An official website of the United States government
FAQs: AUR Reporting for the CMS Promoting Interoperability Program
Requirement Details
Most subsection (d) acute care hospitals, including subsection (d) hospitals in Puerto Rico (collectively referred to as “eligible hospitals”), and Critical Access Hospitals (CAHs) paid under the Medicare Inpatient Prospective Payment System must participate in the Medicare Promoting Interoperability (PI) Program. You can reach out to the person(s) in charge of quality reporting or information technology (IT) for your hospital to confirm if you are eligible and participating. You may need to ask your hospital’s C-Suite (for example, Chief Technology Officer or Chief Financial Officer) to get connected to the correct individual(s) within your hospital.
Other types of hospitals that are ineligible to participate in the Medicare Promoting Interoperability Program include, but are not limited to, Inpatient Rehabilitation Facilities (IRFs), Inpatient Psychiatric Facilities (IPFs), Long Term Care Hospitals (LTCHs/LTACs/LTACHs), PPS-exempt Cancer Hospitals, and Rural Emergency Hospitals (REHs). While these hospital types are not eligible to participate in the Medicare Promoting Interoperability Program, any hospital enrolled in the NHSN Patient Safety Component can report Antimicrobial Use and Resistance (AUR) data into NHSN.
See Question 2 in the NHSN Data Submission Requirements section of the FAQs for clarification on specific units within an eligible hospital or critical access hospital.
Eligible hospitals and CAHs must begin reporting the AUR Surveillance measure under the Public Health and Clinical Data Exchange Objective in the Electronic Health Record (EHR) reporting period in calendar year (CY) 2024. See additional details on the EHR reporting period in Question 1 in CMS Data Submission Requirements.
Yes. To receive credit for the EHR reporting period in 2024, the AUR Surveillance measure requires eligible hospitals and CAHs attest to being in active engagement (Option 1 or Option 2), and to report both AU and AR Option data to NHSN during the EHR reporting period or claim an applicable exclusion.
Beginning with the EHR reporting period in 2025, the AUR Surveillance measure has been split into two separate measures, the AU Surveillance and AR Surveillance measures. Both measures are required in the Medicare Promoting Interoperability Program for the EHR reporting period in 2025.
No. As outlined under Question 3 above, eligible hospitals and CAHs must report a ‘‘Yes’’ response to being in active engagement (Option 1 or Option 2) with CDC’s NHSN to submit Antimicrobial Use and Resistance data for the EHR reporting period in 2024 to fulfill the measure’s requirements. Eligible hospitals and CAHs may also claim an applicable exclusion. In other words, there is not an opportunity for eligible hospitals and CAHs to receive “partial credit” if they answer “Yes” for half of the measure (specifically, they must meet the requirement for AU and AR, and not one or the other).
For eligible hospitals and CAHs that claim an applicable exclusion, the eligible hospital or CAH would claim an exclusion for the entire AUR Surveillance measure. In these situations, NHSN still encourages eligible hospitals and CAHs to report the data they have available. For example, if claiming an exclusion based on the inability to report AR data, while not required for the Medicare Promoting Interoperability Program, the eligible hospital or CAH can still submit AU data to take advantage of the NHSN AU Standardized Antimicrobial Administration Ratio (SAAR) risk adjusted metric and other analytic reports.
Eligible hospitals and CAHs that report a ‘‘No’’ response, fail to report any response, or fail to claim an applicable exclusion for the EHR reporting period in 2024 will not receive credit for the AUR Surveillance measure. These eligible hospitals and CAHs would fail to satisfy the minimum requirements for the Public Health and Clinical Data Exchange Objective and will earn a score of zero for the Medicare Promoting Interoperability Program.
Requirements for the EHR reporting period in 2025 are different, as outlined in the CMS FY 2025 IPPS/LTCH PPS final rule (89 FR 69600 through 69605), and explained in Question 5 below.
Yes. Beginning with the EHR reporting period in 2025, the AUR Surveillance measure has been split into two separate measures: AU Surveillance and AR Surveillance. Each measure has its own set of exclusions and reporting requirements. Eligible hospitals and CAHs must report a ‘‘Yes’’ response to being in active engagement (Option 1 or Option 2) with CDC’s NHSN to submit Antimicrobial Use (AU) and Antimicrobial Resistance (AR) data for the EHR reporting period in 2025 to fulfill measure requirements. Eligible hospitals and CAHs may also claim an applicable exclusion for one or both measures separately.
Eligible hospitals and CAHs that claim an applicable exclusion for only AU or AR would either need to be in active engagement for the other measure or claim a separate exclusion. For example, if claiming an exclusion for the AR Surveillance measure due to lack of access to discrete data elements, the eligible hospital or CAH must be in active engagement for the AU Surveillance measure or claim an applicable exclusion specific to the AU measure.
Eligible hospitals and CAHs that report a ‘‘No’’ response to either measure, fail to report any response, or fail to claim an applicable exclusion will not receive credit for the measure(s). These eligible hospitals and CAHs would fail to satisfy requirements of the Public Health and Clinical Data Exchange Objective and will earn a score of zero for the Medicare Promoting Interoperability Program.
The Medicare Promoting Interoperability Program requires eligible hospitals and CAHs to be in active engagement with CDC/NHSN to submit AUR data, and they are also required to report their level of active engagement (Option 1 or Option 2). CMS defines active engagement as the eligible hospital or CAH is in process of moving towards sending “production data” to a Public Health Agency, in this case CDC/NHSN, or is sending production data to CDC/NHSN. The measure specification materials are posted in the CMS Promoting Interoperability Program Resource Library.
Option 1 – Pre-production and Validation
Eligible hospitals and CAHs must first register their intent to submit AUR data within NHSN. Per the CMS measure specifications, registration should be completed within 60 days after the start of the self-selected, continuous 180-day EHR reporting period. The registered eligible hospital or CAH will then receive an automated email from NHSN inviting it to begin the Testing and Validation step. Following the instructions in the email, eligible hospitals and CAHs must work towards submitting relevant test files.
For the EHR reporting period in 2024, eligible hospitals and CAHs should send one test file for each file type (AU Summary, AR Event, and AR Summary) for validation by the NHSN Team.
For the EHR reporting period in 2025, eligible hospitals and CAHs should send the test files relevant to the measure(s) they plan to attest to. For example, if planning to attest to Option 1 for the AU Surveillance measure while claiming an exclusion for the AR Surveillance measure, the hospital would send one AU Summary test file only and would not send test files for the AR Surveillance measure.
Per the CMS measure specifications, eligible hospitals and CAHs should respond to the request for test files within 30 days of receiving such request. The response should include the test files or a summary of the eligible hospital or CAH’s progress in setting up AUR Module reporting. If the eligible hospital or CAH replies within 60 days, no further updates are needed until the test files are ready for validation. Please allow up to 8 weeks from receipt of test files for the NHSN Team to complete the validation of your test files.
Failure to respond to either the first or the second request for test files within an EHR reporting period will result in that eligible hospital or CAH not meeting minimum measure requirements and earning a total score of zero for the Medicare Promoting Interoperability Program.
Option 2 – Validated Data Production
Eligible hospitals and CAHs must first register their intent to submit AUR data within NHSN if they did not complete “Option 1 – Pre-production and Validation.” CMS defines “production data” as data generated through clinical processes involving patient care, and it is used to distinguish between live data and “test data,” which are submitted for the purpose of testing and validation. For the EHR reporting period in 2024 and forward, eligible hospitals and CAHs must submit any continuous 180-days of AUR data to NHSN. Keep in mind that you must report the same 180 days of AU and AR data as they were considered a single measure under the Medicare Promoting Interoperability Program in 2024. Additionally, those 180-days must be the same for other Medicare Promoting Interoperability Program measure requirements for your eligible hospital or CAH. Please reach out to your Quality Department, Information Technology Department and/or C-Suite team to determine your hospital’s self-selected EHR reporting period.
Note: Because the AU and AR Surveillance measures have been split for the EHR reporting period in 2025, eligible hospitals and CAHs can spend an additional calendar year in “Option 1 – Pre-production and Validation” (specifically, Option 1 for both 2024 and 2025) before being required to move to “Option 2 – Validated Data Production” in 2026.
As outlined in the CMS FY 2023 IPPS/LTCH PPS final rule (87 FR 49335 through 49337), the Medicare Promoting Interoperability Program finalized the adoption of three exclusions for the AUR Surveillance measure. Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from reporting on the AUR Surveillance measure.
If the eligible hospital or CAH:
- Does not have any patients in any patient care location for which data are collected by NHSN during the EHR reporting period; or
- Does not have electronic medication administration records (eMAR)/bar coding medication administration (BCMA) records or an electronic admission discharge transfer (ADT) system during the EHR reporting period; or
- Does not have an electronic laboratory information system (LIS) or electronic ADT system during the EHR reporting period.
Eligible hospitals and CAHs should claim the exclusion that is applicable to their situation. While NHSN can assist eligible hospitals and CAHs, CMS provides guidance on whether a certain scenario meets one of the exclusion criteria.
For questions related to the Promoting Interoperability Program requirements, please reach out to CMS Subject Matter Experts using the QualityNet Question and Answer tool available on the QualityNet.cms.gov website. To access the tool, click on the “Help” tab in the upper right-hand corner, then select “Question and Answer Tool Main Page,” then select “Ask a Question.” From there, choose “PI – Promoting Interoperability” from the Program dropdown menu. You may also contact CMS live Support Center Help Desk at (844) 472-4477.
As outlined in the CMS FY 2025 IPPS/LTCH PPS final rule (89 FR 69600 through 69604), the Medicare Promoting Interoperability Program finalized the adoption of three exclusions for the AU and AR Surveillance measures. Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from reporting on the AU or AR Surveillance measure.
AU Surveillance measure exclusions – If the eligible hospital or CAH:
- Does not have any patients in any patient care location for which data are collected by NHSN during the EHR reporting period
- Does not have eMAR/BCMA electronic records or an electronic ADT system during the EHR reporting period
- (New) Does not have a data source containing the minimal discrete data elements that are required for reporting.
AR Surveillance measure exclusions – If the eligible hospital or CAH:
- Does not have any patients in any patient care location for which data are collected by NHSN during the EHR reporting period
- Does not have an electronic LIS or electronic ADT system during the EHR reporting period
- (New) Does not have a data source containing the minimal discrete data elements that are required for reporting.
Eligible hospitals and CAHs should claim the exclusion that is applicable to their situation. While NHSN can assist eligible hospitals and CAHs, CMS provides guidance on whether a certain scenario meets one of the exclusion criteria. These questions should be directed to the CMS Subject Matter Experts using the QualityNet Question and Answer tool available on the QualityNet.cms.gov website. To access the tool, click on the “Help” tab in the upper right-hand corner, then select “Question and Answer Tool Main Page,” then select “Ask a Question.” From there, choose “PI – Promoting Interoperability” from the Program dropdown menu. You may also contact CMS live Support Center Help Desk at (844) 472-4477.
Eligible hospitals and CAHs should reach out to the CMS Subject Matter Experts to determine what documentation is needed when claiming an exclusion. You can use the QualityNet Question and Answer tool available on the QualityNet.cms.gov website. To access the tool, click on the “Help” tab in the upper right-hand corner, then select “Question and Answer Tool Main Page,” then select “Ask a Question.” From there, choose “PI – Promoting Interoperability” from the Program dropdown menu. You may also contact CMS live Support Center Help Desk at (844) 472-4477.
The NHSN AUR Module provide users with a monthly and yearly statement of their reporting progress, demonstrating compliance with AU and AR reporting.
The AUR Surveillance measure for the EHR reporting period in 2024 requires that eligible hospitals and CAHs are in active engagement with CDC to report both AU and AR data or claim an applicable exclusion. There is no “partial credit” offered for being in active engagement to report AU or AR data. If an eligible hospital or CAH can report AU or AR data, but not both, it must either claim an applicable exclusion or attest “No” to the measure.
If an eligible hospital or CAH claims an exclusion, NHSN encourages them to report the data that are available. For example, if claiming an exclusion based on AR data being unavailable, the eligible hospital or CAH can submit AU data to take advantage of the NHSN AU Standardized Antimicrobial Administration Ratio (SAAR) risk adjusted metric and other analytic reports.
For the EHR reporting period in 2024, attesting “No” to the AUR Surveillance measure results in not meeting minimum program requirements. Therefore, the eligible hospital or CAH would earn a total score of zero for the Medicare Promoting Interoperability Program, would not be considered a meaningful user of certified EHR technology (CEHRT), and may be subject to a downward payment adjustment.
Example for the EHR reporting period in 2024
If an eligible hospital or CAH was in active engagement to report AU data but could not report AR data due to absence of an electronic Laboratory Information System (LIS) (one of the approved exclusions), the eligible hospital or CAH would claim Exclusion #3.
Under the same scenario above, if an eligible hospital or CAH was in active engagement to report AU data, but not AR data, and did not have a valid exclusion for reporting AR data, the eligible hospital or CAH would be required to answer “No” to the measure, and the eligible hospital or CAH would earn a total score of zero for the Medicare Promoting Interoperability Program, would not be considered a meaningful user of certified EHR technology (CEHRT), and may be subject to a downward payment adjustment.
In the FY 2025 IPPS/LTCH PPS final rule (89 FR 69600 through 69605), CMS finalized separating the AUR Surveillance measure into two new measures: the Antimicrobial Use and Antimicrobial Resistance Surveillance measures. For each of the two measures, eligible hospitals and CAHs must report their level of active engagement (Option 1 or Option 2) or claim an exclusion for each measure.
For example, if the eligible hospital or CAH was actively submitting AU production data to NHSN but was unable to gain access to discrete laboratory results, that eligible hospital or CAH could report their level of active engagement as “Option 2 – Pre-production and Validation” for the AU Surveillance measure and claim an exclusion for the AR Surveillance measure.
Beginning with the EHR reporting period in 2025, attesting “No” for the AU or AR Surveillance measure would fail to satisfy requirements of the Public Health and Clinical Data Exchange objective. Therefore, the eligible hospital or CAH would earn a total score of zero for the Medicare Promoting Interoperability Program, would not be considered a meaningful user of certified EHR technology (CEHRT), and may be subject to a downward payment adjustment.
No, data suppression does not count as an eligible exclusion for the AUR Surveillance measure for the EHR reporting period in 2024, or the AR Surveillance measure for the EHR reporting period in 2025. Please see the exclusions listed above in Questions 7 and 8 of the Requirement Details section (EHR reporting period in 2024 and 2025, respectively).
Data suppression prevents complete antimicrobial susceptibility data from being reported to the AR Option. We have observed that there are two types of data suppression.
First, we observed that the testing instrument suppresses the results for organism-drug combinations that are not supposed to be reported for microbiology purposes, such as ampicillin for Pseudomonas aeruginosa. For this scenario, we would recommend keeping those results suppressed and not submitting them to NHSN.
Second, we observed data suppression for the purpose of antimicrobial stewardship; for example, suppressing carbapenems for E. coli isolates that are susceptible to first, second, or third generation cephalosporins to reduce the use of carbapenems. For the organism-drug combinations that are suppressed for this purpose, generally NHSN recommends that, if feasible, the hospital allows the lab to release complete antimicrobial susceptibility testing (AST) results to the EHR and perform data suppression at the EHR level (as opposed to suppression at the susceptibility testing instrument or laboratory information system level). This way, complete data will still be available in the EHR, and theoretically should be available for data extraction and submission for surveillance purposes. You may need to work with your microbiology lab to identify which combinations belong to which purpose.
If your eligible hospital or CAH cannot obtain and/or send suppressed data to the NHSN AR Option, NHSN will accept the data your eligible hospital or CAH is able to provide. Please be sure that your AUR reporting software vendor is using ‘Not Tested’ for the unavailable tests/drugs. The NHSN application will not accept AR Event Clinical Document Architecture (CDA) files that do not contain all the required drugs for a given organism.
Many eligible hospitals and CAHs use outside labs for some, most, or even all susceptibility testing. We also know that, in some cases, those results might not make it into the hospital’s LIS.
At the same time, NHSN has minimum results requirements. A hospital may qualify for an exclusion in rare instances where the following conditions are met:
- They have an LIS for non-microbiology data (e.g., hematology or chemistry results), but don’t have an LIS for microbiology data.
- The AR data required for submission to NHSN are not available as discrete fields in the LIS. For example, results for Candida species identification and/or susceptibility testing are faxed and scanned into the patient record as a PDF.*
In such cases, the eligible hospital or CAH would functionally qualify for an exclusion based on lack of an electronic LIS. Eligible hospitals and CAHs should not employ manual means of data collection for the AUR Module. Eligible hospitals and CAHs should claim the exclusion that is closest to their situation for the AUR Surveillance measure for the EHR reporting period in 2024 or the AR Surveillance measure for the EHR reporting period in 2025.
*Note: For CY 2025, Candida isolates without susceptibility testing results will become eligible for the AR Option reporting. Therefore, eligible hospitals and CAHs that do not perform susceptibility testing on Candida isolates or are unable to access discrete susceptibility results for Candida isolates will no longer qualify for an exclusion for the EHR reporting period in 2025.
If the eligible hospital does not have access to results of all eligible organisms as outlined in the AUR Module Protocol, they may claim an exclusion for the AUR Surveillance measure for the EHR reporting period in 2024 and the AR Surveillance measure in the EHR reporting period for 2025. For example, an eligible hospital or CAH may claim an exclusion if results for Candida species* were not available or only available in the form of images (for example, fax or PDF). As noted in Question 8 above, lack of discrete data is a new exclusion for the EHR reporting period in 2025.
Please note that if isolate identifications are available, but antimicrobial susceptibility results are conditionally available, depending on the individual isolate or patient’s profile due to the eligible hospital or CAH’s reporting algorithm for antimicrobial stewardship (selective/cascade reporting), this would not qualify as an exclusion for the AU and AR Surveillance measures.
*Beginning in 2025, Candida isolates without antimicrobial susceptibility results will become eligible for reporting under the AR Option and therefore the AR Surveillance measure. All other organisms must have susceptibility testing performed to be considered an eligible isolate.
For the EHR reporting period in 2024, if an eligible hospital or CAH is producing and reporting validated production (Option 2) data to NHSN for AU data but is still in the pre-production and validation stage (Option 1) for the AR data, the eligible hospital or CAH would attest “Yes” to the AUR Surveillance measure and report “Option 1– Pre-production and Validation” as its level of active engagement. In this example, the eligible hospital or CAH should work towards sending test files for validation for both AU and AR despite only being able to successfully submit AU data into NHSN.
An eligible hospital or CAH should only select “Yes” to the AUR Surveillance measure and report their level of active engagement as “Option 2 – Validated Data Production” if it is successfully reporting both AU and AR data to NHSN during their chosen EHR reporting period in 2024, which is a minimum of any continuous 180-days.
Beginning with the EHR reporting period in 2025, eligible hospitals and CAHs can be at different levels of active engagement for each measure. Additionally, eligible hospitals and CAHs could be in active engagement (Option 1 or Option 2) for one measure and claim an exclusion for the other measure.
For example:
- An eligible hospital or CAH could submit 180 days of AU production data (Option 2) while still being in the pre-production phase (Option 1) for AR data. They would report their level of active engagement as such.
- An eligible hospital or CAH could submit 180 days of AU production data (Option 2) while working through issues of discrete data elements with an external lab vendor (Exclusion). They would be able to attest to “Option 2 – Validated Data Production” for the AU Surveillance measure and claim an exclusion for the AR Surveillance measure based on lack of access to discrete data elements.
No. Eligible hospitals and CAHs are encouraged to proceed to validated data production (Option 2) as soon as they are ready to do so.
Many eligible hospitals and CAHs already report Antimicrobial Use (AU) and/or Antimicrobial Resistance (AR) data to CDC’s NHSN. We expect they will attest to “Option 2 – Validated Data Production” for the EHR reporting period in 2024 if they are reporting both AU and AR data.
Similarly, some eligible hospitals and CAHs may move through registration (Option 1), testing and validation and begin submitting production data (Option 2) all within CY 2024. If their selected EHR reporting period begins after they have reached the point of submitting validated production data for both AU and AR, they can and should report to being in the Option 2 level of active engagement.
Beginning with the EHR reporting period in 2025, CMS considers AU Surveillance and AR Surveillance to be new measures. Therefore, eligible hospitals and CAHs that selected Option 1 as their level of active engagement for the AUR Surveillance measure in 2024 are encouraged, but not required, to progress to Option 2 in 2025. Eligible hospitals and CAHs needing additional time to submit AU and/or AR data can use 2025 to work through that process and attest to Option 1 again. Eligible hospitals and CAHs attesting to Option 1 for the AU and AR Surveillance measures in 2025 are required to move to Option 2 for both measures for the EHR reporting period in 2026.
Eligible hospitals and CAHs that are ready to send production AU and/or AR data to NHSN for the EHR reporting period in 2025 do not need to wait until the EHR reporting period in 2026 to do so. NHSN encourages eligible hospitals and CAHs to send production data as soon as they are ready.
Yes. If the eligible hospital completes registration of intent and validation of test files in 2023, the eligible hospital or CAH can use that documentation to attest to “Option 1 – Pre-production and Validation” for the EHR reporting period in 2024. Similarly, if the eligible hospital completes registration of intent and validation of test files in 2024, the hospital can use that documentation to attest to “Option 1 – Pre-production and Validation” for the EHR reporting period in 2025. However, hospitals are encouraged to proceed to “Option 2 – Validated Data Production” as soon as they are ready to do so.
Note: For the AU and AR Surveillance measures within the Medicare Promoting Interoperability Program, beginning with the EHR reporting period in 2025, eligible hospitals and CAHs can only spend one calendar year in “Option 1 – Pre-production and Validation.”
Eligible hospitals and CAHs should complete the registration of intent to submit AUR data within NHSN. Once registration is complete, they should work towards sending AUR files to the NHSN AUR Team for validation. Files sent to the NHSN AUR Team prior to November 1 will be processed in time for the eligible hospital or CAH to receive feedback prior to December 31. However, eligible hospitals and CAHs are not required to submit files for validation during the EHR reporting period. Eligible hospitals and CAHs can indicate “Option 1 – Pre-production and Validation” as their level of active engagement if they are working towards the creation of AUR files within that EHR reporting period. See Question 15 in Logistics for more information on attestations.
Per the Medicare Promoting Interoperability Program’s measure specifications, eligible hospitals and CAHs should respond to NHSN’s request for test files within 30 days following the request. The response should include the test files or a summary of their progress in setting up AUR Module reporting with their vendor. As long as the hospital replies within 60 days of the initial request from NHSN, no further updates are needed until the test files are ready for validation. Failure to respond to either the first or the second request for test files within an EHR reporting period will result in that eligible hospital not meeting minimum requirements of the measure.
If an eligible hospital or CAH is already reporting AUR data to CDC, it does not need to complete the validation process of sending test files to the NHSN Team. However, all eligible hospitals and CAHs must complete the registration step within NHSN regardless of where they are in the submission process.
In this example, eligible hospitals and CAHs can ignore the automated emails requesting test files sent by NHSN after they register intent if successfully submitting production files. If the eligible hospital or CAH is sending production AU and AR data to NHSN, they will be able to attest to being in active engagement and report their level of engagement as “Option 2 – Validated Data Production.” Eligible hospitals and CAHs attesting to “Option 2 – Validated Data Production” do not need official proof from NHSN of completing the validation process.
NHSN automatically sends letters to eligible hospitals and CAHs showing their AU and AR data submission status on the 1st of every month. A final letter is sent out on February 1, annually, with the previous year’s AU and AR data submissions to NHSN. Eligible hospitals and CAHs can use these reports to support their level of active engagement status in the event of an audit by CMS. Eligible hospitals and CAHs that have registered intent to submit AUR data can also generate ad hoc letters within NHSN by following the process outlined in Step 3 of the NHSN AUR Module guidance document. The letters should be retained on site, but do not get submitted to CMS, unless requested.
Note: Eligible hospitals and CAHs attest directly to CMS via CMS’ Hospital Quality Reporting system. CDC/NHSN has no role in the attestation process for the AUR Surveillance measure.
No, the AUR Surveillance measure (for the EHR reporting period in 2024) and the AU and AR Surveillance measures (for the EHR reporting period in 2025) are reported to CMS by hospital attestation. Eligible hospitals and CAHs attest “Yes/No” to being in active engagement with NHSN, and also indicate their level of active engagement. This information is reported to and collected in the CMS Hospital Quality Reporting (HQR) system. The NHSN application provides eligible hospitals and CAHs with documentation to use as proof in the event of a CMS audit (see previous FAQ). NHSN does not provide any AUR data to CMS nor does CMS request them, as the Medicare Promoting Interoperability Program is aimed at increasing interoperable healthcare data exchange.
No.
Eligible hospitals and CAHs must report a “yes” response or claim an applicable exclusion* for each of the required measures under the Public Health and Clinical Data Exchange objective to receive the full 25 points for that objective.
Failure to fulfill any of the required measures, including the AUR Surveillance measure, will result in a score of zero for the Medicare Promoting Interoperability Program. In such cases, the eligible hospital or CAH would not be considered a meaningful user of CEHRT and would be subject to a downward payment adjustment. CAHs will receive a downward Medicare payment adjustment from 101% of reasonable costs to 100%. Eligible hospitals will receive a reduction of 75% of their annual market basket update. Exclusions for measures and options for hardship exceptions also exist. Hardship exceptions can only be used for a maximum of 5 years.
*If an eligible hospital or CAH claims exclusions for all required measures in the Public Health and Clinical Data Exchange objective, the entire point value would be redistributed to the Provide Patients Electronic Access to Their Health Information measure under the Provider to Patient Exchange objective.
CMS Data Submission Requirements
Under the definition of ‘‘EHR reporting period for a payment adjustment year’’ at 42 CFR 495.4, for eligible hospitals and CAHs that are new or returning participants in the Medicare Promoting Interoperability Program, the EHR reporting period in 2024 and subsequent years is a minimum of any continuous 180-days.
Eligible hospitals and CAHs self-select any continuous 180-days in the calendar year from which to collect data for reporting. AU and AR data are reported to NHSN on an ongoing basis during the EHR reporting period. Eligible hospitals and CAHs then report or attest their active engagement status to CMS through the CMS hospital quality reporting (HQR) system annually, between January 1st and February 28th, unless otherwise specified by CMS.
For the EHR reporting period in 2024, eligible hospitals and CAHs must collect and report both AU and AR data during the same EHR reporting period or claim an applicable exclusion. The same self-selected EHR reporting period is used for all measures required by the Medicare Promoting Interoperability Program. Please reach out to your Quality Department, Information Technology Department and/or C-Suite team to determine an EHR reporting period that works best for your hospital.
Eligible hospitals and CAHs that attest to “Option 2 – Validated Data Production” for the AUR Surveillance measure for the EHR reporting period in 2024 or the AU and AR Surveillance measures in the EHR reporting period in 2025 must report data to NHSN on an ongoing basis during their self-selected EHR reporting period. Please see Question 15 in Logistics for more information on submitting your level of active engagement to CMS.
Eligible hospitals and CAHs submitting AUR data through NHSN’s AU and AR Options are required to complete a Monthly Reporting Plan for every month that they plan to submit AU and AR data prior to uploading data to NHSN. See Question 8 in Logistics.
For additional information on reporting AUR data, see:
For the Medicare Promoting Interoperability Program, eligible hospitals and CAHs attesting to “Option 2 – Validated Data Production” are expected to report any continuous 180-days’ worth of data to NHSN, as this is their self-selected EHR reporting period. The NHSN Team encourages those eligible hospitals and CAHs to continuously report data outside of their self-selected EHR reporting period to take full advantage of the available risk adjustment metrics and other analytic reports within NHSN.
While attestation/reporting for the Medicare Promoting Interoperability Program within CMS’ HQR system is completed at the CCN level, the NHSN Team encourages all NHSN facilities enrolled as eligible hospitals or CAHs to complete the steps for AUR reporting separately. This means each NHSN facility should complete the registration of intent and work towards sending test files. If the hospital wants to receive official documentation of completing the testing and validation step, each NHSN facility must send AUR files for validation. Each hospital should plan to submit their own production AUR data. After completing the registration of intent, each hospital will receive their own monthly AUR submission status report from NHSN.
Per Medicare Promoting Interoperability Program requirements, eligible hospitals and CAHs must use Certified EHR Technology (CEHRT) that has been updated to meet the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) Certification Criteria for Health IT. Eligible hospitals and CAHs can confirm whether their vendor has been certified by reviewing the Certified HealthIT Product List maintained by the ASTP/ONC. When searching, filter by Certification Criteria and then click the box for “170.315 (f)(6): Transmission to Public Health Agencies – Antimicrobial Use and Resistance Reporting” as shown in the screenshot below.
Additionally, per NHSN requirements, hospitals must use vendors that have completed the NHSN AU and AR Synthetic Data Set Validation requirements. Hospitals can find the list of vendors that have passed AU validation and AR validation on NHSN’s website.
NHSN Data Submission Requirements
The AUR Surveillance measure for the EHR reporting period in 2024 and the AU and AR Surveillance measures for the EHR reporting period in 2025 for the Medicare Promoting Interoperability Program are a hospital-level requirement, submitted by CMS Certification Number (CCN). The measure requires the eligible hospital or CAH to submit data from inpatient or emergency department settings (Place of Service [POS] 21 or 23).
NHSN strongly encourages the submission of data from all NHSN-defined inpatient locations (including procedural areas like operating rooms), facility-wide inpatient (FacWideIN), and select outpatient acute care settings (specifically, outpatient emergency department [ED], pediatric ED, and 24-hour observation area) from which the numerator and denominator data can be accurately captured. Eligible hospitals and CAHs would attest “Yes” if AU Summary, AR Event [numerator], and AR Summary [denominator] data were submitted to NHSN for all locations meeting the above criteria for each month during the self-selected EHR reporting period. A comprehensive submission to NHSN will enable a hospital or CAH to optimize inter- and/or intra-facility comparisons among specific wards, combined wards, and facility-wide data.
As described in the preceding FAQ, NHSN encourages all hospitals and CAHs to submit AUR data from all inpatient locations and select outpatient locations where numerator and denominator data can be accurately captured. This includes:
- Inpatient rehabilitation units (IRF) that are mapped as a location within the eligible NHSN hospital or critical access hospital (regardless of IRF unit CCN)
- Inpatient psychiatric units (IPF) that are mapped as a location within the eligible NHSN hospital or critical access hospital (regardless of IPF unit CCN)
- Skilled nursing/long term care units that are mapped as a location within the eligible NHSN hospital or critical access hospital
- Swing beds that are mapped as a location within the eligible NHSN hospital or critical access hospital
This excludes:
- IRF units that are enrolled in NHSN as a separate NHSN facility using the HOSP-REHAB facility type. However, AUR data can be reported within this separately enrolled NHSN facility.
- IPF units that are enrolled in NHSN as a separate NHSN facility using the HOSP-PSYCH facility type. However, AUR data can be reported within this separately enrolled NHSN facility.
- Skilled nursing/long term care units that are enrolled in the NHSN Long Term Care Facility Component as a separate NHSN facility
- All outpatient clinic locations
Deadlines
Eligible hospitals and CAHs must submit attestations through the CMS HQR system, ensuring they have met all of the program’s requirements annually, between January 1st and February 28th, unless otherwise specified by CMS. Measure-specific exclusions are also submitted through the HQR system at the same time. An HQR User Guide can be found in the CMS Resource Library: Resource Library | CMS.
Per Medicare Promoting Interoperability Program measure specifications, eligible hospitals and CAHs must register their intent to submit AUR data within 60 days of the start of their designated self-selected EHR reporting period. Once the eligible hospital or CAH completes the registration process, it will receive an automated email from NHSN to send test files for validation. Per the CMS measure specifications, eligible hospitals and CAHs should respond to the request for test files within 30 days following the request for test files. The response should include the test files or a summary of the eligible hospital or CAH’s progress in setting up AUR Module reporting. If the hospital replies within 60 days, no further updates are needed until the test files are ready for validation. Failure to respond to either the first or the second request for test files within an EHR reporting period results in the eligible hospital or CAH not meeting measure requirements.
Please allow up to 8 weeks from receipt of test files for the NHSN Team to complete the validation of your test files.
Eligible hospitals and CAHs can attest “Yes” to “Option 1 – Pre-production and Validation” if they are working towards the creation of AUR files within the EHR reporting period. However, if your eligible hospital or CAH wants a letter from NHSN denoting the validation stage is complete, you must have passing test files relevant to the measure(s) you plan to attest to. Specifically, for the AUR Surveillance measure for the EHR reporting period in 2024 please send three files: AU Summary, AR Event (numerator) and AR Summary (denominator). With the measures being split for the EHR reporting period in 2025, eligible hospitals and CAHs can send test files for one or both measures. We ask eligible hospitals and CAHs that would like official record of completing the test file process to submit test files no later than November 1, to allow the NSHN AUR Team time to process the test files.
Please go ahead and complete the registration of intent within NHSN as soon as possible.
Per CMS specifications, eligible hospitals and CAHs that attest to “Option 2 – Validated Data Production” for the AUR Surveillance measure must report on an ongoing basis during their self-selected 180-day EHR reporting period. NHSN automatically sends out letters to the NHSN Facility Administrator and Medicare Promoting Interoperability Program contacts (designated in the NHSN application) showing the registered hospital’s status with reporting on the 1st of every month. A final letter is sent out on February 1 with the prior year’s submissions. As an example, 2024 AUR data must be submitted to NHSN no later than January 31, 2025 in order to be included on the February 1, 2025 status report.
No. Reporting of healthcare-associated infection data and healthcare personnel vaccination data for CMS Quality Reporting Program requirements is separate from the Medicare Promoting Interoperability Program. The AUR Surveillance (2024), AU Surveillance and AR Surveillance (2025) measures within the Medicare Promoting Interoperability Program do not have quarterly deadlines. Eligible hospitals and CAHs planning to attest to “Option 2 – Validated Data Production” should report their AUR data into NHSN on an ongoing basis during their self-selected 180-day EHR reporting period. Eligible hospitals and CAHs submit Medicare Promoting Interoperability Program data/attestations in the CMS HQR system annually, during the HQR open period which is typically from January 1 – February 28, unless otherwise specified by CMS.
Logistics
If your eligible hospital or CAH meets the criteria for an exclusion for the AUR Surveillance measure and selects the applicable exclusion within HQR, then you do not need to complete the registration of intent with NHSN.
If your hospital already completed the registration of intent within NHSN but plan to claim an exclusion, you do not need to provide NHSN with test files for the calendar year in which your hospital is claiming an exclusion.
Only the NHSN Facility Administrator can complete this task. They will log into NHSN, click “Facility” then “AUR PI Registration” on the left-hand navigation bar.
On the AUR Promoting Interoperability (PI) Program Registration page, read the text and check the box to automatically add your name and the hospital name to the form:
Add up to two optional email addresses for individuals, aside from the NHSN Facility Administrator, who will be involved in the Medicare Promoting Interoperability Program process and who will receive copies of submission documentation. These people do not need to have NHSN credentials. Adding the email address on this screen ensures they will receive the automated emails regarding your hospital’s AUR submission status. Of note, adding the optional PI Program contact person’s email address on the registration screen will not start the process to become an NHSN User. If they are not NHSN users, they will not be able to log into NHSN.
Verify all information is correct and click the “Save” button. Click “Yes” on the pop-up alert to confirm your hospital’s registration of intent to submit AU and AR data.
Note: If the person listed as your NHSN Facility Administrator no longer works at your hospital, please submit a request for that role to be reassigned.
Per the CMS measure specifications, eligible hospitals and CAHs should respond to the request for test files within 30 days. Failure to respond to either the first or the second request for test files within an EHR reporting period will result in that eligible hospital or CAH not meeting the measure’s requirements. If the eligible hospital or CAH registers intent to submit AUR data within NHSN prior to having test files ready, they should reply to the request for test files with their current status.
However, eligible hospitals and CAHs are not required to submit files for validation during the EHR reporting period. They can attest “Yes” to “Option 1 – Pre-production and Validation” as long as they are working towards the creation of AUR files within the EHR reporting period.
Per Medicare Promoting Interoperability Program requirements, eligible hospitals and CAHs must use Certified EHR Technology (CEHRT) that has been updated to meet the ASTP/ONC Certification Criteria for Health IT. Additionally, per NHSN requirements, eligible hospitals and CAHs must use a software vendor that has completed the NHSN AU and AR Synthetic Data Set (SDS) Validation requirements.
See more on vendor requirements in Question 5 of the CMS Data Submission Requirements section.
These files should be regular CDA files but contain test data without protected health information (PHI) or personally identifiable information (PII). This step requires the hospital to send one CDA file of each type for the measure(s) you plan to attest to: AU Summary, AR Event (numerator) and/or AR Summary (denominator). First, check with your AUR reporting software vendor as many have created test files to use for this purpose. If your vendor is unable to provide files with test data, you can send production files for validation. However, please be sure to send these via secure email to NHSNCDA@cdc.gov. If possible, please only include one CDA file for each file type: AU Summary, AR Event (numerator) and AR Summary (denominator).
No. There is no penalty for submitting test files that do not pass the initial round(s) of validation by the NHSN Team. However, eligible hospitals and CAHs should make every attempt to submit what they believe to be valid AUR CDA files. Please only send CDA files with the extension .xml. Eligible hospitals and CAHs should send all relevant files for a specific measure at the same time since a passing letter cannot be generated until all files have been validated.
As a reminder, eligible hospitals and CAHs are not required to submit files for validation during the EHR reporting period. They can attest “Yes” to “Option 1 – Pre-production and Validation” if they are working towards the creation of AUR files within the EHR reporting period.
If an eligible hospital or CAH would like an official letter from NHSN showing that the testing and validation step is complete then yes, they should email the relevant files according to the measure they plan to attest to: AU, AR Event and/or AR Summary.
The NHSN Facility Administrator and up to two additional email addresses specified on the AUR Medicare Promoting Interoperability Registration page in NHSN can receive the automated compliance emails. The Facility Administrator can add the additional emails within NHSN on the Facility > AUR PI Registration page. These emails can be updated at any time on the same page.
Yes, the NHSN Facility Administrator can generate an ad hoc compliance report at any time. After logging into the NHSN facility, click “Facility” then “AUR PI Registration” on the left-hand navigation bar.
On the AUR Promoting Interoperability (PI) Program Registration page, click “Reports”:
On the Request for AUR PI Program Status Report page, select the year of report desired then click “View Report”:
Once generated, the report can be emailed, printed, or downloaded.
We recommend at least two people be educated users for AUR Module reporting. It’s most common for either the pharmacist or the infection preventionist to update the monthly reporting plans within NHSN and submit the AUR data, though any NHSN user with appropriate rights can fulfill these responsibilities. It’s also important for eligible hospitals and CAHs to designate who will review and validate submitted data and who will run reports and analyze the data. You can divide these tasks the way that works best for your hospital. Assuming you will need to add new user(s) to your NHSN hospital, please follow the steps to ensure the new user(s) has the necessary rights to perform relevant tasks: User Rights in NHSN AUR Module (cdc.gov).
For NHSN purposes, we encourage eligible hospitals and CAHs to submit the validated AUR data they have available. If the switch happens in the middle of the month, submit from the vendor system that’s captured the larger portion of the month. Please also make a note for your internal analysis and presentation purposes that for the given month, only a partial month of data were submitted to NHSN.
For the Medicare Promoting Interoperability Program, if an eligible hospital or CAH switches vendors, they still need to submit data or attestations for their self-selected 180-day EHR reporting period.
The Missing Data Alerts appear in NHSN for any location in your Monthly Reporting Plan for which you haven’t yet submitted data for, but the month has passed. For example, if you listed FacWideIN, MedWard1, and MedWard2 in your January reporting plan to report AU data but then only uploaded one AU file for FacWideIN, you’ll see Missing Summary data alerts for the January AU data for MedWard1 and MedWard2. In this case, your monthly AUR submission status report would show “Yes” for AU for January because you uploaded FacWideIN data, but you should still work with your software vendor to find AU files for all eligible locations.
Similarly, if you’re seeing an alert for Missing AR Event data, first determine if you had any isolates that met eligibility criteria for the month (see General Submission Requirements AR FAQs). If so, work with your software vendor to find those AR Event files. If your hospital did not have any isolates that met eligibility criteria for a given month, follow the steps to report No AR Events.
Eligible hospitals and CAHs do not indicate their self-selected EHR reporting period within NHSN. That information is entered into the CMS HQR system. Within NHSN, eligible hospitals and CAHs should add AUR reporting to their Monthly Reporting Plans prior to uploading AUR data.
Eligible hospitals and CAHs do not attest to Option 1 or Option 2 within NHSN. The attestations for the AUR Surveillance measure are completed in the CMS HQR system once a year, indicating their level of active engagement from the prior year.
Exclusions are not reported within the NHSN application. Eligible hospitals and CAHs report measure exclusions at the same time they are reporting/attesting to other Medicare Promoting Interoperability Program measures within the CMS HQR system. Eligible hospitals and CAHs should reach out to the CMS Subject Matter Experts for assistance on claiming an exclusion. They can be reached using the QualityNet Question and Answer tool available on the QualityNet.cms.gov website. To access the tool, click on the “Help” tab in the upper right-hand corner, then select “Question and Answer Tool Main Page,” then select “Ask a Question.” From there, choose “PI – Promoting Interoperability” from the Program dropdown menu. You may also contact CMS live Support Center Help Desk at (844) 472-4477.
Additional Resources
You can find more information, including measure specifications, FAQs and recorded webinars on the CMS Promoting Interoperability Programs page.
If you have SAMS credentials you can submit a ticket to the NHSN Helpdesk using this link: https://servicedesk.cdc.gov/epp. If you do not have SAMS credentials you can email us at NHSN@cdc.gov.
For questions related to the Promoting Interoperability Program requirements, please reach out to CMS Subject Matter Experts using the QualityNet Question and Answer tool available on the QualityNet.cms.gov website. To access the tool, click on the “Help” tab in the upper right-hand corner, then select “Question and Answer Tool Main Page,” then select “Ask a Question.” From there, choose “PI – Promoting Interoperability” from the Program dropdown menu. You may also contact CMS live Support Center Help Desk at (844) 472-4477.
Additionally, you can find answers to frequently asked questions by searching the Program Articles. To do so, from the Question and Answer Tool’s home page, select “Browse” and choose “PI – Promoting Interoperability” or any other program from the dropdown menu. You can access the Knowledge Base directly here: Knowledge Base – QualityNet (servicenowservices.com).
