Reopening of 2023 MIPS EUC Application in Response to Change Healthcare Cyberattack

In response to the Change Healthcare cyberattack in late February, the Centers for Medicare & Medicaid Services (CMS) extended the data submission deadline and is now reopening the 2023 Merit-based Incentive Payment System (MIPS) Extreme and Uncontrollable Circumstances (EUC) Exception Application to provide relief to MIPS eligible clinicians impacted by this cybersecurity incident. The application will be open for the remainder of the extended data submission period, which closes April 15, 2024, at 8 p.m. ET.

IMPORTANT: Because CMS is reopening the 2023 MIPS EUC Exception Application window in response to the Change Healthcare cyberattack, CMS will only approve applications citing this cyberattack as the basis for requesting reweighting under the MIPS EUC Exception. Any applications submitted for reasons outside of the Change Healthcare cyberattack will be denied. Additionally, any data submitted to CMS will override your application for those performance categories.

This announcement includes details about the following information:

2023 MIPS Data Submission Deadline
Who Can Submit a 2023 MIPS EUC Exception Application?
What If We’ve Already Submitted Some Data?
How Do I Apply?
Additional Resources

2023 MIPS Submission Deadline Extended: Submit 2023 Data by April 15, 2024

On March 11, 2024, CMS announced that it extended the 2023 MIPS data submission period and MIPS eligible clinicians can submit and update their data until 8 p.m. ET on April 15, 2024. We encourage those who were not impacted, or may have only been slightly impacted, to submit their data as early as possible in advance of this extended deadline.

Who Can Submit a 2023 MIPS EUC Exception Application?

Individual MIPS eligible clinicians, groups, virtual groups, and Alternative Payment Model (APM) Entities participating in MIPS (including Shared Savings Program Accountable Care Organizations) who anticipate being unable to submit data for the 2023 performance year, or complete their data submission, before the extended deadline because of the Change Healthcare cyberattack can submit a 2023 MIPS EUC Exception Application until 8 p.m. ET on April 15, 2024. They can submit an application to request reweighting for any or all MIPS performance categories.

For example:

You’re a solo practitioner or small practice that does your own billing and submits your own MIPS data, but you’ve had to focus your administrative resources on the numerous workarounds required to get your current claims submitted.
You’ve hired a third-party intermediary to support your data submission, but they’re engaged in the critical work of redirecting claims and remittance through other clearinghouses so that their clients can stay financially solvent.

The MIPS EUC Exception application for the 2023 performance year will be open for the remainder of the data submission period, and will close on April 15, 2024, at 8 p.m. ET.

What If We’ve Already Submitted Some Data?

In accordance with our MIPS EUC policies for individuals, groups, and virtual groups, we won’t reweight any performance category for which we’ve received data.

However, if 3 of the performance categories are reweighted to 0% and only one performance category can be scored (e.g., because the MIPS eligible clinician, group, or virtual group submitted data for that category), then the MIPS eligible clinician, group, or virtual group will earn a final score equal to the performance threshold and the MIPS eligible clinician(s) will receive a neutral payment adjustment.

For example:

A MIPS eligible clinician in a small practice reported Medicare Part B claims quality measures during the performance period, resulting in a quality score. Because we’ve received data, we won’t reweight the quality performance category.
If the other 3 performance categories were approved for reweighting to 0% (and no data was submitted for the improvement activities or Promoting Interoperability categories), the quality performance category would be weighted at 100% of the final score, resulting in a final score of 75 points (the performance threshold).

In accordance with our MIPS EUC policies for APM Entities, data submission for an APM Entity won’t override performance category reweighting. If approved, the MIPS eligible clinicians in the APM Entity will receive a score equal to the performance threshold and a neutral MIPS payment adjustment in the 2025 payment year unless the MIPS eligible clinicians had a higher final score (for the same TIN/NPI combination) from individual or group participation.

How Do I Apply?

Sign in to the QPP website.
Select ‘Exceptions Applications’ on the left-hand navigation.
Select ‘Add New Exception’.
Select ‘Extreme and Uncontrollable Circumstances Exception’.
Complete the application.
- You MUST select “Ransom/Malware” as the Event Type and include “Change Healthcare cyberattack” in the Event Description.
Reminder: Any applications submitted for reasons outside of the Change Healthcare cyberattack will be denied.

Applications are reviewed and processed on a rolling basis.

Don’t wait for the April 15th deadline if the Change Healthcare cyberattack is currently preventing you from submitting data, or if you anticipate that it might.

If your application is approved, you can still submit data should circumstances change before the submission deadline.

Additional Resources

For More Information on the MIPS EUC Exception Application:

Review the 2023 MIPS Extreme and Uncontrollable Circumstances Exception Application Guide (PDF, 1MB).

For More Information on the Change Healthcare Cyberattack:

For More Information on PY2023 MIPS Data Submission

The following submission resources are available on the QPP Resource Library: