National Infection Prevention and Control Manual

National Infection Prevention and Control Manual

Chapter 3 - Healthcare Infection Incidents, Outbreaks and Data Exceedance

The purpose of this chapter is to support the early recognition of potential infection incidents and to guide IPCT/HPTs in the incident management process within care settings; (that is, NHSScotland, independent contractors providing NHS services and private providers of care).

This guidance is aligned to the Management of Public Health Incidents: Guidance on the Roles and Responsibilities of NHS led Incident Management Teams 

Built environment incidents/outbreaks

ARHAI Scotland are currently working towards delivery of comprehensive evidence-based guidance which will form Chapter 4 of the National Infection Prevention and Control Manual (NIPCM) on the built environment and decontamination. 

Two Aide-Memoires currently provide best practice recommendations to be implemented in the event of a healthcare water-associated or healthcare ventilation-associated infection incident/outbreak.  These will ensure clinical staff, estates and facilities staff, and Infection Prevention and Control Teams (IPCT) have an understanding of the preventative measures required and the appropriate actions that should be taken.

Prevention and management of healthcare water-associated infection incidents/outbreaks

Prevention and management of healthcare ventilation-associated infection incidents/outbreaks

3.1 Definitions of Healthcare Infection Incident, Outbreak and Data Exceedance

The terms ‘incident’ and ‘Incident Management Team’ (IMT) are used as generic terms to cover both incidents and outbreaks

A healthcare infection incident may be:

An exceptional infection episode

  • a single case of rare infection that has severe outcomes for an individual AND has major implications for others (patients, staff and/or visitors), the organisation or wider public health for example, high consequence infectious disease (HCID) OR other rare infections such as XDR-TB, botulism, polio, rabies, or diphtheria.

See literature review for Infectious Diseases of High Consequence (IDHC)

A healthcare infection exposure incident

  • Exposure of patients, staff, public to a possible infectious agent as a result of a healthcare system failure or a near miss e.g. ventilation, water or decontamination incidents.

A healthcare associated infection outbreak

  • Two or more linked cases with the same infectious agent associated with the same healthcare setting over a specified time period.


  • A higher-than-expected number of cases of HAI in a given healthcare area over a specified time period.

A healthcare infection data exceedance

  • A greater than expected rate of infection compared with the usual background rate for the place and time where the incident has occurred.

A healthcare infection near miss incident

  • An incident which had the potential to expose patients to an infectious agent but did not e.g. decontamination failure.

A healthcare infection incident should be suspected if there is:

  • a single case of an infection for which there have previously been no cases in the facility (e.g. infection with a multidrug-resistant organism (MDRO) with unusual resistance patterns or a post-procedure infection with an unusual organism)

Further information can be found in the literature review Healthcare infection incidents and outbreaks in Scotland.

Updated : 09/02/24 14:40

3.2 Detection and recognition of a Healthcare Infection incident/outbreak or data exceedance

An early and effective response to an actual or potential healthcare incident, outbreak or data exceedance is crucial. The local Board IPCT and HPT should be aware of and refer to the national minimum list of alert organisms/conditions. See Appendix 13.

Healthcare associated infection (HAI) Surveillance systems should be used to aid incident/outbreak detection using a combination of retrospective detection of cases alongside prospective enhanced surveillance in high-risk settings (ICU/PICU/NICU, oncology/haematology). A risk-based approach should be applied for other vulnerable groups e.g. cystic fibrosis, oncology and those undergoing renal dialysis.

Local surveillance/reporting systems should be used for recognition and detection of potential healthcare infection incidents/outbreaks within NHS boards. Systems should make use of ‘triggers’ to allow prompt detection of any variance from normal limits.

The Infection Prevention & Control Team (IPCT)/Health Protection Team (HPT) should utilise surgical site infection (SSI) surveillance systems to identify specific post-surgical healthcare infection incidents/outbreaks (in line with national SSI surveillance program as a minimum).

3.2.1 Assessment

Following detection/recognition of an incident/outbreak a member of IPCT or HPT will:

  • Undertake an initial assessment, utilising the Healthcare Infection Incident Assessment Tool (HIIAT)Appendix 14, gather epidemiological data and clinical assessment information on the patient's condition as per:
  • NHS boards are required to report all HIIAT assessed Green, Amber and Red reports to ARHAI Scotland through the electronic outbreak reporting tool (ORT). See section 3.2.3.
  • NHS boards should monitor the ongoing impact of the incident by escalating and de-escalating as appropriate, using the HIIAT assessment tool. The HIIAT assessment should remain Amber or Red whilst there is ongoing risk of exposure, identification of new cases.

3.2.2 Investigation, management and communication

The IPCT/HPT will establish an IMT if required.

  • In the NHS hospital setting the ICD will usually chair the IMT and lead the investigation of healthcare incidents.  Where there are implications for the wider community e.g., TB or measles, or rare events such as CJD or a Hepatitis B/HIV look back, or where there is an actual or potential conflict of interest with the hospital service, the CPHM may chair the IMT. A draft agenda for the IMT is available.
  • The membership of the IMT will vary depending on the nature of the incident.
  • A healthcare infection incident investigation will usually consist of the following elements: an epidemiological investigation, a microbiological investigation and a specific investigation to identify how cases were exposed to the infectious agent (environmental investigation)
    • As part of the epidemiological investigation, a case definition(s) must be established by the IMT. A case definition should include the following: the people involved (for example, patients, staff), the symptoms/pathogen/infection (for example, with Group A Streptococci), the place (for example, care area(s) involved) and a limit of time (for example, between January and March year/date). The case definition(s) should be regularly reviewed and refined (if required) throughout the incident investigation as more information becomes available. A working hypothesis regarding the transmission route and source of the exposure must be formed based on initial investigation findings.
    • A microbiological investigation into the nature and characteristics of the implicated hazard /infective agent must be conducted.
    • Typing and whole genome sequencing can support outbreak and incident investigations. These services are available for some organisms and details of the services available should be discussed with your laboratory. Public Health Scotland continue to offer a SARS-CoV-2 whole genome sequencing service to support outbreak investigations and address important clinical and epidemiological questions.
    • An environmental investigation must be conducted if the findings of the epidemiological investigation suggest a common exposure to a potential environmental source/environmental reservoir.
    • Review of patient cases should consider any potential missed opportunities to isolate a patient, a delay in which may have resulted in onward transmission. Any learning should be widely communicated to all clinical staff in the board.
    • An infection prevention and control assessment to review the existing IPC practices must be conducted, so that areas for immediate improvement can be identified.
  • The IMT should receive and discuss all information gathered and epidemiological outputs for example an epidemiological (epi) curve, a timeline and a ward map to:
    • determine whether additional case finding and control measures may be necessary
    • confirm that all incident control measures are being applied effectively and are sufficient
  • Control measures must be directed at the source of the exposure and/or at affected persons in order to prevent secondary/further exposure to the agent. Control measures must be initiated within 24 hours of receiving the initial report and should be implemented based on relevant guidance (for example pathogen specific) and investigation findings of the nature of the outbreak.
  • A follow-up period may be defined after an infection incident/outbreak has ended to ensure its termination, including assessment of any ongoing control measures and would be determined by the PAG/IMT.
  • Identify any change(s) in the system: staffing, procedures/processing, equipment, suppliers. A step-by-step review of procedure(s). An outbreak checklist is available.
  • Identify and count all cases and/or persons exposed: This includes the total number of confirmed/probable/possible exposed cases. An incident/outbreak data collection tool is available.

If staff screening is being considered as part of the investigation DL (2020)1 must be followed.

  • HAI deaths, which pose an acute and serious public health risk, must be reported to the Procurator Fiscal, refer to SGHD/CMO(2018)11.
  • The IMT must ensure affected patients, and where appropriate their next of kin, have been informed of any actual or potential harm as a result of the HAI.  Duty of Candour must be considered at each IMT.
  • All significant adverse event reviews involving a category 1 adverse event (events that may have contributed to or resulted in permanent harm, for example unexpected death) should also be reported.
  • If no new cases arise and any remaining cases are considered to no longer pose a risk, the IMT should agree on actions prior to resumption of normal service.

3.2.3 Communications

  • Following the PAG/IMT, the NHS Board is required to communicate all HIIAT Green, Amber and Red assessments with ARHAI Scotland, by completing the electronic Outbreak Reporting Tool (ORT) within 24 hours of HIIAT assessment. 
  • Exported MS Excel files must be emailed to ARHAI Scotland for processing – the “Export Data File for ARHAI” button within the ORT only saves the extract from the ORT into the folder. Extracted data files should be emailed to the ARHAI Scotland ICT mailbox (
  • The Protocol for the Reporting of Healthcare Infection Incidents, Outbreaks and Data Exceedance in NHSScotland through the Outbreak Reporting Tool (ORT) is available in the resources section of the NIPCM.
  • For incidents/outbreaks that are HIIAT assessed as Red, Amber or Green, frequency of updates are as follows:
    • HIIAT Red – review, update and submit a daily update.
    • HIIAT Amber– review, update and submit a twice weekly update.
    • HIIAT Green – review, update and submit a weekly update.
  • The Healthcare Infection Incident and Outbreak Reporting Template (HIIORT) form is for any HIIAT Red, Amber or Green assessed incident/outbreaks. Incidents assessed as Red, Amber or Green, where ARHAI support is requested, will be reviewed for onward communication to Scottish Government Healthcare Associated Infection Policy Unit.
  • Respiratory incidents/outbreaks associated with key respiratory pathogens (COVID-19, influenza and respiratory syncytial virus (RSV)), should be completed within the Respiratory Short Form. However, where IPC measures do not align with the outbreak checklist and NIPCM, or where ARHAI support is requested a full HIIORT form must be completed. The Outbreak Checklist is available in the resources section of the NIPCM website.
  • COVID-19 reporting should now align with reporting for other key respiratory pathogens (Influenza/RSV).
  • Any adverse event related to equipment or medication must be reported as soon as possible (within one working day) to the Incident Reporting and Investigation Centre (IRIC) and the escalation/de-escalation flowchart followed.
Closure of incident/outbreak with lessons learned
  • Once the incident is declared over, and in addition to reporting via the electronic outbreak reporting tool (ORT), the IMT/NHS board should decide on the most appropriate format for a report. This is to communicate any lessons learned using the Hot Debrief Tool. Completion of this and submission to ARHAI Scotland is not mandatory, but for the purposes of sharing lessons learned across Scotland.

The IMT Chair, in discussion with the IMT, should determine whether further reporting on the incident and the incident management is required i.e. SBAR Report and full IMT report template are available in the resources section of the NIPCM website.  

Updated : 04/12/23 14:51