Epidemiological Intelligence (EPIINT): Intelligence Discipline Guide

An outbreak is visible in reporting well before it is measurable in statistics. Epidemiological intelligence is the discipline of reading that early, noisy signal without over-reading it.

What Epidemiological Intelligence is as a discipline

Epidemiological intelligence is structured surveillance of disease occurrence and spread in support of early warning and decision-making. It combines indicator-based surveillance, meaning case notifications, laboratory and genomic data, syndromic and wastewater signals, with event-based surveillance drawn from media, clinician networks and rumour, then verifies both against official reporting. Analysts characterise events by time, place and person, estimate transmissibility and severity where the data supports it, and state plainly what is known, unknown and changing.

Sub-methods include signal detection and triage, verification against national authorities, risk assessment against defined criteria, epidemic curve and line-list construction, genomic lineage tracking, and modelling of spread and burden. In the cycle it runs as a continuous warning loop rather than a one-off product: signals are triaged daily, escalated on defined thresholds, and reassessed whenever case definitions, testing regimes or reporting cadence change.

Why it matters

Epidemiological intelligence answers whether an unusual health event is emerging, how fast, where and in whom, and what that means for operations, travel, workforce and supply. It also answers the harder question that separates competent analysis from headline-chasing: whether apparent growth reflects real transmission or an artefact of expanded testing, a changed case definition, or a reporting backlog being cleared.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Clusters of undiagnosed illness reported by clinicians or local media before any official notification appears.
Epidemic curves built on symptom onset date rather than reporting date, which is what shows true growth.
Case definition, testing capacity or reporting cadence changes that create artificial steps in a time series.
Genomic lineage frequencies and mutation profiles indicating a new variant establishing in a population.
Wastewater and syndromic surveillance indicators that consistently lead confirmed case reporting by days or weeks.
Animal health events and vector range expansion signalling zoonotic or vector-borne risk ahead of human cases.
Health system stress indicators such as bed occupancy, excess mortality and staff absenteeism.
Reporting gaps or official denials in jurisdictions with known surveillance limitations or political sensitivity.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

WHO Disease Outbreak News — Verified outbreak notifications with case counts, response actions and risk assessment by event
WHO Global Health Observatory — Country-level health statistics and indicators with methodology and comparability notes
ECDC surveillance products — Communicable Disease Threats Reports and the Surveillance Atlas for European case data
ProMED-mail — Moderated early reporting of outbreaks and unusual health events, often ahead of official channels
National public health agency dashboards — Authoritative case, hospitalisation and mortality data with the jurisdiction's own case definitions
WOAH WAHIS — Official animal disease notifications, essential for zoonotic and avian influenza early warning
Nextstrain — Open phylogenetic analysis showing lineage spread and evolution from shared sequence data
Our World in Data — Harmonised, sourced health datasets useful for comparison once definitional caveats are read

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Set standing requirements — Define the diseases, regions and thresholds you monitor, and the case definitions you will use for comparison across sources.
Capture multi-stream signals — Ingest official notifications, clinician and media reports, genomic data and syndromic indicators into one triage queue.
Triage and verify — Filter noise, then confirm each candidate signal against the national authority or WHO before it enters any product.
Build the epidemiological picture — Construct a line list and epidemic curve on a consistent date basis, recording testing and definitional context alongside counts.
Assess risk — Judge transmissibility, severity, spread potential and exposure of your population, separating what is measured from what is estimated.
Communicate with uncertainty — Report ranges, confidence and the specific data limitations, and state what observation would change the assessment.
Reassess on revision — Update when data is revised, definitions change or new sequence data lands, and record why the assessment moved.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Person / Name — A named individual — the subject of identity resolution and profiling.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.

Related disciplines

Medical Intelligence — Health Systems, Capability, and Medical Threats

Inside the platform: where Epidemiological Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=EPIINT — Discipline hub
source-catalog.php?disc=EPIINT — Source catalogue filtered to this discipline
search.php — Person / Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Set standing requirements is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Triage and verify turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Reassess on revision feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Epidemiological Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Force health protection depends on early, reliable disease signal. Analysts track outbreaks along deployment routes and in areas of operation, assess whether local health systems could absorb a surge, and inform prophylaxis, vaccination, vector control, water and food safety measures and quarantine planning. It feeds the medical annex to operational planning, the force protection assessment and the commander's decision on movement and basing. Constraints include the obligation to work at aggregate level, never at patient level, and the requirement that reporting supports planning rather than substituting for clinical or preventive medicine advice from qualified medical staff.

🕵 National intelligence

Agencies run epidemiological intelligence as a continuous warning function feeding national health security and foreign policy decisions. Requirements cover early detection of events with international spread potential, assessment of state reporting behaviour under the International Health Regulations, and biosafety and biosecurity concerns. Fusion combines event-based surveillance from media and clinician networks with indicator-based official data, diplomatic reporting and, where relevant, technical sources. Handling is sensitive because assessments about another state's transparency are politically charged, and because health data is legally protected. Dissemination emphasises the distinction between a verified event and an unverified signal, with escalation thresholds defined in advance.

👮 Law enforcement

Law enforcement engagement is narrower: falsified medical products, fraud in health procurement, breaches of quarantine or biosecurity law, and deliberate contamination. Evidential standards require laboratory analysis by accredited facilities, chain of custody over samples and products, and expert testimony on causation. Patient data requires specific legal authority and is protected in nearly every jurisdiction, so investigations work through public health authorities under statutory information-sharing gateways rather than obtaining records directly. Coordination with health authorities must respect their independent statutory duties, which may conflict with investigative timelines.

🔍 Private investigation and corporate security

Corporate and private practitioners use epidemiological intelligence for business continuity, travel risk, site health planning and supply chain resilience. Legitimate work is aggregate: outbreak monitoring, assessment of health system capacity in operating locations, and tracking of official control measures affecting movement. A private actor may not collect health information about identifiable individuals, including employees, without a clear lawful basis and usually explicit consent, and must not infer health status from other data. Products should state plainly that they inform planning and are not clinical or public health advice, since giving the latter creates professional and regulatory exposure.

📰 Journalism and OSINT media

Health reporting carries unusual potential for harm through both under and overstatement. Verification means confirming a signal against the national authority or WHO before reporting it as an outbreak, understanding case definitions and testing regimes before comparing numbers, and distinguishing cumulative counts from incidence. Source protection matters for clinicians who report from countries where doing so carries professional or criminal risk. Publication ethics require avoiding stigmatising language attaching disease to a nationality, ethnicity or occupation, protecting patient identity absolutely, and correcting prominently when case definitions change and figures are revised.

🌍 NGO, humanitarian and human rights

Humanitarian health actors use surveillance to trigger response, plan capacity and advocate for access. Practice is population-centred: early warning systems in displacement settings, syndromic surveillance where laboratory confirmation is impossible, and outbreak response planning that accounts for water, sanitation and crowding. Do-no-harm requires care not to publish information that could trigger discriminatory restrictions on affected communities or expose facilities to attack. Duty of care to staff includes vaccination, prophylaxis, infection control and mental health support. Documentation for accountability includes recording denial of access and attacks on health care.

🎓 University and research

Researchers use epidemiological intelligence for outbreak analysis, surveillance evaluation and modelling of transmission and burden. Reproducibility depends on documenting the case definition, testing regime and data vintage in force for each period analysed, since retrospective revision is routine and an undated series cannot be reproduced. Ethics approval is required wherever data approaches individual level, and health data is special category data even when it has circulated publicly, so line lists are unsuitable for reuse. Modelling assumptions, priors and code should be published alongside results, with sensitivity analysis reported. Data sharing is constrained by repository access agreements for genomic data and by national statistics licensing, so publish methods and aggregate outputs with pointers to the authoritative sources.

Playbook: working Epidemiological Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the surveillance question

Establish what the capability is for: early detection of events with spread potential, monitoring a known outbreak, assessing risk to a specific population or site, or supporting a policy decision. Specify the diseases or syndromes in scope, the geography, the reporting cadence and the escalation threshold. A good output is a written surveillance objective with defined triggers and named recipients. Stop when the objective is specific enough to determine which sources are worth monitoring daily.

Phase 2 — Establish the baseline

Characterise what is normal for the geography: endemic diseases and their seasonality, expected case numbers by month, historical outbreak frequency, vaccination coverage, and the capability and reporting habits of the national surveillance system. Without this, ordinary seasonal transmission reads as an emerging event. A good output is a baseline note with expected ranges and known reporting lags. Stop when you can say what an unremarkable month looks like in this location.

Phase 3 — Set up event-based surveillance

Monitor media in the relevant languages, clinician and expert networks, official statements, and moderated reporting systems that specialise in early signals. Capture signals with source, date and exact wording, since translation and paraphrase distort clinical detail quickly. Include local and vernacular sources, which routinely report days before national or international coverage. A good output is a signal log with provenance. Stop when the source list covers the geography in the languages actually used there.

Phase 4 — Triage signals daily

Apply a consistent triage: is the signal specific about disease, place and time; is the source in a position to know; is it consistent with the baseline; and does it carry potential for international spread or severe outcome. Discard, park or escalate, and record the decision. Most signals are noise, and the discipline is in disposing of them consistently rather than chasing the vivid ones. A good output is a triaged queue with reasons recorded. Stop each cycle when the queue is cleared, not when something interesting is found.

Phase 5 — Verify against authority

Escalated signals must be checked against the national public health authority, regional body or WHO reporting, because verification of events sits with states and WHO under the International Health Regulations rather than with external analysts. Record whether the authority confirms, denies or is silent, and the date. Silence is informative but is not confirmation. A good output is a verification status per event with dated authority references. Stop when the status is recorded, even if unresolved.

Phase 6 — Characterise the event

Describe by time, place and person using whatever structure the data supports: onset dates, case definition in use, geographic distribution, age and occupational patterns, and severity indicators. Build an epidemic curve by onset date rather than reporting date where possible, since reporting artefacts create false waves. Never handle or retain identifiable patient data. A good output is a dated characterisation with the case definition explicitly stated. Stop when the description is stable enough to support a risk assessment.

Phase 7 — Assess transmissibility and severity

Where the data supports it, estimate transmission indicators and severity measures, and state the assumptions and their sensitivity. Be explicit that early estimates are dominated by ascertainment bias: severity looks high when only severe cases are detected, and transmissibility looks low when testing lags. Prefer ranges and state what would tighten them. A good output is an estimate with assumptions, uncertainty and the data that would improve it. Stop before presenting a point estimate the data cannot support.

Phase 8 — Track genomic and laboratory data

Where sequences are shared, follow lineage assignment, growth advantage and any phenotypic signals through established platforms, noting sampling bias by country and by sequencing capacity. Laboratory confirmation methods and their sensitivity determine what case counts mean. A good output is a lineage picture with sampling caveats stated plainly. Stop when the genomic picture is characterised at the level the decision requires, avoiding over-interpretation of small or unrepresentative sample sets.

Phase 9 — Run the risk assessment

Apply a defined framework covering hazard, exposure and context: what the pathogen does, who is exposed and how, and what the health system and control measures can absorb. Produce a rated assessment with explicit criteria and a stated confidence, and identify the information gaps that most constrain it. A good output is a structured risk assessment following an established methodology rather than a narrative. Stop when the rating, the criteria and the gaps are all documented.

Phase 10 — Watch the denominators

Continuously check whether changes in numbers reflect changes in disease or changes in measurement: case definition revisions, testing capacity and policy, reporting cadence, backlog clearance and administrative reallocation. Annotate every time series with these events, because unexplained steps in a curve are usually artefacts. A good output is an annotated series where each discontinuity has a documented cause. Stop when the series can be read without an analyst present to explain it.

Phase 11 — Communicate with calibration

Report what is known, what is unknown and what is changing, in that order, and state plainly the limits of the assessment and its date. Avoid language that stigmatises a place, community or occupation, and avoid implying certainty that a rapidly evolving event cannot support. State explicitly that the product supports planning and is not clinical or public health advice. A good output is a product a non-specialist decision maker can act on without misreading confidence. Stop when the uncertainty is legible, not minimised.

Phase 12 — Review and close the loop

When an event resolves, review the record: how early was the first signal, how long to verification, which sources performed, which triage decisions were wrong and why. Feed the findings back into the source list and the triage criteria. Retain aggregate analysis and dispose of anything approaching identifiable data under policy. A good output is a short after-action note with specific changes to the surveillance configuration. Stop when the changes are implemented rather than merely recorded.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
WHO Disease Outbreak News and emergency reporting	Open	Official WHO reporting on verified outbreaks including epidemiology, risk assessment and recommended measures.	Authoritative verification point for events and the reference against which unverified signals are checked.
ECDC surveillance and threat reporting	Open	European surveillance data, rapid risk assessments and weekly communicable disease threat reports.	Provides structured risk assessments and European case data with methodology and case definitions stated.
ProMED	Registration	Moderated reporting network for emerging disease and toxin events, with expert commentary on submitted reports.	Long-standing early signal source that frequently reports clinician observations before official confirmation.
WOAH WAHIS	Open	World animal health information system with official notifications of animal disease events including zoonoses.	Detects zoonotic events at the animal interface, which often precede human cases by days or weeks.
Nextstrain	Open	Real-time phylogenetic analysis and visualisation of pathogen genomic data with lineage and geographic context.	Tracks lineage emergence and spread, with explicit acknowledgement of sequencing and sampling bias by country.
GISAID	Registration	Repository for influenza and other pathogen genetic sequence data with associated metadata under a data access agreement.	Primary sequence sharing platform underpinning lineage tracking; access terms constrain redistribution of data.
US CDC surveillance and travel health information	Open	Surveillance reports, outbreak notices, travel health notices and clinical and public health guidance.	Reference case definitions, travel notices and detailed technical guidance used in planning products.
Africa CDC	Open	Continental surveillance reporting, outbreak briefs and member state coordination information for African Union states.	Regional reporting that is often more timely and granular than global sources for African outbreaks.
PAHO and regional WHO offices	Open	Regional epidemiological alerts, updates and surveillance data for the Americas and other WHO regions.	Regional alerts frequently carry country detail and case definitions absent from global-level reporting.
IHME Global Burden of Disease	Registration	Modelled estimates of disease burden, mortality and risk factors by country, age and sex over time.	Supplies baseline burden and health system context for risk assessment where surveillance data is sparse.
Our World in Data	Open	Curated, sourced datasets and visualisations on health, vaccination and disease with documented provenance.	Rapid access to harmonised comparative series with clear sourcing, useful for context rather than as primary data.
Humanitarian Data Exchange health datasets	Open	Health facility locations, needs assessments and outbreak data curated for humanitarian response contexts.	Links epidemiological signal to service capacity and population data in crisis settings where official data is thin.
HealthMap	Open	Automated aggregation and geolocation of disease reports from news, official sources and social reporting.	Broad automated signal sweep that surfaces reports for triage, requiring verification before any use.
FAO EMPRES and animal health resources	Open	Early warning and information on transboundary animal diseases, food chain threats and zoonotic risks.	Complements animal health notifications with food chain and livestock context relevant to zoonotic emergence.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Epidemiological Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Signal triage workflow with structured criteria — Applies consistent disposition rules to incoming reports and records the reasoning. Limitation: criteria must be reviewed after events, or the system optimises for the last outbreak rather than the next.
Epidemic curve and line-list construction tooling — Builds curves by onset date and tracks aggregate case characteristics over time. Limitation: line-list detail approaches identifiable data and must be handled as restricted even when publicly circulating.
Nextstrain and phylogenetic visualisation — Displays lineage relationships, timing and geographic spread from shared sequences. Limitation: conclusions are bounded by sequencing coverage, which varies by orders of magnitude between countries.
Automated media and event scanning — Sweeps multilingual news and official feeds for disease terms and geographies. Limitation: high false positive rate and systematic blind spots where local media is offline or restricted.
Machine translation for vernacular sources — Makes local reporting tractable at daily cadence across many languages. Limitation: clinical terminology and hedging translate poorly, so escalation decisions need a competent human reader.
Risk assessment frameworks and templates — Structure hazard, exposure and context judgements against defined criteria. Limitation: templates produce a rating whether or not the underlying data supports one, so gaps must be recorded explicitly.
Wastewater and syndromic surveillance dashboards — Provide signal independent of testing behaviour and clinical presentation. Limitation: coverage is patchy, normalisation is contested, and trends are more meaningful than levels.
Time series annotation tooling — Marks case definition changes, testing policy shifts and backlog events on the curve. Limitation: only works if someone tracks the administrative changes, which is unglamorous and frequently neglected.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Read the case definition before reading the numbers. Most apparent step changes in an outbreak curve reflect a revised definition, a testing policy change or a backlog clearance rather than a change in transmission.
Plot by onset date, not report date, wherever the data permits. Reporting-date curves manufacture weekend troughs and Monday peaks that get interpreted as behavioural effects and occasionally as policy successes.
Early severity estimates are biased upward and early transmissibility estimates biased downward, both by ascertainment. State the direction of the bias rather than presenting a point estimate with false precision.
Animal health notifications often precede human cases. Analysts who monitor only human surveillance systematically detect zoonotic events later than the data allowed, sometimes by weeks.
Silence from a national authority is informative but is not confirmation. Record it as an unresolved verification status rather than treating either the signal or the absence of denial as established.
Local vernacular media routinely reports clinical observations days before national or international sources. A source list built only from English-language and official feeds structurally guarantees late detection.
Sequencing coverage varies by orders of magnitude between countries, so absence of a lineage in a country usually means absence of sequencing. Never report a geographic distribution without the sampling caveat.
Line-list detail is restricted material even when it circulates publicly. Handling leaked patient-level data as though publication laundered it is both a legal exposure and a breach of the duty owed to patients.
Language choices in outbreak reporting have downstream consequences. Attaching a disease to a nationality, ethnicity or occupation drives discriminatory measures that outlast the outbreak and reduce future reporting willingness.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Epidemiological Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Median interval from first detectable open signal to internal escalation, and from escalation to verification status recorded against an authoritative source.
Proportion of escalated events that were subsequently confirmed by a national authority or WHO, tracked alongside the false escalation rate to show triage calibration.
Detection lead time against official announcement, measured per event, showing whether event-based surveillance is genuinely earlier than indicator-based reporting.
Share of time series in production products carrying annotations for case definition, testing policy and reporting changes.
Coverage of the source list against the languages actually spoken in the priority geographies, reviewed after each event for missed local reporting.
Proportion of risk assessments that explicitly state information gaps and the data that would change the rating, rather than presenting a rating alone.
Number of after-action reviews producing implemented changes to source lists or triage criteria, rather than reviews concluded without configuration change.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Comparing jurisdictions with different case definitions, testing rates and reporting lags as if the numbers were equivalent.
Mistaking reporting artefacts such as weekend dips and backfilled batches for real epidemiological change.
Amplifying unverified rumour by giving it the authority of a formal intelligence product.
Quoting rates without a reliable denominator, which produces confident numbers with no meaning.
Treating early case fatality ratios as stable when both numerator and denominator are still moving.
Failing to revisit an assessment after data revision, leaving a superseded judgement in circulation.

Legal and ethical considerations

Health data is among the most protected categories in law. Work at aggregate level, never identify patients, and treat line-list detail as restricted even when it has leaked publicly. Respect the International Health Regulations framework, in which verification sits with national authorities and WHO rather than with commercial analysts. Avoid analysis or wording that stigmatises a community or drives disproportionate restrictions, and state clearly that your product supports planning and is not clinical or public health advice.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Epidemiological Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 4 data points, 2 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Why do case numbers jump without any real change in transmission?

Almost always because the measurement changed. Common causes are a revised case definition, a change in who is eligible for testing, a laboratory backlog being cleared in one day, a switch from confirmed to probable case reporting, reallocation of cases between administrative areas, or a change in reporting cadence such as moving from daily to weekly. Before interpreting any discontinuity, check the authority's technical notes for that date. Annotate the series permanently so nobody reinterprets the same artefact later. Treating an administrative step as an epidemiological event is the most common error in outbreak analysis.

How much can be inferred from early severity figures?

Less than the numbers suggest, and the bias runs in a predictable direction. Early in an outbreak, detection is concentrated on people sick enough to seek care, so the case fatality ratio computed from confirmed cases overstates true severity, sometimes by an order of magnitude. Conversely, transmissibility is often understated because testing lags spread. Report ranges, state that the estimate is conditional on the current ascertainment regime, and identify what would improve it: serosurveys, systematic testing of a defined population, or linkage to hospitalisation data. Avoid comparisons between countries with different testing intensity.

Can private analysts verify an outbreak?

No, and it is important to be clear about that. Under the International Health Regulations, verification of events sits with national authorities and WHO. External analysts detect and characterise signals, then check them against those authorities. What you can legitimately do is document the signal precisely, record the authority's response or silence with dates, assess consistency with independent indicators such as animal health notifications or facility reporting, and state the verification status honestly. Presenting an unverified signal as a confirmed outbreak can trigger disproportionate restrictions and damages the reporting relationships that surveillance depends on.

How should genomic data be interpreted?

With explicit attention to sampling. Sequencing capacity differs by orders of magnitude between countries, so lineage maps are maps of where sequencing happens as much as of where variants circulate. Growth advantage estimates from small or non-random samples are unreliable, and phenotypic claims about severity or immune escape require laboratory and epidemiological evidence beyond the sequence. Use established platforms for lineage assignment, respect the data access terms of the repositories involved, and state the sampling caveat in every product. Genomic surveillance is powerful for detecting emergence and weak for quantifying prevalence.

What is the boundary around health data in this work?

Work at aggregate level and never at patient level. Health data is special category data under GDPR and equivalently protected elsewhere, and the restriction applies regardless of whether a line list has circulated publicly. Do not retain identifiable records, do not attempt to identify individual cases, and do not infer health status about identifiable people from other data. Where an event requires individual-level analysis, that work belongs with the public health authority under its statutory powers. Products should state that they support planning and are not clinical or public health advice.

How do you avoid stigmatising language?

Name diseases and locations according to the conventions established by WHO rather than by association with a place, animal, person or community, and describe transmission by behaviour and setting rather than by group identity. Occupational and demographic patterns can be reported where epidemiologically relevant, but framed as exposure rather than as blame. The practical consequence of stigmatising framing is measurable: affected communities become less willing to present for testing and clinicians become less willing to report, which degrades exactly the surveillance the analysis depends on, and discriminatory restrictions often outlast the outbreak.

What does a good early warning system look like in practice?

Daily triage of a source list built for the actual geography and languages, including animal health and local vernacular media; consistent, recorded disposition of every signal; a defined escalation threshold agreed with recipients before an event; verification checks against the national authority and WHO with dated results; and an after-action review that changes the configuration. The measurable outputs are lead time against official announcement and a false escalation rate that is neither near zero, which indicates excessive caution, nor high enough that recipients stop reading.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

International Health Regulations 2005, which govern state notification obligations, WHO verification, and the determination of a public health emergency of international concern.
WHO rapid risk assessment methodology for acute public health events, defining hazard, exposure and context assessment and the expression of confidence.
WHO best practices for naming new human infectious diseases, governing terminology to avoid stigmatising places, people, animals and occupations.
GDPR Article 9 and equivalent regimes treating health data as special category data requiring an explicit lawful basis and heightened safeguards.
WOAH Terrestrial Animal Health Code notification obligations, governing official reporting of animal disease events including zoonoses.
Nagoya Protocol and WHO pathogen access and benefit sharing arrangements, governing the exchange of biological samples and associated sequence data.
One Health approach as articulated by WHO, WOAH, FAO and UNEP, governing integrated surveillance across human, animal and environmental health.
Sphere Handbook health standards, governing minimum standards for health services and disease control in humanitarian response.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Disease Outbreak News and emergency information — World Health Organization. Authoritative reporting on verified outbreaks and international health emergencies
Communicable disease threats reporting and rapid risk assessments — European Centre for Disease Prevention and Control. Structured European surveillance reporting and risk assessment methodology
ProMED emerging diseases reporting network — International Society for Infectious Diseases. Moderated early signal reporting on human, animal and plant disease events
World Animal Health Information System — World Organisation for Animal Health. Official notifications of animal disease events including zoonoses
Nextstrain real-time pathogen evolution — Nextstrain project. Open phylogenetic analysis and visualisation of pathogen genomic data
Global Burden of Disease study — Institute for Health Metrics and Evaluation. Modelled estimates of disease burden and risk factors by country
Surveillance, outbreak notices and travel health guidance — US Centers for Disease Control and Prevention. Case definitions, technical guidance and travel health notices
Continental surveillance and outbreak reporting — Africa Centres for Disease Control and Prevention. Regional epidemiological reporting for African Union member states
Epidemiological alerts and updates — Pan American Health Organization. Regional alerts and surveillance data for the Americas
Humanitarian Data Exchange — UN OCHA Centre for Humanitarian Data. Health facility, needs and outbreak datasets for crisis settings

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: multi-stream outbreak signal capture, verification workflow and location-linked health risk alerting. Explore the platform, or browse the rest of the library by following any tag above.