Every health care facility that uses CDC's National Healthcare Safety Network (NHSN) must accept the NHSN Agreement to Participate and Consent, sometimes called the "308(d) document."
What the agreement is
It is a user agreement and data consent form that sets out NHSN's purposes and how its data are accessed and protected. A facility administrator reviews and accepts it electronically after informing a senior executive of its terms. It includes an Assurance of Confidentiality under Section 308(d) of the Public Health Service Act, protecting data that facilities provide voluntarily.
Because NHSN holds valuable, sensitive information, some of which can be shared with health authorities, every facility needs to know exactly who can see its data and why. New facilities must accept the agreement when they enroll, within 60 days. Facilities can also share their own data with other organizations as they choose through NHSN's Group function.
Who can see a facility's data
| Who | For what |
|---|---|
| State, local, territorial and tribal health departments | Surveillance and prevention — not regulation. Beyond what a jurisdiction's own mandate covers, a health department needs a signed data use agreement with CDC, and the facilities involved are told and may opt out of NHSN in part or entirely. Facility- and patient-level data may also go to health departments during outbreak investigations to help find cases and control spread |
| Centers for Medicare & Medicaid Services (CMS) | Infection data within the scope of CMS programs for facilities in its Prospective Payment Systems — publicly reported on Medicare Care Compare — plus facility-level and annual survey data for program administration, validation, appeals, evaluation, quality measure development and voluntary quality improvement programs |
| HHS Administration for Strategic Preparedness and Response (ASPR) | Facility-level data for public health preparedness, emergency management and response |
Beyond these, CDC cannot release facility-level data to anyone; other organizations are told to ask the facility. Some data components are excluded from health department agreements (NHSN can supply the list). CDC never shares the name of an individual infection preventionist or patient.
Once accepted, a downloadable consent form showing the administrator's name and acceptance date appears in the Components Followed table on the facility's information page.
The May 2026 update
The COVID-19 pandemic showed NHSN's importance in emergency response and the need for a national system able to move quickly, so CDC updated the agreement:
- Re-consent required. Every enrolled facility must accept the updated agreement to keep participating. A facility administrator with SAMS access is prompted on logging in, and can accept for all the facilities they administer at once. Only the facility administrator may accept it now, once per facility, covering all components — previously a primary contact could accept it component by component. Every facility must have a facility administrator.
- Deadline: June 1, 2027. After that date a facility that has not accepted stays active and keeps its historical data and reports, but cannot submit new data — including data needed for CMS quality programs — until it does.
- Stated Purposes moved online. The list of Stated Purposes, the specific ways NHSN data may be used and shared, now lives only on the NHSN website rather than in the agreement, so it can be updated for emergencies without a new agreement. It remains tied to the agreement and the Assurance of Confidentiality, any change must be approved by CDC's Office of Science, it will never conflict with public health surveillance and healthcare preparedness, and data are no less protected.
- What the purposes now say. They add sharing with ASPR and name tribal health organizations more explicitly, and the first purpose now mentions patient-level claims data explicitly, since NHSN begins accepting claims data in 2026 for its FHIR-based digital quality measures. None of this creates a new reporting requirement.
The Stated Purposes were last updated in December 2017. NHSN plans to review them yearly — sooner in an emergency — and will email all facilities before any change. Facilities cannot opt out of a Stated Purpose, though they can decline to report certain data, which may conflict with state, local or federal mandates or CMS program requirements.
Questions go to the NHSN Help Desk.
Sources
Rewritten from the Centers for Disease Control and Prevention page "FAQs About NHSN Agreement to Participate and Consent" (public domain), in hubnx's own words.
Licence: CC0 1.0 (public domain) · Adapted from www.cdc.gov
1
0
0
0
Comments
