NPRQI Frequently Asked Questions (FAQs)

What is the National Pediatric Readiness Quality Initiative (NPRQI)?

• NPRQI is a national quality improvement platform that helps emergency departments (EDs) measure, reflect, and improve their pediatric emergency care. NPRQI’s data visualization tools allow EDs to assess and benchmark performance while tracking improvements over time.
• Learn more

Is NPRQI a research database or a payor dataset?

• No, NPRQI is neither a research database nor a payor source (not intended for insurance or billing) database. It’s designed for quality improvement, benchmarking, and empowering EDs to improve their Pediatric Readiness.

Does NPRQI provide clinical guidelines?

• NPRQI does not develop its own guidelines, but links to evidence-based resources and best practices relevant to pediatric emergency care.

Was NPRQI reviewed by an Institutional Review Board (IRB)?

• Yes, the University of Texas at Austin IRB has reviewed this initiative in full and determined the project to be exempt from human subject research.

Is NPRQI data protected under a Patient Safety Organization (PSO)?

• Yes. Data entered into NPRQI is protected under a PSO, which ensures confidentiality and federal protections for quality improvement work. Learn more about PSO protections.
• (Create a child page with this information)

Who can participate in NPRQI?

• NPRQI was specifically designed for rural, low-pediatric-volume, and low-resourced EDs. However, all EDs, regardless of pediatric patient volume or location, are welcome to participate. Individual clinicians cannot enroll directly, but may participate through their hospital.

How do I register my site for NPRQI?

• Follow the steps on the NPRQI Enrollment page and review the registration checklist.

How do I access and use the NPRQI platform?

• Before receiving access, all registered EDs must have an executed participant organization agreement (POA). All fully registered NPRQI users will receive an email inviting them to establish secure login credentials along with a link to access the platform.

Who needs to sign the Participant Organization Agreement (POA)?

• An authorized hospital official, such as a CEO, CNO, ED Director, or equivalent, must sign. The authorized signatory will vary for each ED.

Can I access the platform before the POA is signed?

• No, access is granted only after the POA is executed.

Can the POA be modified?

• No, the POA must be signed as provided to maintain uniform protections.

Is the POA considered a Master Services Agreement (MSA)?

• No, the POA is a participation agreement specific to NPRQI.

What is the data entry process?

• Data is entered manually by each user. The following steps will help you get started:
  • Obtain a list of all pediatric patients from the past year (January-December), organized by date and time
  • Determine a data sampling strategy (recommend systematic)
  • Develop a Subject ID Log to internally track all patient encounters entered into the platform
  • Begin entering initial baseline data (30 charts)
  • To optimize the benefits of the NPRQI platform, we recommend patient encounters be entered at regular intervals, depending on each ED's bandwidth/resources and patient volume.

Do multi-site health systems need a separate POA for each location?

• Yes, each physical location must have its own POA, even within the same health system.

Can health systems access site data?

• Yes, EDs must first establish appropriate permissions for system-level access. Each health system is also required to register for NPRQI and submit a POA before accessing its health system’s performance.

What is the cost to participate?

• Participation is free for eligible EDs.

What is the time commitment?

• The time EDs spend using NPRQI varies based on their available resources. On average, most EDs dedicate 2-6 hours per month to enter data and track performance.

What are the benefits for EDs?

• NPRQI improves pediatric outcomes by providing performance benchmarking, PSO protections, and access to QI resources. It also minimizes risk and liability, supports compliance and recognition, and offers data-driven insights that align with regulatory standards. Physicians can also earn MOC Part IV credit.
• Learn More

Can I participate in the 2026 EMSC NPRQI Collaborative?

• Yes, any ED fully registered for NPRQI can join the collaborative when registration opens.
• Learn more

Who operates NPRQI?

• Dell Medical School, operating on behalf of The University of Texas at Austin, acts as the vendor and system operator for the National Pediatric Readiness Quality Initiative (NPRQI) platform.
• Dell Medical School is responsible for the design, development, operation, and security of the application and for compliance with applicable contractual cybersecurity obligations.

What security standards does NPRQI follow?

• NPRQI is developed using secure coding practices aligned with OWASP Top 10 principles and modern healthcare security expectations.
• The platform leverages the Django framework (v4.2.x), which provides security controls functionally equivalent to OWASP ESAPI.

Does NPRQI use OWASP ESAPI?

• NPRQI does not directly implement the OWASP ESAPI library.
• It relies on Django’s native security controls, which provide equivalent protections for input validation, output encoding, authentication, authorization, session management, and CSRF protection.

How is user authentication handled?

• Authentication is handled using Django’s secure authentication framework, including strong password requirements, industry-standard password hashing (PBKDF2 with SHA-256), secure session handling, and protections against session fixation and hijacking.
• Passwords are never stored or transmitted in plaintext.

How is access to data controlled?

• Access is governed by role-based access control (RBAC) enforced server-side.
• Access decisions are based on user role, authorized organizational scope, and explicit aggregation and de-identification rules.
• Authorization cannot be bypassed through user interface manipulation.

Can users access patient-level data?

• Patient-level data is accessible only to authorized site-level users for data entry and review purposes.
• Users with regional, state, network, or national viewing roles do not have access to patient-level data.

How is re-identification risk prevented?

• Re-identification risk is mitigated through aggregation thresholds, suppression of results when thresholds are not met, server-side enforcement of scope rules, and prohibition of raw data access for non-site users.

How is data encrypted?

• Data in transit is encrypted using HTTPS with TLS 1.2 or higher.
• Data at rest is encrypted using platform-managed encryption provided by the hosting environment.

Where is the data hosted?

• NPRQI operates within infrastructure governed by the University of Texas at Austin security framework and approved hosting environments.

Is data stored or processed outside the United States?

• Client data may be stored or processed outside the United States only in accordance with contractual requirements, with equivalent protections applied.

Are security-related actions logged?

• Yes. Security-relevant events are logged, including authentication, authorization, privileged administrative actions, and data modification events.

How is data integrity ensured?

• Transactional controls ensure integrity.
• Failed operations are rolled back, records are locked after submission windows, and edits are auditable.

Is NPRQI compliant with HIPAA?

• NPRQI is designed to support HIPAA-aligned safeguards, including access controls, audit logging, encryption, and data minimization.

Are security reviews performed on the code?

• Yes. All code changes undergo mandatory peer review and security-focused testing prior to merging.

How are vulnerabilities identified and addressed?

• Through automated dependency scanning, code review, testing, and operational monitoring, with remediation according to internal processes.

Can users download data from NPRQI?

• Downloads are restricted by role.
• Only aggregated, de-identified reports are downloadable.

Who has administrative access to the platform?

• Administrative access is limited to authorized NPRQI administrators.
• All administrative actions are logged.

How can users report security concerns?

• Security concerns may be reported through established NPRQI support and governance channels.

How does NPRQI protect against ransomware and data loss?

• The platform employs restricted access, encryption, logical separation of services and backups, and recovery procedures to minimize impact and support restoration.

Are penetration tests or security assessments performed?

• NPRQI undergoes periodic security assessments, including code review, vulnerability scanning, and configuration reviews.
• External certifications are not claimed unless explicitly stated.

How is data separated between participating organizations?

• Logical separation is enforced using RBAC, organizational scoping, and server-side authorization checks.

How are security-impacting changes managed?

• Changes affecting security are reviewed and tested prior to deployment.
• Advance notice is provided where contractually required.

What are the 28 Clinical Quality Measures?

• The measures focus on seven common pediatric conditions and readiness domains.
• See all 28 measures.

How were the measures developed?

• The measures were created by a national expert panel based on evidence, feasibility, and alignment with Pediatric Readiness priorities.
• Read the publication.

Are there performance benchmarks?

• Yes, EDs can compare their performance to similar pediatric patient volume EDs as well as the aggregated national performance.

What is the purpose of the National Pediatric Readiness Project (NPRP) assessment?

• The NPRP assessment measures a hospital’s Pediatric Readiness and identifies opportunities for improvement.
• Learn more about NPRP.

Where can I find the Pediatric Readiness toolkit?

• The toolkit is available here.

What is Quality Improvement and why is it important?

• Quality Improvement is a structured, data-driven process to improve care. It is essential for becoming fully pediatric-ready.
• Learn about QI.

What type of information is collected by NPRQI?

• NPRQI collects information on all four phases of care: assessment, diagnostic, intervention, and disposition. You can review the Record Entry Form to see all the questions in the data portal.
• Learn more

How many charts must my ED enter?

• NPRQI does not require any minimum number of charts for participation. However, we recommend entering approximately 30 charts to establish an initial baseline performance.
• For ongoing data collection, NPRQI suggests that you enter as many charts as you think are feasible.
• Many of our participating EDs enter 10 patient encounters per month.

Who has access to my data?

• Registered users with your ED will have access to your ED's data and performance.

What additional support does NPRQI offer participating EDs?

• NPRQI hosts “Office Hours” twice a month. EDs can register for 1:1 technical assistance with: getting started using NPRQI, unlocking insights from the performance dashboard, identifying high-impact areas for focus, and tailored QI coaching and intervention strategies.