MammoComply Mini Moments

How are facilities chosen for accreditation body onsite visits and random clinical image reviews?

What it is

Each year an accreditation body must visit at least 5 percent of the facilities it accredits, with a minimum of 5 facilities and no more than 50 required unless problems indicate a need for more (21 CFR 900.4(f)(1)(i)).

How it works

At least half of the facilities visited are selected randomly. The others are chosen based on problems found through State or FDA inspections, serious consumer complaints, a history of noncompliance, or other information. Separately, the body conducts random clinical image reviews of a sample that includes at least 3 percent of the facilities it accredits, using the same eight attributes. It should not schedule a random review at a facility that was told to begin accreditation renewal or finished renewal within the previous 6 months.

Why it matters

A facility can be selected at random, or because of a complaint or a past problem.

What it means to the patient or the client

For the client: expect that a visit or random review can happen at any time, and keep your quality assurance records current throughout the year.

How can a facility file a serious unresolved complaint with its accreditation body?

What it is

Every accreditation body must provide a mechanism for the facilities it accredits to file serious unresolved complaints with the body (21 CFR 900.4(g)).

How it works

The body develops and administers a written, documented system, with timeframes, for collecting and resolving serious consumer complaints that could not be resolved at a facility, approved by the FDA. It maintains a record of every serious unresolved complaint it receives about the facilities it accredits for at least 3 years from the date of receipt.

Why it matters

This is the accreditation-body side of the complaint path that 21 CFR 900.12(h) requires each facility to give a consumer.

What it means to the patient or the client

For patients: if a facility cannot resolve a serious complaint, its accreditation body has a documented process to take it up. For the client: know your accreditation body's complaint procedure and its timeframes.

How often does an accreditation body review a facility's clinical and phantom images?

What it is

An accreditation body must review clinical images from each facility it accredits at least once every 3 years, and must review phantom images from each facility at least once every 3 years (21 CFR 900.4(c)(1) and (d)(1)).

How it works

Each facility submits images for review. For phantom images, the facility submits images it produced with a phantom and methods of use specified by the accreditation body and approved by the FDA, for each mammography unit, during a time period the body specifies. Phantom images that result in a failure of accreditation are returned to the facility.

Why it matters

The three-year cycle sets the rhythm of reaccreditation, and the images submitted are the facility's own work product.

What it means to the patient or the client

For the client: practice the submission well before the due date, because what you send is what the reviewers judge.

Is accreditation failure about the whole facility or one unit?

What it is

The three-failure provision refers to overall facility accreditation, not to the accreditation of an individual unit, according to the FDA. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA acknowledged that some causes of failure, such as a mechanical deficiency, may be limited to one unit, while others, such as poor patient positioning, may extend throughout the facility. Accreditation bodies have policies for facilities with several units, and for the circumstances, including poor quality on accreditation images, that may prompt an additional mammography review of overall quality at the facility. The FDA expected accreditation bodies to review their procedures to match the rule and to submit any changes for the FDA's approval.

Why it matters

A facility with multiple units can have one unit fail and another succeed, but the three-attempt rule counts attempts at accreditation of the facility.

What it means to the patient or the client

For the client: ask your accreditation body how it treats a unit that fails while others pass, and what could trigger an additional review of the whole facility.

Is automated breast ultrasound covered by breast ultrasound accreditation or by MQSA?

What it is

The ACR Breast Ultrasound Accreditation Program does not accredit whole breast ultrasound units, the category that includes automated breast ultrasound (ABUS). ACR tells facilities that those types of units should not be added to an accreditation submission.

How it works

MQSA, the federal law for mammography, defines mammography in 21 CFR 900.2 as radiography of the breast, with a few listed exclusions. An ultrasound exam is not radiography, so that definition does not describe it. The sources reviewed for this entry describe no separate accreditation pathway for automated whole breast ultrasound, so a facility that needs one should ask ACR or its accreditation body directly.

Why it matters

A facility that adds an automated whole breast ultrasound system cannot assume it is covered by an accreditation it already holds for handheld breast ultrasound or for mammography.

What it means to the patient or the client

For the client: before you plan around a new ultrasound system, confirm with the accreditation body whether it is covered, and document the answer.

What do accreditation reviewers score when they review clinical images?

What it is

Accreditation bodies score clinical images on eight attributes, unless the FDA has approved others (21 CFR 900.4(c)(2) and (3)).

How it works

The attributes are positioning, compression, exposure level, contrast, sharpness, noise, artifacts, and examination identification. The body sets criteria for acceptable and nonacceptable results for each attribute and an overall pass-fail system. Every image submitted is reviewed independently by two or more review physicians, who must meet the interpreting physician requirements and document their findings and the reasons for each score.

Why it matters

The attributes are specific: for example, enough breast tissue must be imaged that cancers are not likely to be missed from inadequate positioning, and noise must not obscure structures or suggest ones that are not there.

What it means to the patient or the client

For the client: use the eight attributes as a checklist when technologists and the lead interpreting physician review your own images, so deficiencies are found before the accreditation reviewers find them.

What does an accreditation body check during an onsite visit to a facility?

What it is

Accreditation bodies conduct onsite visits to a sample of facilities according to a visit plan approved by the FDA (21 CFR 900.4(f)(1)). The plan must cover a minimum set of checks.

How it works

The plan provides for assessment of the facility's overall clinical image quality assurance activities, and review of documentation to determine whether mammography reports are sent to patients and providers as required. It includes selecting a sample of clinical images for review, verifying that the facility has a medical audit system and is correlating films and pathology reports for positive cases, verifying that the personnel and equipment the facility named are the ones actually performing the designated functions, verifying that a consumer complaint mechanism is in place and being followed, and reviewing factors related to earlier concerns.

Why it matters

The visit tests the facility's real practice against what it described on paper, including who actually does the work.

What it means to the patient or the client

For the client: keep your lists of personnel and equipment accurate, because the visitor checks that the people and units named are the ones in use.

What does an accreditation body do when it finds a deficiency at a facility?

What it is

An accreditation body must require each facility it accredits to meet standards that are substantially the same as the federal quality standards, and must act when a facility does not (21 CFR 900.4(b)).

How it works

The body notifies the facility about equipment, personnel, and other aspects of the practice that do not meet the standards, and advises the facility not to use them for mammography activities. It specifies the actions the facility must take to correct the deficiencies. If the deficiencies cannot be corrected, or the facility is unwilling to correct them, the body must immediately notify the FDA and suspend or revoke the facility's accreditation under its approved procedures.

Why it matters

The path runs from notice to specified corrective action to suspension or revocation, and the body must tell the FDA when correction fails.

What it means to the patient or the client

For the client: a deficiency letter specifies required corrective actions, so answer each item in writing and keep the evidence. For the specific deadline, check the accreditation body's own procedures, because this rule does not set a number of days.

What does the NAPBC breast imaging quality assurance standard require?

What it is

NAPBC Standard 3.4 (2024) requires that all mammography services at an accredited program be provided in accordance with MQSA, and that breast MRI follow recognized quality assurance practices.

How it works

A program that performs breast MRI on site must hold ACR Breast MRI Accreditation or ACR designation as a Comprehensive Breast Imaging Center, and must be able to provide mammographic correlation, directed breast ultrasound, and MRI guided intervention. A program that does not perform breast MRI on site must have an established referral relationship with a local facility that holds one of those ACR credentials and can provide those services. Documentation of the ACR accreditation or designation is submitted with the pre-review questionnaire, and a site reviewer confirms the referral relationship on site.

Why it matters

MQSA covers mammography only, so NAPBC supplies the accreditation requirement for the MRI part of a breast program.

What it means to the patient or the client

For the client: if you offer breast MRI, keep the ACR accreditation or designation certificate in your accreditation file, and if you refer MRI out, keep the written referral relationship.

What happens when a facility fails to become accredited three times in a row?

What it is

If a facility has failed to become accredited after three consecutive attempts, no accreditation body may accept an application from the facility for 1 year from the date of the most recent accreditation failure (21 CFR 900.4(a)(6)(ii)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said the waiting period gives the facility time to implement the necessary corrective actions and other changes, such as additional training or personnel changes. A facility cannot avoid the waiting period by switching accreditation bodies: the final rule says no accreditation body shall accept the application. The FDA noted that accreditation bodies use different terms, such as deficiency and failure, and said the phrase failed to become accredited covers all of them.

Why it matters

Three consecutive failures trigger a mandatory year before any further application, so each attempt counts.

What it means to the patient or the client

For the client: treat the first two failures as warnings, complete the corrective actions your accreditation body specifies, and do not plan to change accreditation bodies as a way around the waiting period.

What happens when a facility keeps failing or does not improve after corrective action?

What it is

The FDA explained how repeated failures and a lack of improvement can lead to action by the accreditation body and the FDA. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Corrective action is individualized by the accreditation body for the specific facility and often includes additional training for personnel. A facility that has completed all required corrective action may reapply, but the accreditation body may consider the facility's entire history, such as a lack of improvement after multiple corrective actions, in deciding whether to suspend or revoke accreditation or revoke its application. The accreditation body must notify the FDA if it believes the facility's practice may pose a serious risk to human health. The FDA may also consider the entire history in deciding that a facility poses a serious risk and in considering suspension or revocation of its certificate under 21 CFR 900.14.

Why it matters

The history of repeated problems counts, not only the most recent attempt.

What it means to the patient or the client

For the client: document the corrective actions you complete and what changed, because an accreditation body or the FDA can review the whole history.

What must be permanently marked on every mammogram image?

What it is

The examination identification attribute in 21 CFR 900.4(c)(2)(viii) lists what must appear on each image in a permanent, legible, and unambiguous manner, placed so it does not obscure anatomic structures.

How it works

The image must show the patient's name and an additional patient identifier, the date of the examination, the view and laterality (placed near the axilla, using standardized codes specified by the accreditation body and approved by the FDA), the facility name and location (at least city, State, and zip code), the technologist's identification, the cassette or screen identification, and the mammography unit identification if the facility has more than one unit.

Why it matters

Missing or wrong identification is a scored attribute in accreditation review, and a mislabeled image is also a patient safety risk.

What it means to the patient or the client

For patients: this information is what ties your image to you and to the right breast. For the client: check a sample of images from each unit for all items, including technologist and unit identification.

Which accreditation body can a facility use, and do all of them hold facilities to the same standards?

What it is

The FDA's Small Entity Compliance Guide says the FDA has approved the American College of Radiology, a private nonprofit that serves as a nationwide accreditation body, and some State agencies, each for a 7 year term. A facility in a State with an approved State accreditation body may use either the State or the ACR, and the guide says the ACR can accredit any facility in the United States.

How it works

All mammography facilities accredited by any FDA-approved body are held to the same federal quality standards. The body reviews the facility's equipment, personnel, clinical image quality, and practices, and accredits it if it meets the standards in the MQSA regulations (21 CFR 900.4). Each body sets its own fees, so the facility should ask the body for them. The guide adds that a State may have its own requirements that are independent of MQSA.

Why it matters

The choice of body affects fees and process, not the federal standards a facility must meet.

What it means to the patient or the client

For the client: compare the fees and procedures of the bodies open to you, and ask each how it handles new units and renewals before you choose.

Which clinical images must a facility submit for accreditation review?

What it is

Unless the FDA specifies otherwise, an accreditation body requires specific images for each mammography unit in the facility (21 CFR 900.4(c)(4)).

How it works

The facility submits craniocaudal (CC) and mediolateral oblique (MLO) views from two mammographic examinations produced during a period the accreditation body specifies. One examination for each unit must be of dense breasts (predominance of glandular tissue) and the other of fat-replaced breasts (predominance of adipose tissue). All submitted images must be ones the facility's interpreting physicians interpreted as negative or benign. If the facility has no images that meet these conditions, it notifies the accreditation body, which specifies alternative selection methods that do not compromise patient care.

Why it matters

The selection rules prevent a facility from submitting only its best or easiest cases, and they keep abnormal cases in the patient's hands.

What it means to the patient or the client

For the client: identify qualifying examinations for each unit ahead of time, and tell the accreditation body early if a unit has none.

Can the FDA approve an alternative to a quality standard, and who can apply?

What it is

Yes. Under 21 CFR 900.18, the FDA may approve an alternative to a quality standard in 21 CFR 900.12 when it determines that the alternative will be at least as effective in assuring quality mammography, that it is too limited in applicability to justify amending the standard or offers a benefit so great that amending would take too long, and that it fits the purposes of the statute.

How it works

Mammography facilities and accreditation bodies may apply for alternatives to any of the quality standards, federal agencies and State governments that are not accreditation bodies may apply for alternatives to the personnel standards in 900.12(a), and equipment manufacturers and assemblers may apply for alternatives to the equipment standards in 900.12(b) and (e). An approval may be used only by the entity it was granted to and under the terms granted, except that when a manufacturer receives one, facilities using that equipment are also covered. The FDA can amend or withdraw an approval to protect human health.

Why it matters

Alternatives such as MQSA Alternative Standard 7 for mobile units and Alternative Standard 26 for density wording exist because of this rule.

What it means to the patient or the client

For the client: if you want to rely on an alternative standard, confirm that it was granted to you or to your equipment's manufacturer, and follow its conditions.

How can a facility appeal a denial of accreditation?

What it is

A facility denied accreditation or reaccreditation is entitled to an appeals process from the accreditation body, and the facility must use that process before asking the FDA for reconsideration (21 CFR 900.7 and 900.15).

How it works

If the facility cannot reach a satisfactory resolution through the accreditation body's appeal, it may request reconsideration from the FDA's Division of Mammography Quality Standards within 60 days of the accreditation body's adverse appeals decision. The request includes three copies of the original denial, everything the facility submitted in the appeal, the adverse appeals decision, and a statement of the basis for disagreement. A facility dissatisfied with the reconsideration is entitled to a formal hearing, and either the facility or the FDA may request review of the hearing officer's decision.

Why it matters

The steps go in order: the accreditation body's appeal first, then FDA reconsideration, a hearing, and a review. A facility cannot perform mammography services while an adverse accreditation decision is being appealed.

What it means to the patient or the client

For the client: the 60 day clock starts at the accreditation body's adverse appeals decision, so keep every appeal document and plan how patients will be served during the appeal.

When can the FDA deny an MQSA certificate to an accredited facility?

What it is

The FDA may deny a certificate application from a facility that an approved accreditation body has accredited, if it has reason to believe certain things (21 CFR 900.16(b)).

How it works

The reasons are that the facility will not be operated in accordance with the quality standards in 21 CFR 900.12, that it will not permit inspections or provide access to records or information in a timely fashion, or that it was guilty of misrepresentation in obtaining the accreditation. If the FDA denies the application, it gives the facility a statement of the grounds, and the facility may request reconsideration and appeal under 21 CFR 900.15(d).

Why it matters

Accreditation does not guarantee certification, because the FDA decides on the certificate separately.

What it means to the patient or the client

For the client: timely access for inspectors and honest, accurate accreditation applications protect the certificate as well as the accreditation.

Can a facility use equivalent wording instead of the required assessment statements?

What it is

The only authorized assessment statements are those in the quality standards and in the approved alternative standards (21 CFR 900.12(c)(1)(iv) and 900.18). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA also said that, as described in its MQSA Policy Guidance Help System, some closely worded variations of the approved assessment statements may generally be acceptable where the particular wording does not change the meaning of the category. The new statements for marker placement and for the two Incomplete assessments come from alternative standards the FDA approved in 2003.

Why it matters

A variation is acceptable only if it does not change the meaning, so exact wording is the safe course.

What it means to the patient or the client

For the client: use the exact approved statements in templates and in any speech recognition or macro text, and ask your accreditation body before using a variation.

Can a report use BI-RADS numbers or subcategories such as 4A instead of the assessment statement?

What it is

No. The FDA disagreed with permitting or encouraging alphanumeric subcategories such as 4A, 4B, and 4C in place of the assessment statement Suspicious. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

All the required assessment statements under the MQSA quality standards are words or phrases, not numbers. They are not identical to the numerical codes derived from the ACR's Breast Imaging Reporting and Data System. The FDA described BI-RADS as a practice guideline published by a professional society that is not associated with the MQSA quality standard requirements.

Why it matters

The MQSA assessment is the word or phrase. A BI-RADS number does not satisfy it, so a report needs the required statement.

What it means to the patient or the client

For the client: if your reports show BI-RADS categories, make sure each report also carries the required MQSA assessment statement, and train staff not to treat the two as the same thing.

How should a report handle a patient's cancer history, prior surgery, or a technical limitation?

What it is

The final assessment statement must still be one of the approved statements, and the other information goes elsewhere in the report (21 CFR 900.12(c)(1)(iv)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

A patient's history of cancer and prior surgery, and any relevant post-surgical findings, may be described in the report, but the report must conclude with a final assessment chosen from the approved statements, such as Benign or Suspicious. The FDA did not add a unique statement for these patients. For a mammogram with technical limitations, such as a patient unable to cooperate, the limitation should be documented elsewhere in the report, not in the assessment statement. The limitation of dense tissue must be stated using the density language in 900.12(c)(1)(vi)(C) or (D).

Why it matters

The assessment statement represents only the interpreting physician's final conclusion, and the explanations belong in the body of the report.

What it means to the patient or the client

For the client: configure report templates so cancer history and technical limits go in the findings section, and the closing line is always an approved statement.

What is the assessment statement, and what is the explanatory language that follows it?

What it is

For each final assessment category in 21 CFR 900.12(c)(1)(iv), the required assessment statement is only the word or phrase inside the quotation marks. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Each statement is followed by explanatory language outside the quotation marks. The FDA said that explanatory language is meant to promote consistent use of the category, but it is not part of the assessment statement and is not required in the report to the referring healthcare provider or in the lay summary. The final rule added a parenthetical to the regulation to make this clear: the assessment statement is only the word or phrase within the quotation marks. The FDA also kept Negative and Benign as separate categories.

Why it matters

Reports must use the exact words in the quotation marks, but need not repeat the explanations.

What it means to the patient or the client

For the client: check that report templates carry the exact quoted phrases for each category, and do not worry about reproducing the explanatory text.

What must a report do about clinical findings or symptoms when the assessment is negative or benign?

What it is

If the interpreting physician is aware of clinical findings or symptoms despite a negative or benign assessment, the report must document and address them (21 CFR 900.12(c)(1)(iv)(A) and (B)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The final rule changed the wording from "explained" to "documented and addressed," because the FDA agreed that the physician may not always be able to explain a finding or symptom in a patient with a negative or benign mammogram. The FDA said this clinical information, including information from a patient history form or interview that the referring provider may not know, should be documented and, if possible, explained or otherwise addressed.

Why it matters

The physician may hold pertinent history the referring provider does not, so the report is where it gets recorded.

What it means to the patient or the client

For patients: if you report a symptom at your mammogram, it should show up in the report even if the result is normal. For the client: make sure intake information reaches the interpreting physician and the report.

What is MammoComply?

What it is

MammoComply is the Mammologix service pillar for staying inspection-ready. It provides report-ready documentation, audit summaries, and KPI visibility that leadership can stand behind [1].

How it works

Mammologix tailors report structures to each client, delivers review-ready output, and organizes reporting around how leadership wants to review information. Deliverables include MQSA medical outcome audits, accreditation-ready reports, interpreting physician outcome reports (recall rate, cancer detection rate, PPV1, PPV2, sensitivity, and specificity), and biopsy and pathology concordance tracking. Mammologix maintains audit-ready records year-round and handles reporting complexity behind the scenes while helping protect sensitive data from unnecessary public exposure [1].

Why it matters

Facilities are not assembling materials at the last minute when an inspector arrives. Leaders and inspectors see organized reporting, credible documentation, and KPI visibility the practice can stand behind.

What it means to the patient or the client

Teams can act on compliance data without the burden of manual data hunting.

Which BCSC publication is the usual source for cancer detection rate benchmarks by age and breast density?

What it is

The Breast Cancer Surveillance Consortium (BCSC) maintains a Screening Performance Benchmarks page on bcsc-research.org. It is the usual reference for U.S. community-practice screening mammography benchmarks, including cancer detection rate [1].

How it works

The page is based on 2,695,664 digital mammography and 998,135 digital breast tomosynthesis screening examinations performed between 2011 and 2021. It links to tables covering clinical demographics, performance measures, and cancer characteristics. BCSC updates the page as new data are analyzed, so the current page should be checked for the most recent benchmarks instead of relying on an older paper [1].

Why it matters

A practice that compares its own cancer detection rate to a national benchmark needs current data and a matching patient grouping, or the comparison can mislead. Using the live BCSC page keeps the benchmark current.

Who assigns the breast density category, and does the FDA control it?

What it is

The interpreting physician assigns the breast density category as part of interpreting the mammogram. The FDA does not control the assignment. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA acknowledged that different interpreting physicians may assign different density categories to the same examination. After the physician assigns a category, the rule requires the category to be included in the report using the wording in 21 CFR 900.12(c)(1)(vi). The FDA noted that the four categories are already in wide use and conform to current clinical practice.

Why it matters

The rule standardizes the wording of the category, not the clinical judgment behind it.

What it means to the patient or the client

For the client: do not expect the regulation to settle a disagreement between readers about a category; use your own quality review if density assignments vary, and make sure the wording is always the required wording.

Do facilities certified by a State agency use the MQSA Facility Portal?

What it is

No. The portal change applies to facilities certified by the FDA. Illinois, Iowa, South Carolina, and Texas operate as State Certifying Agencies and are unaffected by the change.

How it works

Under the States as Certifiers program the FDA delegates certification to qualified states. The FDA's page says the agency may limit the scope of authority it delegates, and that to date it has not granted a State certification authority for Federal facilities.

Why it matters

Geography alone does not tell a facility which path applies. A federal facility located in one of the four states is not certified by that State.

What it means to the patient or the client

For the client: confirm each location's certifying authority from its own records, and write separate guidance for any State-certified sites.

Does access to the MQSA Facility Portal replace displaying a printed certificate?

What it is

No. Facilities are still legally required to prominently display a printed MQSA certificate on-site, according to the FDA's certificate delivery page, which cites section 263b(b)(1) of the statute and 21 CFR 900.11.

How it works

The portal is only the delivery channel. When a portal notice involves a certificate, the facility downloads it, prints it, and posts it where patients and inspectors can see it.

Why it matters

A certificate that sits in the portal but is not posted does not meet the display duty. The visible, current certificate is the proof of certification a patient or inspector sees.

What it means to the patient or the client

For patients: a mammography facility should have its current MQSA certificate on display. For the client: name who downloads, who prints, and who posts, so a portal notice always ends with a certificate on the wall.

How does a facility download a certificate from the MQSA Facility Portal?

What it is

The FDA describes a short login process for retrieving a certificate or letter.

How it works

The user logs in with the facility's Facility ID and email address, completes identity verification with a one-time passcode sent to that email, and then downloads the document directly. Each notification email gives step-by-step instructions for that event.

Why it matters

The passcode goes to the email address on file, so the login only works if that address receives mail and the person has access to it.

What it means to the patient or the client

For the client: make sure the contacts know the Facility ID and can receive a one-time passcode, and decide in advance who downloads, who prints, and who posts.

How long is an MQSA certificate valid, and what is a provisional certificate?

What it is

A fully certified facility has completed the accreditation review process and holds an MQSA certificate valid for three years, according to the FDA.

How it works

A provisionally certified facility holds a certificate valid for up to six months. A facility meeting certain criteria may receive a one-time 90-day extension. Provisional certification lets a new or reinstating facility collect the clinical images needed to complete accreditation.

Why it matters

The certificate cycle and the provisional window set the calendar for reaccreditation and for a new facility's first months.

What it means to the patient or the client

For the client: put the three-year expiration and any provisional end date on a shared calendar with the accreditation body's timeline.

How much warning does a facility get before its MQSA certification expires, and what rides on it?

What it is

The FDA issues a pending expiration letter ten calendar days before a facility's certification expires.

How it works

Under the new delivery process that letter arrives through the MQSA Facility Portal. The FDA's inspection page states that only facilities with a current MQSA certificate will be eligible to receive Medicare and Medicaid payment for screening and diagnostic mammography.

Why it matters

Ten days is a short window, and a lapse affects both the right to perform mammography and payment eligibility.

What it means to the patient or the client

For the client: do not wait for the pending expiration letter to plan reaccreditation, and make sure the contacts who receive it are monitored.

What is changing about how the FDA delivers MQSA certificates?

What it is

The FDA is moving delivery of MQSA certificates and certification-related letters from the mail to an online system, the MQSA Facility Portal.

How it works

A transition period begins September 14, 2026, during which a facility may receive both a mailed copy and a portal notification for the same document. After the FDA's implementation date of October 22, 2026, the FDA will no longer mail MQSA certificates or certification-related letters, and the facility retrieves them from the portal. The change applies to FDA-certified facilities, not to those certified by an approved State agency.

Why it matters

After the transition there is no mailed backup, so a missed portal notice is a missed certificate or letter. The change affects how documents arrive, not what the facility must do to stay accredited and certified.

What it means to the patient or the client

For the client: treat every portal notification as an action item, and do not wait on mail that may arrive late or not at all after October 22, 2026.

Which MQSA certificates and letters will the FDA deliver through the Facility Portal?

What it is

The FDA lists every certificate and letter type that will arrive through the MQSA Facility Portal.

How it works

The list is: 3-year certificates, replacement or duplicate certificates, provisional six-month certificates for new facilities and for reinstatement, 90-day extensions, Interim Notices (45 days), facility name change certificates, accreditation body switch certificates, pending expiration letters, no longer certified letters, denied accreditation letters, denied reaccreditation letters, and letters about three unsuccessful attempts at accreditation.

Why it matters

Each type marks an event in the facility's accreditation and certification cycle, so a portal notice can be time sensitive.

What it means to the patient or the client

For the client: route each type to the person who owns that part of your accreditation timeline, not only to whoever handles the printing.

Who receives MQSA Facility Portal notifications, and how can a facility make sure it sees them?

What it is

The FDA sends portal notification emails to three facility contacts: the Accreditation Contact, the Most Responsible Individual, and the Inspection Contact.

How it works

The emails come from fdsa_mqsa_certs@fda.hhs.gov. The FDA recommends confirming that the names and email addresses on file are current, using the CDRH MPRIS Helpdesk at cdrhmqrp@cdrh.fda.gov for updates, and adding the sending address to approved contact lists so the messages are not filtered as spam. The sending address does not accept replies.

Why it matters

A notice can be delivered successfully and still go unseen if a contact points to a shared inbox, a former employee's address, or an account that blocks the sender.

What it means to the patient or the client

For the client: check all three contacts now, test that each address receives a message, and confirm that someone monitors each one.

Does Medicare or Medicaid pay for mammography at a facility that is not MQSA certified?

What it is

The FDA's Small Entity Compliance Guide does not answer the payment question itself. It says no facility subject to MQSA may conduct a mammography exam unless it holds a certificate, a temporary renewal certificate, or a provisional certificate (42 U.S.C. 263b(b)(1)).

How it works

The guide says the Centers for Medicare and Medicaid Services regulations govern the amount and frequency of Medicare and Medicaid reimbursement, and that questions about payment should go to CMS. A facility that is not certified or provisionally certified must stop providing mammography services.

Why it matters

Whether a payer will pay is a CMS question, and a facility that is not certified cannot lawfully perform the exam in the first place.

What it means to the patient or the client

For the client: keep the certificate current, because a lapse stops mammography services, and ask CMS or your payers directly about reimbursement.

How are mobile mammography units certified and inspected?

What it is

A mobile facility can have one certificate with several locations, or each unit can be a separate certified facility, depending on the accreditation body.

How it works

The FDA's inspection procedures say some facilities, primarily mobile, have several certificates with different ID numbers for different units, and describe mobile facilities that operate more than one site under the same certificate. For each site under one certificate, the inspector reviews quality control records and conducts a phantom image test for each unit. The FDA's inspection fee page says providers with several mobile units and some stationary sites under two or more certificates may combine their facilities, for inspection purposes only, to reduce the total fee. The page, current as of September 25, 2025, gives a formula in which the first unit carries the full fee and each additional unit adds a smaller amount. Inspections of the units are done by the FDA or by the State certifying agency, as for any facility.

Why it matters

How the certificates are set up decides how many inspections and fees a mobile program faces.

What it means to the patient or the client

For the client: confirm with your accreditation body how each mobile unit is certified, and ask your inspector about fee consolidation before the inspection. Check the fee page for the current amounts, because fees change.

How can a facility check whether another mammography facility's MQSA certification is current before referring a patient?

What it is

The FDA publishes a searchable list of FDA and State certified mammography facilities, by State or ZIP code, and says the list is updated weekly.

How it works

The FDA also says all MQSA certificates have an expiration date and that only a facility with a valid, unexpired certificate can lawfully provide mammography services, so the certificate itself is the other check. The FDA states that the list does not mean the FDA or any other organization recommends one certified facility over another, and that Veterans Health Administration facilities are not included. A facility that needs its listed address or telephone number corrected must contact its accreditation body. Because the list is refreshed weekly, a very recent change in status may not yet show.

Why it matters

Referring a patient to a facility without a valid certificate puts the patient and the referral relationship at risk.

What it means to the patient or the client

For the client: check the FDA list before you set up a new referral relationship, and ask a facility you are unsure about to show its current certificate. Keep a dated record of what you found.

How can a facility tell whether a new satellite suite needs its own MQSA certificate?

What it is

Generally yes, when the suite is a separate physical location. The FDA's Small Entity Compliance Guide says the FDA distinguishes each mammography facility by its physical location, and that a healthcare network offering mammography at several locations must apply for accreditation and certification of each location as a separate facility. The FDA's inspection procedures also state that one certificate equals one facility.

How it works

The regulation defines a facility as a hospital, outpatient department, clinic, radiology practice, mobile unit, office of a physician, or other facility that conducts mammography activities (21 CFR 900.2). The FDA inspection procedures describe mobile facilities that operate more than one site under the same certificate, and tell inspectors to review the records and test each unit at each site, so the accreditation body and the certifying agency decide how an unusual arrangement is certified. The FDA's certification page lists the FDA and the States of Illinois, Iowa, South Carolina, and Texas as certifying agencies.

Why it matters

Opening a mammography location without the right certificate means performing mammography without a valid certificate.

What it means to the patient or the client

For the client: before you open or equip a new suite, ask your accreditation body and certifying agency in writing whether it will operate under the parent certificate or needs its own, and keep the answer. Do not start examinations until you have it.

How does a facility apply for a 90-day extension of a provisional certificate?

What it is

A facility with a provisional certificate may apply for a 90-day extension (21 CFR 900.11(b)(3)). There can be no renewal of a provisional certificate beyond the extension.

How it works

The facility submits to its accreditation body a statement of what it is doing to obtain certification and evidence that there would be a significant adverse impact on access to mammography in the geographic area served if it did not get the extension. The accreditation body forwards the request, with its recommendation, to the FDA within 2 business days of receiving it. The FDA may issue the extension if it determines the request meets the criteria in the statute.

Why it matters

The extension turns on access to mammography in the area, so the evidence has to show the community impact, not only the facility's need.

What it means to the patient or the client

For the client: ask your accreditation body early, gather evidence about the area you serve, and start the request before the provisional certificate runs out.

How does a new facility get a provisional MQSA certificate?

What it is

A new facility that begins operating after October 1, 1994 may apply for a provisional certificate (21 CFR 900.11(b)(2)). It lets the facility perform mammography and obtain the clinical images needed to complete the accreditation process.

How it works

The facility applies to an approved accreditation body, or another entity the FDA designates, and submits the information required by the statute. After the accreditation body reports that the facility submitted the required information, the FDA may issue the provisional certificate. It is effective for up to 6 months from the date of issuance and cannot be renewed, but the facility may apply for a 90-day extension.

Why it matters

The provisional certificate is a bridge to accreditation. A facility that cannot finish accreditation inside the window has one limited extension to rely on.

What it means to the patient or the client

For the client: plan the first clinical images and the accreditation timeline from the day the provisional certificate is issued, because there is no renewal.

What does a facility need to lawfully perform mammography under MQSA?

What it is

A certificate issued by the FDA is required for the lawful operation of every mammography facility subject to the rule. The requirement applies to facilities under United States jurisdiction that provide mammography, with the exception of the Department of Veterans Affairs (21 CFR 900.10 and 900.11(a)).

How it works

To obtain a certificate, a facility must meet the quality standards in 21 CFR 900.12 and be accredited by an approved accreditation body or another entity the FDA designates. The facility applies to the accreditation body and submits the information required by the statute. After receiving the accreditation body's decision to accredit, the FDA may issue or renew the certificate if it finds the facility has met the requirements.

Why it matters

Accreditation and certification are two steps by two parties: the accreditation body decides on accreditation, and the FDA decides on the certificate.

What it means to the patient or the client

For patients: a mammography facility should hold a current MQSA certificate. For the client: keep your accreditation and certification dates together so neither lapses unnoticed.

Does MQSA require 3D mammography, set a screening interval, or say who needs supplemental imaging?

What it is

No. The FDA said the choice of imaging technology and of screening interval is for healthcare providers and patients, not the MQSA regulations. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA does not require facilities to offer specific equipment or particular modalities, noting that the choice of technology for each patient is a decision by the interpreting physician and the referring provider. It said the MQSA does not take a position on the frequency or interval for screening mammography, and it declined to require real-time interpretation, additional ultrasound, or the use of any particular technology to determine breast density. It said decisions about ultrasound, molecular breast imaging, MRI, or other tests for patients with dense breasts belong to healthcare providers, who know the patient's history. The density statement tells patients that in some people with dense tissue, other imaging tests in addition to a mammogram may help find cancers.

Why it matters

Clinical choices are left to providers and patients, and the rule only requires the communication, not the care pathway.

What it means to the patient or the client

For patients: how often to be screened, and whether you need other imaging, is a conversation with your healthcare provider. For the client: your service offerings are a business and clinical choice, not an MQSA requirement.

What consumer complaint system must a mammography facility have?

What it is

Each facility must establish a written and documented system for collecting and resolving consumer complaints, and must keep a record of each serious complaint for at least 3 years (21 CFR 900.12(h)).

How it works

A facility must also give the consumer adequate directions for filing serious complaints with the facility's accreditation body if the facility cannot resolve a serious complaint to the consumer's satisfaction, and must report unresolved serious complaints to the accreditation body in the manner and timeframe the body specifies. The rule text does not prescribe a posted notice format or wording. The accreditation body checks during onsite visits that a complaint mechanism is in place and being followed (21 CFR 900.4(f)). The FDA tells consumers to contact the facility's complaint coordinator first, then the accreditation body, and to call the FDA MQSA Hotline at 1-800-838-7715 for serious issues that remain unresolved.

Why it matters

The complaint system is a checked requirement, and the 3 year record is something inspectors and accreditation bodies can ask to see.

What it means to the patient or the client

For the client: keep a written complaint procedure, name a complaint coordinator, give patients the accreditation body's contact details, and keep the log of serious complaints for at least 3 years.

What must a facility's consumer complaint system include?

What it is

21 CFR 900.12(h) requires every facility to have a documented system for consumer complaints. A consumer can be the patient or the patient's representative, such as a family member or referring healthcare provider.

How it works

The facility must establish a written and documented system for collecting and resolving consumer complaints. It must keep a record of each serious complaint for at least 3 years from the date it was received. If it cannot resolve a serious complaint to the consumer's satisfaction, it must give the consumer adequate directions for filing the complaint with the facility's accreditation body, and it must report unresolved serious complaints to the accreditation body in the manner and timeframe the accreditation body specifies.

Why it matters

The rule covers more than collecting complaints: it requires the path to the accreditation body when the facility cannot settle one.

What it means to the patient or the client

For patients: if a mammography facility cannot resolve a serious complaint, it must tell you how to take it to its accreditation body. For the client: write the policy, give patients the directions in writing, and keep each serious complaint on file for at least 3 years.

Where can I find OCR guidance about business associate agreements for a vendor that handles patient tracking letters or outcome data?

What it is

The Department of Health and Human Services, Office for Civil Rights (OCR), publishes general guidance on HIPAA business associate agreements, but it does not address patient tracking letter vendors or outcome data vendors by name. HIPAA defines a business associate by what the vendor does, in 45 CFR 160.103 [1].

How it works

A business associate is a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains, or transmits protected health information for a function HIPAA regulates, including data analysis, quality assurance, practice management, and administration. The definition also includes a person that provides data transmission services with routine access to protected health information, and a subcontractor of a business associate. A written business associate contract that meets 45 CFR 164.504(e) is required. A practice using a vendor for patient tracking letters or outcome data should apply this framework, since no scenario-specific OCR guidance exists. Mammologix recommends that the practice also review the vendor relationship with its privacy officer or counsel, and with its IT specialist for security questions.

Why it matters

A practice that misclassifies a vendor handling tracking letters or outcome data as exempt from a business associate agreement risks a HIPAA compliance gap. Getting this right protects the practice during an OCR audit or complaint investigation.

What does direct supervision mean under MQSA?

What it is

Direct supervision is defined in 21 CFR 900.2(o) and applies throughout the personnel requirements.

How it works

It means one of two things, depending on the task. During joint interpretation of mammograms, the supervising interpreting physician reviews, discusses, and confirms the diagnosis of the physician being supervised and signs the resulting report before it is entered into the patient's records. During a mammography examination, or a survey of the facility's equipment and quality assurance program, the supervisor is present to observe and correct, as needed, the work of the person being supervised.

Why it matters

The definition requires the supervisor's presence or sign-off, not just availability. Supervised examinations counted toward a qualification only count if this standard was met.

What it means to the patient or the client

For the client: keep a record that shows who supervised each training examination and read, and that the supervisor reviewed and signed or was present.

How can a facility appeal an order to notify patients, and what happens if it cannot or will not do the notification?

What it is

The FDA's Small Entity Compliance Guide says a facility that receives a patient and provider notification order can appeal it, under 21 CFR 10.75, to the next level supervisor of the official who signed the order.

How it works

The guide points facilities to the FDA's guidance on appeal options for adverse accreditation decisions, suspension or revocation of certificates, and patient and physician orders. If a facility is unable or unwilling to carry out the notification, the FDA or the State certifying agency may notify patients and their referring providers individually or through the mass media. The FDA generally intends to post a Public Safety Notice of the facility's noncompliance and image quality issues, and an accreditation body is not likely to accept a reaccreditation application until pending compliance actions are resolved. Civil money penalties may be assessed, including for each failure to notify a patient of risk.

Why it matters

Declining to notify does not end the matter, and it can affect reaccreditation and lead to public notice and penalties.

What it means to the patient or the client

For the client: if you receive a notification order, read the appeal instructions at once, work out the deadline, and contact counsel before the notification timeframe runs.

A part was repaired or replaced and the facility is unsure whether it needs an equipment evaluation. What does the FDA recommend?

What it is

The FDA's Small Entity Compliance Guide recommends that the facility or its medical physicist contact the mammography unit or display device manufacturer for clarification when it is unclear whether an equipment evaluation is indicated.

How it works

Digital units must follow a quality assurance program substantially the same as the one the image receptor manufacturer recommends (21 CFR 900.12(e)(6)), so the manufacturer's program decides whether a given adjustment, change, or repair calls for an equipment evaluation. If the manufacturer says no evaluation is indicated, the FDA recommends asking the manufacturer to provide a written statement for the facility's records. The same advice applies to software upgrades to units and display devices.

Why it matters

A written manufacturer statement documents why no evaluation was done if an inspector asks.

What it means to the patient or the client

For the client: when service is done on a unit or display, ask the service engineer to note in writing whether the manufacturer's program requires an equipment evaluation, and file the answer with the service record.

Can a digital unit upgraded to tomosynthesis start imaging patients in 3D right away?

What it is

No. The FDA's Small Entity Compliance Guide says the FDA considers each imaging modality a separate unit because of the technology differences, so a single system that provides two modalities must be accredited as two separate units.

How it works

A software upgrade that lets a full field digital unit work in tomosynthesis mode therefore needs a mammography equipment evaluation within the six months before the unit accreditation application, documentation that the evaluation was passed, and confirmation that the application is under review. After the accreditation body confirms the unit meets the requirements, it can be used on patients and to obtain the clinical images the body needs for its review. The guide adds that a facility may use the 3D mode alone only if it is a separately accredited modality, and that a combination mode unit whose 2D portion is not accredited would not comply with MQSA.

Why it matters

Turning on a new modality without accreditation means using an unaccredited unit.

What it means to the patient or the client

For the client: treat a modality upgrade like a new unit, with the equipment evaluation, the accreditation application, and the confirmation in hand before the first 3D exam.

Can a facility use the ACR quality control manual for digital mammography?

What it is

Yes. The FDA said the current ACR Digital Mammography Quality Control Manual, with its tomosynthesis supplement, has been approved as applicable to any facility as alternative standard number 24. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The manual is not written into the codified rule, because a revised edition would need FDA review to confirm it is at least as effective. A facility that adopts the ACR manual for its full field digital or tomosynthesis system may not limit it to a single piece of equipment, such as a display, while following a different quality control program, such as the manufacturer's manual, for the mammography unit. The FDA also noted that having a quality control program does not mean the premarket authorization requirements for a device are met.

Why it matters

A facility picks either the manufacturer's program or the ACR manual for the system, and applies it consistently.

What it means to the patient or the client

For the client: decide whether to follow the manufacturer's quality control manual or the ACR manual for each digital system, write that decision down, and apply it to the whole system.

Can general purpose x-ray equipment be used for mammography?

What it is

No. 21 CFR 900.12(b)(1) prohibits using radiographic equipment designed for general purpose or special nonmammography procedures for mammography.

How it works

The prohibition includes systems that have been modified or equipped with special attachments for mammography. All radiographic equipment used for mammography must be specifically designed for mammography and must be certified as meeting the applicable FDA performance requirements in effect at the date of manufacture. All devices used in mammography must also have met the applicable FDA premarket authorization requirements for medical devices of that type and intended use.

Why it matters

A converted general purpose unit does not meet the rule, even if it produces acceptable images.

What it means to the patient or the client

For the client: confirm that every unit in use was designed for mammography, and get that confirmation in writing when you buy or lease equipment.

Do mammography display monitors need FDA premarket authorization?

What it is

Generally yes. All devices used in mammography must have met the applicable FDA premarket authorization requirements for medical devices of that type and intended use (21 CFR 900.12(b)(2)(i)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said this applies to devices used in the acquisition, processing, or display of digital mammographic images. For example, a display device used to interpret digital mammographic images generally needs 510(k) clearance before it is used in a mammography facility. Not all equipment needs clearance: some devices, such as medical image storage devices, may be exempt from premarket notification, and the classification regulation should be checked. A facility interpreting mammograms on a display that has not met the applicable premarket requirements would generally be in violation of the quality standards. The existence of quality control tests for a display does not satisfy the premarket requirements.

Why it matters

A display's quality control program and its premarket clearance are separate requirements, and a facility must meet both.

What it means to the patient or the client

For the client: confirm that every interpretation display is cleared for mammography use and keep the clearance documentation with the equipment records.

Is a facility responsible for making its imaging equipment compatible?

What it is

Yes. The FDA agreed that facilities are responsible for ensuring that equipment used in the acquisition, processing, interpretation, retention, and retrieval of mammographic images is compatible. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The reason is that compatible equipment facilitates mammography practice and allows compliance with the record retention, transfer, and release provisions in 21 CFR 900.12(c)(4). The FDA did not add a cautionary statement to the rule, saying facilities will readily be able to determine whether their equipment is interoperable. It also said the requirement that mammograms be presented for interpretation in the original modality means, for example, that screen-film mammograms must be presented as the original hardcopy films, not digitized or scanned.

Why it matters

An image chain that cannot display, store, or send the original images puts the retention and transfer duties at risk.

What it means to the patient or the client

For the client: when you replace a unit, a workstation, or PACS software, test that the new combination can still display, retain, and release your original images, including prior studies.

What film may a facility use to print digital mammograms?

What it is

Since September 10, 2024, a facility that uses hardcopy prints of digital images for transfer, retention, or final interpretation must use a type of film that the film manufacturer designates as appropriate for those purposes and compatible with the printer in use (21 CFR 900.12(b)(11)).

How it works

The FDA's Small Entity Compliance Guide states this as a new requirement from the 2023 rule. Facilities that never print digital images for these purposes are not affected.

Why it matters

Prints used for interpretation or retention need to be made on film the manufacturer designates for that use.

What it means to the patient or the client

For the client: if you print any digital images, check the film manufacturer's designation for your printer and keep the specification in your equipment records.

What must an already certified facility do before it uses a newly installed mammography unit?

What it is

According to the FDA's Small Entity Compliance Guide, a newly installed unit in a certified facility can be used only after a mammography equipment evaluation by a qualified medical physicist within the six months before the unit accreditation application, and after the unit is accredited by the facility's accreditation body.

How it works

The facility must have documentation showing the unit passed the equipment evaluation before it is used on patients (21 CFR 900.12(d)(2) and (e)(10)). The guide also says the facility should have confirmation that the accreditation application for the new unit has been accepted and is under review, and that the FDA generally treats a unit as undergoing accreditation once the initial part of the application is submitted and confirmed as under review. Later equipment evaluations can be done by a medical physicist or under a physicist's direct supervision. The facility should then follow its accreditation body's guidelines for new units.

Why it matters

Clinical use without the evaluation and the accreditation process underway is a compliance problem.

What it means to the patient or the client

For the client: do not schedule patients on a new unit until the physicist's evaluation report is in the file and the accreditation body has confirmed your application.

When does a converted mammography unit count as a new unit?

What it is

Under 21 CFR 900.12(b)(2)(ii), a mammography unit that is converted from one mammographic modality to another is considered a new unit at the facility.

How it works

Before clinical use, the converted unit must undergo a mammography equipment evaluation demonstrating that it complies with the applicable requirements. The facility must also follow its accreditation body's procedures for applying for accreditation of that unit.

Why it matters

Conversion triggers the same steps as installing a new unit. The unit cannot be used clinically until the evaluation shows compliance.

What it means to the patient or the client

For the client: schedule the equipment evaluation and the accreditation application before a conversion goes live, and treat the converted unit's first clinical day as dependent on both.

Who is responsible for quality control of remote review workstations, and what does it involve?

What it is

The facility that performs the mammogram is responsible for meeting the quality standards, including the quality assurance and quality control program, even when the interpretation is performed in a different location (42 U.S.C. 263b(a)(3)(B)).

How it works

The FDA's Small Entity Compliance Guide says all review workstations, on site or remote, need a quality assurance program that is substantially the same as the one recommended by the image receptor manufacturer. A remote workstation, like an on-site one, needs an annual survey by an MQSA-qualified medical physicist or someone under the physicist's direct supervision, and an equipment evaluation when it is installed, reassembled, or has a major component changed or repaired (21 CFR 900.12(e)(6), (9), and (10)). If the image receptor manufacturer does not name tests for the workstation, the guide says to refer to the workstation manufacturer, and then to seek guidance from a standards body experienced with display devices.

Why it matters

The accountability stays with the facility that performed the exam, whatever the reader's location.

What it means to the patient or the client

For the client: if radiologists read from home or from another site, keep survey and equipment evaluation records for each remote workstation in your files and cover them in your quality control schedule.

What must a facility do when a patient has breast implants?

What it is

21 CFR 900.12(g) sets two requirements for mammography of patients with breast implants.

How it works

The facility must have a procedure to ask whether the patient has breast implants before the examination begins. Except where contraindicated, or unless a physician's directions modify it, patients with implants must have mammographic views that maximize the visualization of breast tissue.

Why it matters

The question has to be asked before the examination, because it changes which views are taken.

What it means to the patient or the client

For patients: you may be asked about implants before your mammogram, so that more views can be taken to see breast tissue well. For the client: build the question into scheduling or intake so it is asked every time.

Does a change of ownership change a facility's MQSA responsibilities?

What it is

The FDA's MQSA inspection procedures say the owner or operator of a mammography facility is always responsible for the facility's activities under MQSA.

How it works

A change of ownership does not relieve the current owner of that responsibility. If problems found at an inspection continue under new management, the new management must address them, even if they were found while a previous owner ran the facility. Whether the FDA takes enforcement action after an ownership change is decided case by case and depends on factors such as the facility's earlier compliance record.

Why it matters

A buyer inherits open inspection findings. Reviewing the facility's last inspection report during the transaction avoids learning about open items afterward.

What it means to the patient or the client

For the client: when you buy or take over a facility, open inspection findings come with it, so review the last inspection report and any open corrective actions before you close. Under MQSA the current owner answers for the facility.

Does a facility need a new MQSA certificate when it moves?

What it is

When a facility moves, its MQSA certificate is still valid, according to the FDA's inspection procedures.

How it works

The facility must notify its accreditation body, which tells it about any extra information or testing and informs the FDA or the certifying State of the new address. Any mammography unit, processor, or laser printer that is disassembled and reassembled, at the same or a different location, needs a mammography equipment evaluation by a medical physicist, and any failure found must be corrected before the equipment is used on patients. FDA-issued certificates carry only the facility name, so an address change does not need a replacement certificate; facilities with State-issued certificates should ask their State agency.

Why it matters

The certificate follows the facility, but the equipment evaluation follows the equipment. Planning the physicist's visit before reopening avoids patient imaging on untested equipment.

What it means to the patient or the client

For the client: a move does not require a new certificate, but you must notify your accreditation body. Schedule the physicist's equipment evaluation before patients are imaged on any unit that was taken apart and reassembled.

What happens to the MQSA certificate when a facility changes only its name?

What it is

When a facility changes its name but keeps the same owner, personnel, and equipment, its MQSA certificate stays valid, according to the FDA's inspection procedures.

How it works

The facility notifies its accreditation body, which informs the FDA or the certifying State. A new certificate with the new name is issued with the same expiration date, because the facility has not been reaccredited or recertified. Until the new certificate arrives, the facility must prominently display its original certificate, and once the new one arrives it should stop displaying the original.

Why it matters

The accreditation body is the facility's route for name, address, and ownership changes. Telling it promptly keeps the certificate and the public record in step.

What it means to the patient or the client

For the client: tell your accreditation body about a name change, and keep displaying your original certificate until the new one arrives. The new certificate keeps the same expiration date.

What must a facility do for patients and records when it closes or stops providing mammography?

What it is

A facility that closes or ceases to provide mammography services must notify its accreditation body and certification agency of the arrangements it has made, including reasonable efforts to notify all affected patients (21 CFR 900.12(c)(4)(v)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said reasonable efforts may include sending written notification to patients by a traceable method, speaking directly to patients by telephone, or asking referring providers to reach patients the facility could not contact directly. It did not create a standard form. For records, the facility must permanently transfer mammographic records to the patient or the patient's healthcare provider, or transfer them to another facility or entity that will provide access for the retention periods in 900.12(c)(4)(i), which are longer than 24 months. If a facility ceases mammography but continues as a medical entity and can satisfy the recordkeeping requirements, it may keep the records unless a transfer is requested by or for the patient.

Why it matters

Records stay accessible for the same retention periods whether or not the facility continues to perform mammography.

What it means to the patient or the client

For patients: if your facility stops doing mammograms, you should be told, and your records must remain available to you and your provider. For the client: add patient notification, record transfer, and the notice to your accreditation body to your closure checklist.

What notification rules apply when a mammography unit is moved?

What it is

The FDA's notification protocols describe four scenarios for moving a mammography unit, and the requirements vary by accreditation body and state certifying agency.

How it works

For a wheeled unit moved within the same building, most bodies require no prior notification, the FDA and most states expect notice within 30 days, and post-move testing is required before examinations. For a non-wheeled unit within the same building, several states and the FDA require prior notice, and an equipment evaluation replaces the pre-examination test if the unit was taken apart and reassembled. A move to a different building usually needs prior notification and an equipment evaluation. A move to a facility with a different MQSA ID requires prior notice, a new accreditation process, and an equipment evaluation.

Why it matters

Because the rules differ by accreditation body and state, a facility should confirm with both before the move, not after. The page was current as of March 22, 2018, so check the FDA page for later changes.

What it means to the patient or the client

For the client: confirm the rules with both your accreditation body and your state before you move a unit, not after, because they differ. The FDA page was current as of March 22, 2018, so check it for later changes.

When did the 2023 MQSA amendments take effect, and when did facilities have to comply?

What it is

The FDA published the final rule amending the MQSA quality standards in the Federal Register on March 10, 2023 (88 FR 15126).

How it works

The rule took effect 18 months after publication. The FDA stated that mammography facilities needed to be in compliance with the amended regulations by September 10, 2024. The amendments include the breast density wording in the report and in the lay summary, the revised assessment statements, and the expanded lay summary content.

Why it matters

The September 10, 2024 date is the point at which inspectors assess facilities against the amended wording.

What it means to the patient or the client

For the client: confirm that every report and lay summary template has been updated to the amended wording, and keep the update date on file in case an inspector asks.

Can a copy of a mammogram be used for a second opinion, or only for comparison?

What it is

It depends on the modality. Either original images or exact copies of digital examinations may be used for interpretation, such as a second opinion, or for comparison. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Copies of screen-film examinations may be used for comparison but not for interpretation, because the FDA does not consider film copies to be in the original mammographic modality. A receiving facility that cannot view a hardcopy image may ask for a scanned or digitized copy for comparison. The original film is required only when it is being submitted for interpretation, such as a second opinion. The rule does not specify which types of images must be included when copies are released, and images from other imaging modalities are outside the rule.

Why it matters

A film second opinion needs the original film, while a digital second opinion can use an exact digital copy.

What it means to the patient or the client

For patients: if you ask for a second opinion on a screen-film mammogram, the original film may be needed. For the client: tell receiving facilities which kind of image you are sending and why.

Does MQSA require DICOM format, and is image compression allowed?

What it is

MQSA does not require a specific file format, and it treats lossless compression differently from lossy compression (21 CFR 900.12(c)(4)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA acknowledged that DICOM is the predominant format but said requiring a specific format would be overly restrictive and could limit future formats. Because lossless compression permits complete reconstruction of the image data, images compressed that way are generally considered original mammograms for the retention rule. Images that have undergone lossy compression, which does not keep all of the image data, would generally not be considered original mammograms for that purpose. The FDA said there is no consensus on how much information loss is acceptable.

Why it matters

A facility can store images in any format and compress them losslessly, but lossy copies are generally not the original the rule requires it to keep and transfer.

What it means to the patient or the client

For the client: ask your PACS vendor whether stored images use lossless or lossy compression, and keep an original that is not lossy for every examination you must retain.

How may a facility transfer or release mammography images?

What it is

The rule does not prescribe technical methods for transfer or release of mammograms. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said acceptable methods may include, if they otherwise comply with applicable law, direct electronic transmission of digital files between two facilities using HIPAA-compliant practices, providing HIPAA-compliant remote electronic access to the images in the originating facility's PACS, viewing the images on a physical storage medium such as a CD, or uploading images from a storage medium to the receiving facility's PACS. The FDA views all of these as meeting the requirement to provide original digital images electronically. It declined to require electronic transmission capability or to create a national image repository, citing burden and privacy concerns.

Why it matters

A CD is acceptable, and so is secure electronic access, as long as the images are the required originals or exact copies and privacy rules are met.

What it means to the patient or the client

For the client: document which methods you offer, make sure each is HIPAA compliant, and keep a log of when images were sent or access was opened.

What does retaining a mammogram in its original modality mean for film, digital, and tomosynthesis images?

What it is

Mammograms must be presented for interpretation in the original mammographic modality in which they were performed, and must be retained in retrievable form in that modality and not produced by copying or digitizing hardcopy originals (21 CFR 900.12(c)(1) and (c)(4)(i)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

For screen-film mammography, the original films must be retained, and they cannot be copied, scanned, or digitized to meet the requirement. Images from full field digital mammography or tomosynthesis must be retained in digital format, with the file format and other characteristics of the original image files preserved. If digital images are printed and read on hardcopy, the facility may keep the print alongside the digital data, but a scan of the print cannot be the sole record. Computer-aided detection markings must be removable, so the images can be displayed without them; a set with permanent markings alone would not meet the retention requirement.

Why it matters

The retained record must be the true original, not a copy or a version altered by overlaid marks.

What it means to the patient or the client

For the client: confirm with your PACS administrator that digital originals are stored in their native format, that CAD marks can be turned off, and that no scanned film has replaced an original.

What is the difference between transferring a mammogram and releasing a copy, and between interpretation and comparison?

What it is

The FDA defined these terms when it explained the transfer and release requirements in 21 CFR 900.12(c)(4)(ii) through (iv). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Transfer means conveying the mammogram so that the sending facility no longer retains it. This is common for screen-film examinations and extremely rare for digital and tomosynthesis examinations, where the original stays in the sending facility's PACS and a copy is released. Interpretation means an initial, repeat, or additional review of a mammogram, including a second opinion, and must use the examination in its original modality. Comparison means using a mammogram to help interpret another exam, and is not subject to the original modality requirement. Release of copies has less strict requirements than transfer of an original.

Why it matters

The purpose of the request decides what must be sent: an original or exact digital copy for interpretation, and any usable copy for comparison.

What it means to the patient or the client

For the client: when a request arrives, record whether it is for interpretation or comparison, because that decides which images you must send.

Can a facility dispute an MQSA inspection finding?

What it is

Yes. According to the FDA's inspection procedures, when a facility has been cited as the result of an MQSA inspection, regardless of whether the observation is Level 1, Level 2, or Level 3, the facility has the right to disagree with the observation.

How it works

The facility notifies the FDA district office in writing of its disagreement. The FDA district or regional MQSA compliance contact obtains any needed additional information from the facility, then contacts the State or the inspector to discuss the observation. After reviewing all the information, the compliance contact determines whether the observation was justified. For a Level 3 observation, which needs no response, the same steps apply if the facility disputes it.

Why it matters

The dispute path is written and goes to the FDA district office. It does not stop the response clock for observations that need a response.

What it means to the patient or the client

For the client: if you disagree, put it in writing with your evidence, and still plan the corrective response unless the FDA tells you otherwise.

How long does a facility have to respond to an MQSA inspection finding?

What it is

The FDA's inspection procedures tie the response deadline to the highest level of observation in the inspection report.

How it works

For Repeat Level 1, Level 1, and Repeat Level 2 observations, the response is due within 15 working days. For Level 2 and Repeat Level 3 observations, it is due within 30 working days. For a Level 3 observation, no response is needed, and the correction is checked at the next inspection. If there are no observations, no response is needed. For Level 1 and Level 2 observations, the facility is asked to submit a written response.

Why it matters

The deadline depends on the highest level in the inspection report. The FDA's procedures give the number of working days but this page does not say exactly when the count begins, so the facility should confirm the start date in its report or with the FDA district office.

What it means to the patient or the client

For the client: note the level and the response time as soon as you receive the report, confirm the start date, and assign one person to gather the evidence and write the response. The facility also has the right to disagree with an observation.

What do Level 1, Level 2, and Level 3 mean in an MQSA inspection?

What it is

The FDA classifies inspection observations by severity, because some have a greater effect on the quality of mammography than others. The FDA's inspection procedures describe three levels.

How it works

A Level 1 observation means the inspector found one or more deviations from MQSA standards that may seriously compromise the quality of mammography services; it is the most serious level. A Level 2 observation means the facility's performance is generally acceptable, but the inspector found one or more deviations that may compromise quality. A Level 3 observation means performance is generally satisfactory, with one or more minor deviations. If there are no observations, the report notes that all items are in compliance. An observation that was not corrected, or that recurred since the last inspection, is identified as a Repeat observation at the exit interview.

Why it matters

Level 1 is the most serious and Level 3 the least. The level decides how fast the facility must respond.

What it means to the patient or the client

For the client: the level number runs from most serious (1) to least serious (3), so treat a Level 1 as urgent. Check the exit interview notes for any observation marked Repeat. This describes the FDA's 2015 inspection procedures; confirm against the current FDA guidance.

Who is the most responsible individual for MQSA violations at a facility?

What it is

The FDA's inspection procedures define the most responsible individual as the person at the facility who has the duty and authority to make major decisions about corrective action and general operations.

How it works

Major decisions include approving purchase of expensive equipment such as a new x-ray system, hiring and firing interpreting physicians, technologists, or physicists, and requiring and ensuring significant quality assurance changes. The title does not decide it: the example given is a radiology department chairman who reports to a medical director but holds that authority, who is then the most responsible individual. If an inspector finds serious noncompliances, the FDA addresses a Warning Letter to that person, with copies to the addressee's superior and to the highest known official in the organization.

Why it matters

The role follows authority over decisions, and a Warning Letter reaches both that person and senior leadership.

What it means to the patient or the client

For the client: confirm that the name on file as most responsible individual belongs to the person with real authority over equipment, staffing, and quality assurance changes, and that the person monitors the email address on file.

Does the FDA publish a list of recurring MQSA inspection findings for mock surveys?

What it is

Not in the pages and documents the FDA lists for facilities. The FDA's inspection resources page lists inspection news, guidance on preparing for an inspection, inspection fees, CMS reimbursement issues, and follow-up for inspection violations, and the page states that the standard inspection questions are limited to items the FDA believes have the most direct bearing on facility performance.

How it works

The FDA's national statistics page reports totals rather than individual findings: for fiscal year 2026 as of September 1, 2026, it showed 8,027 facilities inspected, Level 1 noncompliance of 1 percent, Level 2 noncompliance of 15.5 percent, and no noncompliance in 83.4 percent of inspections. The MQSA Inspection Procedures, Version 7.0, set out the inspection questions and how findings are scored, so they work as a mock survey checklist. FDA warning letters, which the question mentions, are published separately.

Why it matters

A mock survey built from the inspection procedures covers the same questions an inspector will ask.

What it means to the patient or the client

For the client: build your mock survey from the FDA inspection procedures and the current preparation guidance, and use the national statistics page only to see how often facilities have findings.

How much notice does a facility get before an MQSA inspection, how long does it take, and who should attend the closeout?

What it is

The FDA's Small Entity Compliance Guide says the inspector normally gives the facility at least five business days of advance notice and works with the facility on scheduling to limit inconvenience.

How it works

Based on national data, an on-site inspection of a facility with one mammography unit could take five to six hours. The inspector usually watches the technologist take a phantom image and scores it at the acquisition or review workstation. The FDA recommends having all needed records organized and readily available, and having staff on hand for questions. After the inspection the inspector generally meets with the facility to discuss any noncompliance and the timeframes for pending documents or corrective action. The FDA recommends that the lead interpreting physician, inspection contact, quality control technologist, radiology manager, and, if possible, the most responsible individual attend the closeout, which could take about 15 to 20 minutes.

Why it matters

A prepared facility makes the inspection shorter and gets a clearer closeout discussion.

What it means to the patient or the client

For the client: put the inspection date and the five people on a standing list, and keep an inspection folder ready with the records in one place.

How should a facility prepare for the annual MQSA inspection?

What it is

The FDA's MQSA Insights page describes what facilities can do to help the annual inspection go smoothly.

How it works

Inspectors give at least 5 business days' notice. Facilities should gather and organize their records beforehand, allow about 20 minutes per mammography unit for taking and scoring the phantom image, and keep staff available for questions. The lead interpreting physician, the quality control technologist, the radiology manager, and the facility's MQSA contact should attend the exit interview, which typically lasts 15 to 20 minutes. The inspector provides the final report within 5 business days, and adverse observations must be corrected within the timeframes the report states.

Why it matters

Organized records shorten the inspection and reduce missed items. Having the right people at the exit interview means findings are heard by those who can act on them.

What it means to the patient or the client

For the client: with at least 5 business days' notice, the preparation that matters most is organized records and the right people at the exit interview. Allow about 20 minutes per mammography unit for the phantom image.

How should a facility respond to inspection observations, and what can the FDA do if the response is not enough?

What it is

The FDA's Small Entity Compliance Guide says a facility should address all noncompliance on the Post-Inspection Report, including observations in printable remarks, in a written response to the FDA compliance officer. If the response appears adequate, the FDA may decide no further action is needed and tell the facility the matter is closed.

How it works

If the response is not sufficient, or the facility does not respond, the FDA may re-inspect to verify the problems are corrected. The FDA may also issue a Warning Letter or take other action, such as requiring an Additional Mammography Review, imposing a Directed Plan of Correction or civil money penalties, or suspending or revoking the certificate (42 U.S.C. 263b(h) and (i)). Repeat Level 2 observations tied to the EQUIP initiative may lead to an Additional Mammography Review by the facility's accreditation body.

Why it matters

A complete, documented written response is the way to close an observation without escalation.

What it means to the patient or the client

For the client: assign one person to answer each observation, keep the evidence of the correction with the response, and track the response deadline.

What do MQSA inspectors check in mammography reports and patient letters?

What it is

The FDA's MQSA Insights page says inspectors check a sample of mammography reports and the patient lay summary letters.

How it works

Inspectors select at least five mammography reports and check that each has the patient's name and an identifier, the facility's name and location, the date of the examination, the interpreting physician, acceptable assessment category wording, and an acceptable breast density assessment. Patient lay summary letters are checked for the patient's name, the facility address, and the federal breast density notification statement.

Why it matters

These are the items most easily fixed in a template. A report or letter template that carries every required element each time prevents repeat findings.

What it means to the patient or the client

For the client: these are the items most easily fixed in a template, so check that every report and lay letter template carries each element every time. For patients: this is why your letter shows your name, the facility's address, and the breast density statement.

What does the annual MQSA inspection review, and does it review image quality?

What it is

The FDA's Small Entity Compliance Guide says each facility location must be inspected at least annually for equipment performance, quality assurance records, quality control records, personnel qualification records, medical records (reports) and lay summaries, and medical audit and outcome records.

How it works

The quality control records include the technologists' tests, the medical physicist's annual survey report, and any equipment evaluations. Documents the inspector may review include accreditation and certification papers, licenses, board certifications, training letters and experience records, a sample of reports and a sample of lay summary letters, and a phantom image from each unit. The guide says annual inspections typically do not review clinical image interpretations or quality, which the accreditation body reviews separately. A facility could therefore have image quality problems even when the inspection finds none. States may also inspect items required by their own laws at the same visit, which generally do not affect MQSA compliance or the MQSA inspection fee.

Why it matters

A clean inspection does not show that images are good, so image quality needs its own attention.

What it means to the patient or the client

For the client: use your own clinical image review and the accreditation body's results to watch image quality, not the inspection result alone.

What does the Post-Inspection Report contain, and how many levels of noncompliance are there?

What it is

The Post-Inspection Report identifies the key facility contacts, the mammography units, the phantom image score for each unit, and the inspector's observations by level of noncompliance, with remarks to help the facility respond. The FDA says identical observations found at two consecutive inspections are identified as repeats.

How it works

The FDA's MQSA Inspection Procedures, Version 7.0 (2015), describe three levels of noncompliance, with Level 3 the minor findings. The FDA's Small Entity Compliance Guide, issued August 26, 2024, describes two levels in practice. Level 1 means one or more deviations from key MQSA requirements that may compromise the quality of mammography, the most severe findings. Level 2 means the facility meets key requirements but failed to meet one or more significant quality items. A footnote in the guide says the FDA previously described three levels but generally classifies observations into two. The inspector generally aims to send the final report within five business days of the on-site inspection, or of receiving pending documents.

Why it matters

The three level scheme is still in the FDA's inspection procedures, while current practice uses two, so a facility should know both.

What it means to the patient or the client

For the client: expect observations to be reported as Level 1 or Level 2 in practice, and keep the three level definitions in mind, because the inspection procedures still describe them.

What is an Additional Mammography Review, and how is it different from an accreditation image review?

What it is

An Additional Mammography Review, or AMR, is a review of clinical images and other information by the accreditation body or the State certifying agency that the FDA or the State orders when it believes mammographic quality at a facility has been compromised and may present a significant risk to human health.

How it works

The FDA's Small Entity Compliance Guide says the review helps determine whether the facility meets the quality standards, including the accreditation body's clinical image quality standards, and whether patients, referring providers, or the public need to be notified. Before September 10, 2024, the test was a serious risk to human health. The guide gives a Level 1 phantom image failure at inspection as an example of when an AMR might be ordered. Accreditation, reaccreditation, and random clinical image reviews are different: accreditation bodies use them to evaluate the ongoing quality of mammography at all facilities, not to investigate suspected problems at one facility.

Why it matters

An AMR is a targeted response to a quality concern and can lead to patient notification.

What it means to the patient or the client

For the client: if you receive an AMR notice, respond within the stated timeframe and treat it as a priority, because the FDA's guide says a facility's failure to comply with the terms of an AMR can lead the FDA to require patient and provider notification.

How can a facility whose MQSA certificate lapsed or was revoked get it reinstated?

What it is

A facility whose certificate expired, was refused renewal, or was suspended or revoked may apply for reinstatement so that it can be treated as a new facility and be eligible for a provisional certificate (21 CFR 900.11(c)).

How it works

The facility contacts an FDA-approved accreditation body or other entity designated by the FDA to learn the reapplication requirements. It documents its history as a previously certified facility, including its earlier name and address, previous owner or lessor, FDA facility identification number, and the expiration date of its most recent certificate. It also submits a corrective action plan describing how it has corrected the deficiencies behind the lapse. The FDA may issue a provisional certificate once the accreditation body reports that the deficiencies are corrected or being corrected and the FDA finds sufficient corrective action. After receiving it, the facility may lawfully resume mammography while completing certification.

Why it matters

If a certificate was revoked for an act described in the statute, no person who owned or operated the facility when the act occurred may own or operate a mammography facility within 2 years of the revocation date.

What it means to the patient or the client

For the client: start with your accreditation body, collect the documents the history requires, and write the corrective action plan before applying.

What happens to the owners and operators of a facility whose certificate is revoked?

What it is

Under the statute, when a facility's certificate is revoked, the owners and operators at the time of the revocation may not own or operate a mammography facility for 2 years. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said an operator may include the lead interpreting physician, other interpreting physicians, the quality control technologist, other technologists, medical physicists, or other staff, depending on the circumstances, and declined to define the term further. At the end of the 2 years, those operators will have failed to maintain their qualifications and must reestablish them under the requirements for their profession before resuming practice at a certified facility. Before a revoked facility can return to mammography, it must comply with all corrective actions its accreditation body requires, and it is again subject to all accreditation and certification requirements.

Why it matters

A revocation carries a two-year bar and a requalification step, in addition to the corrective action required to return.

What it means to the patient or the client

For the client: the consequences of revocation reach individual operators, not only the facility, which is a reason to treat serious findings and records requests seriously.

When can the FDA require a facility to notify patients about poor mammography quality?

What it is

21 CFR 900.12(j) lets the FDA or a State certification agency require patient and provider notification when mammographic quality at a facility may present a significant risk to human health.

How it works

If the FDA or State agency believes quality has been compromised, the facility must provide clinical images and other relevant information for review by the accreditation body or the State agency. If the agency then determines that the quality was so inconsistent with the standards as to present a significant risk to human health, it may require the facility to notify all patients who received mammograms, or those at risk, and their referring healthcare providers, of the deficiencies, the potential harm, and appropriate remedial measures. The notification occurs within a timeframe and in a manner the agency specifies. If the facility is unable or unwilling to notify, the agency may notify patients and providers individually or through the mass media.

Why it matters

The trigger is a determination by the FDA or the State agency, not by the facility alone, and the rule sets no fixed number of days: the agency specifies the timeframe.

What it means to the patient or the client

For patients: if a facility's mammography quality is found to be a significant risk, you can be told directly. For the client: respond promptly and completely to a request for clinical images, because failing to comply is itself a ground for suspension or revocation.

When can the FDA suspend or revoke a facility's MQSA certificate?

What it is

21 CFR 900.14 lists the grounds on which the FDA may suspend or revoke a mammography facility's certificate.

How it works

After notice and an opportunity for a hearing, the FDA may act if the facility, owner, operator, or any employee has misrepresented facts in obtaining the certificate, failed to comply with the quality standards of 900.12, failed to comply with reasonable requests for records, information, reports, or materials (including clinical images for an additional mammography review), refused a reasonable request to inspect, violated the underlying statute, failed to comply with earlier sanctions such as a directed plan of correction or patient and referring physician notification, or failed to honor personnel requests for their qualification records. The FDA may suspend before a hearing if the failure presents a serious risk to human health, a refusal to permit inspection makes immediate suspension necessary, or there is reason to believe the violation was intentional or tied to fraud.

Why it matters

Failing to answer an inspector's or accreditation body's reasonable request for records is itself a ground, separate from any quality problem.

What it means to the patient or the client

For the client: treat every records request from the FDA, a State agency, or your accreditation body as a deadline, and answer it in full.

Who can suspend or revoke a certificate in a State that certifies its own facilities?

What it is

In a State that is an FDA-approved State Certifying Agency, the State suspends or revokes certificates under its own process, not under the FDA's rule. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA explained that Subpart C of Part 900 sets the procedures and standards for State certifying agencies. These agencies must have criteria and processes for suspension and revocation of certificates, and a process for appeals of inspection findings, enforcement actions, and adverse certification decisions. They cannot suspend or revoke certificates under the authority in 21 CFR 900.14, which applies to FDA certificates.

Why it matters

The path of enforcement and appeal depends on who certified the facility.

What it means to the patient or the client

For the client: if your facility is certified by a State agency, use the State's suspension, revocation, and appeal procedures and contacts, not the FDA's.

Who is notified in a patient and referring provider notification, and who does it if the facility will not?

What it is

When the FDA or a State agency requires a facility to notify patients about a significant risk from poor mammography quality, the notification goes to affected patients and their referring healthcare providers (21 CFR 900.12(j)(2)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The 2023 rule changed the text to cover non-physician referring providers as well as physicians, and replaced the word physician with provider or healthcare provider in several sections. If a facility is unable or unwilling to perform the notification, the FDA or the State certification agency may notify the affected population. The FDA declined to require that it use direct notification before mass media, because that could delay notice to patients, and said it will choose the methods that best serve public health in each case.

Why it matters

Notification does not depend on the facility's cooperation, and it reaches non-physician providers as well as physicians.

What it means to the patient or the client

For patients: if a facility's mammography quality is found to be a significant risk, you and your provider can be notified even if the facility will not do it. For the client: keep referring provider contact records complete, including nurse practitioners and physician assistants.

Does MQSA set performance benchmarks or require double reading for interpreting physicians?

What it is

No. The FDA said the MQSA and Part 900 do not contain specific benchmarks for the performance of interpreting physicians, and it declined to add a requirement for double reading. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said the existing requirements are adequate: supervised interpretation is already required for initial qualification and for requalification. It said careful review of the annual medical outcomes audit may help physicians choose continuing education, but it did not agree that additional supervised interpretation for qualified physicians is necessary.

Why it matters

The regulation sets qualifications and requires the audit, but it does not set a performance cut-off that triggers a consequence.

What it means to the patient or the client

For the client: if you want benchmarks or double reading for new, requalifying, or outlying readers, that is a facility policy decision, not an MQSA requirement.

How do interpreting physicians get feedback between annual audits?

What it is

The FDA pointed to two existing mechanisms rather than adding a requirement for continuous case-by-case feedback. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Clinical images produced by a certified facility must continue to comply with the image quality standards of its accreditation body (21 CFR 900.12(i)). To ensure compliance, facilities conduct regular periodic reviews of the image quality of samples of the images performed by each radiologic technologist and the images accepted for interpretation by each interpreting physician. That review provides periodic image quality feedback. Physicians also receive outcomes feedback from the annual medical outcomes audit and must meet the continuing education and experience requirements.

Why it matters

Periodic image quality review gives feedback on images, and the audit gives feedback on outcomes.

What it means to the patient or the client

For the client: run and document the periodic image quality review for each technologist and each physician, because it is the rule's feedback mechanism between audits.

Why does MQSA not require more experience, a diagnostic minimum, or case-based continuing education?

What it is

The FDA considered and declined several proposals to strengthen the interpreting physician requirements. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

It said the current continuing experience requirements in 21 CFR 900.12(a)(1)(ii) are a reasonable balance between maintaining ongoing ability and preserving access to mammography. It declined to add a minimum number of diagnostic mammograms, a requirement that physicians work up their own recalled cases, extra requirements for lower volume or low-income facilities, and specific requirements for active, case-based learning, saying each risked reducing personnel and patient access. It said the requirements are baseline national standards, and that nothing prohibits physicians from getting more experience or facilities from requiring it.

Why it matters

The standard is a floor set to protect access. Facilities that want more can require it.

What it means to the patient or the client

For the client: use the regulation as the minimum, and set higher internal expectations for experience or education where your patients and physicians would benefit.

Are marker placement and localization mammograms counted in the medical outcomes audit?

What it is

No. The FDA agreed that mammograms used for localization should be excluded from the medical outcomes audit, and the required calculations in 21 CFR 900.12(f)(1)(i) through (iii) do not include them. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The rule added the assessment category "Post-Procedure Mammogram for Marker Placement" for that clinical situation. A mammogram given that assessment, rather than Suspicious or Highly Suggestive of Malignancy, is not a positive mammogram and should not be counted in any audit calculation that tracks the outcomes of positive mammograms. The FDA also repeated that the assessment statements are words and phrases, not numeric codes.

Why it matters

Counting a marker placement mammogram as positive would distort the audit numbers.

What it means to the patient or the client

For the client: make sure the post-procedure marker mammogram is assigned its own assessment statement in your reporting system so it falls out of the audit automatically.

Are the three required audit metrics a ceiling, and can a facility link its audit to a cancer registry?

What it is

No. The FDA said the required metrics, PPV, cancer detection rate, and recall rate, are minimum requirements. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

Facilities are not restricted from calculating additional metrics if they choose. The FDA said the medical outcomes audit is intended to allow each facility to assess and improve its own performance. On linking outcomes data with cancer registries, the FDA said it is outside the scope of the rule, although the regulations do not prohibit facilities from adopting the practice.

Why it matters

The required metrics are a floor. Registry linkage and extra measures are permitted but not required.

What it means to the patient or the client

For the client: use the three required metrics as your baseline, and add measures or registry linkage only where they help you improve; you will not be cited for adding them.

Can owners of several mobile mammography units combine their medical outcomes audit?

What it is

MQSA Alternative Standard 7 lets an owner of several mobile mammography units perform one combined medical outcomes audit, treating the units together as a single facility, instead of a separate audit for each unit.

How it works

The alternative changes the requirement in 21 CFR 900.12(f)(1). The FDA approved it on November 4, 2002 and amended it effective December 3, 2002, with no time limit. Every one of these conditions must be met: each facility is a single mobile unit, the same entity or group administers all the included units, the same lead interpreting physician ensures compliance across them, the same group of radiologists reads the images from all of them, and all of them serve the same patient population.

Why it matters

Mobile programs that meet all five conditions can run one audit instead of several. If any condition stops being true, such as a second reading group, the combined audit no longer fits.

What it means to the patient or the client

For the client: a mobile program that meets all five conditions can run one audit instead of one per unit. If a condition stops being true, such as a second reading group, the program goes back to separate audits.

Does a facility with no positive mammograms still have to do a medical outcomes audit?

What it is

Yes. The FDA's Small Entity Compliance Guide says that since September 10, 2024 every facility's audit must include at least three metrics: positive predictive value, cancer detection rate, and recall rate (21 CFR 900.12(f)(1)).

How it works

Recall rate is the percentage of screening mammograms given an assessment of Incomplete: Need additional imaging evaluation, so it can be calculated even when there are no positive mammograms. Cancer detection rate also counts patients who received that Incomplete assessment, so a facility that uses it should have a system to obtain, or try to obtain, the pathology results for those who then had a biopsy. The audit covers both screening and diagnostic mammograms. A facility with no positive examinations and no pathology results should calculate the recall rate and keep written documentation of how its audit system would follow up positive cases and cancers that become known to it, correlate pathology results with the interpreting physician's findings, and perform the analyses each year.

Why it matters

A small or screening-only facility still has an audit duty, and the written description is the evidence that the system exists.

What it means to the patient or the client

For the client: if your facility has few or no positive exams in a year, calculate your recall rate anyway and keep a short written description of your follow-up, correlation, and annual analysis steps.

Does the audit interpreting physician have to be the lead interpreting physician?

What it is

No. The rule says each facility must designate at least one interpreting physician to review the medical outcomes audit data at least once every 12 months (21 CFR 900.12(f)(3)). It does not say that person must be the lead interpreting physician.

How it works

The audit interpreting physician records the dates of the audit period, analyzes the results, documents the results, notifies the other interpreting physicians of their results and the facility aggregate, and documents any follow-up. The lead interpreting physician has the general responsibility for ensuring the quality assurance program meets the requirements in 900.12(d) through (f), and no one else may keep a quality assurance task unless the lead has judged that person qualified (900.12(d)(1)(i)). The regulation text does not require a signed attestation for the audit. The Mammologix library summary of the FDA's inspection procedures says oversight by the lead interpreting physician may be shown by an attestation, a signed procedure, or verbal answers at inspection, and that an attestation signed before the inspection date is used when the lead cannot attend.

Why it matters

The audit review is a designated role, and the lead's oversight is a separate duty.

What it means to the patient or the client

For the client: name the audit interpreting physician in writing, make sure that person actually does the analysis and the notifications, and keep the lead's oversight record separate. A covering radiologist can be designated for the audit if the facility documents the designation.

How is the cancer detection rate calculated for the MQSA audit, and can a facility add a diagnostic rate?

What it is

The required cancer detection rate is a single calculation for screening mammograms (21 CFR 900.12(f)(1)(ii)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA recognized that the clinical community uses several methods, including calculating the rate only for screening mammograms or separately for screening and diagnostic mammograms. It treats its calculation as a minimum, so a facility may calculate the rate by additional methods. The FDA also noted that the required PPV is essentially equivalent to the cancer detection rate for diagnostic mammograms, so by meeting the rule a facility calculates both a screening rate and a diagnostic equivalent.

Why it matters

One required calculation covers screening, and the PPV supplies the diagnostic counterpart, so a separate diagnostic rate is optional.

What it means to the patient or the client

For the client: if you want a separate diagnostic detection rate, calculate it as an extra and keep the regulatory screening rate as the main figure.

How is the cancer detection rate defined and calculated under MQSA?

What it is

Under 21 CFR 900.12(f)(1)(ii), cancer detection rate is a ratio per 1,000 patients, based on patients who were first examined with a screening mammogram.

How it works

Among those patients, take the ones who received an assessment of Incomplete: Need additional imaging evaluation, Suspicious, or Highly Suggestive of Malignancy on the screening mammogram or on a later diagnostic mammogram. Count how many of them were diagnosed with breast cancer within 1 year of the date of the initial screening mammogram, and express that number as a ratio per 1,000 patients.

Cancer detection rate = breast cancers diagnosed within 1 year of the initial screening mammogram, per 1,000 screened patients, as defined in 21 CFR 900.12(f)(1)(ii)

Why it matters

The one year follow up is part of the definition, so the rate is not final until that year has passed. Using the same patient base each year keeps the rate comparable over time.

What it means to the patient or the client

For the client: the rate is not final until the one year follow up has passed, so report it with its audit period and use the same patient base each year. The rule sets no target, so compare it with professional benchmarks.

How is the recall rate defined and calculated under MQSA?

What it is

Under 21 CFR 900.12(f)(1)(iii), recall rate is the percentage of screening mammograms given an assessment of Incomplete: Need additional imaging evaluation.

How it works

Count the screening mammograms in the audit period, count how many received that assessment, and divide. The denominator is screening mammograms, not patients and not diagnostic examinations. The rule defines the measure but does not set a target range for it.

Recall rate (%) = screening mammograms assessed Incomplete: Need additional imaging evaluation / all screening mammograms x 100

Why it matters

Recall rate is one of the three measures the audit must determine. Because the rule gives no target, a facility compares its rate with professional benchmarks and keeps the definition stated exactly the same way each year.

What it means to the patient or the client

For the client: count screening mammograms only and define the measure the same way each year. The rule sets no target range, so compare your rate with professional benchmarks and treat a change as a question to look into.

How long must medical outcomes audit data be kept, and who may see it?

What it is

At a minimum, the data must be retained until the MQSA inspection that covers that medical outcomes audit (21 CFR 900.12(f)(4)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

After that inspection, the facility and the audit interpreting physician may decide whether the data still has use and may choose a longer retention period. The rule requires that each interpreting physician be notified of that physician's individual audit results and the facility's aggregate results. Beyond that, the FDA said the facility and the audit interpreting physician can decide who else, if anyone, may have access to the data.

Why it matters

The retention minimum is tied to the inspection, and access beyond the required notices is a facility decision.

What it means to the patient or the client

For the client: write a short audit data policy that states how long you keep it after the inspection and who can see physician level results.

How long must medical outcomes audit records be kept?

What it is

The records and data that show the facility is meeting the audit requirements have a retention rule in 21 CFR 900.12(f)(4).

How it works

They must be kept until the annual inspection that follows the facility's analysis of that information. The requirement covers the records and data behind the audit, not only the final summary.

Why it matters

A facility that analyzes in one year is asked about it at the next inspection. Keeping the supporting data until then lets it show how the numbers were produced.

What it means to the patient or the client

For the client: keep the data behind each audit, not only the summary, until the annual inspection that follows your analysis. That lets you show an inspector how the numbers were produced.

How must a facility calculate positive predictive value for the MQSA audit?

What it is

The required PPV is the percent of patients with positive mammograms who are diagnosed with breast cancer within 1 year of the date of the mammographic examination (21 CFR 900.12(f)(1)(i)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said this metric is essentially identical to the PPV2sc used by the clinical practice community, and uses the same 1-year interval. The clinical community recognizes several PPV methods, including PPV1, PPV2sc, PPV2dx, and PPV3. The FDA treats its metric as a minimum requirement, so facilities may also calculate additional PPVs by other methods. The FDA did not adopt a particular edition of a clinical guideline for the definitions.

Why it matters

The regulation fixes one required calculation and leaves additional PPV variants to the facility.

What it means to the patient or the client

For the client: report the regulatory PPV on its own line, and add PPV1, PPV2, or PPV3 as extras if you use them, labeled with their definitions.

How often must a facility analyze its medical outcomes audit?

What it is

The medical outcomes audit is an analysis the facility repeats on a schedule set in 21 CFR 900.12(f)(2).

How it works

The first audit analysis must be started no later than 12 months after the facility becomes certified, and it is completed within a further 12 months so that diagnostic procedures and data collection can finish. After that, an audit analysis is conducted at least once every 12 months.

Why it matters

The one year outcome window means a year of data is not final on the day the year ends. Facilities that plan the analysis date with that follow up time in mind avoid reporting numbers that later change.

What it means to the patient or the client

For the client: plan the analysis date with the one year follow up in mind, because a year of outcomes is not final the day the year ends. The first analysis can start up to 12 months after certification and has a further 12 months to finish.

What counts as a positive mammogram for the medical outcomes audit?

What it is

The regulation defines a positive mammogram as a mammogram that has an overall assessment of findings that is either "suspicious" or "highly suggestive of malignancy" (21 CFR 900.2(mm)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said this definition is used in the audit metrics in 21 CFR 900.12(f), and that the final rule distinguishes screening from diagnostic mammography only for the purpose of calculating the audit metrics. The FDA declined to adopt the definitions of positive and negative studies from a particular edition of the ACR's BI-RADS, to avoid restricting the future development of mammography practice.

Why it matters

For the audit, a mammogram is positive only for those two assessments, so the audit follows up on Suspicious and Highly Suggestive of Malignancy cases, not every callback.

What it means to the patient or the client

For the client: use the regulatory definition for the required audit, and if you also track a broader clinical definition, label it separately so the two are not confused.

What does an MQSA inspector check about the medical outcomes audit?

What it is

The FDA described what inspectors generally verify about the audit during the annual inspection. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The inspector generally verifies that the facility completed its medical outcomes audit during the period the inspection covers, or, in the first 2 years of a facility's operation, that the facility established the required audit procedures and designated an audit interpreting physician. The inspector checks that the three required metrics have been calculated, or that the procedures to calculate them are in place. The inspector verifies that the audit interpreting physician notified each interpreting physician of individual results and the facility's aggregate results, and that follow-up actions were documented. The FDA said inspectors generally will not document the specific values the audit produced.

Why it matters

The inspection checks that the audit was done and communicated, not the particular numbers.

What it means to the patient or the client

For the client: be ready to show the completed audit for the period, the dated notices to each physician, and the documentation of any follow-up.

What does the audit interpreting physician have to do?

What it is

Each facility must designate at least one interpreting physician to review the medical outcomes audit data (21 CFR 900.12(f)(3)).

How it works

That physician reviews the data at least once every 12 months and records the dates of the audit periods. The physician is responsible for analyzing the results and documenting them, for notifying the other interpreting physicians of their own results and the facility's aggregate results, and, if follow up actions are taken, for documenting the nature of that follow up.

Why it matters

The rule names these duties on one accountable person. A facility that cannot show the dates, the results, the notice to each physician, and any follow up has gaps an inspector can find.

What it means to the patient or the client

For the client: name one accountable physician and keep proof of each duty: the audit dates, the results, the notice to every interpreting physician, and any follow up. For the interpreting physicians: you are owed your own results and the facility's aggregate results.

What three measures must a mammography medical outcomes audit include?

What it is

Each facility must run a medical outcomes audit program that follows up positive mammographic assessments and correlates pathology results with the interpreting physician's findings (21 CFR 900.12(f)).

How it works

The analysis is done for each interpreting physician and for all physicians together, and at a minimum determines three things: positive predictive value (the percent of patients with positive mammograms who are diagnosed with breast cancer within 1 year of the examination), cancer detection rate (breast cancers diagnosed within 1 year per 1,000 patients first examined with screening mammograms who received an assessment of Incomplete, Suspicious, or Highly Suggestive of Malignancy), and recall rate (the percentage of screening mammograms assessed Incomplete: Need additional imaging evaluation).

Why it matters

These are the measures the rule requires. Other measures, such as PPV2, PPV3, or sensitivity, come from professional guidance and are useful, but the regulation sets only these three as the minimum.

What it means to the patient or the client

For the client: these three are the minimum your audit must determine, for each interpreting physician and for the facility together. PPV2, PPV3, and sensitivity are useful additions from professional guidance, not requirements of the rule.

Which screening assessments count toward the recall rate?

What it is

Recall rate under 21 CFR 900.12(f)(1)(iii) is the percentage of screening mammograms given an assessment of "Incomplete: Need additional imaging evaluation." The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

A comment suggested counting screening mammograms assessed as category 0, 3, 4, or 5 as positive. The FDA kept its definition and noted that assigning Probably Benign, Suspicious, or Highly Suggestive of Malignancy to a screening mammogram is clinically discouraged and rarely occurs in practice.

Why it matters

Only the Incomplete assessment on a screening mammogram counts toward the required recall rate, so the rate depends on assigning that assessment consistently.

What it means to the patient or the client

For the client: make sure your reporting system assigns the Incomplete statement to every screening mammogram that needs more imaging, because that is what the audit counts.

How many mammography procedures does the FDA say are performed each year?

What it is

As of September 1, 2026, the FDA's MQSA national statistics page reports 45,025,781 total annual mammography procedures.

How it works

The FDA explains that the number is an aggregate of the totals that facilities report to their accreditation bodies at the time of re-accreditation, which takes place once every three years. It aggregates only the numbers reported by MQSA-certified facilities other than Veterans Health Administration facilities. The FDA notes that the aggregate may not reflect the current number of procedures performed at these facilities.

Why it matters

Because each facility's figure comes from its own re-accreditation cycle, the total mixes reports from different years, so it is an estimate and not a count for one year.

What it means to the patient or the client

For the client: quote the figure as the FDA's reported aggregate with its date and caveat, not as an exact annual count.

How many MQSA-certified mammography facilities and units are there?

What it is

The FDA's MQSA national statistics page reports how many facilities are certified and how many units are accredited. As of September 1, 2026 it lists 9,128 total certified facilities and 27,793 total accredited units.

How it works

The page breaks the totals down by technology. It lists 9,126 certified facilities with 2D digital units and 14,218 accredited 2D digital units (including full field digital and computed radiography), and 8,657 certified facilities with digital breast tomosynthesis units and 13,575 accredited DBT units. The FDA states the statistics are updated on the first of each month; the page was current as of September 4, 2026.

Why it matters

These are counts of certified facilities and accredited units. They do not show where facilities are, how far patients travel, or whether there is capacity.

What it means to the patient or the client

For the client: use the national counts as context only, and combine them with local data on travel time and capacity before using them to judge patient access. The numbers change monthly, so cite the date.

What do the FDA's fiscal year 2026 MQSA inspection statistics show?

What it is

The FDA reports inspection statistics for fiscal year 2026, as of September 1, 2026.

How it works

It lists 8,027 facilities inspected and 23,986 total units at the inspected facilities. It reports the percent of inspections whose highest noncompliance was Level 1 (1%) or Level 2 (15.5%), and the percent with no noncompliance (83.4%). The page does not break out Level 3 observations in this summary.

Why it matters

Most inspections found no noncompliance, and Level 1 was the highest finding in only about 1 percent. Level 2 was the highest finding in about 15.5 percent, roughly one inspection in six.

What it means to the patient or the client

For the client: use the percentages as a benchmark for how your own inspection compares, and remember that they are national figures for the fiscal year to date, not a target.

Does MQSA tell facilities which screening age or interval to follow, or what recall rate to meet?

What it is

No. The FDA said the MQSA quality standards do not specify benchmark or target values for audit metrics such as recall rate, and that decisions on which clinical practice guidelines to follow belong to the healthcare provider. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The final rule requires facilities to include recall rate and certain other metrics in the medical outcomes audit (21 CFR 900.12(f)(1)(i) through (iii)), to compile the information, and to review it internally to encourage their own quality improvement. The FDA said recommended age ranges and time intervals for screening mammography are more appropriately decided by the healthcare provider, and that the MQSA ensures that mammography, wherever and whenever it is recommended, meets consistent baseline quality standards. The FDA called a request to set different clinical protocols beyond the scope of the rulemaking.

Why it matters

MQSA checks that mammography is done to a quality standard, not that any one screening schedule is followed.

What it means to the patient or the client

For patients: when to start and how often to be screened is a decision with your healthcare provider. For the client: set your own recall rate targets from your audit and published benchmarks, and record the reasoning.

How can a facility keep up with MQSA changes, and who can it call with questions?

What it is

The FDA's Small Entity Compliance Guide says facilities can subscribe to the MQSA listserv on the FDA's MQSA program website to receive email updates when new information is posted, and can contact the MQSA Hotline at 1-800-838-7715 with questions about the 2023 rule.

How it works

The guide also describes the National Mammography Quality Assurance Advisory Committee, which Congress mandated and which has between 13 and 19 members, including physicians, other practitioners, and consumer and industry representatives. It advises the FDA on mammography standards and regulations, standards for accreditation bodies, sanctions, compliance monitoring, a mechanism to investigate consumer complaints, new developments in breast imaging, and access to mammography in rural and health professional shortage areas.

Why it matters

MQSA guidance changes over time, and the FDA's own channels are the reliable way to see new requirements.

What it means to the patient or the client

For the client: assign one staff member to subscribe to the listserv, to review the FDA's MQSA pages on a schedule, and to bring changes to your compliance lead.

How does the FDA keep MQSA inspections consistent between inspectors?

What it is

The FDA said it trains all MQSA inspectors, whether FDA employees or State employees who inspect under State contracts, and sends updated information whenever necessary. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA also said that other FDA staff, including Radiological Health representatives and auditors, oversee inspections and provide inspectional guidance. It concluded that these measures already promote consistency and quality, and declined a request to focus the final rule on inspector consistency. The FDA also noted that accreditation bodies such as the ACR are involved in accreditation only, not in certification or inspection, which is part of the certification process.

Why it matters

Inspections are carried out by FDA and State inspectors working from the same FDA training and guidance.

What it means to the patient or the client

For the client: a facility that disagrees with an inspection finding has a written route to dispute it with the FDA, and the inspection procedures document is the common reference for both sides.

What is the difference between an accreditation body and a certifying agency, and could the FDA be the only accreditation body?

What it is

Under MQSA, accreditation bodies and certification agencies have separate responsibilities. The FDA, or a State certifying agency, certifies facilities after they meet all prerequisites, including accreditation by an FDA-approved accreditation body. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

A commenter recommended that the FDA become the sole accreditation body. The FDA disagreed, pointing to the statute and to 21 CFR part 900, subparts A and C, which distinguish the two roles. It noted that the ACR is one of several FDA-approved accreditation bodies. The accreditation bodies assess image quality, review clinical and phantom images for initial and renewal accreditation, and review a random sample of facilities, and they must tell the FDA about equipment or practices that may pose a serious risk to human health. The FDA said its relationship with each accreditation body, including the ACR, is governed by MQSA and meets applicable Federal ethics requirements, and it declined a request for an independent conflict-of-interest review.

Why it matters

A facility needs both an accreditation body's approval and a certificate from the FDA or a State certifying agency to operate.

What it means to the patient or the client

For the client: treat accreditation and certification as two steps with two different agencies, and track the due dates for each in your calendar.

What MQSA requirements keep mammography image quality up?

What it is

The FDA said image quality is addressed by several existing parts of the rules, not by a single requirement. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

These include the accreditation body's clinical image and phantom image reviews (21 CFR 900.4), the eight image quality attributes in the accreditation body's clinical image reviews (900.4(c)(2)(i) through (viii)), personnel qualifications (900.12(a)), equipment requirements (900.12(b)), quality assurance requirements (900.12(d) through (f)), and the general requirement that clinical images continue to comply with the image quality standards of the facility's accreditation body (900.12(i)). The FDA also noted that its Enhancing Quality Using the Inspection Program (EQUIP) initiative, introduced in 2017, highlighted facility responsibilities for maintaining clinical image quality. The FDA declined to require that random mammograms from all facilities be sent to FDA radiologists for review, saying the accreditation bodies already assess image quality initially and continually.

Why it matters

Image quality depends on people, equipment, quality control, and review, so each has its own requirement.

What it means to the patient or the client

For the client: when you prepare for an inspection or accreditation renewal, check image quality across all of those areas, not only the images submitted for review.

When both a State radiation program and an MQSA inspector visit, which one decides what?

What it is

The sources split authority by program, not by topic. MQSA inspections are carried out by FDA inspectors or by State inspectors under State certifying agencies, and they cover the MQSA requirements as a whole.

How it works

The FDA's certification page says the FDA and the States of Illinois, Iowa, South Carolina, and Texas are certifying agencies, which issue, renew, deny, suspend, and revoke certificates and conduct annual inspections, and the FDA's frequently asked questions page says all MQSA inspectors must complete FDA training. A separate State radiation control inspection applies State law, and the MQSA preserves State requirements that are at least as stringent as the federal ones (42 U.S.C. 263b(m)), as the FDA explained in the preamble of the 2023 final rule. The sources do not assign personnel qualifications to one body and equipment performance to another, so a facility should not assume that split.

Why it matters

A facility can face two sets of requirements, each enforced by its own program.

What it means to the patient or the client

For the client: prepare for each inspection against its own rules, and ask your State radiation program and your certifying agency in writing if the two seem to conflict on a point.

Can an ARRT mammography or breast sonography credential satisfy the technologist's MQSA training requirements?

What it is

Partly yes, according to the FDA's Small Entity Compliance Guide. Passing the ARRT(M) mammography exam or the ARRT breast sonography exam counts as meeting the whole continuing education requirement for 36 months from the date the certification was obtained.

How it works

The FDA says it generally accepts continuing education units related to the diagnosis or treatment of breast disease, and that both exams require more than 15 hours of structured education. For initial training, the ARRT(M) can be used if it was passed before April 28, 1999 or after January 1, 2001. If it was awarded between April 29, 1999 and December 31, 2000, it counts as 24 of the 40 required initial training hours, and the technologist must also document 25 mammography exams performed under direct supervision.

Why it matters

The date of the credential decides how much of the initial training it covers.

What it means to the patient or the client

For the client: record the date on every technologist's ARRT(M) certificate in the personnel file, and note which requirement each credential is being used to meet.

What counts toward an interpreting physician's MQSA continuing education?

What it is

According to the FDA's Small Entity Compliance Guide, all Category 1 CME hours related to the diagnosis or treatment of breast disease, or to other areas that help improve mammography quality, should qualify, so Category 1 hours in breast ultrasound or breast MRI count.

How it works

The guide says passing the American Board of Radiology initial certification or recertification exam does not count, because the ABR does not award Category 1 CME for it. A physician can ask an organization that grants Category 1 credit whether it will grant units specific to mammography, and should keep a letter or certificate showing how many and what type of units were awarded, with the date. The FDA also says it has generally exercised enforcement discretion about requiring hours for each specific modality, relying on the general requirement of 15 hours in 3 years.

Why it matters

Breast ultrasound and MRI courses can count, but the board exam cannot, so the facility needs documentation of each.

What it means to the patient or the client

For the client: keep the CME certificate for each interpreting physician, and do not rely on board certification alone to show the continuing education requirement is met.

What does a technologist need to start performing mammography independently again after a long break or a lapse in experience?

What it is

The technologist must have met the original qualifications, still hold a current State license or a general certification the FDA accepts, and complete the requalification requirements for continuing education and continuing experience before working unsupervised again.

How it works

The FDA's Small Entity Compliance Guide says the continuing education must bring the total to at least 15 units in the previous 36 months, and that a technologist who has not performed at least 200 mammograms in the previous 24 months must perform 25 mammograms under the direct supervision of a qualified technologist (21 CFR 900.12(a)(2)(iii) and (iv)). A technologist using a modality other than the one initially trained must complete at least 8 hours of continuing education in the new modality, and performing 25 supervised exams does not count toward those 8 hours. Inspectors may cite a technologist who has not met the 200 exam requirement, including one who has not started requalification. The FDA generally does not object when a facility is inspected within 6 months of a documented requalification date.

Why it matters

Technologist qualifications are checked at inspection, and failures can lead to findings or enforcement.

What it means to the patient or the client

For the client: track each technologist's 24 month exam count and 36 month education total on a schedule, and start requalification before the counts run out.

How does an interpreting physician reestablish qualifications after a lapse?

What it is

An interpreting physician who falls short of the continuing requirements must reestablish qualifications before resuming independent interpretation (21 CFR 900.12(a)(1)(iv)).

How it works

For a shortfall in continuing experience, the physician must interpret or multi-read at least 240 mammographic examinations under the direct supervision of an interpreting physician, or enough examinations to bring the total up to 960 for the prior 24 months, whichever is less. Those interpretations must be done in the 6 months immediately before resuming independent interpretation. For a shortfall in continuing education, the physician must earn enough additional Category I credits in mammography to reach the required 15 in the previous 36 months before resuming.

Why it matters

Until the requirement is met, the physician cannot interpret independently, so the facility needs a way to route those cases to another qualified reader.

What it means to the patient or the client

For the client: if a physician falls short, remove the physician from independent reading right away and document the supervised reading that restores qualification.

What continuing experience and education must an interpreting physician maintain?

What it is

21 CFR 900.12(a)(1)(ii) sets what an interpreting physician must keep up to stay qualified.

How it works

After the second anniversary of qualifying, the physician must have interpreted or multi-read at least 960 mammographic examinations in the 24 months before the facility's annual MQSA inspection, or before the last day of the calendar quarter preceding it, or any date in between; the facility picks one of those dates. After the third anniversary, the physician must have taught or completed at least 15 Category I continuing medical education units in mammography in the 36 months before the same dates, including at least six in each mammographic modality the physician uses. Before independently reading a new modality, the physician needs at least 8 hours of training in it.

Why it matters

The 24 and 36 month windows are measured back from the inspection, and the facility chooses the date, so a facility can pick the date that fits the physician's record. Units earned by teaching a specific course count only once.

What it means to the patient or the client

For the client: track each physician's 24 and 36 month counts on a running schedule, so a shortfall is found well before the inspection.

What must a medical physicist have to survey a mammography facility?

What it is

21 CFR 900.12(a)(3) sets the qualifications for medical physicists who survey mammography facilities and oversee equipment quality assurance.

How it works

The physicist must be State licensed or approved, or certified in an appropriate specialty by a body the FDA has determined adequate. The initial path requires a master's degree or higher in a physical science with at least 20 semester hours of physics, 20 contact hours of documented specialized training in surveying mammography facilities, and experience surveying at least 1 facility and a total of at least 10 units. To stay qualified, the physicist needs at least 15 continuing education units in mammography in the 36 months before the annual inspection, and must have surveyed at least two facilities and six units in the previous 24 months. A physicist needs at least 8 hours of training before surveying a new modality independently.

Why it matters

The facility's survey is only as valid as the physicist's current qualification, so a lapsed physicist's survey can leave a facility with a gap it does not see.

What it means to the patient or the client

For the client: ask for the physicist's current qualification record when you engage or renew them, and keep a copy with your personnel records.

What must a radiologic technologist have to perform mammography?

What it is

21 CFR 900.12(a)(2) sets the qualifications for radiologic technologists who perform mammographic examinations.

How it works

A technologist must be licensed to perform general radiographic procedures in a State, or hold a general certification from a body the FDA has determined adequate. The technologist must also have completed at least 40 contact hours of documented mammography training, including 25 examinations under direct supervision and at least 8 hours in each modality used. To stay qualified, the technologist needs at least 15 continuing education units in mammography in the 36 months before the annual inspection, at least six of them for each modality used, and at least 200 mammography examinations in the previous 24 months. A technologist who falls short of the experience requirement must perform 25 examinations under supervision before resuming unsupervised work.

Why it matters

The rule counts hours per modality, so a technologist who adds tomosynthesis needs 8 hours of new training before working independently on it.

What it means to the patient or the client

For the client: keep each technologist's training, units, and examination counts in one record, and check them before scheduling anyone on a new modality.

What must an interpreting physician have before interpreting mammograms independently?

What it is

21 CFR 900.12(a)(1)(i) sets the initial qualifications for every physician who interprets mammograms for a certified facility.

How it works

Before interpreting independently, the physician must be licensed to practice medicine in a State, and be certified in an appropriate specialty by a body the FDA has determined adequate, or have had at least 3 months of documented formal training in interpreting mammograms. The physician must also have at least 60 hours of documented medical education in mammography, all Category I, with at least 15 of those hours acquired within the 3 years before qualifying, and must have interpreted or multi-read at least 240 mammographic examinations in the 6 months before qualifying, under the direct supervision of an interpreting physician. Two exemptions in the rule apply to physicians who qualified under the earlier interim regulations and to certain residents.

Why it matters

Each element has to be documented, not only held. A facility that keeps one file per physician with the license, certification or training record, the 60 hours, and the 240 examinations can show an inspector the whole qualification at once.

What it means to the patient or the client

For the client: check the file of every new interpreting physician against these four items before the first independent read. Contract and locum readers are included.

Can a former employee ask for qualification records verbally, and what if the facility does not comply?

What it is

The FDA said a former employee's request for personnel records does not have to be in writing. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA decided that requiring written requests could burden facilities and former employees, delay the records, and reduce access to mammography by delaying how quickly records reach facilities evaluating new personnel. A facility that does not comply with the personnel records retention requirement may receive a citation when the failure is identified at inspection, like comparable violations. The FDA also clarified that the rule's clause about a facility that closes or ceases mammography refers to the facility, not to an individual who stops practicing mammography, and that facilities that close should inform their accreditation body, which will help them meet record obligations.

Why it matters

Qualification records follow the person to the next facility, so access delays can keep qualified staff from working.

What it means to the patient or the client

For the client: accept verbal requests, log the date of each request and the date you provided the records, and have a named person responsible for answering them.

How long must personnel records be kept, and who can ask for them?

What it is

Facilities must keep records of training and experience for people who work or have worked at the facility as interpreting physicians, radiologic technologists, or medical physicists (21 CFR 900.12(a)(4)).

How it works

The records must be available to MQSA inspectors. Records of people who have left must be kept for at least 24 months from the date of departure. The facility must give copies to current personnel on request, and to former employees who ask within 24 months of leaving; if it still has the records after 24 months, it must provide them to former employees on request. Before a facility closes or stops providing mammography, it must arrange access to these records for current and former personnel, either by transferring the records to the personnel or to an entity that will provide access for at least 24 months.

Why it matters

A refusal to give personnel their qualification records can be a ground for suspending or revoking a certificate, so the request is not optional.

What it means to the patient or the client

For the client: keep qualification records separate from general personnel files, have a process for answering a request promptly, and add record access to your closure checklist.

Who is responsible for each part of the quality assurance program?

What it is

21 CFR 900.12(d)(1) requires the facility to assign responsibility for the quality assurance program and each of its elements to qualified individuals who are allowed adequate time for the duties.

How it works

The lead interpreting physician has general responsibility. All interpreting physicians must follow the facility's corrective action procedures when the images they are asked to interpret are of poor quality, and must participate in the medical outcomes audit program. The medical physicist surveys equipment, performs mammography equipment evaluations, and provides the required reports. The quality control technologist is responsible for every individual task not assigned to the lead interpreting physician or the medical physicist, and may use other qualified personnel if the technologist ensures the tasks meet the equipment requirements.

Why it matters

Three roles share the program, and the rule expects each to have the time to do the job.

What it means to the patient or the client

For the client: confirm that each role has a named person and enough protected time, and that every interpreting physician knows the corrective action procedure and takes part in the audit.

Who is the lead interpreting physician and what are they responsible for?

What it is

The lead interpreting physician is the interpreting physician assigned general responsibility for ensuring that the facility's quality assurance program meets the requirements of 21 CFR 900.12(d) through (f) (21 CFR 900.2(x)).

How it works

The facility must identify one. No other individual may be assigned or keep responsibility for a quality assurance task unless the lead interpreting physician has determined that the individual's qualifications for, and performance of, the assignment are adequate. The administrative title and any other supervisory responsibilities of the individual are left to the discretion of the facility, so the title may differ from the role.

Why it matters

The regulation defines the role by its responsibility, not by a job title. A medical director is not automatically the lead interpreting physician unless the facility assigns the responsibility.

What it means to the patient or the client

For the client: write down who holds the lead interpreting physician role and that the person accepted it, and have that person review who is assigned each quality assurance task.

How must a facility test a mobile mammography unit that works at more than one location?

What it is

A mobile unit used at more than one location has an extra testing requirement in 21 CFR 900.12(e)(7).

How it works

The facility must verify that the unit meets the quality control requirements in paragraphs (e)(1) through (e)(6). In addition, at each examination location, before any examinations are conducted, the facility must verify satisfactory performance of the unit using a test method that establishes the adequacy of the image quality the unit produces. For post-move, pre-examination testing, results are compared with the limits set by the test method the facility uses.

Why it matters

Moving a unit can change its performance, so the rule requires a check at each site before patients are imaged.

What it means to the patient or the client

For the client: build a pre-examination check into every mobile site visit, and keep the result with the unit's records for each location.

How often must a medical physicist survey a mammography facility, and what must the report include?

What it is

At least once a year, each facility must undergo a survey by a medical physicist, or by an individual under the direct supervision of a medical physicist (21 CFR 900.12(e)(9)).

How it works

The survey includes, at a minimum, tests that confirm the facility meets the annual test requirements and the weekly phantom image quality test. The physicist evaluates the facility's own quality control results and its documented corrective actions for adequacy. The survey report summarizes that review with recommendations for improvement, is sent to the facility within 30 days of the survey date, and is dated and signed by the physicist. If someone else performed part of the survey under supervision, the report names that person and the part performed.

Why it matters

The 30 day report deadline and the physicist's review of the facility's own records make the survey part of the facility's evidence, not only a test of equipment.

What it means to the patient or the client

For the client: schedule the survey on a recurring calendar, ask the physicist to confirm the report date, and file the report with your quality control records.

How often must a physicist's air kerma measuring instrument be calibrated?

What it is

Instruments that medical physicists use in the annual survey to measure air kerma or air kerma rate from a mammography unit have a calibration rule in 21 CFR 900.12(e)(12).

How it works

They must be calibrated at least once every 2 years and each time the instrument is repaired. The calibration must be traceable to a national standard and done with an accuracy of plus or minus 6 percent (95 percent confidence level) in the mammography energy range.

Why it matters

The physicist's dose measurements are only as reliable as the instrument, so the regulation sets a calibration schedule.

What it means to the patient or the client

For the client: ask your physicist for the instrument's current calibration date and keep it with the survey report.

Must a facility print quality control logs, and must it record numerical results or only pass or fail?

What it is

The FDA's Small Entity Compliance Guide says a facility generally does not need to print QC logs if the inspector can review test data or documentation electronically at the facility. Inspectors will generally ask for a copy of documentation that supports any noncompliance they find.

How it works

QC records should show the numerical results of those tests for which numbers are a natural by-product, because those results show whether the test is within the required action or control limits. For tests such as artifact evaluation, which produce no meaningful numbers, the FDA generally considers a pass or fail indication appropriate and sufficient. Inspectors may use tools such as review workstation display reports, or test data stored in the unit or PACS, to verify the results (21 CFR 900.12(d)(2)). Records must be kept until the next annual inspection is completed and the FDA finds the facility compliant, or until the test has been performed two more times at the required frequency, whichever is longer.

Why it matters

Numbers show how close a result is to the limit, and a bare pass can hide a drift.

What it means to the patient or the client

For the client: record the actual numbers wherever the test produces them, and keep the electronic data accessible so an inspector can check it on screen.

What infection control must a facility have for mammography equipment?

What it is

Facilities must establish and comply with a system for cleaning and disinfecting mammography equipment after contact with blood or other potentially infectious materials (21 CFR 900.12(e)(13)).

How it works

The system must specify the procedures to follow and the methods for documenting compliance. It must comply with applicable Federal, State, and local infection control rules, and with the manufacturer's recommended cleaning and disinfection procedures for the equipment. If adequate manufacturer recommendations are not available, the facility follows generally accepted infection control guidance until they are.

Why it matters

The rule requires documentation that the procedures were followed, not only a written policy.

What it means to the patient or the client

For patients: the equipment you are positioned on should be cleaned and disinfected after contact with blood or infectious material under a documented procedure. For the client: keep the manufacturer's cleaning instructions on file and a log showing the procedure was followed.

What must a facility do when a quality control test falls outside its action limits?

What it is

After each quality control test, the facility compares the result with the specified action limits, or with the manufacturer's recommended limits for modalities other than screen-film (21 CFR 900.12(e)(8)).

How it works

If a result falls outside the limits, the source of the problem must be identified and corrective action taken. For the listed tests, including the daily processor test, the weekly phantom test, the compression device test, the dosimetry test, and the tests for other modalities and mobile units, corrective action comes before any further examinations are performed or any films processed using the failed component. For all other tests it must be taken within 30 days of the test date. Corrective actions are recorded and their results assessed.

Why it matters

Two clocks apply: stop-use before further examinations for some tests, and 30 days for the rest. The record shows that the fix worked.

What it means to the patient or the client

For the client: label each test in your logs as stop-use or 30 days, and record the fix and the recheck result, not only the failure.

What quality control program applies to digital and other non-screen-film mammography units?

What it is

For systems with image receptor modalities other than screen-film, the quality assurance program must be substantially the same as the program the image receptor manufacturer recommends (21 CFR 900.12(e)(6)).

How it works

There is one exception: the maximum allowable dose may not exceed the maximum allowable dose for screen-film systems in the regulation. When the facility compares test results with action limits, it uses the manufacturer's recommended action limits for these modalities.

Why it matters

The regulation's detailed film-era tests do not apply to a digital unit. Instead, the manufacturer's program and action limits become the standard the inspector expects.

What it means to the patient or the client

For the client: keep the manufacturer's current quality control manual for each unit and follow it, including its action limits, with the dose ceiling in the regulation as the one fixed limit.

When is a mammography equipment evaluation required, and who performs it?

What it is

A mammography equipment evaluation is an onsite assessment of a mammography unit or image processor by a medical physicist to determine whether the equipment meets the standards in 21 CFR 900.12(b) and (e) (21 CFR 900.2(bb)).

How it works

An evaluation is required whenever a new unit or processor is installed, a unit or processor is disassembled and reassembled at the same or a new location, or major components of a unit or processor are changed or repaired. A medical physicist, or an individual under the direct supervision of one, performs it. All problems must be corrected before the equipment is used for examinations or film processing (21 CFR 900.12(e)(10)).

Why it matters

The triggers cover repairs and moves as well as new equipment, and the equipment cannot go into service until problems are corrected.

What it means to the patient or the client

For the client: after any repair of a major component or any move, book the physicist before the unit sees patients, and keep the evaluation report with the unit's records.

How long must a facility keep its repeat analysis records?

What it is

A repeat analysis is the facility's tracking of why mammograms had to be repeated, done to improve image quality and to reduce radiation from repeats that better technique could have avoided. The written record of that analysis has its own retention rule.

How it works

The facility keeps the written analysis until the next annual inspection is complete and the FDA has found the facility compliant with the quality assurance requirements, or until the test has been done two more times at the required frequency, whichever is longer (21 CFR 900.12(d)(2)). The rule covers the written record, not necessarily the rejected images themselves.

Why it matters

Inspectors ask for the written record. Knowing which records to keep avoids keeping too little, and knowing it covers the record rather than every rejected image avoids storing films that no longer need to be kept.

What it means to the patient or the client

For the client: keep the written repeat analysis until the retention rule is met, not every rejected image. If you are unsure whether an image counts as part of the study, the question is whether the interpreting physician used it to read the study.

How often must a facility do its repeat analysis, and how many patients does it count?

What it is

The FDA's inspection procedures say a facility must track and analyze the reasons mammograms are repeated, so that image quality improves and unnecessary repeats are reduced.

How it works

The analysis is done at least quarterly. The facility counts at least 250 patients: it collects every rejected image from the start of the quarter until 250 patients have been imaged or the quarter ends, whichever comes first. It may keep tracking beyond 250 patients if it analyzes at least quarterly. How repeats are tracked depends on the equipment, for example software on a digital unit or a tally sheet for screen film, and the reasons must be evaluated and any corrective action documented.

Why it matters

Inspectors look for the quarterly analysis, the evaluation, and the documented corrective action. A facility that collects by calendar habit instead of by the 250 patient count can miss the rule.

What it means to the patient or the client

For the client: put the quarterly analysis on the calendar and count patients, not days: collect until 250 patients have been imaged or the quarter ends, whichever comes first. Keep the evaluation and any corrective action in writing for the inspector.

What quality control records must a facility keep, and for how long?

What it is

21 CFR 900.12(d)(2) requires records of mammography technique and procedures, quality control, safety, protection, and employee qualifications for assigned quality assurance tasks.

How it works

The lead interpreting physician, quality control technologist, and medical physicist must ensure those records are properly maintained and updated. They include monitoring data, problems found by analyzing that data, corrective actions, and whether the corrections worked. The quality control records are kept for each test until the next annual inspection has been completed and the FDA has determined the facility is in compliance with the quality assurance requirements, or until the test has been performed two additional times at the required frequency, whichever is longer.

Why it matters

The rule asks for the whole loop: the measurement, the problem, the correction, and proof the correction worked. A log that records only passing results leaves the second half undocumented.

What it means to the patient or the client

For the client: record what you did about each out-of-range result and whether it fixed the problem, and keep each test's records through the longer of the two retention rules.

Which rejected mammography images must be kept for the 5 or 10 year retention period?

What it is

Rejected images fall into two groups for retention. The FDA's inspection procedures explain which group an image belongs to.

How it works

A rejected image that the interpreting physician used to read the study is part of the original mammogram and is kept for the same 5 or 10 year period as the rest of the study (21 CFR 900.12(c)(4)(i)), even if a repeat was taken. A rejected image that added no diagnostic information can be counted in the repeat analysis and then discarded. Quality control films that are part of an analysis follow the retention guidance for those films.

Why it matters

The test is use in the interpretation, not the label of reject. A facility that discards every rejected image can destroy part of a patient's original study.

What it means to the patient or the client

For the client: the test is whether the interpreting physician used the image to read the study. If so, it stays with the study for 5 or 10 years; if not, it can be counted in the repeat analysis and then discarded.

Can digital mammograms be stored with computer-aided detection marks?

What it is

A facility may keep a set of images with permanent CAD marks, but that set alone does not meet the retention requirement. The FDA's Small Entity Compliance Guide says the facility must retain images that can be displayed without the CAD marks.

How it works

The reason the FDA gave is that CAD markings added by software after the images are acquired typically overlie and obscure parts of the image. The requirement is in 21 CFR 900.12(c)(4)(i), which requires the facility to keep the mammograms in a permanent medical record and to be able to retrieve them in the modality in which they were produced.

Why it matters

An archive that holds only marked images does not meet the retention requirement.

What it means to the patient or the client

For the client: check that your PACS archive stores the original unmarked images and that CAD overlays can be turned off when images are retrieved or released.

What can a facility charge to transfer or release mammography records?

What it is

A facility may not charge more than the documented costs of the service (21 CFR 900.12(c)(4)(iv)). The FDA's Small Entity Compliance Guide gives examples of appropriate charges.

How it works

The examples are administrative costs to log the request, retrieving the images and reports, having the patient sign a release if one is not already on file, packaging and mailing, and photocopying the reports. When original screen-film mammograms are transferred, the facility may make copies but does not have to. If the patient requests the copies, or State or local law requires them, the facility can charge the cost of making them to the patient. If the facility keeps copies for its own reasons, the cost should not be charged to the patient.

Why it matters

A fee above documented cost, or a charge for a facility's own copies, would be a problem.

What it means to the patient or the client

For the client: keep a written fee schedule built from documented costs, and review it when your costs or release methods change.

What does the 15 day deadline for transferring mammograms cover?

What it is

A facility must transfer original mammograms, or release copies, within 15 calendar days of a request (21 CFR 900.12(c)(4)(ii) and (iii)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said the same 15 day time frame applies to either the transfer of originals or the release of copies, and that it is a maximum and a baseline requirement, often met in less time. The deadline refers to the sending, or provision of electronic access, by the sending facility, not to receipt by the other facility, so delivery and tracking time is not counted. The FDA did not make an exception for large tomosynthesis files, saying file size does not significantly affect the time needed to provide electronic access. For questions about how a facility applies the rule, the FDA pointed to its MQSA Facility Hotline or the facility's accreditation body.

Why it matters

The clock runs on the sending facility's action, so what the facility controls is how fast it sends or opens access.

What it means to the patient or the client

For patients: if you ask your facility to send your mammograms to another provider, it has 15 calendar days to send them or give access. For the client: log the request date and the send date, and set a shorter internal target so a radiologist can compare in time.

Does MQSA require a specific mammography report format or an assessment number?

What it is

No. The FDA's Small Entity Compliance Guide says there is no explicit requirement for the format of the mammography report, and no requirement, or prohibition, on including an assessment number or letter code.

How it works

The report must include certain contents (21 CFR 900.12(c)). Since September 10, 2024 those include two overall assessments: the overall assessment of the findings and the overall assessment of breast density. Because each refers to the examination as a whole and an MQSA inspector should be able to verify them easily, the guide says each should be placed in a way that is distinct and identifiable.

Why it matters

Freedom of format does not remove the need for the two assessments to be easy for an inspector to find.

What it means to the patient or the client

For the client: set each overall assessment on its own labeled line in the report template, and review the template whenever your reporting system changes.

What facility name and location must appear on reports and lay summaries for a network with several sites or a mobile unit?

What it is

The facility information must be unique to the facility where the mammogram was performed and must give the name under which that facility is accredited and certified, according to the FDA's Small Entity Compliance Guide.

How it works

The guide says the FDA distinguishes each mammography facility by its physical location, and that a healthcare network offering mammography at several locations must apply for accreditation and certification of each location as a separate facility. The name the FDA recognizes is the name under which the accreditation body accredits the facility. The report to the provider must include the facility name and at least the city, State, ZIP code, and telephone number, and the lay summary must include the facility name, address, and telephone number (21 CFR 900.12(c)(1)(ii) and (c)(2)). For a mobile unit that travels, the same name information applies. A facility may add network or affiliated site information as well.

Why it matters

Reports that carry the wrong site name or the parent name can fail an inspector's check.

What it means to the patient or the client

For the client: confirm that each site's templates carry that site's accredited name and contact details, and that network branding is added without replacing them.

What is the difference between the two Incomplete assessments, and does either need a follow-up report?

What it is

There are two Incomplete assessments. Incomplete: Need additional imaging evaluation is for an area that needs more imaging, such as an abnormality, a part of the breast not adequately seen, or an area with symptoms. Incomplete: Need prior mammograms for comparison is for a possible abnormality where it is important to know whether it is stable or has changed.

How it works

The FDA's Small Entity Compliance Guide says that when the prior mammograms assessment is used, a follow-up report with a final assessment of Negative, Benign, Probably Benign, Suspicious, or Highly Suggestive of Malignancy must be issued within 30 calendar days of the initial report, whether or not comparison views can be obtained (21 CFR 900.12(c)(1)(v)(B)). The additional imaging assessment carries no follow-up report deadline. The older combined statement, Incomplete: Need additional imaging evaluation and/or prior mammograms for comparison, came from Alternative Standard 11, which the FDA withdrew when the 2023 rule took effect, so facilities must use the two separate statements.

Why it matters

The two statements carry different report deadlines, so using the wrong one can miss a required follow-up report.

What it means to the patient or the client

For the client: update templates to the two separate statements, and set a 30 day task to issue the final report whenever the prior mammograms statement is used.

How long must a facility keep original mammograms, and how fast must it transfer them on request?

What it is

21 CFR 900.12(c)(4) sets the retention period for the original mammograms and reports, and a deadline for transferring them.

How it works

The facility keeps them in the patient's permanent medical record for the longest of three periods: not less than 5 years, not less than 10 years if no additional mammograms of the patient are performed at the facility, or any period mandated by State or local law. On request by or for the patient, the facility must transfer the original mammograms and copies of the reports within 15 calendar days of receiving the request. The mammograms stay in the modality in which they were produced and cannot be copies of digitized hardcopy originals.

Why it matters

The longest applicable period controls, so a state rule that is longer than the federal period governs. A written process for the 15 day transfer deadline prevents missed requests.

What it means to the patient or the client

For patients: you can ask for your original mammograms and reports to be transferred, and the facility must send them within 15 calendar days of your request. For the practice: keep a written process for that 15 day deadline, and remember that a longer state or local rule controls.

What must a mammography report contain?

What it is

21 CFR 900.12(c)(1) lists what the written mammography report must include for every examination.

How it works

The report includes the patient's name and an additional identifier, the date of the examination, the facility name and location (city, State, ZIP code, and telephone number), the name of the interpreting physician, and an overall final assessment in one of the listed categories (Negative, Benign, Probably Benign, Suspicious, Highly Suggestive of Malignancy, Known Biopsy-Proven Malignancy, or Post-Procedure Mammogram for Marker Placement). When work-up is incomplete, the report uses one of the two Incomplete statements and gives reasons. It also includes an overall breast density assessment and recommendations to the healthcare provider.

Why it matters

The assessment wording is fixed by the rule, so reports should use the exact words in the list. Clinical questions from the referring provider are to be addressed even when the assessment is negative or benign.

What it means to the patient or the client

For patients: the overall assessment in your report uses fixed wording set by the rule, so the same words mean the same thing at any MQSA certified facility. For the client: use the exact assessment words, and answer the referring provider's clinical questions even when the result is negative or benign.

Are biopsy and localization procedures covered by MQSA?

What it is

The definition of mammography excludes radiography of the breast performed during invasive interventions for localization or biopsy, so those images are outside the quality standards (21 CFR 900.2(aa)(1)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA declined to bring interventional mammography into the regulations, saying it is not aware of information showing significant quality problems with interventional mammography. A post-procedure mammogram is different: it typically includes the entire breast, may be done on general mammography equipment rather than dedicated interventional equipment, and is often logged, reported, and charged as an independent examination. The FDA concluded it should continue to meet MQSA standards, and added the assessment statement Post-Procedure Mammogram for Marker Placement for it.

Why it matters

The imaging during the procedure is excluded, but the whole breast mammogram afterward is regulated.

What it means to the patient or the client

For the client: treat post-procedure marker mammograms as full MQSA examinations, with an assessment statement and a report, while keeping interventional imaging under your other quality programs.

Do referring providers have to meet MQSA requirements?

What it is

Generally no. The FDA said referring healthcare providers who order mammography studies, and who are not themselves the reviewing physicians of the clinical images at issue, are not generally subject to the MQSA or its regulations. The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA explained that the MQSA regulates mammography facilities and their activities, not the general practices of the providers who order imaging. It said that shared clinical decision-making generally takes place between the patient and the referring or clinical healthcare provider, not with the interpreting physician at the mammography facility. Facilities and clinical providers may choose to offer patient education resources, but the FDA said requiring them was outside the rulemaking.

Why it matters

The obligations fall on the facility and its personnel, so the facility cannot assume a referring provider is meeting any MQSA duty.

What it means to the patient or the client

For patients: questions about whether and when to get a mammogram are for your referring provider. For the client: your reports and lay summaries are the facility's job whatever the referring provider does.

Does MQSA apply to mammography performed on men?

What it is

Yes. The FDA's Small Entity Compliance Guide says a patient is defined as any individual who undergoes a mammography evaluation in a facility, and that the breast density assessment and notification requirements apply to patients of any sex. The regulations define mammography by the examination, as radiography of the breast (21 CFR 900.2).

How it works

The FDA's frequently asked questions page describes MQSA in terms of facilities and their certificates and does not address male patients separately. Which patients are referred for mammography, and when, is a clinical decision for the interpreting physician and the referring provider, as the FDA said in the preamble of the 2023 final rule. A facility that performs a mammogram on any patient is performing mammography at a certified facility, with the same equipment, personnel, quality control, and reporting rules in place.

Why it matters

The facility's MQSA obligations are the same whatever the patient's sex, but the rule does not set screening policy for any group.

What it means to the patient or the client

For the client: do not build a separate, looser process for male patients. Apply the same reporting, assessment, and lay summary steps, and ask your certifying agency if you are unsure how to handle an unusual case.

Which imaging technologies does MQSA cover?

What it is

MQSA covers mammographic modalities. The regulation lists screen-film mammography, full field digital mammography, and digital breast tomosynthesis as examples (21 CFR 900.2(z)). The explanation comes from the FDA's responses to public comments in the preamble of the 2023 final rule.

How it works

The FDA said the MQSA and its regulations apply only to radiological equipment used in facilities to perform mammographic modalities, which do not include breast sonography or other non-mammographic modalities. The final rule removed xeromammography from the examples because it is no longer in clinical use in the United States, and added DBT because it has reached wide clinical use. The FDA declined to require interpreting physicians to be qualified in breast ultrasound, saying the MQSA does not provide for requirements related to breast sonography or MRI. Programs such as the ACR Breast Imaging Centers of Excellence and the ACS National Accreditation Program for Breast Centers cover other modalities and are not part of the MQSA regulations.

Why it matters

Ultrasound, MRI, and other modalities are outside MQSA, so other rules and programs govern them.

What it means to the patient or the client

For the client: do not assume your MQSA certificate covers your breast ultrasound or MRI service. Those follow other requirements and accreditation programs.