The SAFER Guides attestation for 2026: what MIPS clinicians (and hospitals) actually have to do

A practice can have its Security Risk Analysis in good order and still realize, sometime in December, that nobody has touched the SAFER Guide. The measure is easy to overlook because it carries no points. But it is required, and for 2026 the version and the rules have both changed enough that last year's approach may not hold up.

What the SAFER Guides are

SAFER stands for Safety Assurance Factors for EHR Resilience. The guides are recommended practices for making electronic health records safer to use: how the system is set up, how clinicians use it day to day, and how an organization watches for problems. They are published by HHS through the Assistant Secretary for Technology Policy and the Office of the National Coordinator (ASTP/ONC) on the SAFER Guides page at healthit.gov.

ASTP released revised versions in 2025, described as updated and streamlined to focus on the highest risk and most common issues. The current set has eight guides in three groups:

• Foundational: High Priority Practices and Organizational Responsibilities. The Organizational Responsibilities guide now includes guidance on AI-enabled systems and EHRs with AI features.
• Infrastructure: Contingency Planning and System Management.
• Clinical process: Patient Identification; Computerized Provider Order Entry with Decision Support; Test Results Reporting and Follow-Up; and Clinician Communication.

The High Priority Practices guide pulls 16 recommendations from the other seven into one document. Each recommendation has a worksheet, and the 2025 versions rate implementation on a five-level scale, from "Not Implemented" up to "Fully Implemented," with a box to note when your EHR itself cannot support a practice.

What MIPS clinicians have to do in 2026

The 2026 CMS measure specification is short, and every line of it matters:

• The guide: the 2025 High Priority Practices SAFER Guide. Not an older edition, and not a different guide.
• The answer: it is a yes or no attestation, and you must answer "Yes." CMS states that failing to report a "Yes" results in no score for the Promoting Interoperability category, even if every other measure is reported. A "No" is not an acceptable answer for 2026, and it was not acceptable in 2024 or 2025 either.
• The timing: any time during the 2026 calendar year. The self-assessment is not restricted to your 180-day reporting period.
• The scoring: none. The measure is required but earns no points and no bonus.
• Groups: if you report as a group, virtual group, or APM Entity, the entity attests, and that answer applies to every clinician in it. CMS also says the self-assessment should be completed for each certified EHR product used to report the category.

CMS asks you to complete the checklist and practice worksheet at the front of the guide. You are not required to have each practice fully implemented, and you are not scored on how many you have. What "Yes" means is that you did the assessment honestly, during the year.

What hospitals and CAHs have to do

The hospital requirement is broader. Under the FY 2026 IPPS final rule, CMS modified the SAFER Guides measure so that eligible hospitals and critical access hospitals must attest "Yes" to an annual self-assessment using all eight of the 2025 SAFER Guides, beginning with the CY 2026 EHR reporting period.

The CY 2026 hospital specifications manual lists the measure as required and not scored. The self-assessment can happen at any point during the calendar year in which the reporting period falls, and hospitals are expected to complete the checklist and practice worksheet at the beginning of each guide, as applicable to the facility. The manual is direct about the consequence: a "No" on any required attestation results in a downward payment adjustment. Because the measure is unscored, a strong score on everything else does not make up for it.

For a small or critical access hospital, eight guides is a real workload. The clinical process guides need input from nursing, pharmacy, lab, and medical staff; contingency planning and system management need IT and your EHR vendor. CY 2026 data is due through the HQR Secure Portal by March 1, 2027, but the self-assessment itself has to be finished by December 31, 2026.

How it differs from the Security Risk Analysis

Both measures sit under the same Promoting Interoperability objective, and both are required yes or no attestations, so they get confused. They answer different questions.

The Security Risk Analysis measure comes from the HIPAA Security Rule. It asks whether you have identified and managed risks to the confidentiality, integrity, and availability of electronic protected health information. For 2026 it has two attestations: that you conducted or reviewed a security risk analysis, and that you conducted security risk management activities.

The SAFER Guides are about patient safety and EHR resilience: whether the right patient is selected, whether test results get followed up, whether you can keep working when the system goes down. There is some overlap, mostly in contingency planning and system management, but a completed risk analysis is not a SAFER self-assessment, and the reverse is also true. Each needs its own work and its own documentation.

What to keep for an audit

You do not submit the completed guide to CMS. You attest. But CMS selectively audits MIPS clinicians and groups each year, and the regulation at 42 CFR 414.1390 requires you to keep the data and information supporting your submission for six years from the end of the performance period. CMS's own SAFER Guide fact sheet recommends keeping your assessment in case of audit.

CMS does not publish a list of what that file should contain. In our view, a defensible record includes:

• The completed, saved copy of each guide (the 2025 version), including the checklist and the worksheets.
• The date or dates the assessment was done, showing it fell within 2026.
• Who took part, by name and role.
• Which certified EHR product or products the assessment covered.
• The follow-up actions you identified, with an owner for each.
• A short sign-off from the person responsible for the attestation.

Common mistakes

• Using an old version. The 2026 specifications for both programs call for the 2025 guides. Be aware that the healthit.gov SAFER page still carries an older note saying the 2016 versions remain applicable to the CMS measures. For 2026, follow the CMS specifications.
• Treating "No" as the safe answer. For clinicians it zeroes the category. For hospitals it brings a payment adjustment.
• Thinking every practice must be in place before you can say "Yes." It does not. An honest "Making Progress" is far better than an assessment that never gets done.
• Hospitals completing only the High Priority Practices guide. That is the MIPS requirement. Hospitals need all eight.
• Assessing one EHR when you report from two. Groups that use more than one certified product should assess each one.
• Assuming the Security Risk Analysis covers it. It does not.
• Saving nothing. A "Yes" with no supporting record is hard to defend six years later.

Getting it done before December 31

1. Download fresh copies of the 2025 guides from healthit.gov. They are interactive PDFs you can fill in and save.
2. List your certified EHR products and decide which assessment covers which product.
3. Name a lead and a small team. The guide itself suggests an assessment team with a leader, drawing on clinicians, clinical administration, IT support, and your EHR vendor where needed. In a small practice that may be three people.
4. Put working sessions on the calendar now. December fills up with holidays and year-end closing. Hospitals should split the eight guides among the people who know each area, with one person pulling the results together.
5. Work through each practice using the worksheets, rate it honestly, and write down what you would need to do to improve.
6. Save, date, and sign the completed guides and store them with your other MIPS or Promoting Interoperability records.
7. Attest "Yes" when you submit, knowing the record behind it is complete.

We facilitate SAFER Guides self-assessments for practices and small hospitals, usually alongside the annual Security Risk Analysis, since the same people tend to be in the room for both. Whether you do it with us or on your own, the important part is the same: do it during 2026, do it with the right version, and keep the record.