The MIPS 2027 modifications that CMS announced in July will eliminate the "High Priority" designation and substitute this designation for a list of 78 designated quality measures. In addition to eliminating the High Priority designation, CMS has also removed the Security Risk Analysis (SRA) measure from the Promoting Interoperability category, effective with the 2027 performance period. Although nothing is finalized at this time, CMS closed its comment period on September 14, 2026, and the final rule remains pending.
Nevertheless, both proposals are relevant to all clinicians reporting quality data. Whether you report as part of MIPS via a traditional pathway or as part of a value pathway, your measure set may be impacted by these changes. Below are details about the proposed modifications, those they affect, and what your billing team needs to review today.
Quick Answer
- Proposals by CMS to replace a performance outcome or top priority measure with one of its 78 "quality" measures.
- A traditional MIPS clinician is allowed to choose one (as) 1 of her/his six quality measures; a value pathway reporter is allowed to choose one (as) 1 of her/his four quality measures.
- The Security Risk Analysis measure will be removed from Promoting Interoperability in 2027; however, HIPAA still requires that each covered entity conduct such an analysis.
- None of these are final; all are proposals.
Why CMS Wants to Retire High Priority Measures
Right now, MIPS clinicians must report at least one outcome measure. If none apply to them they may report a high priority measure instead. That label will cover outcome, patient safety, care coordination and several other measure types.
The agency released the proposed rule (CMS-1848-p) on July 14, 2026 and it was published in the Federal Register two days later. The comment period closed September 14. As of early October 2026 no final rule has posted; the final version determines which proposals survive.
The agency also wants traditional reporting gone for good. Under the proposal traditional MIPS ends after the 2028 performance period. Value Pathways are the only option from 2029 for clinicians outside of a MIPS apm. This is another directorate by CMS since 2019.
This is long runway and CMS says so too. It calls the timeline a clear window for clinicians to select a pathway, develop workflows based upon its measures and set up data collection at the subgroup level whenever needed.
Timing matters because what you report next year determines your Medicare payment for two years thereafter.
What's New in the MIPS 2027 Changes
Let's break it down. The table shows where today's rules stand and what CMS proposes.
| Area | Today | Proposed for 2027 |
|---|---|---|
| Quality requirement | One outcome measure, or a high priority measure | One of 78 designated measures |
| High priority label | In use | Removed |
| Security Risk Analysis | Required | Removed |
| Electronic Prior Authorization | Slated to start in 2027 | Optional bonus in 2027, required in 2028 |
| Traditional MIPS | Available | Ends after 2028 |
Quality category
Traditional MIPS clinicians will have the opportunity to select any of the listed (flagged) quality measures contained within the inventory or they can select one of the specialty sets. The value pathway reporter will have to select from those flag quality measures contained within their respective pathways.
Practices with fewer than 15 patient encounters will be exempt from this step. Any clinician who does not have an option available will attest to that fact and report another quality measure.
If the clinician skips these two steps, they will lose all 10 points on the required quality measure.
The scoring of the measures is receiving some help as well. For measures listed in the new list that are capped at 7 points, the cap for the measure will be based on the defined topped out benchmark. This allows the clinician whose highest performing quality measure was previously capped to earn up to 10 points.
The number of measures being reported by clinicians has been reduced. CMS proposes reporting 180 quality measures in 2027 compared to 190 quality measures in 2026. There were 20 removed quality measures; there were 43 substantive changes made to the existing quality measures.
There are additional value pathways proposed for 2027. CMS proposes three additional value pathways: Diabetic Disease, Hospitalist, and Hypertension. These additions bring the total number of value pathways to 30. All 27 current value pathways will have the ability to include flagged choices.
Promoting Interoperability category
CMS is proposing to eliminate the Security Risk Analysis measure and two of the ONC attestation measures. Specifically, it will be eliminating the On-Center (ONC) Direct Review and ONC-ACB Surveillance. This would begin with the 2026 performance year for those practices; however, electronic prior authorization would be a voluntary bonus in 2027 and then mandatory in 2028. The prior authorization system would require practices to have FHIR-enabled, ONC-certified modules so they can process the requests and meet one or all of the three certified prior authorization criteria beginning in 2028.
But what happens to the security work itself? In its proposed rule, CMS reminded health care professionals that even though they are no longer required by law to perform periodic security risk analyses under the Health Insurance Portability and Accountability Act (HIPAA), they continue to be obligated to perform these activities as part of managing risks to protected health information.
How the Proposals Hit Providers and Billing Teams
Changes to MIPS 2027 will have the biggest impact on practices that use the same metrics each year. One of those metrics you rely on can be removed from MIPS reporting; and, if the new metric is added, it must be compatible with your EHR (Electronic Health Record) and Registry systems.
CMS already implemented a 75 point minimum performance threshold effective through the 2028 Performance Period. If an individual's practice receives a Zero on a single required measure, they will find it much harder to meet or exceed the Threshold. As well as being tied to the Final Score, which also impacts the Medicare Payment Adjustment for the 2029 Payment Year. Therefore, since Revenue is impacted by Reporting, and Reporting should belong in your Healthcare Revenue Cycle Management Services discussions and not only in Clinical Discussions.
How will these changes affect your Practice? Your Practice may require a New Quality Measure, A New Registry Setup, And a Review of your Security Risk Analysis Schedule.
Billing teams own more of this than they think:
- Evaluating quality measure selection and management of Registry contracts
- Reporting based upon claims that requires clean quality coding provided by either an outside Coding Service for you or your own In-House Coders
- Schedule for Security Risk Analysis
- Workflows within the EHR for prior authorizations
Look at your software as well. As part of its proposals to reduce regulatory burden, CMS plans to limit the Certified Electronic Health Record Technology (CEHRT) definition to those functionalities proposed by ONC for deregulation; therefore, you should ask your Vendor which of the CEHRT functionalities will remain.
Does the removal of the Security Risk Analysis mean less work? No. The reporting obligation is eliminated; however, your responsibility remains.
What It Means for Patients and Payers
CMS believes that electronic prior authorizations will reduce the time that it takes to get treatment for patients and the time it takes for doctors to fill out paperwork to help payers receive more prior authorization requests via their FHIR enabled health information technology (HIT) systems as well as the prescription drug measures aligns with another proposal by CMS for drug prior authorization.
Providers may be able to notice this in other areas of medicine. The two newly created pathways for diabetes and hypertension are designed to provide a clinical pathway or "clinical guideline" for managing and preventing chronic illnesses such as diabetes and hypertension.
Denial tracking is important because if a provider has trouble getting an approved prior authorization then they may end up having claims denied. Denial tracking can identify common patterns and issues before you lose money.
What Should Your Practice Do Now?
Short answer: compare your current measure list to the 78 designated measures before cms publishes final rule
Next Steps
- Identify all of your 2026 quality measures and flag every outcome or high priority measure that you report.
- Check your reported measures against the proposed 78 designated measures included in the cms files.
- Contact your EHR vendor and registry to determine whether they will support any measure(s) you select.
- Verify if your practice qualifies as a "small" practice, since small practices are exempt from these new requirements.
- Schedule your security risk analysis (you must complete one regardless of participation in MIPS).
- Find out where electronic prior authorization stands within your EHR system.
- Continue to monitor www.CMS.gov for the final rule release then rerun this comparison again.
Frequently Asked Questions
The Proposed Changes include replacing the High Priority Measures with a 78- Measure List, removing the Security Risk Analysis measure and ending traditional MIPS in 2028.
No. It was posted by CMS on July 14, 2026, comment period ended September 14, 2026; the final rule establishes which apply.
Yes. Whether MIPS asks for an attestation, you have to complete one as part of your compliance with the HIPPA Security Rule.
No. According to CMS' proposal small practices will be exempted from reporting as well as the Attestation process.
Changes to rules such as how data is picked, how an Electronic Health Record (EHR) system is configured and how claims are processed will affect how well all three areas work together. Because Human Medical Billing works directly with medical practices to understand the relationships among them, when a new scoring process is put in place it will be less surprising that this occurs at the end of the Performance Period. If you would like someone else review your Measure List, or if you have questions about your billing workflow, please visit our Contact Us page.
Contact Human Medical Billing to schedule a compliance readiness review or learn more about our end-to-end billing and regulatory support services.
