NHSN AUR reporting software and antimicrobial use software compared for hospitals and critical access hospitals
CMS scores a hospital at zero for Promoting Interoperability if it misses the AU or AR Surveillance measure. Here is which software NHSN has validated, what the EHR modules cover, what critical access hospitals do, and what to ask before you sign.
8 min read
NHSN AUR reporting software is the tool that turns your eMAR and lab data into the monthly HL7 CDA files the CDC's National Healthcare Safety Network accepts for its Antimicrobial Use (AU) and Antimicrobial Resistance (AR) Options. NHSN does not allow manual entry for either Option, so every hospital needs one. Most get it from their EHR vendor (Epic, Oracle Health, MEDITECH, Altera), others from a surveillance platform such as Sentri7, TheraDoc, VigiLanz or BD HealthSight.
No vendor publishes a price. This comparison is written for the stewardship pharmacist, infection preventionist or quality director at a US hospital who has to pick, or replace, the system that produces those files. Antimicrobe does not submit AUR data. It builds the antibiogram from the same lab results the AR file uses, and the article says where that fits.
What CMS requires for AU and AR reporting in 2026
Since the 2024 EHR reporting period, eligible hospitals and critical access hospitals in the Medicare Promoting Interoperability Program have had to report antimicrobial use and resistance to NHSN. From 2025 the single AUR measure was split into two, AU Surveillance and AR Surveillance, and each is scored on its own.
A hospital meets each measure through active engagement. Option 1 is pre-production and validation: register intent with NHSN within 60 days of the start of the reporting period and send test files. Option 2 is validated production data. From 2025 a hospital may spend only one calendar year in Option 1, so hospitals that sat in Option 1 for both measures in 2025 have to be in production for 2026.
Missing either measure scores the hospital at zero for the whole program. For an eligible hospital that means a downward adjustment of three quarters of the annual market basket update, and for a critical access hospital it means Medicare pays 100% of reasonable cost instead of 101%. The software is rarely the expensive part of this decision.
What the AU and AR files actually need
The two Options draw on different systems, which is why a product can be validated for one and not the other. The 2026 NHSN AUR protocol says antimicrobial days for the AU Option come from administration records in the eMAR or bar code medication administration system only, not from pharmacy orders, dispensing or billing, and are reported monthly as antimicrobial days per 1,000 days present.
The AR Option takes isolate data from the laboratory information system and patient days and admissions from the ADT system. The protocol is blunt about one case that matters for small hospitals: facilities that receive results by PDF or fax cannot participate in the AR Option, because the file needs discrete results.
Every production AU file must carry a Synthetic Data Set (SDS) Validation ID, which NHSN issues to the vendor once its test file passes. That is what the CDC vendor lists below record. For Promoting Interoperability credit the hospital also needs certified health IT for the AUR criterion, 45 CFR 170.315(f)(6).
NHSN AUR reporting software options compared
Two things stand out on the lists. TruBridge, the EHR most common in critical access hospitals, does not appear on either one, and neither does ICNet. And several products are validated for AU in a newer version than for AR, so check the exact version your hospital runs against both lists, not just the vendor name.
Altera hospitals already have validated AUR files. The antibiogram they still build by hand is covered on Paragon EHR antibiogram software and in antibiogram software for Sunrise Clinical Manager hospitals.
| Option | AU validated | AR validated | Usually fits |
|---|---|---|---|
| Epic (Bugsy) | Yes, February 2024 and above | Yes, February 2022 and above | Epic hospitals |
| Oracle Health | Yes, Antimicrobial Use Report | Yes, Antimicrobial Resistance Report | Oracle Health and Cerner hospitals |
| MEDITECH | Yes, 6.x, Client/Server, Expanse, MAGIC | Yes, six versions | MEDITECH hospitals, many of them small |
| Altera Sunrise and Paragon | Yes | Yes | Altera hospitals |
| Wolters Kluwer Sentri7 | Yes, 2025 | Yes, 2023 | Hospitals that also want pharmacy surveillance |
| Premier TheraDoc | Yes, 5.4.6 to 5.5 | Yes, 5.4.6 to 5.4.9 | TheraDoc sites |
| VigiLanz | Yes, Dynamic Pharmacy Surveillance 2025 | Yes, 2020 | VigiLanz sites |
| BD HealthSight | Yes, 4.21 | Yes, 4.18 | BD MedMined sites |
| Standalone AUR tools | Algo Express, ILUM Insight, DASON ASAP, PipelineRx and others | Most of the same | Hospitals whose EHR is not validated |
EHR module or a surveillance vendor
If your EHR is validated for both Options, the EHR module is the default and usually the cheapest route, because it reads eMAR, lab and ADT data that already sit in the same database. Epic sites do this through Bugsy, and the trade-offs of that module are covered in Epic Bugsy alternatives, linked below.
A surveillance vendor makes sense when you are buying it anyway for pharmacist alerts, interventions and dosing. Wolters Kluwer sells Sentri7 AUR Reporting as one-click submission to NHSN, and its ONC disclosure says the certified AUR product has a one-time implementation fee and an annual licensing fee. BD describes its HealthSight AUR Reporting Module as enabling clinicians to submit AUR data into NHSN. Premier and VigiLanz certified their AUR reporting under Meaningful Use Stage 3 in 2017.
If AUR is the reason you are shortlisting a surveillance platform, read the full comparison of what each one does in pharmacy surveillance software compared first, and the Epic route in Epic Bugsy alternatives. The vendor pages for Sentri7 alternatives and TheraDoc alternatives cover what else those platforms include.
Which NHSN AUR software works for a critical access hospital?
The answer depends on the EHR. A critical access hospital on MEDITECH, Oracle Health or Altera can usually turn on the vendor's validated module. A hospital on an EHR that is not on the CDC lists needs either a standalone AUR tool that reads its data or one of the exclusions.
The exclusions are narrow. For AU, a hospital is excluded only if it has no patients in NHSN patient care locations, no electronic eMAR or BCMA records or no electronic ADT system, or, new in 2025, no data source with the minimal discrete data elements required. For AR, the same applies with an electronic LIS in place of eMAR. A hospital that sends cultures out and gets results back only as PDFs may meet the AR data source exclusion, but it should confirm that with its attestation advisor rather than assume it.
Small hospitals ask this in public because nobody else answers it. In a July 2025 APIC community thread titled AU and AUR data entry into NHSN for critical access hospitals, an infection preventionist asked what software other critical access hospitals use to create the CDA files, adding that she was trying to help her facility save money. The only reply came from a Cerner hospital that uses a report built into its EHR.
TruBridge hospitals face both questions at once, AUR files and an antibiogram from a small denominator. The antibiogram side is covered on CPSI EHR antibiogram software and, for any small hospital, on critical access hospital antibiogram software.
How much does NHSN AUR reporting software cost?
No vendor on either CDC list publishes a price. The one public cost structure we found is the Wolters Kluwer ONC mandatory disclosure for its certified AUR product, which lists a one-time implementation fee plus an annual license fee. EHR vendors usually price AUR as a licensed module or bundle it with their stewardship content, so the quote depends on your contract more than on bed count.
Compare any quote with the cost of not reporting. For an eligible hospital, a zero Promoting Interoperability score is three quarters of the annual market basket update across all Medicare inpatient payments. For a critical access hospital it is one percentage point of reasonable cost reimbursement. Against either number, a validated module is usually the cheap option, and the real cost is the analyst time to map locations and fix rejected files.
Check data quality before you trust the files
Validation proves a vendor can produce a correct test file, not that your monthly files are right. The CDC 2024 AU Option report says one surveillance vendor that prepared AU submissions for 154 hospitals, about 5% of hospitals submitting AU data in 2024, later told NHSN about a data attribution error. The same report counts 4,362 hospitals, 59.1% of those eligible, that had sent at least one month of AU data by January 1, 2025, and 3,288 that sent nine or more months in 2024.
So ask how the vendor checks each month before it is sent. Hospitals that build the AU feed from their own data warehouse can put data freshness and volume monitoring on it, so a missing unit or an empty month shows up before the NHSN status letter does.
Where Antimicrobe fits
Antimicrobe does not create CDA files and does not submit to NHSN, so it is not an AUR product and should not be on your AUR shortlist. Where it fits is beside one. The AR Option and the hospital antibiogram start from the same finalized susceptibility results in the LIS, and the AR file goes to NHSN while the antibiogram goes to your prescribers and your stewardship committee.
Antimicrobe builds that antibiogram from a CSV export of the lab results: first isolate per patient, organisms under 30 isolates flagged as CLSI M39 recommends, unit and source cuts, and a rule receipt for the committee. The Lab plan is $249 a month for one facility, bought by card, and Stewardship is $749 a month for up to three facilities with trends and MDRO counts.
What the resistance side of the product does is on antimicrobial resistance surveillance software, and every limit is on the pricing page.
Questions to ask before you buy
- Which exact product version is on the CDC AU list, and which on the AR list, and is that the version we will run?
- Is the product certified for 45 CFR 170.315(f)(6), and is it on the Certified Health IT Product List?
- Who maps our NHSN locations, and who fixes a rejected file, you or us?
- How do you check each monthly file before submission, and what happened the last time you found an error after sending?
- For AR, do you read discrete results from our LIS, and what happens to cultures sent to a reference lab?
- What is the implementation fee, the annual fee, and what changes when NHSN updates the protocol?
- Can we export the same susceptibility data for our antibiogram without paying for a second report?
Related on this site: antimicrobial resistance surveillance software, pharmacy surveillance software compared, CPSI EHR antibiogram software, critical access hospital antibiogram software, Antimicrobe pricing.