Acute Enteric Disease Outbreaks

Ian T. Williams, Laura Whitlock, and Matthew E. Wise

Steps in Investigating Acute Enteric Disease Outbreaks

Public health officials investigate outbreaks to identify the source, prevent additional illnesses, and learn how to prevent similar future outbreaks. This chapter provides an overview of how the public health community detects, investigates, and controls outbreaks of foodborne, waterborne, and other enteric (intestinal) disease and emphasizes multijurisdictional foodborne illness investigations in the United States.

Figure 23.1


Steps in an outbreak investigation.

Steps in an outbreak investigation. Source: Reference 1.

An investigation of an outbreak of enteric disease involves certain procedural steps (Figure 23.1) (1). They are described here in sequence, but in reality and as explained in previous chapters, investigations are dynamic, resulting in multiple steps occurring simultaneously. Typically, enteric disease outbreak investigations involve the following steps:

  • Detecting a possible outbreak.
  • Defining and finding cases.
  • Generating hypotheses about likely sources.
  • Testing the hypotheses and evaluating evidence.
  • Finding contamination sources.
  • Controlling the outbreak.
  • Determining when the outbreak is over.

Detecting a Possible Outbreak

Detecting a cluster or possible outbreak of enteric illnesses can occur in different ways. One way health officials find outbreaks is through public health surveillance. By systematically gathering reports of illnesses occurring over time, they know approximately how many illnesses to expect in a given period in a given area. A cluster occurs when a higher number of persons than expected appear to have the same illness in a given period and area. When an investigation reveals that ill persons in a cluster have something in common to explain why they all acquired the same illness, the group of illnesses is called an outbreak.

Informal reports occur when members of a community call the local or state health department to report a group of suspected enteric disease–related illnesses. This might happen, for example, if several persons became sick after eating at a group dinner. Health departments often maintain a system to monitor these reports. Sometimes a clinician (e.g., an emergency department physician) realizes that he or she is encountering more cases of an illness than would be expected and calls the health department directly to discuss it with the epidemiologists there.

Formal pathogen-specific reporting systems also play a vital role in outbreak detection, particularly for multijurisdictional outbreaks. Clinicians and microbiologists in each state must report infections that are on a list of notifiable diseases when they diagnose them among their patients. This list includes many foodborne and other enteric illnesses. As public health officials review disease reports, they might notice that the number of persons with a particular illness is higher than expected.

For certain enteric pathogens (e.g., Listeria monocytogenes, Salmonella enterica, and Shiga toxin– producing Escherichia coli), public health laboratories perform specific tests to help detect clusters that might otherwise be missed. When a clinician suspects that a patient has a foodborne illness, he or she might ask the patient to submit a fecal or other type of sample, depending on the clinical presentation of the illness or the suspected pathogen causing illness. The clinician sends the patient’s sample to a clinical laboratory, where bacteria can be isolated and identified as, for example, Salmonella or Shiga toxin–producing E. coli O157. The clinical laboratory informs the clinician of the diagnosis so that this information can be used to determine whether and how to treat the illness. A sample of the bacteria also might be sent from the clinical laboratory to the state public health laboratory for further characterization.

When a culture is available, the state laboratory might conduct subtyping tests on the bacteria, including serogrouping, serotyping, or DNA fingerprinting, which can include pulse-field gel electrophoresis (2), multilocus variable-number tandem repeats analysis (3), or whole-genome sequencing (4). Serogrouping and serotyping categorize bacteria on the basis of certain markers on the surface of the bacteria. Although serogroup or serotype information often can provide enough information to identify a possible outbreak, especially when the cluster is localized, further subtyping is often needed to separate background illnesses, unrelated to an outbreak, from those connected to a common source. DNA fingerprinting methods are more specific than serogrouping or serotyping, and bacteria that share the same DNA fingerprint are more likely to share a common source: the more rare the fingerprint, the higher the likelihood that the illnesses are connected in some way. For bacterial enteric pathogens, state laboratories, as well as some local and federal laboratories, submit subtyping information to the Centers for Disease Control and Prevention’s PulseNet system (5).

PulseNet is a national molecular subtyping network of public health and food regulatory agency laboratories. By reviewing the PulseNet database, health officials can identify clusters of illnesses caused by bacteria with the same DNA fingerprint at the same time, even if the ill persons are spread across many different health jurisdictions. This is especially useful when the number of illnesses in any one county or state is not large enough by itself to signal a possible outbreak (5).

Defining and Finding Cases

Often, the initially recognized illnesses reflect only a small part of the total outbreak. Finding additional ill persons is key to helping understand the size, timing, severity, and possible sources of the outbreak.

Early in an investigation, health officials usually develop a case definition to help determine which ill persons will be included as part of the outbreak. Case definitions may include details about the

  • Pathogen or toxin, if known;
  • Certain signs or symptoms typical for that pathogen or toxin;
  • Time range for when the illnesses occurred;
  • Geographic range (e.g., residency in a state or region); and
  • Other criteria (e.g., the pathogen’s DNA fingerprint).

Multiple case definitions might be used in an outbreak investigation, each with a different purpose. For example, one case definition might be for confirmed illnesses and another for probable or suspected illnesses. Generally, case definitions start more broadly and are updated and refined over the course of an investigation as new information becomes available. The number of illnesses that meet the case definition is called the case count.

Using the case definition, investigators search for more illnesses related to the outbreak. They do this by

  • Reviewing local disease surveillance reports;
  • Reviewing reports to laboratory surveillance systems (e.g., PulseNet);
  • Asking local clinical and laboratory professionals to report cases of the particular illness more quickly (i.e., as soon as they suspect the diagnosis);
  • Reviewing emergency department records for similar illnesses;
  • Surveying groups or interviewing persons who might have been exposed to the suspected outbreak source (e.g., attended a common meal or event); and
  • Asking health officials in surrounding areas to watch for illnesses that might be related (e.g., through Epi-X [6]).

Health officials monitor the progression of an outbreak by keeping track of who became ill, when they became ill, and where they live. Investigators use a graph called an epidemic curve or epi curve that displays the distribution of the number of illnesses occurring across a selected period (7). The pattern of the epidemic curve can help investigators determine whether ill persons were most likely exposed to the same contaminated source during a short period (e.g., at a single meal) or whether the exposure occurred over a longer period (e.g., several weeks or months). Investigators also use maps to denote where ill persons live so that they can see whether and how the outbreak is spreading within an area or community.

Generating Hypotheses About Likely Sources

A hypothesis is a reasonable suspicion of a vehicle as the contamination source for an outbreak and is based on specific facts and circumstances. Health officials use a process for developing and then testing a hypothesis to identify the source of the outbreak. The number of possible outbreak vehicles and the number of potential points of contamination can be enormous, especially for enteric pathogens transmitted through foods or ingredients. Hypothesis generation is an iterative process in which possible explanations are continually refined or refuted.

Pathogens that cause acute enteric disease outbreaks can spread by contaminated food or water, direct contact with an ill person, or direct or indirect contact with an infected animal or its environment. When investigating the illness source, health officials first need to decide on the likely mode(s) of transmission. The pathogen causing illness, the historical sources of illness with that pathogen, where ill persons live, the ill persons’ demographic characteristics (e.g., age, sex, and race/ethnicity), and the shape of the epidemic curve can all provide clues about the source.

When exposure to a contaminated food is suspected, health officials must consider the considerable number of foods and ingredients that might be the source or vehicle of infection. They may also need to consider the ingredients used in the foods that ill persons report eating. Health officials interview the ill persons to find out where and what they had eaten and other exposures during the days or weeks before they became sick. The focus of the investigation is then further narrowed to the specific foods or other exposures reported by many of the ill persons. Sometimes health officials also interview ill persons’ family members or other persons with similar exposures but who did not become ill. These interviews are called hypothesis-generating interviews.

The period interviewers focus on depends on the pathogen’s incubation period—the time between becoming ill and the likely exposure that made the person ill (e.g., eating the contaminated food, drinking contaminated water or a beverage, having direct contact with an ill person, or direct or indirect contact with an infected animal). This period varies by pathogen. Which foods or other exposures they ask about depends on what health officials have learned so far in the investigation. If several ill persons had attended a single restaurant, hotel, or catered event, for instance, interviews will focus on the menu items prepared, served, or sold there. If no obvious place of exposure is identified, investigators might use a standardized questionnaire, also known as a shotgun questionnaire. This type of hypothesis-generating questionnaire includes questions about a long list of food items or open-ended questions that review each meal a person ate during the days before illness began (8). It typically also includes questions about grocery shopping locations, restaurant dining or attendance at events where food was served, dietary restrictions and use of dietary supplements, travel history, animal contact, and recreational water exposures.

From the interviews, health officials create a short list of the foods, drinks, or other exposures that many of the ill persons had in common. Exposures that none or few ill persons reported are considered less likely to be the source. Health officials then look at other information (e.g., population-based surveys of food consumption) to help determine whether exposure frequencies from ill persons are higher than would be expected among the general population (9). On the basis of the information they gather, health officials develop a hypothesis about the likely outbreak source. However, shotgun interviews can only identify potential vehicles that are included on the questionnaire. If this approach does not lead to any testable hypotheses about the outbreak source, intensive open-ended interviews might be better suited to elucidating hypotheses that are not included in structured questionnaires.

A dynamic cluster investigation process can help to quickly identify a hypothesis. In this process, initial ill persons in the cluster are interviewed by using a detailed exposure history questionnaire. As new exposures of interest are indicated during interviews, the initial ill persons are systematically reinterviewed to assess these new exposures uniformly. Newly identified ill persons also will be uniformly asked about these exposures. This approach is particularly helpful in identifying new or unusual exposures not listed on standard shotgun questionnaires.

Investigating illness subclusters can provide crucial clues about an outbreak source. If multiple unrelated ill persons ate at the same location of a restaurant or purchased food or groceries from the same store location within days of each other, it suggests that the contaminated food item most likely was served or sold there. A useful method for generating hypotheses in multistate outbreaks includes rapid and thorough investigation of restaurant or store clusters. Subcluster investigations can identify specific food vehicles and provide detailed information about such items for trace-back investigations. A trace-back determines and documents the producer, manufacturer, supplier, and distribution pathway(s) for the food item(s) of interest. A key goal in a trace-back is to determine whether there is a supplier or other point in the distribution chain in common.

Generating a plausible hypothesis is often challenging and can take substantial time for several reasons. First, interviews of ill persons highly depend on their ability to recall events. The time from illness onset to knowing the ill person was part of an outbreak is typically 2– 4 weeks for outbreaks that rely on DNA fingerprinting (10). Ill persons might not remember in detail what they ate that long ago. Also, if the contaminated food is an ingredient, the task becomes even more difficult. Ill persons often do not remember or know the ingredients of their meals. These challenges can delay or prevent development of a plausible hypothesis. In certain situations, ill persons might be interviewed multiple times as new ideas arise about possible sources. Visiting someone’s home and examining the foods in their pantry and refrigerator or obtaining permission to review information from purchase receipts, shopper cards, or food journals can be helpful.

Testing Hypotheses and Evaluating Evidence

Figure 23.2


Evidence used to link illnesses to contaminated foods during outbreak investigations.

Evidence used to link illnesses to contaminated foods during outbreak investigations.

Source: Reference 11.

Three types of evidence, or pillars, are used when evaluating hypotheses about the contamination source(s) in an enteric disease outbreak (Figure 23.2) (11).

  • Epidemiologic evidence (e.g., data from interviews of ill persons; distribution of cases by person, place, and time; results of analytic epidemiologic studies; and the history of the suspected pathogen and the past outbreaks it has caused);
  • Evidence from a trace-back of a suspected vehicle linked with ill persons to identify a common point where contamination might have occurred and an assessment of the production facility at that common point; and
  • Laboratory results from testing a suspected vehicle or the production facility where contamination might have occurred.

Evidence from each of these pillars is evaluated in concert to determine whether the data support the conclusion that a suspected food or other exposure is the outbreak cause. Investigators typically determine they have identified the likely source of the outbreak when they have clear and convincing evidence from two pillars. In rare instances, data from one pillar alone might be sufficient to determine the likely source of an outbreak (e.g., point source clusters linked to a meal or single event). In investigations of products with a short shelf life (e.g., unpasteurized milk or leafy greens), conducting testing on products during the likely period of contamination might be impossible, and investigators must rely on evidence from the other pillars to determine the likely source of the outbreak.

A hypothesis should be tested to determine whether the source has been identified correctly. Epidemiologic analytic studies are often used to test hypotheses. Case–control studies or cohort studies are the most common types of analytic study conducted. Health officials analyze information collected from ill persons and comparable well persons to determine whether ill persons are more likely than well persons to have eaten a certain food or to report a particular exposure. These types of analytic studies are often done for outbreaks associated with a single event or restaurant.

If ingestion of a particular food or some other exposure is reported more often by sick persons than by well persons, that food or exposure might be causing the outbreak. By using statistical tests, health officials can determine the strength of the association (i.e., how likely it is to have occurred by chance alone) and whether more than one food or other exposure might be involved. Investigators analyze many factors when interpreting results from these studies, including the frequencies of exposure(s) of interest; strength of the statistical association; dose-response associations; and the production, preparation, and distribution of the product.

If an outbreak is linked to a food that was prepared in different kitchens or to a food that was purchased from different stores and consumed without further preparation, the contamination event probably happened during the production and before preparation in the kitchen. In that situation, investigators perform a trace-back investigation to determine where the contamination occurred (Figure 23.3) (12). Formal trace-back investigations are conducted by regulatory agencies at the state or federal level. These agencies rely on collecting records and documents to support possible product actions, such as a food recall. Trace-backs typically begin by identifying suspected food item(s) reported by ill persons or identifying restaurants or store locations where ill persons dined or shopped. The next step is to determine whether the production chain of the suspected food item(s) converges to a common point. Finding this point helps to define where contamination occurred and to support the hypothesis. Officials review purchase and shipment information from suppliers of the suspected item for the stores, restaurants, or cafeterias where they believe the item was bought or eaten. They then ask suppliers where they received the suspected item, and so forth, back to the point of production. Trace-back investigations can be resource-intensive and challenging, especially when the distribution pathway is complex or when detailed records are lacking at producers, suppliers, stores, or restaurants in the distribution chain.

Figure 23.3

Tracing the food back to the source.

Tracing the food back to the source.

Source: Reference 12.

During investigations where an ingredient is the cause of the outbreak, identifying the culprit can be more difficult because the contaminated ingredient might have been consumed as part of many different foods. In these situations, epidemiologic product tracing can be an important part of the process for identifying a foodborne outbreak vehicle (13). The overall goal of product tracing to aid an epidemiologic investigation is to determine whether a food item or items eaten by multiple ill persons in subclusters have a source or distribution point in common. Product distribution patterns can add specificity to exposures and assess the plausibility of one or more vehicles.

Testing of food, the environment, or water can provide useful information and support a hypothesis. Finding bacteria in an unopened container of food or in a food production facility with the same DNA fingerprint as clinical samples from ill persons in the outbreak can be convincing evidence of an illness source. However, investigators might not be able to identify a pathogen in the contaminated item for multiple reasons.

  • Food items with a short shelf life (e.g., contaminated milk or produce) might be unavailable by the time the outbreak is identified and therefore cannot be tested.
  • Even if the suspected food or water source is available, the pathogen might be difficult to detect because it might have decreased in number since the outbreak or other organisms might have overgrown the pathogen as the food started to spoil.
  • The pathogen might have been in only one portion of the food. A sample taken from a portion that was uncontaminated will have a negative test result. Therefore, a negative result does not rule out this food as an illness source or outbreak cause.
  • Leftover items or items in open containers might have been cross-contaminated from contact with an ill person or a meal preparation item or from contact with the item that actually caused the outbreak.
  • Certain pathogens cannot be detected in food or water sources because no established test exists that can detect that pathogen in the suspected food or water.

Not finding a link between a specific item or other exposure and illness can happen for different reasons.

  • When a restaurant serves meals containing multiple ingredients that are mixed or cooked together or used in multiple menu items, conducting epidemiologic studies to identify the specific contaminated ingredient can be difficult because of collinearity among exposures.
  • Health officials might have recognized the outbreak so long after it occurred that they could not fully investigate it (e.g., food items might be unavailable for testing, ill persons might be unable to recall food histories accurately).
  • An initial investigation might not have led to a specific, testable hypothesis; therefore, no analytic study was performed. Alternately, the initial hypothesis might have been wrong, making the results of any analytic study inaccurate or misleading.
  • An analytic study might have been performed but did not find a specific exposure because the number of illnesses to analyze was limited, multiple food items were contaminated, or the contaminated item was a food that persons might have eaten but are unlikely to remember (e.g., ice in drinks, garnishes, condiments, or ingredients that are part of a food item).

If the outbreak has ended without the source being identified, the source is declared unknown. If the outbreak has not ended, health officials must keep gathering information and studying results to try to find the food or other source that is causing the illnesses. In these situations, the hypothesis generation process might have to be repeated as the investigation continues.

Finding Contamination Sources

If a likely source is identified, officials might perform an environmental assessment to determine the root cause and contributing factors for the outbreak (14). In foodborne illness outbreaks, this assessment might involve one or several facilities along the path from farm to fork. Illness in persons who had eaten food prepared in only one kitchen indicates that the contamination might have occurred in that kitchen. Health officials interview the persons who prepared the food to determine the ingredients used, the steps followed in preparing the food, and the temperatures used to prepare and hold the food. They review employees’ health practices and training and the kitchen’s cleanliness. They also check the health status of the workers at the time the exposures occurred. In a commercial or institutional kitchen or primary food production farm or facility, officials review past inspection reports for history of problems. Information from the environmental assessment can indicate ways to control the outbreak and prevent future similar outbreaks.

Controlling an Outbreak

After the likely source of illness is identified, immediate control measures might be needed. If a contaminated food stays on store shelves, in restaurant kitchens, or in home pantries or refrigerators, more persons might become sick. Outbreak control measures might include requiring specific measures to clean and disinfect meal preparation facilities, temporarily closing a restaurant or processing plant, recalling food items, informing the public about how to make the food safe, or telling consumers to check their homes and discard the suspected item. As health officials learn more during the investigation, they might modify, focus, or expand control measures and advice to the public.

Determining When an Outbreak Is Over

Not all outbreaks are solved. Investigators should continue to develop and test hypotheses if cases continue to be identified. An outbreak ends when the number of new illnesses reported returns to the number health officials normally expect. The epidemic curve helps health officials determine whether illnesses are declining. However, if illnesses begin to increase again after a noted decline, health officials will reopen the investigation. An increase in illnesses might indicate that the source was not completely controlled or that another unknown source of contamination is involved.



Investigating acute enteric disease outbreaks can be a dynamic and complex undertaking, often involving multiple public health and regulatory partners in different jurisdictions. Certain aspects of how the public health community detects, investigates, and controls foodborne and other enteric disease outbreaks are beyond the scope of this chapter. A more comprehensive review of outbreak detection and investigation methods for foodborne disease outbreaks is available in the Council to Improve Foodborne Outbreak Response’s Guidelines for Foodborne Disease Outbreak Response (15).


This work is based in part on “Multistate and Nationwide Foodborne Outbreak Investigations: A Step-by-Step Guide” (available at The authors gratefully acknowledge the many staff at the Centers for Disease Control and Prevention who have helped contribute to developing these ideas and content, especially Robert Tauxe, MD, MPH, and Patricia Griffin, MD.

  1. Centers for Disease Control and Prevention. Steps in outbreak investigation.
  2. Centers for Disease Control and Prevention. Pulsed-field gel electrophoresis (PFGE).
  3. Centers for Disease Control and Prevention. Multiple locus variable-number tandem repeat analysis (MLVA).
  4. Centers for Disease Control and Prevention. Whole genome sequencing (WGS).
  5. Centers for Disease Control and Prevention. PulseNet.
  6. Centers for Disease Control and Prevention. Epi-X: building a network to save lives.
  7. Centers for Disease Control and Prevention. Interpretation of epidemic (epi) curves during ongoing outbreak investigations.
  8. Centers for Disease Control and Prevention. Foodborne disease outbreak investigation and surveillance tools.
  9. Centers for Disease Control and Prevention. Foodborne diseases active surveillance network (FoodNet).
  10. Centers for Disease Control and Prevention. Timeline for reporting cases of Salmonella infection.
  11. Centers for Disease Control and Prevention. Foodborne disease outbreaks.
  12. Centers for Disease Control and Prevention. Finding the point of contamination and source of the food.
  13. Council to Improve Foodborne Outbreak Response. Product Tracing in Epidemiologic Investigations of Outbreaks Due to Commercially Distributed Food Items. Atlanta, GA: Council of State and Territorial Epidemiologists; 2015.
  14. Centers for Disease Control and Prevention. e-Learning on environmental assessment of foodborne illness outbreaks. fio/index.htm
  15. Council to Improve Foodborne Outbreak Response. CIFOR Guidelines for Foodborne Disease Outbreak Response. 2nd ed. Atlanta: Council of State and Territorial Epidemiologists; 2014:153–4.