MIPS Promoting Interoperability (PI) for the 2027 performance period removes the Security Risk Analysis (SRA) measure from the PI category, makes the Electronic Prior Authorization (ePA) measure for medical items and services optional with up to 10 bonus points, and keeps the core 100-point scoring structure intact.
CMS finalized these changes in the CY 2027 PFS final rule (CMS-1848-F), effective January 1, 2027. The 2027 performance period maps to the 2029 MIPS payment year.
The SRA removal deserves a careful read — CMS dropped the MIPS reporting requirement, not the underlying HIPAA Security Rule obligation. Everything else you need to plan your 2027 PI submission is covered below:
- The full 2027 scoring map with point values
- Who qualifies for PI reweighting or an exception
- How to separate what changed from what stayed the same
- Which measures, attestations, and objectives carry forward
- What the ePA bonus actually requires (and what it excludes)
TLDR — MIPS PI 2027
The SRA measure is removed. The ePA bonus is new. The core stays at 100 points.
- 🚫 SRA is no longer a MIPS PI measure for 2027 — HIPAA security risk analysis still required separately
- 💰 Electronic Prior Authorization (medical items/services only) is optional — up to 10 bonus points
- 📊 Core PI scoring totals 100 points across e-Prescribing, PDMP, HIE, Patient Access, and PHCDX
- 📅 Minimum 180 continuous days of reporting using CEHRT
- ⚖️ PI = 25% of the MIPS final score (unless reweighted)
What changed in the 2027 PI requirements?
Two targeted changes — one removal and one addition — define the 2027 PI update. Neither overhauls the category. Both matter for workflow planning.
SRA removal
CMS removed the Security Risk Analysis measure from MIPS PI starting with the 2027 performance period. The practical effect is narrow but important to state precisely. Clinicians no longer attest to SRA as a MIPS measure.
They still have an independent obligation under the HIPAA Security Rule to conduct a security risk analysis. The MIPS reporting line item is gone. The compliance work is not.
The most common mistake practices will make here is conflating the two. A billing manager who sees “SRA removed” and strikes the security risk analysis from the compliance calendar has created a HIPAA problem, not solved a MIPS one.
ePA bonus introduction
The existing Electronic Prior Authorization measure for medical items and services becomes optional in 2027, carrying up to 10 bonus points.
A qualifying “Yes” response indicates the clinician electronically requested prior authorization through the payer’s Prior Authorization API using CEHRT for at least one qualifying medical item or service during the performance period.
Two critical boundaries for this bonus:
- It covers medical items and services only — not prescription drugs
- A missing or “No” response creates no negative scoring consequence
The prescription-drug ePA measure does not start until the 2028 performance period. Confusing these two — especially in internal training materials — leads to workflow errors that are easy to prevent and tedious to correct.
Timeline of recent PI changes
Here is a timeline of the recent changes in PI:
| Performance period | Change | Status by 2027 |
| 2025 | Last year for ONC Direct Review and ONC-ACB Surveillance attestations | Already gone from 2027 reporting |
| 2026 | ONC attestations removed beginning with this period | Already absent |
| 2027 | SRA removed; ePA bonus for medical items/services (optional, 10 points) | Active — plan for it |
| 2028 | Medical-item/service ePA becomes required and unscored; prescription-drug ePA measure added | Future — do not report as 2027 requirement |
How does the 2027 PI scoring work?
The core PI structure totals 100 points. Bonus measures sit on top. The architecture is familiar to anyone who reported PI in 2025 or 2026 — the main change is subtracting SRA and adding the ePA opportunity.
| Objective or measure | 2027 status | Points |
| e-Prescribing | Required | 10 |
| Query of PDMP | Required | 10 |
| Health Information Exchange (choose one pathway) | Required | 30 |
| Provide Patients Electronic Access | Required | 25 |
| Public Health and Clinical Data Exchange (PHCDX) | Required | 25 |
| Core total | 100 | |
| Electronic Prior Authorization (medical items/services) | Optional bonus | Up to 10 |
| Additional PHCDX measures | Optional bonus | Up to 5 |
| Security Risk Analysis | Removed | — |
HIE pathway options
The 30-point HIE objective offers three pathways. A clinician selects one:
- Enabling Exchange Under TEFCA (30 points)
- Health Information Exchange Bi-Directional Exchange (30 points)
- Support Electronic Referral Loops by Sending Health Information and Receiving and Reconciling (15 + 15 points)
The pathway decision often defaults to whatever the EHR already supports. In practice, the bidirectional exchange and TEFCA options work best for organizations with established interoperability infrastructure.
Smaller practices typically land on the referral-loops pathway because the EHR vendor built it in. Neither choice is wrong — but choosing without checking your EHR’s actual capabilities creates unnecessary submission risk.
Required attestations
The 2027 PI measure structure retains two required attestations that are not scored measures:
- SAFER Guide attestation
- CEHRT compatibility and interoperability attestation
Missing an attestation is a different kind of problem than missing a scored measure — it can still affect your PI category without appearing in the point calculation.
What are the 2027 ePA bonus points worth chasing?
The 10 bonus points for electronic prior authorization sit above the 100-point core, making them additive rather than redistributive. For clinicians already using CEHRT to submit prior authorizations electronically, the bonus requires minimal extra work — essentially a “Yes” attestation.
The qualification criteria are specific:
- The request must use CEHRT
- The request must go through the payer’s Prior Authorization API
- The request must be for a medical item or service (not a prescription drug)
- At least one qualifying request must occur during the 2027 performance period
A practice that handles prior authorizations by phone or fax — even through the EHR — does not qualify unless the request routes through the payer’s API. The distinction is technical, not philosophical, and it is worth confirming with the EHR vendor before the performance year begins.
EPA TIMELINE — DO NOT CONFUSE THESE
2027
Optional — 10 bonus points
Medical items and services only. No negative consequence for skipping it.
2028
Required and unscored + new drug measure
Medical item/service ePA becomes required. Separate prescription-drug ePA measure also begins.
Is a security risk analysis still required in 2027?
Yes — but not as a MIPS PI measure.
The HIPAA Security Rule independently requires covered entities to conduct a security risk analysis. CMS removed the MIPS-specific SRA reporting or attestation task. The underlying HIPAA obligation remains entirely intact.
The correct statement is: “SRA is no longer a MIPS measure for 2027.”
The incorrect statement is: “Clinicians no longer need a security risk assessment.”
For practices that treated the MIPS SRA attestation as their only trigger for conducting a security risk analysis, the 2027 change creates an internal process gap. The annual review still needs to happen. It just no longer generates a MIPS checkbox.
Removing the reminder does not remove the requirement — and the HIPAA enforcement side does not care whether MIPS asked about it.
Who qualifies for PI reweighting or an exception?
Some clinicians receive automatic PI reweighting based on their status. Others can apply for a hardship exception. CMS identifies several circumstances that may qualify:
- ASC-based clinicians
- Hospital-based clinicians
- Non-patient-facing clinicians
- Small practices (15 or fewer clinicians)
Small practices may be automatically reweighted but can still choose to submit PI data.
Submitting data can affect that reweighting — which means a small practice that reports PI without understanding the scoring implications may end up worse off than one that stayed reweighted.
Measure-level exclusions and category reweighting are distinct. An exclusion applies to a particular measure when its criteria are met.
It should not be treated as a blanket pass from all PI requirements. Confirm the clinician’s QPP status and the final 2027 measure specifications before advising that an exclusion applies.
What should practices prepare for the 2027 PI submission?
The 2027 reporting period requires at least 180 continuous days using CEHRT. A clinician may report for a longer period, including the full calendar year.
PI generally carries 25% of the MIPS final score, though special status or hardship exceptions can change that weight.
Practical preparation comes down to five moves:
Separate MIPS and HIPAA Requirements
Remove the MIPS-specific SRA attestation from 2027 PI workflows, but keep the HIPAA Security Risk Analysis on the practice’s compliance calendar.
Check ePA Bonus Eligibility
Before the performance year begins, confirm that the practice’s EHR and payer connections meet the electronic prior authorization (ePA) bonus criteria.
Validate the HIE Pathway
Make sure the selected Health Information Exchange (HIE) pathway reflects the data the EHR actually sends and receives.
Review 2027 Measure Specifications
Check the final 2027 specifications for every required measure. General QPP website guidance may not yet reflect the final rule.
Maintain Complete Reporting Evidence
Keep records of the reporting period, CEHRT use, submitted values, active-engagement status, and the basis for any exclusions or reweighting.
The CMS QPP submission deadline for 2027 performance data will follow the usual schedule (early in 2028), but the exact date should be confirmed when CMS publishes the 2028 submission instructions.
Your PI data feeds your public profile — make sure the claims behind it are clean
PI scoring depends on accurate measure reporting, which depends on clean billing workflows and properly configured EHR systems. A missed measure or an incorrect attestation does not just affect your MIPS score — it can ripple into public-facing data on Care Compare.
MedHeave works inside your practice’s EHR and billing systems to catch errors before they become reporting problems.
- Weekly charges-and-payments reporting to surface issues early
- Claim submission within 24-48 hours with coding accuracy reviews
- Dedicated account managers (two per client) for direct communication
- Denial management with 72-hour response windows and 80%+ overturn rate
- Credentialing and enrollment maintenance to prevent gaps in provider reporting eligibility
Frequently asked questions
Here are some commonly asked questions about this topic:
No. CMS removed the MIPS PI reporting requirement — the attestation checkbox — not the underlying HIPAA Security Rule obligation. Covered entities must still conduct a security risk analysis under HIPAA. The practical change is that MIPS no longer asks about it during PI submission. Practices should keep the security risk analysis on their compliance calendar and document it separately from MIPS workflows.
The ePA measure for medical items and services is optional in 2027 and offers up to 10 bonus points for a qualifying “Yes” response. A missing or “No” response does not create a negative scoring consequence. The measure becomes required (and unscored) beginning in the 2028 performance period. A separate prescription-drug ePA measure also starts in 2028 — that is not a 2027 requirement.
CMS requires at least 180 continuous days during the 2027 calendar-year performance period. A clinician may choose to report for a longer period, up to the full year. The reporting period must use certified EHR technology (CEHRT). The 180-day minimum has been the standard for multiple MIPS years, and it carries forward into 2027 without modification.
No. The 2027 bonus is limited to electronic prior authorization for medical items and services — imaging, surgeries, DME, and similar covered items. Prescription-drug prior authorization falls under a separate ePA measure that CMS adds to the HIE objective beginning in the 2028 performance period. Reporting a prescription-drug ePA request against the 2027 medical-item/service bonus would be a submission error.
CMS offers three options for the 30-point HIE requirement. The referral-loops pathway (Sending + Receiving/Reconciling at 15 points each) works for practices with standard EHR referral capabilities. The bidirectional exchange pathway (30 points) suits organizations with established health information exchange connections. The TEFCA pathway (30 points) applies to practices connected through the Trusted Exchange Framework. The right choice depends on what the EHR and existing interoperability infrastructure actually support.
