Outbreak investigation is detective work, but it is disciplined detective work. There are established steps, defined analytical tools, and specific microbiological methods that guide the process. The goal is to identify the source and mode of transmission quickly enough to implement control measures that prevent further cases, and to establish the cause of illness definitively enough to be confident in the control measures chosen.
The WHO Outbreak Investigation Steps
The WHO and CDC both describe outbreak investigation as a stepwise process, though in practice many steps happen simultaneously rather than sequentially.
Step 1: Verify the outbreak. Before assuming an outbreak exists, confirm that the number of cases exceeds what would be expected at baseline. An apparent cluster of gastroenteritis cases may represent normal background incidence rather than a true outbreak if the usual rate is high. The baseline needs to be established from historical surveillance data.
Step 2: Confirm the diagnosis. Clinical and laboratory diagnosis must be established. Are these cases truly the same illness? Is the laboratory result reliable? Are the cases being identified consistently using the same diagnostic criteria? In a hospital outbreak, case definitions must be established: exactly what clinical features and/or laboratory results define a case.
Step 3: Establish a case definition. A case definition specifies who counts as a case for investigation purposes, based on person (demographics), place (which ward, which area, which community), and time (onset within a defined period). Case definitions are usually either broad (sensitive, to capture all potential cases early in investigation) or strict (specific, once the probable cause is known).
Step 4: Find all cases. Active case finding searches systematically for additional cases beyond those that presented spontaneously. In a hospital outbreak, this means reviewing microbiology results, nursing handover records, pharmacy dispensing data for relevant treatments, and direct ward surveillance.
Step 5: Describe the outbreak by time, place, and person. This is descriptive epidemiology. The epidemic curve (Epi curve) is drawn: a histogram of case counts over time. The shape of the Epi curve tells you about the transmission pattern.
Reading the Epidemic Curve
The epidemic curve is one of the most powerful rapid diagnostic tools in outbreak investigation.
A point source outbreak (all cases exposed to the same source at one time) produces a sharp, bell-shaped curve with a rapid rise, a clear peak, and a declining tail. The width of the curve approximates the incubation period range for the causative agent. If the exposure is known (a specific meal at a specific time), the peak of the curve corresponds to the most common incubation period from exposure to onset, and this narrows the probable causative pathogen considerably.
A propagated source outbreak (person-to-person transmission) produces a series of peaks: an initial generation of cases from the original exposure, followed by secondary cases in others exposed to those initial cases, then tertiary cases. The peaks are typically separated by an interval approximating the incubation period. A classic propagated curve is seen in norovirus outbreaks in care homes.
A continuous common source (exposure to a contaminated source over an extended period) produces a prolonged plateau of cases rather than a sharp peak, as new cases appear continuously from ongoing exposure.
The Analytical Epidemiology: Case-Control and Cohort Studies
Descriptive epidemiology identifies the pattern. Analytical epidemiology tests specific hypotheses about the source.
A cohort study is used when the group at risk can be defined (everyone who attended the wedding, everyone who ate in the staff canteen on a specific day). All members of the cohort are interviewed about their exposures (which foods they ate, which drinks they had, which activities they participated in) and their illness status. Attack rates are calculated for each exposure and compared between exposed and unexposed members of the cohort. The relative risk (RR) for each exposure is calculated: RR = Attack rate in exposed / Attack rate in unexposed.
A case-control study is used when the population at risk is not fully enumerable (a community outbreak where you cannot identify all people who were exposed). Cases (people who became ill) are compared to controls (people who did not become ill but came from the same population) regarding their prior exposures. The odds ratio (OR) is calculated for each exposure as a measure of association: OR = (odds of exposure in cases) / (odds of exposure in controls).
A statistically significant association between a specific food or exposure and illness (high OR or RR with confidence intervals excluding 1.0 and low p-value) points toward that exposure as the probable vehicle. Microbiological investigation then confirms the causative agent in the suspected vehicle.
The Microbiological Side of Outbreak Investigation
Laboratory support for outbreak investigation includes case specimen collection, environmental sampling, food testing, and molecular typing.
Case specimens: stool, vomit, blood, urine, throat swabs depending on the suspected pathogen and clinical presentation. Standard culture, serology, and where indicated, PCR or metagenomics.
Food and environmental sampling: high-risk leftover food items, food contact surfaces, food handlers' hand swabs and stool specimens, water samples. The same organism in both cases and a food vehicle is strong evidence. Food testing sensitivity is limited because the quantity of pathogen may have declined by the time samples are collected.
Molecular typing links isolates from different cases to confirm they are the same strain (and therefore from a common source) rather than unrelated cases of the same species. Methods: whole genome sequencing (WGS, the current gold standard), pulsed-field gel electrophoresis (PFGE, still used in some settings), multilocus sequence typing (MLST). WGS can determine whether two isolates differ by as few as 0 to 5 single nucleotide polymorphisms (SNPs), making it possible to link cases with extraordinary precision and to distinguish true outbreak clusters from unrelated coincident cases.
Hospital Outbreak Investigation: Special Considerations
Healthcare-associated outbreaks have specific features: the case population is already ill and immunocompromised, the environment is complex with many potential sources, and rapid control is essential because healthcare workers can transmit between patients.
Key initial infection control measures while investigation proceeds: cohort positive patients (separate from non-cases), enhance hand hygiene compliance (directly observe and measure, not just remind), implement contact precautions for confirmed or suspected cases, restrict staff movement between affected and unaffected areas, suspend elective admissions to affected areas if necessary, enhance environmental cleaning with appropriate sporicidal agents if C. difficile or norovirus is suspected.
The infection control team and the microbiology laboratory must work closely throughout: the lab provides rapid results and molecular typing, the infection control team implements control measures and manages communication, the outbreak control team (including hospital management, public health, and infection prevention) coordinates the response.
Frequently Asked Questions
What is an epidemic curve (Epi curve)?
An epidemic curve is a histogram showing the number of cases of an outbreak plotted by time of illness onset. The shape of the curve reveals the transmission pattern: a sharp bell-shaped curve suggests a point source outbreak, a series of recurring peaks suggests person-to-person (propagated) transmission, and a prolonged plateau suggests continuous exposure to a common source.
What is a case definition?
A case definition specifies the clinical and/or laboratory criteria that a person must meet to be counted as a case in an outbreak investigation. It includes criteria for person (demographics), place (where the case must have been), and time (within what date range). Case definitions can be confirmed (laboratory-confirmed illness), probable (clinical criteria without laboratory confirmation), or suspected (exposure without confirmed illness).
What is the attack rate?
The attack rate (AR) is the proportion of people in a defined group who became ill: AR = Number of cases / Total population at risk, expressed as a percentage. Attack rates are calculated for each exposure in a cohort study to identify which exposures are associated with the highest illness risk.
What is the difference between cohort and case-control study in outbreak investigation?
A cohort study follows a defined group of people who were all potentially exposed (for example, everyone who ate at a buffet) and compares illness rates between those who did and did not have specific exposures. It is used when the population at risk can be fully identified. A case-control study compares a group of cases (ill people) to a matched group of controls (non-ill people from the same population) to identify differences in prior exposures. It is used when the full exposed population cannot be enumerated.
What is molecular typing in outbreak investigation?
Molecular typing methods compare the genetic fingerprint of isolates from different cases to determine if they are the same or different strains. In a true outbreak, cases should carry indistinguishable or very similar strains. Methods include PFGE, MLST, and WGS. WGS is now the gold standard, comparing single nucleotide polymorphisms (SNPs) across the whole genome to define clusters with high precision.
What is a point source outbreak?
A point source outbreak occurs when all cases are exposed to a single source at approximately the same time. The Epi curve shows a rapid rise to a sharp peak followed by a tail, occurring within one incubation period. Classic examples: a wedding buffet contaminated with Salmonella, a water supply contaminated with a short-lived pathogen.
What is the role of the public health laboratory in outbreak investigation?
The public health laboratory provides definitive pathogen identification, molecular typing to confirm outbreak strains, testing of environmental and food samples, and coordination of reference testing. It maintains the epidemiological database of organism types circulating in the community, allowing new outbreak isolates to be compared to historical strains and nationally reported cases.
What is whole genome sequencing used for in outbreak investigation?
WGS generates the complete nucleotide sequence of bacterial or viral isolates from outbreak cases and environmental or food sources. By comparing SNP differences between genomes, WGS determines whether isolates are epidemiologically linked (same or very similar genome) or unrelated. WGS can link cases across wide geographical areas with high confidence and can identify transmission routes within hospital settings with precision, including distinguishing different introduction events.
What is index case?
The index case is the first identified case in an outbreak: the person whose illness triggered recognition of the outbreak. The index case is not necessarily the source of infection (they may have been infected by the same source as others) but is the first case identified. Tracing back from the index case and comparing with subsequently identified cases helps build the timeline of exposure and transmission.
What are the control measures in a foodborne outbreak?
Control measures depend on the source identified. If contaminated food is confirmed: remove the food from sale or consumption, trace and recall the product, notify relevant food safety authorities, inform exposed consumers. If a food handler is the source: exclude from food handling until multiple stool cultures are negative. Environmental contamination: deep cleaning and disinfection of implicated premises. Community outbreak: public health messaging, enhanced surveillance, and in some cases (for example, boil water notices) wide-scale environmental control.