What Happens After a Failed CMS Data Validation Audit: An American Data Network Guide

CMS data validation audit results post to the Hospital Quality Reporting (HQR) Secure Portal in stages through the year, and each posting starts a 30-day clock. For a Quality Director who has cleared validation before, a failing result carries a consequence beyond the payment cut: CMS automatically puts a hospital that fails into the next year’s validation sample.

The payment exposure can be estimated within days. What takes longer is finding what caused the failure, documenting the response, and fixing the underlying process before the next validation cycle.

Key Takeaways

• Beginning with FY 2028, CMS scores the accuracy of chart-abstracted data and electronic clinical quality measures (eCQMs) separately, and a hospital must pass both.
• A failed validation can reduce the hospital’s Medicare inpatient payment update. In FY 2027 terms, the cost is roughly 0.8% of Medicare inpatient operating payments for the year.
• Each set of validation results opens a 30-day window for an educational review, and if the review finds a CMS scoring error, the corrected score counts toward the final result.
• A mismatch the hospital caused can’t be undone; only a CMS scoring error can be corrected, through educational review. What can change is the process behind it, and because CMS automatically re-selects a hospital that fails, next year’s sample will test the fix.
• Routine inter-rater reliability (IRR) testing, internal sampling of eCQM data, and a check on every record packet before it goes to CMS reduce the risk of failing.

What Does a Validation Failure Actually Trigger?

CMS scores two things under the Hospital Inpatient Quality Reporting (IQR) Program: chart-abstracted measures and electronic clinical quality measures (eCQMs). Each score is based on a confidence interval, a statistical range around how often the hospital’s submitted results agree with those of CMS’s Clinical Data Abstraction Center (CDAC), and the upper bound of that range must reach at least 75% on both scores. Falling short on either one fails validation.

Scoring eCQM accuracy was finalized in the FY 2025 IPPS final rule and takes effect with the FY 2028 payment determination. Until then, the combined validation score gave eCQM accuracy zero weight. CMS may review up to 32 chart-abstracted cases a year (eight per quarter) and up to 32 eCQM cases, as detailed in the FY 2028 Hospital IQR Program Guide and the QualityNet Data Validation Resources.

For the broader IQR requirements, see American Data Network’s Hospital Inpatient Quality Reporting Program Guide.

FY 2028 validation covers discharges from all four quarters of 2025. CMS picks up to 200 hospitals at random and up to 200 more using targeting criteria. Every selected hospital, random or targeted, faces the same requirements, according to the eCQI Resource Center’s notice of the FY 2028 targeted sample. The same selection also validates healthcare-associated infection (HAI) data under the separate Hospital-Acquired Condition (HAC) Reduction Program, which has its own 75% test and its own consequences.

Within the IQR Program, CMS validates only one chart-abstracted measure for FY 2028: Severe Sepsis and Septic Shock (SEP-1), which CMS reports under the clinical process of care (CPOC) label, according to the FY 2028 Validation Fact Sheet. A failed chart-abstracted score is a SEP-1 problem, in the abstraction itself or in the records sent to support it, and the investigation should start with how abstractors apply the SEP-1 specifications, how consistently they agree with each other, and whether they are working from the current version.

An eCQM failure calls for a different starting point: how source data are documented, extracted, mapped, and translated into the data submitted to CMS. A hospital that fails both will need to investigate both workflows.

The results notice itself is an email saying results are ready. The case-level detail sits in the Case Detail Report on the HQR Secure Portal, which shows the outcome CDAC reached on every validated case, as described in CMS’s guide to validation case statuses. The email goes to users who hold the portal’s Validation permission, and CMS recommends keeping several active users with that permission.

The immediate priorities are to determine which score failed, begin reviewing the case-level findings, and give finance and senior leadership an early read on the cause and the potential payment exposure.

The validation process includes three 30-day deadlines, and they apply at different stages:

• Record submission: Hospitals have 30 days from the original CMS request date to submit the requested medical records. A record that arrives late counts as a mismatch.
• Educational review: After each set of validation results posts, hospitals have 30 days to request an educational review if they have questions about the findings or believe CMS scored a case incorrectly. The window runs from the posting date whether or not anyone has read the email. If the review finds a CMS error, the corrected score goes into the final confidence interval, according to the FY 2028 Validation Fact Sheet.
• Reconsideration: If CMS determines that the hospital did not meet IQR Program requirements, it sends an Annual Payment Update (APU) notification letter, the notice that says the hospital will not receive its full payment update. The hospital has 30 days from the date on that letter to request reconsideration. For FY 2028, CMS expects to send those letters around March 2027.

The timing matters more than any single deadline. For FY 2028, CMS expects to release final validation scores around January 2027, after all of the 2026 discharges that FY 2029 validation will check have already happened, and the 2026 eCQM data is due March 1, 2027, the same month the letters go out.

A hospital that waits for the letter to start fixing its process will already have submitted most of the data its next validation checks. The results that post during the year are the earliest warning a hospital gets, and the first failed quarter is the time to start.

How Does a Failed Validation Affect Medicare Payment?

The FY 2027 Inpatient Prospective Payment System (IPPS) final rule shows how the payment reduction works. Hospitals that meet the applicable Hospital IQR and electronic health record requirements receive the full 2.3% update, which CMS’s fact sheet on the rule breaks down as a 3.2% market basket increase minus a 0.9 percentage-point productivity adjustment. Failing the IQR requirement, including through a failed validation, removes one quarter of the market basket increase, 0.8 percentage points, which leaves an update of 1.5%.

A failed FY 2028 validation lands on the FY 2028 update, which covers October 2027 through September 2028 and will be set in the FY 2028 rule. In FY 2027 terms, the exposure is roughly 0.8% of the hospital’s Medicare inpatient operating payments for that year: about $800,000 for a hospital with $100 million in those payments. Case mix, volume, wage index, and other payment adjustments move the exact figure.

What Does Remediation Actually Require?

The response has three parts: find the cause, fix the process, and prove the fix held.

Start with the records themselves. A requested record that doesn’t reach CDAC on time, or a record for the wrong encounter, counts as a mismatch, and CMS will not accept a replacement or missing pages once CDAC has the record. A record missing pages can cost the case if CDAC can’t reach the hospital’s result from what was sent, however well the case was abstracted.

Then look for patterns in the mismatched cases. On the chart-abstracted side, mismatches linked to particular abstractors point to training or consistency, while mismatches that cluster at the same point in the SEP-1 measure point to how the specifications are being interpreted, or to an outdated version of them.

On the eCQM side, where CMS draws its sample from all eligible eCQMs the hospital reported, errors concentrated in one measure may point to that measure’s logic or mapping, and errors across several measures may point to how data are documented and extracted.

Next, correct the underlying process. Depending on the cause, that may mean updating abstraction guidance, retraining staff, applying current specifications, strengthening quality checks, or correcting the electronic reporting workflow.

Finally, prove the fix held. Review a new sample of records to see whether the same errors still occur. For chart abstraction, inter-rater reliability (IRR) testing, in which a second qualified abstractor independently re-reviews a sample of cases, shows whether different abstractors reviewing the same record reach the same result. ADN’s own Clinical Data Abstraction Outsourcing Services run on a formal IRR policy and report 98.4% accuracy.

ADN has discussed this approach in more detail in Why Inter-Rater Reliability Is the Hidden Risk Control in Hospital Quality and in its article on clinical data abstraction accuracy.

Start this confirmation well before the next validation cycle, so the hospital can show the correction reaches beyond the specific cases that failed.

The technical review should be matched by clear internal communication. Finance needs a realistic estimate of the payment impact. Senior leadership needs the remediation timeline and an assessment of whether the problem has been contained. The abstraction and data teams need the case-level findings so they can act on them.

Document the corrective action where the quality committee and board will see it: what changed, who owns it, and the evidence that the process is fixed.

How Do You Prevent Recurrence?

Preventing failure starts with regular checks before CMS selects a sample. The same IRR testing used to confirm a fix works as an ongoing check when it runs on a schedule. Hospitals should also make sure current measure specifications are used consistently across the team.

eCQMs need the same routine check. CMS has been measuring eCQM agreement without scoring it: the national average was about 90% in FY 2024 validation results, with the lowest-scoring measure averaging about 84%, and CMS said averages may fall as a full year of data and newer eCQMs are scored. A measure can submit successfully and still contain data that do not match the medical record, because of how information was documented, extracted, or mapped.

Internal sampling covers both. Hospitals can compare a sample of submitted cases, chart-abstracted and electronic, with the medical record to catch recurring errors before CMS does. Every record packet should also get a quality check before it goes to CDAC, as CMS recommends.

When internal resources are limited, ADN’s Clinical Data Abstraction Outsourcing Services provide expert abstractors who stay current on evolving specifications, backed by a formal inter-rater reliability policy, across core measures and registries. ADN Data Analytics Services can analyze the hospital’s clinical and quality data to identify patterns, trends, and priorities.

The aim is to go into the next validation cycle with evidence that the hospital’s quality-data processes changed.