Section 1557 and Health AI Bias: What 45 CFR 92.210 Means, Plus an Audit Worksheet

What 45 CFR 92.210 says

The current eCFR text of §92.210 (45 CFR 92.210 (eCFR)) has three parts:

(a) “A covered entity must not discriminate on the basis of race, color, national origin, sex, age, or disability in its health programs or activities through the use of patient care decision support tools.”

(b) “A covered entity has an ongoing duty to make reasonable efforts to identify uses of patient care decision support tools in its health programs or activities that employ input variables or factors that measure race, color, national origin, sex, age, or disability.”

(c) “For each patient care decision support tool identified in paragraph (b) of this section, a covered entity must make reasonable efforts to mitigate the risk of discrimination resulting from the tool’s use in its health programs or activities.”

§92.4 defines the tool broadly: “Patient care decision support tool means any automated or non-automated tool, mechanism, method, technology, or combination thereof used by a covered entity to support clinical decision-making in its health programs or activities” (45 CFR Part 92 (eCFR), incl. §92.1 and §92.4). That includes paper scores and calculators, not only AI.

Who it applies to, and when

Under §92.4, a covered entity is “(1) A recipient of Federal financial assistance; (2) The Department; and (3) An entity established under title I of the ACA.” Hospitals that take Medicare or Medicaid funds are the usual case. The duty falls on the covered entity, not on the AI vendor, but vendors selling to hospitals will be asked to help.

The rule took effect July 5, 2024 (HHS OCR final rule, 89 FR 37522 (May 6, 2024)). Under the compliance table in §92.1(b), covered entities must comply with §92.210(b) and (c) “Within 300 days of July 5, 2024,” which works out to May 1, 2025.

The 2026 vacatur notice

On June 2, 2026, HHS published a notice that a court in Tennessee v. Kennedy vacated provisions of the 2024 rule “to the extent they expand Title IX’s definition of sex discrimination to include gender-identity discrimination,” and that “the other provisions of the Section 1557 Rule remain in force” (HHS, Notice of Vacatur, 91 FR 32887 (June 2, 2026)). The notice does not mention §92.210, which remains in the current eCFR. How the vacatur affects the “sex” basis in §92.210(a) is a question for counsel. Status as of October 27, 2026.

This is not legal or regulatory advice; consult qualified counsel.

A subgroup performance audit

• Inventory every tool used to support clinical decisions, automated or not.
• List the input variables that measure race, color, national origin, sex, age or disability (§92.210(b)).
• Measure performance by subgroup: discrimination, calibration and error rates at the operating threshold.
• Record mitigation: policy changes, overrides, recalibration, training, human review (§92.210(c)).
• Set an owner and a review date; the identification duty is “ongoing.”

Download the subgroup performance audit worksheet (.xlsx). Each field is mapped to the regulatory text. The rule requires “reasonable efforts” and sets no method; the worksheet is a documentation aid, not a compliance safe harbor.

Go deeper

• Clinical prediction model validation
• Selling to health systems: vendor security review

Sources (accessed October 27, 2026)

1. 45 CFR 92.210 (eCFR)
2. 45 CFR Part 92 (eCFR), incl. §92.1 and §92.4
3. HHS OCR final rule, 89 FR 37522 (May 6, 2024)
4. HHS, Notice of Vacatur, 91 FR 32887 (June 2, 2026)

Related resources

• Healthcare AI consulting
• Clinical study design
• Technical due diligence