If you're a home health agency owner, you’ve probably heard about HARP and iQIES. But what exactly are they, why are they important, and how do you access your portal?
At The Home Health Consultant, we've spent years helping agencies navigate Medicare requirements, so we know the ins and outs of these systems.
This article will break down exactly what you need to know about HARP and iQIES, including how to create your account and get logged in.
What is HARP?
HARP stands for HCQIS Access Roles and Profile, a secure identity management portal provided by CMS (Centers for Medicare & Medicaid Services). Think of HARP as your master key to accessing CMS systems. With one HARP user ID and password, you can securely log into various Medicare applications, including iQIES.
What is iQIES?
iQIES, or the Internet Quality Improvement and Evaluation System, is a cloud-based platform developed by CMS. Home health agencies use iQIES to submit required patient assessments and access important reports. Unlike previous systems, iQIES is internet-based, meaning you can access it from anywhere.
Why Do HARP and iQIES Matter to Your Agency?
Compliance and Payments: Medicare requires agencies to submit patient assessment data through iQIES. Without access to your iQIES account, your agency could face delayed or denied payments.
Day-to-Day Use: While knowing how CMS uses iQIES is good to know, it’s even more important to understand how iQIES is used in agency operation:
- Submit OASIS assessments for home health patients
- Access OBQI (Outcome-Based Quality Improvement) reports to evaluate performance and patient outcomes
- Pull Provider Preview Reports and monitor how your data will appear on public CMS websites like Care Compare
Simplified Access with HARP: HARP (HCQIS Access Roles and Profile) provides a single secure login that connects you to iQIES and other CMS systems. It streamlines user management and reduces the need to juggle multiple credentials.
Improved Security: With multi-factor authentication, HARP helps ensure only authorized staff can access sensitive patient data—protecting both your agency and your patients.
How To Register and Access iQIES for Home Health Agencies
Here's a straightforward guide to setting up your HARP and iQIES access, as of May 2025:
Step 1: Designate a Provider Security Official (PSO)
First, choose a trustworthy individual in your agency (usually an owner, administrator or compliance officer) to serve as the Provider Security Official. This person manages user access to your agency’s iQIES account.
CMS strongly recommends assigning two PSOs per provider to ensure backup coverage (kind of like a PSO ‘designee’). PSOs are responsible for handling access requests and safeguarding sensitive data.
Step 2: Create Your HARP Account
The PSO will register for a HARP account at harp.cms.gov/register.
- Complete the identity verification process using Experian, answering personal questions to confirm identity.
Pro Tip: Please be aware that this process asks multiple personal questions from Experian data, like what street you lived on 20 years ago, or your childhood phone number.
Questions are timed, allowing just enough to read and answer. No more. Failure to respond on time can result in going through an extensive identity verification process. Be prepared to be quizzed quickly on your personal history.
- Set up multi-factor authentication (MFA) using your phone or an authenticator app.
- Create your unique HARP user ID and password.
- Select a security ‘Challenge Question’ and provide the answer. This could be, “What’s your favorite sports player?” or “What’s the name of your childhood pet?”
- You will then be directed to another page which prompts you to answer personal questions about yourself. Be sure to answer accurately & timely. If you answer incorrectly or get logged out, you have to restart the process.
- Press Login to Complete Setup
- Then use the HARP user ID & password you just created to log in
- You will then be prompted to set up two-factor authentication using a phone number
Remember: You should not share your username or login information with anyone. If you need someone else to be able to access your iQIES account, you can add them as an additional user. We explain how to add additional users below.
Step 3: Log in to iQIES and Request PSO Role
Once your HARP account is active, and you’ve set up two-factor authentication:
- Visit iqies.cms.gov and log in with your HARP username and password.
- Select ‘Request User Role,’ then for your user category, select ‘Provider’
- Request the "Security Official" role
- Identify your organization by name or CMS Certification Number (CCN).
- CMS will review and approve your request, typically within a few days.
Step 4: Add Additional Users (If Needed)
Other team members needing access will also register for their own HARP accounts, then request roles like "Provider User" or "Assessment Submitter." The PSO approves these requests through iQIES.
The screenshot below, taken from inside of the portal, explains the different kinds of roles you can create for users who can access your iQIES accounts.
Step 5: Managing and Maintaining Your Accounts
Regularly update passwords and promptly revoke access for departing employees. Bookmark both HARP and iQIES portals for easy access.
How to Use HARP & iQIES & Keep Your Home Health Agency Compliant
HARP and iQIES might initially seem daunting, but they're designed to simplify compliance and enhance security. By following this guide, you'll quickly establish secure access, ensuring smooth Medicare interactions and uninterrupted payments.
If you have any questions or need assistance during the setup, The Home Health Consultant is always here to help you through the process.
If you’re looking for more helpful info about CMS submissions, check out our article on OASIS, and how it can impact your reimbursement rates, below.
*This article was written in consultation with Mariam Treystman.
*Disclaimer: The content provided in this article is not intended to be, nor should it be construed as, legal, financial, or professional advice. No consultant-client relationship is established by engaging with this content. You should seek the advice of a qualified attorney, financial advisor, or other professional regarding any legal or business matters. The consultant assumes no liability for any actions taken based on the information provided.
Topics:
