U.S. flag

An official website of the United States government

Quality of Care External Quality Review

CMS External Quality Review Approach

External Quality Review (EQR) plays an important part in Medicaid and Children’s Health Insurance Program (CHIP) managed care quality and accountability. It is part of a suite of tools, including the EQR Protocols, Quality Strategy, Quality Assessment and Performance Improvement (QAPI) requirements, and State Directed Payments, that can help states leverage their managed care plans to drive quality improvement.

What is External Quality Review?

An External Quality Review (EQR) is the analysis and evaluation by an External Quality Review Organization (EQRO) of aggregated information on quality, timeliness, and access to the health care services that a managed care plan, or its contractors, furnish to Medicaid beneficiaries. The annual EQR results in the generation of an annual EQR technical report. Section 1932(c)(2) of the Social Security Act and 42 CFR §438.350-370 require that each state that contracts with a managed care plan, including Medicaid and/or CHIP managed care organizations (MCO), prepaid inpatient health plans (PIHP), prepaid ambulatory health plans (PAHP), or with primary care case management (PCCM) entities (described in §438.310(c)(2)) must ensure that a qualified EQRO performs an annual EQR for each such contracting managed care plan. The 2016 Medicaid and CHIP Managed Care Final Rule applies all EQR and EQRO requirements to CHIP plans in 42 CFR §457 Subpart L.

States that deliver Medicaid and CHIP services through managed care must contract with at least one EQRO. The EQRO, under contract with a state, conducts the annual EQR and produces the annual EQR technical report. States may also contract with an EQRO to conduct one or more EQR-related activities. A state may elect to contract with two or more EQROs; for example, a state may contract with one EQRO to perform the annual EQR and produce the annual EQR technical report and with a second EQRO to perform EQR-related activities.

EQR-related activities are the mandatory and optional activities, as set forth in 42 CFR §438.358, which produce the data and information that the EQRO analyzes when performing the EQR. States have flexibility regarding who conducts the EQR-related activities, which may be performed by the state, a state agent that is not a managed care plan, or an EQRO. Regulations at 42 CFR 438.352 require CMS to issue protocols for the EQR-related activities. These protocols set forth guidelines for the EQR-related activities.

EQR-related activities are intended to:

  1. Improve states’ ability to oversee and manage the managed care plans they contract with for services.
  2. Help managed care plans improve their performance with respect to quality, timeliness, and access to care.

There are three mandatory activities which must be conducted on each managed care plan, and a fourth which will be mandatory once the protocol is created: For PCCM entities, only the performance measurement validation and a review, conducted within the previous 3-year period, to determine the MCO's, PIHP's, or PAHP's compliance with the standards set forth in subpart D must be conducted.

  1. Performance Measurement Validation
  2. Performance Improvement Project (PIP) Validation
  3. A review, conducted within the previous 3-year period, to determine the MCO's, PIHP's, or PAHP's compliance with the standards set forth in subpart D
  4. Network Adequacy Validation

There are six optional activities. The state has discretion to determine which optional EQR-related activities, if any, it wishes to conduct and include in the annual EQR. The optional activities are:

  1. Encounter data validation
  2. Administration or validation of consumer or provider surveys of quality of care
  3. Calculation of performance measures
  4. Implementation of performance improvement projects
  5. Focus studies on quality of care
  6. Rating of managed care plans
    • CMS must first establish the Medicaid and CHIP Quality Rating System (MAC QRS) framework, and develop a protocol, before this activity can be used by states.

2023 EQR Protocols

EQR protocols provide tools and guidance to States and EQROs using current industry methodologies and offer practical tips and best practices for creating the technical report. The protocols were updated in February 2023 to add a new protocol for the mandatory network adequacy validation activity, to align design features with the 2021 Quality Strategy Toolkit, and to provide new tips and reminders to improve EQR Technical Reports.

2023 Protocol Implementation Timeline

  • With the exception of the NAV protocol (Protocol 4), states must use the 2023 protocols for EQR technical reports due April 30, 2024.
  • As established in the 2016 final rule, states must begin conducting the NAV activity at §438.358(b)(1)(iv) no later than one year from the issuance of the associated EQR protocol. This means that by February 2024, states and EQROs must begin using Protocol 4 in the 2023 protocols to conduct the NAV activity.
  • Though states have one year to begin conducting network adequacy validation, an enhanced match for conducting the new activity is available as of the release of the protocol, February 2023. States must submit their EQRO contracts to CMS for review and approval prior to claiming the enhanced 75 percent match.
  • Results from the NAV activity, conducted in accordance with Protocol 4, must be included in EQR technical reports due April 30, 2025. 
  • States can begin to use these updated protocols immediately, but can continue to use the 2019 EQR Protocols  and 2019 EQR Protocol Worksheets for EQR technical reports due April 30, 2023.

Webinar: 2023 EQR Protocols


Nonduplication (42 CFR § 438.360 and § 457.1250(a)) allows, under certain conditions, a state to use information from a Medicare or private accreditation review of a plan in place of generating that information through one or more of three mandatory EQR-related activities (Protocols 1–3). The revised protocols include new guidance on nonduplication and reflect that the Medicaid Managed Care Final Rule expanded nonduplication to include the validation of PIPs and performance measures (in addition to compliance review).

EQR Technical Reports

The annual EQR technical report is the public facing end-product of the annual EQR. The EQRO produces the technical report for the state. The EQRO must make the annual EQR technical report available to the public, including CMS, both on the state’s website and upon request either in print or electronically. The annual technical report must include:

  1. The results of the EQR-related activities.
  2. The EQRO’s assessment of each managed care plan’s strengths and weaknesses related to quality, timeliness and access.
  3. Recommendations for improving the quality of health care services furnished by each managed care plan and recommendations for how the state can target goals and objectives in the State quality strategy.
  4. Methodologically appropriate, comparative information about all managed care plans.
  5. An assessment of the degree to which each managed care plan has addressed the recommendations for quality improvement made by the EQRO during the previous year’s EQR.

EQR Annual Reporting

CMS requires that all states have final EQR technical reports available to CMS and the public by April 30 of each year. CMS reviews these reports and abstracts data related to Performance Measures and PIPs. This data is analyzed and aggregated into summary tables.

Summary tables abstracted from EQR technical reports by year of submission:

Additional Updates to the EQR Protocols in 2019

  1. Changed the Federal Financial Participation (FFP). For Medicaid programs, EQR and EQR-related activities performed on MCOs may be eligible for an enhanced match rate. Additional details can be found at 42 CFR § 433.15 and § 438.370(a) and the July 10, 2016 CMCS Informational Bulletin (CIB), Federal Financial Participation for Managed Care External Quality Review.
  2. Reiterated Health Insurance Portability and Accountability Act (HIPAA) requirements. States must ensure the privacy of patient information and that managed care plans comply with HIPPA of 1996, and all other federal and state laws concerning confidentiality and disclosure. EQROs must ensure that all EQR-related activities and the EQR technical report process are consistent with HIPPA requirements.

Technical Assistance

Please submit any questions or requests for technical assistance related to EQR to ManagedCareQualityTA@cms.hhs.gov.