What are the requirements to participate in the CY 2026 Medicare Promoting interoperability Program?

To participate in the Calendar Year (CY) 2026 Medicare Promoting Interoperability Program for eligible hospitals and Critical Access Hospitals (CAHs), participants must meet core scoring, technology, and reporting requirements:

Key Requirements

• Minimum Program Score: Earn a total program score of at least 80 points (out of 105 maximum available points, including bonus measures) and receive a non-zero score on every required measure.
• Certified EHR Technology (CEHRT): Use Office of the National Coordinator for Health Information Technology (ONC) certified health IT standards for a continuous, self-selected 180-day reporting period. The last day to begin this 180-day period in CY 2026 is July 5, 2026.
• Electronic Clinical Quality Measures (eCQMs): Submit eight eCQMs (three self-selected and five CMS-selected) for all four quarters of CY 2026.
  • The five CMS-selected eCQMs are:
    1. Safe Use of Opioids—Concurrent Prescribing
    2. Cesarean Birth (Perinatal Care [PC]-02)
    3. Severe Obstetric Complications (PC-07)
    4. Hospital Harm — Severe Hypoglycemia (HH-HYPO)
    5. Hospital Harm — Severe Hyperglycemia (HH-HYPER)
• Modified Attestations for CY 2026:
  • Security Risk Analysis: Must attest "yes" to conducting both a security risk analysis and active ongoing security risk management in accordance with HIPAA rules.
  • SAFER Guides: Must attest "yes" to completing an annual self-assessment using all eight 2025 SAFER Guides (foundational, infrastructure, and clinical process guides).
• Submission Deadline: Submit all required web-based data, objectives, attestations, and quarterly eCQM data to the Hospital Quality Reporting (HQR) Secure Portal no later than Monday, March 1, 2027, at 11:59 p.m. Pacific Time.

Penalties & Consequences

• Acute Care Hospitals: Failure to meet program requirements can result in a downward payment adjustment to your Inpatient Prospective Payment System (IPPS) market basket update.
• Critical Access Hospitals (CAHs): CAHs that do not successfully meet program requirements may see their Medicare reimbursement reduced from 101% to 100% of reasonable costs for the applicable cost reporting period.

In 2026, the Merit-based Incentive Payment System (MIPS) Promoting Interoperability (PI) performance category is worth 25% of your final MIPS score and requires using ONC-certified electronic health record technology (CEHRT) for a minimum of 180 continuous days.

Core Requirements & Objectives

To successfully report and avoid a zero score for this category, eligible clinicians must fulfill data reporting and mandatory attestations across key areas:

• Electronic Prescribing: Generate and transmit permissible prescriptions electronically (Measure ID: PI_EP_1).
• Health Information Exchange (HIE): Support bidirectional information sharing with other providers.
• Provider to Patient Exchange: Enable patient electronic access to their health information.
• Public Health and Clinical Data Exchange: Report required public health measures (such as Immunization and Electronic Case Reporting).
• Protect Patient Health Information: Ensure privacy and security safeguards are met.

Mandatory Attestations

Clinicians must submit specific required attestations, which include:

• Security Risk Analysis (SRA): Must attest to performing an SRA, newly updated in 2026 to require confirmation that security risk management activities follow the HIPAA Security Rule.
• SAFER Guides: Must attest "Yes" to completing an annual self-assessment using the updated 2025 High Priority Practices SAFER Guide.
• CEHRT & ONC Direct Review: Submit a CMS EHR Certification ID and attest to cooperation with ONC direct review.

New in 2026: Bonus Points

• CMS offers up to 5 bonus points under the Public Health and Clinical Data Exchange objective for practices reporting 2026 MIPS data through a Trusted Exchange Framework and Common Agreement (TEFCA) participant.

Exemptions & Re-weighting

• Small practices (15 or fewer eligible clinicians) automatically receive reweighting to 0% for the PI category unless they choose to submit data.
• Automatic re-weighting or hardship exceptions also apply to hospital-based, ASC-based, and non-patient-facing practices.

You can review the official measure details directly via the CMS Quality Payment Program (QPP).

The Centers for Medicare & Medicaid Services (CMS) interoperability requirements mandate that impacted payers implement standardized Application Programming Interfaces (APIs) using Fast Healthcare Interoperability Resources (FHIR) to improve the secure exchange of patient health and claims data.

Impacted Payers

The rules apply to "impacted payers," which include:

• Medicare Advantage (MA) organizations
• State Medicaid and CHIP fee-for-service (FFS) programs
• Medicaid managed care plans and CHIP managed care entities
• Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (and small group market QHP issuers on the FF-SHOP)

Required APIs and Core Mandates

Impacted payers must build and maintain several distinct FHIR-based APIs:

• Patient Access API: Allows enrollees to easily access their adjudicated claims, encounter data, capitated provider data, and certain clinical data (including lab results) via third-party apps within one business day.
• Provider Access API: Enables providers to retrieve patient claims and clinical data for treatment purposes (subject to patient consent and validation like NPI matching).
• Payer-to-Payer API: Facilitates the transfer of historical patient data—including prior authorization statuses—from one payer to another when a patient changes health plans.
• Prior Authorization API: Streamlines the prior authorization process by letting providers electronically submit requests, check requirements, and receive decisions faster.

Technical Standards

• HL7 FHIR: The foundational framework for data exchange.
• USCDI (United States Core Data for Interoperability): Mandates standard versions (such as USCDI v3) for structured clinical notes, conditions, medications, and labs.
• Security & Authentication: Utilizes modern identity standards like SMART/OAuth 2.0 and OpenID Connect to protect patient privacy.

For comprehensive context and official policy details, review the CMS Interoperability Overview.

The Medicare Promoting Interoperability Program is a Centers for Medicare & Medicaid Services (CMS) initiative that requires specific healthcare facilities to use certified electronic health record technology (CEHRT) to safely exchange health data.

Program Overview

• Goal: Improve healthcare quality, safety, and efficiency through better data sharing.
• Participants: Eligible acute care hospitals and critical access hospitals (CAHs).
• Requirement: Hospitals must submit data showing the "meaningful use" of certified electronic health record systems.
• History: Originally started in 2011 as the "EHR Incentive Program" (or "Meaningful Use") under the HITECH Act. It was renamed to focus strictly on interoperability. Individual clinicians now report similar goals through MIPS (Merit-based Incentive Payment System) instead.

Core Reporting Objectives

Participants must report on four main areas during a continuous 90-day reporting period minimum:

• Electronic Prescribing
• Health Information Exchange
• Provider to Patient Exchange
• Public Health and Clinical Data Exchange

The Promoting Interoperability category in MIPS focuses on five main objectives that use Certified Electronic Health Record Technology (CEHRT) to exchange health data.

Core Objectives and Measures

• Electronic Prescribing: Requires submitting an e-prescribing measure (unless an exclusion applies).
• Health Information Exchange (HIE): Includes options like supporting electronic referral loops by sending, receiving, and reconciling health information, or bi-directional exchange.
• Provider to Patient Exchange: Requires providing patients electronic, timely access to their health information using an API or app.
• Public Health and Clinical Data Exchange: Requires active engagement in measures such as immunization registry reporting, syndromic surveillance, and electronic case reporting.
• Protect Patient Health Information: Focuses on privacy and security measures.

Required Attestations

• Security Risk Analysis: Conducting or reviewing a security risk analysis and risk management activities.
• SAFER Guides Assessment: Completing an annual self-assessment using the High Priority Practices Safety Assurance Factors for EHR Resilience (SAFER) Guide.
• CEHRT Interoperability: Attesting to actions that do not limit or restrict the compatibility or interoperability of CEHRT.
• ONC Direct Review: Submitting a required review attestation.