Independent watchdog project. Not affiliated with the State of California, DHCS or Medi-Cal Dental.
Not the State of California
An All Plan Letter is how the State tells your dental plan what to do. The name means the letter goes to all the plans. It does not mean we are going to work through all the letters. DHCS has issued more than a hundred of them, and most are plumbing. We read them and write up the ones that change what a member is entitled to. The rest are on the State's own list, linked below. First is the one that hands you your own prior authorization file.
Go straight to the source
Both links leave this site and land on the State's own pages. We are not the State.
APL 26-006, the short version, out loud
Read along
0:00 / 1:47
Under two minutes on one page of All Plan Letter 26-006: the part that puts your prior authorization in your own hands from 1 January 2027. Press play and read along, or tap any line to jump to it. Everything the track says is explained, sourced and expanded below.
An illustration of what the rules require. Not a real authorization record.
Prior Authorization Tracking. Written and produced by this project. Not sponsored by the State of California, DHCS, Medi-Cal Dental or any managed care plan. It is commentary, not advice, and no substitute for anything your plan sends you in writing.
Start here
An All Plan Letter, or APL, is a letter from the California Department of Health Care Services to the plans it pays. It is not a law and it is not a press release. It is an instruction, and the plans have to follow it or explain themselves. DHCS publishes them all in one place, and almost nobody outside the industry reads them.
That is a shame, because the letters are where members find out what they are owed. This one is a good example. It is addressed to the plans, it is written in the language of federal rule numbers, and buried in it is a promise that from 1 January 2027 you can watch your own prior authorization move.
All Plan Letter 26-006 is dated 24 June 2026. Its subject line is “INTEROPERABILITY FINAL RULES REQUIREMENTS FOR DENTAL MANAGED CARE PLANS.” It replaces APL 22-013, which covered the older half of the same federal rules, and it carries the whole of the new half. It ends with the line that gives every APL its teeth: “Any failure to meet the requirements of this APL may result in a Corrective Action Plan (CAP) and/or monetary sanctions.”
Behind it sit two federal rules. The first, from May 2020, made plans open a door to your claims. The second, from January 2024, makes them open four more doors and put prior authorization behind one of them. California is not inventing any of this. What California is doing is telling its three dental plans, in writing, that it applies to them.
TO: ALL MEDI-CAL DENTAL MANAGED CARE PLANS
Who this page is for. California has 58 counties and dental managed care runs in two of them. In Sacramento, joining a plan is mandatory. In Los Angeles, it is voluntary and most members stay in fee-for-service. San Mateo does it a third way, folding dental into the medical plan. That leaves 55 counties on fee-for-service only, and if you are in one of those, this letter is not addressed to your program. The county rules are here.
The part the track is about
Section A of the letter covers the Patient Access API. Strip out the acronym and it is a on the side of your plan. You pick a health app, you give it permission, it plugs in, and your plan has to hand over what it holds about you.
Three things about that socket are worth knowing before the detail. It is your permission that opens it, and nobody else's. Your plan does not get to decide that the app you picked is the wrong one, except on a security ground it can defend. And the letter is explicit that using it must not be a chore.
“… through the use of common technologies and without special effort from the Member.”
APL 26-006, section A. The same sentence requires the plan to hand the data to a third party application acting “with the approval and at the direction of a Member,” or of someone the member has appointed in writing. A plan may cut off an app only when it reasonably determines, consistent with its own security risk analysis under the HIPAA Security Rule, that letting the app carry on is an unacceptable risk, judged by “objective verifiable criteria that are applied fairly and consistently across all applications and developers.”
The plan must go back to dates of service on or after 1 January 2016. Three kinds of information are already covered. A fourth arrives on 1 January 2027, and that fourth one is the reason for the track.
| What | By when |
|---|---|
| Your claims, once they are settled | Within one business day after the claim is processed. That includes claims you could appeal, claims you did appeal, what the plan paid your dentist, and anything you were charged. |
| Your clinical record, in the federal standard set | Within one business day after the plan receives it. The standard set was USCDI version 1. From 1 January 2026 it is version 3, which is a longer list. |
| Encounter data | Within one business day after the plan receives it from providers. This matters in dental managed care, where plans pay many dentists a flat monthly amount per member rather than per filling, so an encounter record may be the only trace that a visit happened. |
| Prior authorizations, from 1 January 2027 | Visible no later than one business day after the plan receives the request, updated no later than one business day after any change of status, and kept visible for as long as the authorization is live and for at least one year after its last change of status. |
This is the list from the letter. Every one of these has to be visible to you, in the app you chose, for every request your dentist sends on your behalf from 1 January 2027, drugs excepted.
Our read, clearly labeled
The sixth item is the one we did not expect. Today, a member who wants to know what their dentist actually told the plan has to ask the dentist, or ask the plan for the case file after a denial. From 2027 it is supposed to be sitting in the app, before the decision, not after it. If that works as written, the gap between what your dentist says and what your plan says it received stops being invisible.
Drugs are out. The letter notes that information about covered outpatient drugs is no longer required on this socket at all. For a dental plan that is a narrow exclusion, but it is there.
And the plans have to count. From 2026, by 31 March each year, every dental plan must report to DHCS how many of its members moved data to a health app they chose, and how many did it more than once. The numbers go in aggregated and stripped of names. It is the first official measure of whether any of this gets used.
Which leaves the question the letter never answers, and the one a member actually asks first: what app, exactly?
The gap between the rule and the phone
None of this is waiting for 2027. Your claims, your clinical record and your encounters have been required on that socket since 1 January 2021. Prior authorization is the piece that joins them. So the question is not when the data arrives. It is how a member is supposed to reach it today, and that is where the whole thing falls down.
The letter sets the standard in one phrase. The data has to reach you through common technologies and without special effort from the Member. Everything below is the special effort.
We read every interoperability page the three plans publish, in September 2026. All three have built the . None of them can tell you what to plug into it.
| Plan | What it gives a member | Names an app you could use |
|---|---|---|
| Health Net | The most for a member by some distance. A page on managing your digital medical records, the 2016 start date, a plain warning that most apps are not covered by HIPAA, and links to the FTC, the Office for Civil Rights and California's own privacy laws. It sends you to an outside directory to pick from. Its dental pointer names Liberty Dental Plan's interoperability site, in a Medicare context. | No. It names a directory, not an app. |
| Liberty Dental Plan | A developer portal, plus a member FAQ and a patient education deck. The FAQ is eight questions long and genuinely useful on risk. It also tells you something the others do not: “There is not an option to select only certain types of information for sharing. When you grant permission, the external app will be able to access all your LIBERTY dental information.” | No. The eight questions never cover how to find one. |
| California Dental Network (DentaQuest) | Member education pages for patient access, provider access and payer to payer, sitting under a developer facing Interoperability API section. The patient access page says: “Find an app in the Google Play Store (Android) or the App Store (iOS). See My Health Application for examples.” That is the same directory Health Net points to. It also explains how to complain to the Office for Civil Rights, with the address and the 180 day deadline. | No. It names a directory and the phone app stores, warns that “not all apps are connected to DentaQuest,” and says to download one “once you know it connects to DentaQuest.” None of its member pages says which apps do. |
Correction, 22 September 2026
This table first said California Dental Network (DentaQuest) named no directory and no app. That was wrong. Its patient access page sends members to the phone app stores and to My Health Application. An Internet Archive copy from June 2026 shows the same wording, so the miss was ours, not a change on their side. We have fixed the row above and the lines on this page that relied on it.
Health Net and California Dental Network (DentaQuest) both point members at My Health Application, a directory run by the CARIN Alliance. We counted what is in it.
67
Apps listed in the directory
0
That mention dental anywhere
0
Ways to filter by your plan
You can filter those 67 by platform, by category and by whether the maker signed a voluntary code of conduct. You cannot filter by your insurer, and no listing tells you which plans it connects to. The word dental does not appear on the page. And the directory says plainly what it is not:
“The CARIN Alliance manages only this website; the CARIN Alliance does not endorse, certify, or manage any of the applications listed on this site.”
My Health Application, read 20 September 2026. That is a fair and honest disclaimer. It is also the opposite of what a member needs, which is somebody willing to say this app works with your plan and gets you the data the rule promised.
DHCS runs an app program of its own, with a page called Approved Apps that sounds like the answer to all of this. It says: “DHCS reviews and approves apps for privacy, security, and functionality. Apps that are not approved cannot access your Medi-Cal health data.” Under the heading Current approved apps it says they are still under review, so the list is empty today.
It is worth being careful about what that list covers, because the wording invites a member to wait for it. Read what DHCS is actually offering to share:
That is DHCS sharing the data DHCS itself holds and pays for. The page next to it in the same menu is Medi-Cal Fee-for-Service Prior Authorization Metrics Reporting, which is DHCS publishing its own numbers as a fee-for-service payer, separately from the numbers your plan has to publish. And the Interoperability landing page routes its audiences apart: members to the app pages, and managed care plans to the All Plan Letters.
Our read, clearly labeled
The State's approved list is the fee-for-service door. If you are in a Sacramento or Los Angeles dental plan, your dental record is not behind it, and waiting for that list to fill up will not bring you your prior authorization. DHCS has not said this anywhere we can find, and a member who lands on Approved Apps has no way to know it does not apply to them. That is our reading of the evidence above, not a quote, and we will publish a correction if DHCS tells us otherwise. It is also the single most useful thing we learned: two lists, neither of them yours.
No, and the letter is unusually blunt about it. A plan may shut an app out on one ground only.
“… denial and/or discontinuation of any TPAs in connection to an API occurs only when the organization reasonably determines, consistent with their security risk analysis under the HIPAA Security Rule, that continued access presents an unacceptable level of risk… using objective verifiable criteria that are applied fairly and consistently across all applications and developers.”
TPA here means third party application, your app. A defensible security judgment, applied the same way to everybody, is the only lawful reason to refuse one. Not appearing on a State list is not such a reason, and a plan that required it would be applying a categorical gate rather than the objective security test the letter sets.
So the position today, for a member of one of the three dental plans, is this. Your plan must let in any reasonable app you choose. The State's list does not govern that door and is empty anyway. And not one of your plan's own pages will name an app that works. The rule's standard is without special effort from the Member. Right now the effort is the whole job, and finding it is harder than using it.
Handing your dental history to a company you found in a directory is a real decision, and this year gave Californians a reason to take it seriously.
On 20 May 2026, DentaQuest discovered that people outside the company had reached data on its network. DentaQuest is the company behind California Dental Network, and it administers Health Net's dental plan as well, so this is not a distant story for members in either county. The notice it filed with the California Attorney General does not soften it:
“After finishing our review, we determined that your personal information was accessed and posted on the internet.”
The same letter says the information included names and “dental or vision health information, such as provider names, diagnoses, treatments and billing information,” and opens by telling the reader that “DentaQuest works with, or used to work with, your health plan to provide your dental or vision benefits.” The intrusion ran from 17 to 20 May 2026. Members were offered 24 months of identity monitoring. In the federal breach register the entry reads: DentaQuest, LLC, health plan, hacking and IT incident, network server, 15,000,000 individuals, reported 16 July 2026.
We are not telling you to avoid these apps. The right to your own record is worth having, and the people who need it most are the ones arguing with a plan about a tooth. We are saying that the decision deserves better information than anyone is currently giving you, and that a plan asking members to trust a stranger with their dental history in the same year it mailed 15 million breach letters should be the first to make that information easy to find.
For completeness: the California Attorney General's breach database also lists notices filed by Health Net entities, the most recent from Health Net Community Solutions in December 2023. It lists none from Liberty Dental Plan.
None of this needs a new law. The letter already requires plain language member resources, and the fix is a short list on a page a member can find.
You do not need any of this to get your record
The socket is one door. The older one is a written request to your plan under the federal right of access, which comes with a 30 day clock, a federal complaint desk, and no app. It reaches the same claims, the same prior authorizations and the same clinical data, and it works today. How to ask, what to ask for by name, and what to do when the plan or the company running it stalls.
Have you actually connected an app to one of these three plans? We would like to hear from you, because as far as we can tell nobody has published a single working example. Which app, which plan, what it showed you, and what it could not. We are doing our own outreach to the plans and to DHCS, and we will publish what comes back either way. Send us a tip. Your name stays out of it unless you tell us otherwise in writing.
The rest of the letter
The letter sets out five . One is for you, one is for anybody, two are for your dentist and your next plan, and one is the pipe your dentist's software uses to ask in the first place. They have different opening dates and, importantly, different consent rules.
Required since 1 January 2021 for claims, encounters and your clinical record. From 1 January 2027 it must also carry prior authorizations. You open it by giving a health app permission. Covered in full above.
What it must carryPublic, with no login, because it holds no personal information. It is the plan's list of dentists in a form that software can read and check. The plan must update the online directory at least weekly.
Why weekly, and not monthlyBy 1 January 2027. A dentist in the network can ask the plan for the record of a patient the plan has attributed to them, and the plan must answer within one business day. You can opt out, at any time, and the plan has to give you a way to do that before it shares anything at all.
The consent rulesBy 1 January 2027. When you change plans, your new plan must go and fetch your history from the old one, up to five years of it, and put it in your record. This one is opt in. Once you have opted in, the plan must ask within one week of having enough information to ask, within one week of your asking, and at least quarterly after that.
The consent rulesBy 1 January 2027. This is the pipe your dentist's software uses. It has to be loaded with the plan's own list of what needs approval, it has to state every document the plan wants for each item, and it has to answer with one of three things: approved, with the date it ends; denied, with a specific reason; or a request for more information.
Why the third answer mattersFrom 1 January 2026 the plans must run current versions of the shared standards, publish complete documentation for every socket so an app maker can connect, test them, and keep them working. A socket that exists but is undocumented is not compliance.
Where we will be lookingThe weekly rule, and why it survived. Federal law says a provider directory must be updated no later than 30 calendar days after the plan gets new information. California's Health and Safety Code says weekly. The letter deals with the clash in a footnote, and it comes down on the side of the member: where both laws cover the same material, “DHCS must follow the shorter weekly requirement found in Health and Safety Code section 1367.27(e)(1).” Directory accuracy is the thing this site spends most of its time on, so we will take that in writing.
If you are a dentist reading this, three parts of the letter are aimed at your office rather than at members: pulling a patient's record from the plan, the published list of every document the plan requires for a prior authorization, and the plain language provider guides each plan has to write. What changes for your office.
The two sockets that move your record to somebody else have opposite defaults, and the letter is careful about it.
Your dentist's access is opt out. The plan must build a process for you to refuse, and to change your mind later, and it must exist before the plan shares anything through that socket for the first time. If you do nothing, an in-network dentist the plan has attributed you to can pull your record.
Your next plan fetching your history is opt in. Nothing moves until you have said yes. When the new plan asks the old one, it has to attach an attestation that you are enrolled and that you opted in.
Attribution is the quiet word in the first of those. The plan decides which dentist counts as yours, using claims, its own member rosters, or an upcoming appointment. The letter lets plans use processes they already have. It does not say you get told who the plan thinks your dentist is.
Sensitive records keep their own protection either way. Confidentiality rules for mental health and substance use disorder records, including 42 CFR Part 2, still apply and may still need your consent.
Section G
The letter does two things to the decision itself, as opposed to the record of it.
First, it notes that the federal rule changed the timeframe for a standard prior authorization, and that the decision and the specific reason for a denial must both be communicated inside that timeframe. A denial that arrives on time but says nothing useful is not the standard any more.
Second, it does not restate the numbers. It points the plans at the contract and at the other APLs on the subject. That is not evasion. The contract's own deadline for a routine request has not changed. What the federal rule moved is the outer limit sitting behind it, from 14 calendar days down to 7.
The number you actually need is 5 business days for a routine request and 72 hours for an urgent one, with a letter to you within 2 business days of the decision, and a missed deadline counting as a denial you can appeal. Those come from the contract and from APL 22-006, and we have them set out line by line, with the sources, on the prior authorization deadlines page.
The third answer the Prior Authorization API has to be able to give is the interesting one: a request for more information. Today that conversation happens by fax and phone and often stalls, and a stalled request is what eats the clock. Putting it in the pipe, with the plan's own list of required documents published in advance, is the part of this letter most likely to shorten a real wait.
The part we will be checking every March
Starting in 2026, by 31 March each year, each dental plan must post the previous calendar year's prior authorization figures on its own website, covering all items and services except drugs. Not send to DHCS. Post, in public.
Our read, clearly labeled
Read that list again as a member of a mandatory program. Sacramento makes you choose one of three plans. Until now there has been no published number that would tell you which of the three says no most often, or which takes longest. That list is exactly that number, nine times over, and each plan has to publish it about itself. Whether it appears, where it appears and whether the three are comparable is the sort of thing this site exists to check.
The letter also puts the figures in front of the people who run the plan. Each plan must review its prior authorization metrics at least quarterly through its Quality Improvement Committee or an equivalent, and send DHCS an annual report analyzing the trends and systemic issues the figures show, what it is doing about them, and what came out of those committee reviews. The letter names one example of a fix: “implementing automated Prior Authorization approvals with high approval rates to streamline the process.” In plain words, if a plan approves a given treatment almost every time, it should stop making people wait for it.
Section F
None of the above is any use if nobody tells members it exists. The letter deals with that directly. Each plan must provide educational resources in an easily accessible place on its public website, or through the other ways it normally reaches members looking for their health information, in “non-technical, simple and easy-to-understand language.” They must cover, at a minimum:
The plans must tailor all of it to the people they actually serve, including literacy levels and the languages spoken, and they must combine the three explanations into one holistic account rather than three disconnected pages. Then comes the sentence we will be watching:
“Dental MCPs must engage their Community Advisory Committees to review and provide input on the cultural, linguistic, and outreach appropriateness of these materials.”
APL 26-006, section F. Community Advisory Committees meet in public and publish minutes. That makes this one of the few requirements in the letter whose performance a member can check without asking anybody's permission.
Dentists get their own version. Each plan must explain in plain language how a provider requests member data, including how the plan's attribution process works, which is the same process that decides whether your dentist can see you in the system at all.
If you read nothing else
Seven things in this letter are worth a member's attention. The rest is plumbing.
From 1 January 2027, a prior authorization your dentist sends must appear in the health app you chose within one business day, and every change of status within one business day of the change.
Not a code. A specific reason the request was denied, visible to you, inside the same deadline as the decision itself.
The documentation sent in on your behalf becomes something you can look at, rather than something you have to request after the fact.
The date, or the circumstance, on which an approval runs out has to be there in front of you. Losing an approval because it quietly expired should stop being a surprise.
Your new plan must fetch up to five years of claims and authorizations from the old one, within a week of your asking, once you have opted in.
Every March, each plan must publish how often it approves, how often it denies, how often an appeal overturns it, and how long it takes.
Weekly updates, and a public machine-readable copy anybody can check against. Including us.
And what it does not do. This letter changes what you can see, not what you can have. It does not add a covered benefit, it does not make an approval more likely, and it does not shorten the deadline your plan already has to answer your dentist. It also does not hand you an app. The plan has to open the socket; finding a health app you trust to plug into it is left to you, which is precisely why the letter makes the plans publish a guide about choosing one. And if you would rather not use an app at all, you do not have to: the same records can be requested on paper, and the plan has 30 days to answer.
The calendar
1 January 2021
The first two sockets were already due: Patient Access and Provider Directory, with the policies, procedures and public documentation that go with them. This is the half of the rules that APL 22-013 carried, and it has been in force for five years.
1 January 2026
Current standards, the longer USCDI version 3 data set, the changed prior authorization decision timeframe, the specific reason for a denial inside that timeframe, and the start of public reporting.
31 March, every year from 2026
Each plan posts the previous year's prior authorization figures on its own website, and reports its Patient Access usage counts to DHCS.
24 June 2026
APL 26-006 is issued, superseding APL 22-013 and putting all of it in one letter.
1 January 2027
Prior authorization information appears on the Patient Access API. The Provider Access, Payer-to-Payer and Prior Authorization sockets all open. Member and provider education resources must be published.
90 days before each of those
The plan has to send DHCS its updated policies and procedures, with and without track changes, or an email confirming that none were needed.
Being honest about it
If you work at one of these plans, or you have tried to connect an app to one, we would like to hear how it went. Tell us what happened.
Read it yourself
Everything on this page comes from the letter itself and the rules it cites. The letter is 18 pages and it is not hard reading once you know what the acronyms stand for.
The rules on this page start in 2027. The deadlines your plan has to meet today started a long time ago, and they are enforceable now. If yours were missed, we would like to know.
The Wisdom Tooth
Answers from APL 26-006 and this page
Not a live model and not a person. Every answer here was written by this project from the letter, so it cannot invent one and cannot answer what nobody wrote down. It can still be wrong, out of date or incomplete. Check anything that matters against the letter itself and against what your plan sends you in writing. Not legal or medical advice.
