A five-physician cardiology group asked us in August whether they should bother with MIPS in 2027 at all. They had scraped past the 75-point threshold for 2025 by reporting six quality measures they had used for years, attesting to improvement activities in December, and hoping the cost category did not hurt. Their question was really two questions: what does the 2027 proposal change, and is traditional MIPS worth the effort if CMS is going to end it anyway? The honest answer is that the 2027 year looks a lot like 2026 on the surface and quite different underneath, and the group's reporting habit is about to stop working.
The MIPS 2027 proposed changes sit inside the CY 2027 Physician Fee Schedule proposed rule, which CMS released on July 14, 2026 and published in the Federal Register on July 16. Comments closed on September 14. The final rule normally arrives around November 1. Most of the coverage of the proposal has been about the conversion factor and the efficiency adjustment. The Quality Payment Program section runs to hundreds of pages and got far less attention, and it contains the changes that will decide whether a small practice earns a bonus, avoids a penalty or takes a cut of up to 9 percent on 2029 Medicare payments.
A glossary line for the physicians. MIPS is the Merit-based Incentive Payment System, the Medicare program that scores clinicians on quality, cost, improvement activities and Promoting Interoperability (the use of certified EHR technology), and adjusts Part B payments two years later. An MVP, or MIPS Value Pathway, is a pre-built set of measures around a specialty or condition that a practice reports instead of choosing its own measures under "traditional MIPS".
Key takeaways
- The performance threshold stays at 75 points for 2027 and 2028, as CMS finalized earlier, and the data completeness requirement stays at 75 percent.
- CMS proposes three new MVPs for 2027 (Diabetic Disease, Hypertension and Hospitalist) and changes to all 27 existing ones to include newly designated core measures.
- A "core measure" designation would replace the current outcome or high-priority measure requirement, with small practices exempt from mandatory core measure reporting.
- In Promoting Interoperability, the Security Risk Analysis measure would be removed and an Electronic Prior Authorization measure added with up to 10 bonus points.
- Traditional MIPS would end after the 2028 performance year, making MVPs the only pathway from 2029; the practices that start an MVP in 2027 will have two dry runs before it is mandatory.
What stays the same
The score still runs from 0 to 100 and the threshold to avoid a penalty is still 75 points. CMS finalized that number for the 2026 through 2028 performance years in an earlier rule and did not propose changing it. Category weights are unchanged: quality 30 percent, cost 30 percent, improvement activities 15 percent, Promoting Interoperability 25 percent, with the usual reweighting for practices that qualify for exceptions. Data completeness, the share of eligible patients across all payers that a quality measure must include, stays at 75 percent for 2027 and 2028. The maximum negative adjustment stays at 9 percent, applied to 2029 Part B payments for the 2027 year.
The low-volume threshold that exempts many small practices is also unchanged: a clinician or group with $90,000 or less in Part B allowed charges, or 200 or fewer Part B patients, or 200 or fewer covered professional services is not required to participate. Practices near those lines should check their eligibility on the QPP website when CMS updates it, because a practice that was exempt in 2026 can become eligible in 2027 after adding a provider.
The three new MVPs and the core measure idea
CMS proposes adding Diabetic Disease, Hypertension and Hospitalist MVPs for 2027. The first two matter to primary care and to internal medicine subspecialties, because many independent practices have been reporting the same handful of diabetes and blood pressure measures under traditional MIPS for years. An MVP packages those measures with a fixed set of improvement activities and the standard Promoting Interoperability measures, and adds a population health measure calculated from claims. For a practice already reporting controlling high blood pressure and hemoglobin A1c control, the Hypertension or Diabetic Disease MVP may be the closest thing to a direct translation of what they already do.
The bigger structural change is the core measure designation. Today, a clinician reporting traditional MIPS has to include at least one outcome measure, or a high-priority measure if no outcome measure applies. CMS proposes to replace that with a set of designated core measures and to modify all 27 existing MVPs to include them. Small practices, meaning 15 or fewer clinicians, would be exempt from mandatory core measure reporting. The quality measure inventory for 2027 would have 180 measures, with 20 removed and 10 added.
| Element | 2026 (current) | 2027 (proposed) | What it means for a small practice |
|---|---|---|---|
| Performance threshold | 75 points | 75 points | No change to the target |
| Data completeness | 75 percent | 75 percent | No change; still all-payer denominators |
| Number of MVPs | 27 | 30 | Diabetic Disease and Hypertension are the ones to read |
| Quality measure rule | One outcome or high-priority measure required | Core measure designation; small practices exempt from the mandate | Check whether your six measures include a core measure anyway |
| Improvement activities | Current inventory | Six added, eleven removed | Confirm the activities you attest to still exist |
| Promoting Interoperability | Security Risk Analysis required measure | SRA measure removed; Electronic Prior Authorization measure added with up to 10 bonus points | The HIPAA risk analysis is still required by HIPAA; only the MIPS attestation goes |
| Cost | Current measures | No new measures or removals proposed | Nothing to prepare, nothing you can influence much either |
| Traditional MIPS | Available | Available through 2028, then ends | 2027 and 2028 are the practice years for MVP reporting |
Promoting Interoperability: two changes that matter
Removing the Security Risk Analysis measure from Promoting Interoperability has already been misread by some practices as permission to stop doing the risk analysis. It is not. The HIPAA Security Rule requires the analysis independently of MIPS and always has; CMS is proposing to stop asking clinicians to attest to it in this program. Do the analysis, keep the documentation, and stop expecting MIPS credit for it.
The Electronic Prior Authorization measure is new and connects to the CMS prior authorization rule that requires payers to stand up prior authorization APIs by January 1, 2027. The proposal would give up to 10 bonus points to clinicians who request at least one prior authorization electronically through certified technology using the payer API, or who attest that they had no such requests. For a practice whose EHR vendor delivers the capability in 2027, that is an inexpensive ten points. For a practice whose vendor does not, it is a question to ask the vendor now.
The end of traditional MIPS
CMS proposes to sunset traditional MIPS after the 2028 performance period, which corresponds to the 2030 payment year, and to make MVPs the reporting framework from 2029. Virtual groups would be allowed to report MVPs beginning in 2029. The agency has been signaling this since MVPs were introduced for 2023, and the proposal puts a date on it.
For the cardiology group, this changes the calculation. Their six-measure habit works for two more years. An MVP that fits cardiology exists already, and reporting it in 2027 costs little more than reporting traditional MIPS, because the quality measures overlap. The difference is that an MVP has fewer measures to choose from, a fixed improvement activity set, and a population health measure they cannot control. Learning what their score looks like under the MVP in 2027, while traditional MIPS is still available as a comparison, is worth more than the small amount of extra work.
What we think practices should take from the MIPS 2027 proposed changes
We think the practices that will do badly in 2029 are the ones that treat 2027 and 2028 as more of the same. The transition to MVPs narrows measure choice, and a practice that has been reporting six easy topped-out measures may find that its specialty's MVP includes harder ones. The time to find out is now, when a poor MVP score is a learning exercise and not a penalty.
We also think the small practice exemption from mandatory core measure reporting is a mixed blessing. It removes a requirement, but the core measures are likely to be the ones with the most benchmark data and the most stable scoring, and a small practice that avoids them may be avoiding its best-scoring options. Read the list when the final rule comes out.
The proposal is still a proposal. Comments closed September 14 and CMS may change any of this in the final rule. What does not change is the timeline: the 2027 performance year begins January 1, and the measures a practice will report have to be built into the EHR workflow before then. Our practice transformation work with PCMH practices overlaps heavily here, because the same care gap and registry work that supports PCMH reporting also produces the quality data MIPS needs.
Questions we hear
Should we switch to an MVP in 2027 or wait?
If an MVP exists for your specialty and its quality measures overlap with what you already report, run it in 2027. You can still submit traditional MIPS in parallel for the same year if your registry supports both, and CMS scores the higher result. If no MVP fits, report traditional MIPS and watch for the final rule's MVP list for 2028.
Does the removal of the Security Risk Analysis measure change our PI score?
The measure was required but carried no points, so removing it does not change the arithmetic; it removes an attestation and the exclusion risk that came with failing to do it. The new Electronic Prior Authorization bonus is where the points move.
We are below the low-volume threshold. Should we care?
Check every year, because the threshold is calculated on two determination periods and adding a provider or a location can change your status. A practice that is exempt can also opt in if it wants the possibility of a positive adjustment, though in recent years those have been small.
What to do this week
- Read the QPP fact sheet for the CY 2027 proposed rule and the measure specifications for the MVP closest to your specialty.
- Compare your current six quality measures with the MVP's measure list and note the overlap and the gaps.
- Check whether any improvement activity you attested to in 2025 or 2026 is on the proposed removal list.
- Ask your EHR vendor in writing whether it will support the Electronic Prior Authorization measure for 2027.
- Confirm that the HIPAA security risk analysis is scheduled regardless of the MIPS change.
- Put a calendar reminder for the first week of November to read the final rule and update the plan.
