2026 Year-End Compliance: What Healthcare Providers Need to Know About MACRA, MIPS, and Security Risk Assessments

PRACTICE COMPLIANCE • YEAR-END 2026

2026 Year-End Compliance: What Healthcare Providers Need to Know About MACRA, MIPS, and Security Risk Assessments

December 31, 2026, is approaching. Is your healthcare practice prepared?

As the year draws to a close, healthcare organizations should review several important compliance responsibilities tied to Medicare reimbursement, quality reporting, and patient information security.

Three commonly discussed terms are MACRA, MIPS, and Security Risk Assessments (SRAs). Although closely related, they represent different aspects of healthcare regulation and compliance.

Understanding these requirements, particularly the important changes for 2026, can help practices avoid preventable Medicare payment penalties, strengthen cybersecurity, and protect patient information.

Understanding MACRA and MIPS

The Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) transformed how Medicare evaluates and compensates eligible healthcare professionals.

MACRA established the Quality Payment Program (QPP), which includes the Merit-based Incentive Payment System (MIPS) and Advanced Alternative Payment Models (Advanced APMs).

MIPS evaluates eligible clinicians based on performance in four categories:

• Quality (30%): Evaluates clinical care and patient outcomes.

• Cost (30%): Measures the cost and efficiency of providing care.

• Improvement Activities (15%): Recognizes activities that improve patient care, coordination, and clinical processes.

• Promoting Interoperability (25%): Focuses on certified electronic health record technology, information exchange, and protecting patient health information.

These are the standard category weights for traditional MIPS in 2026; certain exceptions and reweighting policies may apply.

A clinician’s final MIPS score can result in positive, neutral, or negative Medicare payment adjustments.

For the 2026 performance year, the threshold is 75 points, and negative adjustments can reach 9%. The resulting payment adjustments will apply in 2028.

Not every healthcare provider participates in MIPS. Eligibility depends on clinician type, Medicare participation, and other factors. Some MIPS-eligible clinicians and groups—including qualifying small-practice, hospital-based, ambulatory surgery center-based, and non-patient-facing clinicians—have Promoting Interoperability automatically reweighted unless they submit qualifying data. Confirm status using CMS’s QPP Participation Status Tool. [1][3]

Why December 31, 2026, Matters

December 31 marks the end of the 2026 MIPS performance year.

This is the final date for completing activities that must occur during the calendar year, including applicable security risk analysis and risk management requirements under the Promoting Interoperability category.

For clinicians reporting Promoting Interoperability, required measures generally must be reported over the same continuous period of at least 180 days during 2026. The final possible 180-day period began July 5, 2026. An organization cannot make up a missing 180-day data collection period simply by completing an SRA in December. [3]

However, December 31 is not the deadline for submitting 2026 MIPS performance data.

CMS’s submission period opens January 4, 2027, and closes March 31, 2027.

Eligible clinicians should also know that December 31, 2026, at 8:00 p.m. Eastern Time is the deadline for certain MIPS hardship and extreme and uncontrollable circumstances exception applications.

Year-end preparation should include confirming reporting eligibility, reviewing performance data, validating required attestations, and organizing documentation supporting completed activities. [3][4]

What Is a Security Risk Assessment (SRA)?

A Security Risk Assessment is an essential component of compliance with the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.

An SRA helps healthcare organizations identify and evaluate potential threats to the confidentiality, integrity, and availability of electronic protected health information (ePHI).

A comprehensive assessment evaluates how electronic patient information is created, received, maintained, and transmitted throughout the organization—not just within its EHR, but also in connected applications, billing systems, backup systems, and vendor-managed services.

Common areas evaluated include:

• Electronic health record systems and connected technologies.

• User access controls, passwords, and authentication.

• Data encryption and secure information transmission.

• Employee security awareness and training.

• Backup systems and emergency preparedness.

• Third-party vendors and systems handling ePHI.

• Vulnerabilities that could result in unauthorized access, information loss, or operational disruptions.

The assessment should document identified risks, evaluate their likelihood and potential impact, and support appropriate corrective actions.

Importantly, completing an SRA is only the beginning. Organizations must also implement reasonable and appropriate safeguards to manage identified risks. [5]

Important Change for 2026: Two Required MIPS Security Attestations

CMS has updated the MIPS Promoting Interoperability Security Risk Analysis measure for the 2026 performance year.

Applicable participants must now affirmatively attest to two separate requirements:

1. Security Risk Analysis

The clinician or organization conducted or reviewed a security risk analysis consistent with the HIPAA Security Rule during the 2026 calendar year.

1. Security Risk Management

The clinician or organization conducted security risk management activities to reduce risks and vulnerabilities to a reasonable and appropriate level.

Applicable participants must be able to truthfully answer “Yes” to both components to earn a nonzero Promoting Interoperability category score. [6]

Although the Security Risk Analysis measure does not award individual points, failure to complete its requirements results in a zero for the entire Promoting Interoperability category.

A zero in Promoting Interoperability does not automatically impose a 9% payment reduction; the overall MIPS final score determines the payment adjustment. [2][3]

CMS also requires applicable participants to complete an annual self-assessment using the 2025 High Priority Practices SAFER Guide, which addresses safety-related practices associated with electronic health record systems. A “No” to this SAFER Guide attestation also results in a zero Promoting Interoperability category score. [3][7]

These activities should be documented and supported by the organization’s compliance and security management processes. [6][7]

Are All HIPAA Security Risk Assessments Due December 31?

This is an important distinction.

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to periodically review and update security measures. Although “SRA” is commonly used as shorthand, “risk analysis” is the term used by the HIPAA Security Rule.

However, HIPAA does not establish December 31 as a universal annual SRA deadline.

The specific year-end requirement discussed above applies to the 2026 MIPS performance year for participants subject to the applicable Promoting Interoperability requirements.

Organizations should maintain ongoing risk analysis and management processes regardless of MIPS participation. Significant operational changes, new technologies, security incidents, and evolving vulnerabilities may warrant additional assessments or updates. [5][6]

Five Steps Healthcare Practices Should Take Before Year-End

1. Confirm MIPS participation and reporting requirements.

Verify individual and group eligibility, applicable reporting pathways, and whether automatic Promoting Interoperability reweighting or an approved exception applies. Do not assume that all MIPS participants must submit Promoting Interoperability data. [3]

1. Review your 2026 Security Risk Assessment.

Ensure the assessment or required review was performed during 2026, appropriately covers ePHI across the organization, and accounts for the technologies and workflows used to manage patient information.

1. Document security risk management activities.

Review identified vulnerabilities and document the risk mitigation measures taken, outstanding corrective actions, assigned responsibilities, and plans for continued improvement.

1. Complete applicable Promoting Interoperability requirements.

Confirm the two Security Risk Analysis components, the 2025 High Priority Practices SAFER Guide self-assessment, and other required attestations are supported by actual activities. Check the 180-day continuous reporting period, certified EHR technology requirements, and CMS EHR Certification ID. [3][6]

1. Prepare for the 2027 submission window.

Organize supporting records, review performance data for completeness, and confirm responsibility for submission. CMS states that supporting Promoting Interoperability documentation must be kept for six years after submission. [3]

Compliance Is More Than Meeting a Deadline

Year-end deadlines are an important opportunity to review compliance performance, but they should not represent the only time an organization evaluates its regulatory responsibilities.

Effective compliance requires ongoing monitoring, sound documentation, appropriate safeguards, and timely responses to identified risks.

For healthcare practices participating in MIPS, understanding the relationship between MACRA, Medicare quality reporting, and HIPAA security requirements is essential.

With December 31, 2026, approaching, now is the time to verify required activities, address outstanding risks, and prepare for a successful reporting period.

A proactive approach supports more than regulatory compliance. It helps protect patients, strengthen organizational operations, and reduce avoidable financial exposure.

References and Official Resources

[1] Centers for Medicare & Medicaid Services (CMS). MACRA and the Quality Payment Program. Official source

[2] CMS. MIPS Payment Adjustments. Official source

[3] CMS. 2026 MIPS Promoting Interoperability Quick Start Guide (including performance and submission dates). Official source

[4] CMS. QPP Exception Applications, 2026. Official source

[5] U.S. Department of Health and Human Services (HHS), Office for Civil Rights. Guidance on Risk Analysis Requirements Under the HIPAA Security Rule. Official source

[6] CMS. 2026 MIPS Promoting Interoperability: Security Risk Analysis Measure Specifications. Official source

[7] Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology. SAFER Guides. Official source

Additional Resource: HHS/ONC Security Risk Assessment Tool, a free resource designed to assist small and medium-sized healthcare organizations. Official source

This article reflects federal guidance verified as of November 3, 2026, and is intended for general educational purposes. Requirements may vary according to an organization’s participation status and circumstances.