2024 MQSA Updates: Quick Reference Guide
A section-by-section FROM/TO reference for every substantive change in 21 CFR Part 900, effective September 10, 2024
Richard D. Lippert, Jr.
Founder, President, and Chief Executive Auditor, Mammologix · Breast Imaging Operations since 1995
The 2023 MQSA Final Rule (88 FR 15126) is the most significant update to mammography regulations since 1997. This quick reference guide covers every regulatory change in FROM/TO format, from new imaging assessment taxonomy and mandatory density notification to enforcement changes and personnel record rules.
In this article
Overview: The Most Significant MQSA Update in 27 Years
The 2023 MQSA Final Rule (88 FR 15126, Docket No. FDA-2013-N-0134) was published in the Federal Register on March 9, 2023, and became fully effective September 10, 2024. It is the first comprehensive revision to 21 CFR Part 900 since 1997.
This guide provides a section-by-section reference for every substantive regulatory change, organized in FROM/TO format for rapid compliance review.
Effective Date: September 10, 2024 Federal Register Citation: 88 FR 15126 Docket: FDA-2013-N-0134 Document Number: 2023-04550
Summary of Major Changes
| CFR Section | Area | Summary |
|---|---|---|
| §900.2 | Definitions | "Healthcare provider" replaces "physician"; modality definitions updated for digital era |
| §900.4 | Accreditation | Three-strikes accreditation rule added |
| §900.11 | Certification | Two-year ownership ban added after certificate revocation |
| §900.12(a)(4) | Personnel records | 24-month retention after employment ends; employee access rights |
| §900.12(b)(2) | Equipment | FDA premarket authorization required; modality change = new unit |
| §900.12(c)(1) | Imaging assessments | Complete FDA imaging assessment taxonomy codified: 9 categories |
| §900.12(c)(1)(vi), (c)(2)(iii) and (iv) | Breast density | Mandatory density notification; 4 report categories, 2 required lay summary statements |
| §900.12(c)(2) | Lay letters | 30-day / 7-day rules; mandatory density notification |
| §900.12(c)(3)(ii) | Urgent reports | 7-day written report for Suspicious and Highly Suggestive |
| §900.12(c)(4) | Record transfer | 15-day deadline; digital records; facility closure provisions |
| §900.12(f)(1) | Medical outcome audit | Formal metric definitions codified; screening vs. diagnostic defined |
| §900.12(f)(4) | Audit retention | Records kept until after first post-analysis inspection |
| §900.12(j) | Notifications | State certification agencies added; expanded notification scope |
| §900.14 | Enforcement | Suspension/revocation grounds expanded |
| §900.15 | Agency name | Updated to Division of Mammography Quality Standards (DMQS) |
§900.2, Definitions
"Healthcare Provider" Replaces "Physician"
FROM: Reporting and communication obligations throughout 21 CFR Part 900 referred to "physician."
TO: The term "healthcare provider" now applies throughout. This covers any qualified individual legally authorized to order mammograms or receive results, including physicians, physician assistants, nurse practitioners, and other licensed providers.
Operational impact: Update report templates, lay letters, and communication workflows. References to "referring physician" should become "referring healthcare provider."
Modality Definitions Updated for the Digital Era
FROM: Definitions written around screen-film mammography, with limited formal reference to digital technologies.
TO: Updated definitions now formally include:
- Full-Field Digital Mammography (FFDM): defined as the production of a digital mammographic image directly or indirectly from x-ray photons
- Digital Breast Tomosynthesis (DBT): defined as a mammographic modality generating a 3D reconstruction from multiple limited-angle exposures
- Computed Tomography (CT) of the breast: explicitly added to the exclusion list; CT of breast is NOT a mammogram under MQSA regardless of the anatomy imaged
Operational impact: Facilities using DBT must ensure certification and accreditation specifically covers DBT. CT breast studies remain outside MQSA scope.
§900.4, Accreditation Standards
Three-Strikes Accreditation Rule
FROM: No explicit limit on failed accreditation attempts.
TO: A facility that fails accreditation three times faces additional requirements before attempting accreditation again. The accreditation body must notify FDA, and the facility must demonstrate corrective action before a fourth application is permitted.
Operational impact: Facilities with poor QC performance or repeated accreditation failures face escalating barriers to re-accreditation. Address QC root causes before re-attempting.
§900.11, Certification Requirements
Two-Year Ownership Ban After Revocation
FROM: No restriction on ownership or operation after certificate revocation.
TO: After a mammography certificate is revoked, the owner is prohibited from owning or operating a mammography facility for two years from the date of revocation.
Operational impact: Certificate revocation now carries significant personal liability for facility owners. Enforcement proceedings must be taken seriously.
§900.12(a)(4), Personnel Record Retention
24-Month Post-Employment Retention + Employee Access Rights
FROM: Personnel qualification records were required while the individual was employed; post-employment retention requirements were less specifically defined.
TO:
- Facilities must retain personnel qualification records for at least 24 months after an individual ceases to work at the facility
- Employees have a right to request copies of their own qualification records; the facility must provide them
- If a facility permanently closes, a designated responsible party must maintain records and ensure continued access
Operational impact: Build a record retention calendar triggered by each departure date. When a physician, technologist, or physicist leaves, flag the file for 24-month retention. Create a documented process for responding to employee record requests.
§900.12(b)(2), Equipment Standards
FDA Premarket Authorization Required for All Devices
FROM: Equipment requirements referenced FDA-approved devices, with less precise definition of what constitutes a new unit versus a replacement.
TO: All mammography equipment must have FDA premarket authorization (PMA, 510(k), or de novo). This applies to digital detector systems, CAD systems used in clinical interpretation, DBT systems, and any device used as part of the mammographic interpretation process.
Modality Change = New Mammography Unit
FROM: Upgrading from one digital system to another at the same site was generally treated as equipment replacement, not a new unit requiring reaccreditation.
TO: Converting from one mammography modality to another , for example, adding DBT capability to an existing FFDM system , is treated as a new mammography unit requiring:
- New accreditation for the new modality
- Notification to FDA
- Updated certificate before clinical use begins
Operational impact: Before any equipment upgrade that changes modality, complete the accreditation and certification update process first. Clinical use of a new modality without proper accreditation is a certification violation.
§900.12(c)(1), Medical Records: Imaging Assessment Categories
This is among the most operationally significant sections of the 2024 Final Rule. The FDA has codified a complete imaging assessment taxonomy in federal regulation.
Complete FDA Imaging Assessment Taxonomy
FROM: Assessment categories were referenced in the regulations without comprehensive enumeration of all FDA-recognized categories.
TO (21 CFR §900.12(c)(1)): The following imaging assessment categories are now formally defined:
Standard Assessment Categories:
| Category | FDA Required Assessment Language |
|---|---|
| A | "Negative" |
| B | "Benign" |
| C | "Probably Benign" |
| D | "Suspicious" |
| E | "Highly Suggestive of Malignancy" |
| F | "Known Biopsy-Proven Malignancy" |
| G | "Post-Procedure Mammogram for Marker Placement" |
Incomplete Assessment Sub-Categories:
| Sub-Category | FDA Required Assessment Language |
|---|---|
| Incomplete (1) | "Incomplete: Need additional imaging evaluation" |
| Incomplete (2) | "Incomplete: Need prior mammograms for comparison" |
The FDA recognizes 9 distinct imaging assessment categories. Category G ("Post-Procedure Mammogram for Marker Placement") and both Incomplete sub-categories are FDA-recognized assessments. MQSA inspectors reference these imaging assessment categories, not BI-RADS® numbers.
BI-RADS® is a registered trademark of the American College of Radiology.
Operational impact: Mammography report templates must produce output that aligns with this taxonomy. Inspectors will review reports against these exact assessment categories. Audit tracking systems must correctly classify Category G and both Incomplete sub-categories.
§900.12(c)(1)(vi), Breast Density Assessment Categories
Mandatory Breast Density Notification, The Nation's First Federal Requirement
FROM: No federal breast density notification requirement. Some states had their own laws, creating inconsistency across the country.
TO: All mammography facilities subject to MQSA must now classify breast density in the report and include a prescribed breast density statement in every lay summary sent to patients. This is the first mandatory federal breast density notification requirement in U.S. history.
The Four Breast Density Categories in the Mammography Report (21 CFR 900.12(c)(1)(vi)):
- Category A: "The breasts are almost entirely fatty."
- Category B: "There are scattered areas of fibroglandular density."
- Category C: "The breasts are heterogeneously dense, which may obscure small masses."
- Category D: "The breasts are extremely dense, which lowers the sensitivity of mammography."
Alternative phrasing (FDA Alternative Standard 26, approved July 11, 2025): the report may phrase the overall density assessment in the singular, for example "The breast is almost entirely fatty" (intended for unilateral mammograms), or as "Breast Density: Almost entirely fatty," "Breast Density: Scattered areas of fibroglandular density," "Breast Density: Heterogeneously dense, which may obscure small masses," or "Breast Density: Extremely dense, which lowers the sensitivity of mammography." The lay summary statements below are the same whichever phrasing the report uses.
The Two Required Lay Summary Statements (21 CFR 900.12(c)(2)(iii) and (iv)):
The lay summary does not repeat the four categories. It carries one of two statements, chosen by the density in the report.
Categories A and B, not dense:
"Breast tissue can be either dense or not dense. Dense tissue makes it harder to find breast cancer on a mammogram and also raises the risk of developing breast cancer. Your breast tissue is not dense. Talk to your healthcare provider about breast density, risks for breast cancer, and your individual situation."
Categories C and D, dense:
"Breast tissue can be either dense or not dense. Dense tissue makes it harder to find breast cancer on a mammogram and also raises the risk of developing breast cancer. Your breast tissue is dense. In some people with dense tissue, other imaging tests in addition to a mammogram may help find cancers. Talk to your healthcare provider about breast density, risks for breast cancer, and your individual situation."
Operational impact: Every lay letter template must be updated before the September 10, 2024 effective date. Density assignment (A/B/C/D) must be documented per examination, and the lay summary must carry the statement that matches it. The FDA is not providing alternative wording for these statements (88 FR 15126), so paraphrased versions do not satisfy the requirement. In states that require four density categories, a facility may also give patients that information, but it is separate from the federal notification paragraph. Inspectors will pull letters and verify both the presence and accuracy of the density statement.
§900.12(c)(2), Lay Letter and Patient Notification Timeline
30-Day / 7-Day Notification Rules + Mandatory Density Language
FROM: Lay letters were required; specific timelines were less precisely defined in regulation.
TO:
- All cases: Lay summary sent within 30 calendar days of the mammographic examination
- Suspicious and Highly Suggestive of Malignancy: Lay summary sent within 7 calendar days of the final interpretation of the mammograms
- Every lay summary must include the patient's name; the facility's name, address, and telephone number; and the breast density statement above
- Written report to the referring healthcare provider: within 30 days of the examination (7 calendar days of the final interpretation for Suspicious and Highly Suggestive of Malignancy)
Operational impact: Facilities must have a documented workflow that flags Suspicious and Highly Suggestive of Malignancy cases for expedited letter production. The 7-day rule requires a fast-track process with specific accountability, not simply a priority note.
§900.12(c)(3)(ii), Written Report Requirements for Urgent Findings
7-Day Written Report for Suspicious and Highly Suggestive of Malignancy
FROM: Urgent finding reporting requirements existed but without the same level of regulatory precision.
TO: For any mammographic examination with an assessment of "Suspicious" or "Highly Suggestive of Malignancy," the facility must provide a written report to the referring healthcare provider within 7 calendar days of the final interpretation of the mammograms.
Operational impact: This 7-day rule applies to both the written report to the healthcare provider and the lay summary for Suspicious and Highly Suggestive of Malignancy cases. Implement a tracking mechanism specifically for these assessments to ensure both deadlines are met and documented.
§900.12(c)(4), Mammography Records: Transfer and Retention
15-Day Transfer Deadline + Digital Records + Facility Closure Provisions
FROM: Record transfer obligations existed; specific timelines and digital provisions were less defined.
TO:
- Facilities must provide mammography records (images and reports) to a patient, their healthcare provider, or another facility within 15 calendar days of a written request
- Digital mammography records must be provided in a format that is usable by the requesting party
- If a facility permanently closes, the facility must:
- Notify patients and referring providers
- Establish a mechanism for continued access to records
- Designate a responsible party for ongoing record access
Operational impact: Develop a documented record transfer workflow with tracking. Verify digital image export capabilities are functional. Have a closure contingency plan on file.
§900.12(f)(1), Medical Outcome Audit: Formal Metric Definitions
Screening vs. Diagnostic Formally Defined; Audit Metrics Codified
FROM: Audit requirements existed; key terms were not formally defined in regulation.
TO: The following definitions are now codified in 21 CFR §900.12(f)(1):
Screening mammogram: A mammographic examination performed on an asymptomatic individual for the purpose of early detection of breast cancer.
Diagnostic mammogram: A mammographic examination performed to evaluate a specific clinical concern, symptom, or abnormal screening finding.
Recall Rate (Abnormal Interpretation Rate / AIR): The percentage of screening mammograms in a defined period that resulted in an imaging assessment of "Incomplete: Need additional imaging evaluation" or any positive assessment category.
Cancer Detection Rate (CDR): The number of cancers diagnosed per 1,000 screening mammograms performed in a defined period.
Positive Predictive Value 1 (PPV1): The percentage of positive screening assessments that resulted in a tissue diagnosis of cancer.
Positive Predictive Value 2 (PPV2): The percentage of recommended biopsies that resulted in a tissue diagnosis of cancer.
Positive Predictive Value 3 (PPV3): The percentage of performed biopsies that resulted in a tissue diagnosis of cancer.
Operational impact: The formal definitions now govern how facilities calculate and report these metrics. The screening vs. diagnostic distinction is regulatory, not just clinical convention. Ensure tracking systems correctly classify examinations and that audit calculations match the codified definitions.
§900.12(f)(4), Medical Outcome Audit Record Retention
Records Retained Through First Post-Analysis Inspection
FROM: Audit record retention requirements were less specifically defined.
TO: Medical outcome audit records must be retained until after the first annual MQSA inspection that follows the completion of the audit analysis period.
Operational impact: Do not purge or archive audit records until after the inspection that covers that analysis period. If an inspection is delayed, retain records longer. Build this requirement into your records management calendar.
§900.12(j), Notification Requirements
State Certification Agencies Added to Notification Scope
FROM: Notification obligations ran primarily to FDA and accreditation bodies.
TO: State certification agencies (where applicable) are added alongside FDA as required recipients of notifications. This includes notifications for personnel qualification failures, equipment malfunctions, corrective actions, and facility status changes.
Operational impact: Facilities in states with active MQSA certification programs must identify and maintain current contact information for their state agency in addition to FDA contacts.
§900.14, Suspension and Revocation
Non-Compliance with Personnel Record Requests Added as Enforcement Ground
FROM: Grounds for suspension or revocation covered accreditation loss, quality failures, and inspection deficiencies.
TO: Added grounds include:
- Failure to comply with personnel record requests: a request from an inspector or FDA official for personnel qualification records must be honored; refusal is now an explicit suspension/revocation ground
- Expanded non-compliance definitions aligned with the updated regulations
- Alignment with the new three-strikes accreditation rule
Operational impact: When an inspector requests personnel files, compliance is not optional. Inability or refusal to produce records can trigger enforcement proceedings.
§900.15, Agency Name Update
FROM: References to "Division of Mammography Quality" (DMQ).
TO: Updated to "Division of Mammography Quality Standards" (DMQS): the current name of the FDA office responsible for MQSA program administration.
Operational impact: Administrative, update internal forms, contact directories, and correspondence templates that reference the division by name.
Download the Quick Reference Guide
For the formatted, print-ready version of this reference guide , suitable for binder filing, staff training, or inspection preparation , download the PDF below.
Download the Mammologix 2024 MQSA Updates Quick Reference Guide (PDF)
References
- 21 CFR Part 900, Mammography Quality Standards (as amended, effective September 10, 2024)
- 88 FR 15126, Final Rule: Amendments to the Mammography Quality Standards Act Regulations (March 9, 2023), Docket No. FDA-2013-N-0134, RIN 0910-AH04, Document Number 2023-04550
- U.S. Food and Drug Administration, Important Information, Final Rule to Amend MQSA: https://www.fda.gov/radiation-emitting-products/mammography-quality-standards-act-mqsa-and-mqsa-program/important-information-final-rule-amend-mammography-quality-standards-act-mqsa
BI-RADS® is a registered trademark of the American College of Radiology.
About the Author
Richard D. Lippert, Jr.
Founder, President, and Chief Executive Auditor, Mammologix · Breast Imaging Operations since 1995
Founder of Mammologix, Richard D. Lippert, Jr. has spent more than 30 years in breast imaging operations, from clinical practice and hospital radiology administration to building specialized service platforms for imaging centers nationwide. His work spans mammography tracking, lay communication, FDA/MQSA-related support, medical outcome audit, and the operational systems that help facilities stay compliant and keep patients from falling through the cracks.
Full credentials and background →Keep Reading
Related Resources
Preparing for an MQSA Inspection: What Mammography Facilities Need to Know
A practical guide to the eight core inspection areas, documentation requirements, and how to prepare under the 2024 regulatory framework
Annual MQSA inspections verify that certified mammography facilities meet federal quality standards. This guide covers exactly what FDA inspectors look for, how to organize your documentation, and how to prepare under the updated 2024 regulatory framework.
Key FDA MQSA Regulatory Documents: A Practitioner's Reference
A Practitioner's Guide to the Federal Register Rulings That Govern Breast Imaging Quality Standards
The foundational Federal Register rulings that govern mammography quality standards, from the original 1997 framework through the 2023 comprehensive update effective September 2024. Essential reading for anyone developing or auditing mammography policies.
Why Your Facility Needs Policy 1.01: Interpreting Physician Initial Qualifications
MAMMOLOGIX Why Your Facility Needs Policy 1.01: Interpreting Physician Initial Qualifications A Guide for Mammography Facilities Committed to Compliance, Quality, and Patient Safety
See how Mammologix puts this into practice
Real operational support for breast imaging centers.