Every country on Earth is legally required to report potential health emergencies to the World Health Organization within 24 hours. That obligation comes from the International Health Regulations (IHR), a binding framework under international law that 196 states have agreed to follow. When the system works, it's how you hear about outbreaks before they cross borders. When it fails, people die while governments stay silent.
Understanding the IHR matters because it determines the speed and quality of the outbreak data that PandemicAlarm and every other monitoring system depends on.
What are the International Health Regulations?
The IHR (2005) is a legally binding agreement among 196 WHO member states that establishes rules for detecting, reporting, and responding to public health events that could spread internationally. It entered force in June 2007 and remains the primary international legal framework governing outbreak response.
Under the IHR, countries must maintain minimum public health capacities: laboratories that can identify pathogens, surveillance systems that can detect unusual disease clusters, and response teams that can contain outbreaks. They must also notify WHO of any event that could constitute a "public health emergency of international concern," or PHEIC, within 24 hours of assessment.
Coverage extends beyond infectious diseases. Chemical spills, nuclear incidents, and contaminated food products all fall under the IHR's scope if they could affect multiple countries. But infectious disease outbreaks account for the overwhelming majority of IHR notifications.
How does the 24-hour reporting requirement work?
Each country designates a National IHR Focal Point, a government office staffed 24/7 that serves as the communication link between that country and WHO. When surveillance systems detect an unusual health event, the focal point must assess it using a standardized decision tool (Annex 2 of the IHR) and notify WHO within 24 hours if the event meets notification criteria.
Annex 2 is a flowchart. It asks four questions about any detected event: Is the public health impact serious? Is the event unusual or unexpected? Is there a significant risk of international spread? Is there a significant risk of international travel or trade restrictions? If two or more answers are "yes," the event requires notification.
Certain diseases trigger automatic notification regardless of the flowchart. Smallpox, polio caused by wild-type poliovirus, new subtypes of human influenza, and SARS all require immediate WHO notification because any single confirmed case has international significance.
After notification, WHO may request additional information, offer technical assistance, or, in the most serious cases, convene an Emergency Committee to determine whether the event constitutes a PHEIC. The WHO Director-General makes the final PHEIC declaration based on the committee's advice.
What happens when countries don't report?
The IHR has no enforcement mechanism. WHO cannot sanction, fine, or penalize a country for failing to report an outbreak. Compliance depends entirely on political will and institutional capacity. Both frequently fall short.
China's handling of SARS in 2002-2003 is the defining example. Guangdong province identified an unusual respiratory illness in November 2002. Chinese authorities did not inform WHO until February 2003, a delay of roughly 3 months during which SARS spread to healthcare workers, contacts, and eventually to 29 countries via international air travel. 774 people died. WHO learned about the outbreak not from China's government but from ProMED-mail, the open-source disease reporting network that flagged rumors of an unusual pneumonia in Guangdong.
That failure directly motivated the 2005 IHR revision. The pre-2005 regulations only covered three diseases (cholera, plague, yellow fever) and relied entirely on government self-reporting. The revised IHR expanded coverage to all potential international health threats and authorized WHO to act on information from non-governmental sources when countries remained silent.
But delayed reporting hasn't stopped. Saudi Arabia faced criticism for slow MERS reporting between 2012 and 2014. Several countries delayed COVID-19 notifications in early 2020. Political calculations (fear of trade restrictions, tourism losses, or international embarrassment) consistently compete with public health obligations.
What changed with the 2024 amendments?
WHO member states adopted targeted amendments to the IHR in June 2024. Notable changes include stronger language around equity in medical countermeasure distribution, requirements for countries to share pathogen genomic sequences rapidly, and establishment of a Coordinating Financial Mechanism to help low-income countries build the capacities the IHR requires.
A new "pandemic emergency" category was formally defined as distinct from PHEIC, recognizing that some events require a level of coordination beyond what the existing PHEIC framework was designed for.
What the amendments did not change: enforcement. Compliance remains voluntary. The new financial mechanism may help countries that want to comply but lack resources. It does nothing about countries that choose not to comply for political reasons.
Why are core capacity requirements so important?
Every state party must maintain minimum capacities in surveillance, laboratory diagnostics, and response. A country that can't detect unusual disease clusters can't report them. The 24-hour notification timeline is meaningless if the surveillance system that feeds it doesn't exist.
As of the most recent WHO Joint External Evaluation data, fewer than 50% of countries meet all IHR core capacity benchmarks. Gaps are concentrated in sub-Saharan Africa, South and Southeast Asia, and small island developing states, precisely the regions where zoonotic spillover and climate-driven disease emergence are most active.
Laboratory capacity is the most common bottleneck. Many countries lack BSL-3 facilities for handling dangerous pathogens and depend on sending samples to international reference laboratories in Europe or the US, adding days or weeks to confirmation timelines. Genomic sequencing capacity, which proved essential during COVID-19 for tracking variants, is even more unevenly distributed.
When WHO tracks outbreaks, it's working within these constraints. Official data is only as good as the surveillance systems generating it.
Why should you care about the IHR?
Because the IHR determines how fast outbreak information reaches you. Every data point on the PandemicAlarm map originates in a reporting chain that the IHR is supposed to govern. When that chain works — pathogen detected, assessed, notified to WHO within 24 hours, shared publicly — you get early warning. When it breaks, you get blind spots.
Knowing the IHR's structure helps you interpret what you see on outbreak dashboards. A country with strong IHR compliance that reports zero cases probably has zero cases. A country with documented surveillance gaps that reports zero cases might simply not be detecting them.
PandemicAlarm compensates for IHR gaps by incorporating data from non-governmental sources: ProMED-mail, media surveillance, and academic networks. But the foundation of global outbreak detection remains the IHR notification system. Its strengths are your early warning. Its weaknesses are your blind spots.