NHSN Digital Quality Measure (dQM) FAQs

What is NHSNLink?

NHSNLink is an open-source HL7 FHIR application for public health reporting. Through an extensible, configurable query engine, NHSNLink connects securely to a healthcare facility’s EHR via the FHIR API  NHSNLink identifies patients of interest from facilities utilizing FHIR standards and passes the data to NHSN for data quality and analytic applications. You can find additional information at about NHSNLink and FHIR.

Does NHSNLink require installation of an external vendor or “third-party” software?

No, you do not need to install or purchase new software. NHSNLink’s architecture minimizes Information Technology requirements for the participating facility.

What data security and privacy procedures are in place for data exchange that involves FHIR and PHI/PII with CDC NHSN?

NHSN has over 20 years of experience in secure and confidential data exchange with over 37,000 U.S. hospitals and other healthcare facilities. Data access and protection provisions are outlined in the NHSN Agreement to Participate and Consent and the NHSN Facility/Group User & Administrator Rules of Behavior. Data are protected by administrative, technical, and physical security controls that safeguard the confidentiality, integrity, and privacy of personal information according to industry-standard policies and federal laws, including the Privacy Act, the Health Insurance Portability and Accountability Act (HIPAA), and the Federal Information Security Modernization Act (FISMA).

Additionally, NHSNLink safeguards information in the following ways:

• Protected by an OAuth2.0 identity-access management (IAM) service delivered by CDC Secure Access Management Services (SAMS), which includes authentication and role-based access control (RBAC).
• Queries only selected, pre-specified FHIR resources that are available only upon authorization from the facility’s server. Access control is provided on a FHIR resource-by-resource basis.
• Data (including internal NHSNLink app communications) are encrypted in-transit through HTTPS/TLS1.2.
• Data are encrypted at-rest using NIST Advanced Encryption Standard 256 (AES 256)

For information about how Protected Health Information (PHI) and Personally Identifiable Information (PII) is secured within NHSNLink, please visit the security considerations section.

How does NHSNLink differ from Electronic Case Reporting (eCR)?

Both NHSNLink and Electronic Case Reporting (eCR) support CDC’s Data Modernization Initiative by improving data sharing between CDC and its partners, but NHSNLink and eCR have different purposes and serve different public health surveillance needs. NHSNLink support NHSN’s model of national-level surveillance of healthcare events to support quality improvement and benchmarking. eCR supports a model for automated case reporting of reportable public health conditions (e.g., state-reported COVID-19 cases).

Will existing non-dQM measures that NHSN supports be transitioned to dQMs?

Current data-reporting methods will remain in place at this time for existing non-dQMs.

How do I know that my facility’s data are being submitted correctly and all required fields are populated?

There is a screening process that will stop the data from being submitted if required fields are not properly populated. These issues must be resolved before the data can be resubmitted.

Will the new dQMs have analysis and report options that facilities can use to modify and analyze data, like the other measures featured on NHSN?

Yes. dQMs have modifiable analysis, and reports are in the NHSN Reports tab.

How can a facility view line-level data submitted via FHIR?

Facilities can view line-level data submitted via FHIR on the NHSN Reports tab within the application. Measure specific line-list reports and functionality are described in the Analysis Resources Line List Document [PDF – 408 KB].

If line-level data is not visible, work with your Information Technology team or EHR vendor to confirm that your FHIR submission is configured correctly and meets NHSN reporting requirements on the FHIR Ready | NHSN | CDC webpage.

Instructions for Accepting the NHSN Agreement for Reporting FHIR Data [PDF – 431 KB]

1. What is the NHSN Agreement for Reporting FHIR Data (“FHIR Agreement”)?
   1. The FHIR Agreement outlines the requirements and specifications healthcare facilities agree to adhere to when submitting data to NHSN using Healthcare Level Seven International (HL7®) Fast Healthcare Interoperability Resources® (FHIR®) application programming interfaces (APIs). The Agreement authorizes NHSN to access a facility’s electronic health record (EHR) via FHIR APIs to retrieve data for digital quality measures (dQMs) and other approved uses. The FHIR Agreement describes facility eligibility criteria as well as data collection and reporting requirements to support secure, consistent, and high-quality data exchange that enables NHSN to accurately measure healthcare quality and patient safety and inform public health action.
2. Who should sign and accept (submit) the NHSN FHIR Agreement?
   1. The FHIR Agreement should be reviewed by the appropriate organizational leadership (e.g., CIO, CMO, CQO) who have the authority to bind the facility to the terms of the agreement. This review may include notifying and seeking approval from organizational leadership for your health system as well as leadership within your facility. Once appropriate leadership have reviewed and approved the agreement, the NHSN Facility Administrator can “accept” (submit) the FHIR Agreement in the NHSN application.
3. What should facilities expect after completing the FHIR Agreement?
   1. Completing the FHIR Agreement enables the facility to move onto the next steps in dQM onboarding, which include completing a Digital Measure Reporting Plan (DMRP) in the NHSN application and connecting to NHSNLink. More details about the phases involved in dQM onboarding can be found at the NHSN Early Adopter webpage.
4. Does the NHSN FHIR agreement replace any previous NHSN agreements my facility has signed?
   1. No. The NHSN FHIR Agreement must be accepted in addition to other NHSN agreements. The most up-to-date version of the NHSN Agreement to Participate and Consent [PDF – 452 KB] and the NHSN Rules of Behavior must both be accepted before a facility can accept the FHIR agreement.
5. Which facilities are eligible to report data using FHIR?
   1. Currently, only a selected number of facilities are eligible to report FHIR dQMs to NHSN. Beginning in 2027, FHIR-based reporting will be more widely available. Facilities who are interested in implementing FHIR-based reporting in the future can prepare by checking their facility’s technical readiness and FHIR API conformance using the CDC NHSN FHIR Ready Guide.
6. How does my facility submit FHIR data to NHSN?
   1. Transmission of FHIR data to NHSN occurs through NHSN’s FHIR application programming interface (API), NHSNLink. NHSNLink securely retrieves data from a participating facility’s FHIR-enabled server on a scheduled basis, according to the specifications indicated by an NHSN Content Package Implementation Guide (IG). In order to ensure your facility is ready to engage in this type of data exchange, visit NHSN FHIR Ready to learn more about becoming “FHIR ready.”
7. How are dQM data used?
   1. The details of how CDC may use data submitted to NHSN, which includes dQM data acquired through NHSNLink, are detailed in the NHSN Stated Purposes, as part of the NHSN Agreement to Participate and Consent.
8. How are data protected when submitted through FHIR?
   1. Information about data security and privacy can be found in the ‘About NHSNLink’ section on the NHSN dQM webpage, NHSN Digital Quality Measures. Information transmitted through federal computer networks may also be monitored for cybersecurity purposes to protect government systems from cyber threats.
9. My facility is not yet submitting data via FHIR. How can we get on a list to participate?
   1. If your facility is interested in pursuing NHSN dQM FHIR-based reporting, please submit a ticket to the NHSN Help Desk via NHSN-ServiceNow (for those with SAMS access) with the subject line “Interested in Reporting FHIR dQMs” or email nhsn@cdc.gov.
10. What if I have additional questions about the FHIR Agreement?
    1. Please submit a ticket to the NHSN Help Desk via NHSN-ServiceNow (for those with SAMS access) with the subject line “NHSN FHIR Agreement” or email nhsn@cdc.gov.