This is the accessible text file for GAO report number GAO-08-283 
entitled 'Health-Care-Associated Infections In Hospitals: Leadership 
Needed from HHS to Prioritize Prevention Practices and Improve Data on 
These Infections' which was released on April 16, 2008.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Committee on Oversight and Government Reform, 
House of Representatives: 

United States Government Accountability Office: 
GAO: 

March 2008: 

Health-Care-Associated Infections In Hospitals: 

Leadership Needed from HHS to Prioritize Prevention Practices and 
Improve Data on These Infections: 

GAO-08-283: 

GAO Highlights: 

Highlights of GAO-08-283, a report to the Chairman, Committee on 
Oversight and Government Reform, House of Representatives. 

Why GAO Did This Study: 

According to the Centers for Disease Control and Prevention (CDC), 
health-care-associated infections (HAI) are estimated to be 1 of the 
top 10 causes of death in the United States. HAIs are infections that 
patients acquire while receiving treatment for other conditions. GAO 
was asked to examine (1) CDC’s guidelines for hospitals to reduce or 
prevent HAIs and what the Department of Health and Human Services (HHS) 
does to promote their implementation, (2) Centers for Medicare & 
Medicaid Services’ (CMS) and hospital accrediting organizations’ 
required standards for hospitals to reduce or prevent HAIs and how 
compliance is assessed, and (3) HHS programs that collect data related 
to HAIs and integration of the data across HHS. GAO reviewed documents 
and interviewed officials from CDC, CMS, the Agency for Healthcare 
Research and Quality (AHRQ), and accrediting organizations. 

What GAO Found: 

CDC has 13 guidelines for hospitals on infection control and 
prevention, which cover a variety of topics, and in these guidelines 
CDC recommends almost 1,200 practices for implementation to prevent 
HAIs and related adverse events. Most of the practices are sorted into 
five categories—from strongly recommended for implementation to not 
recommended—primarily on the basis of the strength of the scientific 
evidence for each practice. Over 500 practices are strongly 
recommended. CDC and AHRQ have conducted some activities to promote 
implementation of recommended practices, but these activities are not 
based on a clear prioritization of the practices. Prioritization may 
consider not only the strength of the evidence, but also other factors 
that can affect implementation, such as cost and organizational 
obstacles. In addition to CDC, AHRQ has reviewed scientific evidence 
for certain HAI-related practices, but the efforts of the two agencies 
have not been coordinated. 

The infection control standards required by CMS and hospital-
accrediting organizations—the Joint Commission and the Healthcare 
Facilities Accreditation Program of the American Osteopathic 
Association (AOA)—describe the fundamental components of a hospital’s 
infection control program. These components include the active 
prevention, control, and investigation of infections. The standards are 
far fewer in number than the recommended practices in CDC’s guidelines 
and generally do not require that hospitals implement all recommended 
practices in CDC’s infection control and prevention guidelines. CMS, 
the Joint Commission, and AOA assess compliance with their infection 
control standards through direct observation of hospital activities and 
review hospital policy documents during on-site surveys. 

Multiple HHS programs collect data on HAIs, but limitations in the 
scope of information they collect and a lack of integration across the 
databases maintained by these separate programs constrain the utility 
of the data. Three agencies within HHS currently collect HAI-related 
data for a variety of purposes in databases maintained by four separate 
programs: CDC’s National Healthcare Safety Network program, CMS’s 
Medicare Patient Safety Monitoring System, CMS’s Annual Payment Update 
program, and AHRQ’s Healthcare Cost and Utilization Project. Each of 
the four databases presents only a partial view of the extent of the 
HAI problem because each focuses its data collection on selected types 
of HAIs and collects data from a different subset of hospital patients 
across the country. GAO did not find that the agencies were taking 
steps to integrate data across the four databases by creating linkages 
across the databases, such as creating common patient identifiers. 
Creating linkages across the HAI-related databases could enhance the 
availability of information to better understand where and how HAIs 
occur. Although CDC officials have produced national estimates of HAIs, 
those estimates derive from assumptions and extrapolations that raise 
questions about the reliability of those estimates. 

What GAO Recommends: 

GAO recommends that the Secretary of HHS identify priorities among the 
recommended practices in CDC’s guidelines and establish greater 
consistency and compatibility of the data collected across HHS on HAIs. 
HHS generally agreed with GAO’s recommendations. In response to 
comments from the Joint Commission, GAO clarified its discussion of 
Joint Commission activities; in addition, it incorporated technical 
comments from the Joint Commission and AOA. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-283]. For more 
information, contact Cynthia A. Bascetta at (202) 512-7114 or 
bascettac@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

CDC Has 13 Infection Control and Prevention Guidelines Containing 
Almost 1,200 Recommended Practices, but Activities across HHS to 
Promote Implementation Are Not Guided by Prioritization of Practices: 

CMS's and Accrediting Organizations' Required Hospital Standards 
Describe Components of Infection Control Programs, and Compliance with 
These Standards Is Assessed through On-Site Surveys: 

Multiple HHS Programs Collect Data on HAIs, but Lack of Integration of 
Available Data and Other Problems Limit Utility of the Data: 

Conclusions: 

Recommendations for Executive Action: 

Comments from HHS and Accrediting Organizations and Our Evaluation: 

Appendix I: Other CDC Activities Designed to Reduce or Prevent Health- 
Care-Associated Infections: 

Appendix II: Centers for Medicare & Medicaid Services' (CMS) Condition 
of Participation: Infection Control: 

Appendix III: Comments from the Department of Health and Human 
Services: 

Appendix IV: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: CDC's Infection Control and Prevention Guidelines, with Number 
of Recommended Practices, Issued between 1981 and 2007: 

Table 2: Number of Practices in the Seven CDC Infection Control and 
Prevention Guidelines That Used the Five Categories, by Category: 

Table 3: Selected Characteristics of HHS Databases That Contain HAI- 
Related Information: 

Abbreviations: 

ABCs: Active Bacterial Core Surveillance: 

AHRQ: Agency for Healthcare Research and Quality: 

AOA: Healthcare Facilities Accreditation Program of the American 
Osteopathic Association: 

APIC: Association for Professionals in Infection Control and 
Epidemiology: 

APU: Annual Payment Update: 

BSI: bloodstream infection: 

CDC: Centers for Disease Control and Prevention: 

CMS: Centers for Medicare & Medicaid Services: 

COP: condition of participation: 

DRA: Deficit Reduction Act of 2005: 

DRG: diagnosis-related group: 

FDA: Food and Drug Administration: 

HAI: health-care-associated infection: 

HCUP: Healthcare Cost and Utilization Project: 

HHS: Department of Health and Human Services: 

HICPAC: Healthcare Infection Control Practices Advisory Committee: 

ICD-9: International Classification of Diseases, Ninth Revision: 

MDRO: multidrug-resistant organism: 

MPSMS: Medicare Patient Safety Monitoring System: 

MRSA: methicillin-resistant Staphylococcus aureus: 

NHSN: National Healthcare Safety Network: 

NNIS: National Nosocomial Infections Surveillance: 

PSI: Patient Safety Indicator: 

PSO: Patient Safety Organization: 

SCIP: Surgical Care Improvement Project: 

SHEA: Society for Healthcare Epidemiology of America: 

SSI: surgical site infection: 

UTI: urinary tract infection: 

VAP: ventilator-associated pneumonia: 

VRE: vancomycin-resistant enterococci: 

WHO: World Health Organization: 

[End of section] 

United States Government Accountability Office:
Washington, DC 20548: 

March 31, 2008: 

The Honorable Henry Waxman: 
Chairman: 
Committee on Oversight and Government Reform: 
House of Representatives: 

Dear Mr. Chairman: 

According to the Centers for Disease Control and Prevention (CDC), 
health-care-associated infections (HAI) are estimated to be 1 of the 
top 10 causes of death in the United States. HAIs, as defined by CDC, 
are infections that patients acquire while receiving treatment for 
other conditions.[Footnote 1] For example, a patient may acquire an 
infection from bacteria on a device used to treat them, such as a 
needle or tube to deliver medicine, fluids, or blood. According to CDC, 
the most common HAIs are urinary tract infection (UTI), surgical site 
infection (SSI), pneumonia, and bloodstream infection (BSI). Some HAIs 
can be caused by bacteria that have become resistant to multiple 
antimicrobial drugs.[Footnote 2] One example of such a bacterium is 
methicillin-resistant Staphylococcus aureus, or MRSA, which causes 
infections that are resistant to treatment with usual antibiotics, 
including methicillin, and can be serious and potentially life- 
threatening. MRSA can cause a wide variety of infections, including 
skin infections, BSIs, SSIs, and pneumonia. 

HAIs can be expensive. In 2005 the average payment for a 
hospitalization in Pennsylvania was over six times higher for patients 
who contracted a hospital-acquired infection than for patients who did 
not acquire infections, according to a report by the Pennsylvania 
Health Care Cost Containment Council.[Footnote 3] A 2007 study of 1.69 
million patients who were discharged from 77 hospitals found that the 
additional cost of treating a patient with an HAI averaged 
$8,832.[Footnote 4] The costs of HAIs are borne not only by the 
patients who suffer infections, but also by those who pay for care, 
such as the Centers for Medicare & Medicaid Services (CMS). According 
to the American Hospital Association, Medicare paid for over one-third 
of all hospital costs in 2005.[Footnote 5] Hospitals may also incur 
some of the cost because they are not fully reimbursed for the cost of 
the extra care attributable to HAIs. 

Although not all HAIs are preventable, public and private organizations 
have established standards and other activities aimed at controlling 
and preventing them. CMS has established health and safety standards-- 
known as conditions of participation (COP)--with which hospitals must 
comply in order to be eligible for payment by Medicare and Medicaid and 
which include the COP for infection control.[Footnote 6] Hospitals may 
choose one of two ways to show that they have met these or equivalent 
standards: they may be certified by a state agency under agreement with 
CMS to survey the hospital's compliance with the COPs or they may be 
accredited by one of two private organizations--the Joint Commission or 
the Healthcare Facilities Accreditation Program of the American 
Osteopathic Association (AOA).[Footnote 7] Most hospitals are 
accredited by the Joint Commission.[Footnote 8] Other activities within 
the Department of Health and Human Services (HHS) aimed at addressing 
the problem of HAIs in hospitals include the development of guidelines 
by CDC, which contain recommended practices that hospitals may adopt, 
and several databases in different parts of HHS that contain 
information about HAIs in hospitals. According to the Institute of 
Medicine, prevention of HAIs through implementation of evidence-based 
guidelines can lead to improvements in quality of care.[Footnote 9] 
Furthermore, the collection of national data on these infections can 
provide a benchmark for individual hospitals to gauge their performance 
and design targeted interventions. 

Federal and state lawmakers are also concerned about HAIs and have 
taken action to reduce them. With the passage of the Deficit Reduction 
Act of 2005 (DRA),[Footnote 10] the Congress took steps to revise the 
way Medicare pays hospitals so that beginning on October 1, 2008, they 
would not receive higher payments for patients that acquire certain 
preventable conditions (including any of three HAIs) during their 
hospital stay.[Footnote 11] The HAI-related preventable conditions that 
CMS identified in the final regulation implementing subsection 5001(c) 
of the DRA were UTIs caused by catheters, infections caused by vascular 
catheters, and mediastinitis following coronary artery bypass graft 
surgery.[Footnote 12] According to Consumers Union--a nonprofit 
organization that has a campaign to stop HAIs--23 state legislatures 
have enacted laws that require public reporting of hospital HAI rates 
or HAI-related information.[Footnote 13] 

In light of congressional activity in this area and concerns you raised 
about how to prevent or reduce HAIs in hospitals, we examined (1) CDC's 
guidelines for hospitals to reduce or prevent HAIs, and what HHS does 
to promote their implementation, (2) CMS's and the accrediting 
organizations' required standards for hospitals to reduce or prevent 
HAIs, and how compliance is assessed, and (3) HHS programs that collect 
data related to HAIs in hospitals, and the extent the data are 
integrated across HHS. 

In general, to conduct our work, we reviewed documents and interviewed 
HHS agency officials, including officials from CDC, CMS, the Agency for 
Healthcare Research and Quality (AHRQ), and the Food and Drug 
Administration (FDA). 

To identify CDC's guidelines for hospitals related to HAIs as well as 
assess their content, we reviewed CDC's infection control and 
prevention guidelines issued between 1981 and 2007. To determine the 
extent to which HHS promotes CDC's guidelines, we asked CDC officials 
about the activities they undertake to promote their guidelines, and we 
interviewed officials from AHRQ. We reviewed minutes of the Healthcare 
Infection Control Practices Advisory Committee (HICPAC), a federal 
advisory body appointed by the Secretary of HHS that provides 
recommendations to the Secretary and CDC and includes members from 
government agencies and private organizations.[Footnote 14] In 
addition, we interviewed officials from CDC, CMS, FDA, and AHRQ. We 
interviewed selected experts in the field of infection control, 
including individuals from private organizations that represent health 
professionals in infection control and develop materials to support 
their work, such as the Society for Healthcare Epidemiology of America 
(SHEA) and the Association for Professionals in Infection Control and 
Epidemiology (APIC). We also reviewed the World Health Organization's 
(WHO) guideline on hand hygiene.[Footnote 15] 

To determine CMS's and the accrediting organizations' required 
standards for hospitals to reduce or prevent HAIs and how compliance is 
assessed, we reviewed CMS's COPs for hospitals and the Joint 
Commission's and AOA's standards for hospitals and interviewed 
officials from CMS, the Joint Commission, and AOA. We reviewed CMS's 
interpretive guidelines, which describe the COPs and provide survey 
procedures used to determine compliance with them and can be found 
primarily in CMS's State Operations Manual.[Footnote 16] In addition, 
we reviewed CMS's revised interpretive guidelines for the infection 
control COP, which were published in November 2007, during the course 
of our work.[Footnote 17] We also reviewed the Joint Commission's and 
AOA's hospital standards manuals. For the purpose of this report, we 
refer to the guidance that CMS provides about its COPs in the 
interpretive guidelines, and that the Joint Commission and AOA provide 
about their standards in their respective manuals, as "standards 
interpretations." Our review focused on CMS's infection control COP and 
the standards the Joint Commission and AOA have in the infection 
control chapters of their respective manuals. We obtained the following 
information from each organization: the number of hospitals surveyed by 
each organization during the first quarter of 2007, and the number of 
hospitals surveyed by each organization during the first quarter of 
2007 that were cited as noncompliant with one of the standards on 
infection control. Using the data we obtained from these officials, we 
calculated the percentage of hospitals surveyed by each organization 
that were noncompliant with at least one infection control standard for 
the first quarter of 2007. Based on information obtained from and 
discussions with each organization, we determined that the data CMS, 
the Joint Commission, and AOA provided to us were sufficiently reliable 
for the purposes of this report. 

To identify HHS programs that routinely collect and maintain in 
designated databases information that relates specifically to HAIs, we 
interviewed officials at CDC, CMS, AHRQ, and FDA, and reviewed relevant 
documents. To describe and assess the programs HHS has that collect 
data related to HAIs and determine the extent to which the data are 
integrated, we reviewed agency manuals and other relevant documents 
that explain the programs that collect the data, examined related 
publications and data analyses conducted by the agencies based on the 
data collected, and reviewed HICPAC meeting minutes from March 2004 to 
June 2007. We also interviewed officials of CDC, CMS, FDA, and AHRQ 
responsible for each agency's HAI data collection efforts. We obtained 
data reported from these HAI-related databases, and based on relevant 
documents and discussion with agency officials we determined that the 
data were sufficiently reliable for the purposes of this report. 

We examined only guidelines, standards, and databases that apply to 
HAIs in acute care hospitals other than critical access hospitals and 
did not examine guidelines, standards, or databases that might apply to 
community-acquired infections or health care workers. We did not 
independently assess the clinical evidence that supports CDC's 
infection control and prevention guidelines. We describe CMS's, the 
Joint Commission's, and AOA's infection control standards, the 
standards interpretations, and the survey process, but we did not 
observe the survey process. We conducted this performance audit from 
January 2007 to March 2008, in accordance with generally accepted 
government auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. 

Results in Brief: 

CDC has 13 guidelines for hospitals on infection control and 
prevention, and in these guidelines CDC recommends almost 1,200 
practices for implementation to prevent HAIs and related adverse 
events. The guidelines cover such topics as prevention of catheter- 
associated UTIs, prevention of SSIs, and hand hygiene. An example of a 
recommended practice in the hand hygiene guideline is the 
recommendation that health care workers decontaminate their hands 
before having direct contact with patients. Most of the practices are 
sorted into five categories--from strongly recommended for 
implementation to not recommended--primarily on the basis of the 
strength of the scientific evidence for each practice. Over 500 
practices are strongly recommended. CDC and AHRQ have conducted some 
activities to promote implementation of recommended practices, such as 
disseminating the guidelines and providing research funds. However, 
these steps have not been guided by a prioritization of recommended 
practices. One factor to consider in prioritization is strength of 
evidence, as CDC has done. In addition to strength of evidence, an AHRQ 
study identified other factors to consider in prioritizing recommended 
practices, such as costs or organizational obstacles. Furthermore, the 
efforts of the two agencies have not been coordinated. For example, we 
found that CDC and AHRQ both conducted reviews of evidence for HAI- 
related practices, such as hand hygiene. Although this could have been 
an opportunity for coordination, an official from the HHS Office of the 
Secretary told us that no one within the office is responsible for 
coordinating infection control activities across HHS. 

While CDC's infection control guidelines describe specific clinical 
practices recommended to reduce HAIs, the infection control standards 
that CMS and the accrediting organizations require as part of the 
hospital certification and accreditation processes describe the 
fundamental components of a hospital's infection control program. These 
components include the active prevention, control, and investigation of 
infections. Examples of standards and corresponding standards 
interpretations that hospitals must follow include educating hospital 
personnel about infection control and having infection control policies 
in place. The standards are far fewer in number than the recommended 
practices in CDC's guidelines--for example, CMS's infection control COP 
contains two standards. Furthermore, CMS and the accrediting 
organizations generally do not require that hospitals implement all 
recommended practices in CDC's infection control and prevention 
guidelines. Only the Joint Commission and AOA have standards that 
require the implementation of certain practices recommended in CDC's 
infection control guidelines. For example, the Joint Commission and AOA 
require hospitals to annually offer influenza vaccinations to health 
care workers, whereas CMS's interpretive guidelines, or standards 
interpretations, are more general, stating that hospitals should adopt 
policies and procedures based as much as possible on national 
guidelines that address hospital-staff-related issues, such as 
evaluating hospital staff immunization status for designated infectious 
diseases. CMS, the Joint Commission, and AOA assess compliance with 
their infection control standards through direct observation of 
hospital activities and review of hospital policy documents during on- 
site surveys. 

Multiple HHS programs collect data on HAIs, but limitations in the 
scope of information they collect and the lack of integration across 
the databases maintained by these separate programs constrain the 
utility of the data. Three agencies within HHS--CDC, CMS, and AHRQ-- 
currently collect HAI-related data for a variety of purposes in 
databases maintained by four separate programs: CDC's National 
Healthcare Safety Network (NHSN) program, CMS's Medicare Patient Safety 
Monitoring System (MPSMS), CMS's Annual Payment Update (APU) program, 
and AHRQ's Healthcare Cost and Utilization Project (HCUP). Each of 
these databases presents only a partial view of the extent of the HAI 
problem because each focuses its data collection on selected types of 
HAIs and collects data from a different subset of hospital patients 
across the country. Although officials from the various HHS agencies 
discuss HAI data collection with each other, we did not find that the 
agencies were taking steps to integrate any of the existing data by 
creating linkages across the databases, such as creating common patient 
identifiers. Creating linkages across the HAI-related databases could 
enhance the availability of information to better understand where and 
how HAIs occur. Although none of the databases collect data on the 
incidence of HAIs for a nationally representative sample of hospital 
patients, CDC officials have produced national estimates of HAIs. 
However, those estimates derive from assumptions and extrapolations 
that raise questions about the reliability of those estimates. 

In order to help reduce HAIs in hospitals, we are calling for stronger 
leadership from HHS by recommending that the Secretary of HHS take 
action to prioritize prevention practices and improve data about HAIs. 
In commenting on a draft of this report, HHS generally agreed with our 
recommendations. In terms of our first recommendation, HHS's comments 
indicated that CMS welcomed the opportunity to work with CDC to review 
and prioritize recommendations for infection control and would consider 
whether to incorporate some of the recommendations into CMS's hospital 
COPs. HHS's comments also noted that the COPs currently lack the 
specificity of guidance and recommendations issued by HHS agencies, 
including CDC's recommendations for infection control. In terms of our 
second recommendation, HHS's comments acknowledged the need for greater 
consistency and compatibility of the data collected on HAIs and 
identified some steps CMS would take to implement this recommendation. 
HHS also provided technical comments, which we incorporated as 
appropriate. In response to comments from the Joint Commission, we 
clarified the discussion of Joint Commission activities; in addition, 
we incorporated technical comments from the Joint Commission and AOA. 

Background: 

CDC has developed several guidelines for hospitals that describe and 
recommend practices to prevent or control HAIs, such as hand washing or 
the use of alcohol-based hand rubs, isolation of infected patients, 
proper sterilization of equipment, provision of antibiotics to patients 
before surgery, and annual vaccination of health care workers for 
influenza. Standards from CMS and hospital accrediting organizations 
provide a means for assessing hospital compliance with infection 
control standards that are also aimed at preventing or controlling 
HAIs. 

CDC's Infection Control and Prevention Guidelines: 

CDC issues both guidelines and guidance relevant to infection control 
and prevention in hospitals. Guidelines are based on scientific 
evidence, whereas guidance is usually provisional and limited in its 
supporting evidence. CDC's infection control and prevention guidelines 
set forth recommended practices, summarize the applicable scientific 
evidence and research, and contain contextual information and citations 
for relevant studies and literature. 

Most of CDC's infection control and prevention guidelines are developed 
in conjunction with HICPAC, an advisory body created in 1992 by the 
Secretary of HHS. According to its charter, HICPAC provides CDC and the 
Secretary with (1) advice and guidance on the practice of infection 
control and strategies for surveillance,[Footnote 18] prevention, and 
control of HAIs and related events in health care facilities; and (2) 
advice on the periodic updating of existing HAI guidelines, the 
development of new guidelines and evaluations, and other HAI policy 
statements.[Footnote 19] HICPAC currently consists of 14 voting members 
from various infection control disciplines throughout the United 
States, a designated staff person from CDC, and 15 nonvoting liaison 
members from government agencies and private organizations. 

When CDC and HICPAC select a topic for an infection control and 
prevention guideline, they begin with internal discussions. After 
selecting a topic, HICPAC members and CDC conduct research on the 
topic, which includes identifying and evaluating clinical studies 
relevant to the topic and developing recommended practices, as 
appropriate. The draft guidelines are written and reviewed by HICPAC 
members; circulated to outside experts to validate the content; and 
sent to other federal agencies for review and approval.[Footnote 20] 
Afterward, HICPAC members resolve issues raised during review in face- 
to-face meetings or conference calls with HICPAC members who wrote the 
guideline. The approved document is published in the Federal Register 
for a 45-to 60-day public comment period, after which comments are 
reviewed by HICPAC members. CDC publishes the final guideline in its 
Morbidity and Mortality Weekly Report, on its Web site, or through a 
professional journal. 

CMS's and the Accrediting Organizations' Standards for Hospitals: 

Hospital compliance with CMS's or the accrediting organizations' 
standards, including those related to infection control, is assessed on 
a regular basis. Unannounced on-site surveys, conducted by surveyors 
from CMS or the accrediting organizations, are a major component in the 
process by which hospitals' compliance with health and safety standards 
is assessed. Standards interpretations are given by CMS primarily in 
its State Operations Manual,[Footnote 21] which is arranged by COP; by 
the Joint Commission in its Comprehensive Accreditation Manual for 
Hospitals: The Official Handbook, which identifies rationales and 
performance expectations that are used to measure each standard and is 
organized into 11 chapters of safety and quality standards such as 
"Medication Management" and "Leadership;" and by AOA's standards 
manual, Accreditation Requirements for Healthcare Facilities, which 
provides explanations for surveyors and the scoring procedures along 
with its standards and is organized into 32 chapters. Based on the 
information documented during the survey, surveyors from each 
organization assess a hospital's compliance with the standards. 
[Footnote 22] Hospitals are required to correct instances of 
noncompliance found during the survey. CMS's policy is to survey 
hospitals every 3 years; however, this policy is contingent on CMS's 
budget. In fiscal year 2007, CMS set a goal to survey hospitals on 
average once every 4.5 years, with no more than 6 years elapsing 
between surveys for any one hospital. Both the Joint Commission and AOA 
survey hospitals at least once every 3 years. 

The Joint Commission has additional components in its standards and 
survey process. First, it issues National Patient Safety Goals, which 
are requirements intended to promote specific improvements in patient 
safety. Officials at the Joint Commission told us that the goals are 
updated annually and derive primarily from informal recommendations 
made in the Joint Commission's safety newsletter, Sentinel Event Alert, 
recommendations from the Sentinel Event Advisory Group, sentinel events 
reported to the Joint Commission, and a review of the patient safety 
literature. The goals target problem areas in health care, such as 
reducing the risk of patient injury resulting from a fall or 
encouraging patients' active involvement in their own care. Each goal 
is reviewed during the on-site survey to determine compliance with it. 
Second, the Joint Commission conducts several "tracers" as part of its 
hospital surveys, during which the care provided to selected patients 
is followed or "traced" through the hospital in the same sequence in 
which the patient received it. Other requirements that a hospital must 
meet to be accredited by the Joint Commission include conducting an 
annual self-assessment of the hospital's compliance with the Joint 
Commission standards and submitting data for selected measures of 
clinical performance, some of which are related to HAIs. 

CDC Has 13 Infection Control and Prevention Guidelines Containing 
Almost 1,200 Recommended Practices, but Activities across HHS to 
Promote Implementation Are Not Guided by Prioritization of Practices: 

CDC has 13 guidelines for hospitals on infection control and 
prevention, and in these guidelines CDC recommends almost 1,200 
specific clinical practices for implementation to prevent HAIs and 
related adverse events. The practices generally are sorted into five 
categories--from strongly recommended for implementation to not 
recommended--primarily on the basis of the strength of the scientific 
evidence for each practice. Over 500 practices are strongly 
recommended. Within HHS, CDC and AHRQ conduct some activities to 
promote the implementation of recommended practices, but the activities 
are not based on clear prioritization of the practices, which may 
consider not only the strength of the evidence, but also other factors 
that can affect implementation, such as cost or organizational 
obstacles. 

CDC Has 13 Infection Control and Prevention Guidelines, Which Contain 
Almost 1,200 Recommended Practices, and over 500 of Them Are Strongly 
Recommended: 

CDC has 13 infection control and prevention guidelines, which contain 
1,198 specific clinical practices that CDC recommends for preventing 
HAIs.[Footnote 23] (See table 1.) The hand hygiene guideline, for 
example, strongly recommends that health care workers decontaminate 
their hands before having direct contact with patients. The number of 
recommended practices for each guideline varies. For example, the 2003 
guideline outlining environmental infection control practices contains 
329 recommended practices, whereas the 2006 guideline for influenza 
vaccination of health care personnel has 6 recommended practices. The 
earliest of the guidelines, which was on catheter-associated UTIs, was 
published in February 1981, and as of December 2007, the most recent, a 
revision of the guideline for isolation precautions, was published in 
June 2007. 

Table 1: CDC's Infection Control and Prevention Guidelines, with Number 
of Recommended Practices, Issued between 1981 and 2007: 

1; Guideline (issue date): Guideline for Prevention of Catheter- 
associated Urinary Tract Infections (1981); 
Total number of recommended practices: 24. 

2; Guideline (issue date): Guideline for Infection Control in Health 
Care Personnel (1998); 
Total number of recommended practices: 183. 

3; Guideline (issue date): Guideline for Prevention of Surgical Site 
Infection (1999); 
Total number of recommended practices: 63. 

4; Guideline (issue date): Guidelines for Preventing Opportunistic 
Infections among Hematopoietic Stem Cell Transplant Recipients (2000); 
Total number of recommended practices: [A]. 

5; Guideline (issue date): Guidelines for the Prevention of 
Intravascular Catheter-Related Infections (2002); 
Total number of recommended practices: 111. 

6; Guideline (issue date): Guideline for Hand Hygiene in Health-Care 
Settings (2002); 
Total number of recommended practices: 42. 

7; Guideline (issue date): Recommendations for Using Smallpox Vaccine 
in a Pre-Event Vaccination Program (2003); 
Total number of recommended practices: [B]. 

8; Guideline (issue date): Guidelines for Environmental Infection 
Control in Health-Care Facilities (2003); 
Total number of recommended practices: 329. 

9; Guideline (issue date): Guidelines for Preventing Health-Care- 
Associated Pneumonia (2003); 
Total number of recommended practices: 208. 

10; Guideline (issue date): Guidelines for Preventing the Transmission 
of Mycobacterium Tuberculosis in Health-Care Settings (2005); 
Total number of recommended practices: [B]. 

11; Guideline (issue date): Influenza Vaccination of Health-Care 
Personnel (2006); 
Total number of recommended practices: 6. 

12; Guideline (issue date): Management of Multidrug-Resistant Organisms 
in Healthcare Settings (2006); 
Total number of recommended practices: 80. 

13; Guideline (issue date): Guideline for Isolation Precautions: 
Preventing Transmission of Infectious Agents in Healthcare Settings 
(2007); 
Total number of recommended practices: 152. 

Guideline (issue date): Total; 
Total number of recommended practices: 1,198. 

Source: GAO analysis of CDC guidelines. 

[A] For the purpose of this table, we do not include a count of the 
recommended practices in this guideline because the guideline is 
targeted to a specific patient population that not all hospitals treat. 
However, for the hospitals that do treat such patients, this guideline 
provides at least another 164 recommended practices. 

[B] The practices in these guidelines are not organized in a way that 
supports counting the total number of practices. 

[End of table] 

The practices in these 13 guidelines are categorized primarily based on 
the strength of the scientific evidence, and these categories have 
changed over time. Basing the categories on the strength of the 
evidence means that the more highly recommended practices have more and 
better scientific support indicating their effectiveness than those 
practices that are not as highly recommended. Seven of the guidelines 
published between 2002 and 2007 used five categories: (1) strongly 
recommended for implementation and strongly supported by well-designed 
experimental, clinical, or epidemiological studies; (2) strongly 
recommended for implementation and supported by some experimental, 
clinical, or epidemiologic studies and a strong theoretical rationale; 
(3) suggested for implementation by suggestive clinical or 
epidemiologic studies; (4) additional practices, including federal, 
state, and other requirements; and (5) not recommended due to 
insufficient evidence or lack of consensus regarding efficacy.[Footnote 
24] Over 500 practices in these 7 guidelines fall into one of the two 
strongly recommended categories. Six of the 7 guidelines identify 82 
practices that are not recommended, due to a lack of evidence 
supporting a recommendation. (See table 2.) For example, the 2003 
guideline for preventing health-care-associated pneumonia identifies 45 
practices that are not recommended. The four guidelines issued between 
1981 and 2000 ranked recommended practices into between three and five 
categories.[Footnote 25] The 2003 guideline on smallpox vaccine and the 
2005 guideline on mycobacterium tuberculosis contain recommended 
practices, but they are not categorized.[Footnote 26] 

Table 2: Number of Practices in the Seven CDC Infection Control and 
Prevention Guidelines That Used the Five Categories, by Category: 

Guideline: Guidelines for the Prevention of Intravascular Catheter- 
Related infections (2002); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 39; 
Recommended practices: Strongly recommended and supported (Category 2): 
39; 
Recommended practices: Suggested for implementation (Category 3): 33; 
Recommended practices: Total number of recommended practices: 111; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 3; 
Not recommended practices (Category 5): 8. 

Guideline: Guideline for Hand Hygiene in Health-Care Settings (2002); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 9; 
Recommended practices: Strongly recommended and supported (Category 2): 
20; 
Recommended practices: Suggested for implementation (Category 3): 13; 
Recommended practices: Total number of recommended practices: 42; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 2; 
Not recommended practices (Category 5): 2. 

Guideline: Guidelines for Environmental Infection Control in Health- 
Care Facilities (2003); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 10; 
Recommended practices: Strongly recommended and supported (Category 2): 
134; 
Recommended practices: Suggested for implementation (Category 3): 185; 
Recommended practices: Total number of recommended practices: 329; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 94; 
Not recommended practices (Category 5): 16. 

Guideline: Guidelines for Preventing Health-Care-Associated Pneumonia 
(2003); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 28; 
Recommended practices: Strongly recommended and supported (Category 2): 
97; 
Recommended practices: Suggested for implementation (Category 3): 83; 
Recommended practices: Total number of recommended practices: 208; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 1; 
Not recommended practices (Category 5): 45. 

Guideline: Influenza Vaccination of Health-Care Personnel (2006); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 1; 
Recommended practices: Strongly recommended and supported (Category 2): 
3; 
Recommended practices: Suggested for implementation (Category 3): 2; 
Recommended practices: Total number of recommended practices: 6; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 0; 
Not recommended practices (Category 5): 0. 

Guideline: Management of Multidrug-Resistant Organisms in Healthcare 
Settings (2006); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 2; 
Recommended practices: Strongly recommended and supported (Category 2): 
60; 
Recommended practices: Suggested for implementation (Category 3): 18; 
Recommended practices: Total number of recommended practices: 80; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 1; 
Not recommended practices (Category 5): 4. 

Guideline: Guideline for Isolation Precautions: Preventing Transmission 
of Infectious Agents in Healthcare Settings (2007); 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 21; 
Recommended practices: Strongly recommended and supported (Category 2): 
83; 
Recommended practices: Suggested for implementation (Category 3): 48; 
Recommended practices: Total number of recommended practices: 152; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 3; 
Not recommended practices (Category 5): 7. 

Guideline: Total by category; 
Recommended practices: Strongly recommended and strongly supported 
(Category 1): 110; 
Recommended practices: Strongly recommended and supported (Category 2): 
436; 
Recommended practices: Suggested for implementation (Category 3): 382; 
Recommended practices: Total number of recommended practices: 928; 
Additional practices including federal, state, and other 
requirements[A] (Category 4): 104; 
Not recommended practices (Category 5): 82. 

Source: GAO analysis of CDC guidelines. 

Notes: CDC has 13 infection control guidelines, of which about half are 
categorized using the five categories displayed in this table. 

[A] For the purpose of this table, Category 4 excludes a count of 
practices that CDC also classified as recommended. More than 84 percent 
of the practices in Category 4 are, for example, Occupational Safety 
and Health Administration workplace standards, building and engineering 
standards, or administrative plans or procedures. 

[End of table] 

In general, CDC took an average of about 3 years to develop each 
guideline--ranging from less than 1 year to 6 years. CDC officials 
agreed that the amount of time it took to prepare a guideline has been 
long. CDC reported that it has been developing one guideline that is 
still in draft form--the Guideline for Disinfection and Sterilization 
in Healthcare Facilities--for over 7 years.[Footnote 27] This guideline 
has taken a long time to develop, in part, according to CDC officials, 
because the agency had to coordinate with other agencies involved in 
the oversight of disinfection and sterilization products. CDC officials 
said they were working to reduce the time it takes to develop 
guidelines by issuing shorter and more focused guidelines. 

CDC and AHRQ Have Taken Steps to Promote Implementation of Practices to 
Reduce HAIs but Lack Prioritization of These Practices to Guide Their 
Actions: 

CDC officials identified some activities that the agency has undertaken 
to promote the implementation of the recommended practices in its 
guidelines.[Footnote 28] CDC disseminates its infection control 
guidelines by publishing them in the Morbidity and Mortality Weekly 
Report, posting them on CDC's Web site, and distributing training 
videos. CDC has also provided some funding support to groups that are 
developing ways to implement selected recommendations in CDC infection 
control guidelines. For example, through its Prevention Epicenter 
Program,[Footnote 29] CDC provided financial support and technical 
assistance to a study that was assessing the effect of an intervention 
to prevent catheter-associated BSIs. The researchers reviewed 
participating hospitals' policies and procedures on a commonly used 
catheter, updated them to reflect CDC's Guidelines for the Prevention 
of Intravascular Catheter-Related Infections, and implemented an 
intervention designed to educate staff about the importance of 
implementing a group of selected recommendations in that 
guideline.[Footnote 30] In a similar effort, CDC provided technical 
support and funding to the Pittsburgh Regional Healthcare Initiative, 
which reportedly has demonstrated a 68 percent decline in BSIs over a 4-
year period among intensive care unit patients.[Footnote 31] 

AHRQ officials also reported undertaking some initiatives to promote 
implementation of practices aimed at reducing HAIs. In 2007, AHRQ 
issued a report that evaluated several strategies, such as clinician 
and patient education, for possible use in hospitals to increase 
implementation of specified infection prevention practices related to 
catheterization, surgical antibiotic prophylaxis, central lines, and 
ventilator-associated pneumonia (VAP) interventions.[Footnote 32] 
Although researchers were unable to reach any firm conclusions 
regarding actionable strategies to prevent HAIs, they identified four 
strategies worth additional study.[Footnote 33] In addition, through 
its Accelerating Change and Transformation in Organizations and 
Networks program, in September 2007, AHRQ funded several studies to 
improve the implementation of practices that are known to minimize HAIs 
and to identify the challenges to implementing those 
practices.[Footnote 34] The program will implement clinician training 
at 72 hospitals that is designed to facilitate change in clinician 
behaviors and habits, care processes, and the safety culture of the 
participating hospitals. In a document summarizing this initiative, 
AHRQ acknowledges that the problem is not the lack of knowledge of 
infection control techniques, but rather the inability to translate the 
knowledge into social and behavioral changes that can be sustained in 
health care organizations. 

While CDC and AHRQ have taken steps to promote the implementation of 
practices to reduce HAIs, these steps have not been guided by a 
prioritization of recommended practices. As WHO has indicated in its 
hand hygiene guideline, when there is a large number of practices it is 
important to prioritize them. One factor to consider in prioritization 
is strength of evidence, which CDC has primarily relied on to 
categorize its recommended practices. However, a 2001 AHRQ study 
suggested other factors to consider in prioritizing recommended 
practices. This study rated 79 patient safety practices--including 22 
practices that were related to HAIs--on their potential to improve 
patient safety. The study examined not only strength of the evidence, 
but also such factors as: 

* the potential magnitude of impact of the practice on mitigating 
patient death or disability, 

* the financial cost of implementing the practice, 

* the complexity of implementing the practice, 

* the organizational and technical obstacles, and: 

* the risk that other negative consequences could occur if the practice 
were put into place. 

In addition to CDC, AHRQ has reviewed scientific evidence for certain 
practices related to HAIs, but the efforts of the two agencies have not 
been coordinated. For example, both agencies independently examined 
various aspects of the evidence related to improving hand hygiene 
compliance, such as the selection of hand hygiene products and health 
care worker education. Although this could have been an opportunity for 
coordination, an official from the HHS Office of the Secretary told us 
that no one within the office is responsible for coordinating infection 
control activities across HHS.[Footnote 35] 

CMS's and Accrediting Organizations' Required Hospital Standards 
Describe Components of Infection Control Programs, and Compliance with 
These Standards Is Assessed through On-Site Surveys: 

The infection control standards that CMS, the Joint Commission, and AOA 
require as part of the hospital certification and accreditation 
processes vary in number and content among the organizations, and 
generally describe the fundamental components of a hospital infection 
control program, that is, the active prevention, control, and 
investigation of infections. Examples of standards and corresponding 
standards interpretations that hospitals must follow include educating 
hospital personnel about infection control and having infection control 
policies in place. CMS, the Joint Commission, and AOA standards 
generally do not require that hospitals implement all recommended 
practices in CDC's infection control and prevention guidelines. Only 
the Joint Commission and AOA have standards that require the 
implementation of certain practices recommended in CDC's infection 
control guidelines. For example, the Joint Commission and AOA require 
hospitals to annually offer influenza vaccinations to health care 
workers, which is recommended in CDC's Influenza Vaccination of Health 
Care Personnel guideline. CMS, the Joint Commission, and AOA assess 
compliance with their infection control standards through direct 
observation of hospital activities and review of hospital policy 
documents during on-site surveys. 

Standards for Hospitals on Infection Control Required by CMS and 
Accrediting Organizations Describe Components of Infection Control 
Programs: 

CMS, Joint Commission, and AOA standards for hospital certification and 
accreditation include standards on infection control. In contrast to 
CDC's infection control guidelines, which describe clinical practices 
recommended to reduce HAIs, the CMS, Joint Commission, and AOA 
standards and their interpretations--which include the performance 
expectations and explain the standards--describe the fundamental 
components of a hospital's infection control program, the overall goal 
of which is the prevention, control, and investigation of infections. 

CMS's infection control COP, the Joint Commission's chapter on 
infection control, and AOA's chapter on infection control have varying 
numbers of standards, some of which have been updated more recently 
than others. (See app. II for CMS's, Joint Commission's, and AOA's 
infection control standards for hospitals): 

* CMS's infection control COP contains two standard-level requirements 
and has not substantially changed since 1986.[Footnote 36] CMS's State 
Operations Manual: Appendix A provides guidance to surveyors in 
assessing compliance with the COP and explains its intent. CMS issued 
revised guidance to surveyors for assessing the infection control COP 
on November 21, 2007, with an immediate effective date. 

* The Joint Commission has 10 infection control standards in the 
infection control chapter of its manual, the Comprehensive 
Accreditation Manual for Hospitals: The Official Handbook.[Footnote 37] 
The Joint Commission describes its standards as broad, overarching 
compliance principles. The Joint Commission manual provides hospitals 
with information about the accreditation process, including how to 
comply with the 10 standards in the infection control chapter, and 
presents a rationale for each standard and "elements of performance," 
which describe the specific requirements for a hospital to be in 
compliance with a standard. There are a total of 48 elements of 
performance associated with the standards in the infection control 
chapter, ranging from 2 to 8 per standard. In 2006 the Joint Commission 
began revising its hospital standards, including the infection control 
standards. These revisions, which the Joint Commission officials 
described as clarifications to existing standards, will take effect on 
January 1, 2009.[Footnote 38] The Joint Commission manual also 
describes other requirements hospitals must meet to be accredited by 
the Joint Commission, such as the eight National Patient Safety Goals 
for 2008, one of which relates to HAIs and requires hospitals to (1) 
comply with the current WHO hand hygiene guideline or CDC hand hygiene 
guideline[Footnote 39] and (2) manage as a "sentinel event" all 
identified cases of unanticipated death or major permanent loss of 
function associated with an HAI.[Footnote 40] 

* AOA has 51 standards in the "Infection Control" chapter of its 
Accreditation Requirements for Healthcare Facilities manual, which also 
provides guidance to surveyors in applying AOA's standards, and these 
were last updated in 2005.[Footnote 41] AOA officials also told us they 
anticipated updating this chapter to reflect CMS's revised infection 
control COP guidance. 

As a whole, the CMS, Joint Commission, and AOA standards and their 
interpretations describe similar required elements of hospital 
infection control programs. Similarities include the following: 

* The infection control program is hospitalwide. 

* The hospital designates a person or persons as responsible for the 
infection control program. 

* The hospital develops policies to control and reduce infections. 

* The hospital educates health care personnel, patients, and family 
members about infection control. 

* The hospital conducts surveillance activities, which include 
infection-related data collection and analysis. 

* The hospital evaluates the effectiveness of infection control 
activities and modifies or updates the infection control program as 
needed. 

However, there are also differences between the CMS, Joint Commission, 
and AOA infection control standards and their interpretations. One 
example is that the CMS and AOA standards specify that the hospital 
should maintain a log of infections and communicable diseases detected 
at the hospital, whereas the Joint Commission has several standards 
whose elements of performance state that hospitals should collect 
infection control surveillance data. Another difference is the extent 
to which the standards and their interpretations require implementation 
of practices recommended in CDC's infection control guidelines. The 
CMS, Joint Commission, and AOA standards generally do not require that 
hospitals implement all required practices in CDC's infection control 
and prevention guidelines. While CMS's and the accrediting 
organizations' standards interpretations make general references to 
incorporating guidelines into the hospital's infection control 
activities, only the Joint Commission and AOA have standards that 
require the implementation of certain practices recommended in CDC's 
infection control guidelines. The CMS standards interpretations have a 
more general statement that a hospital with a comprehensive 
hospitalwide infection control program should adopt policies and 
procedures based as much as possible on national guidelines. For 
example: 

* As noted previously, a Joint Commission National Patient Safety Goal 
requires hospitals to implement selected practices in either CDC's or 
WHO's hand hygiene guideline.[Footnote 42] AOA has a standard on hand 
washing that requires hospitals to have policies and procedures on 
practices related to hand decontamination and the prevention of HAIs, 
some of which are also recommended in CDC's guidelines, such as the 
elimination of artificial nails for staff working in intensive care 
units. The CMS standards interpretations are more general, stating that 
hospitals should adopt policies and procedures based on national 
guidelines that, among other things, address the mitigation of risks 
that contribute to HAIs by, for example, promoting hand washing hygiene 
among staff and employees, including use of alcohol-based hand 
sanitizers. 

* Two AOA standards require hospitals to comply with certain practices 
recommended in CDC's guidelines that reduce surgical site infections 
and prevent central venous catheter-related infections. The CMS and 
Joint Commission standards and their interpretations are not as 
specific. The CMS standards interpretations state that a hospital with 
a comprehensive infection control program should adopt policies and 
procedures that address the mitigation of risk associated with HAIs, 
including surgery-related infections and device-associated infections. 
The Joint Commission standards interpretations state that hospitals set 
goals that include minimizing the risk of transmitting infections 
associated with the use of procedures, medical equipment, and medical 
devices and implement methods such as appropriate sterilization 
techniques to reduce those risks. 

* Both the Joint Commission and AOA standards incorporate 
recommendations from CDC's guideline Influenza Vaccination of Health- 
Care Personnel by requiring hospitals to annually offer influenza 
vaccinations to health care workers. In contrast, the CMS standards 
interpretations are more general, stating that hospitals should adopt 
policies and procedures that address hospital-staff-related issues, 
such as evaluating hospital staff immunization status for designated 
infectious diseases, as recommended by CDC and its Advisory Committee 
on Immunization Practices. 

Compliance with Required Infection Control Standards Is Assessed 
through Observation and Document Review during On-Site Surveys of 
Hospitals: 

During on-site surveys, CMS, Joint Commission, or AOA surveyors assess 
compliance with their respective infection control standards by 
directly observing patient care, interviewing hospital staff, and 
reviewing key infection control documents, such as the hospital's 
infection control plan. In addition, the Joint Commission's surveyors 
assess compliance with the infection control standards by conducting an 
infection control system tracer, which is designed to address a 
hospital's overall system for detecting and preventing infections. 
Joint Commission officials noted that they foster compliance with the 
practices for reducing HAIs by using a "systems-based" 
approach.[Footnote 43] Throughout each on-site survey, CMS, the Joint 
Commission, and AOA surveyors document noncompliance with the standards 
that they observe. For example, CMS, Joint Commission, and AOA 
officials told us that surveyors document observations of poor hand 
hygiene (e.g., a health care worker not washing his or her hands). 

Based on the results of the surveys, CMS and the accrediting 
organizations assess a hospital's compliance with the infection control 
standards. CMS, Joint Commission, and AOA surveyors are required to 
cite all instances of noncompliance. At the end of each survey, CMS 
surveyors review the observations of noncompliance for each standard 
and determine whether to cite the hospital at the condition level or 
the standard level based on the nature (i.e., severity) and extent 
(i.e., prevalence) of the noncompliance. A CMS-surveyed hospital is 
required to develop a corrective action plan within 10 days of 
receiving a report documenting the noncompliance found during a 
survey.[Footnote 44] The Joint Commission assesses each of the elements 
of performance that constitute the infection control standards as 
satisfactory, partially compliant, or insufficient. The entire standard 
is assessed as not compliant if the hospital has insufficient 
compliance with any of the corresponding elements of performance or if 
the hospital is partially compliant with 35 percent or more of the 
elements of performance. Joint Commission-surveyed hospitals have 45 
days from receipt of the survey results to submit a report to the Joint 
Commission that describes the steps the hospitals took to become 
compliant with any standards that were assessed as not 
compliant.[Footnote 45] The AOA standards are assessed on a scale from 
1 to 4, which varies by standard, where 1 indicates full compliance and 
4 indicates noncompliance. AOA-surveyed hospitals have 30 days to 
report to AOA on the steps they took to become compliant with standards 
assessed as noncompliant that indicate immediate jeopardy or are at the 
CMS condition level and 60 days to address other standards assessed as 
noncompliant. Among the surveys conducted in the first quarter of 2007, 
12.6 percent of state-agency-surveyed hospitals, 17.6 percent of Joint 
Commission-surveyed hospitals, and 22.2 percent of AOA-surveyed 
hospitals were cited as noncompliant with one of the respective 
organizations' standards on infection control.[Footnote 46] 

Between regular surveys, limited information about compliance with the 
infection control standards may be identified through validation and 
complaint surveys of hospitals conducted by state survey agencies. 
State survey agencies conduct validation surveys for CMS on a small 
number of Joint Commission-accredited hospitals within 60 days of their 
last Joint Commission survey and compare the results of the two 
surveys.[Footnote 47] For example, in fiscal year 2006, state agencies 
conducted validation surveys at 67 hospitals. State survey agencies 
conduct complaint surveys in response to complaints made by patients, 
family members, or health care providers.[Footnote 48] In the first 
quarter of calendar year 2007, state survey agencies conducted 1,119 
complaint surveys in 828 hospitals, and infection control deficiencies 
were found at 3.5 percent of the hospitals. 

Information about hospital compliance with infection control standards 
is generally not publicly reported on Web sites, although the Joint 
Commission reports compliance with its National Patient Safety Goals on 
its Web site. It reported that in calendar year 2006, 91.2 percent of 
the hospitals surveyed that year were compliant with the goal related 
to implementing CDC's hand hygiene guideline, and 100 percent were 
compliant with the goal related to managing all identified cases of 
unanticipated death or major permanent loss of function associated with 
an HAI as a sentinel event. The rate reported by the Joint Commission 
in 2006 for adherence to hand hygiene practices was much higher than 
some studies had reported. For example, in the 2002 Guideline for Hand 
Hygiene in Health-Care Settings, CDC cited several observational 
studies of health care workers and reported the average adherence 
across the studies to be 40 percent.[Footnote 49] The Joint 
Commission's surveyors assess this requirement by interviewing and 
observing hospital employees and would assess a hospital as 
noncompliant with the requirement if the surveyors observed 
noncompliance three or more times. Joint Commission officials 
acknowledged that their assessment mechanism might not sufficiently 
measure compliance because hospital staff could be on their best 
behavior when surveyors were present. Joint Commission officials told 
us they anticipated publishing in 2008 examples of different ways to 
measure adherence to hand hygiene as well as tools and training 
materials that hospitals could use to improve their hand hygiene 
compliance. 

Multiple HHS Programs Collect Data on HAIs, but Lack of Integration of 
Available Data and Other Problems Limit Utility of the Data: 

Three agencies within HHS--CDC, CMS, and AHRQ--currently collect HAI- 
related data for a variety of purposes in four separate databases, but 
each of these databases presents only a partial view of the extent of 
the HAI problem. Each database focuses its data collection on selected 
types of HAIs and collects data from a different subset of hospital 
patients across the country. Although officials from the various HHS 
agencies discuss HAI data collection with each other, we did not find 
that the agencies were taking steps to integrate any of the existing 
data by creating linkages across the databases such as standardizing 
patient identifiers or other data items. Creating linkages across the 
HAI-related databases could enhance the availability of information to 
better understand where and how HAIs occur. Although none of the 
databases collect data on the incidence of HAIs for a nationally 
representative sample of hospital patients, CDC officials have produced 
national estimates of HAIs. However, those estimates derive from 
assumptions and extrapolations that raise questions about the 
reliability of those estimates. 

Multiple HHS Agencies Collect Different Data on HAIs, but These Data 
Present Only a Partial View of the Extent of the Problem: 

Three agencies within HHS currently collect HAI-related data in four 
separate databases, which were created for a variety of purposes. These 
are the databases associated with CDC's National Healthcare Safety 
Network (NHSN), CMS's Medicare Patient Safety Monitoring System 
(MPSMS), CMS's Annual Payment Update (APU) program, and AHRQ's 
Healthcare Cost and Utilization Project (HCUP). 

The most detailed source of information on HAIs within HHS is the NHSN 
database.[Footnote 50] CDC established the NHSN database in 2005 to 
combine the data it had previously collected on HAIs through the 
National Nosocomial Infections Surveillance (NNIS) system with data 
from two other related databases.[Footnote 51] CDC instituted NNIS as a 
voluntary program in the 1970s to assist hospitals that wanted to 
monitor their HAI rates. CDC analyzed the data submitted by those 
hospitals--which tended to be disproportionately large hospitals, many 
of them academic medical centers--in order to provide the hospitals 
with a benchmark HAI rate against which to compare their own rates. In 
addition, CDC drew on these data to publicly report aggregate trends in 
selected HAIs, and it continues to do that with the data being 
submitted to the NHSN database.[Footnote 52] Many of the hospitals that 
voluntarily participated in the NNIS database have continued to submit 
HAI data voluntarily to the NHSN database. CDC is working with a number 
of states implementing mandatory programs for hospitals to submit HAI- 
related data, using NHSN as the designated mechanism by which hospitals 
must submit their data.[Footnote 53] As a result, by the end of 
December 2007, approximately 1,000 hospitals were enrolled in the NHSN 
database, some of which continued to participate by choice while others 
enrolled in the NHSN program because of state mandates.[Footnote 54] 

The NHSN program provides hospitals with substantial flexibility to 
determine the scope of their HAI data collection efforts. Participating 
hospitals can choose which types of HAIs they will submit data on from 
among those for which the NHSN program has developed detailed 
definitions and protocols, including such device-associated infections 
as central-line-associated BSIs, catheter-associated UTIs, and VAP, as 
well as procedure-related HAIs such as SSIs and postprocedure 
pneumonia. Hospitals also choose the specific hospital units (typically 
different kinds of intensive care units) to monitor for device- 
associated HAIs and the specific surgical procedures to monitor for 
SSIs and postprocedure pneumonia. Hospital staff are supposed to follow 
the detailed definitions and protocols that the NHSN program specifies 
to identify which patients currently under treatment have developed one 
of the targeted infections. Hospitals also have to provide at least 
some HAI data for 6 months of the year to maintain their enrollment in 
the NHSN program.[Footnote 55] 

The MPSMS database provides CMS with information on national trends in 
the incidence of selected adverse events among hospitalized Medicare 
beneficiaries, including a number of different types of HAIs. Beginning 
with hospital discharges from 2002, CMS has collected these data from 
the medical records selected for annual random samples of approximately 
25,000 Medicare inpatients,[Footnote 56] though the list of specific 
adverse events monitored has varied over time. A CMS contractor 
receives copies of these medical records after the patients' discharge 
from the hospital, and the contractor's abstractors[Footnote 57] follow 
CMS's detailed protocols to extract and record specific information on 
each patient in the sample. These data elements are then entered into 
algorithms that determine which patients meet CMS's case selection 
criteria for experiencing the adverse event and for being at risk for 
the adverse event. For example, the abstractors would determine which 
of the sampled patients had a central line catheter inserted during 
that hospital stay and which of those patients had laboratory reports 
indicating a BSI not present at admission, which together would allow 
the calculation of the rate of central-line-associated BSIs.[Footnote 
58] Since 2004, HHS has publicly reported some of the rates of adverse 
events from the MPSMS database in the National Healthcare Quality 
Report and National Healthcare Disparity Report, both of which are 
issued annually by AHRQ. 

The APU program implemented a financial incentive for hospitals to 
submit to CMS data that are used to calculate hospital performance on 
measures of the quality of care they provide. The APU program receives 
quality-related data from hospitals on a quarterly basis for a range of 
medical conditions and, in 2007, began to require submission of 
information on three specific surgical infection prevention measures. 
[Footnote 59] Hospitals paid under Medicare's inpatient prospective 
payment system receive a higher rate of payment if they submit these 
quality data that address their performance on recommended care 
practices. During fiscal year 2008, 3,270 hospitals will receive this 
higher level of payment, which represents 93 percent of hospitals 
eligible to participate in the APU program.[Footnote 60] For patients 
who underwent specified surgical procedures, hospital staff review 
their medical records after discharge and, following detailed protocols 
from CMS, extract and record items of information that relate to three 
infection prevention practices that are associated with reduced risks 
of acquiring an SSI: (1) providing antibiotics within 1 hour of the 
surgery, (2) selecting appropriate antibiotics to prevent surgical 
infections, and (3) stopping the administration of the antibiotics 
within 24 hours of the end of the surgery. This information in turn is 
entered into algorithms that determine what proportion of patients who 
met CMS's criteria for designation as eligible for these infection 
prevention measures actually received them. CMS publicly reports these 
results for each hospital individually on its Web site, Hospital 
Compare, along with state and national averages for 
comparison.[Footnote 61] 

AHRQ sponsored the development of the HCUP databases to create a 
national information resource of patient-level health care data. One of 
the HCUP databases assembles a sample of patient hospital discharge 
data from 37 states and converts them to a uniform format that enables 
the application of AHRQ's 20 Patient Safety Indicators (PSI)--including 
two that relate to HAIs--to an approximate national sample of all 
hospital patients.[Footnote 62] The two PSIs related to HAIs involve 
(1) "selected infections due to medical care," which focuses on 
infections caused by intravenous lines and catheters, and (2) 
postoperative sepsis among patients undergoing elective surgery. 
[Footnote 63] The PSIs are designed to identify patient safety issues 
by using the kinds of data that are available in hospital discharge 
data sets--specifically International Classification of Diseases, Ninth 
Revision (ICD-9), diagnostic and procedure codes, as well as patient 
demographics and admission and discharge status--and can be used with 
the HCUP database without collecting any additional information from 
patient medical records. However, these indicators are intended to be 
used as quality improvement tools to highlight aggregate patterns, and 
so they do not identify specific instances of adverse events with a 
high degree of precision.[Footnote 64] AHRQ has posted national 
estimates for these two indicators--along with the other PSIs-
-on its Web site, showing the trend from 1994 to 2004.[Footnote 65] 

Two HHS agencies collect, or plan to collect, some limited additional 
information about HAIs in other HHS databases. FDA obtains data on 
deaths or serious injuries related to the use of medical devices and 
stores them in the Manufacturer and User Facility Device Experience 
Database. A small portion of these adverse events may involve 
HAIs.[Footnote 66] FDA uses these data to identify devices whose safety 
warrants closer scrutiny, such as might be warranted for heart valves 
that were not properly sterilized by the manufacturer. AHRQ is 
developing a database on adverse events, including HAIs, that will 
assemble data voluntarily submitted by hospitals to multiple Patient 
Safety Organizations (PSO).[Footnote 67] AHRQ officials told us that 
they planned to disseminate aggregate results derived from the PSOs in 
an annual report.[Footnote 68] 

Each of the four main HHS databases that currently collect information 
about HAIs presents only a partial view of the extent of the problem. 
None of them can provide information on the full range of HAIs, because 
each focuses its data collection on selected types of HAIs (see table 
3).[Footnote 69] In addition, none of the databases can address the 
frequency of even these selected HAIs for the nation as a whole, 
because each collects data from different subsets of the nationwide 
population of hospital patients. Although two databases--NHSN and 
MPSMS--address many of the same types of HAIs, the former provides 
information only from selected units of hospitals that participate in 
the NHSN program (which do not represent hospitals nationwide) while 
the latter provides information only on a representative sample of 
Medicare inpatients (i.e., MPSMS does not provide information on non- 
Medicare patients). The APU program does not collect information on 
patients with HAIs, but instead tracks the implementation of practices 
intended to prevent SSIs. The other three databases attempt to identify 
patients who developed infections as a result of their hospital stay 
using different data sources and varying approaches. The methods 
employed by the NHSN, MPSMS, and HCUP databases range from concurrent 
review of patient care as patients are treated in the hospital, to 
retrospective review of patient medical records after patients are 
discharged, to analyses of diagnostic codes recorded electronically in 
patient billing data. 

Table 3: Selected Characteristics of HHS Databases That Contain HAI- 
Related Information: 

Responsible agency and database: CDC's National Healthcare Safety 
Network (NHSN); 
HAI-related data collected: Infection types; 
* central-line-associated BSI; 
* catheter-associated UTI; 
* VAP; 
* postprocedure pneumonia; 
* SSI; * MDRO[A]; 
* other[B]; 
Population for which data are collected: Most hospitals report on 
patients in selected critical care units and those undergoing selected 
procedures such as coronary bypass surgery and colon surgery; 
Hospital role in collecting data: Hospital staff conduct medical review 
of signs, symptoms, and laboratory and radiological test results while 
patient is an inpatient. Hospital staff enter electronic information 
into database over the Internet; 
Type of HAI information published by HHS: CDC publishes rate of 
infection by type of infection and type of hospital unit or procedure 
for hospitals, in aggregate. 

Responsible agency and database: CMS's Medicare Patient Safety 
Monitoring System (MPSMS); 
HAI-related data collected: Infection types[C]; 
* central-line-associated BSI; 
* catheter-associated UTI; 
* postoperative pneumonia; 
* antibiotic-associated C. difficile; 
* MRSA; 
* VRE; 
Population for which data are collected: National sample of 
hospitalized Medicare patients; 
Hospital role in collecting data: Hospital staff send a copy of sampled 
medical records to CMS, which are reviewed by contract abstractors; 
Type of HAI information published by HHS: AHRQ publishes national-level 
data on percentage of Medicare patients who experience selected 
infection types in two annual reports.[D]. 

Responsible agency and database: CMS's Annual Payment Update (APU) 
database; 
HAI-related data collected: Practices to prevent or reduce SSIs; 
* providing antibiotics within 1 hour of surgery; 
* selecting appropriate antibiotics to prevent surgical infections; 
* stopping the administration of the antibiotics within 24 hours of end 
of surgery; 
Population for which data are collected: National inpatient population 
for selected surgical procedures[E]; 
Hospital role in collecting data: Medical record review by hospital 
staff after patient's discharge. The hospital sends data to a CMS 
contractor; 
Type of HAI information published by HHS: CMS posts on a public Web 
site the proportion of patients receiving recommended practice, by 
hospital, as well as the state and national average. 

Responsible agency and database: AHRQ's Healthcare Cost and Utilization 
Project (HCUP) database, Nationwide Inpatient Sample; 
HAI-related data collected: Infection types; 
* postoperative sepsis[F]; 
* "infection due to medical care" (focused on intravenous and catheter 
infections); 
Population for which data are collected: A sample of inpatients in 
hospitals in 37 states; 
Hospital role in collecting data: HCUP obtains hospital discharge data 
with ICD-9 diagnostic and procedure codes from statewide data systems; 
Type of HAI information published by HHS: AHRQ posts on its Web site 
national-level data on the proportion of patients with ICD-9 codes 
indicative of the two infection types. 

Sources: GAO analysis of CDC, CMS, and AHRQ information. 

Notes: BSI is bloodstream infection; C. difficile is Clostridium 
difficile; ICD-9 is International Classification of Diseases, Ninth 
Revision; MDRO is multidrug-resistant organism; MRSA is methicillin- 
resistant Staphylococcus aureus; SSI is surgical site infection; UTI is 
urinary tract infection; VAP is ventilator-associated pneumonia; and 
VRE is vancomycin-resistant enterococci. 

[A] For patients whose infections are laboratory-confirmed, NHSN 
collects data on the pathogens identified, and for specified pathogens 
(including those responsible for MRSA and VRE), the result of any 
testing of their resistance to specific antibiotics. Participating 
hospitals have the option to report separately the number of times in a 
given month that they tested specimens of any of eight specified 
organisms for resistance to selected antibiotics, as well as the 
results of those tests. From these data, NHSN produces rates of 
antimicrobial resistance relative to the number of nonduplicative 
specimens tested (i.e., excluding multiple tests for the same organism 
in the same patient). This part of NHSN does not distinguish between 
MDRO infections acquired in the hospital and community-acquired 
infections present at admission. 

[B] Hospitals can choose to submit to NHSN data on other types of HAIs, 
such as skin and soft tissue infections, cardiovascular system 
infections, and gastrointestinal system infections. CDC does not 
provide data collection protocols for these types of infections, but 
they can be entered into NHSN as "custom events" using definitions 
provided separately by CDC. 

[C] In 2007, CMS added catheter-associated UTIs, VAP, MRSA, and VRE to 
MPSMS and dropped insertion-site infections associated with central 
vascular catheters, BSIs, and postoperative-associated UTIs. 

[D] The two annual reports are The National Healthcare Quality Report 
and The National Healthcare Disparities Report. 

[E] The three practice measures are assessed for certain categories of 
surgeries: coronary artery bypass graft; other cardiac surgery; colon 
surgery; hip arthroplasty; knee arthroplasty; abdominal hysterectomy; 
vaginal hysterectomy; and vascular surgery. 

[F] The rate of postoperative sepsis is computed only for patients 
undergoing elective surgeries. 

[End of table] 

The four databases also apply different sets of procedures to ensure 
the validity of their data, and each set has its own limitations. For 
the NHSN program, CDC requires participating hospitals to agree to its 
detailed instructions for identifying patients with HAIs, but CDC 
currently has no process in place to check how thoroughly and 
consistently those instructions are followed.[Footnote 70] For the 
MPSMS program, CMS relies on internal procedures performed by a 
contractor that collects the data to routinely monitor the interrater 
reliability of its abstractors. However, CMS has not assessed the 
completeness or accuracy of the information in patient medical records 
that the MPSMS database measures rely on and how that might affect the 
HAI rates reported by the MPSMS program. CMS requires hospitals that 
submit APU data to have a small sample of their cases checked each 
quarter by a CMS contractor.[Footnote 71] The contractor assesses the 
accuracy with which the hospital abstracted its APU data from patient 
medical records. AHRQ's HCUP database relies on ICD-9 codes filed with 
patient bills.[Footnote 72] Many hospitals have their ICD-9 coding 
periodically checked by outside auditors, but the reason is to 
determine accuracy for billing purposes, not whether patients 
experienced HAIs. 

Among the four databases, NHSN collects the most clinically detailed 
information about HAIs, but those data nonetheless have important 
limitations. Among the strengths of the NHSN database is that it 
presents detailed information on HAI rates across different types of 
hospital units and multiple types of HAIs. Moreover, its procedures for 
identifying patients with HAIs draw on the wider range of clinical 
information available while patients are still in the hospital, as 
opposed to retrospective reviews of patient medical records after 
discharge. On the other hand, the NHSN database is much more limited 
than any of the other databases in terms of the patient population that 
it represents. Because the hospitals that submit data either do so by 
choice or, for a limited number of states, by mandate, this group of 
hospitals is not representative of hospitals nationwide, as a random 
sample would be. In addition, the data these hospitals supply do not 
reflect the experience of many of their patients. For example, the 
hospitals that participate in the NHSN program report device-related 
HAIs such as central-line-associated BSIs and VAP for selected hospital 
units such as different types of intensive care units (e.g., coronary, 
burn, surgical, medical). In addition, most of the hospitals that 
participate in the NHSN program report procedure-based HAIs such as 
SSIs and postprocedure pneumonia for a relatively small number of 
specific procedures. For example, during March 2007, 225 hospitals 
reported SSIs for colon surgery and 133 did so for coronary bypass 
surgery, but only 11 hospitals reported SSIs for appendix surgery and 
10 for gallbladder surgery. 

Available Data Are Not Integrated across Programs to Use Them to Their 
Full Potential: 

Although officials from the various HHS agencies discuss HAI data 
collection with each other, we did not find that the agencies were 
taking steps to integrate any of the existing data from the four 
databases that collect HAI-related data. This integration could involve 
creating linkages between existing data by, for example, creating 
common patient identifiers in the different databases so that data on 
the same individuals found in multiple databases could be pulled 
together, or creating "crosswalks" that could specify in detail how 
related data fields in the various databases are similar or different. 
We found that the most extensive exchange of information across the 
three HHS agencies that collect HAI data occurred through the 
participation of their representatives in HICPAC. HICPAC generally 
holds 2-day meetings three times per year, and at each meeting the 
members from the participating HHS agencies typically provide a summary 
of their HAI-related activities. Our review of HICPAC minutes from 2004 
through 2007 identified numerous instances of officials describing what 
their own agency was doing to collect HAI data, but we did not find in 
the HICPAC meeting minutes any evidence that the agencies had taken 
action to create greater compatibility among the databases or to 
address gaps in information across the databases. Outside of HICPAC 
meetings, HHS officials provided other examples of communication and 
outreach among HHS agencies taking place in relation to various 
databases. For example, the MPSMS program has a technical expert panel 
that includes representatives from CDC and AHRQ. Similarly, CMS, CDC, 
and AHRQ are represented on the steering committee for the public- 
private Surgical Care Improvement Project (SCIP), which developed the 
HAI-related measures used in the APU program.[Footnote 73] These group 
discussions allow agency officials to discuss and explain their 
different approaches for collecting HAI data, but the focus of these 
meetings is still on the individual database, rather than on creating 
linkages from one database to another. 

Creating mechanisms for linking data across the HAI-related databases 
could enhance the availability of information to better understand 
where and how HAIs occur. A case in point concerns information 
collected by two of the databases on surgical-related HAIs. 
Approximately 500 hospitals already submit data to APU on surgical 
processes of care and to NHSN on surgical infection rates for some of 
the same patients, but these data are not currently linked. As a 
consequence, the potential benefit of using the existing data to 
monitor the extent to which compliance with the recommended surgical 
care processes leads to actual improvements in surgical infection rates 
has not been realized. Officials at CDC reported that they approached 
CMS about developing mechanisms for linking NHSN data with APU data. To 
do this, CDC officials suggested that CDC and CMS agree to collect 
uniform patient identifiers. Officials at CMS reported that although 
they recognized the potential benefits of linking the APU data with the 
data in related HHS databases, CMS is currently focused on managing the 
expansion of the APU program. 

Data Limitations Preclude Development of Reliable National Estimates: 

HHS cannot use its HAI-related databases to produce reliable national 
estimates of HAI rates, even for the selected types of HAIs monitored, 
because none of the databases collect data on the incidence of HAIs for 
a nationally representative sample of hospital patients. Two of the 
databases--APU and HCUP--come close to covering a national population 
for selected HAIs, but the APU database collects data on practices 
intended to prevent HAIs among surgery patients, not on the number of 
HAIs that occur. In addition, although the information in HCUP relates 
to the incidence of some HAIs, its reliance on diagnostic codes 
recorded in claims data substantially reduces the reliability of that 
information.[Footnote 74] The other two databases--NHSN and MPSMS-- 
collect clinical data on the incidence of selected HAIs, but their data 
do not derive from a representative sample of the national hospital 
patient population because NHSN is limited to selected units of 
participating hospitals that do not represent hospitals nationwide and 
MPSMS is limited to Medicare patients. (See table 3.) 

Recent concerns about the magnitude of HAIs caused by the drug- 
resistant pathogen MRSA have further highlighted limitations in HHS's 
databases for estimating HAI rates. In June 2007, APIC, the 
professional association for infection control professionals, released 
the results of a survey it conducted that showed that 46 of every 1,000 
patients in those hospitals had tested positive for MRSA.[Footnote 75] 
This was a much higher rate than had previously been estimated by 
clinicians. The NHSN database has some information about the frequency 
of MRSA infections, as well as other MDROs, but this information is 
limited to the subset of patients for whom each hospital submits data, 
based on the particular hospital units, infection types, and procedures 
that it has chosen to report to NHSN. Thus, the NHSN database does not 
provide information on the overall proportion of patients in a given 
hospital who were found to have a MRSA infection.[Footnote 76] The 
MPSMS program has begun to collect, but has not yet reported, data on 
the incidence of hospital-acquired MRSA infections within the Medicare 
inpatient population.[Footnote 77] However, a CMS official responsible 
for the program acknowledged that the ability of the MPSMS program to 
detect patients with MRSA infections is limited by its reliance on 
retrospective review of patients' medical records. 

The varying content and methods used to collect and report data on HAIs 
for HHS's four databases also preclude HHS from combining data from the 
databases to produce reliable estimates on either selected HAIs or an 
overall HAI rate. Even the databases that collect data on the same 
types of HAIs calculate and report rates in different ways that cannot 
be reconciled. For example, the MPSMS program reported that 1.7 percent 
of all the Medicare patients that had a central line inserted in 2004 
experienced a central-line-associated BSI. In contrast, the NHSN 
program reported the mean number of central-line-associated BSIs 
detected during 2006 by different types of intensive care units, 
calculated as the number of infections per 1,000 days of central line 
use. This ranged from 1.5 per 1,000 days in inpatient medical/surgical 
wards to 6.8 per 1,000 days in burn intensive care units. HHS might be 
able to develop approaches for linking data across its different 
databases, such as by developing common data collection methods and 
specifications or creating crosswalks between the specifications for 
different databases. However, until that is done, the information on 
HAI rates from each of the three databases collecting that information 
stands alone. 

CDC officials have produced national estimates of HAIs, but those 
estimates derive from assumptions and extrapolations that raise 
questions about the reliability of those estimates. Most recently, in 
2007, CDC officials published estimates of the aggregate incidence of 
HAIs and deaths attributable to HAIs in 2002--which included an 
estimate of 99,000 HAI-related deaths per year.[Footnote 78] These 
estimates rested on two key assumptions. The first assumption was that 
data from 283 hospitals reporting to the NNIS program (the predecessor 
program to NHSN) were indicative of hospital rates nationwide, even 
though the authors acknowledged that the NNIS hospitals were not 
randomly selected and their rates could differ from those of U.S. acute 
care hospitals as a whole. The second assumption was that 2002 NNIS 
data on SSIs could be used to estimate rates for all other types of 
HAIs, based on the relative frequency of SSIs compared to other types 
of HAIs observed in a portion of NNIS hospitals during the 1990s. 
[Footnote 79] In 2004, CDC officials announced plans for conducting a 
national survey designed to collect more up-to-date data on 
hospitalwide incidence of all types of HAIs in a sample of hospital 
discharges, but they subsequently decided not to proceed with those 
plans. CDC officials told us they were developing plans to obtain 
similar data by adding questions on HAIs to the National Hospital 
Discharge Survey conducted by CDC's National Center for Health 
Statistics.[Footnote 80] CDC officials said they planned to put 
questions about HAIs into the National Hospital Discharge Survey 
starting in 2010. However, CDC officials stated that they planned first 
to pilot test several different approaches for collecting HAI data 
through the National Hospital Discharge Survey, and it was too early to 
say what specific information they would collect through this process. 

Conclusions: 

HAIs in hospitals can cause needless suffering and death. Federal 
authorities and private organizations have undertaken a number of 
activities to address this serious problem; however, to date, these 
activities have not gained sufficient traction to be effective. Current 
activities at the federal level include guidelines with recommended 
practices issued by CDC, required standards for hospitals set by CMS, 
and HAI-related data collected through multiple HHS databases. Private- 
sector organizations, such as the Joint Commission and AOA, have also 
set infection control standards for hospitals. With the passage of the 
DRA by the Congress, hospitals will be encouraged to reduce certain 
HAIs, because beginning in October 2008 CMS will stop paying hospitals 
higher payments for patients that acquire them. 

We identified two possible reasons for the lack of effective actions to 
control HAIs to date. First, although CDC's guidelines are an important 
source for its recommended practices on how to reduce HAIs, the large 
number of recommended practices and lack of department-level 
prioritization have hindered efforts to promote their implementation. 
The guidelines we reviewed contain almost 1,200 recommended practices 
for hospitals, including over 500 that are strongly recommended--a 
large number for a hospital trying to implement them. A few of these 
are required by CMS's or accrediting organizations' standards or their 
standards interpretations, but it is not reasonable to expect CMS or 
accrediting organizations to require additional practices without a 
prioritization. Although CDC has categorized the practices on the basis 
of the strength of the scientific evidence, there are other factors to 
consider in developing priorities. For example, work by AHRQ suggests 
factors such as costs or organizational obstacles that could be 
considered. The lack of coordinated prioritization may have resulted in 
duplication of effort by CDC and AHRQ in their reviews of scientific 
evidence on HAI-related practices. 

Second, HHS has not effectively used the HAI-related data it has 
collected through multiple databases across the department to provide a 
complete picture about the extent of the problem. Limitations in the 
databases, such as nonrepresentative samples, hinder HHS's ability to 
produce reliable national estimates on the frequency of different types 
of HAIs. In addition, currently collected data on HAIs are not being 
combined to maximize their utility. For example, data on surgical 
infection rates and data on surgical processes of care are collected 
for some of the same patients in two different databases that are not 
linked. HHS has made efforts to use the currently collected data to 
understand the extent of the problem of HAIs, but the lack of linkages 
across the various databases results in a lost opportunity to gain a 
better grasp of the problem of HAIs. 

HHS has multiple methods to influence hospitals to take more aggressive 
action to control or prevent HAIs, including issuing guidelines with 
recommended practices, requiring hospitals to comply with certain 
standards, releasing data to expand information about the nature of the 
problem, and soon, using hospital payment methods to encourage the 
reduction of HAIs. Prioritization of CDC's many recommended practices 
can help guide their implementation, and better use of currently 
collected data on HAIs could help HHS--and hospitals themselves-- 
monitor efforts to reduce HAIs. Unfortunately, leadership from the 
Secretary of HHS is currently lacking to do this. Without such 
leadership, the department is unlikely to be able to effectively 
leverage its various methods to have a significant effect on the 
suffering and death caused by HAIs. 

Recommendations for Executive Action: 

In order to help reduce HAIs in hospitals, the Secretary of HHS should 
take the following two actions: 

1. Identify priorities among CDC's recommended practices and determine 
how to promote implementation of the prioritized practices, including 
whether to incorporate selected practices into CMS's conditions of 
participation (COP) for hospitals. 

2. Establish greater consistency and compatibility of the data 
collected across HHS on HAIs to increase information available about 
HAIs, including reliable national estimates of the major types of HAIs. 

Comments from HHS and Accrediting Organizations and Our Evaluation: 

We obtained written comments on our draft report from HHS, which appear 
in appendix III. HHS generally agreed with our recommendations and 
noted its appreciation for our efforts in developing this report. The 
comments addressed both of our recommendations. 

In terms of our first recommendation, HHS's comments indicated that CMS 
welcomed the opportunity to work with CDC to review and prioritize 
recommendations for infection control and would consider whether to 
incorporate some of the recommendations into CMS's hospital COPs. HHS 
stated that COPs represent minimum health and safety requirements and 
the two standards in the infection control COP have a broad reach for 
assessing a hospital's infection control program. HHS's comments also 
noted that the COPs currently lack the specificity of guidance and 
recommendations issued by HHS agencies, including CDC's recommendations 
for infection control. 

In terms of our second recommendation, HHS's comments acknowledged the 
need for greater consistency and compatibility of data collected on 
HAIs and identified three actions CMS would take. First, CMS will work 
with other HHS agencies to evaluate opportunities for consolidating and 
coordinating national data collection programs. Second, CMS will 
implement consensus-based measures whenever possible. Third, CMS will 
require the collection of data that facilitate linkages between 
databases, including Medicare beneficiary and hospital patient 
identifiers in the APU program. HHS's comments also noted that CDC has 
recently begun moving toward greater alignment with CMS. 

HHS's comments also noted other activities under way that the 
department believes would improve the collection of HAI-related data. 
For example, as part of implementing section 5001(c) of the DRA, 
hospitals are required to begin reporting "present on admission" data-
-diagnoses that are present in patients at the time of admission--in 
order to determine whether the selected preventable conditions were 
acquired prior to the hospitalization. We noted this activity in the 
report, and we believe that it is too early to know the extent of 
information that will be generated on HAIs or how it will be used by 
HHS agencies. HHS's comments also indicated that CMS is evaluating an 
update to the diagnostic and procedure coding system, which could offer 
clearer and more detailed information than the current system, and also 
noted the benefits of employing industry data standards for electronic 
health care data exchanges to facilitate reporting of HAI-related data 
to both CDC and CMS. In our report, we did not assess the effect of 
these activities because they have not been implemented. 

We also obtained comments on a draft of this report from 
representatives of the Joint Commission and AOA. The Joint Commission 
concurred with our findings that it would be beneficial to have more 
accurate estimates of HAIs and that prioritization of practices to 
guide actions in preventing HAIs is a valuable and necessary 
undertaking. However, it noted that other actions, such as cultural 
changes in health care organizations, clear strategies for 
implementation, and a concerted, multifaceted effort by many 
stakeholders, are needed to reduce HAIs. We agree that such actions are 
important in reducing HAIs, and that better prioritization of the many 
recommended practices would facilitate the process the Joint Commission 
describes. The Joint Commission also provided two comments related to 
the section of the report that discusses hospital infection control 
standards. First, it commented that our report places too great a focus 
on the number of standards, and pointed out the benefit of the Joint 
Commission's systems-based approach. It expressed a concern that a 
reader could perceive that the Joint Commission has fewer expectations 
for hospitals than CMS or AOA. That was not our intention, and we have 
modified the report to note the Joint Commission's systems-based 
approach to foster compliance with practices to reduce HAIs. Second, 
the Joint Commission said that the report indicates that their 
standards are less specific in that they have not adopted certain CDC 
recommendations, but they noted that many of the CDC guidelines cannot 
be implemented without additional research or translation into 
concrete, actionable steps. In the draft, we described some activities 
being undertaken by CDC and AHRQ to promote implementation of 
recommended practices to reduce HAIs, including studies funded by AHRQ, 
and we added a clarification to the text to note the importance of 
translating knowledge into social and behavioral changes that can be 
sustained. Furthermore, we believe that clearer prioritization can help 
efforts to promote the implementation of practices to reduce HAIs. 

HHS, the Joint Commission, and AOA provided technical comments, which 
we incorporated as appropriate. 

As arranged with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
after its issuance date. At that time, we will send copies of this 
report to the Secretary of HHS and other interested parties. We will 
also make copies available to others on request. In addition, the 
report will be available at no charge on GAO's Web site at [hyperlink 
http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-7114 or bascettac@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix IV. 

Sincerely yours, 

Signed by: 

Cynthia A. Bascetta: 
Director, Health Care: 

[End of section] 

Appendix I: Other CDC Activities Designed to Reduce or Prevent Health- 
Care-Associated Infections: 

In addition to developing infection control and prevention guidelines 
and recommendations, the Centers for Disease Control and Prevention 
(CDC) provides leadership in outbreak investigations, surveillance, and 
laboratory research and prevention of health-care-associated infections 
(HAI). According to officials, CDC's work in the area of outbreak 
investigations has led to new knowledge on ways to prevent HAIs. For 
example, in 2006, CDC investigated an outbreak of eye inflammation that 
was occurring in patients who recently had cataract surgery at a 
hospital in Maine. The outcome of this investigation led to the 
development of recommended practices for cleaning and sterilizing 
intraocular surgical instruments developed by the American Society of 
Cataract and Refractive Surgery and the American Society of Ophthalmic 
Registered Nurses. 

CDC's surveillance, research, and demonstration projects measure the 
effect of HAIs, adverse drug events, and other complications of health 
care. CDC has funded many activities through its Prevention Epicenter 
Program, which began in 1997 and is devoted to improving the detection, 
reporting, and prevention of HAIs, antimicrobial resistance, and other 
adverse events in health care. For example, CDC funded a multicenter 
trial research project and found that daily bathing with chlorhexidine, 
an antiseptic, reduces the incidence of methicillin-resistant 
Staphylococcus aureus (MRSA), vancomycin-resistant enterococci (VRE), 
[Footnote 81] and bloodstream infection (BSI). In addition, CDC has 
collaborated with three public hospitals in Chicago to develop a 
clinical data warehouse using the hospitals' information systems, which 
enabled the hospitals to develop a series of quality improvement 
strategies to decrease antimicrobial resistance and improve antibiotic 
prescribing and infection control practices. 

Finally, CDC provides direct support and assistance to external groups 
involved in many HAI prevention activities. CDC has funded and 
collaborated with the Pittsburgh Veterans Affairs Medical Center to 
reduce MRSA infections by more than 60 percent in its health care 
units. The success of this project has led CDC and the Department of 
Veterans Affairs to initiate similar efforts across all VA hospitals. 
In addition, CDC is represented on the Surgical Care Improvement 
Project (SCIP) steering committee. SCIP is a national public-private 
partnership to reduce surgical complications that is sponsored by the 
Centers for Medicare & Medicaid Services. CDC told us that they have 
worked with SCIP to develop quality measures and market the project. 
Finally, CDC has provided technical assistance to the Institute for 
Healthcare Improvement, a not-for-profit organization working to 
improve global health care, in the development of the institute's hand 
hygiene "bundle" and MRSA infection prevention "bundle" guides. 

[End of section] 

Appendix II: Centers for Medicare & Medicaid Services' (CMS) Condition 
of Participation: Infection Control: 

The conditions of participation (COP) for hospitals, including the 
infection control COP as well as the survey protocols and interpretive 
guidelines that accompany the COPs, are contained in Appendix A of 
CMS's State Operations Manual.[Footnote 82] CMS issued revised 
interpretive guidelines for the infection control COP on November 21, 
2007.[Footnote 83] 

The COP on infection control (42 C.F.R. § 482.42) (2007) states that: 

The hospital must provide a sanitary environment to avoid sources and 
transmission of infections and communicable diseases. There must be an 
active program for the prevention, control, and investigation of 
infections and communicable diseases. 

(a) Standard: Organization and policies. A person or persons must be 
designated as infection control officer or officers to develop and 
implement policies governing control of infections and communicable 
diseases. 

(1) The infection control officer or officers must develop a system for 
identifying, reporting, investigating, and controlling infections and 
communicable diseases of patients and personnel. 

(2) The infection control officer or officers must maintain a log of 
incidents related to infections and communicable diseases. 

(b) Standard: Responsibilities of chief executive officer, medical 
staff, and director of nursing services. The chief executive officer, 
the medical staff, and the director of nursing services must--: 

(1) Ensure that the hospital-wide quality assurance program and 
training programs address problems identified by the infection control 
officer or officers; and: 

(2) Be responsible for the implementation of successful corrective 
action plans in affected problem areas. 

In addition, CMS officials said that the quality assessment and 
performance improvement COP, which can be found at 42 C.F.R. § 482.21 
(2007), can also affect infection control.[Footnote 84] 

[End of section] 

Appendix III: Comments from the Department of Health and Human 
Services: 

Department Of Health & Human Services: 
Office of the Assistant Secretary for Legislation: 
Washington, DC 20201: 

February 19, 2008: 

Ms. Cynthia A. Bascetta: 
Director, Health Care: 
U.S. Government Accountability Office: 
Washington, DC 20548: 

Dear Ms. Bascetta: 

Enclosed are comments on the Government Accountability Office (GAO) 
Draft Report, "Health-Care-Associated Infections in Hospitals: 
Leadership Needed From HHS to Prioritize Prevention Practices and 
Improve Data on These Infections" (GAO-08-283). 

The Department appreciates the opportunity to review and comment on 
this report before its publication. 

Sincerely, 

Signed by: 

[Illegible] for: 
Vincent Ventimiglia: 
Assistant Secretary for Legislation: 

General Comments Of The Department Of Health And Human Services (HHS) 
On The U.S. Government Accountability Office's (GAO) Draft Report 
Entitled: "Health-Care-Associated Infectins In Hospitals: Leadership 
Needed From HHS To Prioritize Prevention Practices And Improve Data On 
These Infections" (GAO-08-283). 

The Department appreciates GAO's efforts to ensure that the Centers for 
Medicare & Medicaid Services (CMS) collaborates with other Health and 
Human Services (HHS) agencies to--(1) identify and potentially codify 
infection control practices to prevent health-care-associated 
infections (HAIs); and (2) develop linkages between the various HHS 
data collection systems to facilitate the collection and analysis of 
national HAI data. 

As a condition of their participation in the Medicare and Medicaid 
programs, hospitals must comply with all of CMS's minimum regulatory 
health and safety requirements, called conditions of participation 
(CoPs), including the CoP for infection control. 

The CoP for infection control requires hospitals to provide a sanitary 
environment to avoid sources and transmission of infections and 
communicable diseases and to have an active program for the prevention, 
control, and investigation of infections and communicable diseases. 
Hospitals must designate at least one infection control officer to 
develop and implement policies governing control of infections and 
communicable diseases. That officer must develop a system for 
identifying, reporting, investigating, and controlling infections and 
communicable diseases of patients and personnel; and maintain a log of 
incidents related to infections and communicable diseases. Further, 
each hospital's chief executive officer, medical staff, and director of 
nursing services is responsible for ensuring that the hospital-wide 
quality and training programs address problems identified by the 
infection control officer(s) and for implementation of successful 
corrective action plans in affected problem areas. 

As the GAO report notes, CMS has developed interpretive guidelines for 
CoPs that describe the CoPs and provide survey procedures. 
Medicare/Medicaid providers utilize these guidelines to determine how 
to implement the requirements in the CoPs. The CMS guidelines for the 
hospital infection control CoP (CMS State Operations Manual, Appendix A:
[hyperlink, 
http://www.cms.hhs.gov/Manuals/IOMlitemdetail.asp?filtcrType=none&filter
BvDID=9&sortBvDID=1&sortOrder=ascending&itemlD=CMS1201984&intNumPerPage=
10)] reference some of the CDC recommendations that hospitals can use 
to ensure they are in compliance with the requirements of the CoP. For 
example, the Guidelines cite the CDC "Guidelines for Prevention and 
Control of Nosocomial Infections" and "Guidelines for Preventing the 
Transmission of Tuberculosis in Health Care Facilities." The Guidelines 
state that hospitals should provide a safe environment, "consistent 
with nationally recognized infection control precautions, such as the 
current CDC recommendations for the identified infection and/or 
communicable disease...." 

Although CMS does not have specific infection control requirements, 
such as hand hygiene or sterilization standards, we cite noted improper 
practices that do not follow nationally recognized standards (such as 
CDC strongly recommended practices) at our standard-level requirement 
for preventing and controlling infections. In a plan of correction, we 
would expect a hospital to demonstrate that it had implemented 
recognized practices to address the improper practices and that it had 
incorporated the corrective actions into its quality assessment and 
performance improvement program to ensure sustainability. 

Thus, although our CoPs have only two standards, the standards have an 
extremely broad reach when it comes to assessing a hospital's infection 
control program, and we routinely cite observed infection control 
breaches, even when such breaches have not resulted in a known 
infection. 

In regard to the collection of HAI data, it is important to note that 
these data collection programs are designed in some cases for very 
different purposes. For example, the Reporting Hospital Quality Data 
for Annual Payment Update (RHQDAPU) program is designed to produce 
hospital level estimates. Under the RHQDAPU Program, participating 
hospitals report several infection-related measures. These include SCIP-
Inf-1 Prophylactic Antibiotic Received Within One Hour Prior to 
Surgical Incision, SCIP-Inf-2 Prophylactic Antibiotic Selection for 
Surgical Patients, and SCIP-Inf-3 Prophylactic Antibiotics Discontinued 
Within 24 Hours After Surgery End Time. These measures are currently 
publicly reported on CMS's Hospital Compare website. 10n addition, 
under Medicare's Quality Improvement Organization Program, selected 
hospitals receive technical assistance to improve their performance for 
these and additional measures. The rare nature of selected HAI measures 
and the current burden of data collection preclude the production of 
reliable hospital level estimates for these relatively rare events for 
sampled data. Nevertheless, CMS acknowledges the need for greater 
consistency and compatibility of the collected data on HAI's. 

One advance in the collection of HA10 data will occur when we move from 
the current coding system, ICD-9-CM to an updated system, ICD-10. CMS 
is currently evaluating this move. Identifying hospital-acquired 
conditions requires clear and detailed diagnosis codes. The current 
coding system, ICD-9-CM, is three decades old. It is outdated, and has 
numerous instances of broad and vague codes. Attempts to add this 
detail to ICD-9-CM are constrained by a lack of room to expand. This 
has a negative impact on CMS' attempts to identify cases with a 
hospital-acquired condition. ICD-10 codes are more precise and capture 
information using medical terminology used by current medical 
practitioners. Examples of problems with ICD-9-CM that impact our 
current effort with hospital-acquired conditions that have been 
rectified with ICD-10 include the following examples. 

* Pressure ulcers - We selected pressure ulcers as one of our hospital-
acquired conditions. This condition is both high cost and high 
frequency. There are prevention guidelines for pressure ulcers. 
Unfortunately, ICD-9-CM does not provide enough detail to clearly 
identify the exact location, size, or depth of the pressure ulcer. 
Using trend data, one cannot tell if the pressure ulcer is getting 
better or worse (increasing in size or depth). ICD-9-CM has nine codes 
that identify the generic part of the body with the pressure ulcer. It 
provides no information of the size, depth, or exact location of the 
pressure ulcer. ICD-10-CM has 60 codes that identify the size, depth, 
and location of the pressure ulcer. 

* Hospital-acquired Infections - ICD-9-CM does not have unique codes 
that identify specific types of bacterial infections which are 
resistant to antibiotics, such as MRSA infections. MRSA infections are 
captured through a combination of at least three separate codes under 
ICD-9-CM. This includes a vague code that captures all types of 
infections that are resistant to antibiotics. 

ICD-10 has more detail in each code as to the type and location of the 
infection. The next draft of ICD-10 will have detailed codes that would 
indicate whether the patient had a MRSA infection or was colonized with 
MRSA, but suffering no current infection. The ability to expand ICD-10 
to capture detailed information on additional conditions is also one of 
the strengths of ICD-10. 

* Septicemia - CMS is evaluating the selection of septicemia as one of 
the hospital-acquired condition. ICD-9-CM codes are quite problematic 
in capturing septicemia cases. Multiple, overlapping codes are required 
to identify these cases. This makes coding, reporting, and data 
analysis of septicemia difficult. ICD-10 codes are much improved and 
clearly identify septicemia cases. 

* Falls and trauma -ICD-9-CM codes are vague and do not describe 
whether an injury, such as a leg fracture, occurs on the right or left 
leg. ICD-9-CM also does not provide information on whether the 
encounter is for the initial treatment of the fracture or for 
subsequent care. ICD-10 0 has detailed codes that identify the nature 
of the injury, whether it was to the left or right extremity, and 
whether the treatment is toward a new or earlier fracture. ICD-10 D 
also provides greater detail as to where the injury occurred (e.g., the 
patient room, corridor, operating room, bathroom). This detail is not 
present in ICD-9-CM. 

* Foreign body left in after surgery (never event) - ICD-9-CM has one 
vague code that captures the fact that a complication developed as a 
result of a device being inadvertently left in a patient after surgery. 
ICD-10 codes provides much greater detail and describes the type of 
complication that results from this never event. The codes describe the 
type of complication such as an obstruction, perforation, infection, or 
adhesions. The codes also clearly describe the type of procedure 
performed that resulted in the device being inadvertently left in a 
patient, such as an endoscopic procedure or an open procedure. This 
more detailed information provides a more definitive picture of the 
nature of the complication resulting from the never event. 

There are many other parts of ICD-10 that provide clear and concise 
codes to capture events and conditions important for health care 
delivery. ICD-10 has codes that describe under-dosing and over-dosing 
patients. This information would provide valuable information on 
patient outcomes. With more precise codes, CMS could add additional 
hospital-acquired provisions to our proposals. 

Another advance in the collection of HAI data is the recent requirement 
for the collection of Present on Admission data as part of hospital 
submitted Medicare claims. The Deficit Reduction Act (DRA) required CMS 
to select certain conditions for which Medicare will no longer pay an 
additional amount when that condition is acquired during a 
hospitalization. The DRA further requires that the selected conditions 
he reasonably preventable through the application of evidence-based 
guidelines. CMS has closely collaborated with CDC on the selection of 
these conditions, with particular attention to identifying evidence-
based guidelines that are consistent with CDC's recommended practices. 
Thus, this Medicare payment provision is closely tied to CDC's 
prioritized practices. 

As a prerequisite for implementing this Medicare payment provision, the 
DRA also requires hospitals to begin reporting present on admission 
(POA) indicator data to identify whether the selected conditions are 
acquired during a hospitalization. CMS' approach to POA indicator 
reporting is consistent with the standards set forth in the ICD-9-CM 
guidelines, which are maintained by CDC. CMS' collection of POA data 
will generate increased information about hospital-acquired conditions, 
including infections, which can be used by CDC and others to inform and 
disseminate reliable national estimates of these conditions. 

Finally, CMS, under its Quality Improvement Organization 9th Statement 
of Work, will include as components of the Patient Safety Theme, 
measures relevant to health-care associated infections in hospitals. 
These measures will include a Surgical Care Improvement Project (SCIP) 
measure on the use of prophylactic antibiotics and a measure on the 
incidence of Methcillin-Resistant Staphylococcus aureus (MRSA). This 
work is being conducted in collaboration with CDC. 

CMS is committed to ensuring that all patients in Medicare and Medicaid 
participating hospitals receive quality health care and appreciates the 
GAO's support in helping HHS achieve that goal. 

GAO Recommendations: 

In order to reduce HAIs in hospitals, the Secretary should: 

1. Identify priorities among CDC's recommended practices and determine 
how to promote the prioritized practices, including whether to 
incorporate selected practices into CMS's conditions of participation 
for hospitals; and; 

2. Establish greater consistency and compatibility of the data 
collected across HHS on HAIs to increase information available about 
HAIs, including reliable national estimates of the major types of HAIs. 

CMS Response: 

Medicare/Medicaid CoPs are broadly written, minimum health and safety 
requirements that providers and suppliers must meet to participate in 
Medicare and Medicaid. As a result, CoPs lack the specificity of the 
guidance and recommendations issued by HHS agencies, including the CDC 
recommendations for infection control. CMS continuously evaluates the 
CoPs for all Medicare/Medicaid providers to determine whether they need 
to be updated, for example, to reflect more current standards of 
practice. We welcome the opportunity to work with the CDC to review and 
prioritize its recommendations. When the recommendations are 
prioritized, CMS will consider whether to incorporate some of the 
recommendations into the hospital CoPs. 

CMS will take the following actions to establish consistency and 
compatibility of the data collected across HHS on HAIs: 

(1) Work with other HHS agencies to evaluate opportunities for 
consolidating and coordinating national data collection programs. 

(2) Implement consensus-based measures definitions, such as using 
National Quality Forum endorsed measures in the APU program, whenever 
possible. 

(3) Require collection of data that facilitate linkage between 
databases, including Medicare beneficiary ID and Hospital patient ID in 
the APU program. 

CMS will be mindful of the burden to hospitals and the need for 
collecting reliable national level HAI estimates in its national data 
collection programs. We appreciate the GAO's efforts in developing this 
report on prioritizing HAI prevention practices and improving HAI data 
collection. 

Page 35, Paragraph 3, Line 1: The GAO draft report states "Although 
officials from the various HHS agencies discuss HAI data collection 
with each other, we did not find that the agencies were taking steps to 
integrate any of the existing data from the four databases that collect 
HAI-related data." 

* Most recently, CDC has taken steps toward definitional alignment with 
CMS, and CDC has taken steps toward enabling CMS-SCIP data imports into 
NHSN. Also, the HHS Patient Safety Task Force made efforts toward 
integrating patient safety reporting to multiple agencies through a 
common portal. 

* In recent years, the Health Level Seven (HL7) data standards 
organization has developed a XML file format for electronic exchanges 
of structured clinical documents. The HL7 standard, known as Clinical 
Document Architecture (CDA), is designed for use in exchange of 
clinical records, such as continuity of care records and patient 
history and physical examination findings. The versatility of the CDA 
standard has led to additional uses, including HIPAA-mandated 
electronic claims attachments that CMS has developed with HL7 for use 
in claims processing. All electronic claims attachment documents 
promulgated by CMS are CDA documents. CDC is using CDA as the file 
format for information system developers to use in enabling their 
systems to report healthcare associated infection (HAI) data from 
hospitals to CDC's National Healthcare Safety Network (NHSN). The 
clinical, financial, and public health uses of CDA are evidence of the 
importance this industry standard has already achieved as a 
specification for data exchanges between disparate systems. 

* One important benefit of adopting an industry standard solution for 
electronic healthcare data exchanges is that it facilitates 
communication and reuse of data already collected for some other 
purpose. CDA calls for use of standard healthcare vocabulary in the 
documents that are exchanged. This requirement is an integral part of 
enabling interoperability between sending and receiving systems. 
Another important benefit is enabling technical features for importing 
files from one system to another and distributing data into the second 
system's database to be reused for a variety of files that conform to 
the standard format. For example, CDA documents can be imported and 
parsed into a database using the same technical features regardless of 
whether the document carries data about a clinical outcome, such as a 
healthcare associated infection, or a process of care, such as use of 
an antimicrobial agent to prevent a surgical site infection. 

* This latter benefit points to why adoption of an industry standard 
file format, in particular CDA, would he advantageous for CDC in its 
monitoring of HAIs through NHSN and CMS in its monitoring of process of 
care, such as surgical care, through its CART tool and the Annual 
Payment Update database. A CDA import function, under development for 
the NHSN application, will enable CDC's system to be used to import HAI 
data reported via a CDA document. The same function will lend itself 
for use in importing a process of care measurement data if those data 
are conveyed using the CDA file format. The CART tool generates 
proprietary XML files, i.e., files that do not conform to 
specifications of a standards development organization such as HL7. At 
the relatively low cost of converting the proprietary format used in 
the CART tool to the industry-standard CDA file format, the process of 
care data collected for the Annual Payment Update database, including 
Surgical Care Improvement Program (SCIP) data, would be available for 
importation into NHSN and linkage with the outcome data. In other 
words, migration to CDA across CDC and CMS systems will enable 
hospitals participating in both systems to readily combine patient-
level process and outcome data. 

[End of section] 

Appendix IV: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Cynthia A. Bascetta at (202) 512-7114 or bascettac@gao.gov: 

Acknowledgments: 

In addition to the contact named above, key contributors to this report 
were Linda T. Kohn, Assistant Director; Donald Brown; Shaunessye Curry; 
Shannon Slawter Legeer; Eric Peterson; Roseanne Price; and Keisha 
Wilkerson. 

[End of section] 

Footnotes: 

[1] In general, HAIs are distinct from community-acquired infections, 
that is, infections that patients may have acquired before entering the 
hospital. 

[2] Antimicrobial resistance is the result of microbes changing in ways 
that reduce or eliminate the effectiveness of drugs, chemicals, or 
other agents to cure or prevent infections. 

[3] See Pennsylvania Health Care Cost Containment Council, Hospital- 
Acquired Infections in Pennsylvania (Harrisburg, Pa.: November 2006). 

[4] See D. Murphy et al., Dispelling the Myths: The True Cost of 
Healthcare-Associated Infections (Washington, D.C., Association for 
Professionals in Infection Control and Epidemiology, February 2007). 

[5] Medicare is a federal health insurance program that serves over 42 
million elderly and certain disabled beneficiaries and pays for health 
care needs, such as inpatient hospital stays and physician visits. 

[6] See 42 C.F.R. § 482.1 (2007). 

[7] Section 1865(b)(1) of the Social Security Act also provides that 
any other national accreditation body that meets certain requirements 
as determined by HHS may accredit hospitals. 

[8] In calendar year 2007, about 81 percent of hospitals were 
accredited by the Joint Commission, state survey agencies certified 
approximately 16 percent of hospitals, and less than 2 percent were 
accredited by AOA. Less than 1 percent of hospitals were accredited by 
both the Joint Commission and AOA. The Joint Commission was formerly 
known as the Joint Commission on Accreditation of Healthcare 
Organizations or "JCAHO." 

[9] See K. Adams et al., Priority Areas for National Action: 
Transforming Health Care Quality, Institute of Medicine of the National 
Academies (Washington, D.C.: The National Academies Press, 2003). 

[10] Pub. L. No. 109-171, § 5001(c), 120 Stat. 4, 30. 

[11] Under Medicare, hospitals generally receive fixed payments for 
inpatient sta