HIPAA security risk assessment for MIPS
The Security Risk Analysis measure in Medicare's MIPS Promoting Interoperability category: who has to attest, what the two attestations mean, the timing rule, and how it relates to the HIPAA risk analysis.
On this page
HIPAA security risk assessment for MIPS at a glance
For Medicare's MIPS program, the Security Risk Analysis measure requires MIPS eligible clinicians reporting the Promoting Interoperability category to attest "Yes" to two things each performance year: that they conducted or reviewed a security risk analysis under the HIPAA Security Rule, and that they carried out security risk management. The analysis must fall within the calendar year of the performance period. The measure earns no points, but without it the category scores zero. Small practices and some other clinicians may qualify for reweighting or a hardship exception.
| Program | Medicare MIPS — Promoting Interoperability category |
|---|---|
| Applies to | MIPS eligible clinicians reporting Promoting Interoperability |
| Attest | Two "Yes" answers: SRA conducted or reviewed, and risk management done |
| Timing | Within the calendar year of the performance period, covering that period |
| If missing | Promoting Interoperability category scores zero |
| Exceptions | Hardship or reweighting may apply (e.g. small practice, non-patient-facing, hospital-based) |
This page covers the Medicare side of the security risk assessment. For how to actually do the analysis, see HIPAA risk assessment; for the free HHS tool, see the HHS SRA Tool.
What the measure requires
The Security Risk Analysis measure sits in the Promoting Interoperability category of the Merit-based Incentive Payment System. It asks for two “Yes” attestations for the performance year:
- You conducted or reviewed a security risk analysis in line with the HIPAA Security Rule (45 CFR 164.308(a)(1)), including the security of data in your certified EHR technology, such as encryption.
- You carried out security risk management — implementing updates and correcting identified deficiencies to reduce risks to a reasonable and appropriate level.
The measure is required but unscored: it adds no points, yet without both attestations the whole Promoting Interoperability category scores zero.
Timing
CMS expects the analysis to be conducted or reviewed within the calendar year of the performance period (January 1 – December 31) and to cover that period. It can happen before or after the 180-day reporting window for the other measures, as long as it is in the same calendar year. A review of last year’s analysis counts if you actually update it for this year.
Who it applies to — and exceptions
It applies to MIPS eligible clinicians, groups and APM entities that report the Promoting Interoperability category. Some clinicians are reweighted out of the category or can apply for a hardship exception — for example small practices, non-patient-facing clinicians and hospital- or ASC-based clinicians. Check CMS’s hardship guide for the current year. An exception from MIPS reporting is not an exception from HIPAA: the Security Rule risk analysis is still required.
Keep the evidence
Attestations can be audited. Keep the dated analysis, the risk management plan and proof of the fixes made during the year. HIPAA separately requires keeping risk analysis documentation for six years (45 CFR 164.316).
Next steps
- HIPAA for therapists and psychologists in private practice →Scenario
- HIPAA for dental practices →Scenario
- HIPAA for physical therapists and chiropractors →Scenario
- HIPAA risk assessment software →Tool
- Security risk analysis →Requirement
- HIPAA documentation retention →Requirement
Frequently asked questions
Can I reuse last year's security risk analysis for MIPS?
CMS expects the analysis to be conducted or reviewed within the calendar year of the performance period and to cover that period. Reviewing and updating last year's analysis during the year is acceptable; simply re-submitting it is not.
Is the MIPS security risk analysis different from the HIPAA one?
No. The measure points to the HIPAA Security Rule's risk analysis (45 CFR 164.308(a)(1)). MIPS adds the yearly timing and the attestation.
Do small practices have to do the MIPS security risk analysis?
HIPAA still requires a risk analysis. For MIPS, small practices may qualify for a Promoting Interoperability hardship exception or reweighting — check CMS's current hardship guide for the performance year.