2024 MQSA Updates — Quick Reference Guide

Overview: The Most Significant MQSA Update in 27 Years

The 2023 MQSA Final Rule (88 FR 15126, Docket No. FDA-2013-N-0134) was published in the Federal Register on March 9, 2023, and became fully effective September 10, 2024. It is the first comprehensive revision to 21 CFR Part 900 since 1997.

This guide provides a section-by-section reference for every substantive regulatory change, organized in FROM/TO format for rapid compliance review.

Effective Date: September 10, 2024 Federal Register Citation: 88 FR 15126 Docket: FDA-2013-N-0134 Document Number: 2023-04550

---

Summary of Major Changes

CFR Section	Area	Summary
§900.2	Definitions	"Healthcare provider" replaces "physician"; modality definitions updated for digital era
§900.4	Accreditation	Three-strikes accreditation rule added
§900.11	Certification	Two-year ownership ban added after certificate revocation
§900.12(a)(4)	Personnel records	24-month retention after employment ends; employee access rights
§900.12(b)(2)	Equipment	FDA premarket authorization required; modality change = new unit
§900.12(c)(1)	Imaging assessments	Complete FDA imaging assessment taxonomy codified — 9 categories
§900.12(c)(1)(vi)	Breast density	Mandatory density notification; 4 categories with required language
§900.12(c)(2)	Lay letters	30-day / 7-day rules; mandatory density notification
§900.12(c)(3)(ii)	Urgent reports	7-day written report for Suspicious and Highly Suggestive
§900.12(c)(4)	Record transfer	15-day deadline; digital records; facility closure provisions
§900.12(f)(1)	Medical outcome audit	Formal metric definitions codified; screening vs. diagnostic defined
§900.12(f)(4)	Audit retention	Records kept until after first post-analysis inspection
§900.12(j)	Notifications	State certification agencies added; expanded notification scope
§900.14	Enforcement	Suspension/revocation grounds expanded
§900.15	Agency name	Updated to Division of Mammography Quality Standards (DMQS)

---

§900.2 — Definitions

"Healthcare Provider" Replaces "Physician"

FROM: Reporting and communication obligations throughout 21 CFR Part 900 referred to "physician."

TO: The term "healthcare provider" now applies throughout. This covers any qualified individual legally authorized to order mammograms or receive results — including physicians, physician assistants, nurse practitioners, and other licensed providers.

Operational impact: Update report templates, lay letters, and communication workflows. References to "referring physician" should become "referring healthcare provider."

---

Modality Definitions Updated for the Digital Era

FROM: Definitions written around screen-film mammography, with limited formal reference to digital technologies.

TO: Updated definitions now formally include:

• Full-Field Digital Mammography (FFDM) — defined as the production of a digital mammographic image directly or indirectly from x-ray photons
• Digital Breast Tomosynthesis (DBT) — defined as a mammographic modality generating a 3D reconstruction from multiple limited-angle exposures
• Computed Tomography (CT) of the breast — explicitly added to the exclusion list; CT of breast is NOT a mammogram under MQSA regardless of the anatomy imaged

Operational impact: Facilities using DBT must ensure certification and accreditation specifically covers DBT. CT breast studies remain outside MQSA scope.

---

§900.4 — Accreditation Standards

Three-Strikes Accreditation Rule

FROM: No explicit limit on failed accreditation attempts.

TO: A facility that fails accreditation three times faces additional requirements before attempting accreditation again. The accreditation body must notify FDA, and the facility must demonstrate corrective action before a fourth application is permitted.

Operational impact: Facilities with poor QC performance or repeated accreditation failures face escalating barriers to re-accreditation. Address QC root causes before re-attempting.

---

§900.11 — Certification Requirements

Two-Year Ownership Ban After Revocation

FROM: No restriction on ownership or operation after certificate revocation.

TO: After a mammography certificate is revoked, the owner is prohibited from owning or operating a mammography facility for two years from the date of revocation.

Operational impact: Certificate revocation now carries significant personal liability for facility owners. Enforcement proceedings must be taken seriously.

---

§900.12(a)(4) — Personnel Record Retention

24-Month Post-Employment Retention + Employee Access Rights

FROM: Personnel qualification records were required while the individual was employed; post-employment retention requirements were less specifically defined.

TO:

• Facilities must retain personnel qualification records for at least 24 months after an individual ceases to work at the facility
• Employees have a right to request copies of their own qualification records; the facility must provide them
• If a facility permanently closes, a designated responsible party must maintain records and ensure continued access

Operational impact: Build a record retention calendar triggered by each departure date. When a physician, technologist, or physicist leaves, flag the file for 24-month retention. Create a documented process for responding to employee record requests.

---

§900.12(b)(2) — Equipment Standards

FDA Premarket Authorization Required for All Devices

FROM: Equipment requirements referenced FDA-approved devices, with less precise definition of what constitutes a new unit versus a replacement.

TO: All mammography equipment must have FDA premarket authorization (PMA, 510(k), or de novo). This applies to digital detector systems, CAD systems used in clinical interpretation, DBT systems, and any device used as part of the mammographic interpretation process.

Modality Change = New Mammography Unit

FROM: Upgrading from one digital system to another at the same site was generally treated as equipment replacement, not a new unit requiring reaccreditation.

TO: Converting from one mammography modality to another — for example, adding DBT capability to an existing FFDM system — is treated as a new mammography unit requiring:

• New accreditation for the new modality
• Notification to FDA
• Updated certificate before clinical use begins

Operational impact: Before any equipment upgrade that changes modality, complete the accreditation and certification update process first. Clinical use of a new modality without proper accreditation is a certification violation.

---

§900.12(c)(1) — Medical Records: Imaging Assessment Categories

This is among the most operationally significant sections of the 2024 Final Rule. The FDA has codified a complete imaging assessment taxonomy in federal regulation.

Complete FDA Imaging Assessment Taxonomy

FROM: Assessment categories were referenced in the regulations without comprehensive enumeration of all FDA-recognized categories.

TO (21 CFR §900.12(c)(1)): The following imaging assessment categories are now formally defined:

Standard Assessment Categories:

Category	FDA Required Assessment Language
A	"Negative"
B	"Benign"
C	"Probably Benign"
D	"Suspicious"
E	"Highly Suggestive of Malignancy"
F	"Known Biopsy-Proven Malignancy"
G	"Post-Procedure Mammogram for Marker Placement"

Incomplete Assessment Sub-Categories:

Sub-Category	FDA Required Assessment Language
Incomplete (1)	"Incomplete: Need additional imaging evaluation"
Incomplete (2)	"Incomplete: Need prior mammograms for comparison"

The FDA recognizes 9 distinct imaging assessment categories. Category G ("Post-Procedure Mammogram for Marker Placement") and both Incomplete sub-categories are FDA-recognized assessments. MQSA inspectors reference these imaging assessment categories — not BI-RADS® numbers.

BI-RADS® is a registered trademark of the American College of Radiology.

Operational impact: Mammography report templates must produce output that aligns with this taxonomy. Inspectors will review reports against these exact assessment categories. Audit tracking systems must correctly classify Category G and both Incomplete sub-categories.

---

§900.12(c)(1)(vi) — Breast Density Assessment Categories

Mandatory Breast Density Notification — The Nation's First Federal Requirement

FROM: No federal breast density notification requirement. Some states had their own laws, creating inconsistency across the country.

TO: All mammography facilities subject to MQSA must now include breast density notification in every lay letter. This is the first mandatory federal breast density notification requirement in U.S. history.

The Four FDA Breast Density Categories and Required Lay Letter Language:

Category A — Almost Entirely Fatty:

"The breast tissue is almost entirely fatty. This does not affect the ability to find cancer with a mammogram."

Category B — Scattered Areas of Fibroglandular Density:

"The breast tissue has scattered areas of fibroglandular density. This does not significantly affect the ability to find cancer with a mammogram."

Category C — Heterogeneously Dense:

First paragraph (required):

"[Patient name], your mammogram shows that your breast tissue is heterogeneously dense. Dense breast tissue is common and is not abnormal. However, dense breast tissue can make it harder to find cancer on a mammogram and may also be associated with an increased risk of breast cancer."

Plus the standardized FDA informational paragraph regarding supplemental screening discussions with a healthcare provider.

Category D — Extremely Dense:

First paragraph (required):

"[Patient name], your mammogram shows that your breast tissue is extremely dense. Dense breast tissue is common and is not abnormal. However, dense breast tissue makes it harder to find cancer on a mammogram and may also be associated with an increased risk of breast cancer."

Plus the standardized FDA informational paragraph.

Operational impact: Every lay letter template must be updated before the September 10, 2024 effective date. Density assignment (A/B/C/D) must be documented per examination. Letters must use the FDA-required language — paraphrased versions do not satisfy the regulatory requirement. Inspectors will pull letters and verify both the presence and accuracy of density notification language.

---

§900.12(c)(2) — Lay Letter and Patient Notification Timeline

30-Day / 7-Day Notification Rules + Mandatory Density Language

FROM: Lay letters were required; specific timelines were less precisely defined in regulation.

TO:

• All cases: Lay letter sent within 30 days of the examination
• Suspicious (Category D) and Highly Suggestive of Malignancy (Category E): Lay letter sent within 7 days of the examination
• All lay letters must include the mandatory breast density notification language
• Written report to the referring healthcare provider: 30 days (7 days for Category D and E)

Operational impact: Facilities must have a documented workflow that flags Category D and E cases for expedited letter production. The 7-day rule requires a fast-track process with specific accountability — not simply a priority note.

---

§900.12(c)(3)(ii) — Written Report Requirements for Urgent Findings

7-Day Written Report for Suspicious and Highly Suggestive of Malignancy

FROM: Urgent finding reporting requirements existed but without the same level of regulatory precision.

TO: For any mammographic examination resulting in Category D ("Suspicious") or Category E ("Highly Suggestive of Malignancy"), the facility must provide a written report to the healthcare provider within 7 days of the examination.

Operational impact: This 7-day rule applies to both the clinical report and the lay letter for Category D and E cases. Implement a tracking mechanism specifically for these categories to ensure both deadlines are met and documented.

---

§900.12(c)(4) — Mammography Records: Transfer and Retention

15-Day Transfer Deadline + Digital Records + Facility Closure Provisions

FROM: Record transfer obligations existed; specific timelines and digital provisions were less defined.

TO:

• Facilities must provide mammography records (images and reports) to a patient, their healthcare provider, or another facility within 15 calendar days of a written request
• Digital mammography records must be provided in a format that is usable by the requesting party
• If a facility permanently closes, the facility must:
  • Notify patients and referring providers
  • Establish a mechanism for continued access to records
  • Designate a responsible party for ongoing record access

Operational impact: Develop a documented record transfer workflow with tracking. Verify digital image export capabilities are functional. Have a closure contingency plan on file.

---

§900.12(f)(1) — Medical Outcome Audit: Formal Metric Definitions

Screening vs. Diagnostic Formally Defined; Audit Metrics Codified

FROM: Audit requirements existed; key terms were not formally defined in regulation.

TO: The following definitions are now codified in 21 CFR §900.12(f)(1):

Screening mammogram: A mammographic examination performed on an asymptomatic individual for the purpose of early detection of breast cancer.

Diagnostic mammogram: A mammographic examination performed to evaluate a specific clinical concern, symptom, or abnormal screening finding.

Recall Rate (Abnormal Interpretation Rate / AIR): The percentage of screening mammograms in a defined period that resulted in an imaging assessment of "Incomplete: Need additional imaging evaluation" or any positive assessment category.

Cancer Detection Rate (CDR): The number of cancers diagnosed per 1,000 screening mammograms performed in a defined period.

Positive Predictive Value 1 (PPV1): The percentage of positive screening assessments that resulted in a tissue diagnosis of cancer.

Positive Predictive Value 2 (PPV2): The percentage of recommended biopsies that resulted in a tissue diagnosis of cancer.

Positive Predictive Value 3 (PPV3): The percentage of performed biopsies that resulted in a tissue diagnosis of cancer.

Operational impact: The formal definitions now govern how facilities calculate and report these metrics. The screening vs. diagnostic distinction is regulatory, not just clinical convention. Ensure tracking systems correctly classify examinations and that audit calculations match the codified definitions.

---

§900.12(f)(4) — Medical Outcome Audit Record Retention

Records Retained Through First Post-Analysis Inspection

FROM: Audit record retention requirements were less specifically defined.

TO: Medical outcome audit records must be retained until after the first annual MQSA inspection that follows the completion of the audit analysis period.

Operational impact: Do not purge or archive audit records until after the inspection that covers that analysis period. If an inspection is delayed, retain records longer. Build this requirement into your records management calendar.

---

§900.12(j) — Notification Requirements

State Certification Agencies Added to Notification Scope

FROM: Notification obligations ran primarily to FDA and accreditation bodies.

TO: State certification agencies (where applicable) are added alongside FDA as required recipients of notifications. This includes notifications for personnel qualification failures, equipment malfunctions, corrective actions, and facility status changes.

Operational impact: Facilities in states with active MQSA certification programs must identify and maintain current contact information for their state agency in addition to FDA contacts.

---

§900.14 — Suspension and Revocation

Non-Compliance with Personnel Record Requests Added as Enforcement Ground

FROM: Grounds for suspension or revocation covered accreditation loss, quality failures, and inspection deficiencies.

TO: Added grounds include:

• Failure to comply with personnel record requests — a request from an inspector or FDA official for personnel qualification records must be honored; refusal is now an explicit suspension/revocation ground
• Expanded non-compliance definitions aligned with the updated regulations
• Alignment with the new three-strikes accreditation rule

Operational impact: When an inspector requests personnel files, compliance is not optional. Inability or refusal to produce records can trigger enforcement proceedings.

---

§900.15 — Agency Name Update

FROM: References to "Division of Mammography Quality" (DMQ).

TO: Updated to "Division of Mammography Quality Standards" (DMQS) — the current name of the FDA office responsible for MQSA program administration.

Operational impact: Administrative — update internal forms, contact directories, and correspondence templates that reference the division by name.

---

Download the Quick Reference Guide

For the formatted, print-ready version of this reference guide — suitable for binder filing, staff training, or inspection preparation — download the PDF below.

Download the Mammologix 2024 MQSA Updates Quick Reference Guide (PDF)

---

References

• 21 CFR Part 900 — Mammography Quality Standards (as amended, effective September 10, 2024)
• 88 FR 15126 — Final Rule: Amendments to the Mammography Quality Standards Act Regulations (March 9, 2023), Docket No. FDA-2013-N-0134, RIN 0910-AH04, Document Number 2023-04550
• U.S. Food and Drug Administration, Important Information — Final Rule to Amend MQSA: https://www.fda.gov/radiation-emitting-products/mammography-quality-standards-act-mqsa-and-mqsa-program/important-information-final-rule-amend-mammography-quality-standards-act-mqsa

---

BI-RADS® is a registered trademark of the American College of Radiology.