Surgical Site Infection (SSI): NHSN Definitions and Surveillance

SSI (surgical site infection) is a National Healthcare Safety Network (NHSN) surveillance category defined in the CDC NHSN Patient Safety Component Manual, Procedure-associated Module, Chapter 9 (Surgical Site Infection Event), January 2024 edition — the most recent edition available for direct verification. Unlike CLABSI, CAUTI, and VAE, the SSI protocol does not use the infection window period (IWP), present-on-admission (POA), healthcare-associated infection (HAI), or repeat infection timeframe (RIT) definitions that those three surveillance types share; SSI runs on its own logic, triggered by a specific list of NHSN operative procedures rather than by continuous device-days. Surveillance begins the moment a qualifying operative procedure is performed, and every case is monitored for the deepest tissue level at which NHSN’s criteria are met — superficial incisional, deep incisional, or organ/space — over a surveillance period fixed by the procedure category itself, not a flat window. This guide works through that structure using NHSN’s own criteria; confirm the current-year manual chapter before using any of this for official reporting, since NHSN revises the manual annually, typically each January.

The Three Tissue-Depth Classifications

Every SSI is classified by how deep it reaches, and NHSN requires reporting the deepest tissue level at which criteria are met during the surveillance period — a case that meets both superficial and organ/space criteria is reported as organ/space, not superficial.

• Superficial incisional SSI — involves only skin and subcutaneous tissue of the incision, within 30 days of the procedure (all procedure categories get a flat 30-day window for this level). Meets criteria via purulent drainage from the superficial incision; an organism identified from an aseptically-obtained specimen by culture or non-culture microbiologic testing; a superficial incision deliberately opened by a surgeon or designee (with no culture performed) plus at least one of localized pain/tenderness, localized swelling, erythema, or heat; or a physician diagnosis of superficial incisional SSI. Diagnosis/treatment of cellulitis alone, a stitch abscess alone, or a stab-wound/pin-site infection do not qualify. Two subtypes exist: Superficial Incisional Primary (SIP, the main incision) and Superficial Incisional Secondary (SIS, a secondary incision such as a donor site).
• Deep incisional SSI — involves deep soft tissue of the incision (fascial and muscle layers), within 30 or 90 days per the procedure category (see below). Meets criteria via purulent drainage from the deep incision; a deep incision deliberately opened, aspirated, or spontaneously dehisced, with an organism identified (or testing not performed) plus fever >38°C or localized pain/tenderness; or an abscess or other evidence of infection on gross anatomical exam, histopathology, or imaging. Subtypes: Deep Incisional Primary (DIP) and Deep Incisional Secondary (DIS).
• Organ/space SSI — involves any part of the body deeper than the fascial/muscle layers that was opened or manipulated during the procedure, within 30 or 90 days per the procedure category. Meets criteria via purulent drainage from a drain placed into the organ/space; an organism identified from organ/space fluid or tissue by culture or non-culture testing; or an abscess or other evidence of infection involving the organ/space. Organ/space SSI is further assigned to one of roughly two dozen specific infection sites — mediastinitis, endocarditis, meningitis or ventriculitis, periprosthetic joint infection, intraabdominal infection, deep pelvic or reproductive-tract infection, vaginal cuff infection, osteomyelitis, and endometritis among them — each governed by the site-specific criteria in NHSN Chapter 17 (Surveillance Definitions for Specific Types of Infections), not restated in the SSI chapter itself.

The Surveillance Period Runs 30 or 90 Days — Set by the Procedure Category

Each NHSN operative procedure category carries its own SSI surveillance period, listed in the manual’s Table 2, with day 1 defined as the date of the procedure:

• 30-day categories include appendix surgery (APPY), gallbladder surgery (CHOL), colon surgery (COLO), cesarean section (CSEC), abdominal hysterectomy (HYST), kidney and liver transplant, laminectomy, and roughly a dozen more.
• 90-day categories include breast surgery (BRST), cardiac surgery (CARD), coronary artery bypass graft (CBGB/CBGC), craniotomy (CRAN), spinal fusion (FUSN), herniorrhaphy (HER), hip and knee prosthesis (HPRO/KPRO), pacemaker surgery (PACE), and peripheral vascular bypass (PVBY), among others.

Two rules cut across every category: superficial incisional SSIs are always monitored for exactly 30 days regardless of the procedure category, and secondary incisional SSIs are always monitored for 30 days regardless of the surveillance period assigned to the primary incision site. The date of event is when the first element used to meet the SSI criterion first occurs, and it must fall inside the surveillance period; NHSN notes that in practice the elements needed to meet a criterion typically cluster within a 7-10 day span, with no more than 2-3 days between individual elements — an element on day 2 and another three weeks later should not be linked to cite the same SSI.

What Actually Triggers Surveillance: the “NHSN Operative Procedure”

SSI surveillance only applies to procedures that meet NHSN’s specific definition of an operative procedure — three conditions, all required:

1. The procedure is included in the ICD-10-PCS and/or CPT NHSN operative procedure code mapping (entering the code is optional in the NHSN application but recommended).
2. The operation involves at least one incision through the skin or mucous membrane — including a laparoscopic trocar site (treated as a surgical incision, not a stab wound) or a cranial burr hole — or entry through an existing incision from a prior procedure.
3. The procedure takes place in an operating room meeting the Facilities Guideline Institute’s or American Institute of Architects’ construction/renovation criteria for an OR, which can include a dedicated OR, a C-section room, an interventional radiology room, or a cardiac catheterization lab.

An infection following a procedure that doesn’t meet this three-part definition is not an NHSN SSI, even if it’s investigated as a healthcare-associated infection by other means — SSI events can only ever be attributed to NHSN operative procedures. Ambulatory Surgery Centers reporting to NHSN use a separate reporting track, the Outpatient Procedure Component, rather than the acute-care/HOPD SSI protocol described here.

Risk Stratification: Wound Class, ASA Score, Duration — and the SIR

SSI risk is stratified before it’s compared across facilities or procedure categories. Three variables drive NHSN’s traditional basic risk index for a given procedure: wound class (Clean, Clean-Contaminated, Contaminated, or Dirty/Infected — assigned intraoperatively by a member of the surgical team; certain categories such as APPY, BILI, CHOL, COLO, REC, SB, and VHYS can never be recorded as Clean), ASA physical status score (1-6, assigned by the anesthesiologist; only ASA 1-5 patients are eligible for SSI surveillance, ASA 6 — a declared brain-dead organ donor — is excluded), and duration of the operative procedure (the interval between procedure start and finish time, as defined by the Association of Anesthesia Clinical Directors).

For facility-to-facility comparison, NHSN produces a risk-adjusted Standardized Infection Ratio (SIR): observed SSIs divided by predicted SSIs, where the predicted count comes from multivariate logistic regression models built on NHSN baseline data, modeled separately for adults versus pediatric patients and for inpatient versus hospital outpatient procedure department settings. NHSN calculates an SIR only when the predicted count is at least 1, as a minimum-precision floor. Three SIR models exist for different purposes:

• All SSI SIR — the broadest model: includes superficial, deep, and organ/space SSIs (superficial and deep limited to primary incisional events only), across both admission-detected and post-discharge-detected cases, in separate adult/pediatric and inpatient/HOPD models.
• Complex A/R SSI SIR — narrower: deep incisional primary and organ/space SSIs only, identified on admission or readmission to the procedure facility, inpatient procedures only. This is the model CDC uses for its annual HAI Progress Report.
• Complex 30-day SSI model — the narrowest and most specific: inpatient colon (COLO) and abdominal hysterectomy (HYST) procedures in adults only, deep incisional primary and organ/space SSIs with an event date within 30 days of the procedure. This is the model CMS uses for Inpatient Prospective Payment System reporting and public reporting on Hospital Compare.

Before any SIR is calculated, NHSN applies a set of universal exclusion criteria — procedures excluded for missing risk-adjustment variables, sub-5-minute procedure duration, and similar data-quality issues — independent of which SIR model is being run.

PATOS: How SSI Handles Infection Already Present at Surgery

Because the POA framework doesn’t apply to SSI, NHSN uses a separate field — Present At Time Of Surgery (PATOS) — to flag when evidence of infection was visualized and documented intraoperatively (in the operative note’s narrative, not the pre/post-op diagnosis or indication-for-surgery headings). PATOS = YES only applies to the depth actually matching the later SSI: a documented intraabdominal infection at surgery followed by a later organ/space SSI is PATOS = YES, but the same intraoperative finding followed by a superficial or deep incisional SSI is PATOS = NO. A fixed list of organisms is excluded from meeting SSI criteria altogether regardless of PATOS status — well-known community-associated genera (Blastomyces, Histoplasma, Coccidioides, Paracoccidioides, Cryptococcus, Pneumocystis) and organisms associated with latent infections such as herpes, shingles, syphilis, or tuberculosis.

How SSI Fits Alongside CLABSI, CAUTI, and VAE

SSI sits in the same NHSN measurement family as CLABSI, CAUTI, and VAE — all four are retrospective, criteria-based surveillance definitions, not clinical diagnoses, and all four ultimately feed the same SIR framework used for CMS’s HAC Reduction Program and public quality reporting. But the trigger mechanics differ in a way worth being explicit about: CLABSI and CAUTI surveillance runs on continuous central-line-days and catheter-days, VAE runs on ventilator-days, and all three use the shared IWP/POA/HAI/RIT attribution logic described on CASRAI’s Healthcare-Associated Infection Definitions comparison. SSI instead opens a discrete, procedure-specific surveillance window — 30 or 90 days depending on what operative procedure category was performed — and uses PATOS in place of POA. An infection preventionist adjudicating an SSI case is applying that procedure-triggered logic to a specific operative episode, not tracking a continuous device exposure.

Frequently Asked Questions

Is every infection that develops after surgery counted as an SSI?

No. Only infections following a procedure that meets NHSN’s three-part “operative procedure” definition (mapped code, an incision, performed in a qualifying OR) and that meets one of the superficial incisional, deep incisional, or organ/space criteria within that procedure category’s surveillance period count as a reportable SSI.

What’s the practical difference between superficial and deep incisional SSI?

Tissue depth. Superficial incisional SSI is limited to skin and subcutaneous tissue; deep incisional SSI involves the fascial and muscle layers beneath it. A case meeting criteria at both depths is reported at the deepest level met, not both.

How long after surgery can an infection still be attributed as an SSI?

30 or 90 days, depending on the NHSN operative procedure category — see Table 2. Superficial incisional and all secondary incisional SSIs are always capped at 30 days regardless of the procedure category’s own window.

Does SSI surveillance use the same present-on-admission rules as CLABSI or CAUTI?

No. SSI does not use the IWP/POA/HAI/RIT framework those protocols share. It uses a separate Present At Time Of Surgery (PATOS) field, applied only when the documented intraoperative finding matches the depth of the SSI later attributed.

How is the SSI Standardized Infection Ratio calculated?

Observed SSIs divided by predicted SSIs, where predicted SSIs come from a multivariate logistic-regression model built on NHSN baseline data and adjusted for factors like procedure category, wound class, ASA score, and procedure duration. NHSN publishes three different SIR models (All SSI, Complex A/R, and the Complex 30-day model used for CMS IPPS reporting) that include different combinations of SSI depth, admission timing, and procedure population.

This guide summarizes the structure of NHSN Chapter 9 (Surgical Site Infection Event) as published in the January 2024 Patient Safety Component Manual for general orientation. It is not a substitute for the current-year NHSN manual, and it is not clinical guidance for individual patient management. For official reporting, always work from the exact current-year CDC NHSN manual chapter, operative procedure code mapping, and any program-specific reporting instructions (e.g., CMS IPPS).

Related: see the Patient Safety & Infection Prevention hub, the Healthcare-Associated Infection Definitions guide for how SSI’s attribution logic compares directly against CLABSI, CAUTI, and VAE, and the infection preventionist guide for who typically performs this adjudication in practice.