MQSA Requirements: What the 2023 Final Rule Changed for Mammography Facilities

What are the MQSA requirements?

The MQSA regulations are the federal quality standards for mammography, set out at 21 CFR part 900 and enforced by the FDA. They cover certification, accreditation, personnel qualifications, equipment, quality control, reporting to patients and providers, recordkeeping, and the annual medical outcomes audit. Every facility that performs mammography in the United States must hold an MQSA certificate and be inspected at least once a year.

The 2023 MQSA final rule is the largest amendment to those standards since 1999. It is not a separate rulebook. It rewrote parts of 21 CFR 900.2, 900.4 and 900.12, and those changes have been enforceable since 10 September 2024.

As of 1 August 2026, FDA reports 9,118 certified facilities and 27,692 accredited units nationally. In fiscal 2026 inspections to that date, 83.5% of inspections found no noncompliance, 15.6% topped out at a Level 2 finding, and 1% reached Level 1, the most serious category.

Who has to comply with the MQSA requirements?

The rules reach any facility that performs mammography under its own certificate, including hospital departments, imaging centers, mobile units and physician offices. FDA identifies a facility by its physical location, so a network that offers mammography at several sites must accredit and certify each site separately. A mobile unit reports under the name it is accredited and certified as, wherever it parks that day.

Breast density notification

Federal requirements apply regardless of state rules. All mammography facilities must comply with the FDA's breast density reporting requirements even if their state has its own guidelines. The federal notification provides consistent information for all patients nationwide.

The requirements below summarize the 2023 MQSA Final Rule, published 10 March 2023 with a compliance date of 10 September 2024. This is a summary written for imaging operations, not legal advice. Verify against the FDA's own MQSA guidance before you change a procedure.

Keep the federal statement distinct, not separate. Where a state requires its own notification, a facility may include it, and FDA does not prohibit adding information. FDA does recommend that any added text stay separate and distinct from the federal statement. Every required lay summary element, including the federal density statement, must appear inside the same lay summary and cannot be sent as an attachment.

What exactly must the breast density statements say?

Two layers of wording are prescribed, and they are not the same text. The report to the referring provider carries one of four density assessments. The lay summary to the patient carries one of two notification statements, chosen by whether the report assessment was dense or not dense.

The four report assessments, at 21 CFR 900.12(c)(1)(vi):

• "The breasts are almost entirely fatty."

• "There are scattered areas of fibroglandular density."

• "The breasts are heterogeneously dense, which may obscure small masses."

• "The breasts are extremely dense, which lowers the sensitivity of mammography."

Two operational notes are worth adding. A BI-RADS density letter category may be added, but it does not satisfy the requirement on its own. And the density statement cannot be sent as an attachment: FDA requires every mandatory lay summary element to sit inside the same lay summary.

The wording is prescribed, with one 2025 exception. The lay summary statements must appear as written. For the report to the provider, FDA Alternative Standard #26, approved 11 July 2025, added singular phrasing for unilateral mammograms and a set of labeled "Breast Density:" variants.

They are required for every patient, including male patients who undergo mammography.

Facility information and reporting

• Facility-specific information. Facilities must list their own accredited name and address on reports and lay summaries, not the network name. Where multiple locations are involved, the report must clearly indicate where the mammogram was performed.

• Electronic delivery. The lay summary may be handed to the patient at the time of the exam, mailed, or provided electronically, for example through a patient portal or by email. The thirty-day and seven-day clocks apply regardless of the delivery method.

• Updated assessment categories. Incomplete assessments now require two separate statements: one for needing additional imaging, and one for needing prior mammograms. The previously combined statement is no longer permitted. Where the assessment is "Incomplete: Need prior mammograms for comparison", a follow-up report must be issued within thirty calendar days of the initial report, whether or not the prior comparisons are obtained. Under FDA Alternative Standard #25, approved 29 October 2024, that follow-up may carry either a final assessment or "Incomplete: Need additional imaging evaluation". The interpreting physician determines which assessment category applies based on the images taken.

• Timeframe for communicating results. For exams with a final assessment of Suspicious or Highly Suggestive of Malignancy, reports must reach both the healthcare provider and the patient within seven calendar days.

Which MQSA deadline applies to which report?

Four separate clocks run, and they do not all start on the same event. The two routine deadlines start on the date of the examination. The urgent deadline starts on the date of the final interpretation. The incomplete follow-up starts on the date the initial report was issued.

FDA treats all of these as maximums rather than targets. A facility does not have to wait the full 30 days for prior images to arrive, and it does not have to wait 30 days after they arrive to issue the final report. The 15-day record clock is measured at sending, not at receipt.

Special circumstances

• Known biopsy-proven malignancies. A lay summary must be provided for every mammogram, including where a biopsy-proven malignancy is present. The summary should be specific to the findings and must still include the federal breast density notification.

• Post-procedure mammograms for marker placement. Where a post-procedure mammogram is logged as a separate exam, it must meet all MQSA standards, including the breast density notification.

• Imaging during invasive procedures is excluded. The regulations exclude radiography of the breast performed during invasive interventions for localization or biopsy procedures, so that imaging is not subject to MQSA requirements.

• Limited views still require a density assessment. Interpreting physicians must assess breast density in every mammography report, regardless of exam type.

Administrative requirements

These are the obligations that surface during an inspection rather than during a patient visit, and they are the ones most often discovered late. Retention, record release, the annual audit and personnel files each carry their own rule, and none of them depend on how a given exam was read.

How long must a facility keep mammograms and reports?

Original mammograms and mammography reports go in the patient's permanent medical record. The retention period is whichever of three is longest. The floor is five years. It rises to ten years where no further mammograms are performed at that facility. Any longer period required by state or local law overrides both. Facilities must also have written policies and procedures to minimize the chance of losing those records.

Two storage decisions follow from the word "original", and both are PACS configuration questions rather than policy questions:

• Lossy compression does not qualify. An image that has been through lossy compression is not in its original mammographic modality, so it does not meet the retention requirement.

• CAD marks must be removable. A facility may keep a marked set, but it must also be able to display the images without the computer-aided detection marks, because those marks overlie the anatomy.

Medical outcomes audit data has a shorter, differently shaped clock. It must be kept at least until the annual MQSA inspection that follows the analysis of that data. Consumer complaint records run three years from receipt of the complaint.

• Patient record release. Facilities must have a process to release patient records within fifteen days of a request.

• Medical outcomes audit. The annual audit must now include positive predictive value, cancer detection rate, and recall rate, for each interpreting physician and for the facility as a whole.

• What the audit leaves out. Mammograms assessed "Known Biopsy-Proven Malignancy" or "Post-Procedure Mammogram for Marker Placement" are excluded from the three metric calculations, so that a known finding is not counted as a new one. A screening-only facility with no positive exams still owes a recall rate, plus written documentation of how its audit system would follow up positives, correlate pathology, and run the analysis annually. The facility must also name an audit interpreting physician who reports each reader their own results and the facility aggregate.

• Equipment. All mammography devices must meet FDA premarket authorization requirements.

• Personnel records. Facilities must retain personnel records for at least twenty-four months after an employee leaves, and make them available on request.

What has changed since the rule took effect?

The 2023 rule is not the last word. FDA can approve an alternative standard under 21 CFR 900.18 when it judges the alternative at least as effective as the standard it replaces. Two of those approvals since September 2024 change what a reporting system has to support, and neither is widely written up.

Can the 30-day follow-up report still be incomplete?

Yes, since 29 October 2024. Alternative Standard #25 lets the follow-up report to an initial "Incomplete: Need prior mammograms for comparison" carry the assessment "Incomplete: Need additional imaging evaluation" rather than one of the five final categories. The 30-day deadline itself is unchanged. What changed is that meeting it no longer forces a final assessment the images may not support. The alternative has no time limit and is open to every facility.

Can the density assessment be phrased in the singular?

Yes, since 11 July 2025. Alternative Standard #26 permits the report assessment in the singular, which matters for unilateral mammograms, and also permits four labeled variants beginning "Breast Density:". So "The breast is extremely dense, which lowers the sensitivity of mammography" is now acceptable in a report. The lay summary statements to patients were not changed and still must appear as written in the regulation.

Both alternative standards are published on FDA's Alternative Standards (MQSA) page. That page is also where FDA recorded the withdrawal of Alternative Standards #11 and #12, which is why the old combined incomplete statement is no longer available.