NHSN has over 20 years of experience in secure and confidential data exchange with over 37,000 U.S. hospitals and other healthcare facilities. Data access and protection provisions are outlined in the NHSN Agreement to Participate and Consent and the NHSN Facility/Group User & Administrator Rules of Behavior. Data are protected by administrative, technical, and physical security controls that safeguard the confidentiality, integrity, and privacy of personal information according to industry-standard policies and federal laws, including the Privacy Act, the Health Insurance Portability and Accountability Act (HIPAA), and the Federal Information Security Modernization Act (FISMA). Additionally, NHSNLink safeguards information in the following ways: Protected by an OAuth2.0 identity-access management (IAM) service delivered by CDC Secure Access Management Services (SAMS), which includes authentication and role-based access control (RBAC). Queries only selected, pre-specified FHIR resources that are available only upon authorization from the facility’s server. Access control is provided on a FHIR resource-by-resource basis. Data (including internal NHSNLink app communications) are encrypted in-transit through HTTPS/TLS1.2. Data are encrypted at-rest using NIST Advanced Encryption Standard 256 (AES 256)[i]