Since May 1, 2025, 45 CFR 92.210 has required covered entities to make reasonable efforts, on an ongoing basis, to identify the patient care decision support tools they use that employ input variables or factors measuring race, color, national origin, sex, age, or disability, and to make reasonable efforts to mitigate the risk of discrimination from each one. The duty reaches AI-based and non-AI tools alike, it is a process obligation rather than a pre-approval or certification scheme, and HHS said it applies to the covered entities that use these tools, not to their developers as such. Two court orders limit the surrounding rule’s definition of sex discrimination, but neither lists 92.210.
What counts as a patient care decision support tool?
Broadly. The rule defines a patient care decision support tool as “any automated or non-automated tool, mechanism, method, technology, or combination thereof used by a covered entity to support clinical decision-making in its health programs or activities.” On the definition’s plain terms, a sepsis risk score, a rules-based clinical pathway, and a large language model summarizing a chart to suggest a next step all fall inside it if they support a clinical decision. Nothing in 45 CFR 92.210 limits it to AI, and nothing exempts AI from it either.
What exactly must a covered entity do under 92.210?
Three things, read directly from the rule. Paragraph (a) prohibits discrimination on the basis of race, color, national origin, sex, age, or disability through the use of patient care decision support tools. Paragraph (b) creates “an ongoing duty to make reasonable efforts to identify” uses of such tools that employ input variables or factors measuring those characteristics. Paragraph (c) requires that, for each tool so identified, the covered entity “must make reasonable efforts to mitigate the risk of discrimination resulting from the tool’s use.” Paragraph (a) is a flat prohibition; the duties in (b) and (c) are reasonable efforts, not guaranteed outcomes, and the rule does not prescribe a specific bias-testing method or a required statistical threshold. The identification duty is ongoing, not a single check at go-live.
| Paragraph | What it requires |
|---|---|
| 92.210(a) | No discrimination on the basis of race, color, national origin, sex, age, or disability through use of patient care decision support tools |
| 92.210(b) | An ongoing duty to make reasonable efforts to identify tools that use those characteristics as input variables or factors |
| 92.210(c) | Reasonable efforts to mitigate discrimination risk for each tool identified |
Who is covered, and when did this apply?
Section 1557 covered entities are recipients of federal financial assistance, HHS itself, and entities established under title I of the ACA, and the rule applies to every health program or activity any part of which receives federal financial assistance from HHS (45 CFR 92.2 and 92.4). That reaches hospitals, clinics, physician practices, and health insurers that receive that assistance. HHS published the current rule, including 92.210, on May 6, 2024, effective July 5, 2024, with staggered compliance dates. The prohibition in 92.210(a) applied from July 5, 2024, and the identification and mitigation duties in (b) and (c) had to be met within 300 days of that date, which was May 1, 2025. That date has passed.
Has litigation changed any of this?
Part of the surrounding rule, not 92.210 itself. Two court orders limit the 2024 rule’s definition of sex discrimination. On August 30, 2024, the U.S. District Court for the Eastern District of Texas, in Texas v. Becerra, stayed nationwide the effective date of 45 CFR 92.101(a)(2) and all references to it, the rule’s list of what sex discrimination includes (sex characteristics, pregnancy or related conditions, sexual orientation, gender identity, and sex stereotypes), along with 92.206(b), 92.207(b)(3) to (5), and related Medicaid and PACE provisions. That stay had not been lifted as of the case’s latest order we could read, dated May 18, 2026. On October 22, 2025, the U.S. District Court for the Southern District of Mississippi, in Tennessee v. Kennedy, entered a final judgment vacating a list of provisions, including 92.101(a)(2)(iv), to the extent they expand Title IX’s definition of sex discrimination to include gender identity, and declared that HHS exceeded its statutory authority in reading Section 1557 to prohibit gender identity discrimination. HHS published a notice of the vacatur on June 2, 2026, stating that OCR cannot and will not enforce the vacated provisions to that extent and that the other provisions of the rule remain in force. Neither court’s list of provisions includes 92.210.
What that leaves open for 92.210 is narrower. Its prohibition on sex discrimination through these tools stands, but for now the rule’s own list of what sex discrimination includes is not in effect: the gender identity piece is vacated and the rest is stayed. Whether an input variable that measures gender identity, or another characteristic in that stayed definition, falls within 92.210(b)’s identification duty is not settled by any primary source we read. OCR guidance, a final judgment in the Texas case, or new rulemaking would settle it, and this page does not answer it.
New rulemaking is on HHS’s list. Its 2026 Unified Agenda entry (RIN 0945-AA32) plans a proposed rule to modify portions of the Section 1557 regulations, to conform them more closely with the statute, executive orders, and court decisions and to reduce burdens, with the proposal anticipated in February 2027. The entry does not say which provisions would change, and nothing had been proposed as of September 2026. Until a final rule changes it, 92.210 remains in force.
Does a vendor’s own bias testing satisfy the duty?
Not by itself. The identification and mitigation duties in 92.210(b) and (c) sit with the covered entity: HHS said in the rule’s preamble that 92.210 applies to covered entities that use patient care decision support tools, while a separate HHS rule for certified health IT applies to developers. A vendor’s disclosure of known risks or its own validation testing is useful input, the same way a signed business associate agreement is useful input to a HIPAA question without answering it alone. The covered entity still has to make its own reasonable efforts to identify the tool’s input variables and mitigate the risk it finds, and Section 1557 is a distinct statute from HIPAA, enforced by the same office but resting on a different duty: nondiscrimination in a health program, not privacy or security of PHI.
The rule does not ask a health system to prove a tool is bias-free. It asks for an ongoing, reasonable effort to find out which tools use a protected characteristic as an input and to mitigate the risk from the ones that do. A tool nobody checked is the gap 92.210 is written to close.
What you need in place
- An inventory naming every patient care decision support tool in clinical use, AI-based and otherwise.
- For each tool, a documented check of whether race, color, national origin, sex, age, or disability is an input variable.
- A mitigation record for every tool the check identifies, not just a note that the check happened.
- A named owner for the identification duty on an ongoing basis, since a new model version or a new use case can change the answer.
- Awareness that the court orders are narrow: they reach the rule’s definition of sex discrimination, not the identification and mitigation duty itself.
Sources
- 45 CFR 92.210, nondiscrimination in the use of patient care decision support tools
- 45 CFR 92.4, definitions of covered entity and patient care decision support tool; with 92.1(b), compliance dates, and 92.101(a)(2), the definition of sex discrimination
- Nondiscrimination in Health Programs and Activities, final rule, 89 FR 37522, May 6, 2024 (on who 92.210 applies to, 89 FR 37643)
- Texas v. Becerra, No. 6:24-cv-211 (E.D. Tex.), Order Modifying Stay, August 30, 2024, docket
- Tennessee v. Kennedy, No. 1:24-cv-161 (S.D. Miss.), Final Judgment, October 22, 2025, docket
- Notice of Vacatur Regarding Certain Provisions of the 2024 Nondiscrimination in Health Programs and Activities Final Rule, 91 FR 32887, June 2, 2026
- Unified Agenda of Regulatory and Deregulatory Actions, RIN 0945-AA32, reginfo.gov, 2026 edition, checked September 26, 2026
Where Verillian fits
Verillian governs AI use on the devices you enroll. A checkpoint on each device sits between your people’s AI tools and agents and the AI providers. A tool call your policy bans is removed before your machine can run it. Each record is signed on the device it came from and hash-chained to the one before it, so a change to its signed fields is detectable, and it stays on your own infrastructure. The admin server runs where you choose: on premises or in a private cloud you run. macOS, Windows and Linux are supported. For a health system, that record shows which AI services people on enrolled devices used through the checkpoint, one input to the tool inventory a 92.210 identification effort starts from.
When a vendor’s service calls a model on the vendor’s servers, as a hosted clinical decision support tool does, the record of what that model received is created on the vendor’s side, and the contract is your lever for it. What Verillian gives you is the record of AI use that starts on your own devices.
See what a clinician-facing policy has to cover in what a clinician AI use policy has to cover, and how this maps to healthcare and other regulated sectors.
