CMS MIPS Requirement for Annual Security Risk Assessment Attestation: Why It Matters for Medicare Billing Organizations

The Centers for Medicare & Medicaid Services (CMS) Merit-based Incentive Payment System (MIPS) is designed to improve care quality, promote interoperability, and ensure patient data security. One critical component of the Promoting Interoperability (PI) performance category is the annual attestation for a Security Risk Analysis (SRA). This requirement is not optional—any organization that bills Medicare and participates in MIPS must complete and attest to this assessment each performance year.

What Is the Security Risk Analysis Requirement?

Under the HIPAA Security Rule (45 CFR 164.308(a)(1)), covered entities and business associates must conduct a risk analysis to identify potential threats and vulnerabilities to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI). For MIPS, clinicians and organizations must attest “YES” to having:

• Conducted or reviewed a security risk analysis during the performance year.
• Implemented security updates as needed.
• Corrected identified deficiencies.

This analysis must be unique for each year and updated after significant changes, such as implementing new EHR systems or workflows.

Why Is This Requirement Important?

If your organization bills Medicare, compliance with this requirement is essential for several reasons:

1. Protecting Patient Data
   Healthcare organizations handle sensitive patient information daily. A security breach can lead to identity theft, financial fraud, and loss of trust. Conducting an annual risk assessment ensures that vulnerabilities are identified and mitigated before they can be exploited.
2. Regulatory Compliance
   Failure to complete the SRA and attest accordingly can result in zero points for the PI category, significantly reducing your overall MIPS score. This can lead to negative payment adjustments, directly impacting on your Medicare reimbursements.
3. Avoiding Penalties Beyond MIPS
   Non-compliance with HIPAA security requirements can trigger investigations and hefty fines from the Office for Civil Rights (OCR). An annual SRA demonstrates proactive compliance and reduces liability in the event of a breach.
4. Supporting Organizational Resilience
   Cyber threats in healthcare are increasing, from ransomware attacks to phishing schemes. A thorough risk analysis helps organizations strengthen their security posture, ensuring continuity of care and operational stability.

Key Steps for Compliance

• Review your current security policies and procedures.
• Assess technical safeguards, such as encryption and access controls.
• Document findings and corrective actions.
• Retain evidence of the assessment for audit purposes.

Takeaway

The annual Security Risk Analysis attestation is more than a checkbox—it is a cornerstone of patient data protection and regulatory compliance. For organizations billing Medicare, completing this requirement safeguards revenue, reduces risk exposure, and reinforces trust in your ability to protect sensitive health information.

Colington Consulting | HIPAA Compliance, Risk Assessment & Management

If your organization must conduct a HIPAA Security Risk Assessment before the end of the year, contact our office today at 844.740.7100. We can get the assessment scheduled within days. Avoid negative payment adjustments, directly impacting on your Medicare reimbursements.

Helping Organizations Achieve HIPAA Compliance™