Homeland Security and HIM. Appendix B: Syndromic Surveillance Systems in Bioterrorism and Outbreak Detection

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

Editor's note: This document is an appendix to the practice brief "Homeland Security and HIM," Journal of AHIMA vol. 76, no. 6 (2004).

The result of recent events related to bioterrorism and the sudden emergence of outbreaks of West Nile virus, monkey pox, anthrax, and severe acute respiratory syndrome (SARS) have prompted health agencies to seek alternative methods of disease surveillance.

The most common method is the surveillance system, also called "syndromic surveillance." Its aim, according to the Division of Public Health Surveillance and Informatics from the Centers for Disease Control and Prevention (CDC), is to monitor "non-specific clinical information that may indicate a bioterrorism-associated disease before a specific diagnosis is made."1 The CDC defines syndromic surveillance as the use and collection of health data that precede diagnosis and alert public health departments to respond immediately if an outbreak threatens to affect a community.2 Two factors have influenced development of new syndromic systems: the emerging threat of bioterrorism and the growing availability of electronic health data.

Historically, syndromic surveillance has been used specifically to investigate and target potential outbreak cases. Recently, the use of syndromic surveillance has been explored more closely by clinicians and public health agencies to detect and respond more effectively to bioterrorism.

In response to the need for more information in syndromic surveillance systems, the CDC decided to provide information and guidance to public health practitioners and healthcare agencies interested in implementing a syndromic surveillance system in their own setting. The CDC, along with federal, state, local agencies, academia, the business sector and the military, has designed what they call a "draft framework for evaluating syndromic surveillance systems for bioterrorism preparedness." Although it is still a work in progress, the main goal of the draft is to improve and transform the framework into useful guidelines for evaluating early detection surveillance, according to the CDC.3

The increasing availability of electronic health data facilitates the implementation of syndromic systems in healthcare settings and makes it possible for healthcare providers to transmit information "real time."

Healthcare providers have considered implementing syndromic systems in their settings for three reasons:

  • to gather clusters of data indicative of early stages in an outbreak
  • to facilitate disease case detection and case management, outbreak detection, and outbreak management
  • to trigger statistical alarms to the users and provide continuous monitoring of disease indicators, either in real time or on a daily basis

For healthcare providers, the use of a syndromic system provides a more effective way of collecting data than would "otherwise be possible with the use of traditional public health methods (e.g., by reportable disease surveillance, telephone consultation, etc.)." 4

What makes a syndromic surveillance unique from other systems are the indicator data types used to collect health information. The data types used in syndromic systems, according to the CDC, can range from "events preceding clinical diagnosis; tests requests, emergency room chief complaints, clinical impressions on ambulance run sheets, prescriptions filled, retail drug and product purchases, school or work absenteeism, and constellations of medical signs and symptoms in people seen in various clinical settings."5

The Use of ICD-9-CM Coding in Syndromic Systems

Recent events have redirected public health departments to seek alternative methods of surveillance systems for disease reporting.

The most common classification method used in syndromic systems is the International Classification of Diseases, Ninth Revision, Clinical Modification (ICD-9-CM), which can be easily extracted from outpatient visit records or emergency room discharge data. The advantage of using ICD-9-CM codes in syndromic surveillance systems is that these codes are already available in healthcare systems across the country. ICD-9-CM codes are also used in a variety of clinical settings such as outpatient, inpatient, and emergency departments. Most of the time these codes are available electronically and can be shared among health information systems.

In 1999 the CDC developed a set of syndrome categories identifying clinical presentations associated with bioterrorism-related conditions (see Text-based Syndrome Case Definitions and Associated Category A Conditions", below). Later, a multi-agency working group consisting primarily of the CDC and the Department of Defense and a few other investigators was formed to develop syndrome groups using ICD-9-CM codes (see "Fever ICD-9-CM Code List"). The codes were categorized into three sections, based on the "overall association with a syndrome or specific disease and by observed frequency of code usage in three clinical data sources representing discharge diagnosis for outpatient visits and emergency department visits."6

The following are the categories defined within syndrome groups:

  • Category 1: Consists of codes that reflect general symptoms of the syndrome group and also include codes for the bioterrorism disease of highest concern or those diseases highly approximating them
  • Category 2: Consists of codes that might normally be placed in the syndrome group but daily volume could overwhelm or otherwise detract from the signal generated from the Category 1 code set alone
  • Category 3: Consists of specific diagnoses that fit into the syndrome category but occur infrequently or have very few counts7

Further analysis of the syndrome groups will be needed in the future, according to the CDC, as the frequency of code usage changes and varies by data source, thus determining what codes are best incorporated in a particular syndromic system.

The CDC recommends that prior to implementing the use of ICD-9-CM codes in syndromic surveillance systems, healthcare providers must assess how the use of these codes will help accomplish the goals of a syndromic surveillance system in their own settings. If ICD-9-CM codes have not been adapted into a health information system, this would not be the best method in a syndromic surveillance system. Time is critical in syndromic systems, and ICD-9-CM codes must be available immediately.

Text-based Syndrome Case Definitions and Associated Category A Conditions

Syndrome Definition Category A Condition
Botulism-like ACUTE condition that may represent exposure to botulinum toxin
ACUTE paralytic conditions consistent with botulism: cranial nerve VI (lateral rectus) palsy, ptosis, dilated pupils, decreased gag reflex, media rectus palsy
ACUTE descending motor paralysis (including muscles of respiration)
ACUTE symptoms consistent with botulism: diplopia, dry mouth, dysphagia, difficulty focusing to a near point
Lymphadenitis ACUTE regional lymph node swelling and/or infection (painful bubo--particularly in groin, axilla, or neck) Plague (Bubonic)
Localized Cutaneous Lesion SPECIFIC diagnosis of localized cutaneous lesion/ulcer consistent with cutaneous anthrax or tularemia
ACUTE localized edema and/or cutaneous lesion/vesicle, ulcer, eschar that may be consistent with cutaneous anthrax or tularemia
INCLUDES insect bites
EXCLUDES any lesion disseminated over the body or generalized rash
EXCLUDES diabetic ulcer and ulcer associated with peripheral vascular disease
Anthrax (cutaneous)


Fever ICD-9-CM Code List

020.2 Plague, septicemic 1
020.8 Other types of plague 1
020.9 Plague NOS 1
021.8 Tularemia NEC 1
021.9 Tularemia NOS 1
022.3 Anthrax, septicemia 1
022.8 Anthrax, other specified 1
022.9 Anthrax, unspecified 1
038.3 Anaerobes septicemia 1
Source: "Syndrome Definitions." Appendix. Available at http://www.bt.cdc.gov/surveillance/ syndromedef/word/syndromedefinitions-app-fever.doc.

The RODS System

Another method applied in syndromic surveillance is called the Real Time Public Health Surveillance System (RODS). Michael Wagner, MD PhD, director of the RODS Laboratory in the University of Pittsburgh, and associate director Fu-Chang Tsui, PhD, say that the RODS system has been used in settings where a large population may be exposed to a bioterrorism attack.8 The main objective of the RODS system is to provide an early alert to larger exposure or outbreaks and bioterrorism. In February 2002 the RODS system was used during the winter Olympics in Salt Lake City, UT. The RODS system showed that real-time reporting could be applied to hospital data.

A key component of the RODS system is the HL7 message protocol. Wagner and Tsui explain that HL7 has proven to be an effective method of transferring health information electronically and it can be easily integrated into the mainstream.

In December 2003 the RODS system became available free of charge to any healthcare agency interested in adapting the program into their system. Its major barrier has been the inability to have reliable data access. Without reliable data access, real-time reporting cannot be accomplished. Wagner and Tsui believe that it is feasible to establish a permanent real-time link between public health and healthcare providers with the use of the RODS system. The system can be easily implemented in a syndromic surveillance system with already existing methods (HL7) currently used by the healthcare community.

Evaluating the Use of Decision Support Systems in Syndromic Surveillance Systems

Some healthcare agencies have questioned the ability to use decision support systems (DSSs) for bioterrorism syndromic surveillance.

The Agency of Healthcare Research and Quality (AHRQ) has stated that information technologies and decision support systems are valuable tools that can help clinicians and public health officials prepare more effectively in the event of a bioterrorism attack.9 The agency evaluated the potential value of DSSs in bioterrorism attacks and provided an evaluation it hopes will be helpful to clinicians and public health officials.

The evaluation assessed 217 DSSs to determine their full potential in bioterrorism events. After investigation, AHRQ concluded that DSSs can be of great help in the detection, diagnosis, management, prevention, surveillance, and communication in the event of a bioterrorism attack. However, according to AHRQ, DSSs were not designed to be used primarily as bioterrorism surveillance systems. As a result, AHRQ developed the following criteria for clinicians and public health officials interested in evaluating the performance of their DSSs as a bioterrorism surveillance system:

  • All included systems: The purpose of the system, type of hardware required, type of safety measures used to protect samples and data collected, timeliness, and measures to ensure quality and accuracy of the system

  • Detection systems: Portability, ability to multitask samples simultaneously, capability to identify a number of biothreat agents, as well as toxins and organism

  • Diagnostic, management and prevention: Features required in a DSS. AHRQ suggests either manually entering signs and symptoms into the system or integrating an electronic medical record system to capture all types of data from patient information

  • Surveillance systems: Type of surveillance, data collection needed to detect and respond to an outbreak

  • Reporting and communication systems: The type of information needed to be communicated by the system, the intended recipient and sender, and the source of transmission; whether information is available online or transmitted to recipients via e-mail, fax, or phone10

Other Surveillance Systems of Interest

AHRQ believes other types of syndromic surveillance systems may be useful in the early detection of outbreaks and bioterrorism.

Surveillance Networks of Sentinel Clinicians

Clinicians are usually the first ones to recognize early signs of unusual or suspicious illnesses. A clinician network can provide useful reports of clinical impressions and may become a valuable source of surveillance health data in the detection of bioterrorism-related diseases. Eurosentinel is a well-known network of sentinel clinicians that have been recognized for their timely data.11

Influenza Surveillance

AHRQ maintains that influenza surveillance systems are effective in bioterrorism surveillance for three reasons.

  • Sentinel clinicians are experienced in applying a case definition to a clinical population for the collection of public health data. Considering that many bioterrorism-related diseases present themselves initially as flu-like symptoms, this type of surveillance data may become useful to public health officials and clinicians.
  • Already, some influenza surveillance systems have integrated both clinical and laboratory data into their programs to detect early outbreaks more effectively. Surveillance for bioterrorism may be aided by similar integration of multiple data sources.
  • Bioterrorism surveillance systems require an integrated and coordinated global effort to succeed. Influenza surveillance systems can serve as models to new bioterrorism surveillance programs, given their history as integrated surveillance systems across countries.12

Laboratory Surveillance

Laboratory surveillance systems are considered key components in bioterrorism detection programs. Their ability to detect uncommon organisms like anthrax, smallpox, and Ebola and common organisms with antimicrobial resistance programs brings valuable information to surveillance systems. Laboratory surveillance systems feature timely collection, analysis, and reporting of pathogens and antimicrobial resistance, thus accelerating the instant detection of bioterrorism agents.13

Hospital-based Surveillance

Two factors make hospital-based surveillance systems useful in early detection of bioterrorism attacks:

  • They can identify clusters of cases among recently admitted patients, suggesting possible community outbreaks in a local region.
  • They may be able to identify clusters of cases within the hospital suggestive of inpatients with unrecognized communicable diseases.14

However, hospital-based surveillance systems are most commonly used in hospital settings for infection control. Their use in bioterrorism events still remains undetermined.15

Case Study: Nashville Metro Public Health Department

Nationwide, hospitals and health departments are working together to build integrated surveillance systems that detect more than just hospital information. For instance, the Nashville Metro Public Health Department is currently tracking emergency room visits, 911 calls, and nonprescription drugs filled at pharmacies in order to identify early health trends that may pose danger to the general public, according to the Nashville City Paper.16

The information gathered from these sources feeds into the city's health department on a daily basis. Once the data gets processed, it is analyzed by a software program and trained experts looking for healthcare trends. If a significant trend is found, the health department is alerted by automated alarms triggered by the software program or by staff analyzing the data.17

Joseph Schuchter, an epidemiologist for the Metro Health Department, told the paper that the syndromic surveillance system monitors health information on a daily basis and helps detect illnesses in a local region. "It provides an early indicator so we can react to an emerging problem quickly," he said.18

The syndromic surveillance system is called the Early Aberration Reporting System (EARS) and was implemented in Nashville in November 2001. Although it was originally designed as a bioterrorism surveillance system, it has been recently updated to identify the latest outbreaks affecting the community (e.g., flu, SARS, and other epidemic conditions).

EARS has become an integrated system used by local hospitals to facilitate communication among hospitals and health agencies. All hospitals in the Nashville area participate in the EARS program (with the exception of Nashville's Veterans Administration Hospital). Some have even developed their own surveillance system to complement the EARS program. Vanderbilt Medical Center coordinates its own system with EARS by collecting information on every patient's sex, age, and chief complaint. Vanderbilt hopes to acquire a database that can hold up to five years of patient information to analyze and target trends of seasonal sickness in the community.19

Currently, other cities are adopting the EARS program into their own surveillance systems. In Tennessee, Memphis, Knoxville, and Chattanooga are adopting the EARS program. The program is also being implemented in New York, Philadelphia, San Diego, and Chicago.

In addition to taking health information from hospitals, EARS can also capture information from a variety of settings. It can receive data from other sources, such as 911 systems (symptoms with preset codes) and public schools (absentee information). It is also connected to a national consortium of states that gather non-prescription drug retail information that is stored at the University of Pittsburgh. Reports are sent on a daily basis to the health department and all data received from these sources are analyzed daily for significant trends.

While syndromic surveillance "is not designed to replace traditional methods of monitoring, it supplements them as a real time detection tool," Schuchter said.20

Case Study: The Washoe District Health Department and Clark County Health District

The Reno Gazette-Journal reports that health departments are already taking advantage of the funding for syndromic surveillance systems provided by the CDC for bioterrorism preparedness programs. One of them is the Washoe District Health Department, which is using its funding to develop a syndromic surveillance system.21

In March 2003 the Clark County Health District became the first agency to implement a syndromic surveillance system in the state of Nevada. The surveillance system receives daily electronic reports from hospital emergency rooms, clinics, outpatient settings, and urgent care clinics on every person seen in the previous 24 hours. An important part of the information is the patient's chief complaint.22

Clark County's syndromic system captures preliminary clinical data associated with outbreaks and bioterrorism-related conditions. The county monitors symptoms that may be related to an outbreak, like fever, sore throat, vomiting, and neurological complaints like headaches and stiff neck. These types of symptoms may be an indication of meningitis or exposure to a bioterrorism agent, and they are considered prediagnosis data. The value of these symptoms is greater because final diagnosis may take up to three days, especially if further testing is required.23

With the help of syndromic systems, trends are detected faster than they would be using traditional methods. For example, bioterrorism-related conditions like bubonic plague or smallpox usually display flu-like symptoms in their early stages. Thus, the paper reports, a large number of flu-like symptoms in the summer would alert the department to investigate.

The Clark Country syndromic system has already helped to identify recent outbreaks in the community. Norwalk virus and chicken pox in the area were brought to the attention of public health by the system. The Clark County Health District views the system as a "smoke alarm" because syndromic surveillance helps identify outbreaks and apply measures in order to protect the safety of their community.24

Privacy and Patient Confidentiality Issues in the Use of Syndromic Surveillance Systems

The importance of protecting the privacy and confidentiality of patient health information has become greater as we manage integrated systems with sensitive health data. During a bioterrorism event, clinicians must communicate with their patients in a timely, effective, and safe manner. Technology has facilitated ways of communicating among clinicians and patients, and laws (such as HIPAA) have been created to protect patient confidentiality. Nevertheless, communication involving bioterrorism-related conditions will require more sensitive measures. Strong technological security measures must be enforced to protect patient privacy and confidentiality in any bioterrorism surveillance system.25

Although the public and the healthcare community are concerned about public health authorities having total access to a patient's medical record, in most cases the health information used in syndromic systems is deidentified when transmitted to an outside source. Deidentification requires the removal of 18 individual identifiers to ensure patients cannot be identified. Section 164.512 of the HIPAA privacy rule states that disclosure of health information may be permitted when:

  • Required by law
  • Needed for surveillance, investigation, prevention activities, partner notification, and vital statistics
  • Necessary to avert a serious threat to health or safety

Nevertheless, the collection of health data is intended to collect clusters of cases, not individual cases. Syndromic systems are not set up to track individual personal information, rather they focus on recognizing general trends.26

While the full potential of syndromic systems has not been completely established, many areas still need to be evaluated. For instance, the questions of identifying potential false alarms in syndromic systems and of the cost of implementing and managing a syndromic surveillance system in a healthcare setting need to be addressed.27 It is necessary to continuously assess syndromic system performance and potential to effectively detect, identify, and respond to an outbreak in its early stages rather than in a late stage.28

Syndromic surveillance brings reassurance to a community. For it to be reliable, it must demonstrate the capability to detect outbreaks of any kind or size that are usually overlooked by commonly used clinical systems. Nevertheless, the nation's capacity to respond to bioterrorism depends in part on the ability of clinicians and public health officials to detect, manage, and communicate during a bioterrorism event.29

Improving communication among public health departments and healthcare practitioners will remain a valuable tool in bioterrorism preparedness. It is imperative that every barrier to integration of surveillance systems between healthcare providers and health agencies be removed to preserve a safer and healthier community.


  1. Centers for Disease Control and Prevention (CDC). "Syndrome Definitions for Diseases Associated with Critical Bioterrorism-associated Agents." October 23, 2003. Available online at http://www.bt.cdc.gov/surveillance/syndromedef/word/syndromedefinitions.doc.
  2. CDC. "Syndromic Surveillance: An Applied Approach to Outbreak Detection." Available at the CDC Web site at http://www.cdc.gov/epo/dphsi/syndromic.htm.
  3. Centers for Disease Control and Prevention. "Framework for Evaluating Public Health Surveillance Systems for Early Detection of Outbreaks: recommendations from the CDC Working Group." MMWR 2004; 53(No. RR-5): 1-13. Available online at http://www.cdc.gov/mmwr/PDF/rr/rr5305.pdf.
  4. Ibid.
  5. Ibid.
  6. CDC. "Syndrome Definitions for Diseases Associated with Critical Bioterrorism-associated Agents." October 23, 2003. Available at the CDC Web site at http://www.bt.cdc.gov/surveillance/syndromedef/word/syndromedefinitions.doc.
  7. Ibid.
  8. Wagner, Michael, Fu-Chiang Tsui, and Jeremy Espino. "The RODS System." Paper presented at the National Syndromic Surveillance Conference, New York Academy of Medicine, New York, October 2003. Available online at http://www.syndromic.org/pdf/con2-MW-2.pdf. [accessed 5/26/04]
  9. Agency for Healthcare Research and Quality. "Bioterrorism Preparedness and Response: Use of Information Technologies and Decision Support Systems." Evidence Report/Technology Assessment no. 59, June 2002. Available online at http://www.ahcpr.gov/clinic/epcsums/bioitsum.pdf.
  10. CDC. "Syndrome Definitions," 3.
  11. Ibid., 5.
  12. Ibid.
  13. Ibid.
  14. Ibid., 6.
  15. Ibid.
  16. Owens, M.B. "'Disease Tracker' Knows If You're Ill." Nashville City Paper, Dec. 10, 2003. Available online at http://www.nashvillecitypaper.com/ index.cfm?section_id=9&screen=news&news_id=28985. [accessed 5/26/04]
  17. Ibid.
  18. Ibid.
  19. Ibid.
  20. Ibid.
  21. Powers, Lenita. "Washoe Developing System to Track Patients with Symptoms of Certain Illnesses." Reno Gazette-Journal, Dec. 13, 2003. Available at http://www.rgj.com/news/ stories/html/2003/12/13/59120.php?sp1=rgj&sp2=News&sp3=Local+News&sp5= RGJ.com&sp6=news&sp7=local_news&jsmultitag=news.rgj.com/news/local.
    [accessed 5/26/04]
  22. Ibid.
  23. Ibid.
  24. Ibid.
  25. AHRQ. "Bioterrorism Preparedness and Response."
  26. Owens, M.B. "'Disease Tracker' Knows If You're Ill."
  27. CDC. "Framework for Evaluating Public Health Surveillance Systems for Early Detection of Outbreaks."
  28. Ibid.
  29. AHRQ. "Bioterrorism Preparedness and Response."


Gibson, James, and Dan Drociuk. "Survey of BT Directors on Legal, Confidentiality and HIPAA Issues in Syndromic Surveillance." Paper presented at the National Syndromic Surveillance Conference, New York Academy of Medicine, New York, October 2003. Available online at http://www.syndromic.org/pdf/con2-JG-7b.pdf. [accessed 5/26/04]

Prepared by:

Leticia I. Parks, University of Washington HIA graduate

Source: Parks, Leticia I. "Homeland Security and HIM. Appendix B: Syndromic Surveillance Systems in Bioterrorism and Outbreak Detection" Journal of AHIMA 75, no.6 (June 2004): web extra.