A QCDR or Qualified Registry is a third party intermediary that CMS has approved to collect and submit Merit-based Incentive Payment System (MIPS) quality data for clinicians, groups and APM Entities, under 42 CFR 414.1400. This page is for data registries seeking CMS approval, keeping it, or pursuing DirectTrust Data Registry accreditation. Integral Healthcare Solutions (IHS) builds the registry's governance, clinician and vendor agreements and annual evidence calendar and runs a mock review; your measure specialists own measure specifications and data validity, and your registry submits its own self-nomination.

Last reviewed: October 2026.

What is a QCDR or Qualified Registry?

CMS defines the category this way: “Third party intermediaries are organizations that the Centers for Medicare & Medicaid Services (CMS) has approved to collect and submit data on behalf of program participants.” (CMS QPP) CMS adds that “Beginning in 2025, QCDRs and Qualified Registries are the only third party intermediaries approved to submit data on behalf of clinicians, groups, and APM Entities, including Shared Savings Program.” (CMS QPP)

The two types differ on measures: “Unlike Qualified Registries, QCDRs have the opportunity to develop and support their own measures. QCDRs must request CMS approval for their proprietary measures each year.” (CMS QPP)

The governing text is 42 CFR 414.1400, the MIPS third party intermediary regulation, which we read in its current eCFR form (current as of September 1, 2026) on October 2, 2026 (42 CFR 414.1400). It sets the self-nomination period, participant minimum, data validation plan, feedback and agreement requirements described below, and it requires that “All data submitted to CMS by a third party intermediary ... must be certified by the third party intermediary as true, accurate, and complete to the best of its knowledge.” (42 CFR 414.1400)

There is a separate, voluntary accreditation route. DirectTrust says “the Data Registry Accreditation Program (DRAP) was developed, as it establishes a trust framework between stakeholders to ensure a common level of system functionality across the industry.” (DirectTrust) The 2026 criteria version is Data Registry v5.1, one of the new criteria versions DirectTrust released for “its 28 accreditation programs starting January 1, 2026.” (DirectTrust) DirectTrust releases its criteria on request; IHS did not review the criteria text for this page.

Who needs it and what triggers it

The buyer is a data registry, or an organization that submits quality data for clinicians. The work usually starts with one of these:

• Seeking CMS approval. A registry self-nominates during the CMS period (July 1 to September 1 per 414.1400(b)(2) for the simplified process), and it “must have at least 25 participants by January 1 of the year prior to the applicable performance period.” (42 CFR 414.1400(b)(3)(i))
• Annual maintenance. The registry “must submit a data validation plan annually, at the time of self-nomination for CMS' approval,” and QCDRs request approval of their own measures each year (42 CFR 414.1400(b)(3)(iv); CMS QPP).
• Working through an external organization. If the registry relies on an external organization, “it must have a signed, written agreement with the external organization that specifically details the responsibilities of the entity and the external organization. The written agreement must be effective as of September 1 of the year preceding the applicable performance period.” (42 CFR 414.1400(b)(3)(ii))
• An accreditation objective. A registry that wants DirectTrust DRAP accreditation, for example to show partners a common level of system functionality (DirectTrust).

Where the self-nomination window stands

42 CFR 414.1400(b)(2) says an existing QCDR or qualified registry in good standing may use the Simplified Self-Nomination process form “during the self-nomination period, from July 1 and September 1 of the CY preceding the applicable performance period.” The paragraph states that period only for the simplified process. IHS's reading is that the same July 1 to September 1 period applies to a new registry; confirm against the CMS self-nomination materials for the performance year. IHS's reading, October 2026: the window for the 2027 performance period ran July 1 to September 1, 2026 and is now closed, so the next window, for the 2028 performance period, would run July 1 to September 1, 2027. That is an inference from the regulation text; CMS had not published 2028 dates on the pages we reviewed. Work started now targets that window or ongoing program maintenance.

How IHS helps

IHS works the organizational side of registry approval and accreditation. The process:

1. Gap assessment against 42 CFR 414.1400 and the CMS self-nomination materials, or against the DirectTrust Data Registry criteria your registry obtains from DirectTrust.
2. Questionnaires on clinician agreements, data validation and submissions.
3. Document and evidence mapping: each requirement crosswalked to the policy, agreement or record that answers it.
4. Drafting for your leaders to review and approve: governance, clinician agreement templates, external-vendor agreements, data validation responsibilities, issue-handling procedures, and an annual evidence calendar keyed to the CMS self-nomination period (July 1 to September 1 in the current regulation text; IHS re-keys it when CMS publishes each year's dates).
5. Mock review of the evidence file against the requirements.
6. Readiness support: drafted self-nomination narrative text, which your registry submits itself.

What your registry supplies: measure specifications, its data validation plan, platform documentation, and the measure specialists and engineers who own them.

The limit: measure specifications, data validity and the data validation audit belong to your registry's specialists. IHS builds the governance, agreements and evidence calendar around that work and does not validate data or develop measures.

What to have ready

Each item ties to 42 CFR 414.1400 as read on October 2, 2026, or to DirectTrust's published process.

1. Your participant count and roster, against the minimum of “at least 25 participants by January 1 of the year prior to the applicable performance period” (414.1400(b)(3)(i)).
2. Your data validation plan, which goes to CMS “annually, at the time of self-nomination” and cannot change once approved without CMS's prior approval (414.1400(b)(3)(iv)).
3. A schedule and record of performance feedback to clinicians and groups “at least 4 times a year” (414.1400(b)(3)(iii)).
4. Signed written agreements with any external organization, detailing each party's responsibilities and “effective as of September 1 of the year preceding the applicable performance period” (414.1400(b)(3)(ii)).
5. A procedure for certifying submitted data “as true, accurate, and complete to the best of its knowledge” (42 CFR 414.1400).
6. For a QCDR, specifications for each proprietary measure you will ask CMS to approve that year (CMS QPP).
7. For a returning registry in good standing, a decision on whether to use the Simplified Self-Nomination process form (414.1400(b)(2)).
8. A calendar that places all of the above before the CMS self-nomination period (July 1 to September 1 in the current regulation text; IHS re-keys it when CMS publishes each year's dates) (414.1400(b)(2)).
9. For DirectTrust DRAP: a copy of the Data Registry criteria, requested from DirectTrust (criteria available on request).
10. For DirectTrust DRAP: a signed Accreditation Program Agreement and a Financial Attestation of revenue (DirectTrust process).

To walk through this list against your own registry, start with the introductory call.

How it compares

• Qualified Registry vs QCDR. Both are CMS-approved third party intermediaries. QCDRs can develop and support their own measures and must request CMS approval for them each year (CMS QPP).
• Clinicians submitting their own data. CMS tells clinicians “you don't have to use a third party to submit your data.” (CMS QPP)
• Health IT vendors. No longer an intermediary route: the regulation lists “Before the CY 2025 performance period/2027 payment year, Health IT vendor” (42 CFR 414.1400(a)(1)(iii)).
• DirectTrust DRAP. A voluntary accreditation. No page we reviewed says CMS requires it for QCDR or Qualified Registry approval.
• DirectTrust's own services. DirectTrust program pages say: “Learn about our Consulting and Advisory Services which have been designed to provide additional guidance in completing these programs.” (DirectTrust)

What it costs

CMS does not publish a self-nomination fee on the pages we reviewed.

DirectTrust publishes its accreditation fees: “Accreditation fees are based on program(s), location(s), and revenue-level. Accredited organizations incur an Annual Fee. Every other year when an organization pursues accreditation (their On-Cycle year), they additionally incur Assessment, Location, and (if applicable) Multi-Program Discounted and Program-Specific Fees, as appropriate. On Off-Cycle years, organizations pay only the Annual Fee.” (DirectTrust)

Source: DirectTrust's apply page, read October 2, 2026, which states “*Federal, state, and non-profit organizations are included in the Small Size above.” Verify current fees with DirectTrust. IHS scopes each engagement after a free introductory call.

What this is not

• IHS does not submit anything to CMS or DirectTrust. IHS drafts; your registry self-nominates and applies.
• IHS does not develop measures, validate data or certify submissions, and does not predict or guarantee a CMS or DirectTrust decision.
• This page is not legal advice.

Frequently asked questions

What is the difference between a QCDR and a Qualified Registry?

Both are third party intermediaries that CMS approves to submit MIPS data for clinicians, groups and APM Entities. CMS says that, unlike Qualified Registries, QCDRs can develop and support their own measures, and must request CMS approval for those measures each year.

How does a registry self-nominate with CMS, and when is the self-nomination window?

42 CFR 414.1400(b)(2) states a self-nomination period of July 1 to September 1 of the calendar year before the performance period in its sentence on the Simplified Self-Nomination process for existing registries in good standing. IHS's reading is that the same period applies to a new registry; confirm against the CMS self-nomination materials for the performance year. The registry submits its data validation plan with the self-nomination. IHS drafts narrative text and evidence; the registry submits its own self-nomination.

We missed the September 1 deadline; when can we next self-nominate?

IHS's reading of the regulation, October 2026: the window for the 2027 performance period closed September 1, 2026, so the next window, for 2028, would run July 1 to September 1, 2027. CMS had not published 2028 dates on the pages we reviewed, so confirm the dates when CMS posts them.

How many participants does a registry need before it can qualify?

The regulation says the registry must have at least 25 participants by January 1 of the year prior to the applicable performance period.

When is a data validation plan due, and can it change?

The registry submits a data validation plan annually, at the time of self-nomination, for CMS approval. Once approved, it may not change without CMS's prior approval. The plan's content belongs to your measure and data specialists; IHS drafts the surrounding responsibilities and records.

What is the Simplified Self-Nomination process and who can use it?

The regulation lets an existing QCDR or Qualified Registry in good standing use the Simplified Self-Nomination process form during the self-nomination period.

What written agreements do we need with an external data vendor?

If the registry uses an external organization, the regulation requires a signed, written agreement that specifically details the responsibilities of each party. It must be effective as of September 1 of the year before the performance period. IHS drafts these agreements for your leaders and counsel to approve.

Is DirectTrust Data Registry accreditation required for CMS approval?

No page we reviewed says so. DirectTrust describes its Data Registry Accreditation Program as a trust framework for a common level of system functionality, and it is a separate, voluntary route.

How much does DirectTrust Data Registry accreditation cost?

DirectTrust publishes revenue-tiered fees: an Annual Fee every year, plus Assessment and other fees in the On-Cycle year. Its Very Small tier lists a $3,100 Annual Fee and $5,500 Assessment Fee. Verify current fees with DirectTrust; IHS scopes its own work after a free introductory call.