Medicare and Medicaid Programs; CY 2026 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Shared Savings Program Requirements; and Medicare Prescription Drug Inflation Rebate Program

In the CY 2026 PFS proposed rule (90 FR 32682), we stated that the CAHPS for MIPS Survey is an annual survey available to MIPS groups in Traditional MIPS and MIPS Value Pathways (MVPs), and APM Entities. As required at Sec. 425.510(b)(2), for performance years beginning on or after January 1, 2025, ACOs must report quality data on the APP Plus quality measure set established under Sec. 414.1367 according to the method of submission established by CMS. The CAHPS for MIPS Survey is a quality measure in the APP Plus quality measure set (89 FR 98367 through 98371). Therefore, Shared Savings Program ACOs are required to administer the CAHPS for MIPS Survey (except if an ACO does not meet the required sample size specified at Sec. 414.1380(b)(1)(vii)(B)) to meet the quality reporting requirement under the Shared Savings Program. We stated that as of the CY 2026 PFS proposed rule, data was collected using a mail-phone survey administration protocol administered in English and Spanish, with additional translations available. We noted that the CAHPS for MIPS Survey may only be administered by CMS-approved survey vendors.

In the CY 2025 PFS proposed rule (89 FR 61869, 62042, and 62043), we included a request for information (RFI) on the potential expansion of the survey modes of the CAHPS for MIPS Survey from a mail-phone protocol to a web-mail-phone protocol. We solicited public comment on this new protocol given the positive results found from our 2023 CAHPS for MIPS Web Mode Field Test. The field test added the web-based survey mode to the current mail-phone protocol of CAHPS for MIPS Survey administration, and we found that the addition resulted in an increased response rate (89 FR 62043). Commenters widely supported an expansion of CAHPS for MIPS Survey modes to include a web-based survey protocol, emphasizing that this could help increase response rates. (2) Revisions

In the CY 2026 PFS proposed rule (90 FR 32682), we stated that based on the results of the field test, and informed by the responses from commenters in response to our RFI, we proposed to require that beginning with 2027, CMS-approved survey vendors would have to administer the CAHPS for MIPS Survey via a web-mail-phone protocol. Additionally, under this proposal and pursuant to the policy we finalized in the CY 2025 PFS final rule to require, beginning with the 2026 performance period/2028 MIPS payment year, CMS-approved survey vendors to submit the range of costs of their services (89 FR 98459 and 98460), the cost of adding the web survey mode would be included as part of the overall costs of CAHPS for MIPS Survey administration publicly reported by vendors. We referred readers to the CY 2026 PFS proposed rule (90 FR 32768 and 32769) for additional information on this proposal.

We refer readers to section XXX of this final rule, where we are finalizing as proposed our proposal to require that beginning with 2027, CMS-approved survey vendors would have to administer the CAHPS for MIPS Survey via a web-mail-phone protocol. f. Summary of Final Policies

In Tables 52 and 53 of the CY 2026 PFS proposed rule, we summarized the quality reporting requirements and quality performance standard policies for performance year 2025 and subsequent performance years, including our proposals in the CY 2026 PFS proposed rule.

In Tables B-G6 and B-G7 of this final rule, we summarize the quality reporting requirements and quality performance standard policies for performance year 2025 and subsequent performance years, including the policies we are finalizing in this final rule. Table B-G7 also reflects the removal of Quality ID: 487 Social Drivers of Health from the APP Plus quality measure set for Shared Savings Program ACOs, as discussed in section III.F.6.d. of this final rule, for performance year 2028 or the performance year that is 1 year after the eCQM specification becomes available for Quality ID: 493, whichever is later. These tables are same as Tables 52 and 53 of the CY 2026 PFS proposed rule (90 FR 32683 through 32685). [GRAPHIC] [TIFF OMITTED] TR05NO25.125

[GRAPHIC] [TIFF OMITTED] TR05NO25.126

[GRAPHIC] [TIFF OMITTED] TR05NO25.127

[GRAPHIC] [TIFF OMITTED] TR05NO25.128

In the CY 2026 PFS proposed rule (90 FR 32684), we discussed that as stated in the CY 2025 PFS final rule (89 FR 98106), CMS aims to fully transition to digital quality measurement (dQM) in CMS quality reporting and value-based purchasing programs. Including eCQMs as a collection type for Shared Savings Program ACOs reporting the APP Plus quality measure set aligns with our goal to transition to digital quality measurement, including the alignment and development of Fast Healthcare Interoperability Resources[supreg] (FHIR[supreg]) standards and tools for eCQM reporting.

In support of these goals, we directed interested parties to the CY 2026 PFS proposed rule (90 FR 32710-32715), which contains a Request for Information (RFI) to gather public input on the transition to dQM for CMS programs and on our anticipated approach on the use of FHIR[supreg] standards in eCQM reporting. In that section, we described the current state and requested input on key components of the ongoing dQM transition related to FHIR[supreg]-based eCQMs for the Shared Savings Program and the MIPS quality performance category. These components include: (1) FHIR[supreg]-based eCQM conversion progress; (2) Data standardization for quality measurement and reporting; (3) The timeline under consideration for FHIR[supreg]-based eCQM reporting; (4) Measure development and reporting tools; and (5) FHIR[supreg] Reporting and Data Aggregation for ACOs.

We refer readers to section XXX of this final rule. 7. Revisions to the Extreme and Uncontrollable Circumstances Policies To Determine Quality and Financial Performance a. Overview

In the CY 2026 PFS proposed rule (90 FR 32685 and 32686), we stated that in the interim final rule with comment period (IFC) entitled “Medicare Program; Medicare Shared Savings Program: Extreme and Uncontrollable Circumstances Policies for Performance Year 2017”, which appeared in the December 26, 2017 Federal Register (82 FR 60912 through 60919) (herein referred to as the “December 2017 IFC”), we established automatic extreme and uncontrollable circumstances (EUC) policies under the Shared Savings Program for performance year 2017 due to the urgency of providing relief to ACOs impacted by natural disasters (Hurricanes Harvey, Irma, and Maria, and California wildfires). We agreed with interested parties that the financial and quality performance of ACOs located in areas subject to EUCs could be significantly and adversely affected. For example, natural disasters may affect the infrastructure of ACO participants, ACO providers/ suppliers, and potentially the ACO legal entity itself, thereby disrupting routine operations related to their participation in the Shared Savings Program and achievement of program goals (82 FR 60913). We stated that these disruptions could hinder quality performance in ACOs and thus could result in shared losses for which the ACO might be held responsible (82 FR 60914).

Since their establishment, we have revised our EUC policies and expanded them in response to PHEs, to determine the duration of the PHE and the percentage of ACOs' performance year assigned beneficiary populations that were EUC-affected (83 FR 68037), and to specify policies for addressing the effect of EUCs on ACOs' quality performance (85 FR 27576 and 27577; 85 FR 84746).

The current Shared Savings Program quality and finance EUC policies at Sec. Sec. 425.512(c), 425.605(f), and 425.610(i) have been for ACOs affected by natural disasters or PHEs as determined by the Quality Payment Program; however, current policies do not unambiguously address ACOs affected by an EUC due to a cyberattack, including ransomware/ malware.

Cyberattacks, including ransomware/malware, can be circumstances that are outside of the ACO's control and may have several possible effects on our ability to accurately and effectively measure ACOs' quality performance. For instance, a breach of confidential medical records of beneficiaries may make it difficult for ACOs to access medical record data required for quality reporting. Cyberattacks could inhibit the operation of EHR systems and thus render data submitted by ACOs inaccurate and unusable; failure to report quality data that comes from EHR systems could cause ACOs to fail the Shared Savings Program's quality reporting requirements and, therefore, fail to meet the quality performance standard. Further, for ACOs impacted by ransomware/malware, the medical records needed for quality reporting may be inaccessible. Effects due to cyberattacks, including ransomware/malware, on ACO participants and their beneficiary populations could impact the ACO's ability to successfully meet the Shared Savings Program quality performance standard.

Currently the Shared Savings Program's EUC policies regarding calculation of the ACO's quality performance score and mitigating shared losses for ACOs participating

under a two-sided model are aligned with the Quality Payment Program's automatic EUC policy, to account for natural disasters and other extreme and uncontrollable circumstances that impact an entire region or locale. We believe that there is a need to revise the quality and finance EUC policies to plainly account for an ACO affected at the legal entity level by an EUC due to a cyberattack, including ransomware/malware, where such a determination is made by the Quality Payment Program through the MIPS EUC Exception application process. b. Revisions to the EUC Policy To Determine Quality Performance (1) Background

In the CY 2026 PFS proposed rule (90 FR 32686), we stated that the current Shared Savings Program quality EUC policies are codified in the regulation at Sec. 425.512(c). These policies were described in the December 2017 IFC (82 FR 60912 through 60919), March 31, 2020 COVID-19 IFC (85 FR 19267 through 19268), CY 2021 PFS final rule (85 FR 84744 through 84747), and CY 2023 PFS final rule (87 FR 69857 through 69858). In the CY 2021 PFS final rule (85 FR 84744 through 84747),we established at Sec. 425.512(c) that, for performance year 2021 and subsequent performance years, including the applicable quality data reporting period for the performance year, we use an alternative approach to calculating the quality score, as described at Sec. 425.512(c), for ACOs affected by EUCs, instead of using the approach as described at Sec. 425.512(a). We determine the ACO was affected by an EUC based on either of the following:

Twenty percent or more of the ACO's assigned beneficiaries reside in an area identified under the Quality Payment Program as being affected by an EUC.

The ACO's legal entity is located in an area identified under the Quality Payment Program as being affected by an EUC.

As we established in the CY 2022 PFS final rule (86 FR 65271 and 65272), if CMS determines the ACO meets these requirements, then CMS calculates the ACO's quality score based on the following: For performance year 2024 and subsequent performance years, the ACO's minimum quality performance score is set to the equivalent of the 40th percentile MIPS quality performance category score across all MIPS quality performance category scores, excluding entities/providers eligible for facility-based scoring, for the relevant performance year (Sec. 425.512(c)(2)(ii)).

Further, as stated in Sec. 425.512(c)(3)(iv), if the ACO reports quality data on the APP Plus quality measure set, then CMS calculates the ACO's quality score based on the following: For performance year 2025 and subsequent performance years, if the ACO reports the APP Plus quality measure set and meets the data completeness requirement at Sec. 414.1340 and receives a MIPS quality performance category score, then CMS will use the higher of the ACO's quality performance score or the equivalent of the 40th percentile MIPS quality performance category score across all MIPS quality performance category scores, excluding entities/providers eligible for facility-based scoring, for the relevant performance year.

At Sec. 425.512(c)(4), CMS applies determinations made under the Quality Payment Program with respect to--

Whether an EUC has occurred; and

The affected areas.

At Sec. 425.512(c)(5), CMS has sole discretion to determine the time period during which an EUC occurred, the percentage of the ACO's assigned beneficiaries residing in the affected areas, and the location of the ACO legal entity. (2) Revisions

In the CY 2026 PFS proposed rule (90 FR 32686 through 32688), we proposed that, for performance year 2025 and subsequent performance years, we would expand the application of the quality and finance EUC policies to an ACO, as defined at Sec. 425.20, and as an APM Entity as defined at Sec. 414.1305, that is affected by an EUC due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program. Specifically, we proposed to add Sec. 425.512(c)(1)(iii) to state: For performance year 2025 and subsequent performance years, the ACO, as defined at Sec. 425.20, is affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program.

We proposed that if an ACO is affected at the legal entity level (as the term is commonly used throughout 42 CFR part 425) by an EUC due to a cyberattack, including ransomware/malware, and wants relief from Shared Savings Program quality reporting requirements, then the ACO must submit a MIPS EUC Exception application to the Quality Payment Program as an APM Entity for the affected performance year. If the Quality Payment Program approves an ACO's MIPS EUC Exception application, as an APM Entity, for a cyberattack, including ransomware/ malware, for the affected performance year, then we would apply the Shared Savings Program quality and finance EUC policies at Sec. Sec. 425.512(c), 425.605(f), and 425.610(i) to provide relief to the ACO from the Shared Savings Program quality reporting requirements and mitigate shared losses for the affected performance year. Under our proposal, the Shared Savings Program would not apply the quality and finance EUC policies to an ACO that submits a MIPS EUC Exception application as an individual, group, or virtual group.

For information on how to submit a MIPS EUC Exception application for performance year 2025, ACOs can refer to the Quality Payment Program Exception Application website (https://qpp.cms.gov/mips/exception-applications?py=2025) and 2025 MIPS EUC Exception Guide (https://qpp-cm-prod-content.s3.amazonaws.com/uploads/3239/2025-MIPS-Extreme-and-Uncontrollable-Circumstances-Exception-Application-Guide.pdf).

Under our proposal, in alignment with Sec. 425.512(c)(3)(iv), beginning in performance year 2025, if an ACO with an approved MIPS EUC Exception application for a cyberattack, including ransomware/malware, reports the APP Plus quality measure set, meets the data completeness requirement at Sec. 414.1340, and receives a MIPS quality performance category score, then we would use the higher of the ACO's quality score or the equivalent of the 40th percentile MIPS quality performance category score across all MIPS quality performance category scores, excluding entities/providers eligible for facility-based scoring, for the relevant performance year. Under our proposal, in alignment with Sec. 425.512(c)(2)(ii), if CMS determines the ACO meets the requirements of Sec. 425.512(c)(1), then the ACO's minimum quality performance score would be set to the equivalent of the 40th percentile MIPS quality performance category score, excluding entities/providers eligible for facility-based scoring, for the relevant performance year. This proposal would allow an ACO affected by a cyberattack, including ransomware/malware, as determined by the Quality Payment Program, to meet the Shared Savings Program quality performance standard for sharing in savings at the maximum rate under its track and to have any shared losses pro-rated based on the length of the cyberattack, including ransomware/malware, as described in the CY 2026 PFS proposed rule (90 FR 32688 through 32690).

In the CY 2026 PFS proposed rule (90 FR 32687), we stated that section 1871(e)(1)(A)(ii) of the Act prohibits the Secretary from applying substantive changes in regulations retroactively before the effective date of the change except where the Secretary determines, as relevant here, that failure to apply the change retroactively would be contrary to the public interest. We are aware that cyberattacks, including ransomware/malware, have increased in recent years. It is in the public interest to revise the Shared Savings Program quality and finance EUC policies (the latter of which we discussed in the CY 2026 PFS proposed rule (90 FR 32688 through 32690)) to expand the application of these policies to an ACO at the legal entity level that is affected by an EUC due to a cyberattack, including ransomware/ malware, beginning in performance year 2025. Because ACOs rely heavily on digital infrastructure and third-party vendors, they are increasingly vulnerable to ransomware, data breaches, and system outages. Cyberattacks, including ransomware/malware, can severely disrupt care coordination, compromise patient data, and disrupt the patient care environment. These disruptions can delay necessary treatments or procedures and reduce the quality of care provided to beneficiaries. We have heard from ACOs that have experienced cyberattacks about the adverse impact on clinical processes. For example, we have heard from ACOs that as a result of a cyberattack, impacted systems were unavailable and manual processes were implemented, including moving to paper records for certain clinical processes in order to continue to provide patient care. For these reasons, we understand that cyberattacks can disrupt the patient care environment, and we want ACOs to be able to continue to prioritize patient care during and in the aftermath of a cyberattack. As such, we believe that it is in the public interest to provide relief from the Shared Savings Program quality reporting requirements and by mitigating shared losses to any ACO that has an approved MIPS EUC Exception application due to cyberattack during performance year 2025 so that those ACOs can prioritize patient care during and in the aftermath of a cyberattack.

A cyberattack could interfere with the operation of electronic health record systems, affect the integrity of the data used to meet quality reporting requirements, and as a result render ACOs unable to report data that is true, accurate, and complete. Failure to meet the quality performance standard could result in an ACO owing maximum shared losses through no fault of the ACO. If the result of a cyberattack is that an ACO cannot satisfactorily meet the quality performance standard, then the ACO may not receive funds they could otherwise use to reinvest into the ACO and continue to improve the quality of care provided. Therefore, should any ACOs experience a cyberattack during 2025, we do not believe it is in the best interest of an ACO's patient population to disadvantage an ACO from earning shared savings (or for an ACO to incur shared losses) as a result of a disruption caused by a cyberattack.

Additionally, a cyberattack could contribute to unpredictable changes to utilization and spending that may have an impact on expenditures for the applicable performance year beyond the ACO's control. The impact of cyberattacks on physician practices were underscored in a 2024 survey conducted by the American Medical Association, with 90% of respondents at the time of the survey noting that they continued to lose revenue from unpaid claims, 63% noted that they were losing revenue due to the inability to charge patient co-pays or remaining obligations, and 91% had to commit additional staff time and resources to complete revenue cycle tasks.\416\ Additionally, 42 percent of respondents were unable to purchase supplies, 29 percent of respondents were reliant upon private bank loans to fund their practice operations, 42 percent of respondents noted patients were unable to access coverage and cost information, and 25 percent shared that patients at the time of the survey continued to face difficulties getting their prescriptions filled.\417\ These examples illustrate how a cyberattack could impact clinical processes that could contribute to unpredictable utilization and spending. This unpredictable utilization could further skew the results of the data used for quality reporting and assessing whether ACOs met the quality performance standard. Coupled with the previously mentioned impact to data integrity due to the possible need to use paper records to collect and submit quality data, cyberattacks could cause ACOs to submit quality data that is not a true, accurate, and complete reflection of their quality performance.

\416\ American Medical Association (2024). Change Healthcare cyberattack impact: Key takeaways from informal AMA follow-up survey, available at https://www.ama-assn.org/system/files/change-healthcare-follow-up-survey-results.pdf.

\417\ Ibid.

If cyberattacks occur during performance year 2025 and subsequent performance years, we do not wish to hold ACOs who are experiencing extreme and uncontrollable circumstances accountable to a quality performance standard that could be based on inaccurate assessment of their beneficiaries' utilization of care and to apply the Shared Savings Program finance EUC policies Sec. Sec. 425.605(f), and 425.610(i) to 100 percent of the ACO's assigned beneficiaries when an ACO has a MIPS EUC Exception application for a cyberattack, including ransomware/malware. Thus, we believe it is in the public interest to grant ACOs who have an approved MIPS EUC application relief from the Shared Savings Program quality performance standard so that the standard is accurately assessed and ACOs are not held accountable to an inaccurate assessment of the quality of care they provide based on potentially skewed health care utilization as the result of a cyberattack and to provide relief to the ACO by mitigating shared losses for the affected performance year. Our proposal would grant relief to ACOs that submit a MIPS EUC Exception application to the Quality Payment Program for a cyberattack, including ransomware/ malware, and for which the Quality Payment Program approves the ACO's MIPS EUC Exception application.

We proposed the following revisions to the Shared Savings Program regulation at Sec. 425.512(b):

We proposed to revise paragraph (b)(5)(iv) (which we proposed to redesignate as paragraph (b)(4)(iv)), to remove the reference to “paragraphs (c)(3)(ii) through (c)(3)(iv)” and add in its place reference to “paragraphs (c)(3)(ii) and (c)(3)(iii)” consistent with our proposal to limit the applicability of Sec. 425.512(b) to performance years 2023 and 2024, as discussed in the CY 2026 PFS proposed rule (90 FR 32688 through 32690).

We proposed the following revisions to the Shared Savings Program quality EUC regulation at Sec. 425.512(c):

We proposed to revise paragraph (c)(1) introductory text to read as follows, “CMS determines the ACO was affected by an extreme and uncontrollable circumstance based on any of the following:”

We proposed to add a new paragraph (c)(1)(iii) to establish that for performance year 2025 and subsequent performance years, the ACO, as defined at Sec. 425.20, is affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program.

We sought public comments on the proposed changes to the quality EUC policy.

We received public comments on the proposed changes to the quality EUC policy. The following is a summary of the comments we received and our responses.

Comment: Most commenters supported our proposed changes to the quality EUC policy. Many commenters noted that our proposal provides a critical and necessary safeguard for ACOs and ensures the program accounts for modern operational realities. Commenters stated how cyberattacks are becoming increasingly prevalent against health care organizations, and these attacks interfere with ACOs' ability to comply with program requirements, such as, quality reporting. Several commenters appreciated CMS' recognition of the rapidly evolving technological environment and the fact that cyberattacks could occur regardless of whether an ACO is exercising appropriate care in securing health IT systems. A commenter expressed how given the significant operational and data integrity disruptions such events can cause, extending EUC protections in these scenarios is consistent with maintaining fair quality and financial performance assessments. Another commenter stated that this policy will help attract and retain ACO participation in the Shared Savings Program by making it easier for ACOs to recruit and retain patient populations, and to endure the challenges presented by a cyberattack.

Several commenters supported our proposal's protection of continuity of care for beneficiaries. Several commenters stated that it is not just the ACO that is victimized by a cyberattack, but an entire ecosystem of organizations, providers, and beneficiaries that come into contact with that ACO through the course of delivering healthcare. These commenters noted how offering relief during these events is critical to maintaining care continuity and protecting beneficiaries. Several other commenters stated that cyberattacks are increasingly disruptive to care delivery and data integrity, and providing relief to ACOs in these circumstances can help ensure that ACOs can continue to prioritize patient care without being unfairly penalized.

Response: We thank commenters for their support. As we stated in the CY 2026 PFS proposed rule (90 FR 32687), we are aware that cyberattacks, including ransomware/malware, have increased in recent years. Because ACOs rely heavily on digital infrastructure and third- party vendors, they are increasingly vulnerable to ransomware, data breaches, and system outages. Cyberattacks, including ransomware/ malware, can severely disrupt care coordination, compromise patient data, and disrupt the patient care environment. These disruptions can delay necessary treatments or procedures and reduce the quality of care provided to beneficiaries. We have heard from ACOs that have experienced cyberattacks about the adverse impact on clinical processes. Effects due to cyberattacks, including ransomware/malware, on ACO participants and their beneficiary populations could impact the ACO's ability to successfully meet the Shared Savings Program's quality reporting requirements and thus the quality performance standard. We agree with commenters that the proposed changes to the quality EUC policy can help ACOs maintain care continuity and prioritize patient care.

Comment: Several commenters agreed with our proposal to apply these policies beginning in performance year 2025 and stated that ACOs' reliance on digital infrastructure and third-party vendors make them increasingly vulnerable to cyberattacks, and it would not be in the best interest of an ACO's patient population to disadvantage an ACO from earning shared savings.

Response: We thank commenters for their support. In the CY 2026 PFS proposed rule (90 FR 32687), we explained our rationale for why it is in the public interest to revise the Shared Savings Program quality and finance EUC policies to expand the application of these policies to an ACO at the legal entity level that is affected by an EUC due to a cyberattack, including ransomware/malware, beginning in performance year 2025.

Comment: Several commenters supported our proposal to require that an ACO affected at the legal entity level by an EUC due to cyberattack to submit a MIPS EUC Exception application to the Quality Payment Program as an APM Entity. These commenters also supported our proposal on how quality performance would be determined under the quality EUC policy for an ACO with an approved MIPS EUC Exception application. Commenters noted that, if approved, CMS would provide relief from quality reporting requirements for the relevant performance year. The commenters stated that this approach would allow ACOs to attempt to report quality measures for the affected performance year without putting their performance in the program in jeopardy.

Response: We thank commenters for their support.

Comment: A commenter supported the proposed changes to the quality EUC policy, but stated that they do not believe that cyberattacks are uncontrollable, and that organizations can and must take the necessary steps to protect the vital and sensitive health information of the patients under their care.

Response: We agree that ACOs must take steps to protect their patients' health information, including implementing practices and systems to protect against cyberattacks, including ransomware/malware. We note that, as described at Sec. 425.700(b), CMS shares beneficiary identifiable data with ACOs on the condition that the ACO, its ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to the ACO's activities observe all relevant statutory and regulatory provisions regarding the appropriate use of data and the confidentiality and privacy of individually identifiable health information and comply with the terms of the data use agreement described in 42 CFR 425 subpart H. As we stated in the CY 2026 PFS proposed rule (90 FR 32686), we understand that there can be circumstances of cyberattacks, including ransomware/malware, that are outside of the ACO's control, which informed our proposed EUC policies.

Comment: A commenter recommended that CMS clarify the reporting process when a partial EUC is granted (that is, when an EUC is approved for an individual clinician or group). The commenter provided two alternative options for consideration. The first option would be to adjust the policy such that when any member TIN is approved for an EUC, the entire ACO is granted the EUC and is exempt from submitting data for that performance year. The second option would be to adjust the policy to allow the ACO to submit its APP Plus quality measure set data for all unaffected member TINs, such that the data from the impacted TIN would be excluded from the ACO's data completeness and performance calculations without penalty. Another commenter recommended CMS establish an option for ACO participants to file a MIPS EUC Exception application for the quality performance category at the NPI or TIN level, citing how if approved, this would remove the requirement for the ACO to report 100% of eligible patients from those EUC-approved providers, while still allowing the ACO to submit and report data for all other participants.

Response: We stated in the CY 2026 PFS proposed rule (90 FR 32686) that, if an ACO is affected at the legal entity level by an EUC due to a cyberattack,

including ransomware/malware, and wants relief from Shared Savings Program quality reporting requirements, then the ACO must submit a MIPS EUC Exception application to the Quality Payment Program as an APM Entity for the affected performance year. If the Quality Payment Program approves an ACO's MIPS EUC Exception application, as an APM Entity, for a cyberattack, including ransomware/malware, for the affected performance year, then we would apply the Shared Savings Program quality and finance EUC policies at Sec. Sec. 425.512(c), 425.605(f), and 425.610(i) to provide relief to the ACO from the Shared Savings Program quality reporting requirements and mitigate shared losses for the affected performance year. Under our proposal, the Shared Savings Program would not apply the quality and finance EUC policies to an ACO that submits a MIPS EUC Exception application as an individual, group, or virtual group. Applying an individual or group- level exemption (at the NPI or TIN level) to a policy that governs reporting at the ACO level would be inconsistent with the structure of quality reporting under the Shared Savings Program, where the ACO is required to report quality data on behalf of all of its participants. The recommendations suggested by commenters could result in applying the quality and finance EUC policies to an ACO entity that was not directly impacted by a cyberattack, including ransomware or malware.

Comment: A commenter recommended that CMS add a grace period to provide relief for quality reporting in the year the cyberattack occurs.

Response: We interpret the commenter's use of “grace period” as a request for additional time after the cyberattack occurs to submit a MIPS EUC Exception application. We do not agree with the commenter's recommendation to add a grace period to provide relief for quality reporting. The MIPS EUC Exception application for a performance year is typically available until the last day of the performance year. For example, the MIPS EUC Exception application for performance year 2025 will be available until 8 p.m. ET on December 31, 2025. This timing is intended to prevent delays in the calculation of an ACO's quality score and financial reconciliation calculations.

Comment: A commenter recommended that CMS provide clear guidance on documentation requirements and timelines for MIPS EUC Exception applications to avoid delays in relief.

Response: Updated information on documentation and timelines for MIPS EUC Exception applications for ACOs impacted by a cyberattack, including ransomware/malware, that want to submit a MIPS EUC Exception application for performance year 2025, will be available on the Quality Payment Program Exception Application website https://qpp.cms.gov/mips/exception-applications?py=2025 after the release of this final rule.

We also sought comment on whether there are other scenarios we should consider recognizing under the Shared Savings Program quality and finance EUC policies, while safeguarding against overly broad EUC policies that would allow ACOs to circumvent quality reporting requirements or avoid shared losses.

We received public comments on other scenarios that the commenters suggested we should consider recognizing under the Shared Savings Program quality and finance EUC policies.

Comment: A commenter recommended CMS expand the EUC policy to allow an ACO to request an exemption for member TINs whose clinical specialty is 100% misaligned with the required APP measures and who are unable to report on the required measures. Another commenter stated that CMS should also consider other instances where an ACO may miss a quality reporting deadline citing how good faith efforts to meet reporting deadlines by ACO's with positive compliance histories should be considered. A commenter urged CMS to continue monitoring health care developments and revise EUC policies as applicable to ensure patients receive necessary and timely care with minimal disruptions.

Response: We thank commenters for their suggestions.

We received a few comments on the proposed changes to the quality EUC policy that we consider to be out of scope and will not be addressing these comments in this final rule.

After consideration of public comments, we are finalizing the proposed changes to the quality EUC policy as proposed. For performance year 2025 and subsequent performance years, we will expand the application of the quality and finance EUC policies to an ACO, as defined at Sec. 425.20, and as an APM Entity as defined at Sec. 414.1305, that is affected by an EUC due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program. Specifically, we will add Sec. 425.512(c)(1)(iii) to state: For performance year 2025 and subsequent performance years, the ACO, as defined at Sec. 425.20, is affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program.

If an ACO is affected at the legal entity level (as the term is commonly used throughout 42 CFR part 425) by an EUC due to a cyberattack, including ransomware/malware, and wants relief from Shared Savings Program quality reporting requirements, then the ACO must submit a MIPS EUC Exception application to the Quality Payment Program as an APM Entity for the affected performance year. If the Quality Payment Program approves an ACO's MIPS EUC Exception application, as an APM Entity, for a cyberattack, including ransomware/malware, for the affected performance year, then we will apply the Shared Savings Program quality and finance EUC policies at Sec. Sec. 425.512(c), 425.605(f), and 425.610(i) to provide relief to the ACO from the Shared Savings Program quality reporting requirements and mitigate shared losses for the affected performance year. Under our final policy, the Shared Savings Program will not apply the quality and finance EUC policies to an ACO that submits a MIPS EUC Exception application as an individual, group, or virtual group.

We are finalizing that, in alignment with Sec. 425.512(c)(3)(iv), beginning in performance year 2025, if an ACO with an approved MIPS EUC Exception application for a cyberattack, including ransomware/malware, reports the APP Plus quality measure set, meets the data completeness requirement at Sec. 414.1340, and receives a MIPS quality performance category score, then we will use the higher of the ACO's quality score or the equivalent of the 40th percentile MIPS quality performance category score across all MIPS quality performance category scores, excluding entities/providers eligible for facility-based scoring, for the relevant performance year. We are finalizing that if CMS determines the ACO meets the requirements of Sec. 425.512(c)(1), then, in alignment with Sec. 425.512(c)(2)(ii) (as amended by this final rule), the ACO's minimum quality score will be set to the equivalent of the 40th percentile MIPS quality performance category score, excluding entities/providers eligible for facility-based scoring, for the relevant performance year. This policy will allow an ACO affected by a cyberattack, including ransomware/malware, as determined by the Quality Payment

Program, to meet the Shared Savings Program quality performance standard for sharing in savings at the maximum rate under its track and to have any shared losses pro-rated based on the length of the cyberattack, including ransomware/malware, as described elsewhere is section III.F.7 of this final rule.

We are also finalizing with modification the revisions to cross- references within the Shared Savings Program regulation at Sec. 425.512(b). Currently, the provision in Sec. 425.512(b)(5)(iv) specifies CMS' application of the health equity adjustment (being renamed the “population and income adjustment” as described elsewhere in this final rule) in determining the quality performance score for certain ACOs affected by extreme and uncontrollable circumstances, by performance year, described in Sec. 425.512(c)(3)(ii)-(iv). We are not finalizing our proposal to revise paragraph (b)(5)(iv) (which we proposed to redesignate as paragraph (b)(4)(iv)) to remove the reference to “paragraphs (c)(3)(ii) through (c)(3)(iv)” and add in its place the reference to “paragraphs (c)(3)(ii) and (c)(3)(iii)”. Consistent with our modifications to limit the applicability of Sec. 425.512(b) to performance years 2023 through 2025, as discussed in section III.F.6.c.(2) of this final rule, we are not redesignating paragraph (b)(5)(iv) as paragraph (b)(4)(iv), because we are not removing paragraph (b)(3) as proposed, and therefore we do not need to renumber the paragraphs that follow (b)(3). We are finalizing, as a conforming change, an amendment to Sec. 425.512(b)(5)(iv) to remove the reference “paragraphs (c)(3)(ii) through (iv) of this section” and add in its place the reference “paragraphs (c)(3)(ii) through (iv) of this section (as applicable)”. This change in the phrasing of the reference provides clarity since Sec. 425.512(c)(3)(iv) applies for performance year 2025 and subsequent performance years (emphasis added in italics), and performance year 2025 is the final year to which the population and income adjustment will apply.

We are finalizing the following revisions to the Shared Savings Program quality EUC regulation at Sec. 425.512(c) as proposed:

We are revising paragraph (c)(1) introductory text to read as follows, “CMS determines the ACO was affected by an extreme and uncontrollable circumstance based on any of the following:”

We are adding a new paragraph (iii) to (c)(1) to establish that for performance year 2025 and subsequent performance years, the ACO, as defined at Sec. 425.20, is affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/ malware, as determined by the Quality Payment Program. c. Revisions to the EUC Policy To Determine Financial Performance (1) Background

In the CY 2026 PFS proposed rule (90 FR 32688), we stated that the December 2017 IFC established policies for assessing the financial and quality performance of Shared Savings Program ACOs that were affected by EUCs during performance year 2017. These policies, and their subsequent revisions, are equally applicable for the finance EUC policies.

We further refined the finance EUC policies in the May 8, 2020 COVID-19 IFC (85 FR 27550), where we clarified the applicability of the program's EUC policy to mitigate shared losses for the period of the PHE for COVID-19 starting in January 2020. We explained that catastrophic events outside an ACO's control could increase the difficulty of coordinating care for patient populations and, due to the unpredictability of changes in utilization and cost of services furnished to beneficiaries, may have a significant impact on expenditures for the applicable performance year (85 FR 27577). These factors could jeopardize the ACO's ability to succeed in the Shared Savings Program, and ACOs, especially those in performance-based risk tracks, may reconsider whether they are able to continue their participation in the program (85 FR 27577).

Under our current policies at Sec. Sec. 425.605(f)(2) and 425.610(i)(2), ACOs (as defined at Sec. 425.20) that CMS determines to have been affected by an EUC will have their shared losses (if applicable) reduced by an amount that is proportional to the percentage of the year (determined by total months) affected by the EUC(s) and the percentage of the ACO's performance year-assigned beneficiaries residing in EUC-affected areas.

At Sec. Sec. 425.605(f)(3) and 425.610(i)(3), we apply determinations made by the Quality Payment Program with respect to the following:

Whether an extreme uncontrollable circumstance has occurred; and

The affected areas

At Sec. Sec. 425.605(f)(4) and 425.610(i)(4), CMS has sole discretion to determine the time period during which an EUC occurred and the percentage of the ACO's assigned beneficiaries residing in the affected areas. (2) Revisions

In the CY 2026 PFS proposed rule (90 FR 32688), we stated that if the Quality Payment Program approves an ACO's MIPS EUC Exception application, as an APM Entity, for a cyberattack, including ransomware/ malware, for the affected performance year, we proposed to apply the Shared Savings Program finance EUC policies at Sec. Sec. 425.605(f) and 425.610(i) to provide relief to the ACO by mitigating shared losses for the affected performance year.

In the CY 2026 PFS proposed rule (90 FR 32688), we stated that currently ACOs that we determine to have been affected by an EUC will have their shared losses (if applicable) reduced by an amount that is proportional to the percentage of the year (determined by total months) affected by the EUC(s) and the percentage of the ACO's performance year-assigned beneficiaries residing in EUC-affected areas. Unlike the determination of an EUC for a natural disaster or PHE that distinguishes the geographic locations impacted by the EUC, the MIPS EUC Exception application captures the APM Entity's (such as an ACO's) request for the EUC but does not differentiate geographic area(s) impacted by the EUC. Therefore, we would be unable to determine the percentage of the ACO's performance year-assigned beneficiaries residing in an EUC-affected area based on the ACO's submission of an EUC application to the Quality Payment Program in the case of a cyberattack, including ransomware/malware. So, we proposed to apply the Shared Savings Program finance EUC policies Sec. Sec. 425.605(f), and 425.610(i) to 100 percent of the ACO's assigned beneficiaries when an ACO has a MIPS EUC Exception application for a cyberattack, including ransomware/malware, approved by the Quality Payment Program for the affected performance year.

The MIPS EUC Exception application contains fields that allow an ACO to enter both a start date and an end date for the EUC. The application allows an ACO to provide either a start date and an end date or a start date only (if the EUC still persists at the time the application is submitted to CMS). We proposed that if an ACO provides a start date and an end date for the EUC in its application to the Quality Payment Program, then we would use those dates to determine the duration of the EUC. The start date must be provided in the application. The end date may also be provided in the application but is not required. An ACO may subsequently update the end date by contacting the

Quality Payment Program Service Center.

We further proposed that, if an ACO does not provide an end date in the ACO's MIPS EUC Exception application or by contacting the Quality Payment Program Service Center to provide an end date prior to the end of the application submission period, then we would apply a 90-day default duration for purposes of mitigating shared losses. This 90-day default duration is consistent with the timeframe used for determining a PHE declaration by the Secretary (the declaration lasts for the duration of the emergency or 90 days but may be extended by the Secretary).\418\

\418\ See Administration for Strategic Preparedness & Response website, Declarations of a Public Health Emergency web page, at https://aspr.hhs.gov/legal/PHE/pages/default.aspx (describing duration of a public health emergency, among other information).

We proposed that if the ACO's MIPS EUC Exception application has a start date that occurs less than 90 days before the end of the performance year, and the ACO's MIPS EUC Exception application does not include an end date for the EUC and the ACO does not provide an end date to CMS in the form and manner CMS specifies, then we proposed that December 31 of the performance year would be the end date for which the ACO was impacted by the EUC, since that is when both the MIPS EUC Exception and the performance year used to calculate shared savings and shared losses end.

We proposed that if an ACO is affected by an EUC that persists from one performance year to a subsequent performance year, then the ACO would be required to submit a MIPS EUC Exception application for each affected performance year.

Moreover, as we discussed in the December 2017 IFC (82 FR 60916 through 60917), to exercise our authority under section 1899(i)(3) of the Act to use other payment models, we must demonstrate that the payment model--(1) “ . . . does not result in spending more for such ACO for such beneficiaries than would otherwise be expended . . . if the model were not implemented. . . .” and (2) “will improve the quality and efficiency of items and services furnished under” Medicare. As described in CY 2026 PFS proposed rule (90 FR 32687) rule, we assessed the impacts of our proposal for mitigating shared losses for ACOs affected by extreme and uncontrollable circumstances due to a cyberattack, including ransomware/malware, as determined by the Quality Payment Program. We considered the following: the impact of the potential loss of participation in the program by ACOs affected by a cyberattack, including ransomware/malware, as determined by the Quality Payment Program, should we not implement the policy described in the CY 2026 PFS proposed rule (90 FR 32687), and the anticipated minimal impact of adjusting losses for ACOs affected by a cyberattack, including ransomware/malware, as determined by the Quality Payment Program. On the basis of this assessment, we believe incorporating this extreme and uncontrollable circumstances policy into the payment methodologies would meet the requirements of section 1899(i) of the Act by not increasing expenditures above the costs that would be incurred under the statutory payment methodology under section 1899(d) of the Act and by encouraging affected ACOs to remain in the program, which we believe will increase the quality and efficiency of the items and services furnished to the beneficiaries they serve. For these reasons, we conclude that our proposal is permissible under our authority as described in section 1899(i)(3) of the Act.

In the CY 2026 PFS proposed rule (90 FR 32689), we proposed the following revisions to the Shared Savings Program finance EUC regulations at Sec. Sec. 425.605 and 425.610:

At Sec. 425.605, to add paragraph (f)(2)(ii) to read as follows, “For performance year 2025 and subsequent performance years, for an ACO as defined at Sec. 425.20 that is determined to be affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, for any month of the performance year that is affected, CMS considers 100 percent of the ACO's assigned beneficiaries to reside in an affected area.”

At Sec. 425.605, to revise paragraph (f)(3) to read as follows, “CMS applies determinations made under the Quality Payment Program with respect to all of the following (as applicable):”

At Sec. 425.605, to remove the punctuation “; and” at the end of paragraph (f)(3)(i) and adding in its place a period.

At Sec. 425.605, to add a new paragraph (f)(3)(iii) to indicate the following: “The time period during which the ACO was affected by a cyberattack, including ransomware/malware.”

At Sec. 425.605, to redesignate the paragraph (f)(4) as paragraph (f)(5).

At Sec. 425.605, to add a new paragraph (f)(4) to indicate the following: CMS will determine the time period during which an ACO is affected by a cyberattack, including ransomware/malware, as follows:

++ At Sec. 425.605(f)(4)(i), CMS will use the start and end date indicated on an ACO's application to the Quality Payment Program for an extreme and uncontrollable circumstance exception due to a cyberattack, including ransomware/malware, or the start date indicated on the application and an end date subsequently provided by the ACO in the form and manner as specified by CMS.

++ At Sec. 425.605(f)(4)(ii), except as specified in paragraph (f)(4)(iii), if no end date is indicated on the ACO's application or otherwise provided to us in a form and manner specified by us, described in paragraph (f)(4)(i), we will apply a 90-day duration for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

++ At Sec. 425.605(f)(4)(iii), if the start date indicated on the ACO's application described in paragraph (f)(4)(i), is less than 90 days before the end of the performance year and no end date is indicated on the ACO's application or otherwise provided to CMS in the form and manner specified by CMS, described in paragraph (f)(4)(i) of this section, we will apply an end date of December 31st of the performance year for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

At Sec. 425.610, to add paragraph (i)(2)(ii) to read as follows, “For performance year 2025 and subsequent performance years, for an ACO as defined at Sec. 425.20 that is determined to be affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, for any month of the performance year that is affected, CMS considers 100 percent of the ACO's assigned beneficiaries to reside in an affected area.”

At Sec. 425.610, to revise paragraph (i)(3) to read as follows, “CMS applies determinations made under the Quality Payment Program with respect to all of the following (as applicable):”

At Sec. 425.610, to remove the punctuation “; and” at the end of paragraph (i)(3)(i) and adding in its place a period.

At Sec. 425.610, to add a new paragraph (i)(3)(iii) to read as follows: “The time period during which the ACO was affected by a cyberattack, including ransomware/malware.”

At Sec. 425.610, to add a new paragraph (i)(4) to indicate the following: CMS will determine the time

period during which an ACO is affected by a cyberattack, including ransomware/malware, as follows:

++ At Sec. 425.610(i)(4)(i), we will use the start and end date indicated on an ACO's application to the Quality Payment Program for an extreme and uncontrollable circumstance exception due to a cyberattack, including ransomware/malware, or the start date indicated on the application and an end date subsequently provided by the ACO in the form and manner as specified by CMS.

++ At Sec. 425.610(i)(4)(ii), and except as specified in paragraph (i)(4)(iii), if no end date is indicated on the ACO's application or otherwise provided to us in a form and manner specified by us, described in paragraph (i)(4)(i), we will apply a 90-day duration for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

++ At Sec. 425.610(i)(4)(iii), if the start date indicated on the ACO's application described in paragraph (i)(4)(i) is less than 90 days before the end of the performance year and no end date is indicated on the ACO's application or otherwise provided to CMS in the form and manner specified by CMS, described in paragraph (i)(4)(i) of this section, CMS will apply an end date of December 31st of the performance year for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

To redesignate paragraph (i)(4) as paragraph (i)(5).

We sought public comments on these proposed changes to the finance EUC policies.

We received public comments on these proposals. The following is a summary of the comments we received and our responses.

Comment: Many commenters supported the proposal to apply Shared Savings Program EUC finance policies to 100 percent of an ACO's assigned beneficiaries when the ACO has an approved MIPS EUC Exception application for a cyberattack. Multiple commenters recommended that CMS finalize this policy as proposed. A commenter cited that it is beneficial that ACOs are not inappropriately penalized for cyberattacks that may impact ACO performance as cyberattacks may occur regardless of whether an ACO is exercising appropriate care in securing heath IT systems. Another commenter supported the proposal and cited their appreciation of CMS' recognition of the rapidly evolving technological environment. Additionally, a commenter urged CMS to finalize these policies as proposed and applauds CMS' efforts to safeguard ACOs from risking earned shared savings. Another commenter urged CMS to finalize all proposed EUC policy changes related to cyberattacks, citing that these policies will offer much-needed protection and flexibility to ACOs as impacted entities navigate the increasing risks of cybersecurity threats while continuing to deliver accountable care.

Response: We thank commenters for their support.

Comment: Some commenters supported CMS' proposed approach to determine the proportion of the performance year affected by the EUC due to cyberattack using the start and end dates provided on the ACO's EUC Exception application or defaulting to a 90-day duration when no end date is included, unless the start date is less than 90 days from the end of the performance year. A few of these commenters also encouraged CMS to communicate to ACOs that are affected by an EUC over multiple performance years that they must submit multiple MIPS EUC Exception applications to have relief from quality reporting requirements and mitigation of any shared losses for the duration of the EUC due to cyberattack. A commenter supported CMS' proposal to expand EUC policies and recommended that CMS provide clear guidance on documentation requirements and timelines for MIPS EUC Exception applications to avoid delays in relief.

Response: We thank commenters for their support. Updated information and communications will be available on the Quality Payment Program Exception Application website (https://qpp.cms.gov/mips/exception-applications?py=2025) after the release of this final rule. We also note that under the proposal, in alignment with the QPP, if an ACO is affected by an EUC that persists from one performance year to a subsequent performance year, then the ACO would be required to submit a MIPS EUC Exception application for each affected performance year.

Comment: A commenter supported CMS' proposal to expand EUC policies and encouraged CMS to revise the provision requiring a MIPS EUC Exception application to be resubmitted if it extends across two years to instead allow a single application to cover the full 90-day period, even if it spans two calendar years. The commenter cited that by revising the provision to allow a single application to cover the full 90-day period, even if it spans two calendar years, CMS would bring this proposal in line with other EUC provisions concerning the 90-day relief period.

Response: We stated in the CY 2026 PFS proposed rule (90 FR 32352) that if an ACO is affected at the legal entity level by an EUC due to a cyberattack, including ransomware/malware, and seeks relief from Shared Savings Program quality reporting requirements, then the ACO must submit a MIPS EUC Exception application to the Quality Payment Program as an APM Entity for the affected performance year. The MIPS EUC Exception utilizes performance years as the term of relevance; this policy aligns with the QPP requirements for the Exception Application.\419\ Under our proposal, in alignment with the QPP, if an ACO is affected by an EUC that persists from one performance year to a subsequent performance year, then the ACO would be required to submit a MIPS EUC Exception application for each affected performance year.

\419\ See the Quality Payment Program website, Quality Payment Program Exception Applications web page, at https://qpp.cms.gov/mips/exception-applications#mipseucexception-2025 (describing QPP exception guidelines by performance year).

For information on how to submit a MIPS EUC Exception application for performance year 2025, ACOs can refer to the Quality Payment Program Exception Application website (https://qpp.cms.gov/mips/exception-applications?py=2025) and 2025 MIPS EUC Exception Guide (https://qpp-cm-prod-content.s3.amazonaws.com/uploads/3239/2025-MIPS-Extreme-and-Uncontrollable-Circumstances-Exception-Application-Guide.pdf).

After consideration of public comments, we are finalizing our proposed amendments to Sec. Sec. 425.605 and 425.610 to expand the application of the Shared Savings Program finance EUC policies to an ACO as defined at Sec. 425.20 that is affected by an EUC due to a cyberattack, including ransomware/malware, and has an approved MIPS EUC Exception application as determined by the Quality Payment Program, for performance year 2025 and subsequent performance years . We note that in the CY 2026 PFS proposed rule there were minor, inadvertent discrepancies between the proposed amendments to the provisions of Sec. 425.605(f) and Sec. 425.610(i) (90 FR 32857 through 32859), and the preamble descriptions of these proposed changes to the regulation (90 FR 32689 and 32690). To follow is a list of amendments to the Shared Savings Program regulations specifying the finance EUC policies at Sec. 425.605(f) and Sec. 425.610(i) which we are finalizing with this final rule, with corrections to

the descriptions of these amendments for clarity.

At Sec. 425.605, we are adding paragraph (f)(2)(ii) to read as follows: “For performance year 2025 and subsequent performance years, for an ACO as defined at Sec. 425.20 that is determined to be affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, for any month of the performance year that is affected, CMS considers 100 percent of the ACO's assigned beneficiaries to reside in an affected area.”

At Sec. 425.605, we are revising paragraph (f)(3) introductory text to read as follows: \420\ “CMS applies determinations made under the Quality Payment Program with respect to all of the following (as applicable):”

\420\ In describing this proposed change in preamble of the CY 2026 PFS proposed rule (90 FR 32689), we did not specify the revisions were to the introductory text of paragraph Sec. 425.605(f)(3), although we provided this specificity in the amendatory instructions for the proposed provision (90 FR 32857).

At Sec. 425.605, we are removing the punctuation “; and” at the end of paragraph (f)(3)(i) and adding in its place a period.

At Sec. 425.605, we are adding a new paragraph (f)(3)(iii) to indicate the following: “The time period during which the ACO was affected by a cyberattack, including ransomware/malware.”

At Sec. 425.605, we are redesignating paragraph (f)(4) as paragraph (f)(5).

At Sec. 425.605, we are adding a new paragraph (f)(4) to indicate the following: CMS determines the time period during which an ACO is affected by a cyberattack, including ransomware/malware, as follows:

++ We are specifying at Sec. 425.605(f)(4)(i), CMS uses the start and end date indicated on an ACO's application to the Quality Payment Program for an extreme and uncontrollable circumstance exception due to a cyberattack, including ransomware/malware, or the start date indicated on the application and an end date subsequently provided by the ACO in the form and manner as specified by CMS.

++ We are specifying at Sec. 425.605(f)(4)(ii), except as specified in paragraph (f)(4)(iii) of this section, if no end date is indicated on the ACO's application or otherwise provided to CMS in a form and manner specified by CMS, described in paragraph (f)(4)(i) of this section, CMS applies a 90-day duration for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

++ We are specifying at Sec. 425.605(f)(4)(iii), if the start date indicated on the ACO's application described in paragraph (f)(4)(i) of this section is less than 90 days before the end of the performance year and no end date is indicated on the ACO's application or otherwise provided to CMS in the form and manner specified by CMS, described in paragraph (f)(4)(i) of this section, CMS applies an end date of December 31st of the performance year for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

At Sec. 425.610, we are adding paragraph (i)(2)(ii) to read as follows: “For performance year 2025 and subsequent performance years, for an ACO as defined at Sec. 425.20 that is determined to be affected by an extreme and uncontrollable circumstance due to a cyberattack, including ransomware/malware, for any month of the performance year that is affected, CMS considers 100 percent of the ACO's assigned beneficiaries to reside in an affected area.”

At Sec. 425.610, we are revising paragraph (i)(3) introductory text to read as follows: \421\ “CMS applies determinations made under the Quality Payment Program with respect to all of the following (as applicable):”

\421\ In describing this proposed change in preamble of the CY 2026 PFS proposed rule (90 FR 32689), we did not specify the revisions were to the introductory text of paragraph Sec. 425.610(i)(3), although we provided this specificity in the amendatory instructions for the proposed provision (90 FR 32858).

At Sec. 425.610, we are removing the punctuation “; and” at the end of paragraph (i)(3)(i) and adding in its place a period.

At Sec. 425.610, we are adding a new paragraph (i)(3)(iii) to read as follows: “The time period during which the ACO was affected by a cyberattack, including ransomware/malware.”

At Sec. 425.610, we are redesignating paragraph (i)(4) as paragraph (i)(5).

At Sec. 425.610, we are adding a new paragraph (i)(4) to indicate the following: CMS determines the time period during which an ACO is affected by a cyberattack, including ransomware/malware, as follows:

++ We are specifying at Sec. 425.610(i)(4)(i), CMS uses the start and end date indicated on an ACO's application to the Quality Payment Program for an extreme and uncontrollable circumstance exception due to a cyberattack, including ransomware/malware, or the start date indicated on the application and an end date subsequently provided by the ACO in the form and manner as specified by CMS.

++ We are specifying at Sec. 425.610(i)(4)(ii), except as specified in paragraph (i)(4)(iii) of this section, if no end date is indicated on the ACO's application or otherwise provided to CMS in a form and manner specified by CMS, described in paragraph (i)(4)(i) of this section, CMS applies a 90-day duration for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance.

++ We are specifying at Sec. 425.610(i)(4)(iii), if the start date indicated on the ACO's application described in paragraph (i)(4)(i) of this section is less than 90 days before the end of the performance year and no end date is indicated on the ACO's application or otherwise provided to CMS in the form and manner specified by CMS, described in paragraph (i)(4)(i) of this section, CMS applies an end date of December 31st of the performance year for purposes of determining the time period during which the ACO was affected by the extreme and uncontrollable circumstance. d. Scenarios for the Start and End Dates Provided by ACOs When the MIPS EUC Exception Application Is Submitted to CMS

In the CY 2026 PFS proposed rule (90 FR 32690), we provided the following scenarios on how we would apply the proposed quality and finance EUC policies to ACOs affected by an EUC due to a cyberattack, including ransomware/malware. We did not receive any comments on these scenarios. We are finalizing our quality and finance EUC proposals as proposed, so the following scenarios reflect the application of the finalized policies.

Scenario 1: ACO provides a start date and end date for the EUC in the application, or the ACO contacts the Quality Payment Program Service Center to provide an end date for the EUC prior to the end of the application submission period.

Application of the quality EUC policy: The quality EUC policy would apply to the ACO for the entire performance year, where we would use the higher of the ACO's quality score (if the ACO reports quality data on the APP Plus quality measure set) or the equivalent of the 40th percentile MIPS quality performance category score, as established at Sec. 425.512(c)(3)(iv).

Application of the finance EUC policies: The finance EUC policies as established at Sec. 425.605 and Sec. 425.610

would apply for the timeframe captured by the start and end date for the EUC and would apply to 100 percent of the ACO's assigned beneficiaries for the duration of the EUC.

Scenario 2: ACO provides a start date of March 1 for the EUC, but no end date in the application and the ACO does not contact the Quality Payment Program Service Center to provide an end date prior to the end of the application submission period.

Application of the quality EUC policy: The quality EUC policy would apply to the ACO for the entire performance year, where we would use the higher of the ACO's quality score (if the ACO reports quality data on the APP Plus quality measure set) or the equivalent of the 40th percentile MIPS quality performance category score, as established at Sec. 425.512(c)(3)(iv).

Application of the finance EUC policies: The finance EUC policies as established at Sec. Sec. 425.605 and 425.610 would apply a start date of March 1 and an end date that would be 90 days from the start date and will apply to 100 percent of the ACO's assigned beneficiaries for the duration of the EUC.

Scenario 3: ACO provides a start date of November 1 for the EUC, but no end date in the application and the ACO does not contact the Quality Payment Program Service Center to provide an end date prior to the end of the application submission period.

Application of the quality EUC policy: The quality EUC policy would apply to the ACO for the entire performance year, where CMS would use the higher of the ACO's quality score (if the ACO reports quality data on the APP Plus quality measure set) or the equivalent of the 40th percentile MIPS quality performance category score, as established at Sec. 425.512(c)(3)(iv).

Application of the finance EUC policies: The finance EUC policies as established at Sec. Sec. 425.605 and 425.610 would apply a start date of November 1 and an end date of December 31, which is the last day of the performance year, and will apply to 100 percent of the ACO's assigned beneficiaries for the duration of the EUC. 8. Population Adjustment--Financial Benchmarking Methodology a. Overview

In the CY 2025 PFS final rule (89 FR 98574 through 98576), we finalized the Health Equity Benchmark Adjustment (HEBA), aimed at increasing participation in the Shared Savings Program by ACOs that serve an above-average proportion of Medicare Part D enrollees receiving Low Income Subsidy (LIS) or dually eligible beneficiaries and incentivizing ACOs to provide coordinated care to these populations. We believe this policy encourages participation in the Shared Savings Program from ACOs that otherwise may not have considered entering the program, as 45 percent of the ACOs receiving the HEBA in 2025 would not have qualified for the prior savings adjustment or positive regional adjustments, and therefore would have had a less favorable benchmark, had they not received the HEBA. However, since finalizing this policy, we concluded that it would add clarity to rename the HEBA to “population adjustment,” to more accurately reflect the nature of the adjustment, which accounts for the proportion of the ACO's assigned beneficiaries who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid. Accordingly, in the CY 2026 PFS proposed rule (90 FR 32690 through 32693) we proposed changes to the Shared Savings Program regulations to rename the adjustment.

This proposed change seeks to harmonize the adjustment's name with the naming convention used for the other adjustments--the regional and prior savings adjustments--where the titles explicitly reflect key aspects of their underlying methodology. The adoption of the term “population adjustment” would reflect the specific data inputs and population focus of this adjustment, while also promoting consistency in nomenclature across adjustments.

As we explained in the CY 2026 PFS proposed rule (90 FR 32690), the proposed revisions to rename the HEBA differ from the approach proposed in the amendments to the Health Equity Adjustment applied to an ACO's quality score as described elsewhere in the proposed rule (90 FR 32677 through 32679). However, the intent and effect of these respective sections are distinct and therefore the proposed revisions reflect a separate rationale and methodology. Accordingly, the two sections serve different purposes and warrant distinct treatment within the rule. b. Revisions to the Terminology in the Shared Savings Program Regulations Used To Describe the Adjustment (1) Background (a) Context for the HEBA

In the CY 2026 PFS proposed rule (90 FR 32690 and 32691), we stated that, relying on our authority under section 1899(d)(1)(B)(ii) of the Act, we finalized the health equity adjustment to the historical benchmark for agreement periods beginning on January 1, 2025, and in subsequent years (89 FR 98155 through 98166). We finalized provisions of the regulation in 42 CFR part 425, subpart G (see Sec. Sec. 425.652(a)(8) and 425.662) specifying the methodology for calculating the health equity adjustment to the historical benchmark, determining an ACO's eligibility for the adjustment, and the applicability of the adjustment. The text included the terms “health equity benchmark adjustment,” “Health Equity Benchmark Adjustment (HEBA) scaler,” and “HEBA.” In the CY 2025 PFS final rule, we noted the limitations of benchmarks based on historically observed spending, as they could be set too low if they are based on the spending of a population of underserved communities. We discussed that without appropriate adjustments, ACOs caring for these populations may face financial penalties even if they succeed in improving access to high-value care during their agreement periods. Additionally, we noted that the Congressional Budget Office (CBO) reported high start-up costs for providers in rural and underserved communities as a barrier to forming ACOs.\422\ We stated in the CY 2025 PFS proposed rule that these providers may want to participate in ACOs but are disincentivized due to steep start-up costs. The HEBA was finalized to provide additional financial resources to ACOs serving these populations, and to encourage those ACOs to attract and retain beneficiaries from communities that have faced challenges accessing care. The adjustment is calculated based on the number of beneficiaries an ACO serves who are either enrolled in the LIS program or are dually eligible for Medicare and Medicaid, offering a targeted mechanism to reflect the needs of higher- risk populations.

\422\ Congressional Budget Office, “Medicare Accountable Care Organizations: Past Performance and Future Directions” (April 2024), available at https://www.cbo.gov/publication/59879.

(b) HEBA Provisions Finalized in CY 2025 PFS Final Rule

In the CY 2026 PFS proposed rule (90 FR 32691 and 32692), we stated that for agreement periods beginning on January 1, 2025, and in subsequent years, the Shared Savings Program utilizes three key mechanisms to upwardly adjust ACO benchmarks: the HEBA, the positive regional adjustment, and the prior savings adjustment. The positive regional adjustment evaluates an ACO's efficiency compared to its regional

service area. The prior savings adjustment reflects an ACO's historical success in reducing Medicare fee-for-service (FFS) spending growth. The HEBA can increase benchmarks for ACOs with 15 percent or more assigned beneficiaries enrolled in LIS or dually eligible for Medicare/Medicaid, offering a targeted mechanism to reflect the needs of higher-risk populations.

These adjustments are not cumulative: ACOs receive the highest applicable adjustment, capped at 5 percent of national FFS per capita expenditures (89 FR 98158). For ACOs serving medically complex and high-cost beneficiaries, the HEBA often becomes their most favorable adjustment as they may not qualify for the regional adjustment or prior savings adjustments. While risk adjustment accounts for patient health status and dual eligibility status and benchmark calculations stratify expenditures by dual eligibility status, these mechanisms may fall short in fully reflecting costs for ACOs serving LIS or dually eligible beneficiaries in regions with high proportions of dual eligible and LIS populations. This can leave ACOs caring for these populations with unfavorable benchmarks and may reduce their incentive to participate in the program. As explained earlier in this section of this final rule, the HEBA addresses this gap by directly increasing benchmarks for ACOs with a significant proportion of LIS or dually eligible beneficiaries, providing a meaningful financial incentive for participation by those ACOs and retention of such beneficiaries. (c) HEBA Impact--Initial Observations

As described in the CY 2025 PFS final rule (89 FR 98158), CMS finalized a process to provide ACOs with a preliminary HEBA calculation at the start of their agreement period, using the ACO's BY3 assigned population. This preliminary calculation uses the proportion of the ACO's BY3 assigned beneficiaries who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid. We specified that we would then update the calculation when the ACO's historical benchmark is updated at the time of financial reconciliation for the performance year to reflect the ACO's performance year-assigned population in the calculation of the proportion of the ACO's assigned beneficiaries who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid.

In the CY 2026 PFS proposed rule (90 FR 32691), we noted that based on internal analysis of PY 2025 preliminary benchmarks,\423\ of 33 ACOs estimated to receive a HEBA, 13 are new ACOs participating in their first agreement period and would otherwise not have received a positive regional adjustment to the benchmark.

\423\ These benchmarks are preliminary because they are established at the start of an ACO's agreement period and include incomplete data from benchmark year 3.

Following the publication of the CY 2026 PFS proposed rule, we have updated the values we have observed according to more updated data. Based on-internal analysis of PY 2025 final benchmarks, we note that among 16 ACOs estimated to receive a HEBA, 8 are new ACOs participating in their first agreement period and would otherwise not have received a positive regional adjustment to the benchmark (for example, ACO spending is above their region's expenditures) or a prior savings adjustment, since these ACOs are in their first agreement period. This later stage observation continues to suggest that the HEBA is encouraging more participation in the Shared Savings Program, as intended, by high-cost ACOs \424\ that may otherwise not have elected to apply and participate in the program and whose assigned beneficiary populations have the greatest potential to benefit from care coordination and quality improvement. In the CY 2026 PFS proposed rule, we noted that our initial analysis of the preliminary benchmarks suggested that these ACOs could see an approximate 1.36 percent increase in their benchmark compared to an approximate 2.29 percent for ACOs that received either a prior savings adjustment or positive regional adjustment (90 FR 32691). Analysis of the final benchmarks suggests that these ACOs could see an approximate 1.25 percent increase in their benchmark compared to an approximate 3.14 percent for ACOs that received either a prior savings adjustment or positive regional adjustment. Final information on the percentage of ACOs receiving the HEBA and the impact on their benchmarks will depend on the ACO's final PY 2025 assigned population, which is not determined until financial reconciliation, consistent with Sec. 425.662(b)(4).

\424\ By “high-cost ACOs,” we refer in this rulemaking to those ACOs with spending above their region's expenditures.

The Regulatory Impact Analysis of the HEBA from the CY 2025 PFS final rule (89 FR 98523 and 98524) estimated that total net savings is projected to grow over ten years by approximately $260 million as a result of the HEBA attracting additional high-cost ACOs to join the program and creating savings for the Medicare program, ranging from a $1.2 billion cost to a $2.2 billion savings at the 10th and 90th percentiles. (d) Expanding Participation

In the CY 2026 PFS proposed rule (90 FR 32691 and 32692), we stated that the HEBA policy aligns with CMS' aims of advancing prevention, wellness, and chronic disease management, while supporting the growth and expansion of the Shared Savings Program. Analysis revealed significant untapped potential to increase Shared Savings Program participation among practices currently not participating in the program, in particular among providers serving higher cost populations.\425\

\425\ CMS, Press Release “Dr. Mehmet Oz Shares Vision for CMS” (April 10, 2025), available at https://www.cms.gov/newsroom/press-releases/dr-mehmet-oz-shares-vision-cms.

We conducted an analysis of Taxpayer Identification Numbers (TINs) associated with medical providers and/or practices not part of ACOs participating in the Shared Savings Program during PY 2022. The analysis compared TINs that participated in the Shared Savings Program with those that did not. Results indicated that many non-participating TINs served a larger share of beneficiaries with disabled or aged/dual enrollment status and had greater presence in rural areas. The study also found that of all the TINs serving beneficiaries eligible to participate in a Shared Savings Program ACO, 84 percent (or 58,000 TINs) were not participating in the Shared Savings Program. By contrast, only about 11,000 TINs with at least one ACO-assigned beneficiary participated in a Shared Savings Program ACO. Among these non-participants, two-thirds were small practices that furnish care to 100 or fewer beneficiaries. The analysis also highlighted key differences between ACO participating and non-participating TINs in terms of the population they served and their geographic distribution. We observed that TINs associated with medical providers and/or practices not participating in Shared Savings Program ACOs are in regions with low Shared Savings Program ACO penetration and have a greater presence in rural areas. These practices serve larger shares of dual eligible and disabled beneficiaries and have higher spending per beneficiary driven primarily by inpatient and SNF expenditures.

Encouraging participation in ACOs by practices serving these higher-cost beneficiaries remain crucial to the Shared Savings Program. Our internal analysis shows that Shared Savings

Program ACOs have been successful in reducing inpatient and SNF spending. The HEBA accounts for a higher proportion of dual eligible and LIS beneficiaries and therefore can strengthen the business case for providers that serve these populations to join and form ACOs and participate in the Shared Savings Program.

The adjustment is particularly critical in rural areas where the CBO has identified high start-up costs as a significant barrier to ACO formation.\426\ By enabling ACOs in rural and resource-limited areas to operate under more viable and realistic financial benchmarks, the HEBA policy aims to expand participation in the Shared Savings Program and increase the likelihood that these ACOs can succeed financially while delivering high-quality care.

\426\ Congressional Budget Office, “Medicare Accountable Care Organizations: Past Performance and Future Directions” (April 2024), available at https://www.cbo.gov/system/files/2024-04/59879-Medicare-ACOs.pdf.

(2) Revisions

In the CY 2026 PFS proposed rule (90 FR 32692), we proposed to update the language used to describe the health equity adjustment to the benchmark to more accurately reflect the populations served by the ACOs receiving the adjustment. We noted that this change reflects efforts to harmonize terminology across benchmark-related methodologies--regional and prior savings adjustments--where the titles explicitly reflect key features of their underlying methodology. We further noted that the revision to “population adjustment” more accurately reflects the population of beneficiaries that are captured by this adjustment (ACOs' assigned beneficiaries who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid), as well as promotes consistency in nomenclature across adjustment.

Specifically, we proposed to revise Shared Savings Program regulations that include references to “health equity benchmark adjustment” or HEBA to “population adjustment.” We also proposed to revise the term “HEBA scaler,” which is a component in the calculation to “scaler.” The naming changes would apply for performance year 2025 and subsequent performance years. This proposal would revise only the terminology in the regulations. The calculation described in the regulations would be unchanged. We noted that this proposal, if finalized, would have a minimal impact on Shared Savings Program operations. CMS would only need to update the language used in historical benchmark reports and the assignment summary report, beginning with report deliveries occurring after the rule is finalized, and certain other programmatic materials, for example, the Medicare Shared Savings Program Assignment List Report and Assignment Summary Report User's Guide, and the Medicare Shared Savings Program's Shared Savings and Losses, Assignment and Quality Performance Standard Methodology Specifications.

These proposed revisions reflect changes to the terminology used in the regulations at Sec. Sec. 425.652, 425.658, 425.662 and 425.672. We did not propose any changes in the methodology currently used to calculate the health equity benchmark adjustment. Specifically, we proposed the following revisions to provisions of the regulation (restated with minor corrections for clarity):

At Sec. 425.652(a)(8)(ii)(A), we proposed to remove the phrase “health equity benchmark adjustment (HEBA)” and add in its place the phrase “population adjustment.”

At Sec. 425.652(a)(8)(ii)(B) introductory text, (a)(8)(ii)(B)(2), (a)(9)(v),and (a)(9)(vi), we proposed to remove the phrase “HEBA” and add in its place the phrase “population adjustment.”

At Sec. 425.652(a)(9)(v), we proposed to remove the phrase “HEBA scaler used in calculating the HEBA under Sec. 425.662(b)(2)” and add in its place the phrase “scaler used in calculating the population adjustment under Sec. 425.662(b)(2).”

At Sec. 425.658(d), we proposed to remove the phrase “HEBA” and add in its place the phrase “population adjustment.”

At Sec. 425.662, we proposed to revise the section heading to read as follows: “Calculating the population adjustment to the historical benchmark.”

At Sec. 425.662 we proposed to revise paragraph (a) to read as follows: “General. For agreement periods beginning on January 1, 2025, and in subsequent years, CMS calculates the population adjustment to the historical benchmark.”

At Sec. 425.662(b) introductory text, we proposed to remove the phrase “health equity benchmark adjustment” and add in its place the phrase “population adjustment.”

At Sec. 425.662(b)(2), and we proposed to remove the phrase “Calculates the HEBA scaler” and add in its place the phrase “Calculates a scaler.”

At Sec. 425.662, we proposed to revise paragraph (b)(3) to read as follows: “Determines the ACO's eligibility for the population adjustment based on the proportion of the ACO's assigned beneficiaries for the performance year who are enrolled in the Medicare Part D low-income subsidy (LIS) or dually eligible for Medicare and Medicaid. An ACO is only eligible for the population adjustment if this proportion is greater than or equal to 15 percent. An ACO with a proportion less than 15 percent is ineligible to receive the population adjustment.”

At Sec. 425.662, we proposed to revise paragraph (b)(4) to read as follows: “Calculates the population adjustment. If the ACO is eligible for the population adjustment as determined in paragraph (b)(3) of this section, the adjustment is equal to the product of the scaler calculated in paragraph (b)(2) of this section and the proportion of the ACO's assigned beneficiaries for the performance year who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid.”

At Sec. 425.662, we proposed to revise paragraph (c) to read as follows: “Applicability of the population adjustment. CMS compares the population adjustment determined in paragraph (b)(4) of this section with the regional adjustment, expressed as a single value as described in Sec. 425.656(d), and the per capita prior savings adjustment determined in Sec. 425.658(c), if any, to determine the adjustment, if any, that will be applied to the ACO's benchmark in accordance with Sec. 425.652(a)(8)(ii).”

At Sec. 425.672 in paragraph (c)(2)(iv), we proposed to remove the phrase “and calculating the HEBA scaler” and add in its place the phrase “and calculating the scaler.”

We sought public comments on these proposed changes. The following is a summary of comments received in response to our proposals and our responses.

Comment: Many commenters supported the proposed renaming of the “health equity benchmark adjustment” to the “population adjustment.” Some of these commenters agreed that the proposed renaming more accurately reflects the population of beneficiaries captured by the adjustment. Some of these commenters also supported the current HEBA methodology (which remains unchanged under the proposal), with some commenters noting the adjustment is important in recognizing upstream drivers or factors that impact beneficiary health outcomes, and the additional resources needed to provide care for underserved rural and urban patient populations. Some commenters noted that the population adjustment will encourage more participation in the program by high-cost ACOs.

Response: We thank commenters for their support.

Comment: A few commenters opposed the proposal and expressed disappointment over retraction of language and program facets related to health equity. A commenter noted that removing and/or disincentivizing policies to improve health equity and social determinants of health will have a detrimental effect on patients' health, leading to higher costs, while another commenter noted that the renaming withdraws recognition of health care providers who care for vulnerable patients. Another commenter supported the adjustment but mistakenly believed CMS proposed to sunset the HEBA. Another commenter, supportive of renaming the HEBA, suggested that CMS use an alternative name, the “Population and Income Adjustment and Bonus Points” (echoing phrasing used in the proposal to rename the Shared Savings Program's quality health equity adjustment, and seeming to mistake CMS' consideration of this phrasing for renaming the HEBA).

Response: We appreciate commenters' concerns and recommendations. We reaffirm that our intention is not to sunset an adjustment that could support improvements in patients' health or cost efficiencies, but rather to rename it. We note that the term “population adjustment” more accurately reflects the populations served by the ACOs who earn the adjustment (ACOs' assigned beneficiaries who are enrolled in the Medicare Part D LIS or dually eligible for Medicare and Medicaid). We do not believe that renaming the adjustment withdraws recognition for health care providers who care for higher-risk populations as the methodology underlying the adjustment will not change and continues to encourage participation from and provide additional resources to ACOs serving high-cost, medically complex beneficiary populations. We disagree with commenters' recommendations for alternative names. We reiterate that, as noted in the CY 2026 PFS proposed rule, the renaming also harmonizes terminology across benchmark-related methodologies--regional and prior savings adjustments--where the titles explicitly reflect key features of their underlying methodology (90 FR 32690).

Comment: A couple commenters, supportive of the proposed renaming, shared their belief that it is inconsistent to maintain the benchmark adjustment for finance-related policies for ACOs while simultaneously proposing to sunset the quality-related health equity adjustment, as both ensure that ACOs serving a disproportionate share of underserved beneficiaries are not disadvantaged in the Shared Savings Program.

Response: We acknowledge the comments regarding the differences between our proposal to rename (but maintain) the HEBA while proposing to remove the health equity adjustment, which is applicable to an ACO's quality score. We note that in the CY 2026 PFS proposed rule, CMS' proposal to sunset the health equity adjustment from the Shared Savings Program centers on the duplicative nature of this adjustment with other quality incentives and supports, specifically, the eCQM/MIPS CQM reporting incentive and the Complex Organization Adjustment (90 FR 32677 through 32679). In contrast, there are no Shared Savings Program financial benchmark adjustments that serve a similar function to the HEBA. Therefore, we believe it is appropriate to maintain the adjustment under the finance methodology. Additionally, we did not propose any changes in the methodology used to calculate the adjustment or substantive changes to the adjustment. We refer readers to section III.F.6.c(2) of this final rule for our responses to public comments on the proposal to sunset the health equity adjustment.

Many commenters shared feedback that went beyond the scope of our proposal to rename the adjustment, and we are not summarizing and responding to these comments in this final rule.

After consideration of public comments, we are finalizing our proposals to rename the “health equity benchmark adjustment” to the “population adjustment” and the “health equity benchmark adjustment scaler” to the “scaler” and make conforming revisions to the terminology used in the regulations at Sec. Sec. 425.652, 425.658, 425.662 and 425.672. We are finalizing these changes as proposed with the following exception. In the CY 2026 PFS proposed rule (90 FR 32692, and 32859), we included somewhat duplicative proposed amendments to the phrasing in Sec. 425.652(a)(9)(v). For clarity and to ensure accurate implementation of the amendments in the regulations: (1) we are finalizing our proposal to remove from Sec. 425.652(a)(9)(v) the phrase “HEBA scaler used in calculating the HEBA under Sec. 425.662(b)(2)” and add in its place the phrase “scaler used in calculating the population adjustment under Sec. 425.662(b)(2)”; and (2) we are not finalizing our proposal to remove from Sec. 425.652(a)(9)(v) the phrase “HEBA” and add in its place the phrase “population adjustment.” 9. Shared Savings Program Quality Reporting Monitoring Provisions a. Overview

In the CY 2026 PFS proposed rule (90 FR 32692 through 32694), we proposed to revise our regulations at Sec. 425.316(c)(2) related to monitoring of ACOs for compliance with the quality performance standards. Relatedly, we proposed to revise Sec. 425.224(b)(1)(ii)(A) related to reviewing applications for renewing and re-entering ACOs. We explained that the purpose of these proposed changes is to revise our regulations to ensure that ACOs continue to satisfy program requirements or to identify a pattern of noncompliance with ACOs meeting both the quality performance standard and the alternative quality performance standard. We stated our belief that these revisions would not significantly impact the program as currently implemented. b. Background

In the CY 2021 PFS final rule (85 FR 84740 through 84743), we finalized changes to the Shared Savings Program quality performance standard and quality reporting requirements for performance years beginning on January 1, 2021. The regulation we finalized at Sec. 425.316(c)(2) aligned the Shared Savings Program quality reporting requirements with the requirements that applied under the APP under the Quality Payment Program (85 FR 85039 and 85040). We have subsequently updated the quality performance standard and reporting requirements through rulemaking in the CYs 2022, 2023, 2024, and 2025 PFS final rules (86 FR 65255 through 65272, 87 FR 69860 through 69863, 88 FR 79112 through 79114, and 89 FR 98101 through 98132, respectively).

In the CY 2023 PFS final rule (87 FR 70234), we finalized an alternative quality performance standard at Sec. 425.512(a)(4)(ii) and (a)(5)(ii) for performance year 2023 and subsequent performance years. Specifically, to meet the alternative quality performance standard for performance year 2025 and subsequent years as described at Sec. 425.512(a)(5)(ii)(B), an ACO must report quality data on the APP Plus quality measure set established at Sec. 414.1367 according to the method of submission established by CMS and achieve a quality performance score equivalent to or higher than the 10th percentile of the performance benchmark on at least one of the outcome measures in the APP Plus quality measure set. An ACO that does not meet the quality performance standard but does meet the alternative

quality performance standard is eligible to share in savings on a sliding scale as described at Sec. Sec. 425.605 and 425.610. Additionally, ACOs that do not meet both the quality performance standard and the alternative quality performance standard are not eligible for shared savings and will have a shared loss rate not exceeding 75 percent as described at Sec. 425.610(f)(3)(ii) for performance year 2023 and subsequent performance years.

The PHE for COVID-19 was in effect starting in January 2020 and expired on May 11, 2023.\427\ All Shared Savings Program ACOs were deemed affected by the PHE for COVID-19 under the program's quality EUC policy for performance years 2022 and 2023 as defined at Sec. 425.512(c) and were determined to have met the quality performance standard at Sec. 425.512(a) (85 FR 84746). ACOs received a minimum quality performance score equal to the 30th percentile Merit-based Incentive Payment System (MIPS) Quality performance category score in PY 2022, and a score equal to the equivalent of the 40th percentile in PY 2023 across all MIPS Quality performance category scores, excluding entities/providers eligible for facility-based scoring. ACOs that were able to successfully report quality data received the higher of their own MIPS Quality performance category score (adjusted for health equity for performance year 2023, if applicable) or the applicable 30th percentile score. As such, all ACOs that qualified for shared savings for performance years 2022 and 2023 were eligible to receive the maximum sharing rate for their track (or performance level within a track) and, for performance year 2022, any shared losses determined to be owed to CMS using either a fixed (BASIC track) or scaled loss rate (ENHANCED track) were fully offset by the EUC policy and any shared losses determined for performance year 2023 were reduced by a least five-twelfths.

\427\ See Administration for Strategic Preparedness & Response website, Declarations of a Public Health Emergency web page, at https://aspr.hhs.gov/legal/PHE/pages/default.aspx (listing declarations of a public health emergency, among other information). See also U.S. Department of Health and Human Services website, COVID-19 Public Health Emergency web page, available at https://www.hhs.gov/coronavirus/covid-19-public-health-emergency/index.html.

To ensure that the ACO continues to satisfy Shared Savings Program requirements, CMS monitors and assesses the performance of ACOs, their ACO participants, and ACO providers/suppliers. The monitoring policies at Sec. 425.316(c) apply to compliance with quality performance standards. To identify ACOs that are not meeting the quality performance standards, we will review an ACO's submission of quality measurement data at Sec. Sec. 425.500 or 425.512. Currently, as specified at Sec. 425.316(c)(2)(i), if the ACO fails to meet the quality performance standard, we may take one or more of the actions prior to termination specified at Sec. 425.216. As further specified at Sec. 425.316(c)(2)(i), depending on the nature and severity of the noncompliance, we may forgo pre-termination actions and may immediately terminate the ACO's participation agreement at Sec. 425.218. While Sec. 425.316(c)(2) addresses the quality performance standard, it failed to acknowledge the alternative quality performance standard. When we established the alternative quality performance standard in the CY 2023 PFS final rule, we inadvertently did not also propose to modify the corresponding monitoring policies at Sec. 425.316(c)(2). Due to the quality EUC policies in effect until 2023, we did not encounter this discrepancy when monitoring ACO compliance with quality performance standards. c. Revisions

In the CY 2026 PFS proposed rule (90 FR 32693 through 32694), we proposed to add Sec. 425.316(c)(3) to apply to performance years beginning on or after January 1, 2026. Further, the text of the proposed regulation in the CY 2026 PFS proposed rule (90 FR 32854) included a proposed revision to the introductory text of Sec. 425.316(c)(2), to limit the applicability of this provision to performance years beginning on or after January 1, 2021 and before January 1, 2026, that was not described in preamble. Although the proposal was accidentally omitted from the preamble, this revision was proposed in the proposed regulatory text and we are finalizing as proposed. Under our proposal, if an ACO fails to meet both the quality performance standard and the alternative quality performance standard, as determined at Sec. 425.512, we would be authorized to take one or more of the actions prior to termination as specified at Sec. 425.216. Under the proposal, if an ACO is unable to meet the quality performance standard, then the ACO could still meet the alternative quality performance standard without CMS taking one of the prescribed actions prior to termination. We explained our belief that if an ACO fails to meet both standards, it would be appropriate for CMS to take one of the actions described at Sec. 425.216 (provide a warning notice to the ACO, request a corrective action plan from the ACO, or place the ACO on a special monitoring plan) for noncompliance with the quality performance standards. We explained that we inadvertently did not modify the monitoring portion of the regulation, Sec. 425.316(c), when we established the alternative quality performance standard in the CY 2023 PFS final rule, and stated our belief that it would be appropriate to revise the regulation at Sec. 425.316(c) to be consistent with our longstanding practice to monitor ACOs for their compliance with our quality reporting and quality performance standard requirements. Specifically, we proposed to add a new paragraph (c)(3) to Sec. 425.316 to recognize that, for performance years beginning on or after January 1, 2026, if an ACO fails to meet both the quality performance standard and the alternative quality performance standard, as determined at Sec. 425.512, CMS may take one or more of the actions prior to termination specified at Sec. 425.216. Additionally, in keeping with our established policies at Sec. 425.316(c)(2)(ii), we proposed to continue to terminate an ACO's participation agreement if it: (1) fails to meet both the quality performance standard and alternative quality performance standard for 2 consecutive PYs within an agreement period; (2) fails to meet both the quality performance standard and alternative quality performance standard for any 3 performance years within an agreement period, regardless of whether the years are in consecutive order; (3) are a renewing ACO or re-entering ACO that fails to meet both the quality performance standard and alternative quality performance standard for the last performance year of the ACO's previous agreement period and this occurrence was either the second consecutive performance year of failed quality performance or the third nonconsecutive performance year of failed quality performance during the previous agreement period; or (4) are a renewing ACO or re-entering ACO fails to meet both the quality performance standard and alternative quality performance standard for 2 consecutive performance years across 2 agreement periods, specifically the last performance year of the ACO's previous agreement period and the first performance year of the ACO's new agreement period.

As part of the Shared Savings Program application process, we identify applicant ACOs that have previously participated in the Shared Savings Program. If the applicant ACO has a history of noncompliance with the requirements of the Shared Savings Program, we may request the ACO

demonstrate that it has corrected the deficiencies that caused any noncompliance under their previous participation agreement (Sec. 425.224(b)(1)(iii)). The list of criteria we review for previous noncompliance includes, but is not limited to, whether the ACO demonstrated a pattern of failure to meet the quality performance standards, whether, for 2 PYs, the average per capita Medicare Parts A and B fee-for-service expenditures for the ACO's assigned beneficiary population exceeded its updated benchmark, whether the ACO failed to repay shared losses in full within 90 days, and whether the ACO failed to repay shared losses for any performance year while participating under a model authorized under section 1115A of the Act. In alignment with our proposed revisions to Sec. 425.316(c), we also proposed to modify Sec. 425.224(b)(1)(ii)(A) to include the alternative quality performance standard. Specifically, we proposed to modify Sec. 425.224(b)(1)(ii)(A) to state that, as part of the factors we evaluate when determining whether to approve a renewing ACO's or re-entering ACO's application, we will evaluate whether the ACO demonstrated a pattern of failure to meet the quality performance standard and alternative quality performance standard (if applicable), or met any of the criteria for termination at Sec. 425.316(c)(1)(ii), (c)(2)(ii), or (c)(3)(ii).

We solicited comments on these proposals.

We received a public comment on these proposals summarized below.

Comment: A commenter who opposed to the proposal stated that they objected to an ACO's termination from the Shared Savings Program for failure to meet quality performance standards in more than one performance year, as described under Sec. 425.316(c)(3)(ii), and suggested instead that a termination be decided on a case-by-case basis.

Response: The Shared Savings Program seeks to both improve quality performance and reward high quality, while reducing the growth in Medicare spending. As we explained in the CY 2021 PFS final rule (see 85 FR 84743), in which we finalized the existing requirements under Sec. [thinsp]425.316(c), and we continue to believe, requirements for enforcing compliance with the quality performance standard help to hold ACOs accountable for the quality of the care they furnish to their beneficiaries and further encourage ACOs to demonstrate consistently that they are providing high quality of care to their beneficiary populations year over year. As we explained in the CY 2021 PFS final rule (85 FR 84743), in which we finalized the existing requirements under Sec. [thinsp]425.316(c), and we continue to believe, requirements for enforcing compliance with the quality performance standard help to hold ACOs accountable for the quality of the care they furnish to their beneficiaries and further encourage ACOs to demonstrate consistently that they are providing high quality of care to their beneficiary populations year over year. We believe these important objectives would continue to be further reinforced under the proposed revisions to the Shared Savings Program requirements allowing for CMS to take compliance action when an ACO fails to meet the quality performance standard and the alternative quality performance standard.

The commenter appears to have misunderstood the intent of the proposal. Our intent is to only add a reference to the alternative quality performance standard, but it is not to modify the operations of the existing monitoring policy. Under the proposed approach, we would apply the existing requirements under Sec. 425.316(c)(2) for performance years beginning on or after January 1, 2021 and before January 1, 2026; and we would apply the new requirements under new Sec. 425.316(c)(3), for performance years beginning on or after January 1, 2026.

After consideration of a public comment received, we are finalizing as proposed to add new Sec. 425.316(c)(3) with quality reporting monitoring requirements that will apply for performance years beginning on or after January 1, 2026. In accordance withSec. 425.316(c)(3)(i), if an ACO fails to meet both the quality performance standard and the alternative quality performance standard, CMS may take one or more of the actions prior to termination specified at Sec. 425.216. Depending on the nature and severity of the noncompliance, CMS may forgo pre- termination and may immediately terminate the ACO's participation agreement under Sec. 425.218. Specifically, in new Sec. 425.316(c)(3)(ii)(A), CMS may terminate an ACO's participation agreement if the ACO fails to meet both the quality performance standard and the alternative quality performance standard for 2 consecutive years within an agreement period. In new Sec. 425.316(c)(3)(ii)(B), CMS may terminate an ACO's participation agreement if the ACO fails to meet both the quality performance standard and the alternative quality performance standard for any 3 performance years within an agreement period, regardless of whether the years are in consecutive order. Additionally, in new Sec. 425.316(c)(3)(ii)(C), CMS may terminate an ACO's participation agreement for a renewing ACO or re-entering ACO if the ACO fails to meet both the quality performance standard and the alternative quality performance standard for the last performance year of the ACO's previous agreement period and this occurrence was either the second consecutive performance year of failed quality performance or the third nonconsecutive performance year of failed quality performance during the previous agreement period. Lastly, under new Sec. 425.316(c)(3)(ii)(D), CMS may terminate an ACO's participation agreement for a renewing ACO or re-entering if the ACO fails to meet both the quality performance standard and the alternative quality performance standard for 2 consecutive performance years across 2 agreement periods, specifically the last performance year of the ACO's previous agreement period and the first performance year of the ACO's new agreement period.

Further, the text of the proposed regulation in the CY 2026 PFS proposed rule (90 FR 32854) included a proposed revision to the introductory text of Sec. 425.316(c)(2), to limit the applicability of this provision to performance years beginning on or after January 1, 2021 and before January 1, 2026, that was not described in preamble. This change is necessary so that we can effectuate the new Sec. 425.316(c)(3) as explained in the proposed rule and its regulatory text to apply for performance years beginning on or after January 1, 2026. We received no comments addressing the proposed revision to Sec. [thinsp]425.316(c)(2) introductory text, and we are finalizing this change without modification.

We did not receive any public comments on our proposal to amend Sec. 425.224(b)(1)(ii)(A) to include the alternative quality performance standard. We are finalizing our proposal, without modification, to revise Sec. 425.224(b)(1)(ii)(A) to state that, as part of the factors we evaluate when determining whether to approve a renewing ACO's or re-entering ACO's application, we will evaluate whether the ACO demonstrated a pattern of failure to meet the quality performance standard and alternative quality performance standard (if applicable), or met any of the criteria for termination at Sec. 425.316(c)(1)(ii), (c)(2)(ii), or (c)(3)(ii).

Section 1861(s)(7) of the Act establishes an ambulance service as a Medicare Part B service where the use

of other methods of transportation is contraindicated by the individual's condition, but only to the extent provided in regulations. Our regulations relating to coverage for ambulance services are set forth at 42 CFR part 410, subpart B. Since April 1, 2002, payment for ambulance services has been made under the ambulance fee schedule (AFS), which the Secretary established, as required by section 1834(l) of the Act, in 42 CFR part 414, subpart H. Payment for an ambulance service is made at the lesser of the actual billed amount or the AFS amount, which consists of a base rate for the level of service, a separate payment for mileage to the nearest appropriate facility, a geographic adjustment factor (GAF), and other applicable adjustment factors as set forth at section 1834(l) of the Act and Sec. 414.610. In accordance with section 1834(l)(3) of the Act and Sec. 414.610(f), the AFS rates are adjusted annually based on an inflation factor. (For a discussion about the ambulance inflation factor (AIF), please see CY 2011 PFS final rule (75 FR 73397). We stated in the CY 2011 PFS final rule that the AIF will be announced by instruction and on the CMS website. AIF transmittals are available on CMS' website: https://www.cms.gov/medicare/payment/fee-schedules/ambulance/afs-regulations-and-notices and in the Medicare Claims Processing Manual, Chapter 15, section 20.4). The AFS also incorporates two permanent add-on payments at Sec. 414.610(c)(5)(i) and three temporary add-on payments at Sec. 414.610(c)(1)(ii) and (c)(5)(ii) to the base rate and/or mileage rate. 2. Ambulance Extender Provisions a. Amendment to Section 1834(l)(13) of the Act

Section 146(a) of the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA) (Pub. L. 110-275, enacted July 15, 2009), amended section 1834(l)(13) of the Act to specify that, effective for ground ambulance services furnished on or after July 1, 2008, and before January 1, 2010, the ambulance fee schedule amounts for ground ambulance services shall be increased as follows:

For covered ground ambulance transports that originate in a rural area or in a rural census tract of a metropolitan statistical area, the fee schedule amounts shall be increased by 3 percent.

For covered ground ambulance transports that do not originate in a rural area or in a rural census tract of a metropolitan statistical area, the fee schedule amounts shall be increased by 2 percent.

The payment add-ons under section 1834(l)(13) of the Act have been extended several times. Section 3203 of the American Relief Act of 2025 (Pub. L. 118-158, December 21, 2024) extended these provisions through March 31, 2025. Most recently, section 2203 of the Full-Year Continuing Appropriations and Extensions Act, 2025 (Pub. L. 119-4, March 15, 2025) amended section 1834(l)(13) of the Act to extend the payment add-ons through September 30, 2025. Thus, these payment add-ons apply to covered ground ambulance transports furnished before October 1, 2025. We proposed to revise Sec. 414.610(c)(1)(ii) to conform the regulations to this statutory requirement. (For a discussion of past legislation extending section 1834(l)(13) of the Act, please see the CY 2014 PFS final rule with comment period (78 FR 74438 through 74439), the CY 2015 PFS final rule with comment period (79 FR 67743), the CY 2016 PFS final rule with comment period (80 FR 71071 through 71072), the CY 2019 PFS final rule with comment period (83 FR 59681 through 59682), and the CY 2024 PFS final rule with comment period (88 FR 79292-79293)).

This statutory requirement is self-implementing. A plain reading of the statute requires only a ministerial application of the mandated rate increase and does not require any substantive exercise of discretion on the part of the Secretary.

We received a comment regarding this proposal. The following is the summary of this comment we received and our response.

Comment: A commenter supported the proposal and agreed with CMS that the statutory provision is self-implementing and that these provisions are essential to protect access to vital emergency and non- emergency medical care.

Response: We appreciate the commenter's support of these provisions.

After consideration of the public comment that we received, we are finalizing our proposal to revise Sec. 414.610(c)(1)(ii) to conform the regulations to this statutory requirement. b. Amendment to Section 1834(l)(12) of the Act

Section 414(c) of the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA) (Pub. L. 108-173, December 8, 2003) added section 1834(l)(12) to the Act, which specified that, in the case of ground ambulance services furnished on or after July 1, 2004, and before January 1, 2010, for which transportation originates in a qualified rural area (as described in the statute), the Secretary shall provide for a percent increase in the base rate of the fee schedule for such transports. The statute requires this percent increase to be based on the Secretary's estimate of the average cost per trip for such services (not taking into account mileage) in the lowest quartile of all rural county populations as compared to the average cost per trip for such services (not taking into account mileage) in the highest quartile of rural county populations. Using the methodology specified in the July 1, 2004, interim final rule (69 FR 40288), we determined that this percent increase was equal to 22.6 percent. As required by the MMA, this payment increase was applied to ground ambulance transports that originated in a “qualified rural area,” that is, to transports that originated in a rural area comprising the lowest 25th percentile of all rural populations arrayed by population density. For this purpose, rural areas included Goldsmith areas (a type of rural census tract). This rural bonus is sometimes referred to as the “Super Rural Bonus” and the qualified rural areas (also known as “super rural” areas) are identified during the claims process via the use of a data field included in the CMS-supplied ZIP code file.

The Super Rural Bonus under section 1834(l)(12) of the Act has been extended several times. Section 3203 of the American Relief Act of 2025 extended this provision through March 31, 2025. Most recently, section 2203 of the Full-Year Continuing Appropriations and Extensions Act, 2025 amended section 1834(l)(12)(A) of the Act to extend this rural bonus through September 30, 2025. Therefore, we are continuing to apply the 22.6 percent rural bonus described in this section (in the same manner as in previous years) to ground ambulance services with dates of service before October 1, 2025, where transportation originates in a qualified rural area. Accordingly, we proposed to revise Sec. 414.610(c)(5)(ii) to conform the regulations to this statutory requirement. (For a discussion of past legislation extending section 1834(l)(12) of the Act, please see the CY 2014 PFS final rule with comment period (78 FR 74439 through 74440), CY 2015 PFS final rule with comment period (79 FR 67743 through 67744), the CY 2016 PFS final rule with comment period (80 FR 71072), the CY 2019 PFS final rule with comment period (83 FR 59682) and the

CY 2024 PFS final rule with comment period (88 FR 79293)).

This statutory provision is self-implementing. It requires an extension of this rural bonus (which was previously established by the Secretary) through September 30, 2025, and does not require any substantive exercise of discretion on the part of the Secretary.

We received a few comments regarding this proposal. The following is the summary of the comments we received and our response.

Comment: A commenter supported the proposal and agreed with CMS that the statutory provision is self-implementing and that these provisions are essential to protect access to vital emergency and non- emergency medical care. Another commenter supported the proposal and stated that the policy is essential for protecting rural communities and that rural ambulance providers rely on this add-on payment as they often do not have an adequate patient volume to remain in business.

Response: We appreciate the commenters' support of these provisions.

After consideration of the public comments that we received, we are finalizing our proposal to revise Sec. 414.610(c)(5)(ii) to conform the regulations to this statutory requirement.