How to evaluate infection prevention and surveillance software

What the software does

Infection prevention software helps infection preventionists find cases, work out who may have been exposed, follow up and report. Its value depends almost entirely on the data feeding it: laboratory results, admissions and bed moves, and who cared for whom. A product that looks complete in a demonstration can produce thin contact lists once it meets your real feeds. This guide sets out what to ask and test, and names no vendors.

Products in this category cover some or all of these jobs:

• Case detection from laboratory results for the organisms and conditions on your watch list, opened for an infection preventionist to review.
• Surveillance for healthcare-associated infections (HAIs), applying the definitions your program uses and tracking device days, procedures and other denominators.
• Contact tracing: rebuilding where a case was and who shared a room, unit or care team with them during the exposure window.
• Follow-up: isolation, testing and employee health actions, each tracked to completion.
• Outbreak management: line lists, linked cases and timelines across units.
• Reporting to infection control committees, the quality program, the health department and the CDC National Healthcare Safety Network (NHSN).

Decide early whether you are buying HAI surveillance, exposure tracing or both, because they draw on different data and are often judged by different people.

Who should be on the evaluation team

• Infection preventionists and the hospital epidemiologist, who will work cases every day.
• Employee or occupational health, for staff exposures and work restrictions.
• Nurse managers from units with frequent isolation and cohorting decisions.
• The microbiology laboratory, which owns the results feed and organism names.
• Quality and patient safety staff who report HAI measures.
• Antibiotic stewardship, if resistance and antibiotic use data will be shared.
• IT and interface analysts, for laboratory, admission and staffing feeds.
• Privacy, for what unit managers and employee health may each see.
• Emergency management, who coordinate during an outbreak.

Questions to ask and things to test

Ask each vendor to work with your own data, not a prepared demonstration:

• A past case. Trace a case your team worked by hand and compare the two contact lists. Which contacts did the system miss, and which did it add?
• Locations. Check that rooms and units from your admission, discharge and transfer data and your staffing data line up. Test transfers, procedural areas and overflow beds.
• A full case. Have an infection preventionist work a case from positive result to closed follow-ups, including a decision not to treat someone as exposed.
• Who sees what. Confirm what a unit manager and employee health can each see about the same staff exposure.
• An outbreak. Build a sample outbreak and review the line list your health department would receive.
• Rule changes. Review how organism rules and exposure windows are proposed, approved and recorded, so you can show later why a contact was or was not listed.
• NHSN. Ask exactly which NHSN data the product produces, in what format, and who submits it. Ask how the product is updated when NHSN issues new protocols.

Limits to probe

Ask vendors to state their boundaries in writing:

• Data completeness. Contact lists are only as complete as your location, assignment and schedule data. Without a real-time location system, contacts come from rooms, units and assignments, not proximity.
• Decisions. A system can propose contacts under rules your team sets; infection preventionists decide who is exposed.
• Not the EHR or laboratory system. Many products track isolation and testing but do not place orders; those stay in the EHR.
• Submission. Some products prepare health department and NHSN reports but do not submit them; your staff review and submit through their own channels.
• Visitors and contractors. They can be traced only where their locations are recorded.
• Clinical and employment decisions. Treatment, prophylaxis and work restriction criteria come from your policies and applicable law, not the software.
• Jurisdiction. Public health reporting formats differ by state and country. Ask which are supported.

Regulations and standards to understand

Confirm what applies to you in the current official text and with your health department and counsel. The main sources:

• CMS Conditions of Participation. 42 CFR 482.42 requires active hospital-wide programs for the surveillance, prevention and control of HAIs and other infectious diseases, and for antibiotic stewardship. The governing body must ensure systems are in place to track infection surveillance, prevention and control activities, and the infection preventionist is responsible for the program's documentation, written or electronic. The section also requires electronic reporting of acute respiratory illness data in a format and frequency set by the Secretary.
• NHSN. The CDC describes the National Healthcare Safety Network as the nation's most widely used HAI tracking system and the route by which facilities meet CMS infection reporting requirements. NHSN's CMS requirements pages set out what each facility type reports, and its protocols are published in a Patient Safety Component Manual issued in yearly editions.
• CMS payment programs. The Hospital-Acquired Condition Reduction Program uses NHSN measures for central line-associated bloodstream infection, catheter-associated urinary tract infection, surgical site infection after colon surgery and abdominal hysterectomy, MRSA bacteremia and C. difficile infection, and reduces Medicare payments to hospitals in the worst-performing quartile.
• HIPAA. 45 CFR 164.512(b) permits disclosures of protected health information to a public health authority authorized by law to collect it for disease prevention and control, including disease reporting and surveillance.
• OSHA. The Bloodborne Pathogens Standard requires a written exposure control plan and, for many employers, a sharps injury log kept so as to protect the injured employee's confidentiality.
• State law. Which diseases must be reported, to whom and how quickly is set by state and local law. Check with your health department.

Implementation risks

• Location data. Unit and room codes in admission data rarely match staffing systems exactly. Plan time to map them and to maintain the map as units change.
• Laboratory feeds. Organism names and result formats vary. Validate the watch list against real results before relying on alerts.
• Alert fatigue. Broad rules produce long lists that preventionists stop reading. Start narrow and widen with evidence.
• Employee health boundaries. Agree what employee health information unit managers may see before go-live.
• Parallel reporting. Run existing NHSN and health department reporting alongside the new system until the outputs match.
• Outbreak timing. Avoid going live during an active outbreak or a seasonal surge.

Related reading on this site

Requirement pages: CMS Conditions of Participation for hospitals (42 CFR Part 482), CDC National Healthcare Safety Network (NHSN) reporting, HIPAA, OSHA Bloodborne Pathogens Standard.

In the glossary: Medicare Conditions of Participation, CMS, ADT messages, HL7, HIPAA, PHI.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.