Section 1557 of the Affordable Care Act now reaches the tools behind coverage decisions, not only the people who make them. Since May 2025, every health program that receives federal financial assistance, a group that includes most health insurers, has had a standing duty to find the decision support tools it uses that take protected characteristics as inputs. It must also make reasonable efforts to reduce the risk that those tools discriminate. The protected characteristics are the 6 the rule lists, “race, color, national origin, sex, age, or disability.”
The requirement sits in a single short section of the 2024 nondiscrimination rule, 45 CFR § 92.210. It does not ban any variable or prescribe a test. It covers automated and non-automated tools alike, from machine learning models to flowcharts, and it applies to tools that help decide whether care is medically necessary as well as tools that help decide what care to give.
This analysis explains what the section requires and which tools in a health plan are likely to be in scope. It then covers what the Office for Civil Rights (OCR) at the Department of Health and Human Services has said reasonable efforts look like, and how the court fights over other parts of the rule affect it. It closes with how Redlake builds against the requirement.
Key takeaways
- The duty is to identify and to mitigate. Covered entities must make reasonable efforts, on an ongoing basis, to identify patient care decision support tools whose inputs measure a protected characteristic, and to mitigate the risk of discrimination from each one.
- Insurers are covered. The rule applies to health insurance issuers that receive federal financial assistance, which includes Medicare Advantage and Medicaid funding, among other programs.
- The definition is broad. A tool can be automated or not. HHS’s descriptions include tools that assess eligibility for care and analyze medical necessity. Tools used only for administrative work such as billing or scheduling are excluded.
- Reasonable depends on the organization. OCR will weigh an entity’s size and resources, along with whether it has a process for evaluating the tools it adopts.
- Proxies carry much of the risk. A tool can discriminate without using a protected characteristic directly, through inputs such as past spending that track one.
- Court stays target other provisions. Courts have stayed the rule’s gender identity provisions nationwide and the whole rule in Texas and Montana. Elsewhere, § 92.210 is in effect.
What 45 CFR § 92.210 requires
The section has 3 parts. According to the regulatory text, paragraph (a) prohibits a covered entity from discriminating on the basis of a protected characteristic in its health programs or activities through the use of patient care decision support tools. Paragraph (b) imposes a continuing obligation to make reasonable efforts to identify uses of tools that “employ input variables or factors” measuring those characteristics. Paragraph (c) requires reasonable efforts to mitigate the risk of discrimination from each tool identified.
The general prohibition in paragraph (a) has applied since the rule took effect in July 2024. The identification and mitigation duties came later. The rule gave covered entities 300 days after its effective date to comply with them, which Hall Render and Reed Smith place in May 2025.
The definition of a tool is the widest part of the section. As quoted in a National Law Review summary of the final rule, a patient care decision support tool is “any automated or non-automated tool, mechanism, method, technology” used by a covered entity to support clinical decision-making in its health programs or activities. The summary notes that the definition reaches non-automated tools such as pulse oximeters and race-adjusted equations for estimated glomerular filtration rate (eGFR), a kidney function measure. HHS’s own example of mitigation was to stop using the race-adjusted eGFR equation and adopt the revised equation that does not adjust for race.
A client alert by Crowell & Moring describes the kinds of uses the rule contemplates. They include tools that analyze medical necessity and tools that make care recommendations. The alert also notes the exclusions. Tools used for administrative work, such as billing or patient scheduling, are outside the section. Triage flowcharts are inside it.
Who is a covered entity
Section 1557 applies to health programs and activities that receive federal financial assistance from HHS. It also applies to HHS itself and to entities established under title I of the Affordable Care Act, including the exchanges. A summary by McDermott Will & Emery states that the 2024 rule applies to “all health insurance issuers that receive federal financial assistance,” and it names Medicare Advantage and Medicaid among the covered programs. The rule also treats Medicare Part B payments as federal financial assistance for the first time.
Employers that sponsor group health plans are not covered entities in their own right. Because the rule reaches most carriers and third-party administrators, McDermott describes it as applying “at least indirectly to most group health plans.”
Which payer tools are likely in scope
Most discussion of § 92.210 has focused on clinical tools in hospitals and practices, such as sepsis alerts and kidney function equations. Health plans use decision support tools too, and several of them take protected characteristics as inputs, often age and sex, sometimes disability.
The table below is this analysis’s reading of where common payer tools may fall. It is not an OCR determination, and whether a given tool is in scope depends on how it is used.
| Tool | Common inputs that may measure a protected characteristic | Likely relationship to § 92.210 |
|---|---|---|
| Medical necessity criteria applied by software during prior authorization | Age thresholds in criteria, sex-specific criteria | Likely in scope, since the tool supports a decision about whether care is covered as necessary |
| Predicted length-of-stay models for post-acute care | Age and disability-related diagnoses | Likely in scope when the prediction informs coverage or care decisions |
| Rules that auto-approve some requests and route others to a nurse | Age bands, diagnosis groups | Possibly in scope, depending on whether routing affects the outcome a member receives |
| Care management outreach scores | Age and prior utilization | Possibly in scope where the score determines who is offered care |
| Claims edits for billing format and coding consistency | Sex and age edits tied to code definitions | Likely outside, as a billing-related activity |
| Scheduling and call routing tools | Language, location | Likely outside, as scheduling or administrative functions |
Our analysis, applying the scope described in summaries of the final rule. The right-hand column is interpretation, not guidance.
The routing case deserves attention. A tool that approves 1 group of requests automatically and sends another group to clinical review does not deny anything itself. But if it routes requests differently by age, the 2 groups face different wait times and possibly different outcomes. Whether that counts as supporting clinical decision-making is a question the rule leaves open. A cautious reading treats it as in scope and tests it.
Proxies are where much of the risk hides
The section’s identify duty is written around inputs that “measure” a protected characteristic. The best-known case of algorithmic bias in health care involved no such input. In a 2019 study in Science, researchers examined a widely used algorithm that identified patients for extra care management help. It predicted health care costs and used them as a stand-in for health needs. Because unequal access to care meant less was spent on Black patients than on White patients with the same needs, Black patients at a given risk score were considerably sicker. The authors estimated that remedying the bias would raise the share of Black patients receiving additional help from 17.7% to 46.5%.
Payer tools are full of variables like cost. Past spending and prior authorization history, for example, reflect access to care as well as need. Language preference can track national origin. Medicaid eligibility category can track disability. Whether a proxy falls within paragraph (b) is a legal question the rule does not answer directly. As a practical matter, a plan that inventories only direct inputs will miss the kind of tool that has caused the most documented harm, and outcome testing by group is the only way to find it.
What reasonable efforts look like
The rule does not tell covered entities how to meet the identify and mitigate duties. OCR said in the preamble that it would assess compliance case by case. According to the Crowell alert and the National Law Review summary, OCR will weigh 4 factors.
- The entity’s size and resources
- Whether the tool was used as the developer intended and as approved by regulators, or was adapted or customized
- Whether the developer disclosed that the tool uses protected characteristics or carries a risk of discrimination
- Whether the entity has a process for evaluating the tools it adopts
The preamble sets 2 limits that matter for health plans that license tools from vendors. Covered entities do not have to obtain a developer’s training data. But if an entity has reason to believe a tool uses protected variables, or knows or should know that a tool could cause discrimination, it should consult public sources or the developer.
In January 2025, OCR issued a Dear Colleague letter titled Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies. According to Reed Smith’s summary, the letter listed 5 practices that could count as reasonable efforts.
- Review and research. Read OCR’s discussion of the section and what the vendor discloses about the tool’s inputs.
- Policies and procedures. Set written rules for using tools and monitoring their effects, including what information to obtain from vendors.
- Training and auditing. Train staff and audit how tools perform in real settings.
- Human override. Let qualified staff override and report outputs that appear discriminatory.
- Disclosure. Tell patients when a tool that poses a risk of discrimination is in use.
Reed Smith notes that the letter is “not the law.” It states OCR’s view of how the section applies, and it was issued before the change of administration. The section itself has not been amended.
The rule does not ask whether a tool uses age. It asks whether the organization knows that it does, and what it has done about the risk.
Age and disability are the hard cases
Race-adjusted equations are the easy example, because the clinical case for the adjustment has weakened and an alternative exists. Most payer tools raise a harder problem. Age and disability are clinically meaningful. A model that predicts how long a patient will need rehabilitation is less accurate if it ignores age. A criterion for a procedure may reasonably differ by sex where anatomy or evidence differs.
The section does not prohibit using these variables. It requires an organization to know when it does and to reduce the risk that the tool discriminates. For a clinically relevant variable, mitigation is less about removing the input than about checking its effect, and the rule’s structure suggests 3 practical tests.
- Check that the variable does clinical work. If a criterion uses an age threshold, there should be evidence behind the threshold. A threshold without evidence is the easiest risk to remove.
- Compare outcomes by group. A plan can compare approval rates and appeal reversals by age band or disability status for services decided with the tool’s help. A gap that persists after accounting for clinical factors is a signal to investigate.
- Let a person override the tool. If a reviewer sees that a prediction does not fit the patient in front of them, the process should let them act on that judgment and record it.
These tests overlap with existing Medicare Advantage guidance. In its February 2024 answers to plans’ questions, CMS said that coverage determinations must rest on the individual patient’s circumstances and that plans should make sure algorithms do not perpetuate or introduce bias, citing Section 1557. A tool that applies a predicted length of stay to a patient without reassessment fails the CMS test, and it may also be the kind of tool § 92.210 asks plans to examine.
The health IT certification program offers some help. The National Law Review summary notes that the 2024 HTI-1 rule requires developers of certified health IT to disclose certain information about decision support interventions to users, which can help covered entities identify tools that use protected characteristics. That requirement covers certified electronic health record technology, not most payer software, so plans will often have to ask their vendors directly.
How the court stays affect the section
The 2024 rule has been challenged in several courts, mostly over its interpretation of sex discrimination to include gender identity. According to a summary by the PHIA Group, the U.S. District Court for the Southern District of Mississippi stayed the gender identity provisions nationwide in Tennessee v. Becerra. The U.S. District Court for the Eastern District of Texas stayed the rule in its entirety in Texas and Montana in Texas v. Becerra. A Florida court separately barred OCR from enforcing its interpretation of sex discrimination in that state. Hall Render dates the nationwide injunction to July 3, 2024, shortly before the rule’s effective date.
None of those orders was aimed at § 92.210, but the Texas order reaches it, because it stayed the whole rule in those 2 states. Everywhere else, the decision support tool requirements apply. A health plan operating in many states therefore faces the requirement in most of them and not in Texas or Montana while that order stands. For most organizations, running 2 compliance programs is harder than running one, which argues for applying the same inventory and testing everywhere.
What a payer inventory looks like
The rule’s identify duty is, in practice, an inventory. A workable version for a health plan has 5 steps. These reflect this analysis’s reading of the rule and OCR’s letter, not OCR guidance.
- List every tool that touches a clinical decision. Include vendor software and internal models, along with criteria sets and routing rules applied by software. Paper protocols count too. Exclude tools used only for administrative work such as billing.
- Record each tool’s inputs. For licensed tools, ask the vendor which inputs measure a protected characteristic, directly or by proxy, and keep the answer.
- Record the decision each tool supports. A tool that approves requests carries different risk from one that only predicts, and the record should say which.
- Choose a mitigation for each tool with a protected input. Options include removing an input without evidence behind it and testing outcomes by group. For inputs that remain, add human review of the affected decisions and document the clinical rationale.
- Repeat on a schedule. The duty is ongoing. Vendors update models and plans add services, so the inventory needs a review date and an owner.
The inventory also serves other obligations. A Medicare Advantage UM committee already reviews prior authorization policies each year and must understand the tools that apply them, as Rounds described in its analysis of MA committee rules. The same list can support both reviews.
Where Redlake stands
This section is commentary. We build tools that health plans use in utilization review, and 3 rules govern how we build them. A clinician makes every denial. Every recommendation shows its reasons, and every decision can be reconstructed. Those rules were not written for Section 1557, but they line up with what § 92.210 asks.
A tool that only recommends approvals and routes everything else to a clinician limits the ways it can discriminate on its own. A recommendation that cites the criteria and record facts it relied on makes it possible to see whether a protected characteristic drove the result. And a log of recommendations and reviewer actions makes the outcome testing described above possible, because a plan can only compare outcomes by group if it kept the decisions.
What the rule does not settle is how much testing is enough. Our view is that a plan should be able to answer 2 questions with data for every tool that influences a coverage decision. The first is which protected characteristics the tool uses, directly or by proxy. The second is whether outcomes differ by group for the decisions it supports. A plan that can answer both has made a reasonable effort by any measure. A plan that cannot answer either has not yet started.
What to watch in 2026
OCR enforcement. The section depends on case-by-case enforcement. Any OCR resolution agreement or complaint finding under § 92.210 would show how the agency reads “reasonable efforts” in practice.
The Texas litigation. The stay in Texas and Montana covers the whole rule. A ruling that narrows it, or one that extends it, would change where the section applies.
Changes to the rule. The current administration has revised other parts of HHS’s approach to equity in health programs. Any proposal to amend § 92.210 would be published for comment first.
Vendor disclosures. As covered entities ask vendors about inputs, disclosure may become a standard part of contracts. Where it does, smaller plans with less bargaining power will benefit most.
About this analysis
Basis. This analysis relies on the text of 45 CFR § 92.210 as published by the Legal Information Institute, read alongside law firm summaries of the 2024 final rule. Reed Smith’s summary describes OCR’s January 2025 Dear Colleague letter, and Hall Render and the PHIA Group summarize the litigation. We also drew on CMS’s February 2024 answers to Medicare Advantage plan questions and on the 2019 Science study of a care management algorithm. The final rule’s preamble and the Dear Colleague letter were not reviewed directly. Their contents are described from the summaries cited.
Data notes.
- The scope table and the inventory steps are this analysis’s interpretation of the rule, not OCR guidance.
- Whether proxy variables fall within § 92.210(b) is not settled by the rule’s text. The discussion of proxies is analysis.
- The litigation status reflects the summaries cited, which date from 2024. Later rulings may have changed the scope of the stays.
- This analysis is not legal advice.
Sources
- Legal Information Institute, 45 CFR § 92.210, Nondiscrimination in the use of patient care decision support tools
- National Law Review, OCR and CMS issue ACA Section 1557 final rule, April 2024
- Crowell & Moring, HHS applies discrimination prohibitions to use of automated and non-automated patient care decision support tools
- McDermott Will & Emery, 10 takeaways from Section 1557 nondiscrimination protections
- Reed Smith, HHS recent guidance on AI use in health care, January 31, 2025
- Hall Render, Section 1557 final rule status, July 2024
- PHIA Group, Where the Section 1557 final rule stands, August 30, 2024
- CMS, Frequently asked questions related to coverage criteria and utilization management requirements in CMS final rule (CMS-4201-F), February 2024
- Science, Dissecting racial bias in an algorithm used to manage the health of populations, October 2019
Frequently asked questions
What does 45 CFR § 92.210 require of health insurers?
Insurers that receive federal financial assistance must not discriminate through patient care decision support tools. They must make reasonable efforts to identify tools that use a protected characteristic such as race or age as an input, and to mitigate the risk of discrimination from each.
Does Section 1557 ban using age or sex in clinical algorithms?
No. The rule does not prohibit any input variable. It requires covered entities to know when tools use protected characteristics and to reduce the risk that those tools discriminate.
When did the Section 1557 decision support tool requirements take effect?
The general prohibition has applied since the rule took effect in July 2024. The duties to identify and mitigate risk apply since May 2025, 300 days after the effective date.