From notification to action: where infectious-disease information chains break

#Question

What has to happen between an infectious-disease notification and a public-health decision?

#Answer in brief

A notification is not yet a clean epidemiological case record. It is an input to a chain. The report must be validated, classified against an applicable surveillance definition, reconciled with previous reports, enriched with information needed for analysis, aggregated according to a defined denominator and time rule, interpreted in context, and connected to an action. Standard case definitions are important because comparable classification is a prerequisite for meaningful surveillance, but classification alone does not solve identity, completeness, delay or interpretation problems.^[1]

A useful information architecture therefore treats every stage as a transformation with provenance—not as an invisible cleaning step.

#The chain

A simplified pathway is:

event
→ notification
→ validation
→ classification
→ deduplication / linkage
→ enrichment
→ aggregation
→ analysis
→ interpretation
→ action

Each arrow can change the meaning of the data.

#1. Event: the process begins before the database

The surveillance object begins with a health event, exposure, laboratory finding, clinical syndrome or other reportable occurrence.

Before any electronic message exists, selection has already occurred. A person may not seek care. A clinician may not request a test. A laboratory may use a method with imperfect sensitivity. Reporting obligations may apply only to a subset of events.

The information system cannot recover every event that was never observed. Its downstream precision should not obscure upstream invisibility.

#2. Notification: a report is a claim requiring context

A notification usually contains some combination of identifiers, dates, clinical information, laboratory results, exposure information and reporting metadata.

At this stage, questions include:

• Is the report complete enough to process?
• Is the date an onset date, test date, diagnosis date or notification date?
• Is the laboratory result preliminary or final?
• Has the event already been reported through another route?
• Does the report refer to a person, specimen, episode or encounter?

Calling the record a "case" before answering those questions can create false certainty.

#3. Validation: structural correctness is not epidemiological validity

Validation can mean several different things:

• the message conforms to a technical schema;
• required fields are present;
• dates are internally plausible;
• codes are valid;
• the reporter is authorized;
• the event is epidemiologically plausible.

These are not interchangeable.

A record can pass every technical validation rule and still be a duplicate, an old episode, a non-case, or irrelevant to the surveillance objective.

#4. Classification: case definitions create comparability

ECDC notes that EU case definitions provide standardized criteria for identifying and reporting communicable diseases at EU/EEA level, helping ensure similar classification across Member States.^[1]

Classification may combine clinical, laboratory and epidemiological criteria and may distinguish possible, probable and confirmed states.

The important methodological point is that classification is purpose-specific. A surveillance case definition is not necessarily identical to a clinician's diagnostic judgment. It creates an operational rule for a defined surveillance function.

If the definition changes, trend interpretation needs a version boundary. A rise after broadening eligibility is not automatically a rise in disease occurrence.

#5. Deduplication and linkage: counting records is not counting events

The same infection can produce:

• an initial clinical notification;
• one or more laboratory messages;
• updates to classification;
• repeat encounters;
• corrections;
• reports from different institutions.

Without identity resolution, record counts can become event counts by accident.

Deduplication should therefore specify:

• the entity being deduplicated;
• the matching fields used;
• the episode window;
• how uncertain matches are handled;
• whether later records update or create a new episode;
• which source is authoritative when fields conflict.

A deterministic rule may be reproducible and still wrong for edge cases. Human review may be needed for ambiguous linkages.

#6. Enrichment: missing information changes what can be inferred

A minimal notification may support counting but not interpretation.

Age, residence, onset date, vaccination status, travel, exposure, occupation, hospitalization, outcome, genomic information or other variables may be needed depending on the surveillance objective.

Enrichment should not become unlimited data accumulation. Each field should have a defined analytical or operational use. More variables can increase burden, delay and missingness.

WHO's surveillance frameworks emphasize connecting information generation to the actions and users it is intended to support.^[2][3]

#7. Aggregation: every table hides rules

Suppose a weekly report says "120 cases."

That number is meaningless without rules:

• week of onset, diagnosis, specimen or notification?
• first report or final classification?
• residence or reporting facility?
• unique people or episodes?
• confirmed only, or probable plus confirmed?
• latest available status or status at the end of the week?

These choices can materially change a trend.

Aggregation is therefore a methodological transformation, not just a database query.

#8. Analysis: denominators and delays matter

Counts can answer some questions. Rates require denominators aligned to the numerator.

If the system asks whether risk differs by age, geography or vaccination status, the denominator must represent the population that could generate the numerator under the same definitions.

Reporting delay can distort recent periods. A falling curve may reflect incomplete arrival of reports rather than falling incidence. Analysts should distinguish event time from observation time when delay is material.

#9. Interpretation: surveillance is not self-explanatory

An observed increase can arise from:

• more disease;
• broader testing;
• improved reporting;
• a changed case definition;
• catch-up of delayed records;
• a new laboratory;
• improved deduplication;
• altered health-care seeking;
• real clustering in a subgroup.

The analysis should therefore carry operational context with the number.

WHO's 2025 multisource approach explicitly emphasizes synthesis of multiple information sources around decision questions.^[3] Agreement across sources can strengthen interpretation; disagreement can reveal which part of the information chain changed.

#10. Action: close the loop

Surveillance becomes public-health practice when information reaches a responsible user in time to influence prevention, investigation, communication, resource allocation or evaluation.

WHO's older surveillance-and-response framework already stressed accurate, timely and reliable information for effective response and accountability.^[2]

A system that produces excellent national statistics but cannot support local investigation may succeed at one objective and fail at another.

#A synthetic data incident

Imagine that weekly notifications of a disease appear to double.

Investigation finds:

• a new laboratory began electronic reporting;
• older paper reports were entered retrospectively;
• the case definition was unchanged;
• deduplication initially treated laboratory and clinical notifications as separate events;
• after linkage, the apparent doubling becomes a 20% increase;
• the remaining increase is concentrated in one age group and is also visible in laboratory positivity.

The correction is not merely "clean the data." The episode reveals three separate issues:

1. onboarding changed source coverage;
2. backlog entry changed observation time;
3. linkage rules changed event counts.

A trustworthy report should preserve those transformations so a future analyst can reconstruct why the curve changed.

#Design principle: version the meaning, not only the software

For each material field or rule, maintain:

• definition;
• source;
• allowed values;
• effective date;
• transformation logic;
• known limitations;
• version history.

This matters particularly for case definitions and episode rules. ECDC's case-definition pages make clear that operational definitions can be updated as public-health needs and scientific knowledge change.^[1]

A versioned information chain lets analysts distinguish epidemiological change from semantic change.

#Practical audit questions

For any infectious-disease flow, ask:

• What exactly enters the system?
• What is the unit: person, episode, specimen, notification, encounter?
• Which case definition and version applies?
• How are duplicates and updates reconciled?
• Which fields are enriched later?
• Which dates drive routine reports?
• Which denominator matches each numerator?
• How are late reports handled?
• Who interprets anomalies?
• Which decision is expected to follow?

If these questions cannot be answered, more automation can make the uncertainty faster without making it smaller.

#Limitations and uncertainty

This article describes a generic information architecture, not a jurisdiction-specific legal or technical reporting specification. Mandatory notification rules, identifiers, case definitions, privacy requirements, data-retention rules and permissible linkage vary by country and disease. ECDC's EU case definitions apply to EU/EEA surveillance and may not be the operational definitions used for every local purpose.^[1] WHO guidance is used here for system-level principles; disease-specific current guidance should take precedence where it defines more precise surveillance processes.