Hospital Inpatient Quality Reporting (IQR) Program: Measures, Calendar, and the Payment-Update Penalty

The Hospital Inpatient Quality Reporting (IQR) Program is the measure-collection engine underneath most of what a hospital’s quality department reports on. It is a pay-for-reporting program, not a pay-for-performance one: CMS does not pay or penalize a hospital based on how good its infection rates, mortality rates, or patient-experience scores are through IQR itself — it penalizes a hospital for failing to submit the required data completely and on time. That distinction matters because IQR is also the upstream data source for three programs that do score performance: the Hospital Value-Based Purchasing (VBP) Program, the HAC Reduction Program, and the CMS Overall Hospital Quality Star Rating. For infection preventionists, patient-safety officers, quality directors, and risk managers, IQR is where the data-completeness discipline has to start — a gap here doesn’t just risk IQR’s own penalty, it can propagate into every downstream program reading the same submission.

This guide covers the current measure set by category, the submission calendar, how CMS validates what’s submitted, and the specific statutory mechanism behind the annual payment update (APU) penalty for hospitals that don’t participate or don’t submit completely.

Who Has to Participate

IQR applies to subsection (d) hospitals — short-term acute-care hospitals paid under the Inpatient Prospective Payment System (IPPS). A hospital that wants to participate (or continue participating) registers on QualityNet, designates a QualityNet security official, and submits a Notice of Participation — by December 31 of the calendar year before the first quarter it will submit data for a first-time or rejoining hospital, or within 180 days of a new CCN’s QIES open date for a newly enrolled facility (42 CFR §412.140(a)). A hospital that hits an event outside its control — a natural disaster, a system outage — can request an Extraordinary Circumstance Exception (ECE) within 60 calendar days of the event (§412.140(c)(2)).

Facilities outside IPPS, including many critical access hospitals, generally sit outside Hospital IQR specifically, though they may face parallel HAI-reporting obligations through a state statute or a program of their own — the reporting requirement’s source matters for knowing which measure set actually applies to a given facility.

The Current Measure Set, by Category

“IQR measures” is not one list — it’s several structurally different reporting mechanisms bundled under one program, each with its own submission method and its own validation standard. CASRAI covers each category’s mechanics in depth elsewhere; this section maps how they fit together under IQR specifically.

• Chart-abstracted measures. A hospital’s own staff (or a contracted abstractor) manually reviews medical records against detailed clinical criteria and submits the results. As of the most recent CMS specifications update, SEP-1 (the Severe Sepsis and Septic Shock Management Bundle) is the only chart-abstracted measure remaining in the Hospital IQR measure set — see CASRAI’s SEP-1 guide for the bundle elements and abstraction traps, and the general chart abstraction methodology guide for how sampling and inter-rater reliability work across chart-abstracted measures generally.
• Electronic clinical quality measures (eCQMs). Measures calculated automatically from structured EHR data and submitted as QRDA Category I files, covering areas such as opioid safety, obstetric complications, and a growing set of “Hospital Harm” patient-safety eCQMs (severe hypoglycemia/hyperglycemia, pressure injury, acute kidney injury, falls with injury, among others). The mandatory eCQM set has been expanding year over year by rule, layered onto a fixed number of self-selected slots. Full measure list, IDs, and submission mechanics are in CASRAI’s eCQM reporting guide; note that a hospital with genuinely no qualifying patients for a measure still submits successfully via a zero-denominator declaration, not an exception request.
• Claims-based outcome measures. Measures such as 30-day mortality and complication rates for specific conditions are calculated by CMS directly from Medicare claims data already on file — hospitals don’t separately submit these to IQR, which is why they don’t show up on an abstraction or eCQM to-do list even though they’re part of the same measure set.
• Healthcare-associated infection (HAI) measures via NHSN. CLABSI, CAUTI, SSI (colon and abdominal hysterectomy procedures), MRSA bacteremia and C. difficile LabID events, and the Healthcare Personnel Influenza Vaccination Summary all flow through NHSN’s Patient Safety Component and count toward IQR compliance. This is the same NHSN feed the HAC Reduction Program and VBP draw from downstream — see CASRAI’s NHSN reporting requirements guide for the monthly reporting-plan mechanics and submission-window details, which this guide does not repeat.
• HCAHPS (patient experience). The HCAHPS survey is administered continuously by a CMS-approved vendor and its results both satisfy IQR’s patient-experience reporting requirement and feed the Person and Community Engagement domain of the VBP Total Performance Score.

Because this set changes by annual IPPS rulemaking, treat any specific measure count as a snapshot: the FY 2026 final rule, for example, removed four previously-required measures (COVID-19 Vaccination Coverage Among Health Care Personnel, Hospital Commitment to Health Equity, and the two Screening for Social Drivers of Health measures). Confirm the current-year list against the CMS Hospital IQR Specifications Manual before finalizing a reporting plan rather than carrying forward a prior year’s scope.

The Submission Calendar

Each measure type runs on its own cycle:

• NHSN HAI data is entered on a rolling basis throughout the quarter, with a hard CMS cutoff that has generally landed roughly four and a half months after the quarter closes in recent program years — treat that as a planning baseline and confirm the exact date in the current Specifications Manual, not from memory.
• eCQMs are submitted annually, with a March 1 deadline following the calendar-year reporting period, using measure specifications published a full year ahead in CMS’s Annual Update.
• Chart-abstracted data (SEP-1) follows a quarterly abstraction-and-submission cycle aligned to the same general specifications-manual calendar.
• HCAHPS is administered and submitted continuously by the vendor rather than in discrete quarterly batches.

The practical risk isn’t usually forgetting a deadline outright — it’s a stale NHSN monthly reporting plan (a new unit that was never added, a merged unit still listed under its old name) quietly producing an incomplete quarter that isn’t caught until CMS pulls the data.

How CMS Validates What’s Submitted

Reporting the data isn’t the same as CMS accepting it as valid. IQR runs two structurally different validation standards, and one of them is scheduled to change:

• Chart-abstracted measures (SEP-1): a hospital meets the validation requirement by achieving a 75-percent accuracy score on a sample of its submitted records, re-abstracted independently and compared against the hospital’s own submission.
• eCQMs: the standard is currently a production test, not an accuracy test. Prior to the FY 2028 payment determination, a hospital meets the eCQM validation requirement by submitting 100 percent of its sampled eCQM medical records in a timely and complete manner — CMS is checking that the records exist and arrive, not yet scoring their accuracy. Starting with the FY 2028 payment determination, that changes to the same 75-percent accuracy-score standard used for chart-abstracted measures (42 CFR §412.140(d)(2)). That’s a change in kind, not just degree, and it’s easy to miss in secondary coverage.

Whichever standard applies, when CMS requests medical records for validation, the hospital has 30 days from the date of the written request to produce them (§412.140(d)(1)) — a short enough window that “which patient-safety or HIM staffer owns validation record requests” needs to be a named responsibility before a request lands, not decided after.

Why the Measure Set Changes Every Year

CMS can only remove a measure from Hospital IQR through one of eight codified factors (§412.140(g)(3)(i)): it’s topped out, no longer aligned with current clinical guidelines, superseded by a more broadly applicable or more clinically proximal measure, doesn’t demonstrably improve outcomes, is duplicative of a more strongly associated measure, produces negative unintended consequences beyond patient harm, isn’t feasible to implement as specified, or its reporting costs outweigh its benefit. “Topped out” has a specific numeric definition, and both conditions must hold: the gap between the 75th and 90th percentile of hospital performance has to sit within twice the standard error of the full dataset, and the truncated coefficient of variation has to be 0.10 or less. Separately, CMS can remove a measure immediately, without notice-and-comment rulemaking, if it identifies a specific patient-safety concern with the measure itself — announced through the IQR ListServ and QualityNet rather than the annual IPPS rule.

The Annual Payment Update Penalty

The IQR penalty is narrower and more mechanical than the VBP or HAC Reduction penalties, and it’s worth being precise about what it actually does. Under section 1886(b)(3)(B)(viii) of the Social Security Act, a subsection (d) hospital that does not meet Hospital IQR’s participation and data-submission requirements for a given fiscal year has its applicable percentage increase — the annual market basket update — reduced by one-quarter for that FY. It is not eliminated, and it is not scaled to how badly the hospital missed the requirement: any hospital that fails to meet the requirement loses the same one-quarter share of that year’s update, full stop.

Two things this penalty is not:

• It is not performance-based. A hospital with poor infection rates or poor SEP-1 bundle compliance that still reports completely and on time keeps its full market basket update under IQR — performance is what VBP and the HAC Reduction Program are for, using this same underlying data.
• It is not the same mechanism as the Promoting Interoperability penalty, even though both attach to the same annual payment update. A hospital that isn’t a meaningful EHR user under the Promoting Interoperability Program (which itself depends in part on successful eCQM submission) has three-quarters of its applicable percentage increase reduced, under a separate statutory provision, §1886(b)(3)(B)(ix) — see CASRAI’s Promoting Interoperability guide for that mechanism. A hospital that fails both IQR and Promoting Interoperability in the same year is exposed to both reductions against the same base update, not one or the other.

The Umbrella: How IQR Data Becomes VBP, HAC, and Star Rating Scores

IQR’s own penalty is about completeness, but the data it collects is what makes three performance-scoring programs possible at all:

• The Hospital VBP Program draws its measure set directly from IQR-specified measures (readmission measures are excluded by rule) and folds a subset of the same claims, HCAHPS, and NHSN-derived data into domain scores that redistribute a portion of Medicare payment.
• The HAC Reduction Program converts the same NHSN HAI data into Standardized Infection Ratios and combines them with AHRQ PSI-90 claims data — see CASRAI’s AHRQ Patient Safety Indicators guide — into the Total HAC Score that determines the worst-performing quartile’s payment cut.
• The CMS Overall Hospital Quality Star Rating is built substantially from IQR-reported measure groups (mortality, safety of care, readmission, patient experience, and timely/effective care), scored through a latent-variable model and published on Care Compare.

The practical consequence: a single gap in an underlying NHSN submission, a missed denominator, or a late correction doesn’t just risk IQR’s own one-quarter payment-update reduction. Because HAC Reduction and VBP scoring read from the same submitted dataset, that same gap can distort a Standardized Infection Ratio or a domain score months or years after the original reporting quarter closed — which is the argument for treating IQR data completeness as one cross-program compliance responsibility owned by a single person, rather than three programs’ compliance staff independently discovering the same root problem.

Frequently Asked Questions

Is Hospital IQR the same thing as Hospital VBP?

No. IQR is pay-for-reporting: CMS penalizes incomplete or late submission, not poor performance. VBP is pay-for-performance: it uses a subset of the same IQR-specified data to score hospitals against each other and redistribute Medicare payment based on relative results. A hospital can be fully IQR-compliant and still score poorly on VBP, and vice versa on a technicality — they’re separate programs reading overlapping data for different purposes.

What happens if a hospital misses one required measure for one quarter?

The immediate consequence runs through IQR itself: an incomplete or late submission for a required measure can result in the hospital being scored non-compliant for that reporting period, risking the one-quarter reduction to that year’s annual payment update. Because the same underlying data (particularly NHSN HAI data) also feeds the HAC Reduction Program’s Standardized Infection Ratios and the VBP domain scores, an incomplete submission can distort those downstream scores independently of the direct IQR penalty.

Does IQR penalize a hospital for bad clinical outcomes?

Not directly. IQR only checks whether the required measures were submitted completely and on time. A hospital with a high CLABSI rate or low SEP-1 bundle compliance is still IQR-compliant if it reported that data completely — the outcome itself is scored by HAC Reduction and VBP, not by IQR.

How is the IQR penalty different from the Promoting Interoperability penalty?

Both reduce the same annual market basket update, but under separate statutory provisions and at different rates: IQR non-compliance cuts the update by one-quarter (§1886(b)(3)(B)(viii)); failing to be a meaningful EHR user under Promoting Interoperability cuts it by three-quarters (§1886(b)(3)(B)(ix)). A hospital that fails both in the same year is exposed to both reductions against the same base update.

Do critical access hospitals have to participate in Hospital IQR?

Hospital IQR applies to subsection (d) hospitals paid under IPPS. Many critical access hospitals sit outside that payment system and outside IQR specifically, though they may still face HAI or quality-reporting obligations through a state statute or a different CMS reporting mechanism — the source of the requirement determines which measure set actually applies.

This guide is a planning reference for infection-prevention and quality teams, not a substitute for the current-year CMS Hospital IQR Specifications Manual, which is the authoritative source for the exact required measure list, validation sample selection, and submission deadlines for any given program year.