Opens in a new tab

Epidemiological surveillance

Continuous indicator monitoring and statistical detection of deviations

What it is

Systems for the continuous monitoring of health indicators over time series, with statistical detection of deviations from expected behaviour.

Aberration detection algorithms and the integration of multiple data sources for an up-to-date picture of the epidemiological situation.

Objectives

  • Detect deviations in health indicators from their expected pattern at an early stage.
  • Monitor time trends in diseases and health events to inform policy.
  • Provide an up-to-date picture of the epidemiological situation to guide resource allocation.
Key points

Epidemiological time series analysis

  • Incidence time series, identifying trend, seasonality and cyclical patterns.
  • Expected behaviour established from historical data to set the alert threshold.

Statistical aberration detection

  • Deviation detection algorithms: EARS, the Farrington algorithm, CUSUM.
  • Thresholds based on historical percentiles or on predictive models of the expected value.

Source integration

  • Combining multiple sources: case notifications, laboratories, emergency departments, primary care.
  • Harmonising definitions and reporting frequencies into a coherent surveillance series.

Dashboards and alerts

  • Interactive dashboards for monitoring indicators in near real time.
  • Automated alerts when the defined thresholds are exceeded.

What it is for

  • Know when a health indicator moves outside its expected range, without waiting for the deviation to become obvious in the monthly report.
  • Turn data you already collect routinely, such as case notifications, emergency department or primary care data, into a surveillance system that integrates them and monitors them continuously.
  • Have an up-to-date, visual picture of the epidemiological situation to decide where to look and where to step up, on a statistical basis rather than on impressions.
Why choose this service

A rise is easy to recognise once it is large. The value lies in detecting it while it is still small

Eyeballing an indicator picks up a deviation once it is undeniable, which is usually too late. A surveillance system defines statistically what is "expected" at each point in the year and flags when an observation moves outside that range, separating the signal from normal fluctuation.

A defined expected value, not a hunch

To know whether a value is anomalous, you need a model of what is normal. We build the expected behaviour of each indicator from its history, incorporating trend and seasonality, so that the alert is triggered against a statistical reference and not against a feeling that "this month looks high".

Established aberration detection algorithms

Deviation detection in surveillance draws on established, widely used methods such as EARS, Farrington or CUSUM, rather than improvised rules. We select and calibrate the algorithm to suit the series and its reporting frequency, setting the balance between sensitivity and false alarms according to what each one costs the system.

Several sources, one coherent series

Useful surveillance rarely draws on a single source: case notifications, laboratories, emergency departments and primary care look at the same thing from different angles. We harmonise definitions and reporting frequencies to integrate them into a coherent series, so that a signal is confirmed or ruled out by cross-checking sources rather than relying on just one.

From algorithm to dashboard

A surveillance system is only useful if the people who make decisions read it. We deliver detection built into interactive dashboards with automated alerts when thresholds are exceeded, so that the system runs continuously rather than as a one-off analysis that is out of date on delivery.

Our process

What working with us looks like

We apply our D²I (Data to Insights) methodology to every service. A structured, iterative and transparent process that turns complex data into actionable knowledge.

01

Kick-off and problem definition

We meet with you to understand the clinical problem, the data available and the objectives of the project. We agree on deliverables, timelines and communication channels, and we sign whatever confidentiality agreements you need to protect your data.

02

Data review and preparation

We assess the quality of your data, identify inconsistencies and limitations, and structure the data for analysis. If critical information is missing, we tell you before going any further. We document every cleaning decision so that the process is traceable and reproducible. In epidemiological surveillance, this includes harmonising the different sources into a coherent series, cleaning and aligning their definitions and reporting frequencies, and reconstructing a long enough history to estimate the expected behaviour of each indicator.

03

Analysis and modelling

We apply the statistical methodology that fits your questions. We work iteratively: we share preliminary results with you, discuss the findings and adjust the approach where needed. We do not work in the dark until the final delivery. For this service, we model the expected value with trend and seasonality, calibrate the aberration detection algorithms to balance sensitivity against false alarms, and leave the system running in a dashboard with threshold-based alerts.

04

Communicating results

We turn the findings into the format you need: a technical report, tables and figures for publication, an interactive dashboard or an executive presentation. We always include the clinical interpretation, not just the figures.

05

Impact review session

30 days after delivery we meet with you again for a 60-minute strategy session. By then you have had time to present the results internally, the real implementation questions have come up and you can assess the impact of the work with some perspective. We answer your questions, adjust interpretations where necessary and agree together on the way forward.

This is our general process. If you want to understand how we apply it technically to each type of analysis, see our full D²I methodology.

Have a data project on your hands?

Tell us about your case and we will work out together how to approach it.

Book a session
FAQs

Frequently asked questions

I already review my health indicators every month. What does a surveillance system add?

It adds a statistical reference for what is "expected" at each point in time, so that a deviation can be detected before it becomes obvious to the eye. It applies when health indicators are monitored routinely and you want to react earlier, not once the rise is undeniable. Eyeballing an indicator or waiting for the monthly report picks up the anomaly late, because the eye only picks out what already stands out clearly. A surveillance system defines the expected behaviour of each indicator from its history, with its trend and seasonality, and flags when an observation moves outside that range, separating a statistically relevant signal from the fluctuation to be expected in the series. The difference is moving from "this month looks high" to "this value is outside the expected range for this time of year, based on the historical data", which is a basis for deciding where to look.

How is "expected" defined, so that you know when a value is a real deviation?

The expected value is modelled from each indicator's history, incorporating its trend and seasonality, so that the reference takes into account that what is normal at one time of year is not normal at another. This applies to all surveillance based on health time series. Without a model of what is normal, you cannot judge whether a value is anomalous: a value that looks high may be entirely expected for its season, and one that looks normal may be a deviation if it should have been low. Alert thresholds are then set from that expected behaviour, either with historical percentiles or with models that predict the expected value for each point in time. The alert is thus assessed against a constructed statistical reference, not against a hunch. The quality of that reference depends on having a sufficient and consistent history: with short or highly irregular series, the expected value is estimated with more uncertainty.

Which algorithms do you use to detect deviations, and why not a simple rule?

We use aberration detection algorithms that are established and widely used in surveillance, such as EARS, the Farrington algorithm or CUSUM, rather than improvised rules like "raise an alert if it goes up by 20%". This applies to the statistical detection of deviations in surveillance series. A fixed rule ignores the seasonality and inherent variability of each series, and produces either too many false alarms or too many late warnings. Depending on the algorithm chosen, these methods compare observations with expected references or thresholds built from historical data, and they are designed for different profiles: detecting gradual changes, sudden jumps or departures from a seasonal pattern. The algorithm is chosen and calibrated to suit the series and its reporting frequency, setting the balance between sensitivity and false alarms according to what each one costs the system. There is no single optimal algorithm: there is a suitable one for each type of indicator and surveillance question.

My alerts go off too often, or too late. How do you adjust that?

By adjusting the balance between sensitivity and false alarms, which is the central decision in any alert system: increasing sensitivity to possible deviations means tolerating more false alerts, and reducing false alarms means risking later detection. This applies to any surveillance system with alert thresholds. There is no universal sweet spot: the right balance depends on what each type of error costs the particular system. An alert that fires too often overwhelms whoever receives it and ends up being ignored; one that fires too rarely comes too late to act on. Calibration sets the thresholds and the algorithm's parameters with two things in mind: that asymmetric cost, meaning whether a false alarm or a delay is worse in each case, and the real response capacity of whoever receives the alert. The aim is not to eliminate both errors, which is impossible, but to place them where they are manageable for the use the system will be put to.

My data come from different sources (case notifications, emergency departments, primary care). Can they be monitored together?

Yes. In fact, robust surveillance rarely rests on a single source: case notifications, laboratories, emergency departments and primary care can provide complementary signals about the same phenomenon or related ones, and combining them lets you corroborate a signal instead of depending on a single route. This applies when several sources record related indicators with different reporting frequencies and definitions. The work consists of harmonising those definitions and frequencies to build a coherent surveillance series or set of indicators, so that the sources are comparable and can be cross-checked. This matters because a signal that appears in only one source may be an artefact of that source, such as a change in how it is recorded, whereas checking that it appears consistently across several sources makes it more credible. The client provides the sources and knows how they are generated; the service integrates and harmonises them and builds the series or set of indicators that surveillance runs on.

Does this detect outbreaks? How far does it go, and what stays in my hands?

This service detects statistical signals of indicators deviating from their expected behaviour and issues alerts on them; it provides the surveillance and alert system, not the epidemiological field response. This is an important clarification of scope. What the service delivers is the statistical layer: it models the expected value, detects when an indicator moves outside its range, integrates the sources and leaves the system running with its alerts. What it does not do is the epidemiological investigation that follows a signal, such as contact tracing, investigating the source or mode of transmission, or intervening in the field. That work belongs to the client's public health team, who know the context and have the competence and the mandate to act. The distinction protects the client: a statistical alert shows where and when to look first, but the epidemiological decision and the response are theirs. The service flags a statistical deviation worth reviewing; the public health interpretation and the action are the client's.

How does epidemiological surveillance differ from search-based infodemiology, if both use time series?

They share time series methods, but they differ in the data they monitor. Epidemiological surveillance works on health indicators recorded by the health system, such as incidence, emergency department, laboratory or primary care data, in other words notified cases and health events. Search-based infodemiology works on web search volume, an indirect signal of the interest or concern of people who search online, not a record of cases. They do not answer the same question: surveillance detects deviations in recorded health indicators; search-based infodemiology captures the perception dimension from what people search for. The two can complement each other, since the search signal can run ahead of the healthcare signal in some settings, but one monitors notified health data and the other an indirect syndromic signal. If the question is about how recorded cases or health events evolve, it is epidemiological surveillance; if it is about the search interest of people searching online, it is search-based infodemiology.

What do you deliver, and in what format is the surveillance system handed over?

We deliver a statistical surveillance system configured for the agreed sources and reporting frequency, designed to run continuously rather than as a one-off analysis that is out of date on delivery. It includes a model of each indicator's expected behaviour, calibrated aberration detection algorithms, integrated time series and a dashboard with alerts when observations cross the defined thresholds. The system can update only as quickly as its sources: near-real-time data allow near-real-time monitoring, while weekly data produce a weekly view. We document the assumptions, thresholds and sensitivity calibration so that they can be reviewed and recalibrated as the series change. We build and configure the statistical layer; epidemiological review of each alert and the response remain with the client, because an alert is a signal of deviation worth reviewing, not confirmation of an outbreak.

Shall we talk?

Tell us what you are working on and we will give you a straight answer on how we can help.