The 2026 Quality Payment Program policies arrived inside the CY2026 Physician Fee Schedule final rule on October 31, 2025. For the practices we work with, the news is mostly stability: the number you have to beat did not move, the categories weigh what they weighed, and the program CMS keeps signaling it will retire is still here. The decisions are about which path to report under and whether the practice is set up to collect the data from January 1.
We also get asked, every November, about two other compliance items that are not MIPS but land on the same desk: whether the HIPAA Security Rule update has been finalized, and when PCMH annual reporting is due. Both are answered at the end.
Key takeaways
- The MIPS performance threshold stays at 75 points for 2026 and, as finalized, through the 2028 performance year. Below 75 is a penalty of up to 9 percent on 2028 Part B payments; at or above 75 is safe.
- Category weights are unchanged: quality 30 percent, cost 30 percent, promoting interoperability 25 percent, improvement activities 15 percent. Data completeness stays at 75 percent.
- Six new MIPS Value Pathways bring the total to 27. Traditional MIPS remains available for 2026, but CMS has already asked, in last year's rule, whether 2029 should be its last year.
- Do not lose 2025 while planning 2026: the submission window runs January 2 to March 31, 2026, and the hardship exception application is due December 31, 2025.
What CMS finalized for the 2026 performance year
| Policy | 2026 final | Note |
|---|---|---|
| Performance threshold | 75 points | Finalized to stay at 75 through the 2028 performance year |
| Maximum negative adjustment | Minus 9 percent | Applied to 2028 Medicare Part B payments |
| Category weights | Quality 30, cost 30, PI 25, IA 15 | Unchanged; these are set in statute |
| Quality data completeness | 75 percent | Report on at least 75 percent of eligible patients or encounters, all payers |
| Cost measures | 35 | None added or removed; total per capita cost attribution narrowed; calculated by CMS from claims |
| Quality measure changes | 5 added (2 eCQMs, 3 MIPS CQMs), 10 removed, about 30 revised | Check every measure you reported in 2025 against the 2026 list |
| Improvement activities | 3 added, 8 removed | The health equity subcategory is discontinued |
| Promoting interoperability | Security risk analysis attestation; 2025 SAFER Guides | New optional public health reporting measure using TEFCA |
| New MVPs | 6 | Diagnostic radiology, interventional radiology, neuropsychology, pathology, podiatry, vascular surgery |
| Traditional MIPS | Still available | CMS sought comment in the CY2025 rule on ending it after the 2028 performance year; nothing finalized |
The threshold is the whole game
A final score at or above 75 means no penalty. Below 75 means a negative adjustment that scales down to minus 9 percent at very low scores. Above 75 earns a positive adjustment funded by the penalties of everyone below, which in most recent years has been small even for perfect scores. Our view, which has not changed: for most independent practices, MIPS is a penalty-avoidance program, not a bonus program. Spend enough to clear 75 reliably and no more.
For a two-physician practice with $600,000 in Medicare Part B allowed charges, a minus 9 percent adjustment in 2028 is $54,000. That is what the reporting effort is protecting. The effort itself, for a practice whose EHR captures the measures, is a few hours a month of someone watching a dashboard and a few days in February assembling the submission.
The practices that get into trouble are rarely the ones that report badly. They are the ones that did not know they were required to report, or assumed a low-volume threshold exclusion that no longer applied after a new provider joined or a second location opened. The low-volume threshold is $90,000 in Part B allowed charges, 200 Part B patients, and 200 covered services, all three in a determination period; cross all three and you are in. The eligibility check takes five minutes on the QPP website and should be repeated after the second determination period each year. We have seen a practice discover an unexpected penalty on its first remittance of the year because a part-time physician crossed the volume threshold two years earlier and nobody looked.
Traditional MIPS or an MVP
MIPS Value Pathways bundle a smaller set of quality measures, improvement activities and cost measures around a specialty or condition. With six new ones, the count of available MVPs grows to 27, and the specialties added this year (radiology, pathology, podiatry, vascular surgery, neuropsychology) are ones that struggled to find relevant measures in traditional MIPS. If there is an MVP for your specialty, look at it seriously. The measure list is shorter, the cost measures are relevant, and CMS has said this is where the program is going. MVP registration for 2026 runs from the spring through early December 2026, so there is time to decide, but the measures have to be captured from January regardless.
If there is no MVP for your specialty, or the MVP measures do not match what your EHR can capture, traditional MIPS remains available for 2026 with no announced end date. CMS asked in the CY2025 rule whether the 2029 performance year should complete the transition to MVPs and did not propose anything on the question this year. That is a signal, not a rule. Multispecialty groups have a further choice: report as a group under traditional MIPS, or as subgroups under different MVPs, which usually scores better and takes more work.
Data completeness at 75 percent
Quality measures must be reported on at least 75 percent of the patients or encounters eligible for the measure, across all payers, not just Medicare. Practices that report through their EHR usually meet this automatically. Practices that report through a registry with manual abstraction sometimes do not, and a measure that misses completeness scores zero. Confirm with your registry or EHR vendor, in writing, that every measure you plan to report will meet 75 percent from the way your workflow captures the data, starting January 1.
The second trap is the case minimum. A measure needs at least 20 eligible cases to be scored against a benchmark; below that it earns a floor score regardless of performance. A small practice choosing six measures should pick ones with enough denominator volume, and should check the volume in the first quarter rather than discovering in November that a measure never reached 20.
The 2025 submission window
While planning 2026, do not lose 2025. The submission window for the 2025 performance year opens on January 2, 2026 and closes March 31, 2026. If your practice was affected by the shutdown, a storm or a practice disruption in 2025 and cannot report, the extreme and uncontrollable circumstances hardship exception application is due by December 31, 2025. Check your eligibility in the QPP participation lookup now, because eligibility changes with the second determination period and practices are surprised every year. Run a preliminary score in your EHR or registry in the first week of December, while there is still time to close a gap with a December visit.
Questions we hear
Has the HIPAA Security Rule update been finalized?
No. HHS published the proposed rule on January 6, 2025, the comment period closed on March 7, 2025, and OCR received more than 4,000 comments. As of this writing, OCR is still reviewing them; the fall regulatory agenda lists a final rule for 2026. Practices should not wait for it to complete the annual security risk analysis, which is already required and is also a MIPS Promoting Interoperability condition. Treat the proposed rule's requirements (asset inventory, network map, encryption, multifactor authentication, annual audits) as a preview of where enforcement is heading, not as current law.
When is our PCMH annual reporting due?
NCQA PCMH annual reporting is tied to your recognition anniversary, not the calendar year, so the date is specific to your practice. Most practices need eight to twelve weeks to assemble the evidence, which means a practice with a March anniversary should start now. Our PCMH annual review service works backward from the anniversary date.
Can a billing company handle MIPS?
Some of it. Measure selection, data completeness checks and the submission itself are administrative tasks a billing or transformation team can run. The clinical documentation that makes the numerators is the practice's. Our transformation team works with practices on the measure workflow so that the data exists by the time anyone wants to submit it.
What to do this month
- Confirm 2026 eligibility for each clinician and for the group in the QPP participation lookup, and confirm 2025 eligibility while you are there.
- Pick the reporting path: traditional MIPS, an MVP, subgroups, or an APM if you are in one.
- Choose the quality measures (six for traditional MIPS, including one outcome or high-priority measure) and confirm each one can hit 75 percent completeness and 20 cases.
- Pick improvement activities that describe work the practice already does and can document, and check that none of them were removed for 2026.
- Confirm Promoting Interoperability: certified EHR version, the security risk analysis, and the 2025 SAFER Guides attestation.
- Run a preliminary 2025 score now, file the hardship exception by December 31 if you need it, and set a quarterly score check for 2026.
