Security and Data Handling in CDC's National Healthcare Safety Network: The FAQ

CDC answers common questions about the security and data handling of its National Healthcare Safety Network (NHSN) in an FAQ. Its answers, summarised here, describe the system as the FAQ documents it.

On the workstation

• Software to install: none. NHSN was built with Java J2EE on the server and HTML and JavaScript in the browser, and uses no ActiveX or Java controls.
• Disk space: at least 500 MB is recommended, for saving reports, exported data, PDF files and the like — and possibly, in future, downloadable multimedia training.
• Network: the system needs HTTP port 80 open.
• Processing: all data analysis and reporting runs on CDC's servers, using SAS Intranetware.

Security

• Access: CDC's Secure Data Network requires a secure 128-bit encryption digital certificate to log in to NHSN.
• Audit logs: the Secure Data Network logs every user login. Facility administrators cannot see these logs, but if a security breach is suspected, access to them can be requested from the Secure Data Network group.
• Assessment: NHSN has undergone and passed the extensive Certification and Accreditation security risk assessment required for federal IT systems, and its software has been scanned for vulnerabilities and passed. New releases are scanned if they change the system's security posture.

Patient data

• Patient name is not required. It is there only for the facility's own benefit, to identify individual patients; it is stored in CDC's database but not used in any CDC analysis. The only required identifiers are patient ID number, sex and date of birth.
• Importing data: NHSN accepts only comma-separated value (CSV) files for procedure, surgeon and patient demographic data, with health care worker demographics to follow. HL7 version 3 messaging for antimicrobial use and resistance data was under construction.
• Getting data back: a facility can download the data it has entered or imported at any time, in formats such as Excel and dBase.

Backups

NHSN data are kept in SQL databases, with an incremental backup at least every night. Backups, logs, incremental and full, are stored on a separate disk or server, copied to tape every night and ultimately kept off site. Several weeks of backups are kept, and a number of SQL servers stand ready if one fails.

Sources

• Centers for Disease Control and Prevention, National Healthcare Safety Network, "FAQs About NHSN Security." https://www.cdc.gov/nhsn/faqs/nhsnsecurity.html