DUA FAQs for Health Departments and Facilities

CDC and your state, local, or territorial health department have entered into a data use agreement (DUA). The health department will gain access to data reported to CDC’s National Healthcare Safety Network (NHSN) from healthcare facilities in the jurisdiction. The new provisions are designed to allow data access solely for the purposes of surveillance and prevention.  The overarching goal of the new access provisions is to enhance the value of data reported to NHSN for public health purposes. The questions and answers below provide more details about the NHSN data use agreement.

The data will be used for healthcare-associated infection (HAI) surveillance and prevention purposes and not legal and regulatory action.

Access to the data is intended for the HAI program for prevention activities. To identify the HAI coordinator in your health department, use contact information typically shared on their HAI/AR Program website.

Each data use agreement is modeled using a template developed by CDC and customized by CDC and the health department to reflect local data needs, protections, and policies. It is important to note that past data (i.e., data that was entered into NHSN prior to the opt-out period) will not be shared; only future data will be shared with the health department. NHSN data required by state, local, or territorial law to be shared with the health department will continue to be shared as usual (by facilities joining a Group in NHSN and accepting a template for data sharing).

No. Making facility-identifiable data publicly available would be a violation of the data use agreement and CDC will terminate the data use agreement immediately.

State, local, and territorial health departments are taking an increasingly critical role in the prevention of HAIs. In many geographical areas, health departments have developed expertise in HAI prevention and are launching prevention programs in which facilities can participate. By sharing data, prevention needs can be identified, and tailored strategies can be planned and evaluated. Health departments would be motivated to abide by the data use agreement to gain access to HAI data in CDC’s NHSN. A breach in this contract will end the contract, ending the data flow to the health department.

No additional steps will be necessary to share your data such as joining a health department Group in NHSN. CDC will administer a special Group for your health department, and your facility will automatically be joined to the Group.  Your NHSN Facility Administrator can view the data sharing template for this Group at any time from within the NHSN application.

The data use agreement allows CDC to share data with the health department sooner and with more detail than using CMS’ Hospital Compare.

Many health departments have an effective and collaborative relationship with facilities in their jurisdiction, including the prioritizing of prevention programs and opportunities for undertaking complementary HAI prevention projects. The data use agreement may foster additional collaborations between facilities and health departments in this manner.

Some healthcare facilities report some data voluntarily to NHSN, even in jurisdictions with HAI reporting mandates. This voluntarily reported data may become available through DUAs to health departments. Before the health department begins accessing NHSN data under a new DUA (on the 1^st day of the 4^th month after the DUA becomes effective), CDC will provide healthcare facilities in the jurisdiction the opportunity to completely or partially opt-out of voluntary reporting to NHSN via monthly reporting plans.  Facilities will be able to avoid access of data by health department if they modify their voluntary NHSN reporting, by removing select events from their monthly reporting plans, before new data access provisions go into effect. Facilities may also choose to modify voluntary NHSN reporting after DUA data access for the health department has begun. However, data that has already been accessed by a health department may not be retrievable.

CDC and health departments encourage voluntary NHSN reporting to continue wherever possible, while simultaneously enabling health department access to those data for surveillance and prevention programs.  Thus, we make every effort to ensure that healthcare facility data are secure and are not publicly disclosed in a manner than identifies facilities.

No. Participation is at the discretion of each health department.

Yes, a facility can continue to use NHSN for tracking and prevention of HAIs within a facility while partially or completely opting out of sharing data through the DUA. To opt out, the facility removes relevant HAI events from its monthly reporting plans i.e. modifies the voluntary reporting.

To identify the HAI coordinator in your health department, use contact information typically shared on their HAI/AR Program website.

As long as data that are required for health department mandates and/or for CMS quality reporting programs are included in the monthly reporting plan and reported by the specified deadlines, the facility will be in compliance with CMS requirements and with HAI reporting mandates. Removal of data from the monthly reporting plan that is not required by CMS or by health department mandates (i.e., data that is reported voluntarily into the monthly reporting plan) will not jeopardize a facility’s compliance with CMS or health department mandates. If a facility removes certain HAI events from their monthly reporting plans, that data will not be available to the CMS quality reporting programs or to health departments that use NHSN to access mandatorily reported data.   For facility data protection purposes, only data collected through surveillance that is included in a facility’s monthly reporting plans will be shared with CMS and health departments with HAI reporting mandates.

While your health department (state, local, or territorial) may not have a reporting mandate, it is important for facility-based infection preventionists and public health epidemiology staff to work closely together to maximize prevention efforts at all geographic levels and to take advantage of mutually beneficial support and advocacy for resources, as well as technical implementation.  Broadening NHSN’s capacity and services in this way enables analysis at all geographic levels and enhances the system’s value for HAI prevention and response.  Health departments are long-standing partners in public health surveillance and prevention, and they commit—together with CDC—to making every effort to ensure that NHSN data are not publicly disclosed in a manner that identifies facilities.  Therefore, the NHSN Agreement to Participate and Consent—the user agreement and data consent form which details the purposes of NHSN and data access and protection provisions—enables CDC to provide health departments with NHSN data for surveillance and prevention, a purpose that is achieved via a data use agreement.  Additional stated purposes include providing information to health departments in fulfillment of reporting requirements and to CMS so that facilities can comply with the evolving requirements of CMS’ Quality Reporting, Value-Based Purchasing, and Hospital-Acquired Condition Reduction Programs.

CDC’s National Healthcare Safety Network (NHSN) is the nation’s most widely used healthcare-associated infection tracking system. NHSN provides facilities, states, regions, and the nation with data needed to identify problem areas, measure progress of prevention efforts, and ultimately eliminate healthcare-associated infections. Since 2006, CDC has provided health departments in states with mandatory HAI reporting requirements with access to mandatorily reported data in their jurisdiction. As of 2017, thirty-four states, Philadelphia, P.A., and Washington D.C. use NHSN for that purpose. Since October 2011, CDC has provided state health departments with additional access to data reported by healthcare facilities in their jurisdiction to NHSN via data use agreements.

Components that may be included: Patient Safety, Healthcare Personnel Safety, Dialysis
Components that may not be included:  Biovigilance, Long-term Care

X: Indicates HAI/Event is reportable by facility type

Acute care facilities also include:

Critical Access, Children’s, General Hospitals, Oncology, Orthopedic, Pediatric LTACs, Surgical, Women’s, Women/Children’s Hospitals

The following facility types are currently not available for inclusion in DUAs:

All Long Term Care (LTC)/ skilled nursing facilities

Rationale: At present, enrollment and use of the NHSN Long-term Care Component is at an early stage, and one of NHSN’s strategic goals is encouraging greater participation by LTC facilities throughout the U.S.  Until more extensive LTC facility participation in NHSN is assured, with a concomitant increase in understanding of what that participation entails and enables, our strategic goals are better served by omitting rather than including access to LTC Component Data via DUAs with health departments.  

Military and Veterans Affairs (VA) facilities

Indian Health Service (IHS) facilities

Home dialysis centers

The following HAI Events are not available for inclusion in DUAs:

Healthcare Personnel/Blood & Body Fluids Exposure Module; Laboratory & Prophylaxis/Treatment (Hep B-C, HIV/AIDS)

Rationale: NHSN no longer supports the use of the Blood and Body Fluid Exposure Module in the Healthcare Personnel Safety Component.  While several hospitals are still using that module for their own use, we are not including their data in DUAs.

Dialysis Seasonal & Non-seasonal Influenza Vaccine Events

Rationale: At this point, there are no states that mandate reporting of this information among patients.

Dialysis Prevention Process Measures (PPMs) (Hand Hygiene, Injection Safety, Catheter Connection/Disconnection, Catheter Exit Site Care, etc.)

Rationale: PPMs was designed for facilities’ internal quality improvement efforts.  These data are not shared with CMS or other entities by CDC.

Acute Kidney Injury (AKI)

Health departments may choose among various options for accessing NHSN data based on their specific data access needs as described in the table below.

Table: Options for NHSN data access by health departments (HDs) 

1. In DUAs with local and territorial health departments, NHSN data will only be accessible from healthcare facilities that have accepted the 2017 NHSN Agreement to Participate and Consent. More details on data inclusions and exclusions for DUAs can be found here: DUA FAQs for Health Departments and Facilities.
2. In data requests for HAI prevention activities and outbreak investigations, NHSN data will only be provided from the Patient Safety Component and from healthcare facilities that have accepted the 2017 NHSN Agreement to Participate and Consent.
3. For voluntarily reported data obtained via an NHSN group, facility identifiers can be made publicly available if the health department has communicated this public reporting purpose prior to healthcare facility participants joining the group. Otherwise, the health department should provide opportunities for facilities to consent or refrain from consenting to use of their institution-specific data for public reporting.
4. HDs can also use the group function for access the NHSN’s LTCF COVID-19 Module
   1. If HD has an existing define rights template (DRT) in its NHSN standard group, HD group users can access data for facilities that have already conferred rights when the module was deployed.
   2. For those HDs without a DRT, HD group users must manually check of COVID-19 box and undergo normal process of setting up a group.
5. This option for NHSN data access enables HDs to access COVID-19 data reported in NHSN via the COVID-19 Supergroup function, in addition to other infectious diseases.
6. HDs in a NHSN LTCF COVID-19 module group will be able to access data immediately (the same-day as enrollment if not previously enrolled in NHSN).