Introduction
Historical overview of HAI surveillance policies
Healthcare-associated infections (HAIs) impose a substantial burden on healthcare systems and represent a significant cause of morbidity and mortality. 1 Driven by these concerns, some states began surveillance in the early 2000s. Prior to 2003, most HAI reporting was voluntary and limited in scope. Mandatory state reporting laws began to emerge from 2002 to 2004. Reference Herzig, Reagan, Pogorzelska-Maziarz, Srinath and Stone2 By 2008, 23 states mandated reporting by law. 3
These pioneering efforts by states to enact reporting laws and implement HAI programs demonstrated the feasibility of public HAI surveillance. The HAI programs implemented during this period and the legal mandates requiring reporting were primarily based on state policy. 3 However, early guidance from the Centers for Disease Control and Prevention (CDC), as the lead agency for HAI policy, also influenced these approaches. Reference Stricof, Van Antwerpen, Smith and Birkhead4 In addition, the CDC’s Healthcare Infection Control Practices Advisory Committee published valuable guidelines aimed at infection reduction. Reference McKibben, Horan and Tokars5
Notwithstanding the increasing policy development, the states with early HAI surveillance reporting laws and associated programs experienced obstacles such as limited financial resources, staffing shortages, and technological constraints. 3 The result in some cases was delayed program implementation and a restricted scope of the states’ reporting systems. 3 Economic downturns beginning in 2008 further curtailed program development across the nation. Reference Reagan, Rohde, Mitchell, Felkner and Tille6 Additionally, significant variation in legal requirements among the early state HAI reporting laws existed, resulting in concerns about the impact on the delivery of health care and public health in general. Reference Reagan and Hacker7
Since the 1970s, the CDC has collected HAI data from hospitals on a voluntary basis through its National Nosocomial Infections Surveillance system, a precursor to the National Healthcare Safety Network (NHSN), a federal electronic database system for reporting HAI data. 3 In June 2007, CDC completed the development of NHSN and opened enrollment to hospitals in every state. 3 State HAI programs began to adopt the system, and the NHSN evolved into the national standard for reporting HAI data under both state and federal reporting mandates. 8
In 2009, the U.S. Department of Health and Human Services released the first version of the National Action Plan to Prevent Health Care-Associated Infections: Road Map to Elimination. 9 Later updated in 2013 and 2018, this effort established the primary federal framework for HAI prevention and surveillance in the U.S. The National Action Plan set five-year reduction goals for key HAIs and served as the foundation for coordinated efforts between federal agencies, states, and healthcare facilities. 9 The latest national Action Plan HAI targets and metrics were released in 2024. 10
Federal funding for state HAI program support has been provided since 2009, beginning with the American Recovery and Reinvestment Act of 2009, which allocated $40 million in grants to states. 11 This funding supported HAI programs in 49 states, the District of Columbia, and Puerto Rico. 12 The Affordable Care Act of 2010 introduced multiple funding mechanisms to support HAI prevention and surveillance at the CDC and in every state health department. Notably, Section 4002 of the Affordable Care Act established the Prevention and Public Health Fund—the first mandatory, ongoing federal funding stream for prevention and public health—with a portion directed toward strengthening HAI infrastructure. 13 The cornerstone of HAI funding is CDC’s Epidemiology and Laboratory Capacity for Prevention and Control of Emerging Infectious Diseases Cooperative Agreement, which has consistently provided financial support for state HAI programs. 14 The CDC currently funds HAI and antimicrobial programs in 64 state, local, and territorial health departments. 15 Additional federal resources have supported HAI research and implementation projects. 16–18 These federal funding sources have created a layered federal investment framework that underpins the state-level HAI reporting infrastructure.
Federal policies and reporting mandates have reinforced the importance of infection prevention by linking hospital reimbursement to quality metrics, including HAI rates. Through programs such as the Hospital-Acquired Condition Reduction Program and the Hospital Value-Based Purchasing Program, hospitals with poor performance on HAI measures face financial penalties. 19,20 The Centers for Medicare & Medicaid Services (CMS) Hospital Inpatient Quality Reporting (IQR) Program requires acute care hospitals paid under the Inpatient Prospective Payment System (IPPS) to submit a defined set of quality measures each year, including several HAI measures. 21 Hospitals must report HAI data to CMS through NHSN to receive their full annual Medicare payment. Under federal law, hospitals that fail to meet IQR reporting requirements incur a financial penalty, making timely and complete NHSN HAI reporting a condition of full Medicare reimbursement. 21 CMS IQR IPPS reporting requirements have gone through successive phases from 2003 to 2025, expanding reporting requirements from hospitals to other care settings. The growth in these CMS quality programs and a push towards national benchmarks have incentivized hospitals to improve infection control practices.
Against the backdrop of increased federal guidance, funding, and reporting mandates, all U.S. States, the District of Columbia, and some U.S. territories implemented HAI programs to monitor HAIs, regardless of whether the state had an HAI law. Reference Reagan and Hacker7 Occurring concurrently with program development, the enactment of new state-based HAI reporting laws also progressed. The most recent comprehensive 50-state legal mapping of state HAI reporting mandates, based on legal data collected as of January 31, 2013, found that 37 jurisdictions—35 states plus Puerto Rico and the District of Columbia—had laws requiring submission of HAI data. Reference Herzig, Reagan, Pogorzelska-Maziarz, Srinath and Stone2 Original research has provided evidence that these state-level HAI reporting schemes have improved patient care by decreasing infection rates. Reference Liu, Herzig and Dick22
State laws governing HAI reporting have evolved alongside expanding federal policy initiatives, yet the extent of this alignment is not well documented. To examine the shift in HAI surveillance from a decentralized, state-based framework to one significantly shaped by federal policy, this study provides an updated analysis of HAI reporting laws and examines how federal policies have influenced state HAI reporting laws and programs.
Methods
We conducted a systematic public health law review of statutes, administrative regulations, and policies governing HAI surveillance across all 50 U.S. states and the District of Columbia as of March 1, 2024. Searches were conducted using Westlaw Campus Research databases and state online statutory and administrative regulation databases. The analysis focused exclusively on HAI surveillance and public reporting laws. Broader statutes not directly specific to HAI reporting provisions—such as communicable disease regulations and facility licensing requirements—were excluded. Each jurisdiction’s HAI reporting laws were thoroughly reviewed by two reviewers acting independently to ascertain the legal mandates for HAI data reporting. To supplement these findings, we examined state HAI program websites, state-issued reports, and other administrative resources to assess regulatory frameworks and the extent of alignment with federal reporting requirements, policies, and integration.
To supplement the legal review and clarify state-specific reporting requirements, we administered a structured survey to state HAI program coordinators using REDCap. Surveys were distributed by email in March and April 2024. For states where coordinator information was not available online, we contacted the health department by phone to verify the appropriate HAI program contact before sending the survey. Weekly reminder emails were sent to non-responders, and final responses were received in May 2024. The survey included 41 items assessing state HAI reporting requirements, facility coverage, reportable infections, public data release practices, incorporation of federal CMS reporting requirements, and NHSN use. Of the 51 jurisdictions contacted, we received 43 complete responses and 5 partial responses, yielding an overall response rate of 94.1% (48 of 51). Incomplete or missing survey responses did not necessarily result in missing data, as relevant information was available from publicly accessible sources; denominators therefore vary across analyses based on the applicable subset of jurisdictions.
To illustrate the federal influence, state regulatory schemes were reviewed across two key periods of policy development: pre-2009 (prior to major federal guidance and policy initiatives), and 2009 to March 1, 2024 (the date of data collection for this research).
Results
State-based HAI reporting laws
As of March 1, 2024, 38 of the 51 jurisdictions (50 U.S. states and the District of Columbia) (74.5%) have a statute, regulation, or other legal policy mandating the reporting of HAI data by healthcare facilities (Table 1). The remaining 13 states (25.5%) do not have HAI reporting laws (Table 1).
Jurisdictions with healthcare-associated infection reporting laws as of March 1, 2024
Table 1 Long description
A table showing jurisdictions with healthcare-associated infection reporting laws as of March 1, 2024. The table has two columns: Has HAI Law and Jurisdictions. The first column indicates whether a jurisdiction has a healthcare-associated infection reporting law, and the second column lists the jurisdictions. The table is divided into two rows based on the presence of HAI laws. Row 1: Yes, AK, AL, AR, CA, CO, CT, DC, DE, GA, HI, IL, IN, KY, MA, MD, ME, MN, MO, MS, NC, NE, NH, NJ, NM, NV, NY, OK, OR, PA, RI, SC, TN, TX, UT, VA, VT, WA, WV. Row 2: No, AZ, FL, IA, ID, KS, LA, MI, MT, ND, OH, SD, WI, WY. The table also includes a third column showing the number and percentage of jurisdictions with and without HAI laws. 38 jurisdictions (74.5%) have HAI laws, while 13 jurisdictions (25.5%) do not.
Note: Percentages are based on 51 jurisdictions (50 U.S. states and the District of Columbia) as of March 1, 2024.
From 2002 to 2008, 25 jurisdictions (65.8%)—24 states and the District of Columbia—enacted HAI statutes or promulgated regulations requiring HAI reporting (Table 2). Between 2009 and March 1, 2024, 13 additional states (34.2%) adopted reporting mandates (Table 2). Additionally, of the 38 jurisdictions with HAI reporting laws, 29 (76.3%) have revised surveillance mandates since January 1, 2009, through statutory or regulatory amendments or new administrative regulations (Figure 1).
Healthcare-associated infection (HAI) reporting law adoption dates during two periods
Table 2 Long description
A table comparing jurisdictions with healthcare-associated infection (HAI) reporting laws during two periods. The table has two columns: Period and Jurisdictions, and a row for the number and percentage of jurisdictions with HAI reporting laws. The first period, from 2002 to 2008, includes jurisdictions such as AR, CA, CO, CT, DE, and others, with 25 jurisdictions (65.8%) having HAI reporting laws. The second period, from 2009 to March 1, 2024, includes jurisdictions such as AK, AL, DC, GA, HI, and others, with 13 jurisdictions (34.2%) having HAI reporting laws.
Note: Percentages are based on 38 jurisdictions with HAI reporting laws as of March 1, 2024.
Jurisdictions with healthcare-associated infection (HAI) law substantive changes between January 1, 2009, and March 1, 2024 (amendment to statute or regulation or promulgation of new administrative regulation).
Note: A total of 29 of 38 jurisdictions (76.3%) had substantive HAI law changes between 2009 and March 1, 2024.
Federal CMS IQR/IPPS reporting mandates
We found numerous instances where state HAI programs adopted the federal CMS IQR/IPPS reporting mandates. This adoption exhibited in four ways: (1) incorporation or reference to CMS mandates in state law, (2) data-sharing agreements for federally reported data without formal incorporation, (3) alignment of state reporting policies with CMS requirements without incorporation, and (4) allowing substitution of federally reported data for state reporting obligations.
When the text or language of federal law is incorporated into state law, the state legislature or regulatory agency formally adopts federal statutory or regulatory requirements—often by reference—so that those federal standards become binding components of state law. Of the 38 jurisdictions with HAI reporting laws, 23 (60.5%) incorporate CMS reporting mandates into state law by directly adopting or referencing them (Table 3). Five of the 38 jurisdictions with laws (13.2%) do not incorporate CMS reporting requirements but have data-sharing agreements allowing federally reported data to be shared with the state (Table 3). An additional three jurisdictions (7.9%) do not include CMS requirements in their HAI law but have other policies that mirror or align with federal reporting mandates. The HAI law of one state (2.6%) permits facilities to submit federally reported data in place of state reporting obligations (Table 3). In Total, of all 38 jurisdictions with HAI reporting laws, 32 (84.2%) have adopted the CMS IQR/IPPS reporting requirements in some form.
Adoption of federal Centers for Medicare and Medicaid Services (CMS) Hospital Inpatient Quality Reporting Program, Inpatient Prospective Payment System reporting mandates by states with HAI reporting laws
Table 3 Long description
A table showing the adoption of federal Centers for Medicare and Medicaid Services (CMS) Hospital Inpatient Quality Reporting Program, Inpatient Prospective Payment System reporting mandates by states with HAI reporting laws. The table has four rows and three columns. The columns are labeled Form of adoption of CMS reporting in state healthcare-associated infection (HAI) laws, Jurisdiction, and No. (% of 38 jurisdictions with HAI reporting laws). The rows are labeled with different forms of adoption and the corresponding jurisdictions and percentages. Row 1: HAI law incorporates or references CMS reporting mandates, AK, AR, DE, GA, HI, IL, IN, KY, MA, MD, ME, MO, MS, NC, NE, NH, NJ, TX, UT, VA, VT, WA, WV, 23 (60.5%). Row 2: HAI law does not incorporate CMS mandates, but has data-sharing agreements, CA, CO, MN, NY, RI, 5 (13.2%). Row 3: HAI law does not incorporate CMS mandates, but reporting requirements mirror CMS policy, CT, DC, TN, 3 (7.9%). Row 4: HAI law allows substitution of federally reported data for state reporting, OR, 1 (2.6%).
Note: Percentages are based on 38 jurisdictions with HAI reporting laws as of March 1, 2024. Percentages do not add to 100%.
Similarly, federal CMS reporting mandates influence states without HAI reporting laws. Nine of the 13 states without HAI reporting laws have used data-sharing or other voluntary agreements to grant state access to CMS-reported data. Specifically, we found that Arizona, Florida, Iowa, Kansas, Louisiana, Michigan, Ohio, South Dakota, and Wisconsin, states that do not have HAI reporting laws, had either a data use agreement (DUA) or another type of voluntary agreement that allows state access to CMS-reported data.
Across all 51 jurisdictions, 41 (80.4%) have modified or structured their state HAI reporting requirements in response to CMS IQR/IPPS reporting mandates.
The incorporation of federal policies into state laws
Most state HAI statutes and regulations incorporate other federal policies—such as CDC-recommended definitions or CMS reporting methodology—thereby embedding national norms within state-level legal frameworks. Our results show most states with HAI reporting laws incorporate additional federal policy elements. Among the 38 jurisdictions with HAI reporting laws, 37 (97.4%) explicitly incorporate federal recommendations, definitions, public disclosure, or methodological requirements; Minnesota is the sole exception.
Discussion
This research demonstrates a substantial influence of federal policy on state HAI programs and reporting laws. While initial state HAI programs and reporting laws were influenced by early emerging CDC influences, since 2009, as new federal standards have become more extensive, new state law enactments and amendments have increasingly adopted federal policy mechanisms. This transition of state efforts with only minimal early federal influence to a regulatory framework heavily relying on federal policy underscores the federal government’s significant role in shaping state-level infection surveillance.
State-based HAI reporting laws
Our findings reveal a progressive evolution of the enactment of state-level HAI reporting laws over time. As of March 1, 2024, 74.5% of U.S. jurisdictions mandate healthcare facilities to report HAI data to the state, while 25.5% lack such requirements. This widespread adoption underscores the growing recognition of HAIs as a critical public health concern.
The time line of legislation reveals two distinct phases. Between 2002 and 2008, before significant federal HAI policy development, most state HAI reporting laws were created with only emerging influences from the federal government. During this time, 25 jurisdictions—including 24 states and the District of Columbia—implemented reporting mandates. In contrast, from 2009 onward, following the advancement of major federal initiatives, state legislative activity changed significantly. Thirteen additional states enacted HAI mandates, and 76.3% of jurisdictions with existing laws updated their surveillance requirements through statutory or regulatory amendments, or by creating new regulations.
These changes strongly suggest that federal policy has acted as a catalyst for state-level alignment. For instance, Alaska introduced HAI reporting requirements in 2013 through an administrative regulation. 23 Although state-based, this regulation required sharing CMS-reported data with the state and mandated the use of CDC methodologies for public reporting. 23 Overall, we found that the purpose of many post-2009 enactments and amendments is to harmonize state policy with federal standards. Taken together, these developments reflect an expanding reporting scope and a state legal framework evolving in tandem with federal policy initiatives and mandates.
The influence of federal CMS reporting mandates
Our results provide strong evidence of the direct influence of federal CMS reporting mandates on state-level HAI reporting policies. Most states with HAI reporting laws (23, 60.5%) incorporate or reference CMS reporting mandates, requiring or enabling facilities to share CMS-reported data with the state. For example, Kentucky’s regulations authorize the CDC to grant the state health department access to NHSN data reported for CMS programs. 24
In some cases, states do not codify CMS reporting requirements in law but instead rely on DUAs or other voluntary agreements to access CMS-reported data. Since October 2011, the CDC has offered the option of using DUAs to state health departments as an alternative for accessing federal CMS-reported NHSN data. 25 This approach is beneficial in states lacking statutory data-sharing mandates. However, this type of data-sharing alternative is more limited. Access under a DUA is limited to surveillance and prevention purposes; shared HAI data cannot be publicly reported with facility identifiers. 25 For example, New York’s 2022 HAI report notes that, in addition to state-mandated reporting, hospitals submit federal data to NHSN. 26 The state accesses this data through a DUA with the CDC, which restricts its use to surveillance and prevention—not public reporting of facility-specific data or regulatory action. 26
Some states without HAI reporting laws also use DUAs or other voluntary sharing agreements to access federally reported HAI data. For instance, Florida’s HAI website notes that, although the state lacks an HAI law mandating reporting, it receives federal data through a DUA and publishes annual reports based on those data. 27
Other jurisdictions pursue alignment without explicitly incorporating CMS mandates. The District of Columbia’s regulations, for example, do not reference CMS requirements directly. Yet a District report explains that a 2017 amendment aimed to harmonize local reporting with CMS standards to reduce burden and enhance data value. 28
Finally, some states allow the substitution of CMS-reported data for state reporting obligations. For example, facilities in a state may be subject to reporting mandates under both federal CMS requirements and the state law. Oregon’s law permits hospitals that report through NHSN to meet CMS requirements to forgo separate state submissions if they grant the state access to the CMS NHSN data. 29
Collectively, we witnessed a pervasive influence of CMS reporting mandates on state HAI reporting systems. We found the influence observable in the legal provisions, program administrative practices, and above all, in the data-sharing mechanisms. The result is a state-federal coordination that promotes consistency, enhances efficiency through data sharing, and reduces reporting burdens.
The incorporation of federal HAI policies into state laws
Beyond CMS reporting requirements, other federal policies significantly influence state-based HAI reporting laws. We found widespread adoption of other federal HAI policy components, such as federal guidance, definitions, methodological, and public disclosure requirements. While one could argue that all states rely on federal recommendations to some extent, our analysis provides direct evidence that 97.4% of states with HAI reporting laws integrate at least one federal policy into their regulatory scheme.
Many state HAI reporting laws define HAIs using NHSN criteria. Massachusetts, for example, bases its definition of reportable HAIs on NHSN guidelines. 30 State reliance on federal data collection methodology provides a standardized framework to ensure consistent and accurate reporting. For example, Missouri’s HAI statute requires the use of methodologies and systems for data collection established by NHSN. 31 Many states adopt federal schedules for HAI reporting. For example, New Mexico law requires hospitals to report selected indicators through the NHSN system on a schedule aligned with NHSN reporting frequencies. 32
New York’s HAI law exemplifies broad incorporation of federal recommendations. It directs the department to establish hospital HAI guidelines consistent with recognized centers of expertise, including the NHSN. 33 Washington’s law similarly requires its advisory committee to consider methodologies from the CDC, CMS, and other relevant organizations. 34
Most states with HAI reporting laws mandate the public release of HAI data. Reference Reagan and Hacker7 Hawaii’s statute requires public HAI reports using CDC and CMS methodology for “national reporting of HAIs.” 35
Minnesota was the only state with an HAI statute that did not incorporate or reference federal policies. 36 Nevertheless, the statute cites the National Quality Forum (NQF), an entity that previously maintained a strong partnership with the CMS as the consensus-based entity for quality measurement endorsements, including NHSN HAI measures. 37,Reference Harris, Davis-Lopez, Schmidt, Nieser and Massarweh38
Collectively, our review of the legal provisions of current state HAI reporting laws reveals a firm reliance on federal standards. Given that 97.4% of jurisdictions with HAI reporting laws have adopted federal definitions, methodologies, or reporting requirements, there is no doubt that federal policies have provided a foundational framework that greatly influences evolving state-level HAI policy.
Financial support
None reported.
Competing interests
All authors report no conflicts of interest relevant to this article.
Open access
