The Centers for Medicare & Medicaid Services (CMS) has released its updated 2026 External Quality Review (EQR) Protocols, introducing changes that will shape how states evaluate and report on the quality, timeliness, and access to care delivered through Medicaid and CHIP managed care programs.
The updated protocols reflect changes established through the 2024 Medicaid and CHIP Managed Care Access, Finance, and Quality Final Rule and continue a broader shift toward more data-driven, transparent, and outcomes-focused managed care oversight.
For state Medicaid agencies, the update creates an important opportunity to review existing EQR activities, reporting processes, data capabilities, and quality strategies in preparation for upcoming implementation requirements.
The foundation of EQR remains familiar. States continue to be responsible for the four mandatory EQR activities: validation of performance improvement projects, validation of performance measures, compliance review, and validation of network adequacy.
The 2026 protocols, however, strengthen expectations around how states and their External Quality Review Organizations use and report the information generated through these activities.
One of the most significant changes involves EQR technical reporting. For Protocols 1, 2, and 4, technical reports will need to include outcomes data and results from quantitative assessments, not simply validation findings. States have one year following publication of the updated protocols to begin implementing these requirements, with the additional information required in EQR technical reports due April 30, 2028.
This places greater importance on the availability, quality, and consistency of the underlying data used throughout the EQR process.
CMS has also standardized the approach to EQR review periods. Applicable activities will generally use a 12-month review period tied to the most recently concluded contract year or calendar year, whichever is nearest to the EQR activity.
For states, this may require closer alignment among managed care organization data submissions, EQR activities, validation timelines, state review processes, and production of the annual technical report.
The protocols also reinforce the role of annual EQR technical reports as an ongoing accountability and improvement tool. States must notify CMS within 14 calendar days after posting completed reports and maintain at least five previous years of EQR technical reports on their websites.
The updated framework now includes seven optional EQR activities, creating additional opportunities for states to use independent external review expertise as part of their broader managed care quality programs.
Two activities are particularly noteworthy.
Protocol 10 allows EQR activities to support quality ratings for the Medicaid and CHIP Quality Rating System (MAC QRS). States are required to display ratings for applicable mandatory measures no later than December 31, 2028.
Protocol 11 addresses assistance with evaluation activities and can support evaluations related to state managed care quality strategies, State Directed Payments, and In Lieu of Services and Settings when those evaluations involve quality outcomes, timeliness, or access.
Together, these changes demonstrate the increasingly interconnected role of EQR within Medicaid managed care quality oversight.
Although some requirements have future implementation dates, states have an opportunity to begin preparing now. Existing EQR contracts and scopes of work may need to be reviewed against the updated protocols, particularly requirements involving performance data, network adequacy, reporting periods, and annual technical reports.
States may also want to assess whether current managed care data collection and reporting processes provide the information necessary to meet expanded quantitative reporting requirements.
The addition of Protocols 10 and 11 creates another consideration: whether optional EQR activities could support broader state priorities around quality strategy, quality ratings, payment initiatives, access, and program evaluation.
For questions about the updated protocols, contact Kristen Gloria.