To attest Yes to the Promoting Interoperability security risk analysis measure, a MIPS-eligible clinician or group must have conducted or reviewed a HIPAA security risk analysis under 45 CFR 164.308(a)(1) during the calendar year of the performance period, addressing the encryption of ePHI in the certified EHR, implementing the security updates it called for, and correcting the deficiencies it found. Attest No, or be unable to attest, and the category scores zero: for most clinicians a quarter of the final MIPS score, which sets the Medicare Part B payment adjustment two years later.
Last reviewed . Check the current performance year’s measure specification at qpp.cms.gov before relying on any figure here.
The measure is a single Yes or No attestation, but the sentence it asks you to attest to has four parts, and an auditor reads all four. Paraphrasing the Promoting Interoperability measure specification:
Conduct or review a security risk analysis
In accordance with 45 CFR 164.308(a)(1): the HIPAA Security Rule's risk analysis and risk management standard. This is the same analysis the Security Rule already requires; the measure does not create a second, MIPS-specific kind.
Address the security of ePHI in certified EHR technology, including encryption
The measure calls out ePHI created or maintained by CEHRT and refers to 45 CFR 164.312(a)(2)(iv) and 164.306(d)(3): the encryption implementation specification and the rule for documenting why an addressable specification was or was not implemented. The analysis has to show that encryption of that data was considered and what was decided.
Implement security updates as necessary
Where the analysis finds that patches, configuration changes or new safeguards are needed, the measure expects them to have been applied, not merely listed.
Correct identified security deficiencies
As part of the clinician's risk management process. This is 45 CFR 164.308(a)(1)(ii)(B) by another name: the measure ties the attestation to remediation, which is why a report with no record of what happened next is the finding auditors raise most.
Two things follow. First, this is the HIPAA risk analysis, not a MIPS-specific exercise: a practice that already meets 45 CFR 164.308(a)(1)(ii)(A) has done the work and needs only to make sure it was done, or reviewed, in the right year. Second, the attestation is about the whole chain (analysis, updates, corrections) so the evidence has to show remediation, not only findings.
Promoting Interoperability is reported for a continuous performance period of at least 180 days within the calendar year. The security risk analysis does not have to fall inside those 180 days, but it does have to fall inside the calendar year of the performance period. That distinction catches practices every year in the same way: the submission window opens in January and runs for roughly three months, somebody opens the attestation, reaches the security risk analysis measure, and discovers that the last one was done two years ago. At that point there is no honest way to attest Yes for the year that has ended.
The practical rule is to schedule the analysis, or the documented review of the existing one, for the same month every year: early enough that the deficiencies it finds can be corrected before 31 December, because the correction is part of what you attest to. A practice that does its analysis in October and its remediation in the following March has an attestation problem for both years.
The measure says conducted or reviewed, and that word is doing real work. An analysis done properly does not have to be rebuilt from nothing every year. What has to happen every year is a review: somebody re-reads the inventory and confirms it is still accurate, checks whether any system, vendor, location or working practice changed, re-examines the risks whose likelihood or impact that change affects, confirms the prior year’s remediation items were closed or records why they were not, and dates and signs the result. A review that finds nothing changed is a legitimate outcome, but it is a document, with a date, that says so.
What does not count is the same file with a new date on the cover. Auditors compare the review record against the analysis it claims to review, and an analysis that still lists the practice management system you replaced eighteen months ago answers the question for them.
The figures below are the ones that have held across recent performance years. CMS sets several of them in each year’s Physician Fee Schedule final rule, so confirm the current values before planning around them.
| Item | Figure | Why it matters here |
|---|---|---|
| Promoting Interoperability weight | 25% of the final score for most clinicians | A No on the security risk analysis measure zeroes the whole category, not one measure. |
| Performance threshold | 75 points in recent performance years | Below it the adjustment is negative; a 25-point hole makes 75 hard to reach from the other categories. |
| Payment adjustment | Up to −9% to +9% of Medicare Part B covered professional services | Applied two years after the performance year, to every Part B claim for the whole payment year. |
| Performance period | At least 180 continuous days in the calendar year | For the category. The security risk analysis must be in the calendar year, not necessarily those days. |
| Submission window | Opens in January; typically closes at the end of March | When you attest, not when the analysis can be done. |
| Documentation retention | Six years | CMS can select a submission for data validation and audit; HIPAA requires the same retention independently. |
One more consequence sits outside the scoring table. Attesting Yes to a measure whose requirements were not met is a false attestation to CMS, which carries its own consequences beyond a lower score. The attestation is the one place in the MIPS submission where the honest answer may cost points, and it is still the only answer to give.
MIPS-eligible clinician types include physicians, physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, physical and occupational therapists, clinical psychologists, qualified speech-language pathologists and audiologists, registered dietitians and clinical social workers, among others: provided they exceed the low-volume threshold in Medicare Part B allowed charges, patients and covered services, and are not excluded for another reason such as being new to Medicare that year or participating in an Advanced APM.
Some clinician types have the Promoting Interoperability category automatically reweighted to zero, and a small practice (fifteen or fewer clinicians) can apply for a hardship exception that does the same. Neither removes the HIPAA obligation. The Security Rule requires the risk analysis of every covered entity regardless of MIPS status; what the exception removes is the annual attestation and its scoring consequence, not the document.
A data validation and audit request asks for the documentation behind the attestation. This is what supports a Yes:
The EHR vendor's security certification or BAA is evidence about the vendor. It says nothing about the practice's laptops, email, backups, staff access or other vendors, which is most of what a risk analysis covers.
A review has to show what was reviewed. A file whose only change is the year on the cover is a document that was not reviewed, and the modification date usually says so.
A list of safeguards marked present or absent is an inventory of controls. The measure requires an analysis of risk (threats, vulnerabilities, likelihood, impact) and a checklist has none of those.
The measure includes implementing updates and correcting deficiencies. An analysis that found eleven problems and a file that shows nothing being done about any of them is an attestation that cannot be supported.
The submission window opens in January and runs for roughly three months, and a practice that realises it has no analysis at that point cannot backfill one into the year that has ended. The analysis belongs in the performance year; the attestation belongs in the window.
Informational only. Based on the published text of 45 CFR Part 164 and on CMS’s Quality Payment Program resources describing the Promoting Interoperability performance category and its Security Risk Analysis measure, as read on October 9, 2026. Category weights, the performance threshold, the low-volume threshold and exception rules are set per performance year in the Physician Fee Schedule final rule and change: confirm the current year’s measure specification and scoring at qpp.cms.gov before acting. This is not legal advice. No organization or product can be “HIPAA certified” (no such designation exists), and nothing here is a representation about how CMS will score or audit any submission. See our editorial standards.
Looking for the software rather than the explanation? Risk assessment, done for you.