CDC Data Use Agreement with State Health Departments

CDC and your state health department have entered into a data use agreement (DUA). The state health department will gain access to data reported to CDC’s National Healthcare Safety Network (NHSN) from healthcare facilities in the state. The new provisions are designed to allow data access solely for the purposes of surveillance and prevention.

The overarching goal of the new access provisions is to enhance the value of data reported to NHSN for public health purposes. The questions and answers below provide more details about the NHSN data use agreement.

How are the data going to be used by the state health department?
The data will be used for healthcare-associated infection (HAI) surveillance and prevention purposes and not legal and regulatory action.

Who in the state health department will have access to the data?
Access to the data is intended for the state HAI program for prevention activities. To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html.

What data will be included in the data use agreement?
Each data use agreement is modeled using a template developed by CDC and customized by CDC and the state health department to reflect local data needs, protections, and policies. If your state has a data use agreement, CDC will make the agreement publicly available on CDC’s website. It is important to note that past data (i.e., data that was entered into NHSN prior to the opt-out period) will not be shared; only future data will be shared with the health department. NHSN data required by state law to be shared with the health department will continue to be shared as usual (by facilities joining a state Group in NHSN and accepting a template for data sharing)

Will facility-identifiable data be made publicly available?
No. Making facility-identifiable data publicly available would be a violation of the data use agreement and CDC will terminate the data use agreement immediately.

What guarantee does a hospital have that a data use agreement will not be breached?
State health departments are taking an increasingly critical role in the prevention of HAIs. In many states, health departments have developed expertise in HAI prevention and are launching statewide prevention programs in which facilities can participate. By sharing data, prevention needs can be identified, and tailored strategies can be planned and evaluated. State health departments would be motivated to abide by the data use agreement to gain access to HAI data in CDC’s NHSN. A breach in this contract will end the contract, ending the data flow to the state health department.

Will hospitals have to do anything additional within NHSN to participate in this program?
No additional steps will be necessary to share your data such as joining a state health department Group in NHSN. CDC will administer a special Group for your state health department and your facility will automatically be joined to the Group.  Your NHSN Facility Administrator can view the data sharing template for this Group at any time from within the NHSN application.

If the same data is on Centers for Medicare and Medicaid Services’ (CMS’s) Hospital Compare, why does my state want it through a data use agreement with CDC?
The data use agreement allows CDC to share data with the state health department sooner and with more detail than if the state uses CMS’s Hospital Compare.

How does a state health department entering into a data use agreement benefit my hospital?
Many state health departments have an effective and collaborative relationship with facilities in their state, including the prioritizing of prevention programs and opportunities for undertaking complementary HAI prevention projects. The data use agreement may foster additional collaborations between facilities and health departments in this manner.

Can a hospital opt-out of voluntary reporting to NHSN to avoid access of data by the state health department?
After a state health department has worked with CDC to complete a data use agreement and before the health department begins accessing new NHSN data, CDC will provide healthcare facilities in the state’s jurisdiction the opportunity to opt out of voluntary reporting to NHSN. Some healthcare facilities voluntarily report to NHSN, even in states with HAI reporting mandates. Those facilities will be able to stop their voluntary NHSN reporting, before new data access provisions go into effect. CDC and state health departments want voluntary NHSN reporting to continue wherever possible, while simultaneously enabling health department access to those data for surveillance and prevention programs.

Are states required to have a data use agreement?
No. Participation is at the discretion of each state.

If our facility chooses to opt out of the data use agreement, can we still use NHSN for tracking and prevention of HAIs within our facility?
It is possible to opt out of the data use agreement while still using NHSN for tracking and prevention of HAIs within a facility. There are two possible ways for a healthcare facility to opt out of the data use agreement. A facility could stop entering data into NHSN or remove select events from their monthly reporting plans. It is important to note that only data collected through surveillance that is included in a facility’s monthly reporting plans will be shared with CMS. Furthermore, most states that have HAI reporting mandates require HAI surveillance to be in the monthly reporting plans.

Who at the state health department can a hospital contact for additional information? 
To identify the HAI coordinator in your state health department click on your state at CDC’s state-based HAI prevention website: https://www.cdc.gov/HAI/state-based/index.html

Additional Background Information:
CDC’s National Healthcare Safety Network (NHSN) is the nation’s most widely used healthcare-associated infection tracking system. NHSN provides facilities, states, regions, and the nation with data needed to identify problem areas, measure progress of prevention efforts, and ultimately eliminate healthcare-associated infections. Since 2006, CDC has provided health departments in states with mandatory HAI reporting requirements with access to mandatorily reported data in their jurisdiction. As of 2015, thirty-three states and Washington D.C. use NHSN for that purpose.