EWARS syndromic surveillance — detecting outbreak signals in refugee & IDP camp clinic data before they become epidemics
The Early Warning, Alert and Response Network (EWARN) — and its digital successor EWARS, both coordinated by WHO and health cluster partners — is the backbone of outbreak detection in refugee and IDP camps. Instead of waiting for laboratory-confirmed diagnoses, EWARN tracks clusters of symptoms ("syndromes") reported daily by camp clinics, trading some diagnostic precision for speed that can matter more than accuracy when an epidemic-prone disease starts to spread through a densely packed population.
Syndromic surveillance means tracking clusters of symptoms — "acute watery diarrhea," "fever with rash," "acute respiratory infection" — rather than waiting for a stool culture, PCR test, or serology result. In a camp setting this trade-off is deliberate: laboratory capacity is scarce, transport of samples can take days, and by the time a lab confirms cholera or measles, hundreds of additional exposures may already have occurred.
A clinician or community health worker instead applies a standardized case definition — for example "three or more loose stools in 24 hours in a person aged 5 years or older" for suspected cholera — and logs a tally. These tallies are cheap to collect, require no special equipment, and can be reported the same day, giving the surveillance system a days-to-weeks head start over classical lab-confirmed systems.
The cost is specificity: a fever/rash tally captures measles, but also rubella, dengue, and other causes. EWARN accepts this noise because the entire design goal is early signal, not final diagnosis — verification and lab confirmation happen later, only for tallies that cross a threshold.
A standard EWARN syndrome list typically includes: acute watery diarrhea (cholera signal), bloody diarrhea (shigella signal), fever and rash (measles/rubella signal), acute jaundice syndrome (hepatitis A/E signal), acute respiratory infection, suspected meningitis, and acute flaccid paralysis (polio signal). Camps tailor the list to local risk — Rohingya camps added diphtheria-like illness to their syndrome list after the November 2017 outbreak.
Reporting sites range from full field hospitals down to single-room community health posts staffed by a trained community health worker. Each site submits a standardized daily or weekly tally sheet — on paper in the most resource-poor settings, increasingly via SMS or a tablet-based DHIS2 (District Health Information Software 2) form in larger operations like Cox's Bazar.
The Rohingya refugee camps around Cox's Bazar, Bangladesh house roughly 960,000 people at some of the highest population densities of any camp setting on Earth, and run one of the largest EWARS deployments in the world — around 120 health facilities reporting into a shared platform managed with WHO and the health sector. Kenya's Dadaab (historically one of the world's largest refugee camps, hosting Somali refugees since 1991) and Kakuma (hosting refugees from South Sudan, Somalia, DRC and others) run comparable clinic-based EWARN systems under UNHCR and Kenyan Ministry of Health coordination, feeding into the national Integrated Disease Surveillance and Response (IDSR) system.
Across all three sites, the fundamental unit of surveillance is the same: a clinic nurse fills in a tally sheet, and that tally becomes the raw material for a statistical alert generated, in the best-resourced camps, within 24-48 hours.
Individual clinic tallies are noisy — a handful of cases at one site on one day means little on its own. EWARN's central surveillance function pools daily counts from every reporting clinic into weekly, camp-wide totals per syndrome, then compares each week's total against a threshold calculated from that syndrome's own historical baseline. Crossing the threshold does not confirm an outbreak — it triggers the next step in the pipeline.
For syndromes that occur at some background rate every week — acute respiratory infection, acute watery diarrhea in an area without cholera history — EWARN typically sets the alert threshold statistically: the mean of the previous 10-15 weeks of case counts, plus two standard deviations. Under a roughly normal distribution, this flags any week whose count would occur by chance less than about 2.5% of the time, balancing sensitivity (catching real signals early) against false-alarm fatigue among response teams who have limited capacity to chase every blip.
The threshold is recalculated on a rolling basis, so it adapts as the season, camp population, or baseline disease burden changes — a wet-season baseline for diarrheal disease is higher than a dry-season one, and the threshold moves with it.
The mean+2SD approach only works for diseases with a meaningful, non-zero weekly baseline. For diseases that should never occur at all in a well-controlled setting — measles in a vaccinated population, wild poliovirus, or cholera in a camp with no prior transmission — EWARN instead uses a fixed, very low threshold: often a single suspected case is enough to trigger an immediate alert and investigation, because in these diseases, one case reliably predicts many more within days given camp population density and low herd immunity in some sub-groups (unvaccinated newborns, recent arrivals).
This dual-threshold design — statistical thresholds for endemic-background syndromes, fixed single-case thresholds for epidemic-prone rare diseases — is central to EWARN's ability to catch both slow-building and explosive outbreaks.
A threshold is only as good as the data feeding it. If reporting completeness drops — clinics closed, staff shortages, a tally sheet lost in transit — the weekly case count is an undercount of the true burden, and a real signal can sit below threshold for weeks while transmission continues unseen. WHO guidance for EWARN systems sets a target of at least 80% of expected clinics reporting each week; below that, the system explicitly flags data as incomplete and interprets any apparent "quiet week" with caution rather than as reassurance.
| Product | Indication | Trial Design | Key Result |
|---|---|---|---|
| Acute watery diarrhea | Mean+2SD (fixed, single case if cholera-endemic risk) | ≥3 loose stools/24h, age ≥5 — cholera-pattern surveillance | Vibrio cholerae, ETEC |
| Bloody diarrhea | Mean + 2SD | Diarrhea with visible blood in stool | Shigella dysenteriae, EIEC |
| Fever & rash | Fixed — 1 suspected case | Fever plus maculopapular rash, any age | Measles virus, rubella |
| Acute jaundice syndrome | Mean + 2SD | Acute onset jaundice, dark urine | Hepatitis A virus, hepatitis E virus |
| Acute respiratory infection | Mean + 2SD (seasonal baseline) | Cough plus difficulty breathing, high volume syndrome | Influenza, RSV, S. pneumoniae |
| Acute flaccid paralysis | Fixed — 1 suspected case | Sudden onset limb weakness, age <15 | Poliovirus (wild or vaccine-derived) |
When a syndrome's weekly total crosses its threshold, EWARN generates an automated alert — a statistical anomaly, flagged for human review. This is deliberately a low bar: the system is tuned to be oversensitive, because the cost of missing a true cholera or measles signal in a camp of hundreds of thousands of people vastly outweighs the cost of investigating a false alarm.
EWARN's alert algorithm is built to favor sensitivity — catching every possible true signal — over specificity, accepting a substantial false-alarm rate as the price of not missing a real outbreak. A breach can be triggered by a genuine transmission event, but also by a data-entry error, a single clinic's unusual cluster of unrelated illness, a lab reagent problem generating spurious positive results, or a population influx that mechanically raises the raw case count without raising the rate.
Because of this, an alert is explicitly treated as a hypothesis, not a conclusion. The system's job at this stage is only to flag; distinguishing signal from noise is the job of the verification step that follows.
High-density camp settlements — parts of the Kutupalong-Balukhali mega-camp in Cox's Bazar have local population densities estimated above 40,000 people per square kilometer, among the highest of any human settlement — mean that once transmission of an acute watery diarrhea or measles pathogen begins, the effective reproduction number can be far higher than in a dispersed rural population. Shared water points, pit latrines close to shelters, and crowded communal spaces shorten the time between a threshold breach and a full-scale outbreak from weeks to days.
This is why the target interval from statistical breach to field verification team dispatch is kept as short as 24-48 hours in well-resourced camp operations — every day of delay in a high-density camp can translate into a materially larger outbreak by the time response begins.
If reporting completeness is low, the aggregated weekly count under-represents true transmission, and a genuine outbreak can sit below the statistical threshold — the alert simply never fires, or fires only once the outbreak is already large enough to punch through incomplete data. Camp surveillance officers explicitly cross-check completeness alongside case counts: a "no alert" week from a camp reporting at 40% completeness carries far less reassurance than the same result from a camp reporting at 95% completeness, which is why timeliness and completeness are tracked and published as key performance indicators alongside the epidemic curves themselves.
Every threshold breach triggers dispatch of a rapid response or field verification team — typically a surveillance officer paired with a clinician and, where available, a WASH (water, sanitation and hygiene) specialist — to the flagged clinic or zone. Their job is to determine, on the ground, whether the statistical alert reflects a true emerging outbreak, a reporting artefact, or an unrelated cluster that happens to share a syndrome definition.
On arrival, the team reconstructs a line-list — every case behind the aggregate tally, individually reviewed against the standard case definition — to check whether cases genuinely meet criteria (a clinician re-applying "≥3 loose stools/24h" catches cases that were miscoded at triage) and whether they cluster in time, place, or household in a pattern consistent with transmission, rather than being scattered unrelated illness.
Where rapid diagnostic tests (RDTs) are available — cholera RDTs detecting Vibrio cholerae O1/O139 antigen, malaria RDTs, and increasingly measles IgM RDTs — the team tests a sample of suspected cases on the spot, giving a result in 15-30 minutes rather than the days a full lab culture or PCR would take. A positive RDT cluster sharply raises confidence that the statistical signal is real; a run of negative RDTs supports ruling the alert out as a false alarm.
Field teams are specifically trained to look for the recurring causes of spurious breaches: a data-entry or transcription error at one clinic that inflated a single day's tally; a temporary population influx (a new arrival wave) that raised the raw case count without raising the underlying rate; a batch of contaminated or expired RDTs producing false positives; or a genuine but unrelated cluster — for example a shared foodborne illness at one gathering that meets the "acute watery diarrhea" syndrome definition without being cholera at all.
Ruling these out is not a formality: response resources in camp settings are scarce and shared across the whole camp population, so committing an isolation ward, additional clinical staff, and a vaccination campaign to a false alarm has a real opportunity cost for the rest of the camp's health needs.
For most syndromes, formal outbreak confirmation still requires laboratory confirmation of at least one case — a stool culture or PCR positive for Vibrio cholerae, a serum sample IgM-positive for measles — sent to a reference laboratory, which can take additional days even after field verification supports the signal. Camp operations increasingly run this in parallel with response activation rather than in sequence: once field verification strongly supports a true signal (consistent case definitions, clustering, supportive RDTs), response resources begin moving before the final lab confirmation lands, because in a dense camp setting the cost of waiting outweighs the cost of a response that turns out, rarely, to have been triggered by a false alarm.
Once a signal is confirmed, the camp health system pivots from surveillance to response: rapid diagnostic tests are pushed to affected clinics for case triage, an isolation or treatment area is stood up close to the epicenter, and additional clinical staff are surged into the zone. If response is timely, the epidemic curve — new cases per week — stops accelerating and plateaus, then declines, well before it would have burned through the full susceptible population.
Confirmed outbreak response in a camp setting is a coordinated package, not a single action: rapid diagnostic tests are distributed to every clinic in the affected zone so triage can happen locally rather than requiring transport to a central lab; a dedicated treatment or isolation area — for cholera, a Cholera Treatment Centre (CTC) or smaller Oral Rehydration Point (ORP); for measles, an isolation ward to break nosocomial transmission — is established close to the affected population; and additional clinical staff, often redeployed from lower-priority services elsewhere in the camp, are surged in to handle the caseload.
For vaccine-preventable diseases, a reactive vaccination campaign is typically launched in parallel — ring vaccination around confirmed cases for measles, or a broader oral cholera vaccine (OCV) campaign across the camp or affected sector if cholera is confirmed.
Between November 2017 and early 2018, the Rohingya refugee camps of Cox's Bazar experienced a diphtheria outbreak — a disease not recorded in Bangladesh for roughly two decades — that grew to more than 8,500 suspected cases. EWARN clinic-based syndromic reporting picked up the initial signal within days of the first cases, triggering one of the largest diphtheria antitoxin and vaccination responses in recent humanitarian history, including an estimated 900,000+ oral cholera vaccine doses delivered in parallel preventive campaigns across the same camps in 2017-2018.
An epidemic curve plateaus when the effective transmission rate drops below the threshold needed to sustain exponential growth — response interventions push it there through several simultaneous mechanisms: case isolation removes infectious individuals from contact with susceptible people; improved case management (oral or IV rehydration for cholera, antibiotics for shigella) shortens the infectious period and cuts mortality even where it does not stop transmission; targeted vaccination directly reduces the pool of susceptible people; and WASH interventions — chlorinated water points, additional latrines, hygiene promotion — cut the environmental transmission pathway for water-borne syndromes.
In well-resourced, fast responses, the weekly case count can plateau within one to two weeks of response activation; in under-resourced settings or with reporting delays, the same outbreak can take many weeks longer to bring under control, at a much higher cumulative case and death toll.
Response and surveillance are not sequential but continuous: EWARN keeps tracking the same weekly syndrome counts throughout the response, both to confirm the intervention is working (a sustained decline below threshold) and to catch any secondary signal — a different syndrome breaching threshold as a knock-on effect, or a resurgence if the response is scaled back too early. Cox's Bazar's EWARS platform logged more than 1.2 million patient consultations in 2018 alone, illustrating the sheer scale of routine data that has to keep flowing even while an active outbreak response is underway, so that the system does not lose visibility on the next signal while managing the current one.