Public health surveillance rarely runs on a single data stream. Most systems capable of catching an outbreak early are built on two distinct habits of listening: one that counts what clinics already know how to report, and one that pays attention to everything else. The formal names for these are indicator-based surveillance and event-based surveillance, and understanding what separates them — and why programs need both — explains a great deal about how modern epidemic intelligence actually works.
The distinction sounds academic until an outbreak arrives before anyone has a case definition ready for it. That is precisely the gap event-based surveillance was designed to close.
Two Different Questions, Two Different Data Streams
Indicator-based surveillance is the older, more familiar model. It relies on structured data collected against pre-defined indicators — a named disease, a specific case definition, a reporting form that a clinic, laboratory, or hospital fills in on a routine schedule, typically weekly or monthly. The strength of this approach is precision: because the indicator and the threshold for an alert are defined in advance, the resulting counts and rates are comparable over time and across sites. The weakness is exactly the same feature turned inward. A system built to count known diseases against known thresholds has no mechanism for flagging something that falls outside its own definitions — a new pathogen, an unusual cluster, or a signal from a population that never reaches the clinics doing the reporting.
Event-based surveillance exists to cover that blind spot. Rather than structured counts, it works with unstructured, ad hoc information about health events or risks, captured and assessed as it appears rather than on a fixed schedule. There is no reporting calendar in event-based surveillance — a report goes in the moment something is noticed, and the system is built to filter a large volume of noisy input down to the handful of signals worth a closer look. It takes what practitioners call an all-hazards approach: it is not limited to diseases already on a watchlist, and it draws on non-health sources as readily as health ones.
Where Event-Based Surveillance Actually Looks
The range of inputs is what makes event-based surveillance distinct, and it is broader than most people expect from a public health tool:
- Media reports — online news aggregators and social media posts describing unusual illness or death clusters
- Rumors and eyewitness reports — unverified accounts from the public that still merit a first look
- Community health workers and volunteers — frontline observers reporting outside the routine clinic-to-district reporting chain
- Public hotlines — telephone lines set up specifically to receive unusual-event reports from the public
- Expert-curated discussion forums — moderated networks where clinicians and epidemiologists flag events to each other directly
- Official notices and press releases — government health alerts that may reach the wider world before a formal indicator-based report is filed
- Animal health reports — unusual illness or die-off events in animal populations, relevant given how many emerging pathogens are zoonotic
- Environmental hazard reports — chemical or radio-nuclear events with potential public health consequences
None of these sources produce a validated case count on their own. What they produce is a lead — something a surveillance team then has to verify, contextualize, and either dismiss or escalate. That triage step, not the raw collection, is where most of the analytical work in event-based surveillance actually happens.
Real Systems Built on This Distinction
The clearest way to see the difference in practice is to look at the systems built specifically to do event-based work. The World Health Organization’s Epidemic Intelligence from Open Sources (EIOS) initiative analyzes large volumes of publicly available information — websites, social media, news sites — in near real time, using automated tools to help human analysts find the small number of genuine signals inside a very large amount of ordinary noise. In the WHO African Region between 2018 and 2023, EIOS is credited with detecting close to half of reported public health events before those events were formally notified through official channels — a concrete illustration of how much lead time an unstructured-data system can buy over a purely indicator-based one.
ProMED, the Program for Monitoring Emerging Diseases, works differently but toward the same end: it is an expert-curated discussion forum where clinicians and researchers post and review reports of disease events worldwide, and its output has long fed directly into the surveillance work of organizations including WHO and the US CDC. HealthMap, operating since 2006, is an automated system that gathers and visualizes outbreak-related reports from online news aggregators, eyewitness accounts, and curated sources including ProMED itself. HealthMap’s early detection record includes picking up signals of the 2014 West Africa Ebola outbreak and, in December 2019, an unusual pneumonia cluster in Wuhan that was later identified as the beginning of the COVID-19 pandemic — both cases where an unstructured signal arrived before a formal indicator-based report could have been generated.
Why Neither Approach Works Alone
It is tempting, once the event-based examples are laid out, to treat it as the more sophisticated system and indicator-based surveillance as the legacy one. That framing misses the point. Event-based surveillance is fast and wide but noisy and unverified by design; a rumor or a single news report is a hypothesis, not a diagnosis. Indicator-based surveillance is slower and narrower but far more reliable once a signal has been confirmed — it is what turns a suspected cluster into a documented trend with a denominator behind it. A functioning early warning system needs the first to raise a hand and the second to confirm what is actually happening once attention has been drawn there.
| Feature | Indicator-Based Surveillance | Event-Based Surveillance |
|---|---|---|
| Data type | Structured counts and rates | Unstructured reports and signals |
| Source | Clinics, laboratories, hospitals | Media, rumors, hotlines, community reports, official notices |
| Scope | Pre-defined diseases and indicators | All-hazards, including unknown or emerging threats |
| Reporting rhythm | Routine, scheduled | Immediate, as events occur |
| Main strength | Comparable trends over time | Early warning ahead of official notification |
| Main limitation | Blind to anything outside defined indicators | Requires verification before action |
Conclusion
The comparison between indicator-based and event-based surveillance is not a contest between an old method and a new one — it is a description of two complementary jobs inside the same early warning function. Indicator-based surveillance answers "how is a known disease trending against what we expect," while event-based surveillance answers "what unusual thing is happening that we have not yet defined a question for." Programs that rely on only one of the two are, by construction, either slow to notice the unexpected or unable to confirm what they have noticed. The systems doing this well in practice — EIOS, ProMED, HealthMap among them — exist because someone recognized that a rumor and a case count are both data, just not the same kind.