Mammography Quality Standards Act — FDA Certification and Breast Density Reporting

The Mammography Quality Standards Act of 1992 (MQSA, 42 U.S.C. § 263b), implemented at 21 CFR Part 900, requires every mammography facility in the United States to hold a valid FDA certificate as a condition of lawful operation. No facility may perform mammography — whether screening or diagnostic — without meeting the MQSA quality standards covering equipment, personnel, and quality assurance, passing inspection by an FDA-approved accreditation body, and receiving an FDA certificate. The system applies to all ~10,000 mammography facilities performing the approximately 40 million mammograms conducted annually in the United States. A 2023 FDA final rule (88 FR 15168) added the most significant change since the original 1999 quality standards: beginning September 10, 2024, all mammography facilities must assess and report each patient's breast density in the written summary provided after the examination — a requirement expected to prompt supplemental screening conversations for the roughly half of women over 40 who have dense or extremely dense breast tissue.

Legal Authority

• 42 U.S.C. § 263b — Mammography Quality Standards Act of 1992 (MQSA); requires all mammography facilities in the United States to be certified by FDA or an FDA-approved accreditation body; establishes quality standards for equipment, personnel, and practices; authorizes FDA to inspect facilities and impose sanctions for non-compliance
• 21 CFR Part 900 — FDA implementing regulation (Mammography Quality Standards); establishes specific certification requirements, personnel qualifications (interpreting physicians, medical physicists, radiologic technologists), quality assurance standards, and the breast density reporting requirement added by the 2024 FDA rule

Key Mechanics

Every mammography facility in the United States — hospital radiology departments, freestanding imaging centers, mobile units — must obtain FDA certification under MQSA. Certification requires: (1) accreditation by an FDA-approved accreditation body (ACR or state programs in Iowa and Texas); (2) annual FDA inspection; and (3) compliance with quality standards covering equipment performance, image quality testing, and personnel qualifications. Key personnel requirements: interpreting physicians must complete 240 hours of training in mammographic interpretation and maintain 15 CME hours per 3 years; radiologic technologists performing mammography must have 40 hours of initial mammography training and 15 CEU hours per 3 years; medical physicists must conduct annual facility surveys. The FDA's 2023 mammography rule (effective September 2024) added a mandatory breast density reporting requirement: facilities must include standardized breast density information in every mammography report sent to patients and their referring providers; the report must categorize density as "not dense" or "dense" using the ACR BI-RADS system and include language advising patients with dense breasts that density may affect cancer detection and that supplemental imaging may be considered. This requirement fulfilled a decade-long advocacy campaign; as of 2024, approximately 40 states had state-level breast density reporting laws that the federal rule now supersedes.

Current Rule (2026)

What This Rule Does

MQSA created a three-level quality assurance system for mammography: accreditation by an approved body, certification by FDA (or an FDA-approved state), and inspection by the accreditation body or FDA. The three levels interact — a facility cannot receive FDA certification without accreditation, and must maintain both throughout operation:

Accreditation (Subpart A): Private nonprofit organizations and state agencies may apply to FDA for approval as accreditation bodies. The American College of Radiology (ACR) is the primary national accreditation body; some states have their own accreditation programs. Accreditation bodies must evaluate facilities against FDA's § 900.12 quality standards, conduct clinical image reviews, and perform phantom image (test object) reviews; they also conduct unannounced annual inspections. Accreditation is a prerequisite for FDA certification.

Certification (Subpart B, §§ 900.10–900.18): FDA issues certificates to facilities that are accredited and meet the § 900.12 quality standards. A certificate must be displayed at the facility. FDA may suspend or revoke certificates for failure to maintain quality standards, adverse accreditation actions, or serious patient safety violations. The certificate is the legal authorization to operate — performing mammography without a valid certificate is a federal violation.

State Certifiers (Subpart C, §§ 900.20–900.25): States may apply to become FDA-approved certification agencies, allowing them to certify facilities within their state. States that act as certifiers are held to at least the same standards as FDA; FDA evaluates state programs annually and may withdraw approval if programs fail to maintain compliance.

Key Provisions

• § 900.11 — Certificate required: after October 1, 1994, no facility may perform mammography without an FDA certificate; the facility must post the certificate in a location visible to patients; the certificate is facility-specific, not equipment-specific — if equipment at a certified facility is replaced, it must still meet the § 900.12 equipment standards and be tested before clinical use

• § 900.12(a) — Personnel standards: the interpreting physician (radiologist who reads mammograms) must be board-certified in radiology or have specialty training equivalent to board certification, must have specific training in mammography interpretation, and must complete 15 continuing education units in mammography every 3 years; the radiologic technologist (who performs the examination) must be licensed in their state, must have 40 hours of mammography training, must perform 200 mammographic exposures per year minimum, and must complete 15 continuing education units every 3 years; the medical physicist (who performs equipment testing) must have graduate training in physics and specific mammography physics training, must survey each facility annually using specified test methods, and must submit survey reports to the facility in the required format

• § 900.12(b) — Equipment standards: mammography equipment must be specifically designed for mammography (general-purpose X-ray units are not permitted); the facility must use equipment meeting specific requirements for automatic exposure control, breast compression force (minimum 25 pounds force for initial power-drive compression, adequate to produce diagnostic images), image receptor sizes, X-ray beam quality (half-value layer requirements), and dose limits; mean glandular dose per exposure must not exceed 3 mGy for a standard 4.2 cm compressed breast (MQSA dose limit); both film-screen and digital mammography systems are covered (the 1999 standards and 2004 digital amendments brought full-field digital mammography under MQSA)

• § 900.12(c) — Quality assurance: each facility must maintain a quality assurance program covering: daily phantom image evaluation, weekly processor quality control (for film systems), weekly repeat/reject analysis to identify equipment or technique problems, semi-annual equipment performance evaluation by a medical physicist, and annual equipment inspections; a lead interpreting physician must be designated for QA oversight; records must be maintained for 5 years; quality assurance is the continuous compliance mechanism — accreditation body inspection and FDA survey verify that the QA records and procedures are actually being followed

• § 900.12(d) — Medical records and mammography reports: a written report must be completed for every mammographic examination; the report must include the name and address of the facility, the name of the interpreting physician, the date of the examination, the overall assessment of findings (using specified assessment categories — negative, benign, probably benign, suspicious, highly suggestive of malignancy, known biopsy-proven malignancy, or incomplete/additional imaging needed), and the clinical indication for the examination; reports must be provided to the referring physician and, on request, to the patient; records of mammographic examinations must be maintained for at least 5 years, or at least 10 years if no subsequent mammograms at that facility, or for as long as state law requires if longer

• § 900.12(d)(1)(iii) — Breast density notification (2024 requirement): the most significant addition from the 2023 final rule — the written summary provided directly to the patient must include an assessment of breast tissue density, using the following standardized language based on the four-category BI-RADS density classification system:

  • Category A (almost entirely fatty) or Category B (scattered areas of fibroglandular density): "The breast tissue is not dense. Talk with your healthcare provider about your individual situation."
  • Category C (heterogeneously dense) or Category D (extremely dense): "Your breast tissue is dense. Dense breast tissue is common and is not abnormal. However, dense breast tissue can make it harder to find cancer on a mammogram and may also be associated with an increased risk of breast cancer. This information about the results of your mammogram is given to you to raise your awareness and to inform conversations with your healthcare provider. Together, you can decide if additional imaging tests might be right for you." The standardized language requirement — not just a density category notation, but the specific words — ensures that all patients with dense tissue receive a consistent, actionable message about the potential need for supplemental screening; about 10–15% of breast cancers missed on mammography are in dense breast tissue; supplemental ultrasound or MRI may detect cancers in these cases

• § 900.12(f) — Mammography medical outcomes audit: facilities must analyze outcomes data to ensure that mammographic interpretations are leading to appropriate follow-up and biopsy referrals; interpreting physicians' positive predictive values (the percentage of positive mammograms that result in biopsy-proven malignancy) must be tracked; physicians with rates that suggest interpretation problems (too many false positives or false negatives) must be identified and remediation actions taken

• § 900.13 — Revocation of accreditation: if an accreditation body revokes a facility's accreditation, FDA may conduct its own investigation; if FDA determines that the revocation was appropriate, FDA suspends the facility's certificate; facilities lose the right to operate the moment accreditation is revoked — not after appeal; FDA may take emergency action to protect patients if an immediate safety threat exists

• § 900.14 — Suspension or revocation of certificates: FDA may suspend or revoke a certificate if it finds violations of MQSA standards, including failure to have a certificate properly displayed, failure to permit inspections, serious equipment deficiencies, or personnel who fail to meet qualifications; suspension takes effect immediately upon notice; the facility must notify patients of the suspension and their right to alternative facilities

How It Affects You

If you received a mammogram after September 10, 2024: the written summary you received should have included a breast density assessment using the standardized language above. If your tissue was classified as heterogeneously dense (Category C) or extremely dense (Category D) — which applies to approximately 40–50% of women over 40 — you received specific language recommending a conversation with your healthcare provider about supplemental imaging. Dense breast tissue is a significant risk factor for mammography false negatives, and supplemental ultrasound (automated or hand-held) or breast MRI can detect cancers that mammography alone may miss. Insurance coverage for supplemental screening varies by state.

If you operate a mammography facility: FDA certification is required to operate. Key compliance pressure points under the 2024 updates: (1) your mammography report template and patient summary must include the standardized breast density language; (2) your interpreting physicians must use the BI-RADS 5th edition density classification; (3) your QA program must document that density assessments are being made consistently; (4) your medical records system must capture density assessments for outcomes audit purposes. Facilities that have not updated their report templates to include the required language are in violation of § 900.12(d) and subject to certificate suspension. The ACR and other accreditation bodies have model language and template updates available.

If you are a radiologist interpreting mammograms: you must hold the § 900.12(a) interpreting physician qualifications and meet the continuing education requirements. The new density reporting requirement adds an explicit, documented assessment to every case — not just a clinical impression, but a formal BI-RADS density category that generates patient-facing language. This is both a clinical and medicolegal consideration: if a patient with heterogeneously or extremely dense tissue develops interval cancer after a negative mammogram, the required density notification language demonstrates that the facility informed her of the dense-tissue limitation at the time of the examination.

If you are a patient in a state with stricter density notification laws: several states enacted breast density notification laws before the federal MQSA requirement took effect; MQSA preempts state requirements that are less stringent but does not preempt state laws that are more protective; some states have required supplemental screening coverage for dense breasts that goes beyond the federal notification requirement.

Statutory Authority

This rule implements:

• 42 U.S.C. § 263b (Mammography Quality Standards Act of 1992, as amended) — requires FDA to establish quality standards for mammography and to certify facilities that meet those standards; authorizes FDA to establish an accreditation body system; grants FDA authority to suspend or revoke certificates; directs FDA to ensure that patients receive results in writing; the 2004 Reauthorization (P.L. 108-365) extended MQSA and required electronic records capabilities; the 2018 Reauthorization (P.L. 115-64) extended MQSA through 2022; subsequent continuing authorizations have kept the program in force

Recent Rulemakings

• 88 FR 15168 (March 10, 2023) — Major MQSA update, effective September 10, 2024: added the mandatory breast density assessment and standardized patient notification language; updated personnel qualification requirements (interpreting physician mammography continuing education increased from 15 to 15 credits but with new content requirements); updated medical audit requirements; added requirements for electronic image archiving and transfer; codified digital and digital breast tomosynthesis (3D mammography) standards that had previously been covered only by FDA guidance
• 75 FR 20916 (April 20, 2010) — Administrative update addressing accreditation body standards and inspection frequencies
• 62 FR 60614 / 62 FR 55976 (1997) — Original final rule implementing MQSA quality standards, replacing interim standards that had been in effect since 1994; established the § 900.12 personnel, equipment, and quality assurance framework that remained substantively unchanged until 2023

Pending Action

FDA is implementing the 2024 transition — the primary compliance activity is verifying that facilities have updated their mammography report templates and quality assurance programs to reflect the density notification requirement. FDA has provided guidance documents and model report language to support facility compliance. The ACR accreditation body is incorporating density documentation review into its accreditation audits. Long-term: FDA has indicated it may propose additional updates to address evolving mammography technology (including AI-assisted reading and newer 3D tomosynthesis systems), but no NPRM has been published.