You have eight days. The CMS submission window for the 2025 MIPS performance year closes March 31, 2026, and somewhere in your practice right now, someone is pushing quality measures data out of the EHR into a registry portal, a payer spreadsheet, or a vendor's SFTP folder. That export is a disclosure of protected health information. It is governed by the same rules as a records request from an attorney or a fax to a specialist.

This guide covers the operational mechanics — who does what, on what schedule, with what documentation — and then makes the privacy, records-handling, and vendor obligations explicit. It is written for practice administrators, billing leads, and privacy officers. None of it is clinical guidance, and none of it tells you which code fits a given encounter.

Four Submission Paths, Four Different PHI Footprints

How your clinicians report determines how much PHI leaves your building and who touches it. Map this before you renew a single contract.

Medicare Part B claims measures

Numerator data rides along on claims you already submit. No new vendor, no new disclosure channel, minimal added footprint. The tradeoff is limited measure availability and the fact that your clearinghouse relationship is already a business associate relationship you should have papered years ago.

eCQMs pulled from certified EHR technology

Your EHR generates QRDA files. Depending on your setup, either your practice uploads them directly to the CMS portal or your EHR vendor transmits on your behalf. If the vendor transmits, that is a business associate function, and your agreement needs to say so.

MIPS CQMs through a qualified registry or QCDR

This is the heaviest footprint. Registries typically ingest broad clinical extracts — problem lists, medications, labs, vitals, encounter history — because they calculate measures rather than receive finished results. A registry acting on your behalf is a business associate, full stop.

CAHPS and survey vendors

You hand over patient names, contact information, and encounter dates so a vendor can field a survey. That is PHI, transmitted for your health care operations, and it needs the same contractual controls as anything else.

Practices reporting through an ACO or the APM Performance Pathway carry an extra wrinkle: those pathways generally require all-payer, all-patient reporting for the measures in scope. Your commercial, Medicaid, and self-pay patients' data leaves the building too, even though the program is a Medicare program. Your Notice of Privacy Practices and your internal data-flow inventory should reflect that reality.

Do You Need a BAA With a Quality Registry? A Direct Answer

Yes, in almost every case. If a registry, QCDR, analytics platform, or survey vendor receives identifiable patient data to calculate, validate, or submit quality measures on your behalf, it is performing a function for your practice using PHI. That makes it a business associate under 45 CFR 160.103, and you need a signed Business Associate Agreement before the first file transfer.

Three narrow exceptions worth knowing:

  • CMS as a program administrator. Submitting to CMS under a federal quality program does not require a BAA with CMS.
  • Public health registries. Reporting to a state immunization registry or cancer registry operating as a public health authority falls under 45 CFR 164.512(b), not the business associate framework — though many states impose their own conditions.
  • A health plan's own quality activity. Disclosing to a plan that also has a relationship with the patient, for the plan's quality assessment, is permitted under 45 CFR 164.506(c)(4). The plan is not your business associate. It is a covered entity using the disclosure for its own operations.

Everything else — the vendor that scrapes your charts to build a dashboard, the consultant who abstracts records for gap closure, the platform that hosts your measure workbooks — needs paper. If you are looking at a vendor list with blank spaces in the BAA column, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, and faster than waiting three weeks for a vendor's legal team to send a template you will have to redline anyway.

The Chart Chase: When a Plan Asks for Forty Charts in April

Every spring, a health plan or its abstraction vendor contacts your office and asks for records on a list of patients. HEDIS-style hybrid measures require chart review, and the plan has a legitimate basis for the request. What goes wrong is the response, not the request.

The failure pattern is consistent: front desk or medical records receives a spreadsheet of forty patients, someone prints or exports the complete chart for each one, and it all goes out by fax or an unverified email address. Ten years of psychiatric notes travel to a vendor that needed a single hemoglobin A1c value and a date.

Build a standing chart-chase protocol and assign it to a named person:

  1. Verify the requester. Confirm the vendor is contracted with the plan and acting on the plan's behalf. Ask for the plan's authorization letter naming the vendor. Keep it.
  2. Confirm the patients are the plan's members. The 164.506(c)(4) pathway depends on both entities having a relationship with the individual. If a name on the list is not that plan's patient, do not send it.
  3. Scope the request to the measure. Ask which measure and which data elements. Send the relevant results, dates, and documentation — not the full longitudinal record.
  4. Screen for restricted content. Part 2 substance use disorder records, state-protected mental health notes, HIV status, and minor-consent records often require separate handling. Flag these before release, not after.
  5. Log it. Date, requester, patient count, measure, data elements sent, transmission method, staff member.

That log is not an accounting-of-disclosures obligation — treatment, payment, and health care operations disclosures are excluded under 45 CFR 164.528. Keep it anyway. When a patient calls in June asking who saw their chart, the log is the difference between a two-minute answer and a two-week investigation.

Minimum Necessary Applies to Quality Measures, Too

The minimum necessary standard covers disclosures for health care operations. Quality reporting is health care operations. There is no carve-out for "we were improving care."

In practice, this means auditing what your registry actually ingests. Many vendors default to a full-table extract because it is easier to build one pipe than twelve. Ask the implementation team a specific question: which fields does the measure calculation require, and which fields are you pulling that it does not require? Then ask them to turn off the rest in writing.

Where a vendor is doing benchmarking or population analysis rather than submission, push toward a limited data set or a de-identified feed. If the vendor insists on full identifiers for work that does not require them, that is a signal about what they intend to do with the data.

Where Your Numerator Data Actually Lives

Ask your quality lead to show you the tracking file. Nine times out of ten it is a spreadsheet with patient names, MRNs, and gap status, and it lives in one of these places:

  • A personal cloud drive, because the shared drive was slow
  • An email thread with six people on it and one external consultant
  • A laptop that goes home nightly
  • A free project-management tool nobody has a BAA with

That is shadow PHI, and it is invisible to your Security Rule risk analysis unless you go looking. Inventory it. Move it inside sanctioned systems. If the tool is genuinely useful, get a BAA or replace it. Your risk analysis and policy set should name every location where measure-tracking PHI sits, including the ones that embarrass you.

OCR's proposed Security Rule update, published in early 2025, would push covered entities toward far more rigorous asset inventories and network mapping. Watch that rulemaking. Practices that already know where their data lives will absorb the change without drama.

Coding and Documentation Mechanics: An Administrative Walkthrough

Measure performance depends on structured data that someone has to enter. Claims-based measures frequently rely on CPT Category II codes to signal numerator compliance; eCQMs read from discrete EHR fields, value sets, and coded results. Free-text narrative in a note does not count toward a measure, no matter how thorough it is.

Your administrative job is process, not clinical judgment. Practices typically:

  • Pull the current-year measure specifications from CMS and the eCQI Resource Center, and rebuild the internal crosswalk annually because value sets change
  • Confirm that documentation supports whatever is submitted — the clinician documents, the coder maps, and nobody adds a code the record does not support
  • Run monthly measure reports rather than discovering in March that a template field was never turned on
  • Track the data completeness requirement, which CMS has held at 75% of eligible instances for MIPS quality, so a partially populated measure does not score as intended
  • Keep a retrievable audit file: submission confirmations, measure specifications used, and the reports supporting each number, held for the CMS look-back period

Never let gap-closure pressure become documentation pressure. If a workflow rewards entering a code before the service is performed and documented, you have built a false claims problem and layered a records-integrity problem on top of it.

A Twelve-Month Calendar With Names Attached

January through March. Practice administrator owns the submission window for the prior performance year. Verify each clinician's participation status, confirm the registry actually transmitted, download and file confirmation receipts before March 31.

April through June. Privacy officer owns chart-chase season. Run the verification protocol on every payer and abstraction-vendor request. Reconcile requesters against your BAA list.

July through September. Quality lead reviews current-year measure performance at the halfway mark and confirms field-level capture. Administrator reviews hardship-exception eligibility if a system outage, ransomware event, or disaster disrupted data capture.

October through December. Contract owner reviews every quality-related vendor agreement before auto-renewal. Compare the data actually flowing to the data the contract authorizes. Confirm subcontractor flow-down and breach-notification terms.

Five Vendor Contract Clauses to Strike Before You Sign

Read the vendor's master services agreement alongside the BAA. The permissive language usually sits in the MSA.

  • Secondary-use rights. "Vendor may use de-identified data for product development and benchmarking" turns your patient population into someone else's commercial asset. Decide deliberately; do not inherit it.
  • Perpetual license. A license that survives termination means your data never leaves. Require return or certified destruction with a deadline.
  • Vague breach notice. "Promptly" and "as soon as practicable" are not deadlines. Name a number of days that lets you meet your own 60-day obligation.
  • Silent subcontractors. Registries use offshore abstraction help and cloud infrastructure. Require written flow-down and the right to a subprocessor list.
  • Unilateral scope changes. If the vendor can expand the data feed by updating documentation, your minimum-necessary analysis is worthless.

HHS maintains plain-language guidance on business associate obligations. Hand it to a vendor that argues it does not need an agreement because it "only handles quality data."

Do This Before March 31

Pull your vendor list. Mark every entity that touched patient data for quality measures in the last twelve months — registry, EHR, survey vendor, consultant, abstraction firm, spreadsheet host. Any row without a current signed BAA is your priority.

If you find gaps, close them this week: build the agreement through the BAA wizard, export it as a PDF or DOCX, and get it signed before the next data transfer. It is a one-time purchase, and it costs less than the hour you would spend drafting one from scratch.