Reference · Healthcare
HHS Section 1557 and Patient Care Decision Support Tools, Explained
45 CFR 92.210 — Nondiscrimination in the use of patient care decision support tools
Section 1557 of the Affordable Care Act prohibits discrimination in health programs and activities receiving federal financial assistance. The 2024 final rule added 45 CFR 92.210, which applies that prohibition to patient care decision support tools, automated or not, and creates two duties for covered entities: identify tools that use protected-class inputs, and mitigate the risk of discrimination from them. Both have applied since 1 May 2025.
Who it applies to
Covered entities under Section 1557: health programs and activities receiving federal financial assistance from HHS, including hospitals, physician groups, health plans, and state health agencies. The rule reaches the tools they use in care, whether built in-house, bought from an EHR vendor, or embedded in a payer's utilization-review workflow.
The three parts of 92.210
- 92.210(a): no discrimination on the basis of race, color, national origin, sex, age, or disability through the use of patient care decision support tools.
- 92.210(b): an ongoing duty to make reasonable efforts to identify tools that employ input variables measuring a protected class.
- 92.210(c): for each identified tool, reasonable efforts to mitigate the risk of discrimination from its use.
How it connects to ONC HTI-1
ONC HTI-1's decision support interventions criterion requires certified health IT developers to make source attributes available, including whether race, ethnicity, sex, date of birth, or health status are used. Those attributes are the developer-side input to the covered entity's 92.210(b) determination. The determination itself, and the mitigation, remain the covered entity's.
What reasonable mitigation looks like
- An inventory of decision support tools with the protected-class input determination recorded per tool and revisited when a tool changes.
- Bias or outcome testing performed by the organization or its vendor, with metrics and a review cadence.
- Clinician review of tool output before it informs care, and the ability to override.
- A nondiscrimination policy, the 92.8 notice, and a grievance procedure that reach AI-assisted care.
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| Identification (92.210(b)) | Know which decision support tools are in use and which use protected-class inputs | A tool inventory with a per-tool determination and its date |
| Ongoing identification | Revisit the determination when a tool changes | Configuration change history and re-determination records |
| Mitigation (92.210(c)) | Make reasonable efforts to mitigate discrimination risk per tool | Testing by whom, metrics, review cadence, clinician override |
| Nondiscrimination and notice (92.210(a), 92.8) | Cover AI-assisted care in the policy, notice, and grievance procedure | The policy, the posted notice, and the procedure |
Key dates
- 5 July 2024Section 1557 final rule effective date for most provisions.
- 1 May 202545 CFR 92.210 patient care decision support duties apply.
Primary sources
Common gaps
Where covered entities most often fall short of 92.210.
- No inventory of decision support tools. The identification duty presumes a list. Entities that cannot say which tools run cannot say which use protected-class inputs.
- The determination made once. The duty is ongoing. A tool whose model or prompt changed since the determination has to be looked at again.
- Mitigation with no record. Clinician override exists in practice and nowhere on paper. OCR asks what the entity did; the answer needs a date and an owner.
- Notices that stop at the front desk. The 92.8 notice and grievance procedure predate AI-assisted care and never mention it.
In practice
Related
Last reviewed September 5, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.