Written and maintained by CASRAI Editorial Board
Last updated
The Hospital-Acquired Condition (HAC) Reduction Program is a Medicare payment program, not a coding rule. It ranks every applicable hospital against its peers on a composite quality score and cuts total Medicare payments by 1 percent for the worst-performing quartile — a flat penalty that applies regardless of how far into that quartile a hospital falls. For infection preventionists, patient-safety officers, quality directors, and risk managers, the operational reality is that a program built almost entirely from data your teams already own (NHSN infection surveillance, PSI-90 claims data) determines a real payment outcome you can only influence up to two years before it lands.
This guide covers the measure set behind the Total HAC Score, how the worst-performing quartile is identified, why the penalty is a cliff rather than a slope, and where this program stops and two adjacent, frequently-confused mechanisms start.
Not the Same Thing as HAC-POA Coding
“HAC” gets used for two genuinely separate CMS mechanisms, and conflating them is a common error on a quality dashboard:
- The HAC payment provision under the DRG system (Deficit Reduction Act of 2005 §5001(c)) is a claim-level rule: if a condition on CMS’s designated HAC list is coded as not present on admission (POA indicator N or U), the claim loses its ability to be paid at a higher-paying DRG for that diagnosis. It runs directly off the POA field on the individual claim — see CASRAI’s guide to POA indicator coding for the Y/N/U/W mechanics themselves.
- The HAC Reduction Program (HACRP) covered here is a separate, hospital-level payment adjustment authorized by §1886(p) of the Social Security Act (added by the Affordable Care Act, effective October 1, 2014) and codified at 42 CFR §§412.170–412.172. It has nothing to do with any individual claim’s POA flag. It combines a hospital’s PSI-90 composite score with its NHSN healthcare-associated infection data into a single ranking, and applies a payment cut to hospitals in the worst quartile of that ranking.
A hospital can be fully compliant on POA coding and still land in HACRP’s worst-performing quartile, and a hospital with a clean HACRP score can still lose DRG upgrades on individual HAC-list claims. They are scored from overlapping data but are not the same mechanism, and neither one predicts the other. For the claims-based PSI methodology that feeds HACRP’s first domain, see CASRAI’s guide to AHRQ Patient Safety Indicators and the PSI 90 composite.
The Measure Set: Two Domains, One Score
HACRP does not introduce its own clinical measures. It repurposes two measure sets a hospital is already reporting elsewhere into a single composite, the Total HAC Score:
- Domain 1 — CMS PSI-90: AHRQ’s Patient Safety and Adverse Events Composite, built from ICD-10-CM/PCS-coded claims data and POA indicators. It is not a single measure but a harm- and volume-weighted composite of several individual Patient Safety Indicators (pressure ulcers, in-hospital falls with hip fracture, postoperative complications, and similar administrative-data screens). See the linked PSI-90 guide above for how the composite is actually built.
- Domain 2 — CDC NHSN healthcare-associated infection measures: standardized infection ratios (SIRs) reported through the CDC’s National Healthcare Safety Network, drawn from the same core HAI measure set CMS also uses in the Hospital VBP Safety domain — CLABSI, CAUTI, surgical site infection (colon and abdominal hysterectomy procedures), MRSA bacteremia, and C. difficile infection (CDI). See CASRAI’s guide to the Hospital VBP Total Performance Score for how the same five NHSN measures function inside that separate program.
The regulation is explicit that CMS calculates the Total HAC Score “by weighing the selected measures according to the established methodology” (42 CFR §412.172(e)(3)) — the actual domain weighting is not written into the CFR text itself. It is set through CMS’s annual scoring methodology and has moved over the life of the program (early program years weighted the NHSN domain far more heavily than PSI-90; CMS later moved toward parity between the two domains). Treat any specific current-year split you see cited elsewhere as something to confirm against that fiscal year’s HACRP scoring methodology documentation on QualityNet, not as a fixed feature of the regulation — the same caution CASRAI gives for Hospital VBP’s domain weights, which are set the same way.
How the Applicable Period Works
HACRP scores hospitals on a rolling 24-month applicable period, defined at 42 CFR §412.170. As an example of the structure (FY 2022): the PSI-90 window ran July 1, 2018 – June 30, 2020, while the NHSN HAI window ran January 1, 2019 – December 31, 2020 — the two domains’ data-collection windows don’t line up exactly, and each subsequent fiscal year’s window advances by one year from the prior year’s. In practice, this means the payment consequence a hospital feels in a given fiscal year reflects performance from roughly one-and-a-half to two years earlier, not the current year’s infection-prevention or coding performance — a lag worth building into how a quality committee interprets a bad HACRP result.
The Worst-Performing Quartile: A Cliff, Not a Slope
This is the mechanic most worth understanding precisely, because it is routinely misdescribed as a graduated or proportional penalty. It is not. Under 42 CFR §412.172(e)(2), CMS ranks every applicable hospital by Total HAC Score and identifies the 25 percent of hospitals with the highest total scores — “highest” being worst, since every underlying measure here counts adverse events. Every hospital in that top quartile receives the identical payment adjustment: a 99 percent payment multiplier, i.e. a flat 1 percent reduction to Medicare payments for all discharges during the payment year (§412.172(b)).
There is no sliding scale inside that quartile. A hospital that barely crosses into the worst-performing 25 percent receives the same 1 percent cut as a hospital with the single highest Total HAC Score in the country. Conversely, a hospital just outside the cutoff — at the 74th percentile of Total HAC Score — receives no HACRP penalty at all. Two hospitals with nearly identical underlying infection and safety-indicator performance can land on opposite sides of that line and see a full percentage-point difference in payment, purely because of where the national distribution’s quartile boundary happened to fall that year. This threshold-based design is also why year-over-year HACRP status is a relatively noisy signal on its own: modest shifts in the national distribution, not just a hospital’s own performance, can move a hospital across the line in either direction.
The 1 percent reduction also does not stand alone. HACRP sits in the same 42 CFR Part 412, Subpart I as the Hospital Readmissions Reduction Program (HRRP, §§412.150–412.154) and Hospital VBP (§§412.160–412.168), and CMS applies these adjustments in a defined sequence: HRRP and VBP payment adjustments are applied first, and the HACRP 1 percent reduction is applied after them, to the result. A hospital that is also in HRRP’s readmission-penalty range or below VBP’s break-even score is stacking payment reductions from genuinely independent programs, not one blended penalty — see CASRAI’s guide to the Hospital Readmissions Reduction Program for how that separate penalty is calculated.
Reporting, Correction, and the Limits on Appeal
CMS provides each applicable hospital a confidential hospital-specific report with its underlying discharge-level data. Hospitals have 30 days after receipt to review and submit corrections (42 CFR §412.172(f)) — but with an important carve-out: the administrative claims data underlying PSI-90 is explicitly not subject to review and correction through this process. If a PSI-90 case was miscoded, the fix has to happen upstream, in the claims and coding workflow itself (which is exactly where accurate POA indicator assignment matters — see the POA guide linked above), not through a post-hoc HACRP correction request.
HACRP also has a narrower appeal path than its Subpart I neighbors. Under 42 CFR §412.172(g), several core elements of the program — including the criteria that define an applicable hospital and the applicable period itself — are explicitly not subject to administrative or judicial review. A hospital that disputes the scoring methodology or the payment reduction on the merits has meaningfully less recourse here than it would in disputing a Hospital VBP domain score, where CMS’s own regulation enumerates specific reviewable issues. Hospitals can still request an Extraordinary Circumstance Exception (ECE) within 60 calendar days of a qualifying event (systemic data problems, natural disasters, and similar circumstances that affect a hospital’s ability to submit data), the same 60-day window used elsewhere in this Subpart.
What This Means for a Patient-Safety Program
- Infection preventionists: because the NHSN HAI domain and PSI-90 domain are scored on data your team already produces, real-time internal tracking of standardized infection ratios (SIRs) against the CDC’s predicted-infection baselines is the closest thing to an early-warning system HACRP offers — by the time the official Total HAC Score arrives, the applicable period it reflects is already 1–2 years in the past.
- Patient-safety officers and quality directors: because the worst-quartile cutoff is a moving, relative threshold (not a fixed absolute score), track your hospital’s Total HAC Score trend and its distance from prior years’ cutoffs, not just whether last year’s score cleared or missed the line. A stable score can still cross the line if peer hospitals improve faster than yours does.
- Risk managers: build the 30-day correction window and the narrow scope of what’s actually correctable (NHSN-side, not claims-side) into your HACRP response workflow before the confidential report arrives, and don’t plan around an appeal of the scoring methodology itself — the regulation forecloses that path for several of the program’s core elements.
Frequently Asked Questions
Is the HAC Reduction Program the same as PSI-90?
No. PSI-90 is one of two inputs into the HACRP Total HAC Score (the other is the CDC NHSN HAI domain) — a hospital’s PSI-90 result heavily influences its HACRP outcome but is not the whole score, and PSI-90 also has uses outside HACRP entirely (public reporting, other quality programs).
How is the 1 percent HAC Reduction Program penalty different from HRRP or Hospital VBP?
All three sit in the same part of Medicare’s regulations (42 CFR Part 412, Subpart I) but are independent programs measuring different things — HRRP scores excess readmissions, Hospital VBP scores a broader four-domain quality composite with a graduated incentive/penalty, and HACRP scores only patient-safety and infection measures with a flat 1 percent cut for the worst quartile. A hospital can be penalized under one, two, or all three in the same fiscal year, and the HACRP reduction is applied after the HRRP and VBP adjustments, not blended with them.
Can a hospital appeal being placed in the worst-performing quartile?
Only in a limited way. Hospitals get 30 days to review and correct their hospital-specific report (though the underlying claims data is not correctable through this process), and can request an Extraordinary Circumstance Exception within 60 days of a qualifying event. But 42 CFR §412.172(g) explicitly excludes several core program elements — including the criteria for which hospitals count and the applicable period — from administrative or judicial review.
Does a hospital’s HAC Reduction Program penalty reflect its current infection-prevention performance?
Not directly. The applicable period used to calculate a given fiscal year’s Total HAC Score is a 24-month window that ends well before the payment year begins, so a penalty applied this year reflects performance from roughly one-and-a-half to two years earlier, not current performance.
