Public Health Surveillance System | Moana Digital Health

Overview

A Ministry of Health operating without a functioning public health surveillance system is making national health policy decisions in the dark. Without systematic, real-time data on what is happening clinically across the country, outbreak detection depends on rumour rather than evidence, resource allocation depends on historical patterns rather than current need, and performance accountability depends on annual reports that arrive too late to drive any meaningful response.

Moana Surveillance (moana-surveillance) is a dedicated national public health surveillance platform that was built to solve this problem. It operates as a standalone service within the Moana platform, aggregating programme data from every connected facility into a single Ministry-facing intelligence layer. Ministry programme officers access national health data, population-level indicators, trend analytics, outbreak alerts, and geographic visualisations without ever interacting with individual patient records. The surveillance layer receives aggregated event data from the clinical EHR layer, not raw patient records, so patient privacy is preserved at the individual level while national programme visibility is complete.

Moana Surveillance is built for Ministries of Health that need a national intelligence layer on top of facility-level clinical data. It is available as a standalone service and as an integrated component of the broader Moana platform. The same architecture that serves a single national Ministry can scale to multi-country deployments, connecting facility networks across different geographies into one shared surveillance framework.

With over 80 endpoints across programmes, indicators, alert rules, events, trends, predictive analytics, GIS, Patient Master Index, dashboards, reports, and Ministry authentication, moana-surveillance is a production-grade Ministry intelligence platform, not a reporting add-on. It has its own authentication domain, separate from the facility-level clinical system, ensuring that Ministry access is governed independently of clinical staff access.

Programme Coverage

The surveillance engine covers eleven active programme areas from a single shared aggregation and alerting framework:

•        Non-Communicable Diseases: hypertension screening coverage, diabetes management rates, cardiovascular risk factor prevalence, cancer screening coverage

•        Communicable Diseases: TB case notification rates, dengue incidence, influenza-like illness trends, notifiable disease reporting

•        Immunisation: vaccination coverage by antigen and age group, defaulter identification, cold chain monitoring

•        Maternal and Child Health: ANC1 and ANC4+ coverage, skilled birth attendance rate, neonatal mortality rate, maternal mortality ratio

•        Mortality: cause-of-death distribution, crude death rate, age-standardised mortality analysis

•        Laboratory: laboratory-confirmed case counts, diagnostic yield by test type, turnaround time performance

•        Emergency and Syndromic Surveillance: case definitions for priority syndromes, notifiable disease cluster detection

•        Pharmacy: dispensing trend analysis, medicine consumption rates, stock availability monitoring

•        Referrals and Patient Movement: referral completion rates, inter-facility patient flow

•        Health System Performance: facility reporting compliance, data completeness rates, system uptime

•        Civil Registration: live birth registration coverage, stillbirth rate, neonatal mortality rate, under-five mortality rate

Core Capabilities

Hierarchical Geographic Aggregation

Data is aggregated simultaneously across four geographic levels: facility, district, region, and country. Every indicator value is computed at all four levels from the same underlying event data in a single aggregation pass. A Ministry dashboard showing national ANC4+ coverage at 68% can be drilled down to regional breakdown, then to district comparison, then to individual facility performance, with each level reflecting the same underlying clinical data. Aggregation runs on a configurable cron schedule: hourly for critical indicators, daily for standard programme indicators, and weekly and monthly for scheduled report generation.

Four-Tier Threshold Alerting

Configurable threshold rules evaluate every indicator against defined normal ranges and trigger alerts at four severity levels: NORMAL when indicators are within the expected range, WATCH when an indicator approaches a threshold of concern, ALERT when a threshold of concern is crossed, and CRITICAL when an indicator crosses a threshold requiring immediate response. Alert rules support both absolute thresholds and percentage-above-baseline thresholds, with a 52-week seasonal adjustment applied to suppress alerts that are attributable to expected seasonal variation rather than genuine signal. Alerts are delivered via in-app notification, email via SMTP, and SMS via Twilio, with notification routing configurable per alert type and per recipient role.

Predictive Analytics and Forecasting

Holt-linear forecasting models project indicator trajectories forward from current trends. Outbreak risk is scored per district based on deviation from seasonal baseline, recent trend direction, and comparison against historical outbreak patterns. Bed occupancy forecasting projects days-to-ceiling for facility and network capacity based on current admission and discharge rates. Staffing gap probability is estimated from patient volume trends. Stock depletion forecasting projects days-to-stockout for essential medicines from consumption rate history. Scenario modelling allows Ministry planners to evaluate the projected impact of interventions, such as a targeted vaccination campaign or a medicine redistribution, before deploying resources.

Z-Score Anomaly Detection

Statistical anomaly detection runs alongside threshold alerting to catch unusual patterns in indicator data that may not breach absolute thresholds but represent significant deviations from an individual facility's or district's own historical baseline. Z-score anomaly alerts fire when a residual exceeds 2.5 standard deviations from the baseline trend, flagging facilities or districts whose performance is statistically abnormal relative to their own history. This approach catches deteriorating performance before it crosses a global alert threshold, enabling earlier intervention.

Geographic Mapping and GIS

District-level choropleth maps visualise indicator values geographically, allowing Ministry teams to identify regional patterns, high-burden areas, programme coverage gaps, and emerging outbreak clusters at a glance. Shapefiles are uploaded directly into the surveillance system in .shp, .shx, and .dbf format, supporting country-specific geographic boundary configurations without custom development. Regional comparison charts sit alongside the map view, enabling quantitative ranking of districts alongside geographic pattern recognition. Facility drill-down from the map connects geographic views to individual facility performance detail and facility-level data freshness status.

Patient Master Index Deduplication

In multi-facility health systems where patients register at more than one facility over their lifetime, national statistics risk double-counting individuals if duplicate patient records are not identified and resolved. The Patient Master Index deduplication engine uses Soundex and Metaphone phonetic matching algorithms to identify records that are likely to represent the same patient across different facilities, even when names have been spelled differently or recorded with different transliteration conventions. An optional AES-256-GCM encrypted patient hash provides a privacy-preserving cross-facility identity signal without exposing raw patient identifiers. Candidate duplicate pairs are presented to a supervisor review queue with a confidence score. Supervisors review the match evidence and confirm or reject the proposed merge. Only confirmed merges result in record consolidation, ensuring that national statistics count unique individuals rather than registrations.

Offline-First Resilience and Late Sync Reprocessing

Facilities that operate offline, which in Pacific Island health systems includes a significant proportion of the facility network, queue surveillance events locally and transmit them when connectivity is restored. Late-syncing data is automatically incorporated into historical indicator recalculations through a late sync reprocessing pipeline, so delayed data does not distort trend calculations or leave permanent gaps in historical indicators. Facility data freshness status is displayed in the Ministry dashboard as FRESH, STALE, or OFFLINE, giving Ministry teams clear visibility into which facilities are contributing current data to national totals and which have synchronisation delays that should be investigated.

Ministry-Grade Authentication and Governance

The surveillance service operates on its own separate authentication domain, independent of the facility-level clinical EHR. Ministry user accounts require OTP-based two-factor authentication, minimum 12-character passwords with 90-day rotation and last-five-password history enforcement, device fingerprinting, and login alerts for access from unrecognised devices. Session tokens are scoped to the surveillance domain and carry explicit ministry-role claims. A breach declaration workflow supports incident management: when a security or data breach is declared, the workflow tracks the declaration through defined status stages (DECLARED, NOTIFIED, ACKNOWLEDGED, and OVERDUE or RESOLVED), with SLA tracking defaulting to 72 hours for notification and an auto-escalation path if acknowledgment is not received. This breach workflow is designed for IHR compliance.

Optional AI Narrative Insights

An optional AI narrative layer generates plain-language explanations of indicator movements for Ministry programme officers who may not have a biostatistics background. When enabled, the feature summarises what is happening in an indicator, what recent trend it shows, and what the forecasting model suggests about trajectory, in plain language rather than numbers. The feature is disabled by default and requires explicit Ministry sub-processor approval before activation. No patient-identifiable data is ever sent to the AI system: only aggregate indicator codes, programme codes, geographic identifiers, and numerical values are used in the prompt. The AI provider is configurable between Anthropic Claude for cloud processing and a self-hosted model including Llama, Mistral, or Phi via vLLM or Ollama for complete data sovereignty. AI-generated narratives are cached with a configurable TTL to minimise API costs, with cache hit ratios tracked for operational monitoring.

Automated Ministry Reporting

Weekly reports are generated automatically every Monday at 9am. Monthly reports are generated on the first of each month at 9am. Report templates are locked to Ministry-approved formats to ensure consistency across reporting periods and to support comparative analysis. Report outputs are available in CSV and Excel formats with PDF on the development roadmap. Custom reporting periods are supported for ad-hoc Ministry requests, donor reporting deadlines, and emergency situation reporting requirements.

Who Uses This Module

Ministry of Health Programme Officers

Access national programme indicator dashboards, review trend analytics, configure threshold alert rules, and generate standard report outputs for routine Ministry reporting.

National Epidemiologists and Surveillance Officers

Monitor outbreak alert queues, review anomaly detection findings, use GIS mapping to identify geographic clusters, and manage the Patient Master Index deduplication review queue.

Ministry of Health Leadership

Access national health performance dashboards, review predictive analytics outputs, and use scenario modelling for health system planning and resource allocation decisions.

Development Partners and Donor Agencies

Where Ministry authorisation is granted, access programme indicator reports and M&E outputs formatted to development partner reporting requirements.

How This Connects to the Rest of Moana

The surveillance layer receives structured event data from every clinical module in the Moana EHR: patient registrations, clinical encounters, diagnoses, laboratory results, pharmacy dispensing, immunisation events, ANC visits, births, deaths, and civil registration events all generate corresponding surveillance events. The surveillance service processes these events through its aggregation pipeline independently of the clinical system, ensuring that Ministry reporting workloads do not impact clinical system performance. The surveillance authentication domain is separate from the clinical EHR domain, so Ministry users never access the clinical system directly.

Standards and Interoperability

The surveillance layer integrates with DHIS2 via a bidirectional Web API connector, publishing aggregate indicators as DHIS2 Data Value Sets and pulling organisation unit hierarchy. OpenHIE architecture principles are followed, with Moana's FHIR endpoints registerable as mediators in OpenHIM for national health information exchange connectivity. Indicator definitions align with WHO surveillance standards, SDG reporting frameworks, and national health plan M&E indicator sets. IHR compliance is supported through the breach declaration workflow and incident management capabilities.