FAQ Directory: HEDIS

Member-reported data are allowed in specific scenarios, and when all requirements are met.

Organizations may not call members to collect HEDIS data. The expectation is that member-reported data are generated during an encounter where the member receives care.   

Some HEDIS data are reported by members; for example, when standardized assessment tools are used (e.g., PHQ-2), or when documenting language preference, race and ethnicity.  

Services and biometric values reported by members are permitted if they adhere to the following guidelines in HEDIS Volume 2:

• Member-Reported Services and Biometric Values general guideline. Member-reported services may be used if collected by a PCP or specialist (if the specialist is providing a primary care service related to the condition being assessed, in the course of taking a member’s history), and if the information is in the member’s health record. 
• Supplemental Data general guideline.
  Information on services reported by members often reside in non-standard supplemental sources. The supplemental data general guideline states that there must be evidence of provider accountability for the information documented. Documentation of member-reported services must be complete (date, place of service, procedure, prescription, test result or finding, practitioner type).

HEDIS MY 2026

Provider attestations or portal data are allowed in specific scenarios and when all requirements are met.

Organizations may obtain information from providers on services that were rendered via attestation forms or provider portal interfaces. These are considered supplemental sources, and must be substantiated with proof-of-service documentation (e.g., original medical record).

In particular, organizations may not use provider attestations or data entered in an electronic platform as evidence that a service was rendered (i.e., as proof of service). This includes attestation forms filed in the member’s record, which are not primary sources for the information.

HEDIS MY 2026

The following data elements must be present for pharmacy data:

• Generic name (or brand name).
• Strength/dose.
• Route.
• Dispensed or shipped date (i.e., the date when the medication was dispensed or shipped).

Medical record documentation that an individual was prescribed a medication, or that lists current/active medications, does not meet criteria. The dispensed date is required. For mailed prescriptions, the shipped date is considered the dispensed date.  

HEDIS MY 2026

Proof of service is the primary source documentation for a service or a result (not a secondary representation of the information), and should originate from the source system where it was first documented.

Acceptable proof of service:

• A copy of the information from the member’s chart from the service provider or PCP.
• A copy of the clinical report or clinical summary from the visit for service, such as lab or radiology reports.
• A screen shot of the EHR records or state- or county-sponsored immunization registry records.

Proof of service is primary source documentation, not a secondary representation of that information. The following provide examples that are not considered proof of service:

• C-CDA or FHIR files are electronically generated, and are not proof of service. 
• Attestation forms are not the original source of documentation for an encounter, and are not proof of a service or result. 

HEDIS MY 2026

No. BPD-E will not be publicly reporting for MY 2026; NCQA will allow voluntary ECDS reporting for BPD-E. The administrative and hybrid version of the BPD measure will continue to be publicly reported for MY 2026.

HEDIS MY 2026

Yes. The LSC-E, SPC-E and SPD-E measures will be publicly reported for MY 2026.

HEDIS MY 2026

Yes. Some appendices were removed from the publication. This approach for HEDIS MY 2026 reduced redundancy, considered the broader product changes and whether users might prefer to engage with information outside the publication.

For example, as an alternative to Appendix 2: Technical Considerations for New Measures, clinical guideline recommendations for each measure are included directly in the measure specifications. NCQA also updated the State of Health Care Quality Report to reflect the latest HEDIS measure set release, including new measures for MY 2026. The State of Health Care Quality Report is publicly available at NCQA.org.

NCQA is committed to supporting stakeholders who use HEDIS, and we welcome feedback as we continue to evolve HEDIS.

HEDIS MY 2026

Organizations may not use PCS responses that are over 3 years old. Questions that relate directly to a measure specification or general guideline that was revised from a previous measurement year should be resubmitted rather than using the previous answer in PCS.

HEDIS MY 2026

It is up to the organization to ensure that multiple mammograph episodes are the same event if they occur on the same date of service. HEDIS measure certification assumes events on the same day are different mammograms. If evidence shows the mammography episodes are the same, count only one. Organizations should develop their own methods and apply them consistently when reporting.

HEDIS MY 2025

Yes. One follow-up event may meet criteria for multiple BIRADS assessments. Each BIRADS assessment counts as separate denominator events, and requires the appropriate follow-up to count toward the numerator. However, one breast biopsy may meet criteria for multiple high-risk BIRADS assessments, and one mammogram or ultrasound may meet criteria for multiple inconclusive BIRADS assessments.

HEDIS MY 2025

No. Each mammogram requires a unique BIRADS assessment (e.g., two mammograms need two separate BIRADS to meet numerator criteria). A single documented BIRADS assessment dated on or within 14 days (15 days total) of multiple mammography episodes does not meet criteria for multiple denominator events.

DBM-E sample and test decks have been updated and re-posted. If you already received a status of “pass” for a DBM-E test deck, the status has been re-set and you must run the updated deck to certify. The deadline to certify the measure will be extended to July 31 so organizations can accommodate this update.

HEDIS MY 2025

Yes. As described in Numerator 5—Immunization Status: Hepatitis B, use POS code 81 to exclude laboratory claims when identifying members with a history of hepatitis B illness. POS code 81 was mistakenly omitted from the Direct Reference Code tab of the VSD. Because the information needed for reporting is in the measure specification, NCQA does not intend to reissue the VSD.

HEDIS MY 2025