How Outbreak Surveillance Works: From Signal to Alert

Outbreak surveillance works as a chain. Someone notices a possible signal, such as an odd cluster of illness, a lab result or a news report. Health authorities then verify it, assess how risky it is and tell the people who need to act. Every alert you see from WHO, CDC or ECDC has been through those four steps, and each one takes time.

That chain has many entry points. A family doctor in England files a notification, a hospital in Ohio sends emergency department data overnight, a treatment plant samples sewage, a journalist in Siberia reports a strange death.

None of these are an alert yet. They become one only after someone with authority checks the facts.

This guide follows a signal from first report to public alert. It covers the main types of surveillance, the legal duty countries have to report, who publishes what and how often, and why official numbers always trail reality. It ends with an honest account of how PandemicAlarm fits into the chain and where it doesn't.

Key Takeaways

• Surveillance moves through four steps: detection, verification, risk assessment and communication. Verification is usually the slowest, because it depends on a government answering questions.
• There are two broad families. Indicator-based surveillance counts structured reports like notifications and lab results. Event-based surveillance scans unstructured information like news and rumors, then checks it.
• Under the International Health Regulations, countries must assess a possible emergency within 48 hours and notify WHO within 24 hours of that assessment. The 2024 amendments, which added a "pandemic emergency" level, entered into force on 19 September 2025.
• WHO, ECDC, CDC and CIDRAP publish on different rhythms, from same-day news to weekly bulletins. Knowing the rhythm tells you how fresh a number is.
• Official counts always run behind events and below the true total. Testing gaps, reporting delays and politics all play a part.
• PandemicAlarm reads public reports from WHO, CDC, ECDC and CIDRAP and turns them into map events. It is downstream of official surveillance, so it inherits the same delays.

How does outbreak surveillance work, step by step?

Outbreak surveillance follows four steps: detection picks up a possible signal, verification confirms whether it is real, risk assessment judges how serious it is and how likely to spread, and communication tells clinicians, governments and the public what to do. Skipping verification produces false alarms. Slow verification produces late warnings.

1. Detection. A signal arrives. It might be a notification from a doctor, a rise in emergency visits for fever and rash, a positive lab test for an unusual pathogen, or a news story about a cluster of deaths.
2. Verification. Someone with authority asks the obvious questions. Is the report true? Have samples been tested? How many people are affected, and where? For international events, WHO asks the country's National IHR Focal Point, a government office that is supposed to answer around the clock.
3. Risk assessment. Analysts weigh how severe the disease is, how it spreads, whether it might cross borders and whether vaccines or treatments exist. They also state how confident they are.
4. Communication. The result goes out as a bulletin, a clinician alert, a travel notice or a public statement.

A real case from this month shows the chain at work. According to WHO's Disease Outbreak News of 10 October 2026, WHO learned through media reports on 2 October that a worker at the Irkutsk Antiplague Research Institute in Russia had died of severe pneumonia, with pneumonic plague suspected. WHO asked Russian authorities to verify the reports on 3, 5, 6 and 7 October. Russia's focal point first replied on 6 October.

Tests on the worker and contacts found no high-threat pathogen. WHO's published assessment said it had found no evidence of ongoing transmission, but it was candid that "confidence in the assessment remains limited" because no diagnosis was ever confirmed. WHO picked up the signal on the day of the death. Verification took most of a week. Getting answers, not finding the signal, was the slow part.

What is the difference between indicator-based and event-based surveillance?

Indicator-based surveillance collects structured data through formal channels: notifiable disease reports, lab results and sentinel clinics, all counted against agreed case definitions. Event-based surveillance gathers unstructured information, such as news stories, social media posts and community rumors, about events that could be an acute threat. You need both, because each catches what the other misses.

Indicator-based systems are good at trends. Because every report uses the same definitions, you can compare this week's measles count with last year's. Their weakness is speed and scope. They only count diseases someone decided in advance to count, and the paperwork takes time.

Event-based surveillance fills that gap. WHO defines it as "the organized collection, monitoring, assessment, and interpretation of mostly unstructured information," as quoted in a 2018 CDC Emerging Infectious Diseases study of event-based surveillance in Vietnam. The catch is noise. In that Vietnam pilot, 2,520 signals reached district health staff and only 176, about 7%, were verified as real events. Most signals are false or trivial, which is why verification is a step of its own.

WHO now runs event-based surveillance at scale through its Epidemic Intelligence from Open Sources (EIOS) initiative, which scans public media for health threats. WHO says that by the end of 2025, 120 countries and 30 organizations and networks were using the EIOS system.

Volunteer networks were early pioneers of this approach. Our history of how ProMED Mail spotted outbreaks before WHO covers that era (ProMED moved behind a paywall in 2025 and is no longer a PandemicAlarm source). The same noise problem applies to you as a reader, which is why learning to verify outbreak claims matters as much as finding them.

What is syndromic surveillance?

Syndromic surveillance tracks symptoms rather than confirmed diagnoses. Health departments watch data such as emergency department chief complaints ("fever and cough," "vomiting") for unusual rises, before any lab test comes back. It trades accuracy for speed, so it can flag a problem days before confirmed cases are counted.

In the US, CDC's National Syndromic Surveillance Program collects de-identified visit records from emergency departments, urgent care and other settings. CDC says 85% of US emergency departments send data to the program, and that data are available for analysis within 24 hours of a patient's visit (page updated 1 September 2026).

The limitation is obvious once you think about it. A spike in "fever and rash" visits might be measles, or it might be a heat wave and a viral rash going round a school. Syndromic data tell you where to look. Lab confirmation tells you what you found.

How do labs and genomic sequencing fit in?

Laboratories turn suspicion into fact. A clinical lab confirms which pathogen a patient has, and in many countries labs must report certain organisms directly to public health authorities. Genomic sequencing goes further: it reads the pathogen's genetic code, showing which strain is circulating, how cases are related and whether the virus is changing.

Lab reporting runs in parallel with doctors' reports. In England, for example, diagnostic laboratories have their own legal duty to report specific organisms to the UK Health Security Agency (UKHSA), separate from the duty on doctors. UKHSA publishes those lab notifications weekly and warns that they are not counts of cases.

Sequencing has changed what surveillance can see. Comparing genomes lets investigators link cases that look unconnected, or prove that two clusters with the same disease came from different sources. Our explainer on genomic surveillance with GISAID and Nextstrain covers the platforms that share these sequences. The names you hear for new variants come out of the same work, and how WHO, Pango and Nextstrain name variants explains why one virus can carry three labels.

What can wastewater tell you about an outbreak?

Wastewater surveillance tests sewage for traces of pathogens shed by everyone connected to a treatment plant. It doesn't depend on anyone feeling ill, visiting a doctor or getting tested, so it can show a rise in infections across a whole community even when testing has fallen away. It cannot tell you who is infected.

CDC's National Wastewater Surveillance System currently reports on COVID-19, influenza A, RSV, measles, avian influenza A(H5) and mpox. CDC updates the data every Friday and describes them as preliminary (page updated 23 October 2026).

Wastewater is best at trends and early hints. A rising signal for influenza A in a city's sewage is a reason to expect more flu patients, not a case count. Our guide to wastewater surveillance as an early warning covers what the signals mean and where they mislead.

What are notifiable diseases, and who has to report them?

A notifiable disease is one that doctors, and often laboratories, are legally required to report to public health authorities. Each country keeps its own list. Notification is the backbone of indicator-based surveillance: it is how authorities learn about individual cases fast enough to trace contacts and spot clusters.

The rules differ in revealing ways. In England, doctors must report suspected cases without waiting for lab confirmation, phoning urgent ones to their local health protection team within 24 hours, according to UKHSA's guidance on notifiable diseases. In the US, reporting is required by state and local law, and states then send case notifications to CDC voluntarily, as CDC's case surveillance page explains. Across the EU, member states report about 50 diseases to ECDC using common case definitions, per the European Commission's surveillance overview.

Our companion post, Notifiable Diseases: What Doctors Must Report and Why, looks at those three systems in detail and what happens after a doctor files a report.

What do the International Health Regulations require countries to report?

The International Health Regulations (2005), or IHR, are a binding treaty under which countries must assess unusual health events and tell WHO about any that might be a public health emergency of international concern. Article 6 sets the clock: assess within 48 hours of the focal point receiving the information, then notify WHO within 24 hours of that assessment.

You can read the full text in WHO's published edition of the IHR (2005), which binds 196 States Parties. The assessment uses a decision tool in Annex 2 that asks whether an event is serious, unusual, likely to spread internationally or likely to disrupt travel and trade. Our explainer on the International Health Regulations walks through that tool.

Those rules changed recently. WHO confirmed that the 2024 amendments entered into force on 19 September 2025. They add a new alert level, the "pandemic emergency," for threats that go beyond a PHEIC, and require each country to set up a National IHR Authority to coordinate its work. Eleven of the 196 States Parties rejected the amendments and remain bound by the earlier version.

According to WHO's Q&A on the amendments, a pandemic emergency must be a PHEIC caused by a communicable disease that has, or risks, wide spread across several countries, overwhelming health systems, causing major social and economic disruption, and needing coordinated international action. The same Q&A states that WHO has "no ability to impose any health measure, including lockdowns." The regulations depend on countries choosing to comply.

A PHEIC itself remains the more familiar tool. WHO declared the Bundibugyo Ebola outbreak in the Democratic Republic of the Congo (DRC) and Uganda a PHEIC on 17 May 2026, as ECDC's week 42 threats report records. Our guide to what a PHEIC is explains what that declaration does and doesn't change. The separate WHO Pandemic Agreement, adopted by the World Health Assembly in May 2025, is a different instrument, and our post WHO Pandemic Agreement: What It Does and Doesn't Do covers it.

Who publishes outbreak reports, and how often?

Four public sources carry most outbreak news in English: WHO's Disease Outbreak News for international events, ECDC's weekly threats report for Europe and the world, CDC's MMWR and Health Alert Network for the US, and CIDRAP's news service for fast coverage. Each has its own cadence and audience, which shapes how fresh its numbers are.

WHO describes Disease Outbreak News as covering confirmed and potential acute events "across all hazards," including those of unknown cause. Each item follows a fixed structure, from "Situation at a glance" to WHO's risk assessment and advice. Our post on how WHO tracks outbreaks goes through that format.

ECDC's Communicable Disease Threats Report is "a weekly bulletin for epidemiologists and health professionals on active public health threats." The 16 October 2026 issue led with Ebola: as of 15 October, the DRC had reported 9,277 confirmed cases including 4,478 deaths, and Kenya had reported a second confirmed case on 14 October. The companion post How ECDC Tracks Disease Threats Across Europe explains how that report is built.

CDC's Morbidity and Mortality Weekly Report is the agency's main scientific publication, and our guide to reading CDC MMWR reports shows how to use it. For urgent news to clinicians, CDC uses the Health Alert Network, whose messages run from Health Alert (highest importance) to Health Advisory and Health Update. CDC sent a HAN Health Advisory on the Bundibugyo outbreak on 19 May 2026, two days after the PHEIC.

CIDRAP, founded in 2001, is part of the University of Minnesota. It isn't a government agency, but its reporters follow state health departments and published studies closely, so it often carries US state-level outbreaks before they reach a federal bulletin.

Why do official outbreak reports lag behind events?

Official reports lag because every link in the chain adds time. A person has to fall ill, seek care and get tested; the lab has to report; the health department has to check the case and link it to others; a government then decides what to share. Verification protects accuracy, but it cannot be instant.

Foodborne outbreaks show the delay clearly. CDC's outbreak notices carry a standard warning, seen on its October 2026 Salmonella outbreak linked to raw oysters: recent illnesses may not yet be reported, because it usually takes 3 to 4 weeks to determine whether a sick person is part of an outbreak. That gap is built in. It comes from incubation, testing, lab typing and interviews, not from anyone being slow.

The same delay distorts charts. The most recent bars on any outbreak chart are almost always too low, because their cases haven't all been reported yet. It looks like a decline. It often isn't. Our post How to Read an Epidemic Curve explains how to spot that trap, which epidemiologists call right-truncation.

International reports add another layer. WHO generally publishes after a country has confirmed the facts. In the Irkutsk example, Russia's first reply came three days and three requests after WHO first asked. When a government is slow or reluctant, the public record waits too.

What are the limits of disease surveillance?

Surveillance only sees what gets tested, reported and shared. Places with few labs and clinics report fewer cases, which can make them look safer than they are. Many people with mild illness never see a doctor. And governments sometimes delay or soften reports for political or economic reasons. Every official count is a floor, not a ceiling.

Testing gaps. A disease that isn't tested for isn't counted. This hits hardest where labs are scarce. It also hides new pathogens, because no one tests for something they don't suspect.

Underreporting. CDC states plainly on its oyster Salmonella notice that the true number of sick people "is also likely much higher than the number reported," since many recover without medical care. Reported cases are the visible tip.

Political delay. The IHR obliges countries to notify WHO, but WHO cannot force them to. Fear of travel bans and lost trade gives governments a reason to wait. The 2024 amendments did not add an enforcement mechanism.

Ambiguity. Some events never resolve. The Irkutsk death ended with no confirmed cause. Reports of an unexplained illness spread quickly, and many turn out to be something already known, a pattern our post Mystery Illness Reports: Why Most Turn Out to Be Known looks at.

Surveillance is only the start. Once a cluster is confirmed, field teams take over, and the work of outbreak investigation in ten steps and contact tracing decides whether it is contained. It also helps to use the right words for scale, which our post Outbreak vs Epidemic vs Pandemic vs Endemic Explained sets out.

How does PandemicAlarm turn these reports into alerts?

PandemicAlarm is not a surveillance system in the official sense. It reads public reports from WHO Disease Outbreak News, CDC's outbreak pages and MMWR, ECDC and CIDRAP, uses an AI model to pull out the key facts, and places each outbreak on a map with a severity level from 1 to 5. Every event links back to its source.

Here is what happens to a report, in order:

1. Collection. About once an hour, the system checks each source for new items (ECDC every two hours). It skips articles it has already stored.
2. Filtering. Items that clearly aren't about a current outbreak, such as vaccine coverage studies or corrections, are dropped before any AI step.
3. Extraction. An AI model reads each remaining report and returns a fixed set of fields: disease, country, the most specific place named, confirmed cases and deaths, status, whether the disease is new to that country, a short summary, the report's own "as of" date, and a severity level. It is told to use only confirmed counts and only what the report states.
4. Checks. The output is validated (a real country code, coordinates inside that country, a level between 1 and 5). Reports whose latest data are more than 120 days old are discarded, so old case studies don't appear as new outbreaks.
5. Matching. A new report about the same disease in the same place is added to an existing event's timeline instead of creating a duplicate.

The severity level comes from a written five-step rubric that runs from 1 (a routine local outbreak of a known disease) to 5 (PHEIC level or pandemic potential). The model applies it to each report. That makes the scale consistent, but it is a quick reading of one report, not a formal risk assessment by an epidemiologist. Our pillar on how disease severity scoring works explains the levels and how to use them.

You should know the limits. Because PandemicAlarm only reads published reports, it can never be faster than its sources and inherits all their delays. Confirmed-only counts will often sit below the suspected totals you see in the news. An AI model can misread a report, which is why every event links to the original. ProMED, once a major early-warning source, is no longer used because it went behind a paywall in 2025.

To get the most from the map, read our guide on how to read the outbreak map, and if you want alerts tailored to your own travel or family, our guide to building your own outbreak monitoring system shows how to combine sources. For anything that affects a decision about your health or travel, check the original report and talk to a doctor, travel clinic or your national health authority.

FAQ

Is disease surveillance the same as contact tracing?

No. Surveillance is the ongoing collection and analysis of health data to detect and track disease across a population. Contact tracing is a response tool used after a case is found: health workers identify people the patient exposed and follow them up. Surveillance tells authorities where to send tracers in the first place.

Can a member of the public report a suspected outbreak?

Yes, though usually not directly to WHO. If you notice several people falling ill after the same meal, event or water source, contact your local or national health department. Many have online forms for suspected food poisoning. If you are unwell yourself, see a doctor, who can test you and notify the authorities.

Why do outbreak case counts change after they are published?

Counts change because reporting continues after the first figure goes out. Late cases arrive, suspected cases are confirmed or ruled out, and duplicates are removed. ECDC notes that DRC's Ebola data are "under continuous review and harmonisation." Treat any recent figure as provisional and look for the date it applies to.

Which outbreak source should I follow?

It depends on where you live and travel. WHO Disease Outbreak News covers international events, ECDC's weekly report covers Europe and global threats, and CDC covers the US. CIDRAP is often fastest for US state-level news. Following one official source for your region plus one news source catches most significant events.