
- Unless the DMHC advises otherwise, it continues its expedited exemption request process until its planned amendments to the global-risk regulation take effect.
- Each violation of the Act carries a civil penalty up to $25,000; separate penalties for violating Section 1349 also reach anyone who helps direct the violator’s management or policies.
Under California’s Knox-Keene Act, a business is a health care service plan if, for a prepaid or periodic charge, it arranges health care services for subscribers or enrollees or pays or reimburses any part of their cost. Your business then needs a Knox-Keene license unless an exemption applies. Doing business as a plan in California without a license from the Department of Managed Health Care, or an exemption, is unlawful. The test looks at what the business undertakes and how it is paid, not at whether it calls itself a practice, an MSO, a telehealth platform or a membership program, so any of them can fall inside it. Medical groups and MSOs that take on both professional and institutional risk under a contract face a separate licensing rule, with its own exemption route.
What the Knox-Keene Act is, and what it is not
California’s law on health care service plans has a long formal name. The chapter may be cited as the Knox-Keene Health Care Service Plan Act of 1975. Most people shorten it to the Knox-Keene Act, and so does this post.
It is often confused with the Moscone-Knox Act, a different law with a similar name. If your question is who may own a professional corporation, start with what the Moscone-Knox Act means in California. This post stays with Knox-Keene.
The Knox-Keene Act has its own regulator. The Department of Managed Health Care, inside the California Health and Human Services Agency, has charge of the laws on health care service plans and the health care service plan business. This post calls it the DMHC. Its director may conduct audits and examinations of the books and records of plans and other persons subject to the Act.
What makes a business a health care service plan
The Act defines a plan by what a business does and how it is paid. A health care service plan is any person who undertakes either of two things in return for a prepaid or periodic charge paid by or on behalf of subscribers or enrollees:
- to arrange for the provision of health care services to the subscribers or enrollees; or
- to pay for or reimburse any part of the cost of those services.
The definition joins two questions:
- What you undertake. Either you arrange for care, or you pay for or reimburse any part of its cost. Paying alone meets this part.
- How you are paid. The charge is prepaid or periodic, and it is paid by or on behalf of the people who receive the care.
The word person is defined broadly. Under the Act, it includes an individual, firm, association, organization, partnership, business trust, foundation, labor organization, corporation, limited liability company, public agency or political subdivision of the state. So the definition of a plan is not limited to HMOs or insurers. It reaches any person that meets both parts.
The Legislature also stated its purpose. Its stated intent is that the Act applies to any private or public entity that provides, administers or otherwise arranges for health care services in return for a prepaid or periodic charge, unless the Act’s exemption section exempts it. The charge is one paid by or on behalf of a subscriber or enrollee. Notice the first of the three verbs: provides.
Specialized plans, including dental
A plan does not have to cover every kind of care. A specialized health care service plan contract covers a single specialized area of health care, including dental care, in return for a prepaid or periodic charge paid by or on behalf of the subscribers or enrollees. It is either of these:
- a contract for health care services in that area for subscribers or enrollees; or
- one that pays for or reimburses any part of the cost of those services.
The second branch matters to a business that only pays for or reimburses part of the cost of dental or other specialized care and furnishes none of it. The definition reaches that contract too.
Can a practice, an MSO, a telehealth platform or a membership be a plan?
Each of them can be. The test is the arrangement and the charge, so the type of business, and the license its owners hold, do not settle the question.
A medical practice. The Act’s definition of person names corporations and does not set medical practices apart. A practice that arranges for its patients’ care, or pays for part of it, in return for a prepaid or periodic charge faces the same two questions as any other business.
An MSO. An MSO is measured by what it undertakes and how it is paid, like any other business. If the structure is new to you, see what an MSO is in California healthcare and what a management services agreement contains in California healthcare. For many medical groups and MSOs, the pressing question is a risk contract, which the global-risk rule below addresses.
A telehealth platform. A platform that sells subscriptions and lines up clinicians for subscribers raises both questions at once: does it arrange for care, and is it paid a periodic charge? Entity choice is a separate question, covered in telehealth business formation in California.
A membership or subscription practice. Membership models, in which a practice provides its own care for a recurring fee, raise this question often. The Legislature’s statement of intent names an entity that provides health care services for a prepaid or periodic charge, alongside one that administers or arranges them, unless an exemption under the Act applies. Do not build the business on the assumption that delivering all of the care yourself keeps a membership outside the Act. If you plan to sell memberships, put the model to the DMHC, or to us, before you sell the first one.
If you want to know how this applies to your own situation, call Bay Legal at (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or reach us through baylegal.com/contact-us.
Operating without a license, and the exemptions that may apply
The licensing rule is direct. It is unlawful for any person to engage in business as a plan in California, or to receive advance or periodic consideration in connection with a plan from or on behalf of persons in California, unless one of these applies:
- the person first secured from the director a license as a plan that is then in effect; or
- the person is exempted by the Act’s exemption section or a rule adopted under it.
Either act is enough to bring the rule into play: doing business as a plan, or taking advance or periodic consideration in connection with one.
The Act contains exemptions. Two that healthcare business owners commonly ask about follow. They are examples, not the full list.
- Class exemptions by rule or order. The director may, by rule or order, exempt any class of persons or plan contracts from the Act, unconditionally or on terms, if the director finds all of the following:
- the exemption is in the public interest;
- it is not detrimental to the protection of subscribers, enrollees or regulated persons; and
- their regulation is not essential to the Act’s purposes.
- Insurers. The Act does not apply to a person operating under a certificate from the Insurance Commissioner, unless that entity directly provides the health care service through its own or contracting facilities and providers. In that case, the Act applies to the insurer’s plan and to the insurer.
Then comes proof. In a proceeding under the Act, the person who claims an exemption, or an exception from a definition, must prove it. If your model depends on an exemption, or on falling outside a definition, build the record that shows it before anyone asks.
Global risk: when a medical group or MSO needs a license
Medical groups and MSOs that take on risk under contracts meet a second licensing rule: the DMHC’s general licensure regulation on global risk.
Under that regulation, global risk means accepting a prepaid or periodic charge from or on behalf of enrollees in return for assuming both professional and institutional risk. The two halves are defined separately.
- Professional risk. Professional risk is the assumption of the cost of physician, ancillary or pharmacy services provided by physicians or other licensed or certified providers to subscribers or enrollees, in return for a prepaid or periodic charge.
- Institutional risk. Institutional risk is the assumption of the cost of hospital inpatient, hospital outpatient or hospital ancillary services to subscribers or enrollees, in return for a prepaid or periodic charge, other than services under the person’s own hospital license.
The charge is defined broadly too. For the global-risk rule, a prepaid or periodic charge is any compensation for assuming the risk, or arranging for others to assume it, of delivering or arranging the contracted health care services. It is paid at the start or the end of a set period. It may be a fixed amount or a percentage of savings or losses that the entity shares. So the rule is not limited to capitation paid in advance. A share of savings paid at the end of a period can count.
The core rule follows. Under the regulation, any person who assumes global risk must obtain a license to operate a health care service plan under the Act’s licensing requirement in section 1349. The regulation applies to any contract entered into, amended or renewed on or after July 1, 2019.
The regulation also defines a license category for this work. A restricted health care service plan is a licensed plan that assumes both professional and institutional risk for the subscribers or enrollees of another full service or specialized plan, under a contract with that plan. It does not directly market, solicit or sell plan contracts.
The alternative to a license is an exemption. Under the Act’s exemption section, the director shall grant an exemption from the global-risk licensing rule to a person after review and a finding. The finding is that the exemption is in the public interest and not detrimental to the protection of subscribers, enrollees or persons regulated under the Act. The person requesting it submits information for the director to consider.
Keep one limit in view. The global-risk rule and the DMHC guidance below answer whether a risk contract needs a license or an exemption under this regulation. They do not decide whether your business is a health care service plan. The definition above still applies to the business as a whole.
Global-risk contracts the DMHC does not require you to file
The DMHC letter this section and the next rely on, its All Plan Letter on the third extension of the phase-in period for expedited exemption requests, is dated December 3, 2020.
In it, the DMHC has determined that some contracts that technically fall within the global-risk regulation do not need to comply with it at this time. The determination rests on the director’s finding that this is in the public interest and not detrimental to enrollees. The DMHC also determined that entities entering into those contracts do not need to file them with the DMHC.
The arrangements that do not need to be filed at this time include the following, between DMHC-licensed plans, hospitals or provider groups, where the provider takes financial responsibility for providing or arranging all services of an episode of care:
- bundled payments;
- case rates;
- diagnosis-related group (DRG) payments;
- contracts for professional services in a hospital emergency department; and
- per diem payments.
They also include professional capitation-only agreements between a licensed plan and a provider. Under these, by the Division of Financial Responsibility, the provider takes financial responsibility for professional services that may be given in a hospital but shares in none of the hospital’s savings or losses. An arrangement that combines bundled payments, case rates, DRG payments or per diems with other global risk sharing, such as risk pools or global budgets, requires the entity that assumes the global risk to apply for an exemption.
Two more categories sit outside the regulation, in the DMHC’s view. Medical groups, hospitals and other entities that are not DMHC-licensed plans do not need to submit the contracts under which they take part in a CMS Accountable Care Organization. The DMHC treats those contracts as outside the regulation. And where all of the consumers affected by a global-risk arrangement are covered by an insurer licensed by the California Department of Insurance, the DMHC treats the arrangement as outside the regulation.
Neither the global-risk regulation nor the DMHC’s guidance relieves DMHC-licensed health plans of their duty to file their contracts with the DMHC for review and approval. That duty arises under the Act and its regulations, including title 28, section 1300.51 of the California Code of Regulations.
The expedited exemption for other global-risk contracts
Unless the DMHC advises otherwise, it continues its expedited exemption request process until the amendments it plans to the global-risk regulation take effect.
For a global-risk contract outside those categories, the entity, or someone acting for it, submits a Request for Expedited Exemption. The deadline is the later of 30 days after all parties sign the contract or renewal and 30 days after its effective date. To obtain the expedited exemption, the entity, or a person acting for it such as an attorney or another party to the contract, submits two things to the DMHC. The first is a copy of the executed contract. The second is the Request for Expedited Exemption Form, or a cover letter with all the information the form asks for. When the DMHC receives the request, it deems the contract exempt from the regulation and issues an Order of Exemption.
Each party carrying global risk needs its own exemption. Where only one party to a contract assumes global risk, only that party needs an exemption. In the DMHC’s example, a hospital and a provider group set a global budget and share any savings. Both have assumed global risk, and each must receive an exemption.
Renewals, amendments and duration
An evergreen renewal counts as a renewal. When a contract that already has an exemption renews by an evergreen clause, the parties submit the renewed contract within 30 days of the renewal. A short-term renewal of 90 days or less, with no other material change, does not need to be filed.
If the DMHC already issued an Order of Exemption for a contract, non-substantive amendments that do not affect the risk arrangements need not be submitted to the DMHC for an exemption. Amendments that must be submitted to the DMHC for an exemption include those that:
- change the risk-sharing arrangements;
- extend the contract’s duration; or
- change the parties to the contract.
The exemption lasts for the term of the contract if a DMHC-licensed plan is a party to it. If not, it lasts until the earlier of two years from the grant or the contract’s renewal or amendment. For entities that already received an order of exemption during the phase-in period, the DMHC issued a superseding order that extends the duration of those exemption orders. Durations differ, so read the one stated in your own order.
Read the two rules together. A renewal or amendment that need not be filed does not end the exemption. The letter excuses the filing because the order already issued still covers the contract, and that order runs to the end date stated in it. A renewal or amendment that must be filed ends the exemption, and the new request is due within 30 days after all parties sign it or after its effective date, whichever is later; for an evergreen renewal, it is due within 30 days of the date the contract renewed.
An exemption is narrower than it sounds. An exemption from the global-risk regulation does not mean the DMHC approves the contract’s terms for other purposes. The DMHC may still find that the contract violates other parts of the Act. Examples are the rules that medical decisions be made by qualified providers unhindered by fiscal management and that enrollees have timely access to medically necessary care. The order covers the contract it names, under the global-risk rule. The plan definition still applies to the business.
If you are getting ready for this step, we can help you check the papers and the timing first. Call (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or use baylegal.com/contact-us.
Penalties for operating without a license, and for licensed plans
The Act carries civil, administrative and criminal consequences.
Civil penalties
A person who violates the Act, or a rule or order under it, is liable for a civil penalty of up to $25,000 for each violation. The director recovers it in a civil action in the name of the people of the State of California. An action for that civil penalty must be brought within four years after the act or transaction that is the violation.
Operating without a license carries its own civil penalties. A person who violates the Act’s licensing requirement is liable for a civil penalty of up to $5,000, and of up to $1,000 for each subscriber under a contract entered into or renewed during the violation. So is any person who directly or indirectly takes part in directing that person’s management or policies, such as an officer, director or partner. The per-subscriber penalty applies only when one of the conditions the section lists occurs. The exposure is not limited to the entity.
Discipline of a licensed plan
For a licensed plan, the director may, after notice and an opportunity for a hearing, suspend or revoke its license or assess administrative penalties when the plan has committed an act or omission that is a ground for discipline.
The criminal penalty
On conviction, a person who willfully violates the Act or a rule or order under it is punished by a fine of up to $20,000, imprisonment, or both. The imprisonment is for up to one year in a county jail or under Penal Code section 1170(h). No person may be imprisoned for violating a rule or order if it is proven that the person had no knowledge of the rule or order.
When to stop before you sell, sign or renew
For some business models, the honest answer to this post’s title is yes. A model that looked simple at the planning stage can need a license, an exemption or a redesign, and sometimes the better decision is not to launch it in its first form.
Stop and settle the question before you:
- Sell a membership, subscription or prepaid package for health care services, including care your own practice provides.
- Add a dental or other specialized benefit that you pay for or reimburse.
- Sign a contract under which you take on both professional and institutional risk, whether through capitation, shared savings, a risk pool or a global budget.
- Let an exempt contract renew by an evergreen clause, or amend its risk sharing, its duration or its parties.
- Rely on an exemption that you would have to prove in a proceeding under the Act.
Our California healthcare business attorney page and our page on healthcare MSO attorney work in California describe this side of our practice.
If you are deciding what to do next, we would rather talk it through early than after the fact. Call Bay Legal at (650) 668-8000 in Northern California or (213) 668-8000 in Southern California, or reach us through baylegal.com/contact-us.
When we review a membership model, an MSO arrangement or a risk contract, we look at:
- what the business undertakes for the people it serves;
- who pays and on what schedule;
- whether the business provides, administers or arranges the care;
- whether any party takes on professional risk, institutional risk or both;
- whether each party carrying global risk has its own license or exemption; and
- whether any exemption the model depends on can be proved.
Frequently Asked Questions
Is the Knox-Keene Act the same as the Moscone-Knox Act?
No. They are different laws with similar names. The Knox-Keene Act, which may be cited as the Knox-Keene Health Care Service Plan Act of 1975, governs health care service plans, and the Department of Managed Health Care has charge of it. The Moscone-Knox Act is a separate law on a different subject.
Does a membership or subscription medical practice need a Knox-Keene license?
It can. The Act defines a plan by the arrangement and the charge. The Legislature’s stated intent is that the Act applies to an entity that provides, administers or otherwise arranges for health care services for a prepaid or periodic charge, unless an exemption applies. Delivering all of the care yourself does not, on its own, take a membership outside that intent. Settle the question before you sell the first membership.
What are the penalties for operating without a Knox-Keene license?
The business is liable for a civil penalty of up to $5,000, and of up to $1,000 for each subscriber under a contract entered into or renewed during the violation. So is any person who directly or indirectly takes part in directing its management or policies, such as an officer, director or partner. The per-subscriber penalty applies only when a condition listed in the statute occurs. A civil penalty of up to $25,000 per violation also applies to violations of the Act, in an action brought within four years. A willful violation is punished on conviction by a fine of up to $20,000, imprisonment, or both. But no one may be imprisoned for violating a rule or order if it is proven the person had no knowledge of it.
Does a medical group or MSO that takes global risk need a license?
Under the DMHC’s general licensure regulation, any person who assumes global risk must obtain a plan license unless exempt. Global risk means accepting a prepaid or periodic charge from or on behalf of enrollees in return for assuming both professional and institutional risk. The regulation applies to any contract entered into, amended or renewed on or after July 1, 2019. A person requesting an exemption from the global-risk licensing rule must submit information for the director to consider. The director shall grant that exemption to a person after:
- a review;
- a finding that the exemption is in the public interest; and
- a finding that it is not detrimental to the protection of subscribers, enrollees or persons regulated under the Act.
Some contract types are on the DMHC’s no-filing list, and others go through an expedited exemption request. Neither route decides whether the business itself is a plan.
Who has to prove that an exemption applies?
In a proceeding under the Act, the person who claims an exemption, or an exception from a definition, must prove it. If your model depends on an exemption, keep the record that shows it applies.
Legal References
- Knox-Keene Health Care Service Plan Act of 1975, Cal. Health & Safety Code § 1340 et seq.
- Cal. Health & Safety Code § 1341
- Cal. Health & Safety Code § 1343
- Cal. Health & Safety Code § 1343.5
- Cal. Health & Safety Code § 1345
- Cal. Health & Safety Code § 1346
- Cal. Health & Safety Code § 1349
- Cal. Health & Safety Code § 1386, subd. (a)
- Cal. Health & Safety Code § 1387, subds. (a), (c)
- Cal. Health & Safety Code § 1390
- Cal. Health & Safety Code § 1393.5, subds. (a), (b)
- Cal. Health & Safety Code § 1399.5
- Cal. Code Regs., tit. 28, § 1300.49
- Cal. Code Regs., tit. 28, § 1300.51
- Department of Managed Health Care, DMHC All Plan Letter 20-038, General Licensure Regulation: Third Extension of Phase-In Period for Expedited Exemption Requests
