Your 2026 MIPS Attestation Now Covers Risk Management, Not Just Risk Analysis
Did you know CMS requires a security risk analysis for MIPS? Under the Promoting Interoperability (PI) performance category, clinicians must attest that they conducted or reviewed a security risk analysis as required by the HIPAA Security Rule at 45 CFR 164.308(a)(1). Beginning with the 2026 performance period, CMS added a second required attestation: that the clinician also conducted security risk management activities under the same Security Rule standard. Failing to complete either attestation results in no score for the entire PI category, which accounts for 25 percent of a traditional MIPS final score and directly affects a clinician’s Medicare payment adjustment.
What CMS Requires for the 2026 Performance Period
The requirement sits under the PI category’s Protect Patient Health Information objective as the Security Risk Analysis measure (PI_PPHI_1). For 2026, CMS split it into two separate “Yes” attestations:
- Risk analysis: the clinician, group, or APM Entity conducted or reviewed a security risk analysis in accordance with 45 CFR 164.308(a)(1).
- Risk management: the clinician, group, or APM Entity conducted security risk management activities as required under the HIPAA Security Rule, implementing security measures sufficient to reduce identified risks and vulnerabilities to a reasonable and appropriate level.
A few details matter when planning the work. The analysis must be completed or reviewed annually within the calendar year of the performance period, though it need not fall within the PI reporting window. CMS expects it to cover each certified EHR technology (CEHRT) the clinician or group uses. The measure earns no points on its own; it functions as a gatekeeper, so a “No” or an unsupported “Yes” zeroes out the category regardless of how well every other PI measure performs.
The same objective also includes a separate required attestation for an annual self-assessment using the High Priority Practices SAFER Guide. That measure addresses EHR safety practices; it is not a substitute for a HIPAA risk analysis.
Why CMS Added Risk Management
The HIPAA Security Rule has always required both steps. The Security Management Process standard pairs risk analysis at 45 CFR 164.308(a)(1)(ii)(A) with risk management at 164.308(a)(1)(ii)(B); the former identifies the risks, and the latter requires the organization to act on them. CMS finalized the change for clinicians in the Calendar Year 2026 Physician Fee Schedule final rule and made a parallel change for eligible hospitals and critical access hospitals in the FY 2026 IPPS final rule.
The change also mirrors what OCR told attendees at its September 2026 conference with NIST: a risk analysis that does not feed into a documented risk management program is an incomplete compliance posture. CMS now asks clinicians to attest to both halves, meaning a risk analysis that identified problems and then sat in a folder no longer supports a clean attestation.
The Attestation Is Only as Strong as the Analysis Behind It
A “Yes” in the MIPS submission is a representation to CMS that affects Medicare payment, and MIPS submissions are subject to CMS data validation and audit. If a clinician cannot provide documentation supporting the attestation, the PI score and the payment adjustment tied to it can be revised.
The exposure does not stop with CMS. The HIPAA obligation exists independently of MIPS, and OCR measures a risk analysis against its own standard: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) the organization holds. OCR has also been clear that a gap analysis, which compares current practices against a checklist, does not meet that standard. A thin risk analysis therefore creates risk on two fronts: payment under MIPS and enforcement under HIPAA.
In our experience, the gaps that undermine a MIPS attestation are typically the same ones OCR cites:
- Scope is limited to the EHR. CMS requests coverage for each CEHRT; HIPAA requires coverage of all ePHI, including email, patient portals, billing systems, remote access, backups, and vendors.
- Last year’s analysis carried forward. A prior assessment that was never reviewed against new systems, locations, or staff does not reflect the current environment.
- Findings without follow-through. Risks were identified, but no remediation plan, owner, or target date was ever documented; this now directly contradicts the risk management attestation.
- Group attestations that exceed the documentation. A group or APM Entity attests for every clinician, while the underlying analysis covers only one site or one system.
What to Do Before You Attest for 2026
- Confirm timing and scope. Make sure your risk analysis was completed or reviewed during calendar year 2026 and covers every system, location, and vendor that creates, receives, maintains, or transmits ePHI.
- Document risk management, not just risk. For each identified risk, record the safeguard selected, who owns it, the target date, and its current status.
- Assemble an evidence file. Keep the dated risk analysis, the risk management plan, and records of completed remediation together so the attestation can be supported if CMS or OCR requests it.
- Align group submissions. If you report as a group or APM Entity, confirm the analysis covers every participating clinician’s environment and CEHRT.
- Separate MIPS status from HIPAA obligations. Some clinicians, including many small practices, may have the PI category reweighted. That changes MIPS scoring; it does not change the HIPAA Security Rule requirement to conduct and act on a risk analysis.
Frequently Asked Questions
Does MIPS require a security risk analysis?
Yes. The Security Risk Analysis measure is a required attestation within the MIPS Promoting Interoperability performance category. Without it, the clinician, group, or APM Entity receives no score in the category.
What changed for the 2026 MIPS performance period?
CMS added a second required attestation. Clinicians must now attest “Yes” to both conducting or reviewing a security risk analysis and conducting security risk management activities under the HIPAA Security Rule.
Does the risk analysis have to be done during the PI performance period?
No. It may be completed or reviewed outside the PI reporting window, but it must occur within the calendar year of the performance period.
What happens if we attest “Yes” without a supporting risk analysis?
MIPS submissions are subject to CMS data validation and audit. If the attestation cannot be supported, the PI score and the related payment adjustment may be affected, and the missing analysis is also a HIPAA Security Rule deficiency that OCR can cite independently.
Is a risk analysis that only covers our EHR enough?
Not for HIPAA purposes. CMS asks that the analysis cover each CEHRT, but the HIPAA Security Rule requires an accurate and thorough assessment of risk to all ePHI the organization holds, wherever it is created, flows, or leaves.
If our practice is reweighted out of Promoting Interoperability, do we still need to conduct a risk analysis?
Yes. Reweighting affects how MIPS calculates your score, but it does not remove the HIPAA Security Rule requirement to conduct a risk analysis and implement risk management.
Attesting “Yes” Should Mean Something; Colington Consulting Makes Sure It Does
Your 2026 MIPS attestation now asks two questions, and both require documentation that holds up to CMS and OCR. Colington Consulting’s lead consultants have personally conducted more than 1,000 HIPAA risk assessments, and our process is designed to be extensive, accurate, and thorough. We map how ePHI is created, how it moves, and where it leaves your organization across every system, vendor, and location, not just your EHR; we assess and rate each risk specific to your environment; and we deliver a documented risk management plan that supports both your MIPS attestations and the HIPAA Security Rule standard enforced by OCR.
Get a free HIPAA Risk Review. We will show you where your current risk analysis and risk management documentation stand, and what it will take to attest with confidence.
Schedule Your Free HIPAA Risk Review →
Sources
Centers for Medicare & Medicaid Services, Quality Payment Program, 2026 MIPS Promoting Interoperability Performance Category Measure Specification: Security Risk Analysis (PI_PPHI_1).
Centers for Medicare & Medicaid Services, Quality Payment Program, 2026 MIPS Promoting Interoperability Performance Category Measure Specification: High Priority Practices SAFER Guide (PI_PPHI_2).
Centers for Medicare & Medicaid Services, Calendar Year 2026 Physician Fee Schedule final rule, 90 FR 49874.
Centers for Medicare & Medicaid Services, FY 2026 Hospital Inpatient Prospective Payment System (IPPS) and Long Term Care Hospital PPS final rule, Medicare Promoting Interoperability Program.
45 C.F.R. § 164.308(a)(1), Security Management Process (Risk Analysis and Risk Management).
U.S. Department of Health and Human Services, Office for Civil Rights, Guidance on Risk Analysis Requirements under the HIPAA Security Rule, hhs.gov.
U.S. Department of Health and Human Services, Office for Civil Rights, and National Institute of Standards and Technology, “Safeguarding Health Information: Building Assurance Through HIPAA Security” Conference, September 2 to 3, 2026, Gaithersburg, MD.
