Surveillance, epidemics and coordination

1The early warning system (EWARN)

EWARN (Early Warning, Alert and Response Network) is a simplified surveillance system, set up when the national system is no longer functioning. It is based on:

• a short list of priority diseases (acute watery diarrhoea, bloody diarrhoea, measles, malaria, meningitis, acute flaccid paralysis, haemorrhagic fever, acute jaundice);
• standard case definitions, simple and known to all health workers;
• a weekly report from all facilities, including a "zero report" when no cases are seen;
• alert thresholds: a single suspected case of cholera, measles, flaccid paralysis or haemorrhagic fever triggers an immediate alert;
• verification of each alert within 24 hours and a rapid investigation.

Two quality indicators: the completeness and timeliness of reports, ideally at least 80%. A system that receives only one report in two does not see epidemics.

2Responding to cholera

Cholera can kill within hours through dehydration, but the case fatality rate must remain below 1% with good case management. The response combines:

• case management: oral rehydration points (ORS) in the community, cholera treatment units and centres (CTUs, CTCs) for intravenous rehydration with Ringer's lactate for severe cases, antibiotics according to recommendations;
• confirmation by rapid diagnostic tests followed by laboratory culture;
• WASH: water chlorination, disinfection of case households, targeting of the "rings" around cases (CATI), hygiene, safe burials;
• oral cholera vaccine (OCV), requested from the International Coordinating Group (ICG);
• risk communication and community engagement to counter rumours.

A case fatality rate above 1% signals delayed treatment, insufficient access or quality of care that needs to be corrected, often by more ORS points as close as possible to households.

3Responding to measles and other epidemics

In a camp, a single confirmed case of measles justifies a response. Cases are isolated and treated (vitamin A, treatment of complications, nutritional monitoring), the vaccination campaign is launched or completed and active case finding is carried out. For any epidemic, the approach is the same: confirm the outbreak, define cases, describe by time, place and person (epidemic curve, map, age), formulate hypotheses, put control measures in place and monitor the evolution every day.

The International Health Regulations (2005) require States to notify WHO of certain events. NGOs send their alerts to the Ministry of Health and the cluster, never to the media first. Preparedness stocks (cholera kits, rapid tests, vaccines via the ICG) are prepositioned before the high-risk season.

4Health Cluster, HeRAMS and protection of health care

The Health Cluster, led by WHO at global level, coordinates with the Ministry of Health: joint risk analysis, 4W mapping, harmonisation of protocols and medicine lists, response plan, monitoring of gaps and advocacy. The HeRAMS system (Health Resources and Services Availability Monitoring System) records, facility by facility, what is really working: building, staff, equipment, services available, reasons for unavailability. It prevents opening a health post next to a centre that is already working.

Attacks on health care (strikes on hospitals, violence against health workers, obstruction of ambulances, looting) are prohibited by international humanitarian law, as recalled by Security Council resolution 2286 (2016). WHO documents them in its Surveillance System for Attacks on Health Care (SSA). For an NGO: report every incident, protect staff and patients, respect neutrality (no weapons in facilities) and do not suspend care without a continuity plan.

5Setting up an EWARN step by step

An early warning system is designed in two to four weeks and must produce its first weekly bulletin within the first month. The WHO operational guide on early warning alert and response in emergencies describes the approach; it is always carried out under the authority of the Ministry of Health, with support from WHO and the Health Cluster, and aims from the outset at integration into national surveillance.

Step 1: deciding on activation and scope

An EWARN is activated when the national surveillance system is no longer functioning in the affected area, or cannot absorb the population influx, and when the epidemic risk is high. The geographical area, the participating facilities (public facilities, NGO facilities, mobile clinics, then possibly community-based surveillance) and the expected duration are defined.

Step 2: choosing the diseases and case definitions

The list must remain short (8 to 12 events) and be limited to diseases with epidemic potential or high mortality, for which action is possible. The case definitions are those of the Ministry or WHO, printed and posted in every consultation room.

Step 3: organising the data flow

1. Each facility fills in a consultation register in which the diagnosis matches the case definitions.
2. An aggregated weekly form (cases and deaths by event, by age group under 5 and 5 and over) is submitted every Monday before noon for the previous epidemiological week, including a "zero report".
3. An immediate alert form is sent by phone or message within 24 hours for any event with a one-case threshold.
4. The district or site focal point enters the data into a single database (often a DHIS2 module or a standardised cluster spreadsheet), checks quality and follows up with facilities that have not reported.
5. The analysis team produces the bulletin on Wednesday or Thursday.

Step 4: training and supervision

One-day training for clinicians (case definitions, completing forms, alerts), two to three days for focal points (data entry, simple analysis, verification, sample collection). Monthly supervision of each facility, with cross-checking between the register and the weekly form for a sample of weeks.

Step 5: analysing and disseminating every week

• Curves for each event over at least eight weeks, compared with thresholds.
• Proportional morbidity and incidence per 1,000 people per week, when the denominator is reliable.
• List of alerts received, verified within 24 hours, investigated, and their outcome.
• Completeness and timeliness by facility, with follow-up by name of facilities that fail to report.
• Two-page bulletin shared with the Ministry, the cluster and participating facilities, with the actions requested.

An EWARN is only as good as its ability to trigger action. Every bulletin must end with a list of actions, each with a person responsible and a deadline; a verified alert that has not led to any documented decision is a failure of the system, even if the data are perfect.

6Verifying an alert and investigating an outbreak

Most alerts are not outbreaks: case definition errors, double counting, chance clustering. Verification avoids mobilising resources for nothing; investigation, when the alert is confirmed, makes it possible to target the response.

Verification (within 24 hours)

1. Call the clinician or focal point who reported the alert: does the case really meet the definition? What was the date of symptom onset? Where does the patient come from?
2. Look for other cases in the registers of the facility and neighbouring facilities over the past two weeks.
3. Check that a sample has been taken or can be taken, and that the patient is being treated and isolated if necessary.
4. Classify the alert: discarded, pending, confirmed as a signal requiring investigation. Record the decision in the alert log.

Investigation: the classic steps

The line list: the minimum

Identifier (never the name in shared versions), age, sex, place of residence (sector, block), date of symptom onset, date of consultation, key clinical signs, vaccination status if relevant, sample (date, type, result), outcome (recovered, died, ongoing), place of death (facility or community). The date variables make it possible to calculate the time between symptom onset and treatment, a key indicator of access.

Samples

• Cholera: stool samples taken before antibiotics, a rapid diagnostic test on site for orientation, confirmation by culture or PCR; Cary-Blair transport medium for shipment.
• Measles: serum for IgM testing, or throat swab according to the national protocol.
• Meningitis: cerebrospinal fluid, rapid test if available, transport medium for culture.
• Transport in triple packaging in accordance with the regulations for the transport of infectious substances, with a case information form and cold chain if necessary.

Laboratory confirmation is used to confirm the outbreak and identify the pathogen; it is not necessary for every case. Once the outbreak is confirmed, the response is based on the clinical case definition, and samples are taken only from a subset of cases to monitor the evolution and antibiotic susceptibility.

7Cholera: organising case management and the response in practice

The Global Task Force on Cholera Control (GTFCC) recommends a coordinated multisectoral response. The case management component aims for a case fatality rate below 1%; the WASH, vaccination and community engagement components aim to interrupt transmission.

The three levels of case management

Rehydration according to the degree of dehydration

• Plan A (no dehydration): ORS at home after each loose stool, continued feeding, zinc for children.
• Plan B (some dehydration): ORS under observation, about 75 ml per kilogram over 4 hours, then reassessment.
• Plan C (severe dehydration): intravenous Ringer's lactate, 100 ml per kilogram: for people over one year old, 30 ml/kg in 30 minutes then 70 ml/kg in 2 and a half hours; for infants under one year, 30 ml/kg in one hour then 70 ml/kg in 5 hours. Frequent reassessment, switching to ORS as soon as the patient can drink.
• Antibiotics: recommended by the GTFCC for hospitalised patients with severe dehydration, according to the national protocol and local susceptibility (often single-dose doxycycline for adults).

Organising a CTC

The CTC is fenced, with a single controlled entrance and a single controlled exit, and is divided into areas: triage, observation, hospitalisation (cholera beds with a hole and a bucket), recovery, neutral area (staff, pharmacy, kitchen), morgue, waste management. Handwashing and footwear disinfection take place each time a person moves from one area to another. Chlorine concentrations usually used: 0.05% for hands and skin, 0.2% for floors, beds and surfaces, 2% for excreta, vomit and preparation of bodies. Water needs are high, around 60 litres per patient per day or more, according to Sphere recommendations for treatment centres.

Estimating needs

The starting point is an assumed attack rate (often 1 to 5% in a densely populated camp with low WASH coverage, considerably less in an open population) and a proportion of severe cases, often around 20%. Number of beds needed at the peak: severe cases hospitalised per day at the peak × average length of stay (often 2 to 3 days), plus a margin. An adult with severe dehydration often uses around 6 to 10 litres of Ringer's lactate during their stay, which determines the logistics. WHO cholera kits (central, periphery, community and hardware modules) are sized for a defined number of patients; refer to the current kit sheet for the exact composition.

Interrupting transmission

• Case-area targeted interventions (CATI): a team intervenes within 24 to 48 hours in a radius of about 100 to 250 metres around a case's household: household water treatment, distribution of chlorination products and soap, hygiene promotion, ORS, active case finding and, if decided, chemoprophylaxis for household contacts or ring vaccination.
• Water: chlorination at distribution points with a target of at least 0.5 mg/l of free residual chlorine at the point of distribution during an outbreak, checked and recorded daily.
• Burials: safe and dignified burials, disinfection of bodies, support for families to adapt rituals.
• Oral cholera vaccine: request to the International Coordinating Group (ICG) by the Ministry of Health, with a vaccination plan; owing to the global shortage, the ICG has applied a single-dose strategy for outbreak response since 2022.
• Risk communication and community engagement: messages on early rehydration and where to seek care, rumour tracking and response, involvement of religious leaders and traditional healers.

8Worked example: the cholera outbreak at the Kalombo site

Fictional context: the Kalombo site (40,000 displaced people, see day 1) receives the first rains. WASH now reaches 11 litres per person per day, with 1 latrine per 60 people. Sector A, on the riverbank, partly draws its water directly from the river. On the Monday of week 1, the EWARN reports two adults with acute watery diarrhoea and severe dehydration, one of whom died at home.

1. Verification and confirmation (D0 to D3)

The focal point verifies within 6 hours: both cases meet the definition of suspected cholera and live in sector A. Search of the registers: 4 other cases of watery diarrhoea in adults in the past 5 days. Two rapid diagnostic tests are positive; five samples are sent in Cary-Blair medium to the national laboratory, which confirms Vibrio cholerae O1 on D3. The Ministry declares the outbreak and activates incident management; the cluster convenes a daily cholera meeting.

2. Weekly data

3. Interpretation at the end of week 2 and decisions

A case fatality rate of 10.4% and 60% of deaths in the community: the main problem is access, not only quality. The median time between symptom onset and treatment, calculated from the line list, is 19 hours, too long for a disease that kills within hours. Decisions taken at the meeting:

1. Opening of 8 oral rehydration points, 4 of them in sector A, open from 6 a.m. to 10 p.m., with staff trained to detect severe dehydration and refer immediately.
2. Conversion of the observation area of the North health post into a 10-bed CTU, pending the CTC.
3. Setting up a CTC on the plot identified during preparedness, with a reinforced night team (two nurses and a doctor on call); rapid training on Plan C and hourly monitoring.
4. CATI around each new case within 48 hours; closing off direct access to the river and installing two temporary chlorinated water points in sector A.
5. Community messages on ORS and oral rehydration points, disseminated by volunteers, religious leaders and a local radio station; tracking of rumours that "people die at the CTC".
6. Request for oral cholera vaccine from the ICG by the Ministry, with a campaign plan for the whole site.

4. Sizing the CTC (calculation done in week 3)

5. Analysis by sector (end of week 6)

The attack rate, five times higher in sector A than in sector D, confirms the river-water hypothesis. The decline in cases from week 5 is real: report completeness remains above 90%, which rules out a surveillance artefact. The weekly case fatality rate fell from 16.7% to 1.1%, but the cumulative case fatality rate (3.2%) remains high because of the first weeks: the end-of-outbreak report must present both and explain the initial delay.

Main lesson learned: the CTC site and a cholera stock had been planned, but no oral rehydration points had been prepositioned in the sectors. The deaths in the first two weeks occurred mostly at night, at home, among patients who could have been saved by ORS and rapid referral.

9Working in the Health Cluster and protecting health care: the operating procedure

What the cluster expects from a partner

Preparing for a useful coordination meeting

• Send your data before the meeting, not during it.
• Come with a specific request (for example: "we no longer have night-time obstetric referral capacity in the South sector; who can take over?") rather than a list of activities.
• Report the gaps you cannot cover, even if this highlights your own limitations.
• Leave with the decisions and the people responsible, and pass them on to the field team the same day.

The cluster's technical groups

Depending on the context, the cluster relies on technical working groups: sexual and reproductive health (MISP coordination), MHPSS (often joint with protection), immunisation, cholera or diarrhoeal diseases, health information, and an outbreak response coordination group. Joint health-nutrition-WASH groups are essential for cholera and malnutrition.

Protecting health care: procedure for a health organisation

1. Before: share facility coordinates with the parties to the conflict through the humanitarian notification mechanism where one exists; post a no-weapons sign at the entrance; train staff on how to behave with weapon bearers and on impartial triage; continuity plan (stocks in facilities, replacement staff, fallback locations).
2. During an incident: staff and patient safety first; continuation of life-saving care if possible; factual documentation (date, time, place, type of attack, consequences, with no speculation about the perpetrator in shared reports).
3. After: report to the WHO SSA focal point and the cluster within 24 hours; inform the security unit and headquarters; psychosocial support for staff; assessment of resumption of activities; contribution to collective advocacy rather than isolated statements, taking into account the risk to staff.

The SSA classifies incidents by type (violence with weapons, obstruction, abduction, looting, militarisation of a facility, etc.) and by resources affected (facilities, personnel, patients, transport, supplies). These data feed into the Secretary-General's reports on the protection of civilians and the ICRC's Health Care in Danger initiative.

The neutrality of a health facility is built every day: treating all the wounded on medical criteria alone, refusing weapons and armed escorts inside the compound, and not allowing any party to take over the premises. A single breach can make the facility a target.

10Common mistakes, contextual variations, interview questions and references

Common mistakes

Variations by context

What donors and evaluators look at

• The completeness and timeliness of surveillance, and the traceability of alerts through to decisions.
• The case fatality rate of the outbreaks managed, disaggregated by place of death, and the explanation of any discrepancies.
• Preparedness: contingency plans, prepositioned stocks, teams trained before the high-risk season.
• Effective coordination: 4W reports, participation in technical groups, alignment with the national response plan.

Interview questions and elements of a strong answer

1. "Your EWARN has 55% completeness. What do you do?" Identify the facilities that are not reporting and the reasons (form, network, workload, lack of feedback), simplify, follow up, supervise, demonstrate usefulness through the bulletin; do not interpret trends while completeness is low.
2. "A suspected measles case is reported in a camp. What are your first 72 hours?" Verification, sampling, isolation, case management with vitamin A, active case finding, checking coverage, preparing or launching reactive vaccination, informing the Ministry and the cluster.
3. "The cholera case fatality rate is 5%. What are your hypotheses?" Distinguish community deaths from facility deaths; access (distance, night-time, fear, cost) versus quality (triage, volumes of Ringer's, monitoring, complicated cases); corresponding measures.
4. "How do you size a CTC?" Assumed attack rate, proportion of severe cases, length of stay, beds at the peak, Ringer's and water consumption, staffing, margin, weekly review.
5. "One of your facilities has been looted by an armed group. What do you do?" Staff safety, factual documentation, reporting to the SSA and the cluster, staff support, analysis of resumption, collective advocacy rather than isolated denunciation.

Key references

• WHO, Early warning alert and response in emergencies: an operational guide (EWARN operational guide).
• Global Task Force on Cholera Control (GTFCC), guidance on patient management, surveillance, case-area targeted interventions and requesting oral cholera vaccine from the ICG.
• WHO, cholera kit sheets and lists.
• Médecins Sans Frontières, Management of a Cholera Epidemic (practical guide).
• WHO, International Health Regulations (2005), in particular Annex 2.
• WHO, guidelines on meningitis outbreak response and epidemic thresholds in Africa.
• Global Health Cluster, Health Cluster Guide (2020) and 4W tools.
• WHO, Surveillance System for Attacks on Health Care (SSA), methodology.
• United Nations Security Council, resolution 2286 (2016); ICRC, Health Care in Danger initiative.
• Sphere Association, The Sphere Handbook (2018), standards on communicable diseases and on water in treatment centres.