An official website of the United States government
FAQs About NHSN Agreement to Participate and Consent
A: The NHSN Agreement to Participate and Consent is a user agreement and data consent form that healthcare facilities are required to sign in order to use NHSN. The document details the purposes of NHSN and data access and protection provisions. Facilities that request NHSN access must have a facility administrator review and accept the electronic form after informing a healthcare or residential facility executive of the terms of the agreement. Included in the NHSN Agreement to Participate and Consent is the Assurance of Confidentiality, which is a formal confidentiality protection authorized under Section 308(d) of the Public Health Service Act. This assurance covers those data that are voluntarily provided by healthcare facilities through NHSN that would permit identification of any individual or institution and guarantees the data will not otherwise be disclosed or released without the consent of the individual or the institution.
A: NHSN collects valuable and sensitive information, some of which can be shared with territorial, local, state, tribal, and federal health authorities. Therefore, it is important for every healthcare facility to know exactly which entities have access to their data and for what purposes and which entities cannot. Individual facilities can also share their data with other organizations as they deem fit using the NHSN Group function. All newly enrolling facilities must accept the Agreement to Participate and Consent upon enrollment. Newly enrolling NHSN users have 60 days from enrollment to accept the Agreement to Participate and Consent. If changes are made to the existing Agreement to Participate and Consent, all facilities who are enrolled in NHSN will be required to accept an updated version of the Agreement in the NHSN application.
A: The agreement provides information about data confidentiality and data access. The data access provisions allow healthcare facility users to work closely with their respective health departments and to comply with Centers for Medicare & Medicaid Services (CMS) reporting requirements.
With respect to health department collaboration, the provisions enable CDC to provide state, local, territorial, and tribal health departments with access to NHSN data via a data use agreement for surveillance and prevention purposes only (not for regulatory purposes). This enables CDC to bring healthcare-associated infection (HAI) prevention efforts into the traditional public health model, working closely with state, local, territorial, and tribal health departments and healthcare facilities in their particular jurisdictions to reduce HAIs.
State, local, territorial, and tribal health departments requesting data access beyond a state, local, territorial, or tribal mandate will be required to enter into a signed data use agreement with CDC. When a request is accepted by CDC, the facilities involved will be notified and given the option to opt out of NHSN either partially or completely. Therefore, it will be important to know exactly what your facility reporting requirements are for territorial, local, state, tribal, and federal levels.
For facilities that participate in CMS’ Prospective Payment Systems, CDC will share HAI data with CMS that are in scope for CMS programs. View the CMS quality reporting requirements for NHSN. As with all CMS healthcare quality measures, these statistics will be publicly reported on the CMS Medicare Care Compare website.
In addition, the Agreement grants CDC permission to share facility-level data and annual facility survey data with CMS as deemed required in CMS rule-making and that are used by CMS for its program administration, monitoring and evaluation activities, including validation, appeals review, program impact evaluation, and development of quality measure specifications. The agreement also permits CDC to provide healthcare facility-level data, including annual facility survey data, to CMS for use by CMS programs in the design, operations, and evaluation of quality improvement programs in which healthcare facilities participate voluntarily.
–The NHSN purposes are also updated to provide facility-level information to state, local, territorial, or tribal health departments to facilitate HAI prevention efforts, and to provide patient- and facility-level data to health departments during an outbreak investigation to assist case-finding or outbreak control.
The Agreement also grants CDC permission to share facility-level data with the HHS Administration for Strategic Preparedness and Response (ASPR) in support of public health preparedness and emergency management, and to aid emergency response efforts.
Other than the purposes associated with the Agreement to Participate and Consent, CDC cannot release facility-level data to any person or organization. View the full text of the NHSN purposes as stated in the Agreement to Participate and Consent.
A: Some Component data are not included in the purpose regarding data access for state, local, territorial, and tribal agencies. Please contact NHSN@cdc.gov to receive the list of data that are permitted and are not permitted as part of state, local, territorial, and tribal health department data use agreements.
A: Other than to state, local, territorial, and tribal health departments; CMS; and ASPR; CDC cannot grant data access to any organization. If other organizations request data access, CDC will direct them to contact individual facilities, which can grant data access privileges as they see fit through the NHSN Group Function.
A: CDC will not share the name of any individual infection preventionist or patient with any organization.
A: On the NHSN Facility Information page, the Components Followed table will include link to a consent form that can be downloaded for a facility that has accepted the form. The downloadable consent form will display the name of the facility administrator and the date the form was electronically accepted.
A: Yes. A facility administrator will be able to accept the updated Agreement for all facilities they are facility administrator for. Please see the Guidance for Accepting the Updated NHSN Agreement to Participate and Consent on Behalf of Multiple Facilities [PDF – 589 KB] for instructions.
When changes are made to the existing Agreement to Participate and Consent, all facilities who are enrolled in NHSN must re-consent to continue participating in NHSN, in acknowledgement of these changes. All users will be required to accept an updated version of the Agreement in the NHSN application.
The COVID-19 pandemic underscored the critical role of NHSN in emergency response and coordination at the federal, state, local, and territorial levels. The pandemic also emphasized the need for a national surveillance system capable of enabling nimble and rapid responses to public health threats. An update to the NHSN Agreement to Participate is warranted to account for NHSN’s role in emergency response, data sharing with government agencies, and a renewed focus on healthcare preparedness. The Agreement has been updated to include language in the Data Collection and Reporting Requirements section that accounts for new data exchange tools and systems. The introductory section and Stated Purposes have also been updated to more distinctly include tribal health organizations along with state, local, and territorial health organizations when discussing NHSN’s role in working with regional health agencies. Tribal health departments play an important role, along with state, local, and territorial health departments, in monitoring and preventing HAIs. Regardless of reporting mandate coverage, the Agreement grants data access to these health departments for prevention and surveillance purposes.
NHSN’s list of Stated Purposes (use cases), which was historically written into the Agreement to Participate as well as being listed on the NHSN website, will now live solely on the NHSN website. Language has been added to both the Agreement and the Stated Purposes to provide further protection for submitted data by reinforcing the scope of acceptable use cases for data submitted to NHSN, which continues to be limited to public health surveillance and healthcare preparedness.
Previously, facilities were required to accept the Agreement separately for each component in which the facility participated. Now, the updated Agreement will only need to be accepted once per facility, by the Facility Administrator, and will apply across all enrolled components.
A facility administrator with SAMS access will be prompted to review and electronically accept the updated Agreement upon logging into NHSN after the Agreement is updated in the application. For guidance on how to accept the updated Agreement, please refer to 2026 Guidance for Accepting the Updated NHSN Agreement to Participate and Consent [PDF – 511 KB]. Facility administrators for newly enrolling facilities will be prompted to accept the updated Agreement in order to complete enrollment. In the past, a Facility Administrator or Primary Contact (component lead) could accept the Agreement at the component level; now, the Agreement can only be accepted by the Facility Administrator.
All facilities enrolled in NHSN are required to designate a facility administrator. If you need to reassign the facility administrator role, please follow the directions on the NHSN website: Change NHSN Facility Administrator | NHSN | CDC. If you do not know who your facility administrator is, please contact the NHSN Help Desk via NHSN-ServiceNow (for those with SAMS access) or at nhsn@cdc.gov.
The updated Agreement must be accepted in the NHSN application by June 1, 2027.
After June 1, 2027, the facility will remain active in NHSN but will not be able to report new data until the updated Agreement is accepted. This includes facilities that must report to NHSN in order meet requirements for quality programs run by CMS. Facilities will not lose access to NHSN or to historical data and analytic reports.
NHSN data are protected by an Assurance of Confidentiality, in accordance with Section 308(d) of the Public Health Service Act. Under the Assurance of Confidentiality, CDC protects identifying information in data that are voluntarily reported NHSN and must clearly indicate the ways in which submitted data may be used. The NHSN Stated Purposes describe the specific ways that data submitted to NHSN can be used and shared, within the realm of public health surveillance and healthcare preparedness.
In 2026, the list of Stated Purpose has been updated to include data sharing with the Administration for Strategic Preparedness and Response (ASPR) for healthcare preparedness and emergency response purposes. This does not constitute a new reporting requirement.
In addition, NHSN will begin allowing facilities to report claims data in the application in 2026. Healthcare claims play a crucial role in calculating NHSN’s FHIR-based digital quality measures by providing data elements necessary to support event determination, event exclusions, and patient‑level risk adjustment. The Stated Purposes already account for collection of claims data as it is in service to the work of determining adverse patient safety events; however, to eliminate any confusion, explicit claims data terminology has been added to the first Stated Purpose, “Collect data from healthcare facilities in the United States, including patient-level claims data, to permit valid estimation of adverse events among patients or residents and healthcare personnel.”
NHSN intends to review the Stated Purposes for necessary changes on an annual basis, though CDC reserves the right to update the Stated Purposes outside of this cadence, such in the event of a public health or other emergency event or as may otherwise be required. For reference, the Stated Purposes were last updated in December of 2017. Updates are made with caution and intention. CDC does not anticipate a need for frequent changes to the Stated Purposes.
All facilities will be notified via email in advance of any future change to the Stated Purposes.
All facilities will be notified via email in advance of any future change to the Stated Purposes. The Stated Purposes are also publicly available at NHSN’s Stated Purposes | NHSN | CDC.
No, a facility cannot opt out of any of the Stated Purposes. The Stated Purposes are tied to NHSN’s Assurance of Confidentiality and are approved by the CDC Office of Science. They are core to NHSN’s functionality and ability to pursue widespread public health surveillance of adverse patient safety events and to support healthcare preparedness. A facility may effectively opt out by choosing not to report certain types of data to NHSN; however, this may have adverse effects on a facility for data that are required under certain state, local, or federal reporting mandates, or in order to participate in certain CMS quality programs.
The COVID-19 pandemic underscored the critical role of NHSN in emergency response and coordination at the federal, state, local, and territorial levels. The pandemic also emphasized the need for a national surveillance system capable of enabling nimble and rapid responses to public health threats. An update to the NHSN Agreement to Participate is warranted to account for NHSN’s role in emergency response, data sharing with government agencies, and a renewed focus on healthcare preparedness.
NHSN decided to remove the Stated Purposes from the body of the Agreement to Participate to improve responsiveness to urgent public health events and other emergencies. The Stated Purposes can be updated without precipitating the need for a new agreement; however, the Stated Purposes will never be updated in conflict with the core purposes of public health surveillance and healthcare preparedness. NHSN users will always be notified of any changes to the Stated Purposes.
Submitted data are not less protected because the Stated Purposes are removed from the body of the Agreement. The Stated Purposes remain tied to the Agreement to Participate and Consent. Any update to the Stated Purposes must be approved by CDC’s Office of Science as part of NHSN’s Assurance of Confidentiality.
No, the updates to the Stated Purposes do not constitute a new reporting requirement. There is no change to the current expectations around which data your facility submits.
If you have questions about the updated NHSN Agreement to Participate and Consent, you can submit a ticket to the NHSN Help Desk via NHSN-ServiceNow (for those with SAMS access) with the subject line “NHSN Agreement to Participate,” or you can email the Help Desk at nhsn@cdc.gov.
