CDC gets real-time nursing home disease tracker—but hands data to private vendor

What it does

This bill directs the CDC to spend five years expanding the National Healthcare Safety Network (NHSN) to create real-time disease surveillance in nursing homes nationwide. The CDC will contract with a private technology vendor to build the infrastructure, which must integrate with existing reporting systems, alert health authorities immediately to outbreaks, and support an optional care management program for nursing homes. Patient data will be protected under HIPAA, and the collected data cannot be used for regulatory enforcement unless explicitly authorized by law.

Why we flagged it

The bill's core mechanism is a federally funded, CDC-directed surveillance system for nursing homes. While it contracts with private vendors, the operative purpose is public health monitoring and outbreak prevention, not private profit extraction.

What the text implies

• The bill permits a private contractor to hold and process sensitive patient health data under HIPAA as a 'covered entity,' creating a new private intermediary in the nursing home surveillance chain. If the contractor is breached or mishandles data, liability and remedies may be limited by the HIPAA safe harbor.
• The 'staffed care management program' that nursing homes may 'opt into' is undefined in the bill text. If this program is operated by the contractor or a third party, it could create a revenue stream or market advantage for the vendor independent of the surveillance mission.

The full analysis lists 4 implications of this text.

Who stands to gain

Health information technology vendors (HITRUST-certified firms); Electronic health data infrastructure companies; Nursing home operators (via optional care management program)