U.S. flag

An official website of the United States government

Quality of Care External Quality Review

An External Quality Review (EQR) is the analysis and evaluation by an external quality review organization (EQRO) of aggregated information on quality, timeliness, and access to the health care services that a managed care organization (MCO), prepaid inpatient health plan (PIHP), prepaid ambulatory health plan (PAHP), or their contractors, furnish to Medicaid or CHIP recipients. Federal regulations at 42 CFR §§ 438.350, 438.354, 438.358, 438.360, and 438.364 for Medicaid and through a separate cross-reference for CHIP at § 457.1250, set forth the parameters that states must follow when conducting an EQR of its contracted MCOs, PIHPs, and PAHPs. The Managed Care Access, Finance, and Quality Final Rule (CMS-2439-F) eliminates EQR requirements for primary care case management (PCCM) entities, makes it easier for States to use accreditation reviews for EQR, establishes consistent 12-month review periods for the annual EQR activities, and requires more meaningful data and information to be included in the annual EQR technical reports.

This page provides information on the following topics relevant to EQR: 

What is External Quality Review?

Federal requirements at Section 1932(c)(2) of the Social Security Act, which are set forth at 42 CFR § 438.350 for Medicaid and through a cross-reference for CHIP at  § 457.1250, require that each state that contracts with a managed care plan, including a Medicaid and/or CHIP MCO, PIHP, or PAHP must ensure that a qualified EQRO performs an annual EQR for each such contracted managed care plan.

States that deliver Medicaid and CHIP services through managed care plans must contract with at least one EQRO. The EQRO conducts the annual EQR and produces the annual EQR technical report. States have flexibility regarding who conducts the EQR-related activities, which may be performed by the state, a state agent that is not a managed care plan, or an EQRO. 

States must ensure the privacy of patient information, and that Medicaid and CHIP managed care plans comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and all other federal and state laws concerning confidentiality and disclosure. EQROs must ensure that all EQR-related activities and the EQR technical report process are consistent with HIPAA requirements.

EQR-related activities are intended to:

  1. Improve states’ ability to oversee and manage the managed care plans they contract with for services.
  2. Help managed care plans improve their performance with respect to quality, timeliness, and access to care.

EQR-related activities are the mandatory and optional activities, as set forth in 42 CFR § 438.358 for Medicaid and incorporated into separate CHIP regulations through a cross-reference at § 457.1250, conducted on each managed care plan, which produces the data and information that the EQRO analyzes when performing the EQR. There are four mandatory activities:

  1. Performance Measurement Validation
  2. Performance Improvement Project (PIP) Validation
  3. A review, conducted within the previous 3-year period, to determine the MCO's, PIHP's, or PAHP's compliance with the standards set forth in subpart D
  4. Network Adequacy Validation (NAV)

There are seven optional activities:

  1.  Encounter data validation
  2. Administration or validation of consumer or provider surveys of quality of care
  3. Calculation of performance measures
  4. Implementation of performance improvement projects
  5. Focus studies on quality of care
  6. Rating of managed care plans (CMS must develop a protocol before this activity can be used by states.)
  7. Assistance with evaluation activities related to quality strategies, state directed payments, and In Lieu of Services or Settings (ILOSs). (CMS must first develop a protocol before this activity can be used by states.)

Nonduplication

Nonduplication (42 CFR § 438.360 and § 457.1250(a)) allows, under certain conditions, a state to use information from a Medicare or private accreditation review of a plan in place of generating that information through one or more of the mandatory EQR-related activities described in § 438.358(b)(1)(i) through (iii), relating to the validation of PIPs, validation of performance measures, and compliance review (EQR Protocols 1–3). The 2023 protocols include guidance on nonduplication. With respect to the nonduplication of EQR activities with private accreditation, CMS-2439-F removed the requirement that plan accreditation must be from a private accrediting organization (PAO) recognized by CMS as applying standards at least as stringent as Medicare under the procedures in § 422.158. 

Federal Financial Participation (FFP) for EQR

For Medicaid programs, EQR and EQR-related activities performed on MCOs may be eligible for an enhanced match rate. Additional details can be found at 42 CFR § 433.15 and § 438.370(a) and the July 10, 2016 CMCS Informational Bulletin (CIB), Federal Financial Participation for Managed Care External Quality Review.

EQR Technical Reports

The annual EQR technical report is the public facing end-product of the annual EQR. The EQRO produces the technical report for the state. The EQRO must make the annual EQR technical report available to the public, including CMS, both on the state’s website and upon request either in print or electronically. As required in 42 CFR § 438.364(a) for Medicaid and a cross-reference in § 457.1250(a) for CHIP, the annual technical report must include:

  1. For each EQR-related activity, a description of the way the data was aggregated and analyzed, and conclusions were drawn as to the quality, timeliness, and access to the care furnished by the managed care plans. 
  2. The results of each EQR-related activity, including a summary of the:
    • Objectives
    • Technical methods of data collection and analysis
    • Description of data obtained, including validated performance measurement data.
      • CMS 2439-F establishes the requirement for EQR technical reports to include outcomes data and results from quantitative assessments in addition to validation information, for each mandatory EQR-related activity conducted in accordance with § 438.358(b)(1)(i), (ii) and (iv), relating to the validation of PIPs, validation of performance measures, and NAV (Protocols 1, 2, and 4). CMS must update the protocols to support this requirement. After CMS publishes the updated protocols, states have one year to begin implementation.
    • Conclusions drawn from the data
  3. The EQRO’s assessment of each managed care plan’s strengths and weaknesses related to quality, timeliness, and access.
  4. Recommendations for improving the quality of health care services furnished by each managed care plan and recommendations for how the state can target goals and objectives in the State quality strategy.
  5. Methodologically appropriate, comparative information about all managed care plans.
  6. An assessment of the degree to which each managed care plan has addressed the recommendations for quality improvement made by the EQRO during the previous year’s EQR.
  7. The names of the MCOs exempt from external quality review by the State, including the beginning date of the current exemption period, or that no MCOs are exempt, as appropriate.

2023 EQR Protocols

EQR protocols provide tools and guidance to states and EQROs using current industry methodologies and offer practical tips and best practices for creating the technical report.

Technical Assistance is available from CMS to assist states with the EQR protocols. 

2024 Final Rule

On May 10, 2024, CMS published CMS-2439-F, which updated and expanded EQR in the following ways:

  1. Eliminates mandatory EQR requirements for PCCM entities. CMS-2439-F maintains optional activities for PCCM entities so states can continue to access FFP at the 50 percent match rate if they choose (42 CFR § 438.358(b)(2) and § 457.1250(a)).
  2. Establishes consistent 12-month EQR review periods. (1) CMS-2439-F clarifies the 12-month review period for the applicable EQR-related activities begins on the first day of the most recently concluded contract year or calendar year, whichever is nearest to the date of the EQR-related activity, and is 12 months in duration and (2) required that the EQR-related activities be performed in the 12 months preceding the finalization of the annual report (42 CFR § 438.358(a)(3), § 438.358(b)(1), and § 457.1250(a)).
  3. Adds a new optional EQR activity to support states in their evaluations of quality outcomes and timeliness of and access to care in managed care plans and programs. The new activity assists in evaluations of quality strategies, SDPs, and ILOSs that pertain to outcomes, quality, or access to health care services (42 CFR § 438.358(c)(7) and § 457.1250(a)).
  4. Makes it easier for states to use accreditation reviews for EQR. CMS-2439-F removes the requirement that PAOs must apply for Medicare Advantage (MA) deeming authority from CMS in order for states to rely on PAO accreditation reviews in lieu of EQR activities (42 CFR § 438.360(a)(1)).
  5. Requires more meaningful data and information to be included in the annual EQR reports. 
    • States’ EQR technical reports must include outcomes data and results from quantitative assessments in addition to validation information, and this type of data from the mandatory NAV activity must be included in the EQR technical report (42 CFR § 438.364(a)(2)(iii) and § 457.1250(a)).
      • CMS must update the protocols to support this requirement. After CMS publishes the updated protocols, states have one year to begin implementation.
  6. Requires states to notify CMS that their EQR technical report has been completed and posted on the state’s website and to retain EQR technical reports from previous years. Beginning with EQR technical reports due April 30, 2025, states are required to (1) notify CMS within 14 calendar days of posting their EQR technical reports on their website and (2) by December 31, 2025, maintain at least the previous 5 years of EQR technical reports on their website (42 CFR § 438.364(c)(2)(i) and (iii), and § 457.1250(a)).

EQR Annual Reporting

CMS requires that all states have final EQR technical reports available to CMS and the public by April 30 of each year. CMS reviews these reports and abstracts data related to performance measures and PIPs. These data are analyzed and aggregated into summary tables.

Summary tables abstracted from EQR technical reports by year of submission:

Technical Assistance

Technical assistance is available from CMS to assist states with EQR. Please submit any questions or requests for technical assistance related to EQR to ManagedCareQualityTA@cms.hhs.gov.