cms-hospital-compare · CMS
cms-hospital-compare · CMS
cms-hospital-compare · CMS
cms-hospital-compare · CMS
cms-hospital-compare · CMS
Medicare runs a standing wager against its own hospitals: every year, the quartile that scores worst on patient safety loses money. The Hospital-Acquired Condition Reduction Program, created by §3008 of the Affordable Care Act and live since fiscal 2015, scores each acute-care hospital on a composite of patient-safety and healthcare-associated-infection measures, ranks them by a single total HAC score, and docks 1% of every Medicare fee-for-service payment from the worst-performing quartile for the whole fiscal year. There is no appeal to an absolute standard: the program grades on a curve, and the bottom 25% pay. The FY2026 file shows who landed there — and how little the single penalty number tells you about the harms underneath it.
One in four hospitals is cut, by design
719 of the 3,055 hospitals in the FY2026 program — 23.5% — take the 1% payment reduction. That share barely moves from year to year, because it is not a quality threshold a hospital can clear. The penalty is defined as the worst-performing quartile by total HAC score, so a roughly fixed quarter of the field is cut every cycle no matter how the absolute infection rates move.
| Outcome | Hospitals | Share |
|---|---|---|
| Payment reduction (worst quartile) | 719 | 23.5% |
| No reduction | 2,293 | 75.1% |
| No payment-reduction value published | 43 | 1.4% |
Source: CMS Hospital-Acquired Condition Reduction Program, FY2026 file, snapshot 2026-06-03.
The 43 hospitals without a published payment-reduction value are mostly facilities with too few eligible cases to score — 126 hospitals in the file carry no total HAC score at all. Everyone else is sorted into the two outcomes that matter: cut, or not cut.
A HAC penalty is a payment adjustment set against the field, not a verdict on a hospital's care. It records where a hospital ranked on one composite score in one period — and a hospital can cut its infection rate and still be penalized if its peers cut theirs faster.
The composite hides a tenfold spread across harms
The total HAC score folds six measures into one number: the PSI-90 patient-safety composite and five standardized infection ratios (SIRs) reported through the CDC's National Healthcare Safety Network. An SIR above 1.0 means a hospital recorded more infections than the national baseline predicts; below 1.0 means fewer. Reading the measures separately shows that "hospital-acquired conditions" is not one problem but five very different ones.
| Infection measure | Hospitals reporting | Median SIR | Above baseline (SIR > 1) |
|---|---|---|---|
| Surgical-site (SSI) | 2,270 | 0.80 | 35.6% |
| MRSA bloodstream | 2,068 | 0.64 | 23.0% |
| Central-line (CLABSI) | 2,182 | 0.56 | 17.8% |
| Catheter UTI (CAUTI) | 2,355 | 0.49 | 14.1% |
| C. difficile (CDI) | 2,767 | 0.35 | 4.0% |
Source: CMS HAC Reduction Program, the five infection measures, FY2026.
Surgical-site infections are the laggard: 35.6% of reporting hospitals sit above the national baseline, the highest of any measure, against just 4.0% for C. difficile. That is close to a tenfold gap in how many hospitals are still losing ground on a given harm. The medians tell the other half of the story — every measure's median SIR is comfortably below 1.0, so the typical hospital is beating the baseline on every infection. The harms are mostly trending the right way; the program still cuts a quarter of the field because it ranks hospitals against each other, not against the baseline.
The penalty is relative, not absolute
This is the design feature most often misread. Every cut hospital loses the same flat 1%, regardless of how far past the worst-quartile line it fell, and the line itself is a ranking, not a rate. The median PSI-90 composite is 0.96 across the 2,809 hospitals that report it — at or just under the value the measure treats as expected — yet 23.5% of hospitals are still penalized. A hospital can lower its own infection rates year over year and remain in the penalized quartile if peer hospitals lower theirs faster. The penalty answers "who ranked worst this period," not "who is unsafe."
That framing matters for how the number should be cited. A hospital in the penalized quartile has not necessarily failed a safety bar; it has placed in the bottom quarter of a field that, on the underlying measures, is mostly improving.
Where penalties land
Penalty rates vary far more by state than the national 23.5% suggests — and one state sits at zero. Among states with at least 25 hospitals, the FY2026 rate runs from 0% to better than half.
| State | Hospitals | Penalized | Penalty rate |
|---|---|---|---|
| Iowa | 30 | 16 | 53.3% |
| West Virginia | 25 | 12 | 48.0% |
| New Mexico | 26 | 11 | 42.3% |
| New York | 129 | 45 | 34.9% |
| California | 277 | 76 | 27.4% |
| Texas | 284 | 32 | 11.3% |
| Florida | 169 | 18 | 10.7% |
| Maryland | 43 | 0 | 0.0% |
Source: CMS HAC Reduction Program, selected states (≥25 hospitals), FY2026.
Maryland penalizes none of its 43 hospitals — not because they outperform, but because they are exempt. The state operates under a CMS all-payer global-budget waiver (the Maryland Total Cost of Care Model) that carves its hospitals out of most Medicare pay-for-performance programs, the HAC Reduction Program included. Maryland's hospitals still appear in the file and still report their infection measures; they simply cannot receive the payment cut. It is a policy artifact, not a safety result, and a reminder that the geography of penalties is partly the geography of payment waivers. At the other end, Iowa (53.3%) and West Virginia (48.0%) penalize close to half their hospitals — rates that track smaller, rural-heavy hospital fields rather than any single quality story.
What one row actually is
Each row in hac_reduction_program is one hospital for one fiscal year: a CMS facility identifier, state, the PSI-90 composite and its winsorized z-score, the five infection SIRs and their z-scores, the total HAC score, and a payment-reduction flag. The published file is the current program year — FY2026 — not a longitudinal history, so this study counts and groups within a single cycle rather than modeling a trend. The CMS facility ID is a CCN, and the CCN-to-entity-graph link is deferred, so HAC standing renders on no individual hospital profile. Every figure here is a count, share, or percentile at the program, measure, or state level. No hospital is named, ranked, or scored.
Methodology
All figures are direct aggregations over the hac_reduction_program table, populated from CMS's Hospital-Acquired Condition Reduction Program public-use file, published through the CMS provider data catalog as part of Hospital Care Compare. The table holds 3,055 hospitals for fiscal year 2026 across 51 states and territories; source_release_date 2026-06-03; public, read-only; license US-Government-Works. Methodology version: cms-hac-reduction-program/v1.
A hospital is counted as penalized when its payment_reduction flag is "Yes," which by construction is the set CMS places in_worst_quartile by total HAC score (719 hospitals; the two fields agree exactly). The above-baseline share for each infection is the count of reporting hospitals with a standardized infection ratio greater than 1.0 divided by the count of hospitals reporting that measure — measures are reported by different subsets of hospitals, so each share has its own denominator (shown in the table). Median SIRs and the PSI-90 composite use percentile_cont(0.5) over non-null values. State rates are restricted to states with at least 25 hospitals so a single facility cannot swing the rate. Because these are counts and percentiles over a published file, every figure is exact as of the snapshot rather than estimated. The source-provenance contract is documented in the provenance methodology.
Limitations
- A relative ranking, not an absolute safety bar. The penalty cuts the worst-performing quartile by total HAC score. Because hospitals are scored against one another, most penalized hospitals still beat the national infection baseline on the underlying measures. Penalty status is not a verdict on whether a hospital is safe, and this study draws no inference about any hospital.
- Aggregate and program-level only. Every figure is a count, share, or percentile at the program, measure, or state level. No individual hospital is named, ranked, or scored, and the CCN-to-entity-graph link is deferred, so HAC standing renders on no hospital profile.
- A single program year, not a trend. Figures reflect the FY2026 file dated 2026-06-03. The program runs annually with shifting measure sets and baselines; this study does not model change across years.
- Maryland and other exemptions distort geography. Maryland's all-payer waiver removes its hospitals from the penalty entirely, and other facilities are excluded for low case volume. State penalty rates reflect these structural exemptions, not quality alone.
- Measure denominators differ. Small hospitals are exempt from infection measures with too few eligible cases, so each SIR is reported by a different subset of hospitals. The per-measure above-baseline shares are not directly comparable as counts; they are shares of each measure's own reporting set.
- Detection can raise reported infection rates. Hospitals that surveil and report more thoroughly can post higher SIRs than those that capture fewer events. The measures describe reported infections, which is not identical to true incidence.
Sources
- CMS — Hospital-Acquired Condition Reduction Program — the program rules and methodology behind every figure in this study.
- CMS — Provider Data Catalog (Hospital) — the public Hospital Care Compare files that publish the HAC scores and infection ratios.
- CDC — National Healthcare Safety Network (NHSN) — the surveillance system that produces the standardized infection ratios CMS scores.
The companion dataset page for CMS Hospital Care Compare lists the full schema and refresh cadence. This is the patient-safety mirror of the price-transparency enforcement funnel and sits alongside the balance-sheet view of the same hospitals in how ownership shapes hospital margins, the hospitals running lowest on cash, and the financial distress concentrated in rural America; for the cost side of inpatient care see the Medicare inpatient DRG cost reference, and for the equivalent harm-and-correction record in long-term care, how long nursing homes take to fix cited deficiencies.
Frequently asked questions
- What is the Hospital-Acquired Condition Reduction Program?
- It is a Medicare pay-for-performance program created by the Affordable Care Act (§3008). Each fiscal year CMS scores acute-care hospitals on a set of patient-safety and healthcare-associated-infection measures, ranks them by a single total HAC score, and cuts 1% from every Medicare fee-for-service payment to the worst-performing quartile. The penalty applies to the whole fiscal year.
- How many hospitals are penalized, and is that number fixed?
- In FY2026, 719 of the 3,055 hospitals in the program — 23.5% — receive the 1% payment reduction. The share is roughly constant year to year because the penalty is defined as the worst-performing quartile by total HAC score, not as a fixed quality threshold. About one in four hospitals is cut every year by the program's own design.
- Which hospital-acquired infection is the hardest to control?
- Surgical-site infections. Among hospitals reporting it, 35.6% sit above the national baseline — a standardized infection ratio greater than 1.0 — the highest of the five tracked infections. C. difficile is the most controlled, with only 4.0% of hospitals above baseline. The single composite HAC score masks this wide variation across harm types.
- Why are no Maryland hospitals penalized?
- Maryland operates under a CMS all-payer global-budget waiver that exempts its hospitals from many Medicare pay-for-performance programs, including the HAC Reduction Program. Maryland hospitals still appear in the published file and report their measures, but 0 of the 43 carry a payment reduction. The exemption is a structural policy artifact, not a quality signal.
- Does a HAC penalty mean a hospital is unsafe?
- No. The penalty is a relative ranking, not an absolute safety verdict. Because hospitals are scored against one another, most penalized hospitals still beat the national infection baseline on the underlying measures — the median PSI-90 composite is 0.96 and the median central-line-infection ratio is 0.56. A hospital can improve its own rates and still be cut if its peers improve faster. This study draws no inference about any hospital's care.
- Can I reproduce these figures?
- Yes. Every number is a direct count or percentile over the public hac_reduction_program table — CMS's Hospital-Acquired Condition Reduction Program file, snapshot dated 2026-06-03 — with no modeling. The exact SQL for the penalty count, the per-infection baseline shares, the median ratios, and the state breakdown is published in the reproducibility block below.
Who uses this data
The source data behind this study is public
Compliance teams, journalists, and researchers work from the same federal source families cited above — queried by NPI or facility identifier through Fonteum’s open dataset pages and API. Every figure traces to a frozen, downloadable snapshot you can reproduce yourself.
Datasets used
Reproducibility
Every claim, reproducible
The SQL
-- Which hospitals lose Medicare pay for hospital-acquired conditions, and how
-- the single composite penalty hides very different infection problems.
-- Fully reproducible query.
--
-- Question: Medicare's Hospital-Acquired Condition (HAC) Reduction Program
-- (ACA Sec. 3008) cuts 1% of every Medicare fee-for-service payment from the
-- worst-performing quartile of acute-care hospitals, ranked by a single total
-- HAC score. For FY2026: how many hospitals are cut, which hospital-acquired
-- infections are least controlled, and where do penalties land? The lead
-- figure: 719 of 3,055 hospitals (23.5%) take the 1% reduction. A HAC penalty
-- is a RELATIVE ranking against the field, NOT an absolute safety verdict or a
-- statement about any hospital's care.
--
-- Source:
-- public.hac_reduction_program — CMS "Hospital-Acquired Condition Reduction
-- Program" public-use file, published via the CMS provider data catalog as
-- part of Hospital Care Compare. 3,055 hospitals, fiscal year 2026;
-- source_release_date 2026-06-03. Public, read-only.
-- License: US-Government-Works (17 U.S.C. Sec. 105).
-- methodology_version = 'cms-hac-reduction-program/v1'.
--
-- Universe: this study reads the FY2026 program file AS A WHOLE — every row is
-- one acute-care hospital scored for the fiscal year. The file is the current
-- program year, not a longitudinal history, so figures are counts/percentiles
-- within one cycle and are not modeled as a trend.
--
-- Measure note: the total HAC score folds in the PSI-90 patient-safety
-- composite plus five standardized infection ratios (SIRs) from CDC NHSN —
-- CLABSI, CAUTI, SSI, CDI, MRSA. An SIR > 1.0 means more infections than the
-- national baseline predicts; < 1.0 means fewer. Each infection is reported
-- by a different subset of hospitals (small hospitals are exempt below a case
-- threshold), so each measure carries its own denominator below. The CMS
-- facility id is a CCN; the CCN-to-entity-graph link is deferred and no
-- individual hospital is named in the study.
-- ============================================================================
-- (1) Universe reconciliation — the FY2026 program file at a glance.
-- ============================================================================
SELECT
count(*) AS hospitals,
count(DISTINCT facility_id) AS distinct_facilities,
count(DISTINCT state) AS states,
count(*) FILTER (WHERE total_hac_score IS NULL) AS no_total_score,
min(fiscal_year) AS fy,
max(source_release_date) AS snapshot
FROM public.hac_reduction_program;
-- hospitals 3,055 · distinct_facilities 3,055 · states 51 · no_total_score 126
-- fy 2026 · snapshot 2026-06-03
-- ============================================================================
-- (2) HEADLINE: how many hospitals are penalized. The 1% cut falls on the
-- worst-performing quartile by total HAC score, so payment_reduction = 'Yes'
-- is exactly the in_worst_quartile set (the two fields agree). ~1 in 4
-- hospitals is cut every year by the program's own design.
-- ============================================================================
SELECT
payment_reduction,
count(*) AS hospitals,
round(100.0 * count(*) / sum(count(*)) OVER (), 1) AS pct_of_all,
count(*) FILTER (WHERE in_worst_quartile) AS also_worst_quartile
FROM public.hac_reduction_program
GROUP BY payment_reduction
ORDER BY hospitals DESC;
-- No 2,293 75.1% (worst_quartile 0)
-- Yes 719 23.5% (worst_quartile 719) <- the 1% penalty cohort
-- NULL 43 1.4% (worst_quartile 0)
-- ============================================================================
-- (3) The composite hides the infections. For each of the five tracked
-- hospital-acquired infections: how many reporting hospitals sit ABOVE the
-- national baseline (SIR > 1.0), and the median SIR. Surgical-site
-- infections are the laggard (35.6% above baseline); C. difficile the best
-- controlled (4.0%). Every median is below 1.0 — the typical hospital beats
-- the baseline on every measure, yet a fixed quartile is still penalized.
-- ============================================================================
SELECT 'SSI' AS measure, count(ssi_sir) AS reporting,
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY ssi_sir)::numeric, 3) AS median_sir,
count(*) FILTER (WHERE ssi_sir > 1) AS above_baseline,
round(100.0 * count(*) FILTER (WHERE ssi_sir > 1) / count(ssi_sir), 1) AS pct_above
FROM public.hac_reduction_program
UNION ALL
SELECT 'MRSA', count(mrsa_sir),
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY mrsa_sir)::numeric, 3),
count(*) FILTER (WHERE mrsa_sir > 1),
round(100.0 * count(*) FILTER (WHERE mrsa_sir > 1) / count(mrsa_sir), 1)
FROM public.hac_reduction_program
UNION ALL
SELECT 'CLABSI',count(clabsi_sir),
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY clabsi_sir)::numeric, 3),
count(*) FILTER (WHERE clabsi_sir > 1),
round(100.0 * count(*) FILTER (WHERE clabsi_sir > 1) / count(clabsi_sir), 1)
FROM public.hac_reduction_program
UNION ALL
SELECT 'CAUTI', count(cauti_sir),
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY cauti_sir)::numeric, 3),
count(*) FILTER (WHERE cauti_sir > 1),
round(100.0 * count(*) FILTER (WHERE cauti_sir > 1) / count(cauti_sir), 1)
FROM public.hac_reduction_program
UNION ALL
SELECT 'CDI', count(cdi_sir),
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY cdi_sir)::numeric, 3),
count(*) FILTER (WHERE cdi_sir > 1),
round(100.0 * count(*) FILTER (WHERE cdi_sir > 1) / count(cdi_sir), 1)
FROM public.hac_reduction_program
ORDER BY pct_above DESC;
-- SSI reporting 2,270 · median 0.795 · above 809 · 35.6% <- worst measure
-- MRSA reporting 2,068 · median 0.641 · above 476 · 23.0%
-- CLABSI reporting 2,182 · median 0.559 · above 389 · 17.8%
-- CAUTI reporting 2,355 · median 0.489 · above 332 · 14.1%
-- CDI reporting 2,767 · median 0.346 · above 111 · 4.0% <- best controlled
-- ============================================================================
-- (4) The penalty is RELATIVE, not absolute. The median PSI-90 patient-safety
-- composite is at/just under the value the measure treats as expected, yet
-- 23.5% of hospitals are penalized — because the cut targets a fixed
-- worst-performing quartile, not a quality threshold. A hospital can beat
-- the baseline and still be cut if peers improve faster.
-- ============================================================================
SELECT
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY psi_90_composite_value)::numeric, 3) AS median_psi90,
count(psi_90_composite_value) AS psi90_reporting,
round(percentile_cont(0.5) WITHIN GROUP (ORDER BY clabsi_sir)::numeric, 3) AS median_clabsi_sir
FROM public.hac_reduction_program;
-- median_psi90 0.962 · psi90_reporting 2,809 · median_clabsi_sir 0.559
-- ============================================================================
-- (5) WHERE penalties land — penalty rate by state, restricted to states with
-- >= 25 hospitals so a single facility cannot swing the rate. Maryland sits
-- at 0% (its all-payer global-budget waiver exempts its hospitals from the
-- program); Iowa and West Virginia penalize close to half their hospitals.
-- ============================================================================
SELECT
state,
count(*) AS hospitals,
count(*) FILTER (WHERE payment_reduction ILIKE 'Y%') AS penalized,
round(100.0 * count(*) FILTER (WHERE payment_reduction ILIKE 'Y%')
/ count(*), 1) AS penalty_rate
FROM public.hac_reduction_program
GROUP BY state
HAVING count(*) >= 25
ORDER BY penalty_rate DESC;
-- high: IA 53.3% (16/30) · WV 48.0% (12/25) · NM 42.3% (11/26) · OR 40.6% (13/32)
-- AL 37.7% (29/77) · MA 36.4% (20/55) · NY 34.9% (45/129)
-- large states: CA 27.4% (76/277) · PA 27.1% (36/133) · TX 11.3% (32/284) · FL 10.7% (18/169)
-- low: CT 11.1% (3/27) · NJ 8.2% (5/61) · VA 7.0% (5/71) · UT 3.1% (1/32) · MD 0.0% (0/43)
-- ============================================================================
-- (6) The Maryland exemption, made explicit. Its hospitals report measures but
-- carry no payment reduction — a structural policy artifact of the state's
-- all-payer waiver, NOT a quality result.
-- ============================================================================
SELECT
count(*) AS md_hospitals,
count(*) FILTER (WHERE payment_reduction ILIKE 'Y%') AS md_penalized,
count(*) FILTER (WHERE total_hac_score IS NOT NULL) AS md_with_score
FROM public.hac_reduction_program
WHERE state = 'MD';
-- md_hospitals 43 · md_penalized 0 · md_with_score (hospitals still reporting)The snapshot
| dataset_id | cms-hac-reduction-program |
| snapshot_date | 2026-06-03 |
| slsa_provenance_url | pending - publishes with the SLSA provenance generator (not yet live) |
The JOINs
universe: the FY2026 program file as a whole -- 3,055 hospitals, source_release_date 2026-06-03, 51 states/territories penalized = payment_reduction ILIKE 'Y%' (= in_worst_quartile) -- 719 of 3,055 (23.5%); 2,293 not penalized; 43 with no value above-baseline by measure = count(*) FILTER (WHERE <measure>_sir > 1) / count(<measure>_sir) -- SSI 809/2,270 35.6% ... CDI 111/2,767 4.0% median SIRs = percentile_cont(0.5) -- SSI 0.795, MRSA 0.641, CLABSI 0.559, CAUTI 0.489, CDI 0.346; PSI-90 0.962 penalty rate by state = pen / hospitals, GROUP BY state HAVING count(*) >= 25 -- IA 53.3% (16/30) high; MD 0.0% (0/43) low large states: NY 34.9% (45/129), CA 27.4% (76/277), PA 27.1%, TX 11.3%, FL 10.7% -- penalty rate is not a function of hospital count
The pipeline version
| git_sha | 8c06d24b |
| slsa_provenance | pending - publishes with the SLSA provenance generator (not yet live) |
| methodology_version | cms-hac-reduction-program/v1 |
Reproduce this
Run the exact query against the frozen 2026-06-03.
Cite this study
Citation-ready for researchers and AI.
Check the chain
The cited snapshot identifies the federal file. Where an attestation is present, its file hash can be re-derived; figures are not individually signed.
cms-hac-reduction-program · 2026-06-03Not suppliedInspect supplied artifact- FINANCIAL DISTRESS · JUN 2026The price-transparency enforcement funnel: 11,440 actions, 28 finesSince January 2021, CMS has taken 11,440 hospital price-transparency enforcement actions against 4,975 hospitals. Almost none end in a fine: just 28 reached a civil monetary penalty, the only action that carries one. The rest are warnings, corrective-action requests, and — overwhelmingly — hospitals that fixed the problem and closed the case.
- FINANCIAL DISTRESS · JUN 2026For Profit vs Nonprofit Hospitals: Who Owns Them, Who ProfitsAcross 6,019 US hospitals in the federal HCRIS cost reports, for-profit facilities are the only ownership class earning a positive average operating margin — +0.19% — while nonprofit hospitals average −4.75% and government hospitals −62.38%. The ranking holds on every measure, but the gap is narrower than the averages suggest.
- FINANCIAL DISTRESS · JUN 2026Hospitals at Risk of Closing? The Days-Cash-on-Hand SignalFederal HCRIS cost reports let us compute days cash on hand for 5,459 hospitals, but facility-level figures are distorted by system-level cash pooling — so the raw '2,800 hospitals under 30 days' headline is mostly noise. The defensible signal is narrower: 690 hospitals that report thin cash and also run an operating loss.
- FINANCIAL DISTRESS · JUN 2026Rural hospital closures, by the numbers: which hospitals are most at riskRural Critical Access Hospitals — the small facilities at the center of the closure crisis — run a 50.4% financial-distress rate, against 39.2% for urban hospitals, across 6,019 Medicare hospitals in the federal HCRIS cost reports. Their average operating margin is −8.93%, and 682 are losing money on patient care.
- FINANCIAL DISTRESS · JUN 2026DRG Code List with Medicare Payments and Volumes (2026)Across all 540 MS-DRGs in the 2024 Medicare inpatient file, hospitals were paid an average of $15,166 per stay against $92,408 in billed charges — a 6.1× gap. Sepsis (DRG 871) was the highest-volume code at 577,119 discharges; CAR T-cell therapy (DRG 018) the costliest at $434,771 per stay.
Federal source citations
Fonteum LLC · June 17, 2026 · All figures trace to the frozen federal-data snapshot cited above.