NHSN Reporting Requirements for Hospitals: Mandatory Measures, Deadlines, and the CMS IQR Link

NHSN reporting is not one submission — it is an ongoing, module-by-module data feed that an infection preventionist or quality department maintains every month, for every applicable patient-care location, for as long as the hospital is subject to a reporting requirement. That makes it fundamentally different from a once-a-year facility-characteristics submission like the NHSN Annual Hospital Survey: the Annual Survey describes what the facility is (bed count, ICU types, staffing model); ongoing HAI-event reporting describes what happens in it, continuously, and is what CMS actually scores for payment purposes. This guide covers the ongoing side: which modules are genuinely mandatory versus voluntary, how the monthly reporting plan works, the deadline mechanics, and what CMS does with the data once it lands.

Which HAI Modules Are Actually Mandatory — Not Just Available

NHSN’s Patient Safety Component offers more surveillance modules than any one hospital is required to run. The distinction that matters operationally is between modules CMS has tied to a payment program and modules a facility runs voluntarily for its own quality-improvement purposes (or because a state health department mandates it independently of CMS). For the Hospital Inpatient Quality Reporting (IQR) Program, the HAI measures CMS has required in recent program years are:

• CLABSI — central line-associated bloodstream infection, adult, pediatric, and neonatal ICUs plus applicable wards (see CASRAI’s CLABSI surveillance guide for the LCBI criteria that determine whether a given bloodstream infection counts).
• CAUTI — catheter-associated urinary tract infection, the same ICU/ward location scope as CLABSI (see the CAUTI guide for SUTI criteria).
• SSI — surgical site infection following colon procedures and abdominal hysterectomy specifically, not the full NHSN SSI operative-procedure category list.
• MRSA bacteremia LabID Event — a laboratory-identified event measure, distinct from clinically adjudicated CLABSI/CAUTI cases; it counts positive lab results meeting a specimen-source and timing rule, not a chart-reviewed infection determination.
• Clostridioides difficile (CDI) LabID Event — the same LabID logic applied to C. diff toxin/NAAT-positive stool specimens.
• Healthcare Personnel (HCP) Influenza Vaccination Summary — a facility-level staff vaccination rate, not a patient-event measure, but reported through the same NHSN Patient Safety Component and required for IQR.

Modules like VAE and hemovigilance are real, actively maintained NHSN modules that plenty of hospitals run — but they are not, as a rule, part of the CMS IQR measure set the way the six above are. A hospital’s infection-prevention program may still be required to report them under a state HAI-reporting statute, an accreditor requirement, or the hospital’s own Hospital-Acquired Condition (HAC) reduction strategy, which is a separate reason to run the module than “CMS IQR requires it.” Because the required measure set is set annually in the CMS IQR Specifications Manual and can change between program years, confirm the current list on QualityNet before finalizing a reporting plan rather than relying on a prior year’s scope from memory.

The Monthly Reporting Plan: Why “We Entered the Data” Isn’t the Same as “We Reported”

NHSN does not infer a facility’s reporting scope from the events it enters. Every enrolled facility maintains an explicit monthly reporting plan inside NHSN: for each patient-care location, for each month, the facility declares which modules are “in plan” for that location. CMS checks compliance against the plan, not just against raw event counts — a location that should have been marked in-plan for CLABSI but wasn’t, even if a CLABSI case from that unit happens to be entered somewhere else in the system, can still register as a gap.

This is the single most common source of an avoidable IQR compliance problem: the plan itself is stale. A new ICU opens, a unit is renamed or merged, a step-down unit starts taking central lines it didn’t before — and the reporting plan doesn’t get updated to match. Practically, that means the reporting plan needs its own owner and its own monthly checkpoint, separate from the person entering individual HAI events, with a standing task to confirm the plan matches the current unit list before that month closes.

Submission Windows and the Deadline Calendar

NHSN HAI data is submitted on a rolling basis throughout the quarter as events and denominator data occur, but CMS sets a hard cutoff after which a given calendar quarter’s data is locked for IQR purposes. Across recent IQR program years this cutoff has generally landed roughly four and a half months after the quarter closes — for example, first-quarter (January–March) data due in mid-August. Treat that cadence as a planning baseline, not a citable exact date: the CMS Hospital IQR Specifications Manual sets the precise deadline for each measure and each quarter every program year, and it is the only source that should be used to schedule an actual submission or confirm a compliance-sensitive date. Missing the window for even one location’s one module in one quarter can register as an incomplete quarter for that measure, which is why the reporting-plan checkpoint above needs to run well before the deadline, not in the final week.

Two details catch programs off guard. First, denominator data (patient-days, device-days, procedure counts) has to be submitted alongside the numerator event data — a quarter with correctly entered infection events but missing or incomplete denominator counts is not a complete quarter, and it also distorts the facility’s own Standardized Infection Ratio once that denominator is used as the model’s expected-infections base. Second, NHSN allows data correction after initial submission, but corrections made after CMS pulls the dataset for a given reporting period do not retroactively fix that period’s IQR compliance determination — corrections matter for accuracy of the historical record, not for having met that quarter’s deadline.

What CMS Does With the Data: Three Programs, One Feed

The same NHSN submission gets pulled into more than one CMS program, and each one scores it differently:

• Hospital IQR Program — a pay-for-reporting program. CMS checks whether the required measures were submitted completely and on time, largely independent of how good or bad the actual infection rates are. A hospital that reports a high CLABSI rate is still IQR-compliant if it reported completely; a hospital that reports nothing for a required measure and location is not, regardless of how well it’s actually doing on infection prevention. Non-compliance affects the hospital’s annual payment update.
• Hospital-Acquired Condition (HAC) Reduction Program — a pay-for-performance program that takes the same NHSN HAI data (converted into Standardized Infection Ratios) and combines it with AHRQ PSI-90 data into a composite score. Hospitals in the worst-performing quartile take a flat payment penalty, independent of the IQR reporting determination — a hospital can be fully IQR-compliant and still land in the HAC penalty quartile because its risk-adjusted rates were comparatively worse than its peers’.
• Hospital Value-Based Purchasing (VBP) Program — folds a subset of the same NHSN-derived infection measures into a broader domain score alongside patient experience, mortality, and other clinical-outcome measures, redistributing a portion of Medicare payment based on relative performance.

The practical consequence is that one gap in the underlying NHSN submission — a missed reporting-plan location, an incomplete denominator, a late correction — doesn’t just risk an IQR flag. It can also distort the SIR that feeds HAC Reduction Program scoring and, downstream, the VBP domain score, because all three programs are reading from the same NHSN dataset rather than three independent ones. That’s the argument for treating NHSN data completeness as a single cross-program compliance task owned by one person, rather than three separate downstream problems each program’s own compliance staff discovers separately.

A Working Checklist for the IP or Quality Team

• Confirm the monthly reporting plan matches the current unit list — including any newly opened, renamed, or merged location — before the month closes, not after.
• Assign denominator-data collection (patient-days, device-days, procedure counts) to a named owner with the same monthly cadence as event entry; a quarter isn’t complete without it.
• Run a monthly internal review of entered events against source documentation (line/catheter logs, culture results, OR logs for the applicable SSI procedures) rather than waiting for a quarterly reconciliation.
• Confirm LabID mapping for MRSA bacteremia and CDI against the current lab interface whenever the microbiology or clinical lab system changes vendors or result-coding format.
• Check the current-year CMS IQR Specifications Manual for the exact measure list and submission deadlines before finalizing next year’s reporting plan — don’t carry forward the prior year’s scope by default.
• Treat a completed quarter as “submitted and denominators complete,” not “events entered” — the two are checked separately by CMS.

Frequently Asked Questions

Is NHSN reporting mandatory for every hospital?

NHSN enrollment and reporting is mandatory for hospitals participating in the Hospital IQR Program for the specific measures and locations CMS requires — which functionally covers essentially all short-term acute-care hospitals paid under the Inpatient Prospective Payment System, since IQR compliance affects the annual payment update. Facilities outside IPPS (some critical access hospitals, for example) may face NHSN reporting obligations through a different mechanism, such as a state HAI-reporting statute, rather than through Hospital IQR specifically — the reporting requirement’s source matters for figuring out exactly which modules apply.

What happens if a hospital misses a required NHSN measure for a quarter?

The immediate consequence runs through the Hospital IQR Program: an incomplete or missed submission for a required measure and location can result in the hospital being scored as non-compliant for that reporting period, which affects the annual payment update. Because the same data also feeds the HAC Reduction Program’s SIR calculations and the VBP domain score, an incomplete denominator or missing event data can distort those downstream scores as well, independent of the direct IQR penalty.

Do CLABSI, CAUTI, and SSI reporting cover every unit in the hospital?

No — the IQR-required scope is specific locations, not the whole facility: adult, pediatric, and neonatal ICUs and applicable wards for CLABSI and CAUTI, and colon-procedure and abdominal-hysterectomy cases specifically for SSI, not the full NHSN operative-procedure category list. A hospital may choose to run broader surveillance voluntarily, but the CMS-required scope is narrower than “every patient-care area.”

How is this different from the NHSN Annual Hospital Survey?

The Annual Hospital Survey is a once-a-year submission describing the facility itself — bed counts, ICU configuration, staffing model, and similar structural characteristics — and it’s the basis CMS uses for risk-adjusting some NHSN measures. The HAI-event reporting covered in this guide is ongoing: ICU-, ward-, and procedure-level surveillance data entered continuously throughout the year and submitted on a quarterly cutoff. A facility completes both, but they’re different submissions on different cycles serving different purposes.

Does correcting NHSN data after the deadline fix a hospital’s IQR compliance for that quarter?

Corrections improve the accuracy of the historical NHSN record and matter for internal quality tracking, but a correction submitted after CMS has pulled a given period’s dataset does not retroactively change that period’s IQR compliance determination. That’s part of why the reporting-plan and denominator checkpoints in the checklist above need to happen well ahead of the deadline rather than as a post-deadline cleanup step.

This guide is a planning reference for infection-prevention and quality teams, not a substitute for the current-year CMS Hospital IQR Specifications Manual, which is the authoritative source for the exact required measure list, applicable locations, and submission deadlines for any given program year.