What this is
What is an outbreak investigation record?
What is an outbreak investigation record?
It is the single record that carries a suspected cluster of workplace illness from first report to close-out: a fixed case definition, a timeline of onsets, the common exposures considered, the controls applied, and a conclusion on source. It exists so a cluster is worked the same way each time rather than reconstructed from memory once it has already passed.
What counts as a cluster for this record?
More than one case sharing a case definition, a plausible common exposure (area, shift, food, water, welfare facility or shared transport), and onsets close enough in time to suggest a common source rather than coincidence. A single isolated case is handled through illness exclusion, not this record.
What is the difference between a workplace source and a community source?
A workplace source means the exposure sits inside the site: a shared surface, a canteen item, a welfare facility, transport between shifts. A community source means workers brought the same circulating illness in independently. Most clusters among workers turn out to be community-sourced, which is exactly why the record has to show the working, not just state the conclusion.
Scope
When is an outbreak investigation record required?
This record covers one suspected cluster from first report through to a concluded source and closed status. Using it for a single isolated case, or for the ongoing plan that sits behind it, produces records that do not report cleanly against either.
Use this template when
- A cluster of illness among workers is suspected, whether or not the source is yet known
- More than one case shares a plausible common exposure and a workable case definition
- Public health or occupational health needs a documented case definition, timeline and exposure review to act on
- A linked record needs this one to exist, such as an illness exclusion or a notification already raised
- The investigation needs to conclude formally on workplace versus community source before it is closed
Do not use it for
- Illness Exclusion Record, which covers a single individual's exclusion from food handling on health grounds and their clearance to return, not a cluster.
- Infectious Disease Response Plan, which sets out the standing response arrangements for reporting, exclusion, cleaning and continuity, rather than one dated investigation.
- Health Screening Event Record, which documents a planned screening event, not a reactive cluster response.
- Absence Trend Review, which looks at absence patterns over time rather than a single suspected cluster with a fixed onset window.
- Formal notification to a public health authority itself, which is a separate action taken outside this record even though this record captures that it happened.
Compliance mapping
Which ISO 45001 cl.10.2 requirements does this satisfy?
ISO 45001 cl.10.2 covers reacting to an incident, evaluating and implementing the action needed, and reviewing whether it worked. This record is the evidence that each step happened in that order for a suspected illness cluster.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.10.2 | React to the incident and determine what happened | Header |
| ISO 45001 cl.10.2 | Establish the facts before drawing conclusions: a fixed case definition, active case finding, and a timeline of onsets | Case finding |
| ISO 45001 cl.10.2 | Evaluate the need for action by identifying plausible common exposures | Common exposures |
| ISO 45001 cl.10.2 | Implement the action needed to eliminate or reduce the cause | Control |
| ISO 45001 cl.10.2 | Review the effectiveness of the action taken and conclude on source | Outcome |
| ISO 45001 cl.10.2 | Retain documented information as evidence of the investigation and its outcome | Outcome |
What it does not cover
- A case definition written down before active case finding begins, which means people are being counted, or not counted, against a rule that was fixed in advance rather than adjusted as the picture changed.
- Contractors and agency staff included in the case count, which means the attack rate reflects everyone actually exposed on site, not just permanent employees.
- Common exposures reviewed by area, shift, food, water, welfare facilities and shared transport, which means the source conclusion rests on something checked rather than something assumed.
- A documented conclusion on workplace versus community source, which means the record states what changes and what does not, rather than leaving the question open.
- Public health notified where the situation required it, which means the decision not to notify was made on purpose, not by default.
Global
Outbreak Investigation Record requirements by country
The record itself is the same everywhere; what differs is which authority expects to be told about a workplace illness cluster, and under what threshold.
RIDDOR 2013 and the Health Protection (Notification) Regulations 2010
Certain occupational diseases are reportable to HSE under RIDDOR, and registered medical practitioners must notify local authorities of suspected notifiable diseases separately.
The site's own investigation does not replace either notification route; the record should show that the question of whether either applied was actually considered.
State and local notifiable disease reporting rules, alongside OSHA recordkeeping under 29 CFR 1904
Reportable disease thresholds are set at state and county level, not federally, and an illness cluster may also trigger OSHA recordability if it results in medical treatment or days away from work.
The investigation lead needs to know the local health department's reporting rule, not assume a single national one applies.
State and territory public health acts
Notification of a suspected outbreak to the relevant state health department is typically a duty on the treating practitioner or laboratory, but workplaces are commonly expected to cooperate and may be asked for exposure information directly.
This record is what a workplace hands over when a health department asks how the cluster was worked, so the timeline and exposure fields need to stand on their own.
How to complete it
How to complete an outbreak investigation record, step by step
Filling in the fields is mechanical. Four judgement calls decide whether the finished record would actually hold up if a health department, an auditor or a lawyer asked to see the working.
Two or more cases sharing a plausible exposure and a workable case definition is the threshold. Opening the record too late means the earliest cases, and the earliest evidence, are already gone.
Too loose, and unrelated illness gets swept in and inflates the count. Too tight, and genuine cases get missed. The definition needs to be written before counting starts and left alone once it has.
Undetermined is a legitimate conclusion, but only after common exposures have actually been checked. Closing as community source without checking the canteen, welfare facilities or shared transport is a conclusion reached, not earned.
If food, water or a shared consumable is even plausibly implicated, the product risk field needs a real answer, because it is the one most likely to trigger a hold elsewhere in the business.
What auditors find
Most common outbreak investigation record findings
What an auditor or a health department actually checks when they pull one of these records.
| Finding | Clause | What fixes it |
|---|---|---|
| Case definition was written after the case count had already been assembled | ISO 45001 cl.10.2 | Require the case definition field to be completed and locked before active case finding is marked underway. |
| Contractors and agency staff were left out of the case count | ISO 45001 cl.10.2 | Make contractor and agency inclusion a required field checked before the attack rate is calculated. |
| Attack rate was never calculated despite cases identified being greater than one | ISO 45001 cl.10.2 | Add a validation that blocks closing the record until the attack rate field carries a value. |
| Source was concluded without common area, shift, canteen or transport exposures being reviewed | ISO 45001 cl.10.2 | Sequence the form so the outcome section cannot be reached until every common exposure field has an answer. |
| Public health notification was left as No with no reason recorded | ISO 45001 cl.10.2 | Add a short justification field whenever notification is marked No or N/A, so the decision is visible, not silent. |
| The record was closed while workplace transmission was still marked possibly or yes | ISO 45001 cl.10.2 | Block closure, or require an open action, whenever transmission likelihood is anything other than No. |
Case in point
Case in point: the definition that moved
A site logged four gastrointestinal cases across two shifts inside three days and opened this record. The case definition was drafted loosely at first, then tightened once the fifth suspected case turned out to be unrelated food poisoning from outside work. The timeline held, but the case count changed shape twice before the attack rate was calculated, and nobody had recorded why.
The investigation lead went back and added a note against the case definition field explaining the revision, then recalculated the attack rate against the final definition only. The record still closed as community source, but this time the conclusion carried the working: the canteen, welfare facilities and shared transport had all been checked and cleared, not assumed clear.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- HLT-053
- Archetype
- Record
- Record ID
- OBI-2026-000
- Scoring
- Investigations closed
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 45001 cl.10.2
- Links
- Links Illness exclusion, Notification
- Tags
- Infection control, Outbreak
- Sections
- 5
- Fields
- 45
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 3
Header
13 fieldsRecord ID*
Auto sequence. Format OBI-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Suspected Illness*
Cases Identified*
First Case Onset*
Case Definition Written*
- Yes3 pts
- No0 pts
Investigation Lead*
Public Health Notified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Workplace Source Or Community Source
Most clusters among workers come from the community. Distinguishing the two decides whether you clean harder or change how the work is organised.
Case finding
6 fieldsCase Definition Applied Consistently*
- Yes3 pts
- Partly1 pt
- No0 pts
Active Case Finding Carried Out*
- Yes3 pts
- Partly1 pt
- No0 pts
Contractors And Agency Included*
- Yes3 pts
- Partly1 pt
- No0 pts
Timeline Of Onsets Built*
- Yes3 pts
- Partly1 pt
- No0 pts
Attack Rate Calculated*
- Yes3 pts
- Partly1 pt
- No0 pts
Cases Mapped To Area And Shift*
- Yes3 pts
- Partly1 pt
- No0 pts
Common exposures
6 fieldsCommon Area Identified*
- Yes3 pts
- Partly1 pt
- No0 pts
Common Shift Identified*
- Yes3 pts
- Partly1 pt
- No0 pts
Canteen Or Water Considered*
- Yes3 pts
- Partly1 pt
- No0 pts
Welfare Facilities Considered*
- Yes3 pts
- Partly1 pt
- No0 pts
Transport Sharing Considered*
- Yes3 pts
- Partly1 pt
- No0 pts
Community Outbreak Ongoing*
- Yes3 pts
- Partly1 pt
- No0 pts
Control
6 fieldsExclusions Applied*
- Yes3 pts
- None required3 pts
- No0 pts
Enhanced Cleaning Implemented*
- Yes3 pts
- Partly1 pt
- No0 pts
Hand Hygiene Reinforced*
- Yes3 pts
- Partly1 pt
- No0 pts
Welfare Facilities Improved*
- Yes3 pts
- Partly1 pt
- No0 pts
Product Risk Assessed*
- Yes3 pts
- Partly1 pt
- No0 pts
Communication To Workforce Issued*
- Yes3 pts
- Partly1 pt
- No0 pts
Outcome
14 fieldsSource Concluded*
- Community3 pts
- Workplace0 pts
- Mixed1 pt
- Undetermined1 pt
Workplace Transmission Likely*
- No3 pts
- Possibly1 pt
- Yes0 pts
Product Implicated*
- No3 pts
- Possibly1 pt
- Yes0 pts
Hold ID
Links to QUA-003 Hold ID
Outbreak Closed*
- Yes3 pts
- Ongoing1 pt
Closed Date
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Occupational Health*
Signature*
Site Manager*
Second Signature*
HLT-053 · record IDs look like OBI-2026-000 · Links Illness exclusion, Notification
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The form is the easy part. Fixing the case definition on time, chasing the common exposure checks, and keeping the notification decision visible is the work that actually slips.
Holds the outbreak investigation register, prompts for the case definition and timeline as soon as a cluster is opened, and keeps the link to illness exclusion and notification current.
Picks up the control-measure actions this record raises, such as enhanced cleaning or welfare facility improvements, and tracks them through to close alongside other site controls.
Watches the public health notification field and flags a No or N/A left without a justification, so the decision not to notify is a decision, not an omission.
Coordinates the crew across KnowHealth, KnowSafe and KnowComply, rolls open outbreak investigations into one view, and holds every write for your approval before it touches a record.
This template lives in KnowHealth — employee wellbeing. Exposure monitoring, health surveillance, case management and return to work.
Meet KnowHealth→Glossary
Outbreak Investigation Record definitions and key terms
- Case definition
- The fixed set of criteria used to decide whether a person counts as a case in this cluster, set before counting begins so the case list is not adjusted to fit a conclusion.
- Attack rate
- The proportion of an exposed group who became cases, used to judge how serious a cluster is relative to the number of people who could plausibly have been affected.
- Active case finding
- Deliberately looking for cases beyond the ones that self-reported, rather than only counting people who happened to raise a hand.
- Common source
- A single shared exposure, such as a food item, water supply or surface, that explains multiple cases without person-to-person spread between workers.
- Index case
- The first case identified in the cluster, used as the reference point for building the onset timeline even if it later turns out not to be the true first case.
FAQ
Frequently asked questions about outbreak investigation record
What is the outbreak investigation record template based on?+
It is built against ISO 45001 cl.10.2, the clause covering how an organisation reacts to an incident, evaluates and implements the action needed, and reviews whether that action worked.
What sections does the outbreak investigation record contain?+
There are five sections: header, case finding, common exposures, control and outcome. Together they hold 45 fields, most of them required.
How many outbreak investigation records should we have?+
This is a singleton in the sense that the register is set up once, but a new record instance is raised for every suspected cluster. It is not something you fill in once and leave.
Which programme does the outbreak investigation record belong to?+
It sits in the Wellbeing and Mental Health programme, which treats psychosocial risk and health protection with the same rigour as physical risk.
How is the outbreak investigation record scored?+
Scoring tracks investigations closed, where high is good. That only reflects reality if the case definition, timeline and exposure fields were completed at the time rather than backfilled once the cluster had already resolved.
Can the outbreak investigation record template be changed?+
Yes. Every field, option, score and conditional rule is editable, along with the links to illness exclusion and notification. Most sites run it as shipped for a cycle before adjusting anything.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Wellbeing and Mental Health
Wellbeing Survey
Asks workers about workload, support, stress and how they are coping
Psychosocial Risk Assessment
Assesses workplace factors that affect mental health, including demand, control, support and change
Workload Review
Reviews whether workload, hours and staffing are sustainable for a team
Wellbeing Program Plan
Sets out what wellbeing support is available and how people access it
Support Referral Record
Records that a worker was pointed towards support services, without recording why
Fitness for Duty Assessment
Assesses whether a worker is currently able to perform their role safely
More in Infection Control
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001 cl.10.2 — Incident, nonconformity and corrective action
- RIDDOR 2013 — Reporting of Injuries, Diseases and Dangerous Occurrences Regulations
- Health Protection (Notification) Regulations 2010 (UK)
- OSHA 29 CFR 1904 — Recording and Reporting Occupational Injuries and Illnesses
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.