A security risk analysis is required for a base score under the “Promoting Interoperability” category. Clinicians must fulfill the requirements of a base score measure to earn any score in the Promoting Interoperability score.
Under MIPS, clinicians must “Conduct or review a security risk analysis in accordance with the requirements in 45 CFR 164.308(a)(1), including addressing the security (to include encryption) of ePHI data created or maintained by certified electronic health record technology (CEHRT) in accordance with requirements in 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), and implement security updates as necessary and correct identified security deficiencies as part of the MIPS eligible clinician’s risk management process.”