National Infection Prevention and Control Manual

National Infection Prevention and Control Manual

Chapter 3 - Healthcare Infection Incidents, Outbreaks and Data Exceedance

The purpose of this chapter is to support the early recognition of potential infection incidents and to guide IPCT/HPTs in the incident management process within care settings; (that is, NHSScotland, independent contractors providing NHS services and private providers of care).

This guidance is aligned to the Management of Public Health Incidents: Guidance on the Roles and Responsibilities of NHS led Incident Management Teams 

Built environment incidents/outbreaks

ARHAI Scotland are currently working towards delivery of comprehensive evidence-based guidance which will form Chapter 4 of the National Infection Prevention and Control Manual (NIPCM) on the built environment and decontamination. 

Two Aide-Memoires currently provide best practice recommendations to be implemented in the event of a healthcare water-associated or healthcare ventilation-associated infection incident/outbreak.  These will ensure clinical staff, estates and facilities staff, and Infection Prevention and Control Teams (IPCT) have an understanding of the preventative measures required and the appropriate actions that should be taken.

Prevention and management of healthcare water-associated infection incidents/outbreaks

Prevention and management of healthcare ventilation-associated infection incidents/outbreaks

3.1 Definitions of Healthcare Infection Incident, Outbreak and Data Exceedance

The terms ‘incident’ and ‘Incident Management Team’ (IMT) are used as generic terms to cover both incidents and outbreaks

A healthcare infection incident may be:

An exceptional infection episode

  • A single case of an infection that has severe outcomes for an individual patient OR   has major implications for others (patients, staff and/or visitors), the organisation or wider public health e.g. infectious diseases of high consequence such as VHF or XDR-TB, botulism, polio, rabies, diphtheria.

See literature review for Infectious Diseases of High Consequence (IDHC)

A healthcare infection exposure incident

  • Exposure of patients, staff, public to a possible infectious agent as a result of a healthcare system failure or a near miss e.g. ventilation, water or decontamination incidents.

A healthcare associated infection outbreak

  • Two or more linked cases with the same infectious agent associated with the same healthcare setting over a specified time period.


  • A higher-than-expected number of cases of HAI in a given healthcare area over a specified time period.

A healthcare infection data exceedance

  • A greater than expected rate of infection compared with the usual background rate for the place and time where the incident has occurred.

A healthcare infection near miss incident

  • An incident which had the potential to expose patients to an infectious agent but did not e.g. decontamination failure.

A healthcare infection incident should be suspected if there is:

  • a single case of an infection for which there have previously been no cases in the facility (e.g. infection with a multidrug-resistant organism (MDRO) with unusual resistance patterns or a post-procedure infection with an unusual organism)

Further information can be found in the literature review Healthcare infection incidents and outbreaks in Scotland.

Updated : 10/06/22 09:54

3.2 Detection and recognition of a Healthcare Infection incident/outbreak or data exceedance

An early and effective response to an actual or potential healthcare incident, outbreak or data exceedance is crucial. The local Board IPCT and HPT should be aware of and refer to the national minimum list of alert organisms/conditions. See Appendix 13.

Healthcare associated infection (HAI) Surveillance systems should be used to aid incident/outbreak detection using a combination of retrospective detection of cases alongside prospective enhanced surveillance in high-risk settings (ICU/PICU/NICU, oncology/haematology). A risk-based approach should be applied for other vulnerable groups e.g. cystic fibrosis, oncology and those undergoing renal dialysis.

Local surveillance/reporting systems should be used for recognition and detection of potential healthcare infection incidents /outbreaks within NHS Boards. Systems should make use of ‘triggers’ to allow prompt detection of any variance from normal limits.

The Infection Prevention & Control Team (IPCT)/Health Protection Team (HPT) should utilise surgical site infection (SSI) surveillance systems to identify specific post-surgical healthcare infection incidents/outbreaks (in line with national SSI surveillance program as a minimum).

3.2.1 Assessment

Following detection/recognition of an incident/outbreak a member of IPCT or HPT will:

  • Undertake an initial assessment, utilising the Healthcare Infection Incident Assessment Tool (HIIAT)Appendix 14, gather epidemiological data and clinical assessment information on the patient's condition as per:
  • NHS Boards are required to report all HIIAT assessed Green, Amber and Red reports to ARHAI Scotland through the electronic outbreak reporting tool (ORT).
  • NHS Boards should monitor the ongoing impact of the incident by escalating and de-escalating as appropriate, using the HIIAT assessment tool. The HIIAT assessment should remain Amber or Red whilst there is ongoing risk of exposure, identification of new cases.

3.2.2 Investigation, management and communication

The IPCT/HPT will establish an IMT if required.

  • In the NHS hospital setting the ICD will usually chair the IMT and lead the investigation of healthcare incidents.  Where there are implications for the wider community e.g., TB or measles, or rare events such as CJD or a Hepatitis B/HIV look back, or where there is an actual or potential conflict of interest with the hospital service, the CPHM may chair the IMT. A draft agenda for the IMT is available.
  • The membership of the IMT will vary depending on the nature of the incident.
  • A healthcare infection incident investigation will usually consist of the following elements: an epidemiological investigation, a microbiological investigation and a specific investigation to identify how cases were exposed to the infectious agent (environmental investigation)
    • As part of the epidemiological investigation, a case definition(s) must be established by the IMT. A case definition should include the following: the people involved (e.g., patients, staff); the symptoms/pathogen/infection (e.g., with Group A Streptococci); the place (e.g., care area(s) involved); and a limit of time (e.g., between January and March year/date). The case definition(s) should be regularly reviewed and refined (if required) throughout the incident investigation as more information becomes available. A working hypothesis regarding the transmission route and source of the exposure must be formed based on initial investigation findings.
    • A microbiological investigation into the nature and characteristics of the implicated hazard /infective agent must be conducted.
    • Typing and whole genome sequencing can support outbreak and incident investigations. These services are available for some organisms and details of the services available should be discussed with your laboratory. Public Health Scotland continue to offer a SARS-CoV-2 whole genome sequencing service to support outbreak investigations and address important clinical and epidemiological questions.
    • An environmental investigation must be conducted if the findings of the epidemiological investigation suggest a common exposure to a potential environmental source/ environmental reservoir.
    • Review of patient cases should consider any potential missed opportunities to isolate a patient, a delay in which may have resulted in onward transmission. Any learning should be widely communicated to all clinical staff in the board.
    • An infection prevention and control assessment to review the existing IPC practices must be conducted, so that areas for immediate improvement can be identified.
  • Identify any change(s) in the system: staffing, procedures/processing, equipment, suppliers. A step-by-step review of procedure(s). A generic outbreak checklist is available.
  • Identify and count all cases and/or persons exposed: This includes the total number of confirmed/probable/possible exposed cases. An incident/outbreak data collection tool is available.
  • The IMT should receive and discuss all information gathered and epidemiological outputs e.g. an epidemiological (epi) curve, a timeline and a ward map to:
    • Determine whether additional case finding and control measures may be necessary.
    • Confirm that all incident control measures are being applied effectively and are sufficient.
  • Control measures must be directed at the source of the exposure and/or at affected persons in order to prevent secondary/ further exposure to the agent. Control measures must be initiated within 24 hours of receiving the initial report and should be implemented based on relevant guidance (e.g. pathogen specific) and investigation findings of the nature of the outbreak.
  • A follow-up period may be defined after an infection incident/ outbreak has ended to ensure its termination, including assessment of any ongoing control measures and would be determined by the PAG/IMT.
  • Identify any change(s) in the system: staffing, procedures/processing, equipment, suppliers. A step-by-step review of procedure(s). A generic outbreak checklist is available.
  • Identify and count all cases and/or persons exposed: This includes the total number of confirmed/probable/possible exposed cases. An incident/outbreak data collection tool is available.

If staff screening is being considered as part of the investigation DL (2020)1 must be followed.

  • HAI deaths, which pose an acute and serious public health risk, must be reported to the Procurator Fiscal, refer to SGHD/CMO(2018)11.
  • The IMT must ensure affected patients, and where appropriate their next of kin, have been informed of any actual or potential harm as a result of the HAI.  Duty of Candour must be considered at each IMT.
  • All significant adverse event reviews involving a category 1 adverse event (events that may have contributed to or resulted in permanent harm, for example unexpected death) should also be reported.
  • If no new cases arise and any remaining cases are considered to no longer pose a risk, the IMT should agree on actions prior to resumption of normal service.

3.2.3 Communications

  • Following the PAG/IMT, the NHS Board is required to communicate all HIIAT Green, Amber and Red assessments with ARHAI Scotland, by completing the electronic Outbreak Reporting Tool (ORT) within 24 hours of HIIAT assessment. Incidents assessed as RED, AMBER and where ARHAI support is required GREEN will be reviewed for onward communication to Scottish Government Healthcare Associated Infection Policy Unit.
  • Any adverse event related to equipment or medication must be reported as soon as possible (within one working day) to the Incident Reporting and Investigation Centre (IRIC) and the escalation/de-escalation flowchart followed.
Closure of incident/outbreak with lessons learned
  • Once the incident is declared over, and in addition to reporting via the electronic outbreak reporting tool (ORT), the IMT / NHS Board should decide on the most appropriate format for a report. This is to communicate any lessons learned using the Hot Debrief Tool. Completion of this and submission to ARHAI Scotland is not mandatory, but for the purposes of sharing lessons learned across Scotland.

The IMT Chair, in discussion with the IMT, should determine whether further reporting on the incident and the incident management is required i.e. SBAR Report and full IMT report template are available in the resources section of the NIPCM website.  

Updated : 06/10/22 14:51

3.3 COVID-19 clusters/incidents definitions

The definitions below should be applied to determine if a COVID-19 cluster/incident within a healthcare setting is occurring and determine when it can end. When assessing patient and staff clusters to determine if an outbreak is occurring, a high degree of suspicion should be applied. Active surveillance should be undertaken by IPCTs to allow clusters/incidents to be detected at the earliest possible opportunity.

Note: the current COVID-19 cluster reporting system is currently under review 

3.3.1 Criteria to declare a COVID-19 cluster/incident in an inpatient setting

Two or more patient and/or staff cases of COVID-19 within a specific setting where nosocomial infection and ongoing transmission is suspected. For the purposes of this reporting, a high degree of suspicion should be applied and further investigation undertaken for any ward where there are unexpected cases of suspected or confirmed COVID-19. e.g., any cases that were not confirmed or suspected on admission. No time limit should be applied to determining whether a case is nosocomial e.g. 48 hours.


Where two or more staff cases of suspected or confirmed COVID-19 are identified and transmission between the staff members is suspected to be associated with workplace exposure/behaviours.

Note: If there is a single suspected or confirmed case in a patient who was not suspected as having COVID-19 on admission, this should initiate further investigation and risk assessment. This single case may constitute a possible cluster depending on the contacts and exposures identified. Contact tracing within acute inpatient settings should be based on local outbreak management and on the advice of the local Infection Control Doctor.

Where the patient has been in a side room with transmission-based precautions in place for 48 hours prior to symptom onset, and where all staff were wearing appropriate PPE appropriately, the IPCT may decide that there is no further action needed other than active monitoring for any new unexplained cases associated with the ward.

3.3.2 Criteria to determine that a COVID-19 cluster/incident in an inpatient setting has ended

No new test-confirmed or suspected cases with illness onset date 10 days following the last new confirmed case (from date of symptom onset or date of positive test if case has remained asymptomatic), within the affected ward or department.  The cluster can be closed provided that these criteria are met. 

Updated : 28/08/23 14:35

3.4 COVID-19 Antimicrobial Resistance and Healthcare Associated Infection (ARHAI) reporting requirements

Note: the current COVID-19 cluster reporting system is currently under review. 

Reporting should be led by the IPCT.  Reporting of COVID-19 should occur on recognition of a COVID-19 cluster

COVID-19 Cluster (possible COVID-19 cluster as defined in section 3.3)

  • A cluster should be assessed using the Healthcare Infection Incident Assessment Tool (HIIAT) as per Appendix 14 of the NIPCM. 
  • All confirmed clusters/possible outbreaks, must be reported to ARHAI Scotland. 
  • All COVID-19 clusters should be reported through the electronic ORT
  • All board-level data is accessible through the ARHAI Scotland interactive dashboards on the eViz portal
  • The data submitted above is reported through ARHAI Scotland to the Scottish Government Healthcare Associated Infection Policy Unit and it is essential that all fields within the tools are completed to enable reporting requirements to be met. 
  • Any media statements prepared by the IMT in response to the incident should be shared with ARHAI.

Updated : 28/08/23 14:40