US regulation 45 CFR 92.210 covers patient care decision support tools. A covered health program must make reasonable efforts to identify uses of such tools that rely on inputs like race, age, sex or disability, and reasonable efforts to reduce the risk of discrimination from them. Agents that recommend care fall under the same logic.
What the rule text says
Section 92.210 sits within the Section 1557 nondiscrimination rules. Two paragraphs matter here:
- Paragraph (b), identification. A covered entity has an ongoing duty to make reasonable efforts to identify uses of patient care decision support tools in its health programs or activities that use input variables measuring race, color, national origin, sex, age or disability.
- Paragraph (c), mitigation. For each tool identified, the entity must make reasonable efforts to mitigate the risk of discrimination resulting from the tool's use.
The text I reviewed did not show a compliance date, and I did not review the definition section. Check the current eCFR text and your counsel for scope and dates.
Why agents raise the stakes
A static risk score is one input to a clinician. An agent may gather records, draft a plan, or queue an order. Three things can get lost:
- Hidden inputs. An agent may pull in fields nobody listed, or infer age or sex from other data.
- Drift. A model update changes outputs without a change to your code.
- Reach. An agent used for one clinic workflow quietly spreads to others.
A working approach
- Inventory. List every tool, model and agent that influences patient care or access, including vendor features.
- Map inputs. For each, list the input variables and whether any measure the protected categories in the rule, directly or by close proxy.
- Assess. Compare outputs across groups using data you are allowed to use, and record the method and the result.
- Mitigate. Remove an input, adjust a threshold, add review, or stop the use. Write down which and why.
- Re-run on change. New model version, new data source or new use triggers a repeat.
- Keep a person in charge. The clinician decides. The agent informs.
FDA software guidance
Separately, the FDA's Clinical Decision Support Software guidance is listed as Final and dated January 2026. It concerns which CDS functions fall outside the device definition. I did not review its criteria, so read the guidance itself if your agent gives clinical recommendations.
Where Safeguard fits
Safeguard's asset discovery helps you build the inventory of tools and agents, and compliance and evidence automation helps keep assessment records tied to each. Policies and gates can require review before an agent action runs.
Quick check
Does 92.210 ban AI in care decisions?
No. It asks covered entities to make reasonable efforts to identify and mitigate discrimination risk from these tools.
Is a vendor tool covered?
The duty applies to the covered entity's use of tools in its programs. Ask the vendor for input and testing information, and keep your own records.
Sources
- 45 CFR 92.210, Cornell Legal Information Institute
- Clinical Decision Support Software guidance page, FDA
Last reviewed: 19 October 2026.
