The Centers for Medicare & Medicaid Services (CMS) reduces Medicare inpatient payments by 1% for every hospital in the worst-performing quarter of its Hospital-Acquired Condition Reduction Program (HACRP). More than 700 hospitals take that cut in a typical year. Five of the six measures behind the score are healthcare-associated infections, which puts infection prevention, and the accuracy of the infection data a hospital reports, at the center of a penalty that touches every Medicare discharge for twelve months.
Picture two community hospitals with the same case mix and similar infection rates. One runs an infection prevention program staffed for surveillance and little else. The other funds the same bundles and education, and also pays for someone to check its NHSN data before it is submitted. Two years later, one of them lands above the penalty line. At $80 million in Medicare inpatient payments, the penalty alone is $800,000, before anyone counts what the infections cost to treat.
How does the HAC Reduction Program penalty work?
Each fiscal year, CMS calculates a Total HAC Score for every eligible acute care hospital. Hospitals scoring above the 75th percentile receive a 1% reduction on their Medicare inpatient (IPPS) operating and capital payments for that year's discharges. Physician payments are excluded, and Maryland hospitals are exempt under the state's separate payment agreement.
Because the cutoff is a percentile, about a quarter of scored hospitals are penalized no matter how much the field improves. Definitive Healthcare estimated FY2025 penalties at more than $186 million across the program.
Performance drives most of the outcome, though structure plays a part. A 2024 study in JAMA Network Open of 3,117 hospitals found that safety-net hospitals (odds ratio 1.41) and hospitals with very major teaching intensity (odds ratio 1.94) were still penalized more often after CMS revised its methodology to address exactly that problem.
Which measures make up the Total HAC Score?
The Total HAC Score is the equally weighted average of a hospital's scores on six measures:
CMS PSI 90, the Patient Safety and Adverse Events Composite (from Medicare claims)
Central line-associated bloodstream infection (CLABSI)
Catheter-associated urinary tract infection (CAUTI)
Surgical site infection (SSI) after colon surgery and abdominal hysterectomy
Methicillin-resistant Staphylococcus aureus (MRSA) bacteremia
Clostridioides difficile infection (CDI)
For a hospital scored on all six, the five infection measures make up five-sixths of the Total HAC Score. Those five come from National Healthcare Safety Network (NHSN) surveillance. PSI 90 comes from claims, so it reflects coding and documentation, and it usually sits outside the infection prevention program's reach.
Why don’t more hospitals know where they stand?
Part of the answer is timing. FY2026 penalties, applied to discharges from October 2025 through September 2026, were based on NHSN infection data from January 2023 through December 2024 and PSI 90 data from July 2022 through June 2024. An infection reported in early 2023 was still reducing payments in the fall of 2026.
The other part is routing. Results arrive as a Hospital-Specific Report through CMS's quality reporting system, usually to quality staff, who have 30 days to review the calculations and request corrections. The money leaves separately, as slightly smaller claims payments spread across twelve months. Finance sees lower reimbursement, quality sees a score, and unless someone connects the two, the board may hear about it from neither.
How much of the score reflects care, and how much reflects reporting?
The score is not built from what happened in your facility, but from what was reported about what happened.
Case finding, consistent application of NHSN definitions and interrater reliability between infection preventionists all sit between clinical reality and the number CMS uses. At community-hospital volumes, where predicted infection counts are small, one event called incorrectly can move a measure's standardized infection ratio noticeably. Over-calling counts against you as surely as missing a case.
CMS checks the data. Each year it selects up to 200 hospitals at random and up to 200 more using targeting criteria and compares their reported infections against cases identified by a trained CMS abstractor. A hospital that fails validation can be assigned the maximum Winsorized z-score (W-Z score) for the measures that failed, which is the worst value available on that measure. A reporting problem found in validation can do more damage to the score than the infections themselves would have. [[INTERNAL LINK: IP&MA surveillance validation / interrater reliability service page or blog post]]
What does a performance-focused infection prevention program look like?
Compliance-focused programs ask whether policies exist and whether staff follow them. Performance-focused programs fund the same bundles and frontline education, then pay for surveillance competency and for checking the data before it goes to NHSN. In a budget meeting, the first kind gets asked what it costs. The second gets asked what it returns, and has an answer.
Preventing one CLABSI avoids its treatment cost and the extra days attached to it. AHRQ's analysis of selected hospital-acquired conditions put the added inpatient cost at roughly $600 to $48,000 per case, in 2015 dollars. That prevented infection also frees a bed for the next admission and removes one event from the numerator of a measure that sets a penalty on every Medicare discharge you bill. And a patient goes home on schedule.
Back to those two hospitals
Both had committed clinical teams, and their infection rates were close. What separated them was whether infection prevention was funded only as a clinical obligation, or also as the program that protects Medicare revenue using the same work. One of those hospitals will spend next year explaining a penalty to its board. The other won't.
Frequently Asked Questions
What is the HAC Reduction Program penalty? Hospitals with a Total HAC Score above the 75th percentile receive a 1% reduction on Medicare inpatient (IPPS) operating and capital payments for every discharge in that fiscal year.
Which hospitals are included? Subsection (d) acute care hospitals paid under the Medicare Inpatient Prospective Payment System. Maryland hospitals are exempt.
How is the Total HAC Score calculated? CMS converts each of the six measure results into a Winsorized z-score and averages the scores a hospital has available, with each measure weighted equally. Hospital-level results are published in the CMS HAC Reduction Program dataset.
How do hospitals find out whether they were penalized? CMS sends each hospital a confidential Hospital-Specific Report and allows 30 days to review it and request corrections before results are made public.
Where to start
IP&MA works with hospitals to reduce HAC Reduction Program penalty exposure through an ongoing engagement rather than a one-time assessment.
It begins with a no-cost preliminary review of your NHSN and CMS data. The review shows which measures are driving your Total HAC Score, how much of that score reflects care versus reporting, and how much of the current performance period is still open. Work then goes to the measures actually moving your score, starting with validating the surveillance data underneath them, and progress is tracked against the open window instead of waiting for next year's report. Every proposal includes a facility-specific ROI analysis.
Request a preliminary penalty review to see where your exposure currently sits.