Hardship exceptions: small-practice and EHR outage relief

What a hardship exception actually excuses

A hardship exception, when granted, reweights or excuses one or more MIPS performance categories from your final score — it does not exempt you from MIPS altogether, and it does not excuse you from licensure, billing, or HIPAA compliance obligations that exist independent of the quality-payment program. Confirm exactly which category an exception covers before assuming the rest of your reporting obligations disappeared with it.

The distinction matters because a solo who wins a hardship exception for Promoting Interoperability, for example, still has Quality and Improvement Activities to consider unless those categories were separately excused. Read the specific exception you're granted as a scoped reprieve for a named category, not a blanket pass, and keep documentation of exactly what was approved in case a later audit asks what you were and weren't required to report.

The two headline triggers: small-practice status and an EHR outage

Two circumstances come up most often for a solo behavioral-health practice: qualifying as a small practice under the program's size definitions, and a significant EHR event — an outage, a vendor failure, a forced migration — that genuinely prevented you from reporting a category. Both are common enough that it's worth knowing the shape of each before you need either.

Small-practice status is typically a standing circumstance you either qualify for or don't, based on your practice's size, rather than a one-time event you have to prove happened. An EHR-related hardship, by contrast, is usually tied to a specific, documentable event — a named outage window, a vendor's own incident report, a migration date — and the burden is on you to show the event actually prevented the specific reporting it excuses, not just that it was inconvenient.

Because the qualifying circumstances and the application windows for each of these change, and because a hardship exception interacts with other pathway decisions like the low-volume threshold and opting in, confirm the current year's specific criteria and deadline directly with the program rather than relying on last year's rule.

Don't confuse this with an information-blocking exception

A MIPS hardship exception and an information-blocking exception are unrelated programs that happen to share the word exception, and conflating them is an easy, costly mistake. The 21st Century Cures Act's information-blocking rule defines eight specific exceptions to when a practice may lawfully decline to share electronic health information — a completely different question from whether your MIPS score gets reweighted 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act's information-blocking rule defines eight specific exceptions, a distinct program from a MIPS hardship exception despite the shared word..

If an EHR outage is genuinely preventing you from releasing records on request, that's a question for the information-blocking framework's own exceptions, not for a MIPS hardship application — the two run through entirely different processes with different documentation requirements, and qualifying for one says nothing about qualifying for the other. Keep the two applications, and their supporting evidence, in separate files even when they're triggered by the same underlying outage, since a reviewer for one program has no reason to accept documentation built for the other.

An EHR outage doesn't excuse everything — what still applies

A hardship exception for a reporting category doesn't pause your underlying HIPAA obligations, which apply regardless of your MIPS status or your reporting burden that year. The Security Rule requires administrative, physical, and technical safeguards for ePHI at every practice size, scaled to your resources but never waived by a MIPS exception 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the HIPAA Security Rule's safeguard requirements apply at every practice size and are not waived by a MIPS hardship exception..

If your outage genuinely disrupted your ability to complete a required risk analysis, that's worth documenting as part of both your MIPS hardship application and your own compliance file — ONC and OCR publish a free Security Risk Assessment tool sized for a small practice, and completing it as soon as systems are restored closes the gap the outage created rather than leaving it open indefinitely 3Ref 3Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices, relevant to completing a risk analysis an outage disrupted.. An excused reporting category is not the same as an excused risk analysis, and treating them as equivalent is one of the more common ways a solo discovers, later, that a hardship exception didn't cover what they assumed it did.

Before the outage: what your EHR contract should already cover

The best time to reduce your exposure to an EHR-related hardship is before the outage, in the contract you sign with your vendor. ONC's EHR contracting guide flags data-access, termination, and liability terms worth negotiating before you sign, precisely because those are the terms that determine how stranded you are during an outage 4Ref 4Office of the National Coordinator (2016).EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.ONC's EHR contracting guide on data-access, termination, and liability terms worth negotiating before an outage, to reduce exposure and support any later hardship application..

A contract that guarantees you exportable access to your own data, spells out the vendor's own uptime and incident-response commitments, and doesn't lock your records behind a proprietary format is worth more during an actual outage than any hardship application filed after the fact. If you're evaluating a new EHR or renegotiating an existing contract, read the access and termination clauses with an outage specifically in mind, not just the sales pitch about reliability.

A well-negotiated contract doesn't guarantee you'll never need a hardship exception, but it does mean that when you do apply for one, you'll have the vendor's own incident documentation to support it, rather than your word alone.

How this interacts with the low-volume threshold and opting in

A hardship exception is one of several pathway decisions that shape your MIPS obligations, and it doesn't stand alone — the low-volume threshold may exempt you from reporting entirely before a hardship question ever arises, and opting in changes both your requirements and your payment risk if you fall under that threshold but choose to report anyway.

Work through the pathway questions in order rather than jumping straight to a hardship application: first confirm whether you're required to report at all under the low-volume threshold, then whether opting in makes sense if you're not, and only then consider whether a hardship exception is the right tool for a category you are required to report but genuinely couldn't. A specialty-shaped alternative, MVPs: the smaller, specialty-shaped MIPS, may also reduce your burden enough that a hardship application isn't necessary in the first place.

Applying for a hardship exception you didn't need, because a simpler pathway decision would have resolved the same problem, wastes the application effort on the wrong lever.

Applying: what to have ready

Whatever triggers your application, have the same core documentation ready: the specific category you're requesting relief for, the dates and nature of the circumstance, and any third-party evidence — a vendor's incident report, a small-practice size confirmation — that supports the claim. A vague application asking to be excused from this year's difficulties is far weaker than one naming a category, a date range, and a documented cause.

Keep this file organized the way you'd organize evidence for the MIPS audit file generally, since a hardship exception you were granted is exactly the kind of thing a later program integrity review may ask you to substantiate. An approval isn't the end of the paper trail; it's the start of what you need to be able to produce if asked.

File early rather than at the deadline. A hardship application submitted with time to spare, supported by contemporaneous documentation from when the event happened, is a stronger record than one assembled from memory close to a filing window.