NHSN Antimicrobial Use (AU) Option: A Guide to Reporting

An example monthly reporting plan with antimicrobial use (AU) locations checked. CDC.

CDC's National Healthcare Safety Network (NHSN) collects hospitals' antimicrobial use (AU) data through the AU Option of its Antimicrobial Use and Resistance (AUR) Module. This guide condenses NHSN's answers to the most common questions. Details: the AUR Module page and protocol.

Getting started

• Requirements: data from an electronic medication administration record (eMAR) or bar-code medication administration (BCMA) system, packaged in Clinical Document Architecture (CDA) format. No manual entry — there is too much data.
• Vendors: since January 2021, every vendor submitting AU data must pass Synthetic Data Set (SDS) validation; see the list of validated vendors. Ask your current vendor first. A "homegrown" system is possible but not recommended for most, and must also pass SDS validation; toolkits are on the CDA Submission Support Portal.
• Access: users need SAMS credentials, added by a facility administrator with Patient Safety Component rights (Administrator-level rights recommended for submitters; custom rights must include the Patient Safety Annual Facility Survey to see SAAR reports). Train meanwhile on the AUR Educational Roadmap.

Deadlines and back data

• Monthly: upload within 30 days after each month ends.
• CMS: hospitals in the Medicare Promoting Interoperability Program must upload a calendar year's data by January 31 of the next year. Eligible hospitals and critical access hospitals must be in active engagement with NHSN for AU and AR Surveillance during a self-selected 180-day reporting period, using certified EHR technology. The measures are attestation-based: NHSN does not share AU data with CMS.
• Retrospective data: back to January 2012 if monthly reporting plans exist; otherwise back to January of the year the facility enrolled or of the previous calendar year, whichever comes first.

Monthly reporting plans

• AU must be in the reporting plan for every month you submit — no data "off plan." Plans don't carry over; use "Copy from Previous Month."
• To include FacWideIN (facility-wide inpatient), the plan must list at least one individual location. A location in the plan with no data raises missing-data alerts, cleared by submitting the data.

Locations

• Report: all NHSN-defined inpatient locations (including operating rooms), FacWideIN, and three outpatient settings — emergency department, pediatric ED and 24-hour observation — wherever numerator and denominator data are captured accurately and electronically. Leave out locations that can't, from FacWideIN too. No other outpatient clinics.
• Mapping: use NHSN's standard location mapping; add locations as needed, but don't create duplicate "AU" versions of existing ones or remap correctly mapped units.
• Why location-level data: FacWideIN alone can't be broken down, and blocks SAARs and Targeted Assessment for Antimicrobial Stewardship (TAS) reports, which are risk-adjusted by location.
• FacWideIN includes only inpatient locations — not the ED, pediatric ED or observation area.
• Observation patients: count antimicrobials given to anyone physically in an inpatient location, whatever their status. If the facility has a mapped 24-hour observation area, keep it out of FacWideIN.
• Rehabilitation and psychiatric units mapped as locations can be included; if enrolled as separate NHSN facilities, report them there.

Counting antimicrobial days

• Routes: only intravenous, intramuscular, digestive and respiratory. Exclude topical, ophthalmic, otic, locks, irrigation and other routes everywhere.
• Each drug separately: meropenem and amikacin on the same day = one day of each.
• One drug, two routes: IV in the morning and oral in the evening = one IV day and one digestive day, but only one total day for that drug.
• Only the day given: vancomycin every other day in renal failure counts once, even though it lasts two days.
• Locations vs facility: a patient dosed in two units on one day adds a day to each unit but one to FacWideIN, so unit totals always exceed FacWideIN.
• Routes vs totals: the four route counts can sum to more than total days, never less.
• Completed doses only: no partial infusions, no ordered-but-not-given doses.

Days present and admissions

• Days present ≠ patient days: days present count every patient in a location at any time in a calendar day; patient days come from the once-daily census. A patient admitted to the ICU at 00:01 and moved to a ward at 08:31 counts a day present in both, but a patient day only on the ward.
• Expected gap: days present are almost always higher. In 2024 national data, 90% of facilities had a difference under:

Percent difference = (days present − patient days) ÷ days present × 100.

• FacWideIN counts a patient once a day, however many transfers.
• Admissions: patients arriving in an inpatient location during the month, whatever their status — even if discharged the same day. Inpatient → ED or observation → inpatient counts as two. A stay spanning months is one admission, in the month it began; a patient discharged and returning on another day is a new admission. (This differs from the MDRO/CDI Module's definition.)

Uploading data

• Facility OID: CDA files identify the facility by its Object Identifier, found under Facility → Facility Info; request one if missing.
• Zip files: AU and AR files can share a zip — one facility per zip for manual upload, several for DIRECT — up to 1,000 files or 2 MB. File names: letters, digits, hyphens and underscores only.
• Every required drug, every month: report each antimicrobial in the protocol's Appendix B — 0 if the eMAR/BCMA captures it but none was given; NA if it can't be captured electronically.
• Can't see the upload option? Under Import/Export, look for "AUR Summary Data" or "Events, Summary Data, Procedures Denominators"; if missing, ask an administrator for rights.
• Partial success: when some files fail, Submit imports only those that passed. Save the PDF report each time — it lists what imported, what failed and why, and the Help Desk needs it.
• Generate data sets after every upload: new data don't appear in reports until you do, and each user's data sets are their own.

Fixing and checking data

• Editing: no manual edits. Use your vendor's succession management to overwrite a record, or delete and re-upload. Succession management can't delete without replacing.
• Deleting: Summary Data → Delete AUR Data, choose location, month and year ("(ALL)" deletes every location for that month).
• Validation: run the implementation data validation when starting or changing vendors, the shorter annual validation each year, and the data quality line list after each import, which checks six common problems.
• Reports: SAAR tables and plots, rate tables, line lists and bar charts — see the quick reference guides.

Who sees the data

Only users at your facility — unless you accept a Group's request (a health system or quality organization), or a health department has a Data Use Agreement with CDC covering your jurisdiction. Groups can view but never add or edit data, and facilities in a Group can't see each other's. Health departments, the VA and the Department of Defense can also ask NHSN which facilities in their area submit AU data.

Sources

Based on "FAQs: Antimicrobial Use (AU) Option," National Healthcare Safety Network, Centers for Disease Control and Prevention; a work of the United States government in the public domain.