7.1 Accreditation Bodies, FDA/MQSA Personnel, Records, Audits, and Policies

7.1 Accreditation Bodies, FDA/MQSA Personnel, Records, Audits, and Policies

Quick Answer: A mammography facility may legally image only after an FDA-approved accreditation body (AB) accredits it and FDA or a State-as-Certifier issues an MQSA certificate. The AB reviews equipment, personnel, clinical images, and practices. FDA (or the State-as-Certifier) certifies and inspects. ARRT Mammography, R.T.(M), is a personnel credential; it does not replace MQSA facility certification or MQSA personnel qualifications in 21 CFR 900.12.

ARRT's Mammography content specifications (implemented September 1, 2025) test Image Production C as operational knowledge: who accredits, who certifies, which personnel files the inspector asks for, what must be on the image and in the report, and which policies the facility must actually run. This section uses current FDA MQSA pages and 21 CFR Part 900. Do not substitute a study-guide rumor for a number FDA has not published.

Accreditation is not certification

Congress enacted the Mammography Quality Standards Act in 1992 so that mammography used to detect breast cancer would meet national quality standards. Under MQSA, two different approvals must both be in place before a facility performs mammography (21 CFR 900.11(a)):

FDA's facility accreditation page (current as of March 20, 2025) lists these FDA-approved accreditation bodies: the American College of Radiology (ACR) in Reston, Virginia, and the State of Arkansas (Arkansas Department of Health). ACR is the national AB most candidates will see. A facility located in a State that FDA has approved as an AB may choose that State AB or ACR. All FDA-approved ABs are held to the same federal quality standards; a State may still impose additional State-only rules that are not MQSA.

Certification is issued by FDA or, where the State is a SAC, by that SAC. FDA currently lists Illinois, Iowa, South Carolina, and Texas as State certifying agencies, with FDA certifying facilities elsewhere. Do not mix the two lists on the exam: Arkansas appears as an accreditation body; Illinois, Iowa, South Carolina, and Texas appear as certifying agencies. Iowa can be a SAC without being the facility's AB.

flowchart TD
  apply[Facility applies to FDA-approved accreditation body]
  review[AB reviews equipment, personnel, clinical images, and practices]
  accredit[AB accredits for up to 3 years]
  cert[FDA or State-as-Certifier issues MQSA certificate]
  operate[Facility may legally perform mammography]
  inspect[Annual MQSA inspection]
  physics[Annual medical physicist survey]
  images[Periodic AB clinical image review]
  fail[Three consecutive accreditation failures: 1-year wait]
  apply --> review
  review --> accredit
  review --> fail
  accredit --> cert
  cert --> operate
  operate --> inspect
  operate --> physics
  operate --> images

Process and frequency

A new facility contacts an FDA-approved AB first. After the AB accepts the required application materials, FDA or the SAC may issue a provisional certificate so the facility can perform mammography and collect the clinical images the AB needs. A provisional certificate is valid for up to six months, is not renewable, and may receive a single 90-day extension (21 CFR 900.11(b)(2)–(3)). Full certification follows completed accreditation review. FDA's Small Entity Compliance Guide states that a full MQSA certificate is valid for three years, and accreditation is valid for up to three years (42 U.S.C. 263b(c)(1); 21 CFR 900.11(b)(1); 900.4(c)(1) and (d)(1)).

To keep accreditation, the facility undergoes periodic clinical image review by its AB (21 CFR 900.4(c)), an annual medical physicist survey (21 CFR 900.4(e) and 900.12(e)(10)), and an inspection at least annually by a certified MQSA inspector (42 U.S.C. 263b(g)(1)(E)). If the certificate expires before accreditation is completed, the facility must stop performing mammography. After three consecutive accreditation failures, no AB may accept a new application for one year from the most recent failure (21 CFR 900.4(a)(6)(ii)).

Exam trap: ACR image review is accreditation work. The inspector who arrives with five business days' notice is performing the annual MQSA inspection, not issuing the certificate.

Personnel: three MQSA roles, high level

21 CFR 900.12(a) names three personnel categories. The facility must keep qualification records and produce them at inspection. Records of personnel who have left must be kept at least 24 months after departure; current personnel may request copies, and former employees may request copies if they ask within those 24 months (21 CFR 900.12(a)(4)).

FDA states that 8 hours of training in any manufacturer's digital breast tomosynthesis (DBT) system satisfies the DBT new-modality requirement. If an RT falls below 200 examinations in 24 months, requalification is 25 mammograms under direct supervision before unsupervised work resumes. If CE falls short, the RT must bring the total to 15 in the previous 36 months before unsupervised work resumes.

ARRT (M) versus MQSA. ARRT Mammography certification and registration is a postprimary personnel credential. MQSA is a federal facility program. Holding R.T.(M) does not, by itself, prove the 40 hours, 25 supervised exams, 200/24-month experience, or 15/36-month CE that 21 CFR 900.12(a)(2) requires at the facility. Conversely, a technologist can meet MQSA RT qualifications without holding ARRT (M) if State license and MQSA training/experience are met. FDA's recognition of ARRT for the general radiography certification prong is not the same as MQSA treating ARRT (M) as a substitute for mammography-specific MQSA training. Keep the credential and the facility rule on separate exam shelves.

Recordkeeping: assessment, image ID, retention, and communication

Assessment categories on the mammography report (21 CFR 900.12(c)(1), as amended, enforced September 10, 2024) must use FDA wording, not a private nickname. Final categories are: Negative; Benign; Probably Benign; Suspicious; Highly Suggestive of Malignancy; Known-Biopsy-Proven Malignancy; and Post-Procedure Mammogram for Marker Placement. If work-up is incomplete, the IP assigns Incomplete: Need additional imaging evaluation or Incomplete: Need prior mammograms for comparison, with reasons. If the prior-mammogram incomplete category is used, a follow-up report with a final overall assessment must go out within 30 calendar days of the initial report, whether or not comparison images arrive. Inspectors sample reports for patient name plus an additional identifier, facility name and location (city, State, ZIP, telephone), exam date, IP identification, acceptable assessment wording, and breast-density assessment.

Image identification (21 CFR 900.12(c)(5)) must be permanent, legible, unambiguous, and placed so it does not obscure anatomy:

• Patient name and an additional patient identifier
• Date of examination
• View and laterality near the axilla, using AB-standardized codes FDA has approved
• Facility name and location (city, State, and ZIP at a minimum)
• Technologist identification
• Cassette/screen identification (film-screen language still in the regulation)
• Mammography unit identification if the facility has more than one unit

Retention (21 CFR 900.12(c)(4)(i)): keep original mammograms and reports for the longest of not less than 5 years, not less than 10 years if no additional mammograms of that patient are performed at the facility, or any longer State or local mandate. Originals must remain retrievable in the mammographic modality in which they were produced; copying or digitizing hardcopy originals does not satisfy the original-image rule. Facilities must have policies to minimize loss. Transfers or copies go out within 15 calendar days of the request. If digital mammograms or DBT are transferred for final interpretation, the facility must provide original digital images electronically. Before closing, the facility arranges continued access, notifies its AB and certification agency in writing, and makes reasonable efforts to notify affected patients.

Communication of results. A lay summary in words the patient can understand goes to each patient within 30 calendar days of the examination (21 CFR 900.12(c)(2)). A more detailed report goes to the referring healthcare provider. If the final assessment is Suspicious or Highly Suggestive of Malignancy, both the provider report and the patient lay summary must go out within 7 calendar days of the final interpretation. Verbal results do not replace the written lay summary. Facilities that accept patients without a healthcare provider must maintain a referral system when clinically indicated, including when the assessment is Probably Benign, Suspicious, or Highly Suggestive of Malignancy (21 CFR 900.12(c)(2)(ii)).

Medical outcomes audit

Each facility must run a medical audit and outcome analysis (21 CFR 900.12(f)). As of the 2023 MQSA Final Rule, the annual audit includes positive predictive value, cancer detection rate, and recall rate for each interpreting physician and for the facility as a whole. FDA's inspection-prep page expects written analysis that includes all mammograms assessed Suspicious or Highly Suggestive of Malignancy, determination of whether biopsy tissue was benign or malignant, the three calculated metrics, facility-level analysis, and per-IP analysis. This audit measures interpretation outcomes. EQUIP, in the next section, measures whether images presented for interpretation meet image-quality standards. Do not treat the audit as a substitute for clinical image review.

Required policies: infection control and consumer complaints

Infection control (21 CFR 900.12(e)(13)) requires the facility to establish and follow procedures for cleaning and disinfecting mammography equipment after contact with blood or other potentially infectious materials, and to document compliance. Between-patient cleaning of breast-contact surfaces belongs in that system; the inspector can ask for the written procedure and the documentation method.

Consumer complaints (21 CFR 900.12(h)) require a written, documented system for collecting and resolving complaints. Keep each serious complaint at least 3 years. If the facility cannot resolve a serious complaint, it must give the consumer directions for filing with the facility's AB and must report unresolved serious complaints to the AB on the AB's timetable. FDA examples of serious complaints include use of unqualified personnel and failure to send mammography reports or patient lay summaries within 30 days.

On the exam, a question that names ACR, FDA, ARRT, and the medical physicist is usually asking you to match accredit / certify / credential / survey, not to pick the most familiar logo.