MIPS and the security risk analysis: the December 31 rule

The rule, plainly

Medicare’s Merit-based Incentive Payment System — MIPS — has a category called Promoting Interoperability, the part that scores how a practice uses its certified EHR. To score in that category at all, the practice must attest “yes” to its Security Risk Analysis measure, and as of 2026 that means two things: a security risk analysis conducted or reviewed, and risk-management work on what it found — the same two duties HIPAA’s Security Rule already assigns. CMS’s spec is explicit about timing: the analysis “must be conducted within the calendar year of the performance period (January 1st – December 31st).”

The spec is equally explicit about the consequence: failure means “no score for the Promoting Interoperability performance category, regardless of whether other measures in this category are reported.” In the standard weighting that category is a quarter of the MIPS final score. You submit the attestation early the following year — but the analysis itself cannot slide past December 31.

Who this actually binds

Fewer practices than the countdown-marketing implies. Walk the gates in order:

• The low-volume threshold. MIPS is required only if you exceed all three: more than $90,000 a year in Medicare Part B professional services, more than 200 Part B patients, and more than 200 covered services. Many solo practices are out on this gate alone.
• The small-practice reweighting. Practices with 15 or fewer clinicians get the Promoting Interoperability category automatically reweighted to zero — no EHR reporting expected. But it’s opt-in-then-binding: a small practice that chooses to report the category anyway cancels its own reweighting, and the December 31 rule then applies in full.
• Clinician type. Counselors and marriage-and-family therapists became able to bill Medicare in 2024 — but they are not MIPS-eligible clinician types, so none of this applies to them. (The eligible list runs physicians, PAs, NPs, psychologists, PTs, OTs, clinical social workers, and a few more.)
• Certified EHR. Scoring the category requires certified EHR technology in place, with at least 180 continuous days of data in the calendar year.

Put together: this deadline genuinely binds medical groups that report Promoting Interoperability — a real population; per CMS’s published 2023 experience data, roughly 370,000 clinicians attested this measure — and genuinely does not bind most solo practices, therapists, or dentists. If someone uses MIPS to sell you urgency without asking which side of those gates you’re on, they’re selling, not informing.

If it binds you: what to do before December 31

If your practice is reporting Promoting Interoperability for 2026, here is the short list, in order:

1. Confirm you’re actually in. Check your status at qpp.cms.gov and ask whoever handles your MIPS reporting whether the practice is reporting this category. A small practice that has been reweighted owes nothing here unless it chooses to report anyway.
2. Conduct or review this year’s analysis. A review of an earlier analysis counts, but it must be dated within this calendar year and cover the whole year. If you report from more than one certified EHR, each one needs it. Installing or upgrading to a new system calls for a fresh analysis, not just a review.
3. Act on what it found. The second of the two “yes” statements is about risk management: putting security measures in place that bring the risks down to a reasonable and appropriate level. At minimum, CMS expects you to be able to show a plan for each gap and the steps you’ve taken on it.
4. Date it and keep it. CMS’s audit guidance asks for a dated report of the procedures and results of both the analysis and the risk-management work, identifiable to your practice (practice name, clinician, NPI). It doesn’t have to come from your EHR. Keep it for six years from the end of the performance year.
5. Attest in the new year. The 2026 submission window runs January 4 to March 31, 2027. Attesting in March is fine; doing the analysis in January is not.

December is the worst month to start: end-of-year clinical crunch plus an analysis that takes real time is how attestations get signed on hope. The earlier in the fall you begin, the more room there is to act on what it finds — and that second “yes” depends on it.

If it doesn’t bind you

The duty doesn’t vanish — it just loses the date. The security risk analysis requirement comes from the HIPAA Security Rule itself and applies to practices covered by HIPAA, whatever their size, on no particular calendar — federal enforcement has made it a focus since 2024.

A documented, dated analysis is worth having on file either way. The free assessment walks you through it and ends in that paper trail.

Free — no account needed to start, and your answers never leave your browser. Not legal advice: for questions about your specific obligations, talk to a healthcare attorney.