Glossary

This page defines the acronyms and technical terms used throughout the NBS 7 System Administrator guide.

A

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

AGW: See Azure Application Gateway.
AIMS: APHL Informatics Messaging System. A platform managed by the Association of Public Health Laboratories (APHL) for public health data exchange and messaging.
AKS: See Azure Kubernetes Service.
AKV: See Azure Key Vault.
AMG: Amazon Managed Grafana. An AWS-managed version of Grafana, an open-source dashboarding platform.
AMP: Amazon Managed Service for Prometheus. An AWS-managed version of Prometheus, an open-source monitoring and alerting toolkit.
API: Application Programming Interface. A defined interface that allows software systems to communicate.
AVR: Analysis, Visualization, and Reporting. An umbrella term for the reporting and analytics capabilities of NBS and related public health systems.
AWS: Amazon Web Services. A public cloud platform. See also Microsoft Azure.
Amazon EFS: Amazon Elastic File System. AWS-managed file storage. The Azure equivalent to EFS is Azure Files.
Amazon EKS: Amazon Elastic Kubernetes Service. A managed Kubernetes service from AWS. Hosts containerized services in AWS deployments. The Azure equivalent to Amazon EKS is AKS.
Amazon MSK: Amazon Managed Streaming for Apache Kafka. An AWS-managed version of Kafka, an open-source event streaming platform. The Azure equivalent to MSK is HDInsight.
Amazon RDS: Amazon Relational Database Service. An AWS managed database service. The Azure equivalent to Amazon RDS is Azure SQL.
Amazon S3: Amazon Simple Storage Service. AWS object storage. The Azure equivalent to Amazon S3 is Azure Blob Storage.
Amazon VPC: Amazon Virtual Private Cloud. An isolated cloud network in AWS. The Azure equivalent to Amazon VPC is VNet. See also peering and subnet.
ArgoCD: An open-source GitOps tool for deploying and managing Kubernetes applications.
Azure: See Microsoft Azure.
Azure Application Gateway: An Azure web traffic load balancer, also known as AGW. The AWS equivalent to Azure Application Gateway is a Network Load Balancer (NLB).
Azure Blob Storage: An Azure service for object storage. The AWS equivalent to Azure Blob Storage is Amazon S3.
Azure Files: An Azure service for file storage. The AWS equivalent to Azure Files is Amazon EFS.
Azure Key Vault: An Azure service for creating and managing encryption keys, certificates, and application and database secrets. The AWS equivalent to Key Vault is AWS KMS.
Azure Kubernetes Service: An Azure-managed service for Kubernetes, also known as AKS. Hosts containerized services. The AWS equivalent to AKS is Amazon EKS.
Azure Monitor: An Azure service for monitoring infrastructure health and performance. The AWS equivalents are Amazon Managed Service for Prometheus and Amazon Managed Grafana for metrics collection and dashboard visualization.
Azure RBAC: Azure Role-Based Access Control. An Azure service for managing access to cloud resources, often used with Microsoft Entra ID for identity management. The AWS equivalent to Azure RBAC is AWS IAM.
Azure SQL: A family of Azure-managed database services (includes Azure SQL Database or Azure Database for SQL Server). The AWS equivalent to Azure SQL is Amazon RDS.
Azure VNet: Azure Virtual Network. An isolated cloud network in Azure. The AWS equivalent to VNet is Amazon VPC.

B

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

build provenance: Verifiable metadata documenting how a software artifact was created. It supports software supply chain integrity by confirming the artifact came from a known, unmodified source.

C

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

C-CDA: Consolidated Clinical Document Architecture. A broad HL7 standard for structured clinical documents, including discharge summaries and referral notes. The eICR format is a public health-specific implementation of C-CDA.
CDA: Clinical Document Architecture. An HL7 standard for structuring clinical documents for exchange. C-CDA is a US-specific implementation of CDA; eICR is a public health-specific implementation of C-CDA.
CDC: Centers for Disease Control and Prevention. The federal agency that develops and maintains NBS.
CDF: Commonly Defined Fields (also: Collaboratively Defined Fields). Custom fields in NBS that are collaboratively defined across jurisdictions, as distinct from locally defined fields (LDFs). CDFs support import versioning.
CIDR: Classless Inter-Domain Routing. A notation for specifying IP address ranges (for example, 10.0.0.0/16).
CLI: Command-Line Interface. A text-based interface for running commands. System admins might use several CLI tools, such as the AWS CLI, kubectl, and the Terraform CLI.
CRD: Custom Resource Definition. A schema that defines validation rules for a new resource type within Kubernetes. You can use CRDs to extend the Kubernetes API with custom resource types needed by its services.
Classic NBS: Any NBS versions prior to 7.0.0, including all NBS 6.x releases.
case investigation: A case investigation records one instance of a disease or condition for a specific person, including clinical, epidemiological, and administrative data. Investigations might use the generic form or a condition-specific PAM.
case notification: A message sent from a STLT to CDC reporting a confirmed or probable case of a nationally notifiable disease.
change data capture: A technique for tracking row-level changes in a database and streaming them to downstream systems in near real time. Abbreviated as cdc in code.
condition: A disease or health event that is subject to public health reporting. Conditions might be nationally notifiable (reported to CDC) or only jurisdiction-level reportable.
container: A lightweight, portable unit of software that packages an application and its dependencies so it runs consistently across environments.
container image: A read-only template used to create containers.
control plane: The component of a Kubernetes cluster that manages cluster state, including scheduling workloads and maintaining desired configuration.

D

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

DI API: Data Integration API. An NBS 7 service that provides an API for external systems to push data into NBS.
DIBBs: Data Integration Building Blocks. CDC open-source middleware for public health data integration.
DNS: Domain Name System. The system that translates domain names (such as app.example.com) to IP addresses.
Debezium: An open-source change data capture tool.
data ingestion pipeline: The NBS 7 services responsible for receiving, validating, and routing incoming public health data into NBS though the DI API entry point. Accepts data in eICR, PHDC, and C-CDA formats.

E

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

EHR: Electronic Health Record. A digital system used by clinical providers to record and manage patient health information. EHRs automatically generate eICR documents when a reportable condition is diagnosed, enabling automated case reporting to public health agencies.
ELR: Electronic Lab Report. Lab results that are electronically transmitted from laboratories to public health departments.
ETL: Extract, Transform, Load. A batch process that moves and transforms data from one system to another.
ETOR: Electronic Test Orders and Results. A public health data exchange standard for electronically transmitting laboratory test orders and results. Related to ELR but covers the ordering side as well as results.
Elasticsearch: An open-source search and analytics engine.
eCR: Electronic Case Reporting. Automated reporting of disease cases from healthcare electronic health records (EHRs) to public health agencies.
eICR: Electronic Initial Case Report. A structured document generated by an EHR system to send relevant clinical data to public health agencies.

F

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

FHIR: Fast Healthcare Interoperability Resources. A modern HL7 standard for healthcare data exchange using web APIs.

G

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

GitOps: A practice of using Git repositories as the source of truth for infrastructure and application configuration.

H

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

HDInsight: An Azure-managed Kafka service. Used for event streaming in Azure deployments. The AWS equivalent to HDInsight is Amazon MSK.
HIE / HIN: Health Information Exchange / Health Information Network. Organizations or networks that facilitate electronic sharing of health information across providers and public health agencies.
HL7: Health Level Seven. A set of international standards for exchanging clinical and administrative health data.
Helm: A package manager for Kubernetes.
Helm chart: A collection of files that define a Kubernetes application deployment, including configuration templates and default values.

I

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

IAM: AWS Identity and Access Management. The AWS service for controlling access to cloud resources. The Azure equivalents of IAM are Microsoft Entra ID and Azure RBAC.
IRD: Investigate and Respond Division. The CDC division within OPHDST where NBS is housed, within the PHIT branch.
IaC: Infrastructure as Code. The practice of managing infrastructure through code (such as Terraform scripts) rather than manual configuration.
IdP: Identity Provider. A system that manages user authentication and issues identity tokens.
ingress controller: A Kubernetes component that manages external access to services within a cluster, typically through HTTP/HTTPS routing rules.

J

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

jurisdiction: The geographic or programmatic scope of authority for a health department unit.

K

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

KMS: AWS Key Management Service. The AWS service for creating and managing encryption keys. Used to encrypt data at rest. The Azure equivalent to KMS is Azure Key Vault.
Kafka: Apache Kafka. An open-source distributed event streaming platform. Hosted on AWS as Amazon MSK or on Azure as HDInsight.
Keycloak: An open-source identity and access management tool used for managing user authentication, SSO, and token issuance.
Kubernetes: An open-source container orchestration platform that automates deployment, scaling, and management of containerized applications.
kubectl: The command-line tool for interacting with Kubernetes clusters.

L

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

LDF: Locally Defined Fields. Custom fields added by an individual STLT within NBS to capture jurisdiction-specific data. LDFs are distinct from CDFs, which are shared across jurisdictions.
LIMS / LIS: Laboratory Information Management System / Laboratory Information System. Software used by laboratories to manage samples, workflows, and results. LIMS/LIS systems are typically the source of ELR data.
LOINC: Logical Observation Identifiers Names and Codes. A standard code system that identifies what was measured in a lab test.
Linkerd: An open-source service mesh for Kubernetes.
lab report: An observation originating from a laboratory, containing lab orders and results. Lab reports might arrive electronically as an ELR or be entered manually, and often trigger the creation of a case investigation in NBS.
load balancer: A component that distributes incoming network traffic across multiple servers or services.

M

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

MMG: Message Mapping Guide. A CDC-published guide that defines the HL7 message structure for reporting a specific notifiable condition to CDC.
MPI: Master Patient Index. A cross-system index used to match and link patient records across sources.
MPR: Master Patient Record. The authoritative patient record in NBS, derived from all patient revisions (point-in-time demographics).
MSGOUT / MSGOUTE: Messaging Database (Enterprise). The NBS staging database for inbound and outbound messaging.
MasterETL: The Classic NBS batch process that extracts, transforms, and loads data from the NBS operational database (ODSE) into the reporting database (RDB).
Microsoft Azure: A public cloud platform. See also AWS.
Microsoft Entra ID: An Azure identity and access management service, formerly known as Azure Active Directory. The AWS equivalent to Entra ID is AWS IAM.
Microsoft SQL Server: The relational database used by NBS. Also referred to as SQL Server or MSSQL.
MoU: Memorandum of Understanding. A formal agreement between parties. For example, a STLT might be required to establish a MoU with new service providers.
mTLS: Mutual TLS. A method of TLS authentication in which both the client and the server verify each other’s identity using certificates, rather than only the client verifying the server as in standard TLS.
managed node group: A group of worker nodes in AWS that share the same configuration. The Azure equivalent to a managed node group is a node pool in AKS.
microservice: A software architecture pattern in which an application is built as a collection of small, independently deployable services.
morbidity report: An observation originating from a healthcare provider (hospital or clinic), containing basic data about one instance of a disease.

N

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

NBS: National Electronic Disease Surveillance System Base System. A CDC-developed software system for public health surveillance.
NBS 6: See Classic NBS.
NBS 7: The modernized version of NBS, and the subject of this guide.
NBS Central: A web-based portal providing helpdesk ticketing, collaboration forums, documentation, and a wiki for the NBS community. Access to NBS Central requires a login (choose Register at the top of the login screen).
NEDSS: National Electronic Disease Surveillance System. The federal initiative that establishes standards for electronic disease surveillance.
NETSS: National Electronic Telecommunications System for Surveillance. A legacy data exchange format for transmitting surveillance data to CDC.
NIST 800-53: National Institute of Standards and Technology Special Publication 800-53 (Rev. 5). A risk-based framework providing a catalog of security and privacy controls for federal information systems.
NLB: See Network Load Balancer.
NND: National Notifiable Disease. A disease or condition that jurisdictions are required by federal policy to report to CDC.
NNDSS: National Notifiable Diseases Surveillance System. The CDC system that receives case notification data from STLTs.
NSG: Network Security Group. An Azure resource that controls inbound and outbound network traffic for other Azure resources. The AWS equivalent to an NSG is a security group.
Network Load Balancer: An AWS load balancing service that operates at the network layer, often used for high-throughput or low-latency workloads. The Azure equivalent to NLB is Azure Application Gateway.
NiFi: Apache NiFi. An open-source data flow automation tool.
namespace (Kubernetes): A logical partition within a Kubernetes cluster used to isolate resources.
node: See worker node.
node pool: A group of worker nodes in Azure that share the same configuration. The AWS equivalent to a node pool is a managed node group in Amazon EKS.
notifiable disease: A disease or condition that providers and laboratories are legally required to report to public health authorities. CDC maintains the national list. See also reportable disease.

O

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

ODS / ODSE: Operational Data Store (Enterprise). The NBS primary transactional database. Stores real-time case and investigation data. The “E” suffix reflects the current design iteration of the database schema.
OIDC: OpenID Connect. An authentication protocol that allows an application to verify a user’s identity through an IdP.
OPHDST: Office of Public Health Data, Surveillance, and Technology. The CDC office that houses the IRD division, which encompasses NBS.
observation: In NBS, a report received by a health department from an external source (such as a lab or provider). Observations include lab reports and morbidity reports.
on-premises: Infrastructure that is hosted and managed at a physical location controlled by the organization, rather than in a cloud environment.

P

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

PAM: Program Area Module. An NBS extension that adds disease-specific data collection fields and workflows beyond the base system. For example, the STD/HIV PAM adds fields specific to sexually transmitted diseases and HIV.
PHCR: Public Health Case Report. An XML format used to import case data into NBS from legacy or external systems.
PHDC: Public Health Document Container. An XML document format used for structured case data exchange.
PHI: Protected Health Information. Health data protected under HIPAA.
PHIN: Public Health Information Network. A CDC initiative establishing standards and tools for public health information exchange.
PHIN VADS: Public Health Information Network Vocabulary Access and Distribution System. A CDC-hosted repository of standardized vocabulary and code sets used in public health messaging.
PHINMS: Public Health Information Network Messaging System. A legacy CDC messaging system for transmitting surveillance data.
PHIT: Public Health Investigation Tools. The CDC branch within IRD that directly manages NBS.
PII: Personally Identifiable Information. Data that can be used to identify, locate, or contact an individual.
Page Builder: An NBS feature that allows administrators to build configurable forms for collecting and sending notifications for disease and condition data.
peering: A network connection between two Amazon VPCs or VNets that lets resources communicate as if on the same network. In Amazon VPC, this is called VPC peering. In Azure, the equivalent is VNet peering.
permission set: In NBS, a collection of objects and operations a user is authorized to access. A permission set is combined with program area, jurisdiction, and access level to define a user’s role.
pod: The smallest deployable unit in Kubernetes. A pod contains one or more containers that share network and storage resources.
program area: At CDC, a category that groups related diseases or conditions for administrative and security purposes (for example, STD/HIV or Hepatitis). Users are assigned to program areas as part of their role.

R

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

RBAC: Role-Based Access Control. An access management principle that restricts resource access based on a user’s job role rather than individual identity.
RDB: Reporting Database. The NBS database that stores flattened data for reporting and analysis.
RDB_Modern: The modernized reporting database in NBS 7, populated by the RTR pipeline.
RR: See Reportability Response.
RTR: Real-Time Reporting. An NBS 7 reporting pipeline that replaces the batch ETL approach with event-driven data movement using Kafka.
Reportability Response: Reportability Response (RR). A structured message returned to an originating EHR system after an eICR is received and processed.
reportable disease: A disease or condition that providers are required to report to the local or state health department under jurisdiction law. Distinct from notifiable disease, which refers to federal reporting requirements to CDC.

S

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

SAML: Security Assertion Markup Language. A standard for exchanging authentication and authorization data. Used for SSO integrations with Keycloak.
SAS: Statistical Analysis System. Analytics software used with Classic NBS for reporting.
SBOM: Software Bill of Materials. A formal, machine-readable inventory of the software components, dependencies, and libraries used to build an application. SBOMs identify vulnerable or outdated components in a software supply chain.
SLA: Service Level Agreement. A contract that defines service performance expectations. A STLT might be required to establish an SLA with a new service provider (for example, a cloud service provider).
SNOMED CT: Systematized Nomenclature of Medicine - Clinical Terms. A standard code system identifying clinical findings and organisms.
SQL: Structured Query Language. A standard language for managing and querying relational databases.
SRT / SRTE: System Reference Tables (Enterprise). The NBS database that stores standard code sets including LOINC, SNOMED CT, RxNorm, and FIPS codes.
SSO: Single Sign-On. An authentication method that allows users to log in once to access multiple systems.
STLT: State, Territorial, Local, and Tribal. A group term for public health jurisdictions.
service mesh: An infrastructure layer that manages service-to-service communication within a distributed application, providing encryption, observability, and traffic management.
subnet: A subdivision of a VPC’s IP address range. Subnets are used to isolate internet-facing components from internal services.

T

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

TLS: Transport Layer Security. A cryptographic protocol that secures data in transit.
Terraform: An open-source infrastructure-as-code tool for provisioning and managing cloud resources. Used in both AWS and Azure deployments.
Traefik: An open-source ingress controller and reverse proxy.
transfer of ownership: The act of reassigning an observation or case investigation from one jurisdiction or program area to another.

V

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

values file (Helm): A YAML configuration file that supplies environment-specific settings to a Helm chart during deployment.

W

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · X · Y · Z

WDS: Workflow Decision Support. An NBS application feature that automates processing of incoming ELR and eCR data. Configured by system administrators.
WildFly: An open-source Java application server used as a runtime environment.
worker node: A physical or virtual machine in a Kubernetes cluster that runs containerized workloads (pods). In Amazon EKS, worker nodes run as EC2 instances; in AKS, they are provisioned as node pools.