DUA FAQs for Health Departments and Facilities
CDC and your state, local, or territorial health department have entered into a data use agreement (DUA). The health department will gain access to data reported to CDC’s National Healthcare Safety Network (NHSN) from healthcare facilities in the jurisdiction. The new provisions are designed to allow data access solely for the purposes of surveillance and prevention. The overarching goal of the new access provisions is to enhance the value of data reported to NHSN for public health purposes. The questions and answers below provide more details about the NHSN data use agreement.
How are the data going to be used by the health department?
The data will be used for healthcare-associated infection (HAI) surveillance and prevention purposes and not legal and regulatory action.
Who in the health department will have access to the data?
Access to the data is intended for the HAI program for prevention activities. To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html.
What data will be included in the data use agreement?
Each data use agreement is modeled using a template developed by CDC and customized by CDC and the health department to reflect local data needs, protections, and policies. If your state or municipality has a data use agreement, CDC will make the agreement publicly available on CDC’s website. It is important to note that past data (i.e., data that was entered into NHSN prior to the opt-out period) will not be shared; only future data will be shared with the health department. NHSN data required by state, local, or territorial law to be shared with the health department will continue to be shared as usual (by facilities joining a Group in NHSN and accepting a template for data sharing).
Will facility-identifiable data be made publicly available?
No. Making facility-identifiable data publicly available would be a violation of the data use agreement and CDC will terminate the data use agreement immediately.
What guarantee does a hospital have that a data use agreement will not be breached?
State, local, and territorial health departments are taking an increasingly critical role in the prevention of HAIs. In many geographical areas, health departments have developed expertise in HAI prevention and are launching prevention programs in which facilities can participate. By sharing data, prevention needs can be identified, and tailored strategies can be planned and evaluated. Health departments would be motivated to abide by the data use agreement to gain access to HAI data in CDC’s NHSN. A breach in this contract will end the contract, ending the data flow to the health department.
Will healthcare facilities have to do anything additional within NHSN to participate in this program?
No additional steps will be necessary to share your data such as joining a health department Group in NHSN. CDC will administer a special Group for your health department, and your facility will automatically be joined to the Group. Your NHSN Facility Administrator can view the data sharing template for this Group at any time from within the NHSN application.
If the same data is on Centers for Medicare and Medicaid Services’ (CMS’) Hospital Compare, why does my health department want it through a data use agreement with CDC?
The data use agreement allows CDC to share data with the health department sooner and with more detail than using CMS’ Hospital Compare.
How does a health department entering into a data use agreement benefit my facility?
Many health departments have an effective and collaborative relationship with facilities in their jurisdiction, including the prioritizing of prevention programs and opportunities for undertaking complementary HAI prevention projects. The data use agreement may foster additional collaborations between facilities and health departments in this manner.
Can a facility opt-out of voluntary reporting to NHSN to avoid access of data by the health department?
After a state, local, or territorial health department has worked with CDC to complete a data use agreement and before the health department begins accessing new NHSN data, CDC will provide healthcare facilities in the jurisdiction the opportunity to opt-out of voluntary reporting to NHSN. Some healthcare facilities voluntarily report to NHSN, even in jurisdictions with HAI reporting mandates. Those facilities will be able to stop their voluntary NHSN reporting, before new data access provisions go into effect. CDC and health departments want voluntary NHSN reporting to continue wherever possible, while simultaneously enabling health department access to those data for surveillance and prevention programs.
Are health departments required to have a data use agreement?
No. Participation is at the discretion of each health department.
If our facility chooses to opt-out of the data use agreement, can we still use NHSN for tracking and prevention of HAIs within our facility?
It is possible to opt-out of the data use agreement while still using NHSN for tracking and prevention of HAIs within a facility. There are two possible ways for a healthcare facility to opt-out of the data use agreement. A facility could stop entering data into NHSN or remove select events from their monthly reporting plans. It is important to note that only data collected through surveillance that is included in a facility’s monthly reporting plans will be shared with CMS. Furthermore, most states that have HAI reporting mandates require HAI surveillance to be in the monthly reporting plans.
Who at the health department can a hospital contact for additional information?
To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html
Additional Background Information:
CDC’s National Healthcare Safety Network (NHSN) is the nation’s most widely used healthcare-associated infection tracking system. NHSN provides facilities, states, regions, and the nation with data needed to identify problem areas, measure progress of prevention efforts, and ultimately eliminate healthcare-associated infections. Since 2006, CDC has provided health departments in states with mandatory HAI reporting requirements with access to mandatorily reported data in their jurisdiction. As of 2017, thirty-four states, Philadelphia, P.A., and Washington D.C. use NHSN for that purpose. Since October 2011, CDC has provided state health departments with additional access to data reported by healthcare facilities in their jurisdiction to NHSN via data use agreements.
|Reportable Healthcare Associated Infections (HAIs)/Event Data that may be included in NHSN Data Use Agreements (DUAs)|
|Components that may be included: Patient Safety, Healthcare Personnel Safety, Dialysis
Components that may not be included: Biovigilance, Long-term Care
|Facility Type||Acute Care Facility||Long-term Acute Care (LTACH) Hospital||Inpatient Rehab (IRF) Facility||Inpatient Psychiatric (IPF) Facility||Ambulatory Surgery Centers (ASC) Facility||Outpatient Dialysis Facility|
|CLIP||X||X||X||X||–||N/A for DUAs|
|PNEU (Post Procedure)||X||X||X||–||–||–|
|Antimicrobial Use (AU)||X||X||X||X||–||–|
|Antimicrobial Resistance (AR)||X||X||X||X||–||–|
|Healthcare Personnel Flu Vaccination (HCP)||X||X||X||X||X||X|
|Dialysis Seasonal & Non-seasonal Influenza Vaccine Events||
N/A for Data Use Agreements
|Dialysis Prevention Process Measures|
|Healthcare Personnel/Blood & Body Fluids Exposure Module|
|X: Indicates HAI/Event is reportable by facility type|
Acute care facilities also include:
Critical Access, Children’s, General Hospitals, Oncology, Orthopedic, Pediatric LTACs, Surgical, Women’s, Women/Children’s Hospitals
The following facility types are currently not available for inclusion in DUAs:
All Long Term Care (LTC)/ skilled nursing facilities
Rationale: At present, enrollment and use of the NHSN Long-term Care Component is at an early stage, and one of NHSN’s strategic goals is encouraging greater participation by LTC facilities throughout the U.S. Until more extensive LTC facility participation in NHSN is assured, with a concomitant increase in understanding of what that participation entails and enables, our strategic goals are better served by omitting rather than including access to LTC Component Data via DUAs with health departments.
Military and Veterans Affairs (VA) facilities
Indian Health Service (IHS) facilities
Home dialysis centers
The following HAI Events are not available for inclusion in DUAs:
Healthcare Personnel/Blood & Body Fluids Exposure Module; Laboratory & Prophylaxis/Treatment (Hep B-C, HIV/AIDS)
Rationale: NHSN no longer supports the use of the Blood and Body Fluid Exposure Module in the Healthcare Personnel Safety Component. While several hospitals are still using that module for their own use, we are not including their data in DUAs.
Dialysis Seasonal & Non-seasonal Influenza Vaccine Events
Rationale: At this point, there are no states that mandate reporting of this information among patients.
Dialysis Prevention Process Measures (PPMs) (Hand Hygiene, Injection Safety, Catheter Connection/Disconnection, Catheter Exit Site Care, etc.)
Rationale: PPMs was designed for facilities’ internal quality improvement efforts. These data are not shared with CMS or other entities by CDC.
Acute Kidney Injury (AKI)