Hospital infection data has a file format, and it has versions

Hospitals do not type their infection data into a form. They export it from an
infection control software system as CDA — Clinical Document Architecture
— files, built to a specification the NHSN publishes.

The format is strict. **A CDA document contains required template identifiers,
specific vocabulary and specific constraints**, all detailed in an
implementation guide (IG).

Why the version matters

**CDA import files are created based on the NHSN HAI implementation guides,
and because NHSN protocols change, imports for specific events and summary
reports must be created to specific IG versions for specific years.**

That is the practical trap. An implementation guide is not a manual you read
once. A facility submitting 2026 events with a 2024 guide produces files that
are well-formed and wrong, and the mismatch may only surface when the data
fails validation — or worse, when it validates and means something different
from what was intended.

The NHSN publishes a Guide to CDA versions precisely so a facility can
work out which IG applies to which event type and year.

Why it is not just a spreadsheet

**Creating CDA is more complicated than creating CSV files, and is usually
mediated by an infection control software system** that packages the data into
the correct format.

So there is a third party in the chain — the software vendor — which is why
the toolkits include vendor IDM files alongside the impact notes for each
release. A protocol change reaches a hospital through its software, and if the
vendor has not implemented the new IG, the hospital cannot comply however
willing it is.

Toolkits are published per module, including Antimicrobial Use (AU) and
Antimicrobial Resistance (AR), with impact notes for each release
setting out what changed.

*Source: National Healthcare Safety Network, Centers for Disease Control and
Prevention.*