The MIPS audit file: the records behind every attestation

What actually belongs in the file

The MIPS audit file is the paper trail that lets you reproduce, on demand, every number you attested to. For each measure, keep the source report or registry export, the denominator population you calculated from, the date range, and — where the measure came from a screening tool or a flowsheet — a copy or a screenshot showing the entry. If you claimed a hardship exception for any category, file the evidence supporting that claim right alongside the measure data.

Who actually needs this file depends on your participation status. If the low-volume threshold excludes you and you're not reporting, there's nothing to build. If you opted in — knowing that opting in makes you fully scored — or you're required to report, the file exists the moment you submit your first measure, not the moment someone asks for it.

Build it by performance year, not as one running folder. A validation request, when it comes, asks about a specific year's submission, and a file organized any other way turns a simple request into an afternoon of searching.

The same underlying data often does double duty. A number of MIPS quality measures track clinical patterns — antidepressant medication management, follow-up after an emergency department visit for mental illness — that health plans separately report through HEDIS, so a well-kept audit file quietly backs how a payer reads your quality patterns as well as your federal attestation 1Ref 1National Committee for Quality Assurance (2026).HEDIS.That HEDIS measures such as antidepressant medication management and ED follow-up for mental illness track the same clinical patterns several MIPS quality measures do, so a MIPS audit file's source data reaches into payer quality reporting too..

Signatures are where most files fall apart

The single most common gap in a MIPS audit file isn't a missing measure — it's an encounter note behind a measure that was never properly signed. Medicare requires services to be authenticated by a handwritten or electronic signature, and an unsigned or improperly authenticated note undermines the encounter the measure is supposedly built on, even if the clinical care was real 2Ref 2Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires services to be authenticated by signature and that a missing or defective signature undermines the underlying encounter a MIPS measure depends on..

The fix, if you find one, is the same attestation process used for any signature gap: correct it going forward, and where the specific note allows it, attest properly rather than leaving the gap in place. Check this before a validation request forces the question — a measure resting on an unsigned note is a much harder conversation to have after CMS has already asked.

No MIPS-specific countdown, so pick a durable floor

Nothing in federal MIPS guidance sets its own retention period for audit-file evidence, so don't invent a number — pick a floor that's at least as long as your other retention duties and hold to it consistently. A reasonable practice norm is to treat MIPS source data the same way you treat the clinical records it's drawn from, since the underlying encounters are the same documents either way.

Professional record-keeping guidance frames that same question for clinical records generally: a commonly cited starting point is several years past last service for an adult, longer for a minor — but state law controls the actual duration, and your state's rule is the one that governs, not any guideline's example 3Ref 3American Psychological Association (2007).Record Keeping Guidelines.APA's retention framing — a commonly cited multi-year example that always yields to state law — used as the analogous floor for how long to keep MIPS source data.. Whatever floor you pick for your clinical records, apply the same floor to the MIPS file sitting behind them; there's no reason to let the audit trail expire before the record it documents.

It's PHI — handle it like the rest of your records

A MIPS audit file is built from real patient encounters, which makes it protected health information the moment it's assembled, not a separate administrative category exempt from HIPAA. The Privacy Rule governs how covered entities use and disclose PHI, including for treatment, payment, and healthcare operations — and compiling quality-measure evidence for a federal reporting program falls squarely inside healthcare operations 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule governs PHI use and disclosure including for healthcare operations, which covers compiling quality-measure evidence for a federal reporting program..

That means the same access controls, the same minimum-necessary discipline, and the same storage standards that apply to your charts apply to the spreadsheet or folder holding your measure evidence. A common mistake is treating audit-file exports as "just numbers" and emailing them around loosely — if the export includes patient-level detail behind the aggregate, it needs the same handling as the chart it came from.

If a subpoena or court order reaches for it

A subpoena for your quality data gets handled differently depending on what accompanies it. HIPAA distinguishes a court order — where you may disclose only what the order actually authorizes — from a bare subpoena without a court order, which permits disclosure only with satisfactory assurances that the patient was notified or a protective order is in place 5Ref 5HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order from a bare subpoena, and what must accompany a bare subpoena before PHI, including MIPS-related records, may be disclosed..

Don't produce records off a bare subpoena alone; confirm which category you're looking at before you send anything. This applies whether the request names your clinical chart directly or reaches for the MIPS audit file built on top of it — the underlying PHI protections don't relax just because the document in question is a quality report rather than a progress note. If you're closing your practice, this file doesn't get to disappear with it; carry it forward the same way you carry forward the records it's drawn from.

What a validation request actually looks like

A validation or audit request asks you to reproduce specific numbers from a specific performance year — not to defend your entire practice. Respond with exactly what the request asks for: the source reports, the denominators, the dates, pulled from the file you already organized by year. A well-built file turns this into an afternoon of assembling documents you already have, not a scramble to reconstruct a year-old submission from memory.

Most discrepancies a validation turns up are the same documentation-lane problems any self-review finds — a thin note, a denominator miscounted — and get corrected the same way. The rare case is a pattern that looks deliberate rather than sloppy, which is a different and much smaller category of problem, worth recognizing as distinct from an honest reporting error before you decide how seriously to treat it.