Epidemiologic surveillance for communicable diseases was re-initiated in Lebanon in 1995. Historically, surveillance was initiated by the Law of 31 December 1957, but it was interrupted during the civil war from 1975 to 1994. Electronic surveillance is a necessary tool for storing, analyzing, displaying, mapping, generating abnormal indicator-based signals, modeling, disseminating, reporting and standardizing data/information. This paper will describe and assess [1, 2] the electronic surveillance of outbreaks for four endemic diseases – typhoid fever, brucellosis, viral hepatitis A (VHA), and amebic dysentery [3] – in Lebanon for the first 28 weeks in 2005 and the first 26 weeks in 2007.



The purpose of an electronic early warning system is the generation of abnormal indicator-based signals indicative of events of public health importance, routine automatic screening at all levels on a weekly/daily basis, and early outbreak detection.


Physicians and hospitals are the primary data providers. Since the end of 2001, public and private hospitals have designated the main staff member in charge of disease notification to the Ministry of Public Health (MOPH). First-line data users are MOPH surveillance officers at central and peripheral levels.


Operations are based on two systems: mandatory notification and electronic early warning.

Mandatory notification

Mandatory notification targets 37 diseases, which are immediately or monthly notifiable. Standard case definitions are reviewed for each disease by MOPH circulars based on WHO recommendations [48]. One reporting standardized form is completed by the physician or hospital representative. Standard specific investigation forms are completed by a MOPH surveillance staff member. Physicians can report to the MOPH either at the district, province or central level. Reporting forms are usually sent to the MOPH by facsimile. Since 2007, physicians and hospitals were encouraged to report to MOPH through the mail using postage paid envelopes. Forms are transmitted from peripheral levels to the central level on a monthly basis. Since 2007, forms have to be transmitted on a weekly basis. On average, 1345 cases of typhoid fever, VHA, amebic dysentery and brucellosis were reported annually to the MOPH for the period of 2004–2006. Among them, 95% were notified by hospitals. Upon receipt at the MOPH, forms are marked with the date of receipt. Data completeness and laboratory findings are verified. When necessary, data is completed by contacting data providers by phone. Data entry for case-based surveillance is performed at the central level into the Epidemiological Surveillance Unit (ESU) database, a local application that was developed using the following public software: EpiData 2.1 b, Epi Info 6.04 d and Winglue [911]. The database includes coded variables for disease, time, place, and person. According to available dates, a disease-event is dated, by order of priority, by: 1) onset; 2) diagnosis; 3) admission; 4) reporting; 5) reception (Table 1).

Table 1 Distribution (%) of cases according to selected date for disease-event for reported cases of typhoid fever, dysentery, viral hepatitis A and brucellosis, in Lebanon, Jan 2005 to Jun 2007.

Electronic early warning system

The electronic early warning system screens the national database searching for abnormal signals, using the "EWARN" application [12]. Two data sources are used:

• ESU database, which provides the historical data (starting year 1995) and current year data.

• Population estimates based on national surveys of 1994–1996, 1997, 2004, and UN national growth rates [1316].

Database files are compiled into one aggregated file.


Cases are computerized according to the week of disease-event. Different mobile time periods are used as a frame for comparison: current week, current 4 weeks, current 52 weeks, 3 weeks previous to current week, 48 weeks previous to current 4 weeks, same 4 weeks of last year, same 52 weeks of last year.

Indicators and thresholds

Indicators for triggering abnormalities include absolute numbers, relative increase ratios and incidence rates (weekly and 52-week period). Relative ratios are:

• "RR1/3": cases for current week over weekly average of previous 3 weeks.

• "RR4/48": cases for current 4 weeks over 4-week average of previous 48 weeks.

• "RR4/4": cases of current 4 weeks over cases of same 4 weeks one year ago.

• "RR52/52": cases of current 52 weeks over cases of same 52 weeks one year ago.

The threshold for relative increase is set to 1.5 if the denominator is >0. Otherwise, an abnormal signal is generated for at least 3 cases.

Data outputs

For every area, generated abnormal signals are listed specifying the disease and observed abnormality. Additional outputs include disease-tables, area-tables, epidemic curves, and maps with Epimap2.0 [17]. All outputs are in HTML format allowing easy navigation between pages.

Epidemiologic analysis, interpretation and investigation

Routine screening was conducted on a weekly basis in 2005, and on a daily basis since the end of 2006. At each new screening, outputs are archived for later review.

Abnormal indicator-based signals

Abnormal indicator-based signals are identified by disease, place, and time. One abnormal signal may include one or several indicators. The indicator-based characteristic refers to the use of structured data collected through routine surveillance systems as mandatory notification [18].


Alert-episode is a group of signals for one disease that reflects common time and place findings. An alert-episode has starting and ending dates. An alert-episode is used to highlight the potential occurrence of clusters and outbreaks.


An alert-episode presenting acute change – related to current week or 4 week indicators – is considered to reflect a potential cluster. Cluster is defined by the following criteria:

  • Person: at least three cases or an increasing number

  • Time: during current 4 weeks

  • And one of the following:

    • Place: common/adjacent localities

    • Social: common social link (institution, gathering, etc.)

Cluster verification is done by collecting information in-office. The in-office verification includes: checking for duplicates and data, mapping cases at locality level with HealthMapper2.0 [19], completing laboratory findings, and phone-interviewing cases using investigation forms. A verified cluster is flagged for in-field investigation.


In 2005, each abnormal indicator-based signal was archived in "ASTER," a local database. Since 2007, abnormal signals are listed in several sheets:

• Matrix by time and place for monitoring signals and detecting alert-episodes;

• Alerts log book for identifying and following alert-episodes;

• Daily sheet for descriptive analysis by disease, time, place, and person.

Surveillance staff

The central team is in charge of managing the electronic early warning system, including communicating and assisting peripheral teams regarding potential alerts. The peripheral teams are in charge of verifying alert-episodes and clusters, and conducting investigations.


First period

During the first 28 weeks of 2005, 19 weekly screening operations were conducted. Twenty-six weekly abnormal signals were detected. For those signals, 11 alert-episodes were identified: 5 for typhoid fever, 2 for amebic dysentery, 3 for brucellosis and 1 for VHA. Among the alert-episodes, 7 clusters were verified. Three of them were related to outbreaks of typhoid fever because of water contamination (Table 2).

Table 2 Alert-episodes identified through electronic early warning in Lebanon for the period from 2005-W01 to 2005-W28.

Second period

During the first 26 weeks of 2007, 133 daily screening operations were conducted over 150 working days and 199 daily abnormal signals were detected. For those signals, 22 alert-episodes were identified: 7 for typhoid fever, 2 for amebic dysentery, 2 for brucellosis and 11 for VHA. Among the alert-episodes, 11 tempo-spatial clusters were verified. One outbreak of typhoid fever and 1 of VHA were found because of water contamination (Table 3).

Table 3 Alert-episodes identified through electronic early warning in Lebanon for the Period from 2007-W01 to 2007-W26.


The completeness of conducting alerts detection is 68% for the first period of 2005 and 89% for the second period of 2007. The timeliness measured by the time-interval between first cases and first alerts shows an average of 4 weeks for the first period and 5 weeks for the second period. The validity measured by the positive predictive value for the two periods is 64% and 50%, respectively.


Time definition

The system has a delay in detecting alert-episodes since the first cases occurred. Sources of obstacles for timely detection are:

• Delay in reporting to MOPH since the target diseases are monthly notifiable;

• Delay in transmission from peripheral to central level. Weekly transmission is not respected by all districts;

• Delay in data entry at central level, possibly during holiday periods.

Ways to improve timeliness can be explored by the following:

• Compute cases by week of reception to MOPH, which will reflect timeliness of the "EWARN" application and not of the surveillance system;

• Define epidemic-prone diseases as weekly, even immediately, notifiable;

• Analyze other available timely diseases databases;

• Perform data entry at peripheral level which is linked electronically to the central level;

• Establish electronic reporting at the data-providers level.

Geographical information system

Cluster definition may not be optimal. The use of GIS can enhance cluster definition and investigation procedures. It helps in visualizing cases and adding new cluster criteria based on exposure: infrastructure (e.g., water, sanitation) and environment (e.g., farms, vectors). Besides ensuring human resources, equipment/material, and budgeting, more efforts are being directed for information resources:

• Ensuring Information and Communication Technology at all levels;

• Training and building capacity of available staff members on how to use information.

According to defined core competencies, the training process is being built upon:

• Issuing documented national guidelines: case definitions, population estimates, maps, ISO-weeks; and descriptive, investigation and monitoring tools;

• Conducting continuous training with exercises;

• Supervising/monitoring.


The electronic surveillance of outbreaks for epidemic-prone diseases, which are mandatory notified on a monthly basis using indicator-based thresholds, is capable of detecting spatio-temporal clusters and outbreaks; however, with some delay. The rationale of monthly reporting and monthly transmission of data and information is not adapted for early warning engines. The national surveillance system needs to be reviewed in order to provide timely data for early warning surveillance and response systems and epidemic intelligence.

On the other hand, the IHR (2005) requires inclusion of informal sources in surveillance as event-based monitoring. This will detect additional outbreaks and allow measuring the sensitivity of the electronic early warning system.

Surveillance is not static. It is data to be collected, analyzed and displayed in various manners to present relevant intelligible information.