CMS has tightened the rules again for MIPS. The Promoting Interoperability (PI) category is still about interoperability, but in 2026, it is also about operational discipline, cybersecurity, documentation, and timing. CMS has made four key modifications for 2026:

Modified Security Risk Analysis measure
Modified SAFER Guide measure
New optional bonus measure - Public Health Reporting Using TEFCA
New measure suppression policy

⚠️ A “No” response on either the Security Risk Analysis measure or the SAFER Guide measure means a zero score for the entire PI category.

What is Promoting Interoperability (PI), and why does it matter?

PI measures whether clinicians are using certified electronic health record technology (CEHRT) to support patient access, health information exchange, e-prescribing, public health exchange, and protection of electronic patient information. For traditional MIPS and MVP participants, PI is worth 25% of the MIPS final score; for APP participants, it may be worth 30%. To earn a PI score, clinicians must submit:

CMS EHR Certification ID (with all the required functionalities, including FHIR API)
Report for a minimum 180 consecutive-day period
Complete required attestations
Submit complete data for all measures (unless you qualify for exclusion)

The MIPS clock is winding down

Promoting Interoperability (PI) requires at least a continuous 180-day reporting period, making July a critical point in the MIPS calendar. CMS identifiesJuly 5, 2026, as the start of the last possible 180-day PI reporting period, so July 1 should be treated as the alert date for providers who have not started.

Why it matters
Waiting longer reduces the time available to fix workflow gaps, clean up numerators and denominators, verify CEHRT status, complete attestations, coordinate public health reporting, and correct submission issues. If PI monitoring doesn’t begin by July, the practice may not have enough time to improve performance before the reporting period closes.

Pro Tip
Use July 1 as the internal deadline to confirm your PI reporting option, identify your 180-day window, validate CEHRT, review required attestations, and begin active monitoring.

Cybersecurity in MIPS: What changed in 2026

CMS modified the Security Risk Analysis measure for 2026. Clinicians must now attest that they conducted or reviewed a security risk analysis and conducted security risk management activities as required under the HIPAA Security Rule. Both components require a “Yes” response. This is more than identifying risk; providers must show they are managing risk through documented planning and mitigation efforts.

CMS also updated the High Priority Practices SAFER Guide requirement. Clinicians must complete an annual self-assessment using the 2025 High Priority Practices SAFER Guide.

Pro Tip
The requirement remains attestation-based, but it should not be treated as a year-end formality. Assign an owner, complete it during the calendar year, and retain it as audit-ready documentation.

New in 2026: A TEFCA bonus opportunity

CMS added a new optional bonus measure under the Public Health and Clinical Data Exchange objective: Public Health Reporting Using TEFCA. The measure is worth 5 bonus points when the clinician meets TEFCA-related conditions, including active engagement with a public health agency, and use of CEHRT to exchange with that agency.

Pro Tip
For organizations already investing in TEFCA-enabled exchange, this may be a practical scoring opportunity.

Automatic reweighting is available, but look before you rely on it

CMS continues to automatically reweight PI to 0% for small practices, hospital-based clinicians, ambulatory surgical center-based clinicians, and non-patient-facing clinicians. However, automatic reweighting should not be confused with broad automatic Extreme and Uncontrollable Circumstances (EUC) relief. So far in 2026, CMS has issued targeted automatic relief for specific disaster-affected areas, not broad relief comparable to prior years.

With quality benchmarks becoming more stringent and many quality measures topped out at 7 points, MIPS-eligible small practices and non-patient-facing providers should evaluate whether reporting PI could yield a stronger result than accepting automatic reweighting.

Pro Tip
Do not assume reweighting is automatically the best scoring strategy. For some small practices and non-patient-facing providers, reporting PI may still be worth evaluating. PI points may help reach or exceed the 75-point MIPS performance threshold required to avoid negative payment adjustment.

EHR and submission rules: every detail counts

Certified EHR functionality must be in place by the first day of the PI performance period, and the EHR must be certified by the last day. A qualifying PI submission must include complete performance data, required attestations, the CMS EHR Certification ID, and performance period dates.

Avoidable errors can still cost the full PI score. Common problems include an invalid Certification ID, incomplete attestations, incorrect reporting dates, missing numerator or denominator data, unsupported exclusions, and failure to aggregate group data correctly.

Yes, you can submit more than once

CMS allows multiple PI submissions and scores the highest qualifying submission received before the deadline. Submitting early provides time to validate, correct, and resubmit. Waiting until the final deadline removes that margin for error.

How MyMipsScore can support you

Darena Health’s MyMipsScore helps provider organizations and EHRs manage PI with fewer surprises. EHRs can update their certified capabilities quickly with Darena’s certified modules and extend comprehensive MIPS support to their customers.

We support provider organizations with CEHRT validation, measure review, reporting workflows, submission readiness, required attestations, public health reporting considerations, and evaluation of whether reporting PI may improve the overall MIPS outcome. Our guidance spans multiple MIPS reporting paths, like traditional MIPS and MVPs across all MIPS categories.