Why hospital COVID reporting turned out to be infrastructure

The week

In July 2020, the people who compiled each US hospital’s daily COVID-19 numbers were handed a new task in the middle of a pandemic summer, with many hospitals stretched by rising admissions: send the numbers somewhere else, starting in five days.

The request did not come out of nowhere. Since the spring, hospitals had been asked for COVID-19 data by federal agencies, states and sometimes counties, often in overlapping formats. At the end of March, the White House had asked hospitals to send daily capacity data to the CDC. The CDC had stood up a COVID-19 module in its existing hospital surveillance system for the purpose. Participation was voluntary, and coverage was incomplete.

On July 10, 2020, the Department of Health and Human Services, or HHS, updated its guidance for hospitals on reporting COVID-19 data. Hospitals were directed to stop reporting through the CDC’s National Healthcare Safety Network. That network, known as NHSN, is the system the Centers for Disease Control and Prevention has long used to collect data from hospitals, best known for tracking infections acquired in healthcare settings. Hospitals had been sending their COVID-19 data through it.

From July 15, hospitals were to submit daily data on capacity, patients and supplies through a system run for HHS by the contractor TeleTracking, or through their states where the state reported on their behalf. In practical terms, that meant counts of beds and how many were full, how many patients had COVID-19, and stocks of supplies, every day, to a different destination. The data fed HHS Protect, the department’s data platform for the pandemic response.

The guidance set out several routes. A hospital could send its data to its state, if the state had taken on federal reporting and could certify that it was authorized to submit on the hospital’s behalf. It could use the TeleTracking portal, typing into forms or uploading Excel or CSV files built on the HHS template; scanned images were not acceptable. Or it could authorize its health IT vendor or another third party to send data directly, but only after HHS confirmed the feed was working. Until then, the hospital had to use another route.

The fields themselves went well beyond bed counts. They included the hospital’s Medicare certification number and NHSN identifier, staffed beds by type, confirmed and suspected COVID-19 inpatients, and the previous day’s admissions broken down by age bracket. They covered emergency department visits, deaths, remdesivir vials used and remdesivir inventory at 11:59 p.m., and whether the hospital faced a critical staffing shortage. For many fields, hospitals could choose their own daily reporting window, as long as it stayed relatively consistent.

The same guidance covered hospitals that ran COVID-19 tests in their own laboratories. They had to report daily counts of tests ordered, resulted, positive and negative, with a midnight-to-midnight cutoff, through their own set of options. For a hospital with an in-house lab, the July change meant two reporting streams to rebuild, not one.

HHS said the change would produce more complete and timely data for allocating supplies and treatments such as remdesivir, an antiviral drug for COVID-19 whose allocation to hospitals depended on this kind of data. The argument was that better data would get scarce resources to the places that needed them most, at a time when cases were rising sharply across the South and West.

The American Hospital Association briefed its members on the changes on July 13, two days before the switch. The timeline left little room for testing. Hospitals that submitted through their EHR vendor depended on that vendor rebuilding its feed in the same window, along with every other customer’s.

Public health experts and others criticized the move, raising concerns about transparency, the sidelining of the CDC and the burden on hospitals of changing systems mid-surge. The worries were partly about principle, who should own national health data, and partly about practice: hospital staff who were already working overtime now had to learn new forms, logins and rules. For a period after the switch, some CDC public data pages stopped updating, leaving researchers, journalists and the public without figures they had come to rely on. Members of Congress later asked the Government Accountability Office to review the new requirements.

For most people the episode looked like a dispute between agencies. For hospital leaders it was a stress test of something they had rarely had to think about: the plumbing that turns what happens on a ward into a number someone else can use.

Hospital capacity data had rarely been news before 2020. That year it guided the allocation of treatments, supplies and staff, and shaped public decisions about reopening. A count of occupied intensive care beds in one county could influence whether schools opened, where a shipment of medicine went and how worried a governor sounded at a press conference.

The July switch made visible a pipeline that had been built quickly and largely by hand. For health system data leaders and public health agencies, the pipeline has three layers: definitions of what is counted, the mechanics of collecting and submitting data, and the governance of who receives and publishes it. The switch touched all three at once, which is why hospitals with weak foundations felt it so sharply.

A short explanation of the plumbing comes first, because the three layers only make sense against it. After the three layers, a comparison of two hospitals shows how earlier choices played out, followed by the costs of weak reporting, the foundations that held, and the questions a leadership team can ask.

The plumbing behind a daily number

We tend to think of infrastructure as roads, power lines and water pipes: things nobody notices until they fail. Data reporting is the same. Behind every daily number is a chain of steps. Someone, or something, looks at a source, such as a list of patients currently in the building. The information is counted according to a rule. The count is checked, formatted and sent to a recipient, who combines it with counts from other hospitals and publishes the result.

The technical word for that chain is a data pipeline. Like a water pipeline, it has a source, treatment along the way and a delivery point. And like a water pipeline, it can be built from sturdy, connected parts or from buckets carried by hand. In 2020, many hospital pipelines were closer to buckets.

Three pieces of hospital technology sit at the source end. The electronic health record, or EHR, is the main clinical system: the digital chart where doctors and nurses record diagnoses, orders, test results and notes. A bed management system tracks which beds exist, which are occupied and which are being cleaned or blocked. Supply systems track inventory such as ventilators and protective equipment. None of them were designed primarily to feed a national dashboard. They were designed to run a hospital.

That distinction explains much of what followed. When a government asks for a new number, someone inside the hospital has to translate it into the terms of these systems, extract it and send it. If that translation is written down and automated, a change in destination is a modest technical task. If it lives in the head of one analyst and a spreadsheet, every change is an emergency.

Where the numbers go after they leave

The pipeline does not end at the hospital’s edge. In 2020 a hospital’s count might go directly to a federal system, to a state health department that forwarded it, or to both. States often ran their own collection systems for their own dashboards and emergency operations. Federal agencies combined submissions into national views, which then flowed to allocation decisions and public reports.

Each hop adds a chance for change. A state might apply its own definitions, fill gaps or submit on a different schedule. A federal system might reject a record that a state system accepted. The same hospital could therefore appear with different numbers in different places on the same day, without anyone making a mistake. Understanding that chain is the first step to explaining a discrepancy rather than being blamed for it.

Why daily reporting is harder than monthly

Hospitals were used to reporting to regulators and registries on monthly, quarterly or annual cycles. Those reports allow time for review, correction and sign-off. Daily reporting removes that slack. Data must be extracted, checked and sent every day, including weekends and holidays, often before a fixed morning deadline.

That cadence changes the engineering. A monthly report can tolerate a manual step; a daily one turns the same step into thirty a month. A monthly error can be caught in review; a daily one is published before anyone sees it. The faster the cycle, the more the process depends on automation and automated checks rather than on people catching mistakes.

Definitions: what counts as a COVID bed

Reporting depends on shared definitions. What counts as a confirmed or suspected COVID patient, a staffed bed, an ICU bed, an available ventilator? Small differences in definition produce large differences in totals. A hospital may have thirty physical ICU beds but nurses for only twenty; whether it reports thirty or twenty changes how full it looks by a third.

During 2020, definitions changed several times as guidance evolved, and hospitals read some fields differently. Comparisons across facilities and over time were therefore weaker than published charts suggested. A smooth line on a public chart could hide a dozen local interpretations.

Each reported field should map to a written definition and to a specific source in the hospital’s systems. A staffed ICU bed, for example, might be derived from the bed management system’s unit list, minus beds blocked for staffing, as of a fixed time each day. When a definition changes, the mapping must change with it, and someone must check whether historical comparisons still hold.

A data dictionary for external reporting, owned by a named analyst, is a modest investment that pays off every time a requirement changes. A data dictionary is exactly what it sounds like: a reference document that lists every field, says what it means, where it comes from and how it is calculated.

Identifiers decide whose numbers are whose

Before any count can be combined, the recipient has to know which hospital sent it. The July guidance asked for the hospital’s Medicare certification number and its NHSN identifier. That sounds routine. It is not, because the two do not always describe the same thing. Several campuses can share one certification number, while each has its own beds, units and staff.

A health system has to decide whether those campuses report together or separately, and then keep that choice consistent across every recipient. Mergers, new campuses and closed units all change the answer. When identifiers drift, numbers can vanish from one hospital’s total or be counted twice. A reporting dictionary should therefore include the facility map itself as well as the fields.

Surge beds and the moving denominator

Capacity is a harder concept than it sounds during a surge. Hospitals converted recovery rooms, step-down units and even procedure areas into intensive care space. Some of those beds were staffed some days and not others. A field asking for “ICU beds” could reasonably be answered with the licensed count, the normal count, or the count in use that day including surge space.

Each answer tells a different story. Reporting licensed beds understates strain. Reporting only surge-inclusive beds can make a hospital look less full just as it is most stretched, because the denominator grew. A good dictionary entry says which count the field means, how surge space is treated, and who decides when a surge bed counts as staffed. Without that, two neighboring hospitals reporting identical numbers can be in very different situations.

Timing, revisions and late results

Timing belongs in the definition too. A census taken at midnight differs from one taken at noon, because patients are admitted and discharged throughout the day. Reporting the same snapshot time every day, and recording it, made trends meaningful and stopped day-to-day noise from being read as surges.

Clinical definitions raised harder questions. Whether a patient counted as a suspected case depended on documentation that clinicians entered for care, not for reporting. Results that arrived after the snapshot changed yesterday’s numbers. Hospitals had to decide whether to revise past submissions or report only forward, and to apply the choice consistently. Writing those rules down, and telling recipients which rule the hospital followed, prevented later disputes about apparent discrepancies.

Turning clinical documentation into a count

The suspected-case field shows how deep definitions reach. A clinician orders a test because a patient has symptoms. The order may carry a reason, or it may not. An infection prevention team may flag the patient for isolation. Each of those events lives in a different part of the EHR. A report that counts “suspected COVID” has to choose which event defines the category and when the patient leaves it.

Different choices produce different counts from the same patients. Counting isolation flags captures patients isolated for other reasons. Counting pending tests misses patients treated before a test was ordered. The choice is partly clinical and partly technical, which is why the data dictionary needs a clinical owner as well as an analyst. A report built by an analyst alone often counts what is easy to query rather than what the definition intends.

Collection: the manual effort behind daily numbers

Many hospitals compiled daily reports by hand. Staff counted patients and beds from census reports and spreadsheets, then keyed totals into web forms. Some health systems automated extraction from EHR and bed management systems; many could not do so quickly.

Take a small community hospital where, each morning, a nurse manager prints the census, highlights the COVID-positive and suspected patients, tallies beds by unit, checks the ventilator log, and types the totals into a web form. It takes ninety minutes on a good day. Now the destination changes. There is a new form with different fields, a new login, a new file format for those who upload rather than type, and new validation rules that reject entries the old form accepted. All of it must work within days, while the nurse manager is also covering shifts. Changing the destination meant changing forms, credentials, file formats and validation rules, sometimes with days of notice, while staff were stretched by patient care.

The durable fix is automated extraction from source systems, with validation before submission. Validation catches the obvious errors, such as more occupied beds than staffed beds or a sudden drop to zero. Those checks are simple rules a computer can apply in seconds, and they spare the hospital from sending numbers that are plainly impossible.

Validation rules worth writing down

Validation is where a small amount of effort prevents most public embarrassment. A handful of rules catch the bulk of errors before they leave the building:

• Logical limits. Occupied beds cannot exceed staffed beds, COVID-19 inpatients cannot exceed all inpatients, and ICU patients cannot exceed ICU beds in use.
• Parts that must add up. Admissions broken down by age bracket should sum to the total admissions reported.
• Sudden changes. A day-over-day swing beyond a set threshold should pause the submission until someone confirms it.
• Missing versus zero. A blank field and a true zero mean different things, and the pipeline should never turn one into the other.
• Inventory sense checks. Supply counts cannot be negative, and usage cannot exceed what was on hand plus what arrived.

Each rule should record when it fired and what the reviewer decided. Over time, that log shows which fields are fragile and where the definitions need work.

Separate the steps

A well-built pipeline separates three steps: extracting from source systems, transforming to the required definitions, and submitting to the destination. Specialists call this extract, transform and load, often abbreviated ETL. When the destination changes, only the last step needs rework.

Each step has its own controls. Extraction should run on a schedule, log what it pulled and alert when a source is unavailable. Transformation should be driven by the data dictionary, with each rule versioned so the hospital can say which version produced which day’s numbers. Submission should keep a copy of exactly what was sent, when, and the recipient’s response. Those three records together let a hospital answer any later question about a number it reported.

Testing deserves its own environment. A change to a definition or a destination should be run against past days’ data before it goes live. Comparing old and new outputs side by side shows whether a jump in the numbers reflects reality or the change. Hospitals that tested this way could tell a recipient in advance that a figure would shift, rather than explaining it afterwards.

That design pays off beyond any single requirement, because quality measures, registry submissions and payer reporting can share the same plumbing. Hospitals report data to many recipients for many reasons. A pipeline built once and reused is cheaper than a separate manual process for each.

System-level choices

Health systems with several hospitals had a further choice. Central submission by a system data team ensured consistency but depended on every hospital’s source systems being mapped. Local submission was faster to start but produced inconsistent numbers across the system. Centralizing cost more up front and less every time a requirement changed afterwards.

Systems spanning several states faced a sharper version. Each state could have its own reporting route, its own extra fields and its own deadlines, on top of the federal request. A central team with one dictionary and one pipeline could produce each state’s file as a variation on a shared core. Local teams each building their own version produced as many interpretations as there were states.

The vendor route

Many hospitals relied on their EHR vendor to produce the report. That made sense: the vendor knows its own data model and can build a feed once for many customers. It also concentrated risk. When requirements changed, each vendor had to update its product for every customer, and hospitals waited in the same queue.

A hospital using a vendor feed still owns the definitions. The vendor’s report embeds choices about which documentation counts as a suspected case or how surge beds are treated. Those choices may not match local practice. Hospitals that reviewed the vendor’s logic against their own dictionary caught mismatches early. Those that treated the feed as a black box found out when their numbers looked wrong.

People, runbooks and logins

Resilience mattered as well. A daily submission that depends on one analyst, one spreadsheet or one login fails when that person is ill. Documented runbooks, a trained backup and monitoring that alerts when a submission is late kept reporting steady through staff absences. A runbook is a step-by-step instruction sheet that lets someone unfamiliar with the task complete it correctly. Credentials for external portals should belong to a role mailbox or service account where permitted, not to one employee. A service account is a login that belongs to a function, such as “capacity reporting,” rather than to a person, so it does not disappear when someone is out sick or leaves.

Shared logins bring their own risk, so they need controls. Where a portal allows several named users under one facility, that is usually better than a single shared password. Access should be reviewed when staff change roles, and the reporting team should know who can submit on the hospital’s behalf. A submission made by someone who has left the organization is a governance failure as well as a security one.

Governance: who receives and publishes the data

The controversy was largely about governance: which agency held the data, who could see it and how it would be published. Governance, in data terms, means the rules about who owns information, who may use it, who checks its quality and who decides when it changes.

Public health agencies, researchers and the public had relied on CDC data, and the change interrupted that access. States also ran their own reporting and sometimes received data by different routes than federal agencies. That produced conflicting numbers for the same hospitals. When two official sources disagree, trust in both suffers, and hospital leaders end up explaining figures they did not publish.

For hospitals, governance questions are practical. A hospital needs to know which recipient is authoritative for each requirement, whether one submission satisfies several, and who is responsible for accuracy when a state submits on its behalf. Written answers prevent duplicate reporting and contradictory figures, and they protect the hospital if its numbers are later questioned.

The case for the switch, taken seriously

The federal change had defenders, and their argument deserves a fair hearing. NHSN had been built for periodic surveillance reporting, not daily operational data from every hospital in the country. Completeness under the voluntary spring arrangement was patchy. Allocating scarce drugs needed timely data from as many hospitals as possible, and a system designed for the purpose might deliver it faster.

That case was about the national pipeline, and on its own terms it had merit. It does not change the hospital-level conclusion. Whatever the right federal design, the destination was going to move at least once, and it did move again later. Hospitals could not control those decisions. They could control how much each one cost them, and that depended on the layers described here.

Privacy and publication

Capacity reports are mostly aggregate counts, but governance still has a privacy side. HIPAA permits covered entities to disclose information to public health authorities for public health purposes without patient authorization. Aggregate counts generally do not identify anyone. In a small rural hospital, though, a count of one or two patients on a given day can point to a person in the community.

Publication rules matter for that reason. When federal facility-level data was released later in 2020, very small counts were suppressed. Hospitals should still know what each recipient will publish, at what level of detail, and whether that publication could identify a patient. That question belongs with the privacy officer as well as the reporting team.

Agreements with states and vendors

When someone else submits on a hospital’s behalf, the hospital’s name is still on the number. Each arrangement should be written down. With a state, the hospital needs to know the deadline the state sets, how the state transforms or fills in data, and how errors are corrected and by whom. It also helps to receive a copy of what the state actually forwarded, so differences can be traced.

With a vendor, the useful terms are about change. How quickly will the vendor implement a new requirement, and will it tell the hospital when the logic behind a field changes? Can the hospital see and test the output before it is sent? Those terms rarely appear in standard EHR contracts. They are easier to add at renewal than to request in the middle of a surge.

One owner across the layers

A single internal owner for all external reporting, with authority to approve definition changes, ties the three layers together. Without that owner, the definitions sit with one team, the pipeline with another and the relationships with regulators with a third, and nobody sees the whole.

The owner’s job is concrete. It keeps the inventory of every external report, its recipient, its legal basis and its deadline. It approves definition changes and records why. It signs off on the route for each requirement and the agreements with states or vendors that submit on the hospital’s behalf. And it reports to leadership on late or rejected submissions, so that problems surface before a regulator raises them.

Two hospitals, one announcement

To see why the same announcement could be a minor task for one hospital and a crisis for another, compare two hypothetical organizations facing the July change.

The first, a regional health system, had spent the spring building its reporting properly. Its analysts had written a data dictionary for every field in the federal request, mapped each one to the EHR or the bed management system, and set a fixed snapshot time each morning. A scheduled job pulled the numbers automatically, ran validation checks and produced a file ready to send. When the destination changed, the system data team read the new requirements, compared the fields with their dictionary and found that most were the same. They changed the submission step to point at the new destination, set up the new credentials under a team account, and tested a few days of data. The hospitals in the system barely noticed.

The second, a county hospital, had done what many hospitals did that spring: survived. Its daily numbers came from a spreadsheet maintained by a single analyst, fed by printed census reports and phone calls to unit managers. The analyst knew which numbers meant what, but none of it was written down. When the new requirements arrived, the analyst had to work out which old fields matched which new ones, learn a new form, get a personal login approved and train a colleague as backup, all while handling the usual daily submission. When a field on the new form was defined slightly differently, the hospital’s numbers jumped, and someone outside the hospital asked why.

Neither hospital did anything wrong in the spring. The county hospital made a reasonable choice under pressure. But the difference in the summer was entirely the result of earlier decisions about definitions, automation and ownership. That is the nature of infrastructure: its value shows up when something changes, not on an ordinary day.

One detail is easy to miss. The work at the regional system was not glamorous. Nobody bought an expensive new platform. The gains came from writing things down, separating steps and giving one team clear ownership. Those are management choices as much as technology choices, and they are within reach of most organizations.

What the county hospital could fix in a month

The county hospital did not need a data warehouse to close most of the gap. In a few weeks, its analyst could write one-line definitions and sources for the fields that mattered most. A colleague could be trained and given access under a role account where the portal allowed it. A one-page runbook could describe the morning routine, including whom to call when a unit manager does not answer.

Simple checks could be added to the spreadsheet itself, flagging impossible values before anyone typed them into a portal. And the analyst could keep a copy of each day’s submission, so questions about past numbers had an answer. None of those steps required new software or a large budget. Together they turned a personal routine into an organizational process, and they made the next change of destination a matter of hours rather than days.

Hospitals in between

Most hospitals sat between these two. A large academic medical center might have strong analytics but dozens of units with local habits for blocking beds. A critical access hospital, small and rural, might have one person covering reporting, IT and quality. A children’s hospital or a psychiatric hospital had to work out which fields applied at all. Each faced the same three layers with different resources.

The useful question for each was the same: which layer would break first. For the academic center it was often definitions across units. For the critical access hospital it was people. For a hospital relying on its vendor it was the vendor’s release schedule. Knowing the weakest layer told a leader where the next hour of effort should go.

Hours, allocations and reputations

The costs of weak reporting are easy to underestimate because they are spread thin. Each change consumes hours from nurses, analysts and managers who would otherwise be doing something else. During a surge, those hours come from the same people caring for patients, so the true cost is measured in fatigue as much as in overtime pay.

The risks are concrete. When reporting is tied to how scarce treatments and supplies are allocated, an undercount can mean a hospital receives less than it needs. When reporting becomes a requirement for participating in public insurance programs, as it later did, inaccurate or missed submissions become a compliance issue rather than an inconvenience. And when public figures about a hospital are wrong, the reputational damage lands on the hospital, whoever made the error.

Public health agencies bear costs too. A state health department that collects data on behalf of its hospitals inherits every one of their definition problems. It must chase late submissions, query impossible values and explain differences between its dashboard and the federal one. Departments with thin data staff found that daily hospital reporting absorbed people who were also needed for case investigation and vaccine planning.

There is also an opportunity. The same pipeline that feeds a regulator can feed the hospital’s own operations center. Leaders who can see accurate, timely capacity numbers can make better decisions about staffing, transfers and elective procedures. Reporting built as permanent infrastructure serves those internal decisions as well as the regulator.

The objection that this is too much for an emergency

A reasonable objection is that emergencies are temporary, and building permanent infrastructure for a temporary request wastes scarce money. In the spring of 2020, many hospitals made exactly that judgment, and it was defensible at the time.

The weakness of the objection is that external reporting rarely stays temporary. Requests made in emergencies tend to become requirements, and requirements tend to outlive the emergency. Even where a specific report ends, the next one arrives. A pipeline built with separate steps, a dictionary and an owner can be reused for the next request. A one-off spreadsheet cannot.

Foundations that absorbed the switch

The foundations are unglamorous: every externally reported field has a written definition, a source system and a fixed snapshot time. Extraction is automated where possible, with validation checks before anything leaves the building. Extract, transform and submit are separate steps. One owner is responsible for external reporting across the system, with a trained backup, a runbook and a shared login where permitted. A written map shows which recipient is authoritative for each requirement.

The habits that made every change expensive were just as consistent:

• Treating each new request as a one-off. Building a fresh manual process for every requirement multiplies cost and error.
• Leaving definitions unwritten. If the meaning of a field lives only in someone’s head, it leaves when they do.
• Hard-wiring the destination. Pipelines that mix extraction, calculation and submission together have to be rebuilt whenever the recipient changes.
• Single points of failure. One person, one spreadsheet or one personal login is a fragile foundation for a daily obligation.
• Ignoring revisions. Without a consistent rule for late results, the same day’s numbers can disagree across reports.
• Trusting a feed without reading it. A vendor or state route still carries the hospital’s name, so its logic needs local review.

Measures that show the foundations are in place

Leaders can track a short set of measures. They include the share of reported fields produced automatically rather than keyed by hand, and the number of submissions late or rejected each month. They include the time it takes to absorb a definition change, from notice to first correct submission, and whether every field has a current dictionary entry with a named owner. Each can be measured without new technology, and each shows whether the foundations would hold through the next change.

Hospitals that had invested in these foundations absorbed the July switch with modest effort. Those relying on manual counts found every change expensive, and their staff paid in overtime at the worst possible moment.

Every reported number needs a definition, a source and an owner

1. How many external reports do we submit, to whom, and who owns each one?
2. Is there a written definition and source for every field we report, and when was it last reviewed?
3. If a regulator changed the destination of a report tomorrow, which parts of our process would have to change, how long would it take, and which daily submissions still depend on someone typing numbers into a web form?
4. If the person who submits our capacity data is out sick, who covers, are the steps written down, and are our portal logins tied to individual employees or to roles?
5. Do our own leaders use the same capacity numbers we send to regulators, and if not, why not?

A health system that can answer these in a single meeting has turned reporting into infrastructure. One that needs a week of emails to answer them is still carrying buckets, and the next change in destination will show it.

With hindsight

The HHS reporting system remained the main route for hospital COVID data for much of the pandemic. The early weeks were rough: some CDC public pages stopped updating, and journalists and researchers spent the following months comparing federal figures with state ones and finding gaps. Completeness and consistency improved as hospitals and states settled into the new route.

In August 2020, CMS made COVID-19 reporting a condition of participation in Medicare and Medicaid for hospitals, through an interim final rule, turning reporting from a request into a requirement. A condition of participation is one of the rules a hospital must meet to be paid by Medicare and Medicaid, which for most hospitals means it is not optional in any practical sense. Hospitals that had treated reporting as a temporary chore now faced it as a compliance obligation with enforcement behind it.

In December 2020, HHS began publishing facility-level capacity data that researchers and journalists used widely. Very small counts were suppressed, but the rest was there for anyone to see. Facility-level publication meant a hospital’s numbers were visible to anyone who cared to look, including journalists and researchers comparing hospitals with their neighbors. The quality of a hospital’s reporting became, in effect, part of its public record.

The destination then moved again. In December 2022, collection of hospital COVID-19 data moved from the HHS system run by TeleTracking back to the CDC’s NHSN. Hospitals that had built a layered pipeline changed their submission step. Hospitals still keying numbers into a web form learned another portal.

After the public health emergency ended in May 2023, CMS kept a reduced reporting requirement in place until the end of April 2024. Reporting then became voluntary for a few months. From November 2024, CMS made reporting of respiratory illness data, covering COVID-19, influenza and RSV, to NHSN an ongoing condition of participation for hospitals and critical access hospitals. That return to a permanent requirement was itself another change in definitions and cadence, exactly the kind a layered pipeline is built to absorb.

Public health systems got investment too. The CDC’s Data Modernization Initiative, which received pandemic funding, set out to improve how data moves between providers, states and federal agencies. Progress was uneven, and many state systems still depended on manual processes years later. Standards work on electronic formats for capacity reporting advanced, but adoption by hospitals remained gradual.

Some things held up and some did not. The argument that national hospital data needed a stable home was borne out by its eventual return to NHSN as a permanent requirement. The hope that the pandemic would push every hospital onto fully automated reporting was not. NHSN continued to accept manual entry and file uploads alongside automated feeds, because many hospitals still depended on them. The gap between hospitals with mature pipelines and those without narrowed, but it did not close.

The governance argument of July 2020 also faded rather than resolving. Debate about which agency should hold hospital data gave way to the slower work of making one system reliable. For hospitals, the practical result was the same either way: a reporting obligation that outlived the emergency, with a destination and definitions that kept changing.

Read together, these events tell a clear story. Reporting that began as an emergency request became a condition of payment, and then a permanent obligation. The destination moved more than once, the definitions changed with each move, and the publication of facility-level data raised the cost of getting numbers wrong.

The hospitals that came through this well were not necessarily the largest or the best funded. They were the ones that treated reporting as infrastructure: definitions written down, pipelines that separated the source from the destination, and a single owner who saw the whole picture. For them, each change was an adjustment. For hospitals still counting by hand, each one was another scramble.

External reporting is a permanent part of how a hospital is regulated, paid and judged in public, far too important to be squeezed into a manager’s morning. Building it properly once costs less than rebuilding it in a crisis, and the same foundations serve the hospital’s own decisions every day.