MIPPA Accreditation Security Requirements for Imaging Providers
If you bill Medicare for advanced diagnostic imaging, MIPPA accreditation is mandatory. Accreditation focuses on image quality and patient safety, but the systems behind it — modalities, PACS, RIS and reading workstations — hold patient data that HIPAA requires you to protect. This guide explains how the two fit together and how to stay ready for both.
What MIPPA requires
The Medicare Improvements for Patients and Providers Act of 2008 requires suppliers of the technical component of advanced diagnostic imaging billed under the Medicare Physician Fee Schedule to be accredited by a CMS-approved accrediting organization. The requirement has applied since January 1, 2012.
- Covered modalities: MRI, CT, nuclear medicine and PET
- CMS-approved accreditors include the American College of Radiology (ACR), the Intersocietal Accreditation Commission (IAC), The Joint Commission and RadSite
- Accreditation covers personnel qualifications, equipment performance, image quality, safety and quality-assurance programs
Where security comes in
MIPPA itself is not a cybersecurity law, and each accreditor sets its own standards. But imaging providers are HIPAA covered entities, so the HIPAA Security Rule applies to every system that creates, stores or transmits electronic protected health information — and accreditors, payers and hospital partners increasingly ask to see it.
- A documented, current HIPAA security risk analysis covering modalities, PACS, RIS and teleradiology links
- Access controls and unique user IDs on reading workstations and PACS
- Encryption for images and reports in transit to referring providers and remote readers
- Patch and vulnerability management for imaging devices, including vendor-managed systems
- Backup, downtime and recovery procedures for image archives
- Business associate agreements with PACS, cloud and teleradiology vendors
Keeping evidence ready for site visits and renewals
Accreditation is renewed on a recurring cycle, and the hardest part is usually finding proof — policies, logs, training records and risk assessments — when it is requested. Meridian Radar™ scores your security and compliance gaps, and Meridian Ledger™ collects evidence continuously so it is ready before a site visit, payer audit or OCR inquiry.
Frequently asked questions
Does MIPPA accreditation include HIPAA security?
Not directly. MIPPA accreditation focuses on quality and safety, and each accrediting organization defines its own standards. HIPAA Security Rule obligations apply separately to imaging providers as covered entities.
Which imaging services need MIPPA accreditation?
The technical component of MRI, CT, nuclear medicine and PET services billed under the Medicare Physician Fee Schedule. X-ray, ultrasound, fluoroscopy and mammography are not part of the MIPPA advanced diagnostic imaging requirement (mammography has its own MQSA rules).
Can Senticit accredit my imaging center?
No. Only CMS-approved accrediting organizations grant accreditation. Senticit helps you build and document the security and compliance program that supports it.