Preparing Immunization Reports for Joint Commission and CMS Surveys

Two very different things get called "immunization reporting," and confusing them is how facilities end up scrambling the week before a survey. One is submitting an aggregate rate to a federal system — a single number, once a year, tied to your payment. The other is showing a surveyor standing in your office the individual records behind that number. Those are two different audiences asking for two different things.

If you run occupational health at a hospital, clinic, or long-term care facility, you own pieces of both. This piece separates the requirements and lays out what to keep on hand so a surveyor's request is a five-minute pull rather than a scramble.

What surveyors actually want to see

On-site surveyors don't audit your NHSN dashboard. They ask for source records, and they ask for them by name. Expect to produce:

• Individual immunization records for staff — dates, vaccine, lot where applicable — not just an aggregate percentage.
• Aggregate rates, so they can see you measure and act on the program.
• Declinations and contraindications — the documented reason a given person wasn't vaccinated. A blank is a finding; a signed declination or a documented medical contraindication is not.
• Retention proof — that you keep the right records for the required length of time.

The through-line: your rate is only as defensible as the individual records under it. If you can report 78% but can't produce the file for a specific nurse a surveyor picks off the roster, the number doesn't help you.

HCP flu vaccination reporting to NHSN

This is the mandatory, CMS-tied submission most people mean by "flu reporting." A broad set of CMS-certified facilities must report Healthcare Personnel (HCP) influenza vaccination summary data through CDC's National Healthcare Safety Network (NHSN): acute care hospitals, inpatient rehabilitation facilities, critical access hospitals, long-term acute care hospitals, PPS-exempt cancer hospitals, inpatient psychiatric facilities, and skilled nursing facilities (CDC — NHSN HCP Influenza Vaccination Summary Reporting FAQs).

The reporting period runs October 1 through March 31. For the 2025–2026 season that's October 1, 2025 through March 31, 2026, and you submit a single summary covering the whole period — monthly reporting is not required (CDC — Operational Guidance for SNFs). Data goes in through the NHSN Healthcare Personnel Influenza Vaccination Summary form; the separate Seasonal Survey on Influenza Vaccination Programs is optional (AHCA/NCAL).

The deadline is the part people trip on: the annual cutoff to have your data entered is May 15 (AHCA/NCAL). Build your internal close for early May and treat mid-May as the hard wall, not the target — chasing down "unknown" records in the final week is the classic way to end up with a worse rate than you earned.

Getting the denominator right

Most reporting errors are denominator errors. NHSN splits your HCP into three groups:

1. Employees — anyone on the facility payroll.
2. Licensed independent practitioners — physicians, advanced practice nurses, and physician assistants who are affiliated but not employed.
3. Adult students, trainees, and volunteers aged 18 or older who are affiliated but not employed.

(CDC FAQs)

The numerator then sorts everyone into: vaccinated at your facility, vaccinated elsewhere with documentation, medical contraindication, declined, and unknown (CDC Operational Guidance). "Unknown" is its own bucket — every person you can't account for lands there and drags your rate down, so a stale roster costs you a number you may have actually met.

Why the deadline has teeth

For skilled nursing facilities, missing the required NHSN data submission under the SNF Quality Reporting Program can cost up to a 2% reduction in your Annual Payment Update (CMS — SNF QRP Quick Reference Guide). Acute care hospitals face a separate consequence: Hospital Inpatient Quality Reporting noncompliance is penalized through a reduction to the annual market-basket update rather than the SNF's flat APU figure, so don't assume the 2% number carries over.

Nursing homes have an added layer. Under 42 CFR 483.80(g), long-term care facilities must electronically report COVID-19, influenza, and RSV information — including resident vaccination status — to NHSN in the format and frequency the Secretary specifies, with these ongoing requirements effective January 1, 2025 (eCFR — 42 CFR 483.80).

One thing that reporting obligation does not mean: mandatory COVID vaccination for staff. The CMS healthcare-staff COVID-19 vaccination mandate was rescinded in 2024. What remains is the reporting — especially the LTC obligation above — so don't run a staff program as if the mandate still exists.

Joint Commission immunization requirements

Accreditation looks at immunization differently than CMS. Two standards carry the weight.

IC.02.04.01 requires an accredited organization to run an annual influenza vaccination program: offer the vaccine to licensed independent practitioners and staff, educate them about the vaccine and prevention, provide it at accessible sites and times, and annually evaluate vaccination rates and the reasons people give for declining (Infection Control Today). Two changes are worth pinning down: the old 90% vaccination-rate goal was eliminated effective January 1, 2021 (Barrins & Associates), and the revised Infection Prevention and Control chapter took effect July 1, 2024 (AHE). You're no longer chasing a magic number — you're demonstrating a functioning program that measures itself and acts on why people opt out.

IMM-2, "Influenza Immunization," is the patient-level ORYX measure, and it's a different animal entirely. Its numerator is inpatient discharges who were screened for flu vaccination status and vaccinated before discharge if indicated (release v2026A, posted 08/08/2025) (Joint Commission Manual — IMM-2). Staff vaccination and patient screening are separate obligations with separate data; keep the two workflows apart so a surveyor doesn't catch you reporting one where they expected the other.

The OSHA overlay: Hepatitis B

Flu gets the attention, but Hep B is where retention bites. Under the Bloodborne Pathogens standard, the employee medical record must include the worker's Hepatitis B vaccination status, with the dates of all Hep B vaccinations (OSHA — 29 CFR 1910.1030). Any employee who declines the offered vaccine must sign the declination statement in Appendix A of the standard (OSHA — 29 CFR 1910.1030 App A).

And you keep it a long time: employee medical records must be retained for at least the duration of employment plus 30 years (OSHA — 29 CFR 1910.1030(h)). That's the outlier that quietly outlives every other record in your program — plan storage accordingly, because a purge cycle tuned to your other records will destroy Hep B files decades early.

Keeping records survey-ready year-round

The facilities that sail through surveys keep survey-ready immunization records as a standing process, not a spring project. Four habits do most of the work:

• Track at the individual level. Every rate you report should be reconstructable from named source records, including "received elsewhere" entries backed by documentation.
• Capture the reason, always. Record whether the person was vaccinated, signed a declination, or has a documented contraindication — and never leave the field blank. Blank is the "unknown" bucket, and it's the finding.
• Mind the denominator blind spots. Licensed independent practitioners, volunteers, and adult trainees belong in the NHSN denominator per the three group definitions above, yet they're the people most likely to be missing from a payroll-driven list. Whether contract and agency personnel count depends on the arrangement — check the current-season NHSN protocol rather than assuming.
• Retain by the strictest clock. Hep B records ride the employment-plus-30-years rule; don't set your retention to a shorter cycle that catches them.

Purpose-built occupational-health systems help here. carefoundryESC captures declinations and contraindications alongside each immunization, maps HCP into NHSN-aligned denominator categories, and holds records against the long OSHA retention window. The discipline still matters more than the tool: document the reason every time, and keep the roster complete.

FAQ

How do I report HCP flu vaccination to NHSN? Enter one summary on the NHSN Healthcare Personnel Influenza Vaccination Summary form covering the October 1–March 31 season, split across the three denominator groups (employees; licensed independent practitioners; adult students, trainees, and volunteers), by the May 15 annual deadline (CDC).

Is there still a 90% flu vaccination goal under the Joint Commission? No. The 90% goal was eliminated effective January 1, 2021. IC.02.04.01 now focuses on running the program and evaluating rates and declination reasons (Barrins & Associates).

Is COVID vaccination mandatory for staff? No. The CMS staff COVID-19 vaccination mandate was rescinded in 2024. Reporting obligations remain, notably for long-term care under 42 CFR 483.80(g) (eCFR).

Survey readiness isn't a report you generate — it's the state your records live in the other 51 weeks of the year. Get the individual tracking and the declination documentation right, and both the NHSN submission and the surveyor's request become routine. If your current process can't produce a named staff member's file in under a minute, that's the gap to close first.