What does MQSA actually require us to send patients after a screening mammogram, and by when?

Every patient who has a mammogram at your facility must receive a written summary of her results, in plain language she can understand, sent directly to her, within thirty days of the exam. If the assessment is incomplete, suspicious or highly suggestive of malignancy, that clock shortens: the report goes to her provider and the summary goes to her as soon as possible, and no later than seven days. Since September 2024, the summary must also tell her whether her breast tissue is dense or not dense, using language the FDA specifies.

That is the federal floor. It comes from the Mammography Quality Standards Act, which is enforced by the FDA through annual inspections, and it applies to every certified facility in the country regardless of size or ownership.

What follows is that rule set translated into the work it creates. Most of it lands on a scheduler or a practice manager, not on a radiologist, because the radiologist's job ends when the report is signed and yours begins when it has to reach a person.

What the Mammography Quality Standards Act asks of every certified facility

MQSA is a certification regime. You cannot legally perform mammography in the United States without an FDA certificate, and you cannot hold that certificate without accreditation from an approved body, personnel who meet defined qualifications, equipment that passes annual physics surveys, a quality assurance program, and a medical outcomes audit.

The communication requirements sit inside that same regulation. They are not a courtesy layered on top of the clinical work. An inspector can and does write a citation for notification failures the same way she writes one for a missed phantom image test.

Three obligations matter for front office work. Send the full report to the referring provider. Send a lay summary to the patient. Keep records showing both happened, and when.

Keep reading: Should we text, call or mail our annual recall reminders, and how do the three compare on cost?

Lay summary versus the report sent to the referring provider

These are two different documents with two different audiences, and conflating them is the most common error in a small center.

The report to the referring provider is the radiologist's finalized interpretation. It carries the overall assessment in the standard categories, the findings, comparisons to prior exams, and any recommendation for additional imaging or biopsy. It is written for a clinician.

The lay summary is written for the patient. The regulation requires it to be in terms easily understood by a lay person. It has to convey the result, but it is not simply a copy of the report with the header changed.

	Provider report	Patient lay summary
Audience	Referring clinician	The patient herself
Language	Clinical, full assessment category	Plain language, no jargon
Must include density	Yes, the assessment of breast tissue	Yes, in the FDA specified wording
Standard timing	Within 30 days of the exam	Within 30 days of the exam
Sent by	Facility, however the report is routed	Facility, directly to the patient

One practical consequence: you cannot satisfy the patient notification requirement by giving the report to her doctor and assuming the doctor will tell her. The obligation to reach the patient sits with your facility.

Standard notification timing and the shorter window for suspicious findings

Thirty days is the outer boundary for routine results, and it is a boundary, not a target. A center that habitually mails at day twenty eight has no margin for a printer failure or a staff absence.

The seven day requirement is the one that changes daily workflow. When an assessment is incomplete and needs additional imaging, or suspicious, or highly suggestive of malignancy, the facility must make reasonable attempts to communicate results to the patient as soon as possible, and in no case later than seven days.

What a seven day clock means operationally

It means you cannot batch. A weekly Friday letter run works fine for negative results and fails immediately for a category zero read signed on a Monday, because a letter that leaves Friday and arrives the following Wednesday has consumed nine days.

Build a separate daily lane. Every business morning, someone pulls the prior day's finalized reports with an incomplete, suspicious or highly suggestive assessment. Those patients get a phone call the same day and a written summary sent that day. Log the call attempt with a timestamp whether or not you reached her.

Set an internal target well inside the rule. If your internal standard is three business days for these results and thirty for routine, you have real room when something goes wrong.

Keep reading: Why do so many of our screening no shows never come back, and what can we do about it?

The 2023 final rule and breast density notification language

The FDA published a final rule amending the mammography regulations in March 2023, with a compliance date of September 10, 2024. The headline change is national breast density notification.

Before this rule, density notification was a patchwork. More than thirty states had passed their own laws, each with its own wording and its own trigger. The federal rule sets a national floor: every patient lay summary must state whether her breast tissue is dense or not dense, and must include specified language explaining that dense tissue makes it harder to find cancer on a mammogram and is associated with an increased risk of developing breast cancer, and that she should talk with her healthcare provider about her individual situation.

Two operational points get missed.

First, the four BI-RADS density categories collapse into two statements for the patient. Categories A and B produce the not dense language. Categories C and D produce the dense language. Your letter template needs both variants and a reliable way to pick between them from the report field.

Second, state law still applies where it is stricter or adds requirements. The federal rule is a floor, not a ceiling. If your state mandates additional wording or a separate notice, you send both.

The same final rule also standardized the assessment categories facilities must use in reports and tightened medical outcomes audit expectations. Those are radiologist and QA facing, but they change the fields your letter templates read from, so worth confirming your template maps to the current category names rather than legacy ones.

What to do when a patient has no referring provider on file

Self referred patients are common at independent screening centers, and the regulation anticipates them. Where the patient has no referring provider, the facility sends the results directly to the patient. In practice that means she needs to receive the substance of the report, not only a two line summary, because there is no clinician downstream to interpret it for her.

Do the data work at check in, not at result time. Three fields, captured before she leaves: name of the provider she wants results sent to, that office's fax or portal, and confirmation that the address and mobile number on file are current. A blank provider field discovered on day twenty six is a scramble.

If she genuinely has no provider, say so in the record explicitly rather than leaving the field empty. An explicit "self referred, no provider" is auditable. An empty field looks like an oversight.

See how MammoLoop handles this for breast imaging and women's screening centers

Documentation your inspector will ask to see

MQSA inspections are annual, usually unannounced within a window, and the inspector will sample records. What she is checking is whether you can demonstrate the process, not whether you remember it.

• A copy or record of each lay summary sent, tied to the patient and the exam, with the date it was sent.
• Evidence the provider report was transmitted, with a date, however you route it.
• Timestamped attempts for the seven day category, including calls that did not connect.
• Your template library, showing current density language for both variants.
• A written procedure naming who does what, and the backup when that person is out.
• Handling of undeliverable mail, showing what happens after a letter comes back.

The recurring finding at small centers is not a missing letter. It is a letter that almost certainly went out with no record proving it did. Sending and logging have to be one action, not two.

Why recall letters and result letters must stay separate

A result letter is a regulated communication about a specific exam, on a specific clock, with mandated content. A recall reminder is a marketing and continuity of care communication about an exam that has not happened yet. Keeping them in one workflow creates two hazards.

The compliance hazard: if the same queue and the same template produce both, an audit cannot cleanly separate what was sent as a result notification from what was sent as an appointment nudge. Your evidence gets muddy.

The patient hazard is worse. A woman opening an envelope that begins with her results and ends with a booking prompt will read the whole thing as a sales piece, or she will read a routine reminder as though it carried findings. Neither is acceptable when the subject is her breast health.

Separate templates. Separate suppression rules. Separate logs. A patient in an open workup should be suppressed from annual recall entirely while she is still receiving result communications about the exam in progress.

Putting the two systems side by side

Result notification is a compliance obligation with a fixed clock. Recall is an operational discipline with no external deadline at all, which is exactly why it slips first when the week gets busy.

MammoLoop handles the second one, deliberately kept apart from the first. It carries the annual recall cohort, sends the staged texts and letters that bring a woman back for next year's screening, tracks the callbacks, and works the no shows. Your result letters stay where your compliance process already lives. The follow up that has no regulator behind it gets a system of its own.