FAQs: AUR Reporting for the CMS Promoting Interoperability Program

Most acute care hospitals take part in the CMS Promoting Interoperability (PI) Program. You can reach out to the person(s) in charge of quality reporting for your hospital. Critical access hospitals (CAHs) are also eligible to participate in the CMS PI Program.

Other types of hospitals that provide inpatient care are not included in the CMS PI Program. This includes, but is not limited to, Inpatient Rehabilitation Facilities (IRFs), Inpatient Psychiatric Facilities (IPFs), and Long Term Care Hospitals (LTCHs/LTACs/LTACHs).

Eligible hospitals and CAHs participating in the CMS PI Program must begin reporting the AUR Surveillance measure for Electronic Health Record (EHR) reporting periods in calendar year (CY) 2024.

However, eligible hospitals and CAHs are encouraged to begin reporting AUR surveillance data to the CDC’s National Healthcare Safety Network (NHSN) sooner (if they are not already reporting). As in previous years, for the CY 2023 EHR reporting period, eligible hospitals and CAHs can receive 5 bonus points under the Public Health and Clinical Data Exchange Objective if they report data to a public health registry. CDC’s NHSN AUR Module has been an option for eligible hospitals and CAHs to satisfy the Promoting Interoperability Program’s Public Health Registry Reporting measure since 2017.

Yes. To receive credit beginning in CY 2024, the measure requires eligible hospitals and CAHs attest to reporting both AU and AR Option data to NHSN for the EHR reporting period, or else claim an applicable exclusion.

No. As outlined under question #3, the measure requires eligible hospitals and CAHs to report a ‘‘yes’’ response to being in active engagement with CDC’s NHSN to submit Antimicrobial Use and Resistance (AUR) data for the EHR reporting period. Hospitals may also claim an applicable exclusion. In other words, there is no option for eligible hospitals and CAHs to receive “partial credit” if they answer “yes” to only part of the measure (e.g., they meet the requirement—reporting or exclusion—for either AU or AR, but not both).

Eligible hospitals and CAHs that report a ‘‘no’’ response or fail to report any response in CY 2024 will not receive credit for reporting the measure. These hospitals would fail to satisfy the Public Health and Clinical Data Exchange Objective and will earn a score of zero for the CMS PI Program.

The CMS PI Program requires hospitals be in active engagement with CDC/NHSN to submit AUR data for CY 2024. CMS defines active engagement as the eligible hospital or CAH is in process of moving towards sending “production data” to a Public Health Agency, in this case CDC/NHSN, or is sending production data to CDC/NHSN. The Measure Specification materials are posted in the CMS Promoting Interoperability Resource Library.

Hospitals can meet the active engagement criteria in one of two ways:

Option 1 – Pre-production and Validation

Hospitals first have to register intent to submit AUR data within NHSN. Per the CMS measure specifications, the registration should be completed within 60 days after the start of the EHR reporting period. The registered acute care hospital or CAH will then receive an automated email from NHSN inviting it to begin the Testing and Validation step. Following the instructions in the email, hospitals must submit one test file for each file type (AU Summary, AR Event, and AR Summary) for validation by the NHSN AUR Team. Per the CMS measure specifications, hospitals should respond to the request for test files within 30 days following the request for test files. Failure to respond twice within an EHR reporting period will result in that eligible hospital not meeting the measure. If the hospital registers intent to submit AUR data within NHSN prior to having test files ready, the hospital should reply to the request for test files with their current status. The hospital should continue to email a status update at least every 60 days until the hospital has test files to send for validation to complete Option 1.

Note: Beginning in CY 2024, eligible hospitals and CAHs can only spend one calendar year in Option 1 – Pre-production and Validation.

Option 2 – Validated Data Production

Hospitals first have to register intent to submit AUR data within NHSN if they did not complete Option 1 – Pre-production and Validation. CMS defines production data as data generated through clinical processes involving patient care, and it is used to distinguish between data and “test data,” which is submitted for the purpose of testing and validation. For CY 2024, hospitals must submit 180 continuous days of AUR data. Keep in mind that you must report the same 180 days of AU and AR data as they are considered a single measure for the CMS PI Program. Additionally, those 180 days are supposed to be the same for all CMS PI Program measures for your hospital.

Note: Hospitals wishing to receive bonus points for the CY 2023 CMS PI Program under the Public Health Registry measure within the Public Health and Clinical Data Exchange Objective must submit 90 continuous days of AUR data. Both AU and AR data must be submitted for the same 90 days as all CMS PI Program measures for your hospital.

As outlined in the CMS Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year 2023 Rates; Quality Programs and Medicare Promoting Interoperability Program Requirements for Eligible Hospitals and Critical Access Hospitals; Costs Incurred for Qualified and Non-Qualified Deferred Compensation Plans; and Changes to Hospital and Critical Access Hospital Conditions of Participation (IPPS) FY 2023 final rule, any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the AUR Surveillance measure if the eligible hospital or CAH:

1. Does not have any patients in any patient care location for which data are collected by NHSN during the EHR reporting period; or
2. Does not have electronic medication administration records (eMAR)/bar coding medication administration (BCMA) records or an electronic admission discharge transfer (ADT) system during the EHR reporting period; or
3. Does not have an electronic laboratory information system (LIS) or electronic ADT system during the EHR reporting period.

The measure requires that eligible hospitals and CAHs are in active engagement with CDC to report both AU and AR data—or claim an applicable exclusion. There is no “partial credit” for being in active engagement to report AU or AR data, but not both.

If an eligible hospital or CAH can report AU or AR data, but not both, it must either claim an applicable exclusion for the data it can’t report or attest “No” to the measure.

In CY 2023, hospitals reporting a “No” will not receive the 5 bonus points available for the Public Health Registry Reporting Bonus Measure.

Beginning in CY 2024, reporting a “No” for a will result in a total score of 0 points for the Public Health and Clinical Data Exchange objective. As a reminder, eligible hospitals or CAHs who fail to achieve a minimum total score of 60 points are not considered meaningful users and may be subject a downward payment adjustment. Required measures earn a score, but if a required measure is not fulfilled, the eligible hospital or CAH will earn a score of zero for the PI Program.

Example for CY 2024

If an eligible hospital or CAH was in active engagement to report AU data but could not report AR data due to absence of an electronic Laboratory Information System (LIS) (one of the approved exclusions), the hospital would claim the exclusion for the measure as a whole.

Under the same scenario above, if an eligible hospital or CAH was in active engagement to report AU data, but not AR data and did not have a valid exclusion for reporting AR data, the hospital would be required to answer “No” to the measure and thus fail to successfully demonstrate meaningful use and thus be subject to a negative payment adjustment.

No, data suppression does not count as an eligible exclusion. Please see the exclusions listed above.

Data suppression prevents complete antimicrobial susceptibility data from being reported to the AR Option. We have observed that there are two types of suppression. The first is that the testing instrument suppresses the results for organism-drug combinations that are not supposed to be reported for microbiology purposes, such as ampicillin for Pseudomonas aeruginosa. The second is data suppression for the purpose of antimicrobial stewardship; for example, suppressing carbapenems for E. coli isolates that are susceptible to first, second, or third generation cephalosporins in order to reduce the use of carbapenems.

For purpose #1, we would recommend keeping those results suppressed and not submitting them to NHSN. For the organism-drug combinations that are suppressed for purpose #2, generally we would recommend that, if feasible, allow labs to release complete AST results to the EHR and perform data suppression at the EHR level (as opposed to suppression at the susceptibility testing instrument or laboratory information system level). This way, complete data will still be available in the EHR and theoretically should be available for data extraction and submission for surveillance purposes. You might need to work with your microbiology lab to identify which combinations belong to which purpose.

However, if your hospital cannot obtain and/or send suppressed data to the NHSN AR Option, NHSN will accept the data your hospital is able to provide. Please be sure that your AUR reporting software vendor is using ‘Not Tested’ for the unavailable tests/drugs. The NHSN application will not accept AR Event CDA files that do not contain all the required drugs for a given organism.

Many hospitals use outside labs for some, most, or even all of their susceptibility testing. We also know that, in some cases, those results might not make it into the hospital LIS.

NHSN’s AR Option will accept whatever results a hospital provides through its LIS. Not having those reference or outside lab results should not preclude a hospital from reporting whatever susceptibility results they do have in their LIS.

At the same time, NHSN has some minimum results requirements. A hospital may qualify for an exclusion in rare instances where the following conditions are met:

• They have an LIS for non-microbiology data (e.g., hematology or chemistry results), but don’t have an LIS for microbiology data.
• The AR data required for submission to NHSN are not available in the LIS.

In such cases, the hospital would functionally qualify for an exclusion based on lack of an electronic LIS.

If an eligible hospital or CAH is producing and reporting validated production data to NHSN for one of the two—say, AU data—but is still in the pre-production and validation stage for the other—in this example, AR data—the hospital would attest “yes” to the measure and report “Option 1– Pre-production and Validation” as its overall level of engagement for the measure.

An eligible hospital or CAH would only select “yes” for the measure and report their level of engagement as “Option 2 – Validated Data Production” if it is successfully reporting both AU and AR data to NHSN.

No. Hospitals are encouraged to proceed to validated data production as soon as they are ready to do so.

Many eligible hospitals/CAHs already report Antimicrobial Use (AU) Option and/or Antimicrobial Resistance (AR) Option data to CDC’s NHSN. We expect they will attest to “Option 2 – Validated Data Production” for EHR reporting periods in the CY 2024 if they are reporting both AU and AR data.

Similarly, some hospitals may move through registration, testing and validation and begin submitting production data all within CY 2024. If their selected EHR reporting period begins after they’ve reached the point of submitting validated production data for both AU and AR, they can and should attest to reaching that stage.

If a hospital is already reporting AUR data to CDC, it does not need to complete the validation process of sending test files to the NHSN Team. However, all hospitals must complete the registration step within NHSN to kick off the automated monthly AUR submission status report emails regardless of where they are in the submission process. If the hospital is sending production AU and AR data to NHSN, they will be able to attest to being in active engagement and report their level of engagement as “Option 2 – Validated Data Production” in CY 2024. Hospitals attesting to “Option 2 – Validated Data Production” do not need official proof from NHSN of completing the validation process.

Hospitals submit their attestations directly to CMS. CDC has no role in the attestation process for the AUR measure.

However, hospitals can request documentation from CDC/NHSN to support their active engagement status for the required measures under the Public Health and Clinical Data Exchange Objective (e.g., being in active engagement with a CDC/NHSN to report AUR data). Hospitals can use that documentation to support their attestation in the case of an audit by CMS.

NHSN automatically sends out letters showing the registered hospital’s reporting status on the 1st of every month. A final letter is sent out on February 1 with the previous year’s submissions. Eligible hospitals and CAHs can use these reports in case of an audit by CMS. Registered hospitals can also generate ad hoc letters within NHSN following the process outlined in Step 3 of our guidance document [PDF – 356 KB].

No, the AUR Measure of the CMS PI Program is attestation based. Hospitals attest Yes/No to being in active engagement with the AUR measure within the CMS hospital quality reporting (HQR) system. NHSN provides hospitals with documentation to use as proof in the event of a CMS audit (see previous FAQ). NHSN does not provide any AUR data to CMS nor does CMS request them, as this program is aimed at increasing interoperable healthcare data exchange.

No.

Under the definition of ‘‘EHR reporting period for a payment adjustment year’’ at 42 CFR 495.4, for eligible hospitals and CAHs that are new or returning participants in the CMS PI Program, the EHR reporting period in CY 2024 is a minimum of any continuous 180-day period within CY 2024. This is an increase from 90 continuous days in CY 2023.

Eligible hospitals and CAHs must report both AU and AR data for the same continuous 180-day (or more) period during the EHR calendar year, and that reporting period must be the same one used for all required PI Program measures.

Hospitals that attest to “Option 2 – Validated Data Production” for the AUR measure must report on an ongoing basis during their selected EHR reporting period.

Hospitals submitting data through NHSN’s AU and AR Options are required to complete a Monthly Reporting Plan for every month that they plan to submit AU and AR data prior to uploading data to NHSN.

For additional information on reporting AUR data, see:

• NHSN AUR Module Protocol [PDF – 3 MB]
• FAQs: Antimicrobial Use (AU) Option
• FAQs: Antimicrobial Resistance (AR) Option

The AUR reporting measure for the CMS PI Program is a hospital-level attestation. NHSN strongly encourages the submission of data from all NHSN-defined inpatient locations (including procedural areas like operating rooms), facility-wide inpatient (FacWideIN), and select outpatient acute care settings (specifically, outpatient emergency department [ED], pediatric ED, and 24-hour observation area) from which the numerator and denominator data can be accurately captured. Hospitals would attest “Yes” if AU Summary, AR Event [numerator], and AR Summary [denominator] data were submitted for all locations meeting the above criteria for each month for the required time frame (e.g., 180 continuous days in CY 2024). A comprehensive submission will enable a hospital to optimize inter- and/or intra-facility comparisons among specific wards, combined wards, and facility-wide data.

Per CMS PI Program requirements, hospitals must use Certified EHR Technology (CEHRT) that has been updated to meet the 2015 Edition Cures Update criteria. Hospitals can confirm whether their vendor has been certified by reviewing the Certified HealthIT Product List maintained by the Office of the National Coordinator for Health Information Technology (ONC). When searching, filter by Certification Criteria then click “View 2015 Certification Criteria” then click the box for “170.315 (F)(6): Transmission to Public Health Agencies – Antimicrobial Use and Resistance Reporting” as shown in the screenshot below.

Additionally, per NHSN requirements, hospitals must use vendors that have completed the NHSN AU and AR Synthetic Data Set Validation requirements. Hospitals can find the list of vendors that have passed AU validation and AR validation on NHSN’s website.

Participants must submit their attestation through the CMS hospital quality reporting (HQR) system, ensuring they’ve met all the program requirements for the EHR reporting period and their electronic clinical quality measures (eCQMs) for the required reporting period. Participants have until the last day in February of each year to attest for the previous year.

Note: This date is subject to change due to weekends, federal holidays, or other changes proposed and finalized in CMS regulations.

Hospitals can complete the registration of intent within NHSN when your AUR software is set up to produce test and/or production AU and AR files. Once the hospital completes registration, it will receive an automated email from NHSN to send test files for validation. Per the CMS measure specifications, hospitals should respond to the request for test files within 30 days following the request for test files. Failure to respond twice within an EHR reporting period would result in that eligible hospital or CAH not meeting the measure. Please allow up to 8 weeks from receipt of test files for the NHSN Team to complete the validation of your test files. Additionally, if your hospital wants a letter from NHSN denoting the validation stage is complete, you must have three passing test files: AU Summary, AR Event (numerator) and AR Summary (denominator). We ask hospitals to register and submit test files no later than November 1, 2024, to allow the NSHN AUR Team time to process the test files.

NHSN automatically sends out letters showing the registered hospital’s status with reporting on the 1st of every month. A final letter is sent out on February 1 with the previous year’s submissions. Therefore, hospitals should submit their production CY 2024 AUR data to NHSN no later than January 31, 2025, in order to be included on the February 1 status report.

Only the NHSN Facility Administrator can complete this task. They will log into NHSN, click “Facility” then “AUR PI Registration” on the left-hand navigation bar.

On the AUR Promoting Interoperability (PI) Program Registration page, read the text and check the box to automatically add your name and the hospital name to the form:

Add up to two optional email addresses for individuals, aside from the NHSN Facility Administrator, who will be involved in the PI Program process and who will receive copies of submission documentation. These people do not need to have NHSN credentials. Adding the email address on this screen ensures they will receive the automated emails regarding your hospital’s AUR submission status. Of note, adding the optional PI Program contact email address on the registration screen will not kick off the process to become an NHSN User. If they are not NHSN users, they will not be able to log into NHSN.

Verify all information is correct and click the “Save” button. Click “Yes” on the pop-up alert to confirm your hospital’s registration of intent to submit AU and AR data.

Note: If the person listed as your NHSN Facility Administrator no longer works at your hospital, please submit a request for that role to be reassigned.

Per the CMS measure specifications, hospitals should respond to the request for test files within 30 days following the request for test files. Failure to respond twice within an EHR reporting period will result in that eligible hospital not meeting the measure. If the hospital registers intent to submit AUR data within NHSN prior to having test files ready, the hospital should reply to the request for test files with their current status. The hospital should continue to email a status update at least every 60 days until the hospital has test files to send for validation to complete Option 1 – Pre-production and Validation.

These files should be regular CDA files but contain test data without protected health information (PHI) or personally identifiable information (PII). This step requires you to send one CDA file of each type: AU Summary, AR Event (numerator) and AR Summary (denominator). First, check with your AUR reporting software vendor as many have created test files to use for this purpose. If your vendor is unable to provide files with test data, you can send production files for validation. However, please be sure to send these via secure email to NHSNCDA@cdc.gov. If possible, please only include one CDA file for each file type: AU Summary, AR Event (numerator) and AR Summary (denominator).

The NHSN Facility Administrator and up to two additional email addresses specified on the AUR PI Registration page can receive the automated compliance emails. The Facility Administrator can add the additional emails within NHSN on the Facility > AUR PI Registration page. These emails can be updated at any time on the same page.

Yes, the NHSN Facility Administrator can generate an ad hoc compliance report at any time. After logging into the NHSN facility, click “Facility” then “AUR PI Registration” on the left-hand navigation bar.

On the AUR Promoting Interoperability (PI) Program Registration page, click “Reports”:

On the Request for AUR PI Program Status Report page, select the year of report desired then click “View Report”:

Once generated, the report can be emailed, printed, or downloaded.

We recommend at least two people be educated users for AUR Module reporting. It’s most common for either the pharmacist or the infection preventionist to update the monthly reporting plans within NHSN and submit the AUR data, though any NHSN user with appropriate rights can fulfill these responsibilities. It’s also important for hospitals to designate who will review and validate submitted data and who will run reports and analyze the data. You can divide these tasks the way that works best for your hospital. Assuming you will need to add new user(s) to your NHSN hospital, please follow the steps to ensure the new user(s) has the necessary rights to perform relevant tasks: User Rights in NHSN AUR Module (cdc.gov) [PDF – 491 KB].

Eligible hospitals and CAHs must report a “yes” response or claim an applicable exclusion* for all required measures under the Public Health and Clinical Data Exchange objective to receive the full 25 points for that objective**.

The scores for each of the individual measures are added together to calculate the total score of up to 105 possible points for each eligible hospital or CAH. For the CY 2023 reporting period, a total score of 60 points or more will satisfy the requirement to report on the objectives and measures of meaningful use, which is one of the requirements for an eligible hospital or CAH to be considered a meaningful EHR user and avoid a downward payment adjustment. Failure to fulfill any of the required measures, including the AUR measure, will result in a score of zero for the Promoting Interoperability Program.

Eligible hospitals or CAHs scoring below 60 points will not be considered meaningful EHR users and could be subject to a downward payment adjustment.

*If an eligible hospital or CAH claims exclusions for all required measures, the entire point value for the Public Health and Clinical Data Exchange Objective would be redistributed to the Provide Patients Electronic Access to Their Health Information measure under the Provider to Patient Exchange objective.

**Beginning in CY 2023, the points allocated to the Public Health and Clinical Data Exchange Objective increase from 10 to 25 points to create a more meaningful incentive for eligible hospitals and CAHs to engage in the electronic reporting of public health information and recognize the importance of public health systems.