The short answer. Plans are spending less on traditional HEDIS programs and expecting providers to close more gaps. The obligations that would make that work already sit in provider contracts and provider manuals, but plans rarely enforce them. With the hybrid method scheduled to retire by MY 2029, a provider agreement that does not require timely electronic clinical data will cost you the rate, not just the chase budget.
The regulations put the burden on the plan, not the provider
Read the Medicare Advantage quality rule closely. A plan must ensure that the information it receives from providers is reliable and complete. That is 42 CFR 422.152(f)(1)(ii). The same section asks the plan to encourage its providers to participate in CMS and HHS quality improvement initiatives. That is 422.152(a)(4).
Encourage. The regulation makes the plan accountable for provider data and asks almost nothing of the provider. Everything that actually obligates a provider to support your quality program lives in your paper: the provider agreement and the manual it incorporates by reference. If your contract does not require it, it does not exist.
What the contracts actually say
Most provider agreements carry four kinds of quality language:
Medical record access, sometimes with a turnaround time.
A general duty to cooperate with the plan's quality improvement program.
Compliance with the provider manual, incorporated by reference.
A pay-for-performance or quality incentive addendum.
The pattern is consistent. The obligations have no specifics, no timelines, and no consequences. Most of the operational detail lives in the provider manual, which the provider rarely reads and the plan can change. That is not an accident. It is a negotiated truce.
Why nobody enforces the clauses you already have
Ask a room of quality leaders whether they can name the clause that obligates providers to support HEDIS. Most hands go up. Ask whether they have enforced it in the last 12 months. Almost every hand goes down. The reasons are structural:
Leverage. The plan often needs the network more than the network needs the plan.
Network adequacy. You cannot terminate your way to compliance.
Silos. Contracting owns the paper, quality owns the outcome, and the two rarely meet.
Abrasion. Provider relations protects the relationship, not the measure.
No remedy. The contract describes the duty but never the consequence.
So plans buy their way around the gap. Chase vendors, outreach programs, and year-end gap lists all compensate for a data obligation the contract never defined.
The digital clock removes the workaround
NCQA plans to phase out the hybrid method by MY 2029. Some hybrid measures become administrative-only and others move to ECDS. On NCQA's proposed timeline, Controlling High Blood Pressure (CBP) and Blood Pressure Control for Patients with Diabetes (BPD) move to ECDS in MY 2028. Glycemic Status Assessment (GSD), Transitions of Care (TRC), and Care for Older Adults (COA) follow in MY 2029. NCQA expects the full move to digital HEDIS around 2030.
When hybrid is gone, there is no chart chase to rescue a rate. If the clinical data does not reach the plan electronically during the measurement year, the gap stays open. Under hybrid, a weak provider data relationship cost you money. Under ECDS, it costs you the rate.
The missing lane: provider to plan
On January 1, 2027, Medicare Advantage organizations must operate a Provider Access API under 42 CFR 422.121(a). The plan must make member data available to in-network providers no later than one business day after a request, and it must maintain a process that associates enrollees with their in-network providers.
That rule moves data from the plan to the provider. Nothing in it requires the provider to send clinical data back for quality measurement. The return lane is a contract term.
There is an upside. The attribution process you must build for the API is the same member list you need for gap closure. Build it once and use it twice.
Six terms a quality-ready provider agreement needs
You do not need a new contract. You need the clauses you already have, with specifics, timelines, and consequences added.
Data rights. Electronic access to clinical data for attributed members, not only records on request.
Format. Defined standards, such as FHIR, C-CDA, or a supplemental data file layout, that your HEDIS vendor and auditor accept.
Timeliness. Monthly or continuous feeds during the measurement year, not a year-end scramble.
Accuracy. The provider attests to the completeness of submitted data, and the plan may validate it.
Attribution. A shared member list, reconciled on a set schedule.
Remedies and rewards. Incentive eligibility tied to data obligations, with a cure period before any penalty.
Tie the data terms to the incentive first. A provider who sends clean, timely data should earn more than one who does not, before anyone talks about penalties. Bring your HEDIS auditor into the design, not the cleanup.
Align the contract, the expectations, and the operations
Most plans fail at the seams. The contract asks for data the plan cannot ingest, or provider relations makes promises the contract does not support. Check all three layers:
Contract. Does the paper say what we need, with a timeline and a consequence? Owner: Contracting and Quality.
Expectations. Does the provider know what we need, in plain language, before the year starts? Owner: Provider Relations.
Operations. Can we receive, validate, and use the data we are asking for? Owner: Quality Operations and IT.
If one layer is missing, the other two do not work.
What to do next
Pull your top 10 provider agreements and the provider manual. List every quality obligation.
Put contracting and quality in the same room for one hour.
Map which provider groups can send electronic clinical data today.
Pick one clause to fix at the next renewal.
Ask your HEDIS auditor what they will need to see under ECDS.
Frequently asked questions
Do Medicare Advantage regulations require providers to submit HEDIS data?
No. 42 CFR 422.152 makes the plan responsible for reliable and complete provider data and only asks plans to encourage provider participation in quality initiatives. Any provider obligation to share clinical data must come from the provider agreement or the manual it incorporates.
When does NCQA retire the HEDIS hybrid method?
NCQA plans to phase out the hybrid method by MY 2029, with each hybrid measure becoming administrative-only or moving to ECDS. The transition is proposed and goes through public comment and NCQA committee approval measure by measure.
Does the CMS Provider Access API help plans collect data from providers?
Not directly. The API, required for MA organizations starting January 1, 2027, sends plan data to in-network providers. The attribution process it requires can support gap closure, but the provider-to-plan data flow still depends on your contract.
What should a provider contract say about quality data?
At minimum: electronic data rights for attributed members, a defined format, in-year timeliness, an accuracy attestation, a reconciled attribution list, and incentives tied to meeting those obligations with a cure period before penalties.
Sources
42 CFR 422.152, Quality improvement program. eCFR
42 CFR 422.121(a), Provider Access API. eCFR
NCQA, "NCQA's Proposed Timeline for Retiring and Replacing HEDIS Hybrid Measures," November 15, 2024. ncqa.org
NCQA, "NCQA Shares New Guidance for Digital HEDIS Reporting," November 1, 2024, updated March 2026. ncqa.org
About the author
Tina M. Dueringer, BSN, RN, CCM, PCC is CEO and Principal Advisor of Dueringer Advisors, Inc., a clinically led advisory firm for health plans and the companies that serve them. About Tina
Discuss this on LinkedIn: Follow Dueringer Advisors on LinkedIn
Talk with us: Contact Dueringer Advisors