Every autumn a practice calls us in a mild panic because someone remembered MIPS. The question is always the same: is it too late? For the 2026 performance year the honest answer, as of mid-September, is "not quite, but the calendar is now doing the deciding for you". Two of the four performance categories have minimum reporting periods that must fit inside what is left of the year, and one of them is already tight.
The stakes have not changed. The performance threshold for 2026 is 75 points. Score below it and the payment adjustment applied to your Medicare Part B claims throughout 2028 is negative, on a sliding scale down to minus 9 percent. Score above it and the positive adjustment is usually small, because the program is budget neutral and most participants clear the bar. For a practice with $900,000 in Part B allowed charges, the difference between reporting and not reporting is up to $81,000 in 2028. That is worth an afternoon in September.
Key takeaways
- Check participation status by NPI first; the low-volume threshold and APM participation decide whether any of this applies.
- Promoting Interoperability needs a continuous 180-day period, so it had to start by July 5; improvement activities need 90 days and must start by October 3.
- Each quality measure needs 75 percent data completeness for the full year; September is the last point at which a template fix can still rescue a measure.
- The 2026 security risk analysis must be dated in 2026, and the submission window runs January 4 to March 31, 2027, with vendor deadlines earlier.
First, confirm you are actually in
Check each clinician's participation status on the QPP website using their NPI. The low-volume threshold excludes clinicians who, in the determination period, billed $90,000 or less in Part B allowed charges, or saw 200 or fewer Part B patients, or provided 200 or fewer covered services. A clinician must exceed all three to be required to report. Groups reporting as a group are assessed at the group level. Practices in an ACO or other APM entity are usually scored through the APM Performance Pathway and should confirm what the entity is handling for them rather than assuming.
Two more facts change the plan for small practices, which CMS defines as 15 or fewer clinicians under the TIN. First, a small practice that does not submit Promoting Interoperability data has that category automatically reweighted to zero, with Quality rising to 40 percent and Improvement Activities to 30 percent of the final score, so a small practice that missed the July 5 start is not automatically sunk. Second, a small practice that submits at least one quality measure receives six bonus points in the Quality category. Both matter when you are deciding where to spend the remaining three months.
The four categories and what the calendar says
| Category | 2026 weight | Minimum performance period | Status on September 18 |
|---|---|---|---|
| Quality | 30 percent | Full calendar year, January 1 to December 31 | Running whether you planned it or not; the question is whether the data is being captured |
| Cost | 30 percent | Full calendar year, calculated by CMS from claims | Nothing to submit; nothing to do except code accurately |
| Promoting Interoperability | 25 percent | A continuous 180-day period within 2026 | The latest possible start was July 5. If your period is not running, this category is at risk |
| Improvement Activities | 15 percent | A continuous 90-day period within 2026 | Latest possible start is October 3. Pick the activities now |
The Promoting Interoperability row is the one that catches people. A 180-day period ending December 31 must begin by July 5. If nobody chose a start date, the practical approach is to confirm the certified EHR has been in continuous use since before July 5 (it usually has) and to make sure every required measure, the security risk analysis and the attestations can be supported for a period that starts on or before that date. If the EHR was switched in August, talk to the vendor about a reporting-period exception now, not in February.
The arithmetic of a missed category is worth spelling out for practices too large for the small-practice reweighting. If Promoting Interoperability scores zero, the maximum possible score is 75, which means clearing the threshold requires a perfect score in Quality, Cost and Improvement Activities. Nobody gets a perfect Cost score, because Cost is scored against benchmarks. In practice, a zero in PI for a larger group is a penalty. That is why the hardship exception application, which covers situations like a decertified EHR or extreme and uncontrollable circumstances, is worth filing when it applies; it closes on December 31 and reweights the category rather than zeroing it.
Quality: the 75 percent data completeness rule
Each quality measure you submit must include at least 75 percent of the eligible patients or encounters for the full year, across all payers for most collection types, and meet the 20-case minimum to be scored against a benchmark. Practices fail this quietly: the EHR captures the measure for the patients whose visit template includes the field and misses the rest. In September, run the measure reports for the year to date, look at the denominator against your visit count, and fix the template gaps while there are still three months of visits to capture. A measure at 60 percent completeness in December cannot be rescued.
Here is what the rescue looks like in September. A practice has 1,800 encounters eligible for a controlling high blood pressure measure so far this year and the EHR has structured data for 1,080 of them, which is 60 percent. To reach 75 percent by December 31 on a projected 2,400 eligible encounters, it needs 1,800 with data, so 720 of the roughly 600 remaining visits plus backfilled records must be captured. That is only possible if the template is fixed this month and the team also closes the gap on patients returning in the fourth quarter. In November the same measure is unrecoverable, and the honest move is to swap in a measure that already meets completeness.
If you are reporting an MVP (there are 27 for 2026, six of them new) you select four quality measures from the MVP's list plus one improvement activity, and CMS calculates the MVP's cost measures. If you are in traditional MIPS you need six quality measures including at least one outcome or high-priority measure. Either way, pick measures where you already perform well and capture the data completely, not measures that sound impressive.
The security risk analysis is not optional
Promoting Interoperability requires attesting that a security risk analysis was conducted or reviewed during the 2026 calendar year. It cannot be the 2025 analysis. It must cover the certified EHR and the practice's handling of electronic PHI, and it should produce a dated document with findings and a remediation plan. This is also a HIPAA Security Rule requirement, so doing it properly serves two purposes. Practices without one should schedule it for October. A one-page checklist is not an analysis.
Improvement activities: choose by October 3
Pick activities that describe things you already do. Care coordination with a documented process, patient portal engagement, use of a certified EHR for a specific workflow, participation in a QCDR, or, for practices with PCMH recognition, the recognition itself, which earns full credit for the category. Document the 90-day period with dates and evidence (screenshots, policies, reports), because the audit request, if one comes, arrives months later when nobody remembers.
The submission window
Data submission for the 2026 performance year opens January 4, 2027 and closes March 31, 2027 at 8 p.m. Eastern. There is no late submission. Data can go in through the QPP portal, your EHR vendor, a qualified registry or a QCDR. Decide the submission method now and confirm the vendor's own internal deadline, which is often weeks before CMS's. Payment adjustments from this performance year apply to Part B claims from January 1 through December 31, 2028.
Questions we hear
We are a solo practice above the low-volume threshold. Is group reporting even relevant?
No; you report as an individual under your NPI and TIN. The small-practice provisions above apply to you, and in our experience the fastest path to 75 is six quality measures with complete data, one or two improvement activities you already do, and the automatic PI reweighting if the 180-day period was never set up.
Our registry vendor says it will "handle everything". What should we still check?
Three things: that the vendor's data pull covers all payers where the measure requires it, that the completeness figures it shows you are for the full year rather than the quarter, and that its internal submission deadline is on your calendar. The vendor submits what it has. Whether it has enough is your problem.
Is chasing bonus points worth it?
We think most independent practices should treat clearing the 75-point threshold as the goal and not chase bonus points. The upside is small and the effort to reach it is large. The downside of missing is not.
What to do this month
- Check participation status for every clinician and the group on the QPP website. Record the result.
- Confirm the Promoting Interoperability period start date and that every required measure is being captured for it, or confirm that small-practice reweighting or a hardship exception applies.
- Run year-to-date quality measure reports. Any measure below 75 percent completeness gets a template fix this month or a replacement measure.
- Select improvement activities and set the 90-day period to start no later than October 3.
- Schedule the 2026 security risk analysis for October at the latest.
- Confirm the submission method and the vendor's deadline for the January 4 to March 31 window.
