Medical Intelligence (MEDINT): Intelligence Discipline Guide

Medical intelligence is not about outbreaks. It is about whether the hospital your team would actually be taken to can treat what would actually happen to them, at two in the morning, on a Sunday.

What Medical Intelligence is as a discipline

Medical intelligence assesses health systems and medical threats as an operating environment: hospital and clinic location and real capability, specialist services, blood supply, ambulance and evacuation options, pharmaceutical supply chains and product quality, water and sanitation conditions, endemic disease and prophylaxis requirements, and occupational and environmental hazards. It supports duty of care, deployment approval, evacuation planning and continuity assessment, and it works at facility and population level rather than on the health of identifiable individuals.

Sub-methods include facility mapping and capability grading, referral pathway and evacuation route analysis, pharmaceutical supply and falsified-medicine assessment, licensing and medical eligibility checks for evacuation, and epidemiological baselining of endemic risk. In the cycle it is a planning discipline: the product is usually a country or site medical annex, refreshed on a defined cadence and stress-tested against specific scenarios rather than written once.

Why it matters

Medical intelligence answers whether care of a required standard is reachable inside the clinically relevant time window, what supplies and blood products are genuinely available, and where the medical failure points in an operation sit. It is the difference between a plan that names a hospital and a plan that knows what that hospital can do out of hours, with which specialists, and what happens when the road to it is closed.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Facility locations paired with actual service capability: surgery, intensive care, obstetrics, dialysis, imaging and laboratory.
Realistic transit times to definitive care given road conditions, terrain, curfews and the security situation.
Blood bank availability by product and group, donor screening standards, and the pattern of recurring seasonal shortages.
Pharmaceutical supply reliability and the local prevalence of substandard or falsified medical products.
Staffing density and specialist availability, including attrition from strikes, conflict or emigration.
Endemic disease burden and the vaccination or prophylaxis requirements for the specific location and season.
Water, sanitation and vector control conditions that drive health risk at a site or camp.
Medical evacuation options: available air assets, receiving facilities, insurance cover and border and licensing constraints.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

WHO Global Health Observatory — Health workforce, infrastructure and service coverage indicators by country with definitions
WHO Medical Product Alerts — Notifications of falsified and substandard medicines, with product, batch and region detail
healthsites.io and OpenStreetMap — Open health facility locations and attributes, useful as a base layer requiring validation
Humanitarian Data Exchange — Operational datasets on facilities, access and populations, often the best source in crisis settings
IHME Global Burden of Disease — Modelled disease burden, risk factors and mortality by country and cause for baselining
National medicines regulators — Authorised product registers, recalls and safety alerts for the jurisdiction you are operating in
WHO and UNICEF immunization estimates — National vaccination coverage estimates by antigen and year, indicating susceptibility gaps
ACLED — Dated, geocoded incidents including attacks affecting health facilities and personnel

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Define population and scenarios — State who is covered, where they will be, and the clinical scenarios the plan must handle, from trauma to obstetric emergency.
Map and grade facilities — Locate facilities and grade them by verified capability and hours of operation rather than by name, size or claimed status.
Validate on the ground — Confirm capability through local partners, recent visitor reporting or direct contact, because published facility lists record existence only.
Model evacuation timelines — Work out realistic times to definitive care under normal and degraded conditions, including permits, insurance and receiving facility acceptance.
Assess supply and endemic risk — Review medicine, blood and consumable availability, product quality risk, and the endemic disease and prophylaxis picture.
Identify failure points — Name the specific points where the plan breaks, and record the mitigation, the owner and the trigger for using it.
Refresh on cadence — Review on a schedule and immediately after conflict, disaster or major health system disruption in the area of operation.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Person / Name — A named individual — the subject of identity resolution and profiling.
Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.
Facility / Site — A physical installation — plant, base, port, data centre — with a fixed footprint and function.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.

Related disciplines

Epidemiological Intelligence — Disease Occurrence, Spread, and Public Health Threats

Inside the platform: where Medical Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=MEDINT — Discipline hub
source-catalog.php?disc=MEDINT — Source catalogue filtered to this discipline
search.php — Person / Name profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define population and scenarios is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Validate on the ground turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Refresh on cadence feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Medical Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Medical intelligence underpins force health protection and the medical estimate. Analysts assess host-nation facility capability, surgical and blood availability, evacuation timelines against the clinical timelines that matter, endemic disease and required prophylaxis, water and sanitation conditions, and environmental and industrial hazards near basing. It feeds the medical annex, casualty evacuation planning, role of care laydown and the commander's risk decision on deployment. Constraints include working at facility and population level rather than on individuals, respecting international humanitarian law protections attaching to medical facilities and personnel, and ensuring the product informs planning while clinical decisions remain with qualified medical officers.

🕵 National intelligence

National agencies use medical intelligence for duty of care to deployed personnel, assessment of a state's health system resilience as an element of national power, and analysis of biological and chemical hazards. It supports evacuation planning for diplomatic and intelligence staff and informs assessments of how a health emergency would affect stability. Handling matters because health information about identifiable officers is protected and because assessments of another state's health capability can be politically sensitive. Products are usually planning annexes maintained on a cadence, with the underlying facility data kept current because it decays faster than most reference material.

👮 Law enforcement

Law enforcement interest centres on falsified and substandard medical products, diversion of controlled pharmaceuticals, health procurement fraud, and the medical dimension of trafficking and forced labour investigations where victims require care. Evidential standards require accredited laboratory analysis with chain of custody for seized products and expert testimony on harm. Victim medical information requires specific legal authority and consent where possible, and is handled under strict access control. Coordination with health services must respect clinical confidentiality, and investigators should not seek clinical records as a shortcut where a properly authorised route exists.

🔍 Private investigation and corporate security

Corporate security and travel risk teams use medical intelligence for duty of care: deciding whether a location can support a deployment, planning evacuation, briefing travellers on prophylaxis and hazards, and selecting providers. Legitimate work is facility and population level. A private actor must not collect or infer health information about identifiable individuals including employees without a clear lawful basis and normally explicit consent, must not request clinical records from providers, and must state plainly that products inform planning rather than constituting clinical advice, since giving the latter creates professional liability and regulatory exposure.

📰 Journalism and OSINT media

Reporting on health systems requires care with both facts and identities. Verification means confirming facility status through more than one route, since directories are frequently out of date and a listed hospital may be non-functional, and understanding what a capability claim means clinically before repeating it. Source protection is critical for clinicians who speak about conditions in their facility, as they face dismissal or prosecution in some jurisdictions. Publication ethics require absolute protection of patient identity, care with images of the injured and deceased, and awareness that identifying functioning medical facilities in conflict can make them targets.

🌍 NGO, humanitarian and human rights

Humanitarian health actors use this discipline for response planning, referral pathway design, procurement of quality-assured medicines and advocacy on access. Practice is population-centred and equity-aware: mapping who can actually reach care, not only where facilities exist. Do-no-harm is acute here, because publishing detailed information about functioning medical facilities in conflict has repeatedly preceded attacks on them, so information management follows deconfliction protocols rather than open publication. Duty of care to staff includes vaccination, prophylaxis, infection control, psychological support and a realistic evacuation plan they have been briefed on.

🎓 University and research

Researchers study health system capacity, service availability, pharmaceutical quality and access barriers. Reproducibility depends on documenting facility data provenance and the date of assessment, since facility functionality changes rapidly and stale data drives wrong conclusions. Ethics approval is required for any work involving patients, clinicians as subjects, or facility-level data that could identify practitioners. Data sharing must exclude anything that could locate protected facilities in conflict settings or identify individuals, and health data sharing agreements should specify secondary use limits explicitly.

Playbook: working Medical Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the medical requirement

Establish who is being protected, where, for how long, and against what. A short business trip to a capital, a six-month field deployment and a permanent site presence generate entirely different requirements. Identify the decisions the product supports: deploy or not, which provider, what prophylaxis, what evacuation arrangement. A good output is a scoped requirement naming the population, locations, duration and decisions. Stop when the scope determines the geographic and clinical depth needed.

Phase 2 — Profile the population at risk

Characterise the group without collecting individual health data: numbers, general demographic profile, expected activities and exposures, and whether the deployment includes people with foreseeable additional needs, handled through a confidential medical clearance process run by qualified staff rather than by the analyst. Record what the organisation's duty of care obligations require in the relevant jurisdictions. A good output is an exposure profile at group level. Stop when the profile supports planning without any identifiable clinical information reaching the analytic file.

Phase 3 — Baseline endemic disease

Establish the endemic disease picture and its seasonality: vector-borne disease and transmission season, water and food-borne risk, respiratory and vaccine-preventable disease, and antimicrobial resistance patterns which increasingly determine whether local treatment will work. Use authoritative sources and note where surveillance is weak enough that absence of reporting is not absence of disease. A good output is a disease baseline with seasonality and prophylaxis implications flagged for clinical review. Stop when the picture covers the deployment period rather than an annual average.

Phase 4 — Map facilities and grade capability

Locate hospitals, clinics and specialist services, then grade what they can actually do rather than what they are called: surgical capability and hours, anaesthesia, intensive care beds with ventilators and trained staff, imaging, laboratory, blood availability and screening practice, oxygen supply, and reliable power. Verify functionality through more than one route, since directories are frequently obsolete. A good output is a graded facility list with assessment dates. Stop when the facilities that could actually receive your population are verified, not when the list is long.

Phase 5 — Assess blood and pharmaceutical supply

Examine blood supply: source, screening regime, availability of components, and whether walking donor arrangements are the practical reality. Assess pharmaceutical supply chain integrity, prevalence of falsified and substandard products, regulatory authority capability, and which suppliers are quality assured. This determines whether local sourcing is viable or whether everything must be imported. A good output is a supply assessment with named quality-assured routes. Stop when the practical sourcing answer is clear for the medicines and products that matter.

Phase 6 — Trace referral and evacuation pathways

Work the pathway from point of injury or illness to definitive care: who provides prehospital care and with what capability, realistic road and air transit times including at night and in bad weather, border and customs procedures for medical evacuation, permit and overflight requirements, and the nearest facility that can genuinely provide definitive care. Time it against the clinical windows that matter. A good output is a timed pathway with the binding constraint identified. Stop when the pathway is validated against a real, current example.

Phase 7 — Assess water, sanitation and environment

Evaluate water source and treatment, sanitation infrastructure, waste management, food safety and hygiene practice in the settings your population will use, plus environmental and industrial hazards: air quality, heat, altitude, chemical facilities, mining and legacy contamination. These drive far more illness than exotic disease. A good output is a hazard assessment with control measures identified for each significant exposure. Stop when the mundane risks are covered as thoroughly as the dramatic ones.

Phase 8 — Evaluate providers and insurance

Check licensing and accreditation of candidate providers, evacuation companies and assistance services against the relevant authority, and confirm what the insurance or assistance contract actually covers including exclusions, pre-authorisation requirements and the definition of medical necessity. Many evacuation failures are contractual rather than clinical. A good output is a verified provider list with the contractual limits stated. Stop when someone at the sharp end could activate the arrangement without discovering a surprise.

Phase 9 — Stress test with scenarios

Run the plan against concrete scenarios: a road traffic injury at night in the wet season, a cardiac event at a remote site, a communicable disease outbreak with a facility closure, and a mass casualty event that saturates local capacity. Identify where each scenario breaks and what mitigation is available. A good output is a set of scenario walkthroughs with named failure points and mitigations. Stop when each scenario has been worked to a conclusion rather than to a reassurance.

Phase 10 — Apply the do-no-harm and confidentiality test

Review the product for information that could endanger facilities or people: precise coordinates of functioning hospitals in a conflict, identities of clinicians who provided information, and anything approaching individual health data. Follow deconfliction protocols rather than publishing facility detail in active conflict. A good output is a reviewed product with sensitive detail removed or handled under restricted distribution. Stop when the product can be distributed to its intended audience without creating risk.

Phase 11 — Produce the medical annex

Write the product for the people who will use it under pressure: a short actionable summary, the graded facility list with contacts, the evacuation pathway with timings and activation steps, prophylaxis and vaccination requirements referred to clinical authority, and the hazards with their controls. State the assessment date and the limits plainly, including that it supports planning and is not clinical advice. A good output is usable at three in the morning by someone who did not write it. Stop when it has been read back by an intended user.

Phase 12 — Maintain and re-verify

Facility capability decays quickly: staff leave, equipment fails, funding lapses, conflict closes sites. Set a re-verification cadence proportionate to volatility, and trigger off-cycle review on conflict escalation, outbreak, provider change or an actual incident. Record the date of last verification on the face of the product. A good output is a maintained annex with visible currency. Stop maintaining only when the presence ends, and mark superseded versions clearly.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
WHO country health data and Global Health Observatory	Open	National health statistics, service coverage indicators, health workforce data and disease burden by country.	Establishes the population-level health baseline and system capacity indicators underpinning any facility assessment.
WHO medical product alerts	Open	Alerts on falsified and substandard medical products with product identifiers and affected regions.	Identifies specific falsified products circulating in the operating area, driving sourcing and procurement decisions.
US CDC travel health information	Open	Destination-specific health recommendations, vaccination and prophylaxis guidance, and travel health notices.	Authoritative reference for endemic disease and prophylaxis requirements to be confirmed by clinical staff.
TravelHealthPro	Open	UK national travel health guidance covering country-specific disease risk, vaccination and outbreak news.	Independent second reference on endemic risk and prophylaxis, useful where guidance between authorities diverges.
ECDC surveillance and country reporting	Open	European communicable disease surveillance, threat reports and antimicrobial resistance surveillance data.	Supplies antimicrobial resistance patterns that determine whether local empirical treatment is likely to work.
Humanitarian Data Exchange health facility datasets	Open	Curated health facility locations, functionality status and service availability data for crisis-affected countries.	Best available facility mapping in humanitarian contexts, requiring verification because functionality changes quickly.
WHO Health Resources and Services Availability Monitoring	Open	Assessments of facility functionality, service availability and access constraints in emergency settings.	Provides assessed functionality rather than mere existence, which is the distinction that matters for planning.
ReliefWeb	Open	Aggregated humanitarian situation reports, health cluster bulletins and assessments across active emergencies.	Current operational detail on health service disruption, outbreaks and access constraints from responding agencies.
Medecins Sans Frontieres field reporting	Open	Operational reporting and medical guidance from field programmes including protocols and situation updates.	Ground-level detail on what care is actually deliverable in a setting, and published clinical protocols for austere environments.
United States Pharmacopeia and medicines quality resources	Open	Standards and programmes on medicines quality assurance, including work on substandard and falsified medical products.	Reference for pharmaceutical quality assurance practice when assessing whether local sourcing is defensible.
PIC/S and national medicines regulators	Open	Pharmaceutical inspection cooperation standards and national regulatory authority registers of licensed products and facilities.	Establishes whether a national regulator is capable and whether a supplier or product is properly licensed.
IHME Global Burden of Disease	Registration	Modelled disease burden, mortality, risk factor and health system estimates by country, age and sex.	Fills baseline gaps where national health statistics are absent or unreliable, with published uncertainty intervals.
IATA and civil aviation authority medical transport guidance	Open	Standards and requirements affecting medical transport by air including patient transport and permit requirements.	Clarifies the regulatory constraints that determine realistic evacuation timelines and permit lead times.
WHO International Travel and Health	Open	Guidance on health risks to travellers, vaccination requirements and country-specific health considerations.	Reference for vaccination requirements including those legally mandated for entry to specific countries.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Medical Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Facility mapping in a geographic information system — Plots facilities against population, roads and drive times to show real accessibility. Limitation: drive time models rarely capture checkpoints, seasonal road closure or night-time restrictions.
Isochrone and routing analysis — Models realistic transit times to definitive care under different conditions. Limitation: routing data quality is poor in exactly the environments where the analysis matters most.
Structured facility assessment checklists — Grade capability consistently across sites using observable criteria. Limitation: remote assessment cannot verify staffing competence or equipment serviceability, which are the usual failure points.
Medicines quality verification resources — Check product registration, manufacturer licensing and alert status before procurement. Limitation: registration confirms licensing, not that the specific batch in front of you is genuine.
Outbreak and surveillance dashboards — Track communicable disease activity affecting the deployment area. Limitation: surveillance coverage is weakest in the settings where health system fragility makes outbreaks most consequential.
Air quality and environmental monitoring services — Provide measured exposure data for particulates and other pollutants. Limitation: station coverage is sparse outside major cities and modelled estimates carry large uncertainty.
Evacuation provider and insurance policy review workflow — Establishes coverage limits, exclusions and activation procedures before an incident. Limitation: contractual language often leaves medical necessity determination with the insurer, which is a real operational risk.
Scenario walkthrough templates — Force the plan to be tested against concrete cases rather than assessed in the abstract. Limitation: only useful when someone with clinical knowledge participates, otherwise timelines get validated by optimism.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

A hospital on a list is not a hospital that can operate. Verify surgical capability, anaesthesia, ventilators with trained staff, blood, oxygen and out-of-hours coverage separately, because a facility that is fully capable at ten in the morning may offer nothing at midnight.
Blood is the constraint that decides survivability more often than surgical skill. Establish the source, the screening regime and whether components are available, and treat walking donor arrangements as the planning reality where the supply chain is thin.
Time the evacuation pathway against clinical windows, not against distance. An airfield ninety minutes away that is closed at night and requires a permit with a two-day lead is not an evacuation route for a haemorrhage.
Antimicrobial resistance patterns now determine whether local empirical treatment will work. This is routinely omitted from country medical briefs and is one of the most consequential facts in them.
Mundane hazards dominate the casualty statistics. Road traffic injury, water and food-borne illness, heat and pre-existing cardiac conditions produce far more evacuations than the exotic diseases that occupy most of the briefing.
Publishing detailed information about functioning medical facilities in an active conflict has repeatedly preceded attacks on them. Follow deconfliction protocols and restricted distribution rather than open publication, however useful the map would be.
Facility data decays within months. An assessment without a date is not usable, and re-verification triggered by conflict, funding change or an actual incident matters more than a calendar cadence.
Never let individual clinical information enter the analytic file. Medical clearance and fitness decisions belong with qualified clinicians under confidentiality, and an analyst holding that data creates both legal exposure and a barrier to honest disclosure by staff.
Evacuation failures are more often contractual than clinical. Read the policy for exclusions, pre-authorisation requirements and who determines medical necessity, and test the activation procedure before you need it.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Medical Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Proportion of facilities in the annex verified within the stated re-verification cadence, with functionality confirmed through more than one independent route.
Accuracy of modelled evacuation timelines when compared against actual movements, tracked after every real activation or exercise.
Share of medical annexes containing an assessment date, stated limitations and an explicit statement that they support planning rather than constituting clinical advice.
Number of scenario walkthroughs completed per site per year and the count of failure points identified and subsequently mitigated.
Proportion of procurement routed through quality-assured suppliers for locations with documented falsified medicine prevalence.
Time from a triggering event such as conflict escalation or facility closure to updated annex issue, measured per event rather than averaged.
Rate at which travellers and deployed staff report having read and understood the briefing, tested by recall of the activation procedure rather than by acknowledgement of receipt.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Trusting facility lists that record existence rather than function, in settings where many listed clinics are closed.
Assuming published bed counts equal usable capacity with staff, power, oxygen and consumables present.
Ignoring out-of-hours and weekend degradation, when surgical and specialist cover often disappears entirely.
Reading a facility name or tier label as a capability grade without verification.
Missing licensing, insurance and medical eligibility constraints that block an evacuation at the worst moment.
Relying on data collected before a conflict, disaster or currency collapse changed the health system entirely.

Legal and ethical considerations

Never collect or infer health information about identifiable individuals without a clear lawful basis and consent; health data attracts the strictest protection under GDPR, HIPAA and equivalent regimes. Keep assessments at facility and population level, respect medical confidentiality when working with local clinicians and partners, and state plainly that products inform planning and are not clinical advice. In conflict settings, information about medical facilities carries humanitarian law sensitivities and must be handled to avoid enabling harm.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Medical Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 data points, 3 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How do you assess a hospital you cannot visit?

Triangulate and grade conservatively. Combine facility datasets with recent humanitarian and health cluster reporting, published assessments, provider network information, and direct contact with the facility to confirm current services, staffing hours and equipment status. Ask capability questions rather than name questions: is there a surgeon on call overnight, how many functioning ventilators with trained staff, what blood components are held, is oxygen supply reliable, is there a working generator. Record the date and route of each confirmation. Where verification is single-source, grade the facility down and state the limitation explicitly in the annex.

What actually drives medical evacuation decisions in practice?

Time to definitive care and the contractual arrangement, more often than clinical subtlety. The binding constraints are usually prehospital capability, road conditions and security at night, airfield operating hours, permit and overflight lead times, and whether the assistance provider will authorise movement quickly. Many evacuation failures are administrative: an exclusion in the policy, a pre-authorisation requirement nobody had tested, or a determination of medical necessity resting with the insurer. Test the activation procedure in advance, document who can authorise what, and time the whole pathway against a realistic worst case rather than the best case.

Can an employer collect health information about staff for duty of care?

Only within tight limits and normally not by the analyst. Health data is special category data requiring an explicit lawful basis and, in most employment contexts, is handled by an occupational health function under confidentiality rather than by security or intelligence teams. The analyst's product should be facility and population level. Fitness for deployment decisions are made by qualified clinicians who hold the individual information; the organisation receives a fitness determination, not the underlying data. Building health profiles of employees within an analytic function is both unlawful in many jurisdictions and destructive of the trust that makes honest disclosure possible.

How significant is falsified medicine risk?

Highly significant in many operating environments, and it changes sourcing entirely. Where a national regulator has limited inspection capability and supply chains are informal, the practical answer is to import quality-assured products through verified routes rather than to buy locally, and to plan storage and cold chain accordingly. Check WHO medical product alerts for specific products circulating in the region, confirm supplier and product registration with the national regulator, and prefer manufacturers subject to recognised inspection regimes. Assume that packaging inspection is insufficient, because falsified products are frequently indistinguishable without laboratory analysis.

Why does the mundane risk get so little attention?

Because it is unexciting and the exotic risk is memorable. In practice road traffic injury, gastrointestinal illness, heat-related illness and cardiac events account for the overwhelming majority of evacuations and deaths among deployed civilian and military populations. The corrective is to allocate assessment and mitigation effort in proportion to observed casualty causes rather than to perceived threat: vehicle standards and driver policy, water and food safety in the actual accommodation used, heat management, and pre-deployment cardiovascular screening by clinical staff will save more people than any tropical disease briefing.

What information about medical facilities should not be published?

In active conflict, precise coordinates and detailed capability descriptions of functioning facilities, the identities of clinicians who provided information, and anything indicating that a site treats particular casualties. Attacks on health care have followed publication of exactly this material. Use established deconfliction mechanisms rather than open reporting, restrict distribution to those who need it, and consider whether the level of detail serves the decision. The same logic applies to humanitarian medical facilities generally: they are protected under international humanitarian law, and information practices should reinforce that protection rather than erode it.

How often should a country medical annex be refreshed?

On a cadence set by volatility, plus triggers. In a stable environment an annual review with contact verification may suffice. In a conflict or an outbreak the useful life of facility data can be measured in weeks. Trigger off-cycle review on conflict escalation, facility closure, provider or insurer change, disease outbreak, and after any actual medical incident, because real events reveal errors in the plan that no desk review finds. Put the last verification date on the face of the document, and mark superseded versions clearly so an old annex is never mistaken for current guidance.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

International humanitarian law protections for medical units, transports and personnel under the Geneva Conventions and their Additional Protocols.
WHO Health Emergency and Disaster Risk Management framework, governing health system preparedness, capacity assessment and emergency response planning.
Sphere Handbook minimum standards for health, water, sanitation and hygiene in humanitarian response, defining acceptable service levels.
GDPR Article 9 and equivalent health data regimes including HIPAA, governing lawful basis, consent and safeguards for health information.
WHO Good Distribution Practices and PIC/S inspection standards, governing pharmaceutical supply chain integrity and manufacturer quality assurance.
International Health Regulations 2005, governing state health emergency notification and the health measures applied at points of entry.
WHO member state mechanism on substandard and falsified medical products, governing detection, reporting and response to falsified medicines.
Occupational health and safety duty of care obligations in the employer's jurisdiction, which determine the standard the assessment must support.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Global Health Observatory and country health profiles — World Health Organization. Health system, workforce and service coverage indicators by country
Travelers' Health destination guidance — US Centers for Disease Control and Prevention. Country-specific disease risk, vaccination and prophylaxis guidance
TravelHealthPro country information — UK National Travel Health Network and Centre. National travel health guidance and outbreak surveillance for travellers
Antimicrobial resistance surveillance — European Centre for Disease Prevention and Control. Surveillance data on resistance patterns affecting empirical treatment choices
Humanitarian Data Exchange health facility datasets — UN OCHA Centre for Humanitarian Data. Curated facility location and functionality data for crisis contexts
ReliefWeb humanitarian situation reporting — UN OCHA. Aggregated health cluster bulletins and situation reports from responders
Field operational and medical guidance — Medecins Sans Frontieres. Clinical protocols and operational reporting from austere and crisis settings
Pharmaceutical Inspection Co-operation Scheme standards — PIC/S. International standards for pharmaceutical manufacturing and distribution inspection
Sphere Handbook — Sphere Association. Minimum standards for humanitarian health, water and sanitation response
Global Burden of Disease results — Institute for Health Metrics and Evaluation. Modelled health burden estimates with uncertainty intervals by country

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: facility capability mapping, evacuation modelling and refreshed country medical annexes for duty of care. Explore the platform, or browse the rest of the library by following any tag above.