Hostname: page-component-74656f9884-j7cmm Total loading time: 0 Render date: 2026-11-09T19:05:56.303Z Has data issue: false hasContentIssue false
  • English
  • Français

Towards data-driven refinement of an automated cluster alert system: assessing the concordance of epidemiological expert assessment and genotyping

Published online by Cambridge University Press:  10 October 2026

Darius Ferenc Ruether Open the ORCID record for Darius Ferenc Ruether [Opens in a new window] ,
Marco Paul ,
Sandra Jendrossek Open the ORCID record for Sandra Jendrossek [Opens in a new window] ,
Nicholas Jakob Böhm Open the ORCID record for Nicholas Jakob Böhm [Opens in a new window] ,
Brar Piening Open the ORCID record for Brar Piening [Opens in a new window] ,
Friederike Maechler Open the ORCID record for Friederike Maechler [Opens in a new window] ,
Anna Weber Open the ORCID record for Anna Weber [Opens in a new window] ,
Selin Saydan ,
Luis Alberto Peña Diaz Open the ORCID record for Luis Alberto Peña Diaz [Opens in a new window]  and
Michael Behnke Open the ORCID record for Michael Behnke [Opens in a new window]
...Show all authors
Darius Ferenc Ruether*
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany Berlin Institute of Health at Charité – University Medical Center Berlin, BIH Biomedical Innovation Academy, BIH Charité Digital Clinician Scientist Program , Berlin, Germany
Marco Paul
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany Unfallkrankenhaus Berlin, Germany
Sandra Jendrossek
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Nicholas Jakob Böhm
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Brar Piening
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Friederike Maechler
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Anna Weber
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Selin Saydan
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Luis Alberto Peña Diaz
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Michael Behnke
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Christine Geffers
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
Seven Johannes Sam Aghdassi
Affiliation:
Institute of Hygiene and Environmental Medicine, Charité – University Medical Center Berlin, corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin , Berlin, Germany
*
Corresponding author: Darius Ferenc Ruether; Email: ferenc-darius.ruether@charite.de
Rights & Permissions [Opens in a new window]

Abstract

Objective:

An automated CLuster AleRt system (CLAR) is employed at our hospital to detect clusters of relevant microorganisms. Alerts are subsequently assessed by infection prevention and control (IPC) experts to determine their epidemiological relevance. This study compares expert assessment of CLAR alerts with genotyping results.

Design:

Retrospective observational study

Methods:

We analyzed all CLAR alerts and genotyping reports generated during routine IPC activities between 08/2019 and 12/2024. CLAR alerts were classified relevant/not relevant based on epidemiological assessment by IPC physicians. Selected isolates were genotyped when transmission was suspected. Where multiple alerts and genotyping reports were available for an epidemiological cluster, only the first alert with genotyped isolates and the first corresponding genotyping report were considered, in order to emulate conditions at the onset of potential outbreaks. Genotyping was performed either by whole-genome sequencing (cgMLST) or repetitive-sequence-based polymerase chain reaction (rep-PCR). We calculated the proportion of CLAR alerts with ≥1 genotypically clustering isolate and performed a multivariable regression analysis to identify parameters associated with a higher likelihood of concordance.

Results:

We identified 116 relevant CLAR alerts corresponding to first genotyping reports (n = 77 cgMLST, n = 39 rep-PCR) of epidemiological clusters. Overall, these alerts contained 253 genotyped isolates. Genotypic clustering of ≥1 CLAR alert isolate was confirmed for 87 CLAR alerts (75.0%). A higher proportion of concordance with genotyping was seen for relevant alerts in neonatology (93.8%) and with carbapenem-resistant Enterobacterales (94.4%), also confirmed by multivariable analysis.

Conclusions:

Expert-assessed epidemiological relevance of CLAR alerts showed promising concordance with genomic findings and may inform future machine learning-based predictions.

Information

Type
Original Article
Information
Infection Control & Hospital Epidemiology , First View , pp. 1 - 9
Check for updates
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution and reproduction, provided the original article is properly cited.
Copyright
© The Author(s), 2026. Published by Cambridge University Press on behalf of The Society for Healthcare Epidemiology of America

Introduction

As outbreak detection remains a relevant task in infection prevention and control (IPC), several institutions have implemented routine sequencing strategies to uncover potential nosocomial transmission events. Due to resource constraints, these typically focus on multidrug-resistant organisms (MDROs) Reference Mellmann, Bletz and Boking1 or on clinical isolates, Reference Sundermann, Kumar and Griffith2 thus resulting in a potential blind spot concerning susceptible but epidemiologically relevant microorganisms. Semi or fully automated outbreak detection systems (AODS) may address this blind spot by detecting clusters based on patient movement, microorganism and phenotypical data. In 2018, our institution implemented an AODS, the CLuster AleRt system (CLAR), which continuously evaluates microorganism frequency to identify statistically unexpected counts of isolates. Reference Aghdassi, Kohlmorgen and Schroder3,Reference Schroder, Pena Diaz and Rohde4

Although automated outbreak detection has a long history in healthcare epidemiology, Reference Wright, Perencevich, Novak, Hebden, Standiford and Harris5–Reference Childress and Childress9 recent advances in machine learning (ML) have renewed interest in developing systems that can identify clinically and epidemiologically relevant clusters from routinely collected data. Reference El Arab, Almoosa, Alkhunaizi, Abuadas and Somerville10–Reference Sundermann, Chen and Miller12 While genotyping provides the most accurate assessment of transmission events, Reference Gilchrist, Turner, Riley, Petri and Hewlett13,Reference Prior, Becker and Brandt14 the limited resources lead to small and biased datasets. In contrast, expert-reviewed alerts generated by a hospitalwide AODS cover a much broader range of epidemiological events. However, the concordance between these assessments and genotypic clustering has not previously been investigated. Here, we addressed this question to inform future ML-based identification of relevant CLAR alerts and to better understand what information is captured when expert assessment will be used as the outcome for model development.

Methods

Study design and setting

We conducted a retrospective observational study including manually annotated CLAR alerts from all wards of Charité — University Medical Center Berlin, a 3,000-bed university hospital with three hospital sites and approximately 150 in patient units. CLAR alerts have been manually assessed for relevance since August 2019 as part of routine IPC work. This retrospective study considered alerts generated between August 1, 2019 and December 31, 2024, and genotyping results from the same period.

The CLuster AleRt system

CLAR is a module of the HygienePortal, a digital platform for IPC and hospital epidemiology developed in-house that supports IPC management and real-time data integration and analysis (Figure 1). It has the functionality of a rule-based AODS that generates alerts indicating temporal and spatial clusters of microorganism detections. Important settings of CLAR rules involve specification of considered microorganisms, specimen types, wards or departments, antibiotic susceptibility testing results, specification of time intervals and handling of repeat isolates (copy strains). Routinely implemented rules daily evaluate unusual patterns either of selected pathogens that are particularly relevant in the context of hospital outbreaks (Acinetobacter baumanii, Clostridioides difficile, Citrobacter species, Escherichia coli, Enterococcus faecalis, Enterococcus faecium, Enterobacter species, Klebsiella species, Pseudomonas aeruginosa, Staphylococcus aureus, Salmonella species, Serratia species, and selected viruses) or of any microorganism in blood cultures. CLAR is not restricted to MDRO, but also considers isolates without relevant antimicrobial resistance. Temporal clustering is assessed using predefined 14-day or 30-day intervals, while spatial clustering is evaluated based on patient movement at the level of individual hospital wards or prespecified groups of wards. By considering historical data of more than one year, CLAR generates alerts if the identified cluster size exceeds an expected threshold value calculated by at least one of six employed algorithms (early aberration reporting system (EARS), Reference Hutwagner, Thompson, Seeman and Treadwell15 cumulative sums, Reference Watkins, Eagleson, Veenendaal, Wright and Plant16 Farrington Reference Farrington, Andrews, Beale and Catchpole17 and three confidence interval algorithms using different assumptions of data distribution Reference Nishiura18 ). Further details of the system as well as the applied rules and algorithms are given in the supplementary material and the previous work by Schröder et al. Reference Schroder, Pena Diaz and Rohde4

Figure 1.

Schematic representation of data sources and integration of the automated outbreak detection system CLAR into routine IPC workflow. Data from the hospital electronic health records and the laboratory system were migrated into the HygienePortal, a digital, in-house developed IPC system of the hospital. It includes a data warehouse with structured data about patient movements (e.g., hospital admission and discharge, ward transfers), microbiological results (e.g., positive blood cultures), patient demographics (e.g., age, gender, comorbidities), and outcomes (e.g., in-hospital death). Important settings of CLAR rules involve definition of considered species, specimen type, ward or departments; antibiotic susceptibility testing results; specification of time intervals and handling of copy strains; use of different statistical algorithms: EARS, CuSums, Farrington, confidence interval methods (Poisson, score, normal distribution). CLAR, CLuster AleRt system; CuSums, cumulative sums; EARS, Early Aberration Reporting System.

Flowchart illustrating the integration of an automated outbreak detection system into routine infection prevention and control workflow.

The primary use case of CLAR is the early detection of hospital outbreaks, with a particular focus on identifying potential transmission chains. As additional cases are detected over time, the system may generate repeated alerts for the same cluster. Generated CLAR alerts were assessed by the IPC team on a daily basis without strictly predefined criteria. If the responsible physician, based on clinical context and epidemiological information, rated alerts as relevant and suspected transmission events, genotyping was frequently requested. In many cases, genotyping was not restricted to CLAR alert isolates, but could also include isolates of previous clusters or manually detected cases, reflecting complex constellations in real-world hospital environments.

The data sources of CLAR and the integration of the system into the routine workflow of the IPC team are visualized in Figure 1.

Genomic analysis of isolates

Genotyping was performed for available bacterial isolates either by whole-genome sequencing (WGS) using core-genome multilocus sequence typing (cgMLST) or repetitive-sequence-based polymerase chain reaction (rep-PCR). The corresponding reports contained information on the genomic concordance of all currently analyzed isolates in terms of identified clusters (based on species-specific allelic distance thresholds (cgMLST) or band pattern similarity thresholds (rep-PCR)). WGS was performed using short-read sequencing technology on Illumina MiSeq or iSeq platforms, while strain typing by rep-PCR was conducted using the DiversiLab system. If new cases with an epidemiological link were detected and additional isolates were requested for genotyping, a report series was created with follow-up reports containing information on the new isolates in comparison with older isolates. All reports were communicated to the requesting IPC team. The absence of genomic concordance was interpreted as evidence against transmission, whereas genomic concordance was considered suggestive of a possible transmission event.

Data collection

During the study period, all CLAR alerts of bacterial isolates that were manually annotated by the IPC team as relevant and all genotyping reports were reviewed. Genotyping reports contained information about species, isolates, sample date, reporting date, applied methods and assignment of isolates to genomic clusters. Data of CLAR alerts included affected wards and patients, species, isolates, sample date, specimen type, antibiotic susceptibility testing results, triggering algorithms (i.e. exceeding calculated threshold), patient movements and relevance assessment of IPC physicians. For the purpose of this article, we applied the following terminology described in Table 1.

Table 1.

Definition and explanation of applied terminology

A table defining and explaining terminology used in cluster detection and alert management.
Table 1. Long description

A table with six rows and two columns defining and explaining terminology used in cluster detection and alert management. The first column lists terms such as Alert series vs single alerts, Algorithmic clusters, Epidemiological clusters, Genotyping report series, Genomic clusters, and G+/G-CLAR alert. The second column provides detailed explanations for each term. For example, Alert series vs single alerts explains the difference between original and secondary alerts. Algorithmic clusters describe how alerts are counted to avoid double counting. Epidemiological clusters detail the relevance and genotyping assessment. Genotyping report series refers to constellations with multiple genotyping reports. Genomic clusters define how isolates with matching genotypes form a cluster. G+/G-CLAR alert classifies CLAR alerts based on genomic level matching.

The assessment of CLAR alerts and genotyping reports is visualized in section 3 of the supplementary material.

Inclusion and exclusion criteria

Given the retrospective nature of the study, we had to apply the following inclusion and exclusion criteria as well as the following sequence of steps to arrive at our final data set:

  1. 1. Genotyping reports from the investigated period were included, and, where applicable, report series were identified

  2. 2. CLAR alerts with bacterial isolates and assessed as relevant by IPC physicians were included, and, where applicable, alert series were identified

  3. 3. Only genotyping reports and alerts that could be matched (i.e. genotypically investigated CLAR alerts) were included. Where genotyping results were available for more than one CLAR alert per alert series, only the earliest alert with at least one genotyped isolate was included in the analysis. Similarly, where more than one genotyping result was available for an epidemiological cluster, only the first report with at least one CLAR isolate was included in the analysis. This decision was made to emulate conditions at the beginning of an outbreak. Initial reports of a genotyping report series reflect the time point at which an alert was first considered clinically relevant and triggered further investigation, including genotyping. Follow-up reports a priori have a higher likelihood of clustering which would introduce a bias toward higher concordance between epidemiological relevance and genotyping results. Consequently, the number of considered epidemiological clusters in the final data set equals the number of analyzed genotyping reports and CLAR alerts.

Primary and secondary outcomes

The primary outcome was the proportion of G+ CLAR alerts (definition provided in Table 1 and visualized in supplementary material) among all genotypically investigated CLAR alerts. This proportion was not reported as a positive predictive value, because not all relevant CLAR alerts underwent genotyping. Secondary outcomes were characteristics of CLAR alerts associated with concordance between relevance assessment and genotyping results.

Statistical analysis

To determine the concordance between epidemiological relevance and genotyping result, we calculated the proportion of G+ CLAR alerts of all genotypically investigated CLAR alerts. Differences between G+ and G- CLAR alerts were tested using chi-squared test (for categorical variables), Fisher’s exact test (for categorical variables with cell counts <5) or Mann–Whitney-U test (for continuous variables). Agreement statistics (e.g., Cohen’s kappa) were not calculated, because the study population was restricted to alerts classified as epidemiologically relevant. A multivariable logistic regression analysis with a stepwise backward approach was performed to investigate if parameters of CLAR alerts were associated with concordance between relevance assessment and genotyping results. Variables were selected based on epidemiological rationale, relevance to outbreak detection, and results of univariable analysis. A P value < .05 was used as the threshold for statistical significance. Analyses were performed in SPSS version 29.0 and R-Studio version 4.5.3.

Results

During the study period, 9,697 alerts for bacterial isolates were recorded. The alerts comprised 6,282 distinct algorithmic clusters (Figure 2). Of these, 3,960 alerts (40.8%) representing 2,992 algorithmic clusters (47.6%) were assessed as relevant. Suitable genotyping reports could be matched in 116 cases to CLAR alerts, resulting in 116 considered epidemiological clusters. Overall, the first CLAR alerts of epidemiological clusters comprised 360 unique patient isolates and contained between two to twelve patient isolates per alert (median: 2) (Table 2).

Figure 2.

Flowchart of CLAR alert assessment results. cgMLST, core genome multilocus sequence typing; CLAR, CLuster AleRt system.

Flowchart illustrating the assessment process of CLAR alerts for bacterial isolates.

Table 2.

Comparison of included CLAR alerts with isolates belonging to genomic clusters (G+ CLAR alert) and without isolates belonging to genomic clusters (G- CLAR alert)

Table comparing CLAR alerts with and without genomic clusters.
Table 2. Long description

A table comparing CLAR alerts with isolates belonging to genomic clusters (G+CLAR alerts) and without isolates belonging to genomic clusters (G-CLAR alerts). The table has 16 rows and 8 columns. Column headers are Overall, n (%); Period, n (%); Ward type, n (%); Alert size, median (IQR); Alerting algorithm, n (%); Number of alerting algorithms, n (%); Type of algorithmic cluster, n (%); Original alert of alert series or single alert, n (%); Species, n (%); Specimen type of CLAR alert isolates, n (%); Antibiotic resistance of CLAR alert isolates (MDRO), n (%). Row 1: Overall, n (%): All first CLAR alerts per epidemiological cluster, 116 (100.0); G+CLAR alerts, 87 (100.0); G-CLAR alerts, 29 (100.0); P value, ; % of G + CLAR alerts per category, 75.0. Row 2: Period, n (%): 08-12/2019, 6 (5.2); 2020, 31 (26.7); 2021, 39 (33.6); 2022, 17 (14.7); 2023, 8 (6.9); 2024, 15 (12.9). Row 3: Ward type, n (%): Intensive care unit (ICU), 64 (55.2); Non-ICU, 20 (17.2); Neonatology, 32 (27.6). Row 4: Alert size, median (IQR): Number of different patients, 2 (2-3). Row 5: Alerting algorithm, n (%): EARS, 78 (67.2); CuSums, 48 (41.4); Farrington, 35 (30.2); CI, 84 (72.4); CI-Poisson, 108 (93.1); Z-Score, 108 (93.1). Row 6: Number of alerting algorithms, n (%): 1, 6 (5.2); 2, 2 (1.7); 3, 27 (23.3); 4, 43 (37.1); 5, 26 (22.4); 6, 12 (10.3). Row 7: Type of algorithmic cluster, n (%): Single alert, 50 (43.1); Alert series, 66 (56.9). Row 8: Original alert of alert series or single alert, n (%): Yes, 78 (67.2); No, 38 (32.8). Row 9: Species, n (%): K. pneumoniae, 30 (25.9); E. faecium, 21 (18.1); S. aureus, 16 (13.8); S. marcescens, 14 (12.1); K. oxytoca, 8 (6.9); A. baumannii, 5 (4.3); E. coli, 5 (4.3); E. cloacae, 4 (3.4); C. freundii, 4 (3.4); P. aeruginosa, 3 (2.6); Other, 6 (5.2). Row 10: Specimen type of CLAR alert isolates, n (%): Blood culture, 32 (27.6); Other clinical, 55 (47.4); Screening, 60 (51.7). Row 11: Antibiotic resistance of CLAR alert isolates (MDRO), n (%): MRSA, 6 (5.2); ESBL, 14 (12.1); 3GCR, 29 (25.0); CRE, 18 (15.5); VRE, 16 (13.8); No MDRO, 61 (52.6.

1, 3, 4: Proportions do not sum to 100%, because one CLAR alert can be generated by multiple algorithms (1), can contain isolates from different specimen types (2) and with different antibiotic resistance patterns (4). These variables were analyzed separately for each category, as categories were not mutually exclusive.

2: Reasons for “No” for this variable were constellations where genotyping reports were available for isolates not contained in the first alert of an alert series, but from secondary alerts.

Abbreviations: 3GCR - Third-generation cephalosporine-resistant, CI - Confidence interval, CLAR- CLuster AleRt system, CRE - Carbapenem-resistant Enterobacterales, CuSums - Cumulative sums, EARS - Early aberration reporting system, ESBL - Extended-spectrum beta-lactamase, IQR - Interquartile range, MDRO - Multidrug-resistant organism, MRSA - Methicillin-resistant Staphylococcus aureus, VRE - Vancomycin-resistant Enterococci.

The number of triggering algorithms per CLAR alert was variable across the data set. In 108 alerts (93.1%), thresholds of two confidence interval algorithms (CI-Poisson, CI-Score) were exceeded, while thresholds of Farrington algorithm were exceeded in only 35 cases (30.2%). As per the definitions provided above, of the included 116 alerts, 50 (43.1%) were single alerts and 66 (56.9%) were part of an alert series. The majority of alerts was generated by intensive care units (n = 64, 55.2%) and neonatal wards (n = 32, 27.6%). The five most frequent microorganisms causing alerts were K. pneumoniae (25.9%), E. faecium (18.1%), S. aureus (13.8%), S. marcescens (12.1%) and K. oxytoca (6.9%). Alerts contained isolates that were detected in screening (51.7%), blood (27.6%) and/or other clinical specimen types (47.4%), and with a relevant antimicrobial resistance phenotype in 47.4% (3GCR: 25.0%, carbapenem-resistant Enterobacterales (CRE): 15.5%, vancomycin-resistant Enterococci: 13.8%, extended-spectrum beta-lactamase: 12.1%, methicillin-resistant Staphylococcus aureus: 5.2%). Percentages of CLAR alerts with specimen types and antimicrobial resistance phenotypes do not sum to 100%, as these characteristics could differ between isolates within the same CLAR alert. The epidemiological graphs of selected CLAR alerts are provided in the supplementary material.

Genotyping was performed by WGS in 77 reports (66.4%) and rep-PCR in 39 reports (33.6%). In total, the reports contained 508 patient isolates, of which 253 isolates (49.8%) were from the assessed CLAR alerts. In 87 of 116 CLAR alerts (75.0%), at least one isolate belonged to a genomic cluster (G+ CLAR alert, Table 2); at the isolate level, 171 of all 253 genotyped CLAR alert isolates showed genetic clustering (67.6%). In eight of the CLAR alerts (6.9%), isolates were grouped into multiple genomic clusters. In 29 of 116 CLAR alerts (25.0%), none of the isolates showed genetic concordance with other isolates (G- CLAR alert).

Comparing the 87 G+ CLAR alerts to 29 G- CLAR alerts, we detected some differences with respect to the alert characteristics and the genotyping results. In a larger proportion of G+ CLAR alerts, thresholds of CI-Poisson and CI-Score were exceeded (96.6% vs 82.8%, P = .023). Also, G+ CLAR alerts were more likely the original alert of an alert series or a single alert compared to G- CLAR alerts (72.4% vs 51.7%, P = .040). Non-significant differences between the two groups of CLAR alerts with regard to the causing microorganisms were found primarily for K. pneumoniae (G+ 29.9% vs G- 13.8%, P = .140) and E. faecium (G+ 14.9% vs G- 27.6%, P = .163). In G+ CLAR alerts compared to G- CLAR alerts, isolates were more often from screening materials (59.8% vs 27.6%, P = .005) and had a higher proportion of CRE (19.5% vs 3.4%, P = .041). No differences were found for the size of the CLAR alerts, i.e. the number of affected patients. The frequency of combinations per ward type and specimen type for G+ and G- CLAR alerts is depicted in Figure 3A. It demonstrates that the majority of G+ CLAR alerts was found in the neonatology involving screening isolates (n = 18) and on the ICU involving other clinical isolates (n = 17). Figure 3B shows combinations of alerting algorithms with a majority of G+ CLAR alerts being generated by CI algorithms and EARS (n = 27).

Figure 3.

UpSet plots showing the distribution and overlap of CLAR alert characteristics including ward type and specimen type (A), or alerting algorithms (B) the horizontal bars indicate the number of alerts per category (set size), while the vertical bars represent the number of alerts per intersection (intersection size). The intersection matrix below displays the combination of CLAR alert characteristics present in each intersection, with filled dots indicating included characteristics. Lines connecting dots indicate combinations of multiple characteristics. CI, confidence interval algorithm; CLAR, CLuster AleRt system; EARS, early aberration reporting system; ICU, intensive care unit; POI, poisson.

Two UpSet plots show the distribution and overlap of CLAR alert characteristics.
Figure 3. Long description

Panel A: An UpSet plot displays the distribution and overlap of CLAR alert characteristics including ward type and specimen type. The horizontal bars indicate the number of alerts per category (set size), while the vertical bars represent the number of alerts per intersection (intersection size). The intersection matrix below shows the combination of CLAR alert characteristics present in each intersection, with filled dots indicating included characteristics. Lines connecting dots indicate combinations of multiple characteristics. Panel B: Another UpSet plot shows the distribution and overlap of alerting algorithms. The horizontal bars indicate the number of alerts per category (set size), while the vertical bars represent the number of alerts per intersection (intersection size). The intersection matrix below displays the combination of CLAR alert characteristics present in each intersection, with filled dots indicating included characteristics. Lines connecting dots indicate combinations of multiple characteristics.

Alert characteristics associated with concordance between epidemiological relevance and genotypic clustering

We further investigated the differences between G+ and G- CLAR alerts by conducting multivariable logistic regression analyses with a stepwise backward selection. Parameters of the final model independently associated with genotypic clustering were alerts containing CRE isolates (OR: 11.08, 95%-CI: 1.37−89.87) and pertaining to the neonatology department (OR: 10.13, 95%-CI: 2.19−46.91). Variables removed during the selection process based on P > .05 were screening isolates, single alert or original alert of alert series, number of algorithms, K. pneumoniae and E. faecium.

Discussion

In 75.0% of the epidemiological clusters detected by CLAR, at least one isolate of the first CLAR alert belonged to a genomic cluster in the initial genotyping report. This finding corroborates our previous results that CLAR is capable of identifying relevant clusters Reference Schroder, Pena Diaz and Rohde4 and further suggests a moderate to high positive predictive value of expert assessment for identifying probable transmissions. The proportion of G+ CLAR alerts was especially high in the neonatology department (93.8%). This may be explained by the implementation of routine screening protocols in neonatology, usually performed at least weekly, which provide a more comprehensive and stable representation of the microorganism-specific endemic level. As a result, deviations from routine epidemiological patterns identified by CLAR and deemed relevant by experts are more likely to reflect true aberrations rather than stochastic variation, and thus more frequently correspond to underlying transmission events.

With regard to the type and number of algorithms, the highest proportions of G+ CLAR alerts were found for alerts triggered by three to four algorithms. Overall, the results indicate that, in the hospital setting, the use of multiple complementary algorithms may be advantageous for capturing different outbreak patterns, although some algorithms may perform better than others.

The predominance of screening samples in G+ CLAR alerts compared to isolates from blood culture or other clinical specimen types may indicate that screening isolates are more likely to be selected for genotyping in situations where there is already a high likelihood of transmission, whereas blood culture isolates may be genotyped also due to their clinical relevance rather than a strong suspicion of transmission. This underscores the necessity to also consider screening material in outbreak investigations.

While the most frequently represented microorganisms in genotyping reports for epidemiological clusters detected by CLAR were K. pneumoniae and E. faecium, the proportion of G+ CLAR alerts of these two microorganisms revealed a substantial difference (86.7% vs 38.2%). These findings align with previous research, such as the study by Weber et al., indicating a higher likelihood of transmission for 3GCR K. pneumoniae isolates detected by CLAR than for 3GCR E. coli. Reference Weber, Neffe and Diaz19

The majority of G+ CLAR alerts did not involve MDRO. This correlation further emphasizes the importance of incorporating non-MDROs in AODS, while the scope of manual or genomic systems is often limited to MDROs. Reference Mellmann, Bletz and Boking1,Reference Sobkowiak, Schwierzeck and van Almsick20 However, among relevant CLAR alerts involving CRE, 17 of 18 alerts contained at least one isolate belonging to a genomic cluster.

Results of the multivariable regression analysis confirmed a higher likelihood of concordance between expert assessment and genotypic clustering in case of alerts with CRE or originating from neonatology. However, generalisability of the model is limited, because it focuses on the onset of new clusters. It is important to emphasize that the model does not identify factors associated with outbreak occurrence itself. Rather, it assesses which characteristics of alerts that have already been classified as epidemiologically relevant are associated with a higher likelihood of genotypic confirmation. Nevertheless, when derived from local epidemiological data and expert assessments, such analyses may facilitate interpretation of ML models predicting relevance by providing insight into the circumstances under which epidemiological and genomic evidence are most likely to align.

Although the first studies on automated outbreak detection using statistical surveillance methods were published in the 1980s, Reference Schifman and Palmer8,Reference Childress and Childress9 more recent studies continue to investigate such approaches in hospital settings, albeit with different methodologies. Reference Baker, Septimus and Kleinman21,Reference Wolf, Barth-Jakschic, Bader, Peter and Liese22 None of them comprehensively incorporated both genomic information and epidemiological expert assessment. Other approaches have taken the opposite perspective, using routine sequencing as the starting point and subsequently reconstructing epidemiological links through temporal associations and patient movement. Reference Sundermann, Kumar and Griffith2,Reference Sobkowiak, Schwierzeck and van Almsick20 While these frameworks provide high-resolution insights into transmission pathways, they are inherently resource-intensive and may not be feasible outside large tertiary care centers, indicating the need to reduce the reliance on WGS. Reference Liu, Chen and Sundermann23 Also, genotyping results are easier to interpret when an epidemiological link has already been established, as cluster assignment in sequencing-based analyses depends on predefined cut-offs and is therefore influenced by the chosen methodology. Reference Maechler, Weber and Schwengers24

While recent economic evaluations have suggested that continuous genomic surveillance may be a cost-effective strategy compared with outbreak-triggered sequencing by enabling earlier detection of transmission events, Reference Egli and Howden25 our findings support a targeted alternative, in which AODS are used to prioritize isolates with the highest likelihood of representing epidemiologically relevant events. The CLAR system, combined with expert epidemiological assessment, enables the identification and prioritization of potentially relevant clusters among routine microbiological findings before sequencing resources are allocated. Such a workflow may provide a pragmatic balance between comprehensive surveillance and resource efficiency by focusing genomic investigations on signals most likely to represent true transmission events.

Several limitations must be acknowledged when interpreting the findings of this study. First, as alert assessment depended on the evaluating IPC expert, inter-individual variability may have influenced which alerts were classified as relevant and therefore included in the analysis. Second, a substantial proportion of genotyping results from the early study period were based on rep-PCR, which has lower discriminatory resolution compared to WGS. This may have led to misclassification of genomic relatedness and thus affected the assessment of transmission. Third, isolates of CLAR alerts deemed not relevant were not routinely sequenced, which limits our ability to assess false negatives. In addition, a non-negligible number of CLAR alert isolates could not undergo genotyping because they were not retained. Fourth, to emulate early outbreak conditions, we disregarded follow-up alerts and genomic reports, which, if included, might have altered results. Fifth, the likelihood of observing genomic clustering may also vary between pathogens depending on their underlying population structure and genomic diversity, which we could not investigate, because our study was based on selectively genotyped isolates from CLAR alerts rather than systematic sampling of the hospitalwide pathogen population. Finally, we only assessed alerts from routinely implemented rules including the microorganisms mentioned in the methods, or from blood cultures. Thus, clusters of unusual pathogens, especially if not recovered from blood cultures, were not investigated, limiting the generalizability of our results.

Together, our findings suggest that epidemiological context complements genomic surveillance and may help prioritize isolates for targeted sequencing. Future ML models could learn to incorporate this information to support outbreak detection and cluster prioritization. However, expert contextualization will remain essential, as neither epidemiological nor genomic data alone fully capture the complexity of transmission dynamics in clinical settings. ML-based systems could therefore help allocate limited resources, particularly healthcare staff and sequencing capacity.

Supplementary material

The supplementary material for this article can be found at https://doi.org/10.1017/ice.2026.10569

Data availability statement

Not applicable, because all data were collected within the context of the surveillance of healthcare-associated infections conducted in accordance with the German Protection against Infection Act.

Acknowledgements

Dr. Rüther is participant in the Berlin Institute of Health (BIH) Charité Digital Clinician Scientist Program funded by the Charité – University Medical Center Berlin, and the Berlin Institute of Health at Charité.

Author contributions

F.D.R. formulated the research questions with the input of S.J.S.A., S.S., M.B., and L.A.P.D. provided the necessary programing and performed data extraction. F.D.R., M.P., S.J., and N.B. collected the data. F.D.R. was responsible for data analysis and composed the manuscript with the input of all co-authors.

Financial support

None reported.

Competing interests

The authors declare that they have no competing interests.

Ethical statement

The study was approved by the Charité University Medical Center Institutional Review Board (process number: EA2/180/25). Informed consent was not needed for this retrospective analysis of routinely collected data within the context of the surveillance of healthcare-associated infections conducted in accordance with the German Protection against Infection Act.

Use of artificial intelligence tools

OpenAI’s ChatGPT was employed as a drafting tool to assist with refining the language, coherence, and structure of this manuscript. All scientific content, analyses, and conclusions were exclusively the responsibility of the authors.

References

Mellmann, A, Bletz, S, Boking, T, et al. Real-time genome sequencing of resistant bacteria provides precision infection control in an institutional setting. J Clin Microbiol 2016;54:2874–2881.10.1128/JCM.00790-16CrossRefGoogle Scholar
Sundermann, AJ, Kumar, P, Griffith, MP, et al. Real-time genomic surveillance for enhanced healthcare outbreak detection and control: clinical and economic impact. Clin Infect Dis 2026;82:134–141.10.1093/cid/ciaf216CrossRefGoogle ScholarPubMed
Aghdassi, SJS, Kohlmorgen, B, Schroder, C, et al. Implementation of an automated cluster alert system into the routine work of infection control and hospital epidemiology: experiences from a tertiary care university hospital. BMC Infect Dis 2021;21:1075.10.1186/s12879-021-06771-8CrossRefGoogle ScholarPubMed
Schroder, C, Pena Diaz, LA, Rohde, AM, et al. Lean back and wait for the alarm? Testing an automated alarm system for nosocomial outbreaks to provide support for infection control professionals. PLoS One 2020;15:e0227955.10.1371/journal.pone.0227955CrossRefGoogle ScholarPubMed
Wright, MO, Perencevich, EN, Novak, C, Hebden, JN, Standiford, HC, Harris, AD. Preliminary assessment of an automated surveillance system for infection control. Infect Control Hosp Epidemiol 2004;25:325–332.10.1086/502400CrossRefGoogle ScholarPubMed
Hacek, DM, Cordell, RL, Noskin, GA, Peterson, LR. Computer-assisted surveillance for detecting clonal outbreaks of nosocomial infection. J Clin Microbiol 2004;42:1170–1175.10.1128/JCM.42.3.1170-1175.2004CrossRefGoogle ScholarPubMed
Brown, SM, Benneyan, JC, Theobald, DA, et al. Binary cumulative sums and moving averages in nosocomial infection cluster detection. Emerg Infect Dis 2002;8:1426–1432.10.3201/eid0812.010514CrossRefGoogle ScholarPubMed
Schifman, RB, Palmer, RA. Surveillance of nosocomial infections by computer analysis of positive culture rates. J Clin Microbiol 1985;21:493–495.10.1128/jcm.21.4.493-495.1985CrossRefGoogle ScholarPubMed
Childress, JA, Childress, JD. Statistical test for possible infection outbreaks. Infect Control 1981;2:247–249.10.1017/S0195941700055144CrossRefGoogle ScholarPubMed
El Arab, RA, Almoosa, Z, Alkhunaizi, M, Abuadas, FH, Somerville, J. Artificial intelligence in hospital infection prevention: an integrative review. Front Public Health 2025;13:1547450.10.3389/fpubh.2025.1547450CrossRefGoogle ScholarPubMed
van der Werff, SD, van Rooden, SM, Henriksson, A, et al. The future of healthcare-associated infection surveillance: automated surveillance and using the potential of artificial intelligence. 2025;298:54–77.J Intern Med 10.1111/joim.20100CrossRefGoogle ScholarPubMed
Sundermann, AJ, Chen, J, Miller, JK, et al. Whole-genome sequencing surveillance and machine learning for healthcare outbreak detection and investigation: a systematic review and summary. Antimicrob Steward Healthc Epidemiol 2022;2:e91.10.1017/ash.2021.241CrossRefGoogle ScholarPubMed
Gilchrist, CA, Turner, SD, Riley, MF, Petri, WA Jr., Hewlett, EL. Whole-genome sequencing in outbreak analysis. Clin Microbiol Rev 2015;28:541–563.10.1128/CMR.00075-13CrossRefGoogle ScholarPubMed
Prior, K, Becker, K, Brandt, C, et al. Accurate and reproducible whole-genome genotyping for bacterial genomic surveillance with Nanopore sequencing data. J Clin Microbiol 2025;63:e0036925.10.1128/jcm.00369-25CrossRefGoogle ScholarPubMed
Hutwagner, L, Thompson, W, Seeman, GM, Treadwell, T. The bioterrorism preparedness and response early aberration reporting system (EARS). J Urban Health 2003;80:i89–96.10.1007/PL00022319CrossRefGoogle ScholarPubMed
Watkins, RE, Eagleson, S, Veenendaal, B, Wright, G, Plant, AJ. Applying cusum-based methods for the detection of outbreaks of Ross River virus disease in western Australia. BMC Med Inform Decis Mak 2008;8:37.10.1186/1472-6947-8-37CrossRefGoogle ScholarPubMed
Farrington, CP, Andrews, NJ, Beale, AD, Catchpole, MA. A statistical algorithm for the early detection of outbreaks of infectious disease. J Roy Stat Soc a Sta 1996;159:547–563.10.2307/2983331CrossRefGoogle Scholar
Nishiura, H. Early detection of nosocomial outbreaks caused by rare pathogens: a case study employing score prediction interval. Osong Public Health Res Perspect 2012;3:121–127.10.1016/j.phrp.2012.07.010CrossRefGoogle ScholarPubMed
Weber, A, Neffe, L, Diaz, LAP, et al. Analysis of transmission-related third-generation cephalosporin-resistant enterobacterales by electronic data mining and core genome multi-locus sequence typing. J Hosp Infect 2023;140:96–101.10.1016/j.jhin.2023.07.020CrossRefGoogle ScholarPubMed
Sobkowiak, A, Schwierzeck, V, van Almsick, V, et al. The dark matter of bacterial genomic surveillance-antimicrobial resistance plasmid transmissions in the hospital setting. J Clin Microbiol 2025;63:e0012125.10.1128/jcm.00121-25CrossRefGoogle ScholarPubMed
Baker, MA, Septimus, E, Kleinman, K, et al. A trial of automated outbreak detection to reduce hospital pathogen spread. NEJM Evid. 2024;3:EVIDoa2300342.10.1056/EVIDoa2300342CrossRefGoogle ScholarPubMed
Wolf, S, Barth-Jakschic, E, Bader, B, Peter, S, Liese, J. Hospital-wide pathogen transmission surveillance combining epidemiological, genetic, and spectroscopic approaches. Microbiol Spectr 2026;14:e0223025.10.1128/spectrum.02230-25CrossRefGoogle ScholarPubMed
Liu, C, Chen, J, Sundermann, AJ, et al. Exploring the utility of MALDI-TOF mass spectrometry and antimicrobial resistance in hospital outbreak detection. ArXiv[Preprint]; 2026. arXiv:2602.16737v1.Google ScholarPubMed
Maechler, F, Weber, A, Schwengers, O, et al. Split k-mer analysis compared to cgMLST and SNP-based core genome analysis for detecting transmission of vancomycin-resistant enterococci: results from routine outbreak analyses across different hospitals and hospitals networks in Berlin, Germany. Microb Genom 2023;9:mgen000937.Google ScholarPubMed
Egli, A, Howden, BP. A global economic perspective on whole-genome sequencing strategies for pathogens: continuous surveillance versus outbreak-triggered investigations. Lancet Microbe 2026:101416.10.1016/j.lanmic.2026.101416CrossRefGoogle ScholarPubMed
Dominguez, SR, Anderson, LJ, Kotter, CV, et al. Comparison of whole-genome sequencing and molecular-epidemiological techniques for Clostridium difficile strain typing. J Pediatric Infect Dis Soc 2016;5:329–332.10.1093/jpids/piv020CrossRefGoogle ScholarPubMed
Spinler, JK, Raza, S, Thapa, S, et al. Comparison of whole genome sequencing and repetitive element PCR for multidrug-resistant Pseudomonas aeruginosa strain typing. J Mol Diagn 2022;24:158–166.10.1016/j.jmoldx.2021.10.004CrossRefGoogle ScholarPubMed
Figure 0

Figure 1. Schematic representation of data sources and integration of the automated outbreak detection system CLAR into routine IPC workflow. Data from the hospital electronic health records and the laboratory system were migrated into the HygienePortal, a digital, in-house developed IPC system of the hospital. It includes a data warehouse with structured data about patient movements (e.g., hospital admission and discharge, ward transfers), microbiological results (e.g., positive blood cultures), patient demographics (e.g., age, gender, comorbidities), and outcomes (e.g., in-hospital death). Important settings of CLAR rules involve definition of considered species, specimen type, ward or departments; antibiotic susceptibility testing results; specification of time intervals and handling of copy strains; use of different statistical algorithms: EARS, CuSums, Farrington, confidence interval methods (Poisson, score, normal distribution). CLAR, CLuster AleRt system; CuSums, cumulative sums; EARS, Early Aberration Reporting System.

Figure 1

Table 1. Definition and explanation of applied terminologyTable 1 long description.

Figure 2

Figure 2. Flowchart of CLAR alert assessment results. cgMLST, core genome multilocus sequence typing; CLAR, CLuster AleRt system.

Figure 3

Table 2. Comparison of included CLAR alerts with isolates belonging to genomic clusters (G+ CLAR alert) and without isolates belonging to genomic clusters (G- CLAR alert)Table 2 long description.

Figure 4

Figure 3. Figure 3 long description.UpSet plots showing the distribution and overlap of CLAR alert characteristics including ward type and specimen type (A), or alerting algorithms (B) the horizontal bars indicate the number of alerts per category (set size), while the vertical bars represent the number of alerts per intersection (intersection size). The intersection matrix below displays the combination of CLAR alert characteristics present in each intersection, with filled dots indicating included characteristics. Lines connecting dots indicate combinations of multiple characteristics. CI, confidence interval algorithm; CLAR, CLuster AleRt system; EARS, early aberration reporting system; ICU, intensive care unit; POI, poisson.

Supplementary material: File

Ruether et al. supplementary material

Ruether et al. supplementary material
Download Ruether et al. supplementary material(File)
File 733.9 KB