4 Outbreak Response

Outbreak

A higher number of cases of a disease above what is normally expected in a specific population and time period.

The number of cases and the time period used to define an outbreak depend on the characteristics of the disease and how it spreads within the population under surveillance. For some diseases, detection of one case could be considered an outbreak because the disease is so rare, severe or contagious that we want to prevent any cases from occurring (e.g., poliomyelitis). Often an outbreak might be indicated a large number of cases occurring over a short time period, but some outbreaks occur slowly over a longer period of time because of the time it takes for transmission to occur or symptoms to develop (e.g., syphilis).


Outbreak steps

The following table shows eight outbreak investigation steps based on the steps outlined in the Pacific Outbreak Manual. Some countries or resources describe outbreak investigations using more or different steps.

In practice, the steps will usually not occur in order. Some steps may happen at the same time or in a different order, and it may be necessary to move back and forth between steps as new information is available. Even though implementing control measures is one of the last steps described, it is often necessary to start some interim control measures at the beginning of the investigation and to update these measures (including withdrawing them if appropriate) as more is understood about what is occurring.

Outbreak investigations require the input of people with different skills and resources. It is best to form an outbreak investigation team as early as possible to ensure that all relevant people who are able to contribute to the investigation are included. This ensures the outbreak can be controlled effectively and quickly. The number and types of people that should be involved in the team will depend on the size and location of the outbreak and what is causing the outbreak.

Table 4: Outbreak investigation steps

Outbreak Step

Overview of step

  1. Confirm the outbreak
The first step of an investigation is to find out if an outbreak is actually occurring. A higher number of cases than usual may not always mean that there is an outbreak, so it is important to consider the information that is available to determine if further investigation is needed.

Questions to consider to verify an outbreak:

  • Is the number of cases more than expected? (e.g., compared with previous weeks’ data? Compared with same period in previous year? Considering seasonal disease fluctuations?) It is important to understand the data that are being compared.
  • Are the initial reports that suggested an outbreak was occurring accurate?
  • Do cases have the same disease or symptoms?
  • Has there been a change in testing and/or reporting of the disease that means there is an improved detection of cases, rather than an increased number of cases? (e.g., increased local awareness leading to increased testing or reporting? Increase in population size? New test introduced? New surveillance site(s) added? Change in case definition?)
  1. Establish a diagnosis (if you can)
  • Getting a laboratory diagnosis to determine which pathogen is causing the outbreak can be useful to help decide what actions can be taken to control the outbreak. However, it is not always necessary to know the pathogen in order to take control measures. Not knowing the pathogen should not stop the investigation from occurring.
  • An outbreak could be identified based only on clinical symptoms of cases, or some cases could be included in the outbreak investigation because they have symptoms consistent with having the disease.
  • Get clinical details from health workers to work out what symptoms are common among those people who are sick and assess what disease they might have.
  • Get specimens from people who are sick with similar symptoms and send to the laboratory for testing. The tests undertaken should be guided by the symptoms people have. Talk to laboratory staff about specimen type, collection, storage, and transport; consider in-country capacity and overseas reference laboratory options.
  1. Make an outbreak case definition

A standard outbreak case definition

  • Allows everyone to include and exclude cases in a comparable way
  • Should be easily understood and be able to be used by everyone involved in the investigation
  • May be based on previous case definitions but should be adapted to suit each specific outbreak

Need to find a balance between being

  • Too broad (too sensitive) – too many false cases will be included
  • Too narrow (too specific) – real cases will be excluded

A case definition should include elements of:

  • Clinical features e.g., fever, diarrhoea, +/- laboratory confirmation
  • Person: e.g., age, sex
  • Place: e.g., village, island, school
  • Time period: e.g., onset date

May have different categories based on level of certainty

  • Confirmed, probable, possible
  • Confirmed case definitions often, but not always, include laboratory results to confirm that the person has the disease that is causing the outbreak
  • Probable case definitions usually apply when there is strong evidence that the person is part of the outbreak (e.g. symptoms, contact with a confirmed case) but laboratory evidence could not be obtained to confirm

May classify cases based on exposure

  • During outbreaks, secondary cases may be defined to distinguish them from primary cases
  • Primary cases are individuals directly exposed to the outbreak source
  • Secondary cases are individuals who contracted the illness through exposure to a primary case rather than the outbreak source itself (e.g. household contacts who became infected)

Case definition may change over time as new information is learned in the outbreak

  • Start with a sensitive case definition (i.e., broad) and refine to be more specific as the outbreak develops
  • Include more laboratory information
  • Refine based on time, place or person criteria
  1. Find cases and find information

Actively find additional cases

  • Use existing surveillance systems, if possible
  • Ask front line staff what they are seeing
  • Implement active surveillance at health facilities (e.g., call health facilities and ask if they have treated anyone who meets the case definition)
  • Conduct site visits if possible
  • Talk to cases, ask about illness amongst close contacts
  • Listen to rumours
  • Issue a public alert encouraging sick people to identify themselves

Collect information

  • Important information to collect:
    • Identifying information: name, date of birth, address, phone number
    • Demographic information: age (or calculate from date of birth), sex, occupation
    • Clinical details: date of onset, symptom details, severity of illness, hospitalisation
    • Risk factor information: exposure to known infectious agents or their source (e.g., food, travel, gatherings, or cases)
  • A questionnaire or a case investigation form is used to ensure the same information is collected from every case.
  • Information may come from interviewing the cases using the questionnaire or from reviewing clinical records.
  • Having complete and consistent data for analysis is important to help identify the source of the illness.

 

  1. Make a linelist
  • A linelist is a table where each ‘row’ contains information about one case (example below)
  • Commonly created in Microsoft Excel, but can be done on paper
  • A linelist is a way to consistently organise the data you have collected from cases and makes it easy to describe and interpret your data
  1. Analyse and interpret data
From your linelist, you can start to analyse the data (e.g., describe person, place, time) and generate ideas about what is causing it (why, how). You can analyse and interpret the data in several ways:

Time

  • Develop an epidemic curve (epicurve)
  • Graph the cases by the date their symptoms started (or closest date to illness onset). The date you find out that people are cases could be very different to when they got sick (e.g., if they delayed seeking health care). Describing cases by symptom onset date helps you to understand when people have been getting sick and when they might have been infected.
  • Consider using the date of their first positive test if you do not know what date their symptoms started (or if they did not have symptoms)

Place

  • Village, workplace, exposure(s) of interest
  • Map cases

Person

  • Describe age and sex of cases (minimum age, maximum age, median age, % male, % female)
  • Describe clinical features (% vomiting, % fever, % hospitalised, % died, etc)

After analysing the data, you now need to interpret it and to generate ideas as to what is happening (hypothesis generation). For each of the following questions, it is important to consider whether the hypothesis make sense/is plausible.

  • What pathogen is causing the outbreak?
  • How is it spreading?
  • Likely source?
  • Who is most at risk?
  • Why are some people particularly at risk?
  • Could the outbreak continue to spread?

You might decide that you need further information to better understand the disease outbreak and decide on the right actions to take to control the spread.

  • Collect additional information from cases
  • Collect clinical specimens from cases and/or environmental samples for laboratory testing
  • Conduct an analytic study (e.g., case-control or cohort study)
  1. Implement control measures
Act early to minimise impact and control the risk to other people in the community; do not wait until the end of the investigation. Control measures are often implemented at the same time as the above steps.

Use general measures initially (e.g., general health messaging, alerting the community that the outbreak is occurring) and adapt these according to new information and how the outbreak evolves.

Measures may include:

  • Control source: chlorination of water, withdrawal of food product, isolate cases, etc
  • Limit transmission: hygiene measures, mosquito nets, etc
  • Reduce susceptibility of potential cases (hosts): vaccination, etc
  1. Communicate findings
It is important that you communicate clearly and regularly throughout the investigation. You should communicate with everyone who is involved in the investigation so that good decisions can be made, people do not duplicate tasks, and things do not get missed.

You should also communicate to the community to keep people informed of what is happening, what the risks are, how to avoid getting sick, and what actions are being taken.

The way that you communicate findings will depend on your target audience.

Communication with the investigation team and health staff

  • Sit-reps (situation reports)
    • Mainly for senior health staff and government departments
    • Frequency depends on situation and how quickly the outbreak is spreading (from none to twice daily)
    • Length – 1 or 2 pages, plus attachments (if required)
    • A sit-rep will include:
      • Date, time, and sit-rep number
      • Current outbreak description: Descriptive epi/laboratory results
      • Control measures that have been taken
      • Actions to be completed
      • Resource needs
  • Outbreak report
    • Mainly for internal health department records
    • Completed at the conclusion of the outbreak
    • An outbreak report will include:
      • All items in a sit-rep
      • Response team and assigned roles
      • Analysis of the outbreak
      • All response activities undertaken
      • An epidemic curve as appropriate
      • Public health recommendations
      • Conclusions and lessons learned

Communication with the public

Timely and targeted public communication can:

  • Help control outbreaks
  • Help people take action to stop themselves getting sick
  • Help the public to trust decisions made by health authorities
  • Prevent fear and misinformation
  • Prevent the outbreak from causing significant social or financial burden

Public risk communication should always:

  • Be honest and factually correct
  • Be easily understood
  • Acknowledge uncertainty and concerns
  • Acknowledge the risks and avoid over-reassurance
  • If in doubt, prepare people for the worst

Common mistakes in public risk communication:

  • Waiting until you have all the naswers
  • Withholding bad news
  • Not telling people what to expect and how to act
  • Not listening to the public and to rumours

At the end of an outbreak

An outbreak may be closed when there is no longer any risk to the public, when enough information has been gathered to understand what occurred and/or no further actions can be taken to control the spread. Decisions to close an outbreak should be based on the evidence gathered, analysis undertaken and advice of experts involved in the investigation. If you know the pathogen that caused the outbreak, it is common to wait until at least two incubation periods for that pathogen have passed without new cases being found before closing an investigation.

Example:

You have been investigating an outbreak of diarrhoea among people living in village X. Your analysis suggests that a sewerage leak in the village caused the infections. The leak has now been fixed and despite actively looking, no further cases have been found for two weeks. After speaking with the investigation team, the investigation team leader decides that the investigation can be closed.

After an investigation has been closed, it is important to reflect on how the investigation went so that improvements can be made for future investigations. A review should be undertaken to identify positive aspects of the investigation that should be done again and the things that can be avoided or improved next time. Outbreak reviews can also help to improve routine surveillance and how it is used to identify outbreaks.

The type of review undertaken will depend on the size, length and seriousness of the outbreak. Reviews can range from a reflection in an outbreak report to a debrief with the investigation team to a full After Action Review where feedback is gathered from all stakeholders through different formats. Whichever method is chosen, it is important to document the conclusions of the review so that they can be incorporated into future work. More information on how to conduct an after action review can be found in WHO’s Guidance for after action review.

Some of the things that may be considered in a review are:

  • Could the outbreak have been identified sooner?
  • Were the right people involved in the investigation team?
  • Was communication clear and timely?
  • Were decisions made based on evidence?
  • Were decisions and actions recorded?
  • Was the right public health action taken and was it implemented at the right time?

Common Source Outbreak

A common-source outbreak is one where people are exposed to an infectious agent from the same source.
There are three types of common source outbreaks:


Point source outbreak

A type of common source outbreak where people are exposed over a relatively short period of time, so that all cases occur within one incubation period for the pathogen that caused the outbreak. This occurs when the infectious agent was only present for a defined period of time, such as at an event attended by the cases.

Example:

Contaminated food source at a dinner party with 100 guests and 65 guests become cases.

An epicurve in a point source outbreak will have a sharp increase in cases followed by a slower decrease over time.

Column graph showing the number of cases against the onset of illness from 1 September 2022, to 7 September 2022. The x-axis is labeled with dates in a dd/mm/yyyy format at one day intervals, and the y-axis is labeled with the number of cases ranging from 0 to 50. There are five bars, each representing a different number of cases, with a significant peak indicating a notable increase in cases on 4 September.
Figure 7: Epidemic curve for a point source outbreak, Province A, 1 to 9 September 2022

Continuous common source outbreak

A type of common source outbreak where people are exposed to the source over time, with cases occurring longer than the time of one incubation period.

Example:

Contaminated water source to a village where access is not stopped, and people continue to drink the contaminated water.

An epicurve in a continuous common source outbreak will have multiple peaks and declines. There are cases as long as people remain exposed to the common source.

Column graph showing the number of cases reported over time, by data of illness onset. The horizontal axis represents dates from 1 January 2022, to 31 October 2022, in 2-day increments. The vertical axis indicates the number of cases, ranging from 0 to 14 in increments of 2. The first case is on 2 January 2022 and the last case is on 28 October 2022. There is a peak around 13 October 2022.
Figure 8: Epidemic curve for a continuous common source outbreak, Province B, 1 January to 31 October 2022

Intermittent common source outbreak

A type of common source outbreak where people are exposed to an infectious agent at irregular time periods; sometimes they are exposed, and sometimes not.

Example:

If a restaurant has five food handlers and one is positive for Hepatitis A, we would expect the number of Hepatitis A cases to have eaten at the restaurant only when the infected food handler was working.

An epicurve in an intermittent common source outbreak will show rapid increases and decreases, reflecting the presence of the source. The length of time between peaks is not related to incubation period, but is instead related to times when the source is present.

Column graph showing the number of cases reported over time, by data of illness onset. The horizontal axis represents dates from 2 October 2026 to 11 November 2026, in 2-day increments. The vertical axis indicates the number of cases, ranging from 0 to 8 in increments of 2. The first case is on 6 October 2026 and the last case is on 11 November 2026. There are peaks, and no cases reported for some dates.
Figure 9: Epidemic curve for an intermittent common source outbreak, Province C, 2 October to 11 November 2026

Propagated outbreak

An outbreak that does not have a common source, but instead spreads from person to person.

Example:

Measles, where each infected person can infect 12- 18 other non-immune people, who can then each infect up to another 12-18 other non-immune people.

An epicurve in a propagated outbreak usually has a number of irregular peaks reflecting the generations of infection, with peaks separated by approximately one incubation period.

Column graph displaying the number of cases over time by onset of illness. The horizontal axis is labeled with dates of onset ranging from 1 March 2022 to 28 May 2022, marked at approximately weekly intervals. The vertical axis is labeled ‘Number of Cases’ and ranges from 0 to 30, increasing by increments of 5. The bars represent the number of cases reported on each date, with several peaks indicating higher numbers. There are significant spikes around mid-April and late April.
Figure 10: Epidemic curve for a propagated outbreak, Province D, 1 March to 28 October 2022

Cluster 

A cluster is group of cases with a similar disease or set of symptoms reported over a specified time and in a defined area that is suspected to be higher than expected. The word ‘cluster’ is often used to describe a situation prior to a formal outbreak being declared.

Example:

Syndromic surveillance may identify a cluster of influenza-like-illness (ILI) cases in a particular village.


Contact

Someone who has been exposed to a source of an infection or pathogen.

Example:

A person who has spent time with a confirmed COVID-19 case is known as a contact. It means that they were exposed to a confirmed case while the case was infectious. They are not currently a case but have the potential to become a case.


Linelist

A linelist is a way of organising data into a table where each ‘row’ contains information about one case.

The variables (e.g., Age, sex, clinical characteristics) about each case are in the columns. It is important there is only one row per person and one column per variable (i.e., do not combine multiple symptoms in one column as this cannot be easily analysed). Linelists are commonly created in Excel, but can also be done on paper. A linelist makes it easy to analyse and interpret your data.

An example of a linelist is below.

Linelist exaxmple
ID First Name Last Name Sex Age (Years) Village Province Date of illness onset Nausea Vomiting Laboratory confirmation
1 Name Name M 36 Village X Province A 4/12/2022 Yes Yes No
2 Name Name M 42 Village X Province A 4/12/2022 Yes Yes Yes
3 Name Name M 63 Village Y Province A 2/12/2022 Yes Yes No
4 Name Name F 38 Village Y Province A 1/12/2022 No Yes Yes
5 Name Name F 25 Village X Province A 5/12/2022 Yes Yes No
6 Name Name M 34 Village Y Province A 7/12/2022 Yes No Yes
7 Name Name F 43 Village Y Province A 2/12/2022 No Yes No
8 Name Name M 52 Village X Province A 3/12/2022 Yes Yes Yes
9 Name Name F 51 Village X Province A 5/12/2022 No No No
10 Name Name M 40 Village Y Province A 4/12/2022 Yes Yes No

Endemic

The constant presence and spread of a disease or infectious agent within a given geographic area or population group in a way that is expected.

Example:

Malaria is endemic in some Pacific Island nations, in parts of Africa, parts of Asia, and parts of South and Central America.


Epidemic

The occurrence of more cases of disease than expected in a given area or among a specific group of people over a particular period of time. The increase is often higher than an outbreak or over a longer time period.

Example:

Whilst dengue fever can be endemic to a country, there may be a dengue fever epidemic when cases increase over a long period of time in a particular area.


Pandemic

An epidemic occurring worldwide, or over a very wide area, crossing international boundaries (multiple continents) and usually affecting a large number of people.

Example:

COVID-19 was declared a pandemic because the SARS-CoV-2 virus was a new virus spreading between large numbers of people on multiple continents.


Green star: This book has been designed for both intermediate and advanced FETP fellows, with more advanced content indicated by a green star image next to the term. Intermediate fellows are not expected to be familiar with the advanced content. Sensitivity and specificity

Sensitivity and specificity are measures of how accurately a person is identified as either having or not having a disease (or health condition under investigation). The principles of sensitivity and specificity apply both to diagnostic tests that identify if a person is infected with a pathogen and more broadly to case definitions that establish the criteria for a person to be considered as having a disease.


Sensitivity

Sensitivity is how likely it is that a person that truly has a condition will be correctly classified as having the condition (true positive). High sensitivity means that as many true cases will be counted as possible and there will be less cases missed. This is important for serious diseases that require an immediate response or in the early stages of an outbreak when you do not yet have much information about what is causing the outbreak and it is important to identify as many cases as possible.

Example:

  • Sensitivity of a laboratory test
    • A blood test with 95% sensitivity means that the test will detect the pathogen in 95% of people who are infected. The other 5% will be incorrectly classified as not being infected.
  • A sensitive case definition is one that is broad to try to include as many cases as possible:
    • Three of more loose stools in a 24-hour period
      AND
      Resident or visitor of Province B
      AND
      Symptom onset on or after January 15, 2022.

Specificity

Specificity is how likely it is that a person who does not have a condition will be correctly classified as not having the condition (true negative). High specificity means that less people will be incorrectly classified as having the condition when they do not have it. This is important for conditions that might cause serious distress or harm to a person if incorrectly diagnosed as having the condition (such as one with stigma, or a fatal disease that cannot be treated).

Outbreak case definitions are usually changed to be more specific during an investigation when more information is available about what is causing the outbreak and who is affected.

Example:

  • Specificity of a laboratory test
    • A PCR test that is 90% specific means that a pathogen will not be detected in 90% of people who are not infected. The test will incorrectly find that the pathogen is present in the remaining 10% of people who are not infected.
  • A specific case definition is one that is narrow to be certain that someone counted as a case really has the disease:
    • Detection of E.coli in a clinical specimen
      AND
      Resident or visitor of Village C
      AND
      Symptom onset on or after January 15, 2022.

 

Sensitivity and specificity usually need to be balanced because having high sensitivity often reduces specificity and the other way around. This is particularly true when deciding on a case definition. A sensitive (broad) case definition will likely count some people as cases when they do not have the disease. A specific (narrow) case definition may miss counting some people who have the disease. Each condition or outbreak will have different priorities for sensitivity and specificity and these priorities can change over time.

 

License

Icon for the Creative Commons Attribution 4.0 International License

A Reference Guide for Field Epidemiologists Copyright © 2025 by University of Newcastle is licensed under a Creative Commons Attribution 4.0 International License, except where otherwise noted.