Learn about CEHRT, Quality category, topped-out measures, cost category, QCDR, Improvement Activities, Promoting Interoperability, and much more, through the Frequently Asked Questions (FAQs) below. Please schedule a consultation if you are looking for a Security Risk Analysis (SRA) for MIPS or Expert Consultants to help you navigate the process.
Table of Contents
What is certified electronic health record technology (CEHRT), and what does the current ONC certification standard require?
Certified electronic health record technology (CEHRT) is any health IT system, typically an electronic health record, that has been tested and certified under standards adopted by the Office of the National Coordinator for Health Information Technology (ONC) and listed in ONC’s Certified Health IT Product List (CHPL) at healthit.gov/chpl. For MIPS Promoting Interoperability purposes, clinicians must use CEHRT meeting the 2015 Edition Cures Update certification criteria, which requires support for structured data capture, patient access APIs, electronic prescribing, and data exchange functions aligned with the 21st Century Cures Act (Public Law 114-255). Using uncertified technology, or a certified product whose certification has been suspended or removed, means a clinician cannot satisfy PI reporting requirements and may be subject to automatic PI reweighting to 0% or a zero-category score. When switching or upgrading EHR systems, a new Security Risk Analysis must also be conducted, because system changes introduce new vulnerabilities to electronic protected health information (ePHI). Clinicians can verify their system’s certification status by searching the CHPL at healthit.gov/chpl.
How does the Quality category work?
The Quality category, worth 30% of the final MIPS score in 2026, requires clinicians to report on clinical quality measures drawn from an inventory of 190 total measures (5 added, 10 removed, and 30 substantially updated for 2026). Individuals and most groups report 6 measures, including at least one outcome or high-priority measure; if fewer than 6 applicable measures exist and the clinician is not using a QCDR, they must report all applicable measures. Each submitted measure is scored on a 1 through 10-point scale against a benchmark derived from historical performance data. The data completeness threshold remains at 75% through at least the 2028 performance year. Two notable 2026 changes apply: large practices (16 or more clinicians) no longer receive the 3-point scoring floor for measures that meet data completeness and case minimums, their scores fall on the full 1 through 10 scale, while small practices retain the 3-point floor. Additionally, “health equity” has been removed from the definition of a high-priority quality measure, which affects which measures qualify to satisfy the high-priority measure requirement.
What are topped-out measures, and how are they scored?
A topped-out quality measure is one where nearly all reporting clinicians already perform at the highest possible level, leaving little room for meaningful differentiation in scoring. CMS addresses topped-out measures through two distinct policies. Under the standard topped-out benchmark cap, once a measure’s benchmark is in its second consecutive year of being topped-out, it is subject to a 7-point maximum, meaning even perfect performance earns no more than 7 out of 10 possible points. Separately, for 2026, CMS identified 19 quality measures belonging to specialty sets and MVPs with limited measure choice and a disproportionately high concentration of topped-out measures. Rather than applying the standard benchmark to these 19 measures, which would yield very few meaningful scoring differences, CMS applies “previously defined topped-out measure benchmarks”: an alternative, flatter scoring structure designed to allow clinicians in measure-constrained specialties to earn meaningful points. Clinicians in specialties with limited measure options should check the CMS QPP benchmarks resource each year to identify which measures fall under either policy, as both affect the achievable point ceiling differently.
How does claims-based quality measure scoring work in 2026?
For 2026, CMS revised the scoring methodology for claims-based quality measures to align with how cost measures are now benchmarked, using a median-based approach and standard deviations rather than purely percentile ranking. Under the prior methodology, a clinician’s performance rate was placed in a decile and scored accordingly. Under the updated methodology, the median performance rate on a measure corresponds to a mid-range point value, with scores above and below determined by standard deviations from that median. This change is intended to produce fairer differentiation in measures where performance is tightly clustered and to reduce the risk of unexpectedly low scores in areas with limited performance variation across clinicians.
How does the cost category work?
The Cost category, also worth 30% of the final MIPS score in 2026, requires no separate reporting action from clinicians. CMS calculates this category entirely from Medicare Part B claims data, attributing costs to clinicians based on billed services. The total number of cost measures remains at 35 for 2026, with no additions or removals. Two structural changes are in effect. First, the Total Per Capita Cost (TPCC) attribution rules were updated: advanced practice practitioners, nurse practitioners, physician assistants, and clinical nurse specialists, are now excluded from TPCC attribution when all other clinicians in the group are excluded based on specialty, addressing long-standing concerns about specialty practices being penalized for costs associated with non-physician practitioners. Second, CMS finalized a new two-year informational-only feedback policy for any future cost measures: when a new cost measure is introduced, clinicians will receive performance feedback without it affecting their MIPS final score for the first two years; only in its third year will it count toward the composite score.
What is a qualified clinical data registry (QCDR), and how does it differ from a qualified registry?
A qualified clinical data registry (QCDR) is a CMS-approved organization that collects clinical data from clinicians and submits MIPS quality measure data on their behalf, with the additional capability of developing and administering its own specialty-specific measures, called QCDR measures, that are not part of the standard CMS quality measure inventory. This makes QCDRs particularly valuable for specialties with limited applicable measures in the standard catalog, as QCDR measures can count toward the MIPS quality reporting requirement. A qualified registry is also a CMS-approved data intermediary that collects and submits MIPS data on behalf of clinicians, but it is limited to CMS-approved measures from the standard inventory and cannot develop proprietary measures. Both QCDRs and qualified registries must be approved by CMS annually and, beginning with the 2026 performance year, must support any MVPs applicable to the participants for whom they submit data, no later than one year after the MVP is finalized. Regardless of submission method, the attesting clinician remains responsible for the accuracy and completeness of all submitted data.
How does the Improvement Activities category work?
The Improvement Activities (IA) category, worth 15% of the final MIPS score in 2026, rewards clinicians for engaging in practice-level activities that improve care delivery, patient access, patient safety, and care coordination. For 2026, the total inventory contains 104 activities (3 added, 7 modified, 8 removed).
Beginning with the 2025 performance year and continuing in 2026, CMS eliminated the medium/high activity weighting system. Under the previous rules, activities were worth either 10 points (medium) or 20 points (high), and clinicians combined them to reach a 40-point ceiling. Under the current rules, all activities carry equal weight and the number required depends on practice type and reporting pathway: large practices (16 or more clinicians) reporting under Traditional MIPS must attest to 2 activities to achieve the maximum IA score; small practices (15 or fewer clinicians), rural practices, non-patient-facing clinicians, and practices in Health Professional Shortage Areas (HPSAs) need only attest to 1 activity to earn full IA credit; and MVP reporters, regardless of practice size or special status, must attest to 1 activity.
Each activity must be performed for a minimum continuous 90-day period during the calendar year. Multiple activities do not need to share the same 90-day window. For group reporting, at least 50% of clinicians in the TIN must perform the same activity to receive group credit. October 3, 2026, is the last day to begin a qualifying 90-day IA performance period and still meet the December 31 year-end cutoff. The “Achieving Health Equity” subcategory has been retired and replaced with “Advancing Health and Wellness” for 2026. Clinicians recognized as Patient-Centered Medical Homes (PCMHs) or comparable specialty practices continue to receive automatic full credit for the IA category.
How does the Promoting Interoperability category work?
The Promoting Interoperability (PI) category, worth 25% of the final MIPS score in 2026, evaluates how effectively clinicians use certified electronic health record technology (CEHRT) to support patient engagement and health information exchange. To earn any score in this category, clinicians must collect and report PI data using CEHRT meeting current ONC certification criteria for a minimum of 180 consecutive days within the calendar year. Clinicians must also report all required measures, provide their CMS CEHRT Identification Number, submit the Information Blocking attestation confirming they have not restricted lawful access to electronic health information under the ONC Information Blocking Rule (45 CFR Part 171), and complete both required components of the Security Risk Analysis (SRA) attestation, confirming that the SRA was conducted and that risk management activities were completed in accordance with the HIPAA Security Rule (45 CFR 164.308(a)(1)). Attesting to the High-Priority Practices SAFER Guide self-evaluation using the 2025 edition is also required. The SRA, SAFER Guide, and Information Blocking attestations all function as unscored prerequisites, failing to attest to any one of them results in a zero score for the entire PI category, regardless of performance on all other PI measures. For 2026, the eCR (Electronic Case Reporting) measure is suppressed, and full credit is awarded automatically, though the measure must still be reported. A new optional TEFCA bonus measure is available, with total optional PI bonus points capped at 5.
Explore Blogs, Webinars and other Resources
Trusted by Reputed Companies
Accreditations and Associations
* Disclaimer: This list of accreditations is held by our team of employees and consultants.
What Our Clients Say
We used databrackets (formerly EHR 2.0) in our small medical practice for our risk analysis assessment to be in compliance with meaningful use. Their response was fast, the final report is detailed but simple and easy to follow. They were always available to answer our questions.
E. Compres
Pulmonary and Sleep Center of the Valley
I never miss the opportunity to learn something new …that’s why I am always registering to all free seminars offered on the web. databrackets (formerly EHR 2.0) happened to be the friendliest, comprehensive and up-to- date source of HIPAA Privacy and Security updates.
Alexandra V.
Community Healthcare Network
Today’s presentation was great! Thank you for sending the slides. My only feedback is that it would be fabulous to have the slides ahead of time so I could print them and take notes on the slides.Thanks for your time and knowledge today!
T.B., PM
Community Health Network
Particularly interesting was the flow chart on Administrative Simplification. I utilize all of the Security subcategories you list under the Security tile and appreciate knowing that I am hitting all of the relevant topics during my employee training.
Jessica B.
JD, CHC
I have re-worked our original risk assessment….We are using databrackets' (formerly EHR 2.0) Meaningful Use Security Risk Analysis Toolkit and it meets our needs. It was easy to use and I believe that it very beneficial to our meeting meaningful use.
Bill Curtis
Neurosurgical Associates Of Texarkana, TX
Information (webinars) presented by databrackets (formerly EHR 2.0) highlights some of today’s most demanding healthcare topics. The webinars help to direct those operating in today’s rapidly changing environment in the right direction.
Candace M.
Privacy and Security Officer, Springhill Medical Center
Our Growing List of Credentials
0
+
Assessments
0
+
Clients
0
+
Assessment Libraries
0
+
Years of Experience
0
+
No. of Staff Trained
0
+
HIPAA
0
+
SOC 2 Readiness
0
+
Pen Testing
0
+
ISO 27001 Certifications
0
+
Dollars Saved in Compliance Penalties