DUA FAQs for Health Departments and Facilities

CDC and your state, local, or territorial health department have entered into a data use agreement (DUA). The health department will gain access to data reported to CDC’s National Healthcare Safety Network (NHSN) from healthcare facilities in the jurisdiction. The new provisions are designed to allow data access solely for the purposes of surveillance and prevention.  The overarching goal of the new access provisions is to enhance the value of data reported to NHSN for public health purposes. The questions and answers below provide more details about the NHSN data use agreement.

How are the data going to be used by the health department?

The data will be used for healthcare-associated infection (HAI) surveillance and prevention purposes and not legal and regulatory action.

Who in the health department will have access to the data?

Access to the data is intended for the HAI program for prevention activities. To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html.

What data will be included in the data use agreement?

Each data use agreement is modeled using a template developed by CDC and customized by CDC and the health department to reflect local data needs, protections, and policies. If your state or municipality has a data use agreement, CDC will make the agreement publicly available on CDC’s website. It is important to note that past data (i.e., data that was entered into NHSN prior to the opt-out period) will not be shared; only future data will be shared with the health department. NHSN data required by state, local, or territorial law to be shared with the health department will continue to be shared as usual (by facilities joining a Group in NHSN and accepting a template for data sharing).

Will facility-identifiable data be made publicly available?

No. Making facility-identifiable data publicly available would be a violation of the data use agreement and CDC will terminate the data use agreement immediately.

What guarantee does a hospital have that a data use agreement will not be breached?

State, local, and territorial health departments are taking an increasingly critical role in the prevention of HAIs. In many geographical areas, health departments have developed expertise in HAI prevention and are launching prevention programs in which facilities can participate. By sharing data, prevention needs can be identified, and tailored strategies can be planned and evaluated. Health departments would be motivated to abide by the data use agreement to gain access to HAI data in CDC’s NHSN. A breach in this contract will end the contract, ending the data flow to the health department.

Will healthcare facilities have to do anything additional within NHSN to participate in this program?

No additional steps will be necessary to share your data such as joining a health department Group in NHSN. CDC will administer a special Group for your health department, and your facility will automatically be joined to the Group.  Your NHSN Facility Administrator can view the data sharing template for this Group at any time from within the NHSN application.

If the same data is on Centers for Medicare and Medicaid Services’ (CMS’) Hospital Compare, why does my health department want it through a data use agreement with CDC?

The data use agreement allows CDC to share data with the health department sooner and with more detail than using CMS’ Hospital Compare.

How does a health department entering into a data use agreement benefit my facility?

Many health departments have an effective and collaborative relationship with facilities in their jurisdiction, including the prioritizing of prevention programs and opportunities for undertaking complementary HAI prevention projects. The data use agreement may foster additional collaborations between facilities and health departments in this manner.

Can a facility opt-out of voluntary reporting to NHSN to avoid access of data by the health department?

Some healthcare facilities report some data voluntarily to NHSN, even in jurisdictions with HAI reporting mandates. This voluntarily reported data may become available through DUAs to health departments. Before the health department begins accessing NHSN data under a new DUA (on the 1st day of the 4th month after the DUA becomes effective), CDC will provide healthcare facilities in the jurisdiction the opportunity to completely or partially opt-out of voluntary reporting to NHSN via monthly reporting plans.  Facilities will be able to avoid access of data by health department if they modify their voluntary NHSN reporting, by removing select events from their monthly reporting plans, before new data access provisions go into effect. Facilities may also choose to modify voluntary NHSN reporting after DUA data access for the health department has begun. However, data that has already been accessed by a health department may not be retrievable.

CDC and health departments encourage voluntary NHSN reporting to continue wherever possible, while simultaneously enabling health department access to those data for surveillance and prevention programs.  Thus, we make every effort to ensure that healthcare facility data are secure and are not publicly disclosed in a manner than identifies facilities.

Are health departments required to have a data use agreement?

No. Participation is at the discretion of each health department.

If our facility chooses to opt-out of the data use agreement, can we still use NHSN for tracking and prevention of HAIs within our facility?

Yes, a facility can continue to use NHSN for tracking and prevention of HAIs within a facility while partially or completely opting out of sharing data through the DUA. To opt out, the facility removes relevant HAI events from its monthly reporting plans i.e. modifies the voluntary reporting.

Who at the health department can a hospital contact for additional information?

To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html.

If our facility opts out of the DUA, can we continue to comply with CMS and state or local HAI reporting requirements?

As long as data that are required for health department mandates and/or for CMS quality reporting programs are included in the monthly reporting plan and reported by the specified deadlines, the facility will be in compliance with CMS requirements and with HAI reporting mandates. Removal of data from the monthly reporting plan that is not required by CMS or by health department mandates (i.e., data that is reported voluntarily into the monthly reporting plan) will not jeopardize a facility’s compliance with CMS or health department mandates. If a facility removes certain HAI events from their monthly reporting plans, that data will not be available to the CMS quality reporting programs or to health departments that use NHSN to access mandatorily reported data.   For facility data protection purposes, only data collected through surveillance that is included in a facility’s monthly reporting plans will be shared with CMS and health departments with HAI reporting mandates.

I understand that NHSN may share data with health departments for mandatory reporting and with CMS, but why would NHSN share our data with health departments that do not have reporting mandates?

While your health department (state, local, or territorial) may not have a reporting mandate, it is important for facility-based infection preventionists and public health epidemiology staff to work closely together to maximize prevention efforts at all geographic levels and to take advantage of mutually beneficial support and advocacy for resources, as well as technical implementation.  Broadening NHSN’s capacity and services in this way enables analysis at all geographic levels and enhances the system’s value for HAI prevention and response.  Health departments are long-standing partners in public health surveillance and prevention, and they commit—together with CDC—to making every effort to ensure that NHSN data are not publicly disclosed in a manner that identifies facilities.  Therefore, the NHSN Agreement to Participate and Consent—the user agreement and data consent form which details the purposes of NHSN and data access and protection provisions—enables CDC to provide health departments with NHSN data for surveillance and prevention, a purpose that is achieved via a data use agreement.  Additional stated purposes include providing information to health departments in fulfillment of reporting requirements and to CMS so that facilities can comply with the evolving requirements of CMS’ Quality Reporting, Value-Based Purchasing, and Hospital-Acquired Condition Reduction Programs.

Additional Background Information

CDC’s National Healthcare Safety Network (NHSN) is the nation’s most widely used healthcare-associated infection tracking system. NHSN provides facilities, states, regions, and the nation with data needed to identify problem areas, measure progress of prevention efforts, and ultimately eliminate healthcare-associated infections. Since 2006, CDC has provided health departments in states with mandatory HAI reporting requirements with access to mandatorily reported data in their jurisdiction. As of 2017, thirty-four states, Philadelphia, P.A., and Washington D.C. use NHSN for that purpose. Since October 2011, CDC has provided state health departments with additional access to data reported by healthcare facilities in their jurisdiction to NHSN via data use agreements.

Reportable Healthcare Associated Infections (HAIs)/Event Data
that may be included in NHSN Data Use Agreements (DUAs)

Components that may be included: Patient Safety, Healthcare Personnel Safety, Dialysis
Components that may not be included:  Biovigilance, Long-term Care
Reportable Healthcare Associated Infections (HAIs)/Event Data that may be included in NHSN Data Use Agreements (DUAs)
Facility Type Acute Care Facility Long-term Acute Care (LTACH) Hospital Inpatient Rehab (IRF) Facility Inpatient Psychiatric (IPF) Facility Ambulatory Surgery Centers (ASC) Facility Outpatient Dialysis Facility
VAE X X X n/a
PNEU (Vent) X X X n/a
PNEU (Post Procedure) X X X
Antimicrobial Use (AU) X X X X
Antimicrobial Resistance (AR) X X X X
Healthcare Personnel Flu Vaccination (HCP) X X X X X X
Dialysis Event X
Dialysis Seasonal & Non-seasonal Influenza Vaccine Events N/A N/A N/A N/A N/A N/A
Dialysis Prevention Process Measures N/A N/A N/A N/A N/A N/A
Healthcare Personnel/Blood & Body Fluids Exposure Module N/A N/A N/A N/A N/A N/A

X: Indicates HAI/Event is reportable by facility type

Acute care facilities also include:

Critical Access, Children’s, General Hospitals, Oncology, Orthopedic, Pediatric LTACs, Surgical, Women’s, Women/Children’s Hospitals

The following facility types are currently not available for inclusion in DUAs:

All Long Term Care (LTC)/ skilled nursing facilities

Rationale: At present, enrollment and use of the NHSN Long-term Care Component is at an early stage, and one of NHSN’s strategic goals is encouraging greater participation by LTC facilities throughout the U.S.  Until more extensive LTC facility participation in NHSN is assured, with a concomitant increase in understanding of what that participation entails and enables, our strategic goals are better served by omitting rather than including access to LTC Component Data via DUAs with health departments.  

Military and Veterans Affairs (VA) facilities

Indian Health Service (IHS) facilities

Home dialysis centers

The following HAI Events are not available for inclusion in DUAs:

Healthcare Personnel/Blood & Body Fluids Exposure Module; Laboratory & Prophylaxis/Treatment (Hep B-C, HIV/AIDS)

Rationale: NHSN no longer supports the use of the Blood and Body Fluid Exposure Module in the Healthcare Personnel Safety Component.  While several hospitals are still using that module for their own use, we are not including their data in DUAs.

Dialysis Seasonal & Non-seasonal Influenza Vaccine Events

Rationale: At this point, there are no states that mandate reporting of this information among patients.

Dialysis Prevention Process Measures (PPMs) (Hand Hygiene, Injection Safety, Catheter Connection/Disconnection, Catheter Exit Site Care, etc.)

Rationale: PPMs was designed for facilities’ internal quality improvement efforts.  These data are not shared with CMS or other entities by CDC.

Acute Kidney Injury (AKI)