Implementation System of a Biosurveillance System in the Republic of Korea and Its Legal Ramifications.

Laws are fundamental tools that regulate and manage various issues to protect the rights of the people in a society. Legislation on disease surveillance enables agencies to regulate and manage public health, including preventing the spread of infectious diseases. We assessed the Infectious Disease Prevention and Control Act of Korea (IDPCA) through the lens of biosurveillance to understand its effectiveness in protecting public health. In addition, the relevant legislation and regulations of the United States and the World Health Organization were examined. The evaluation concludes that the current IDPCA is limited in terms of providing guidance for early detection of and response to hazards using integrated data and an information-sharing system. Further revision of the laws is needed to enable early detection and warning of potential threats to public health.

The 2015 Middle East respiratory syndrome (MERS) outbreak in the Republic of Korea (ROK) was the second largest outbreak of its kind, with 186 confirmed cases and 38 deaths.[1] In addition, increasing international travel and infectious disease outbreaks in recent decades have prompted further calls to strengthen national surveillance systems.[2] During the MERS outbreak in 2015, national legislation pertaining to infectious diseases did not include guidelines on MERS. Because of the lack of guidelines and previous experience with MERS, the Korea Centers for Disease Control and Prevention (KCDC) failed to provide a timely response.[3] Given that outbreaks of disease occur beyond predictions and jurisdictional boundaries, the ROK government initiated intergovernmental programs. One such program is the big data–based Food Poisoning Prediction Model, developed in 2015.[4] The model was developed by several government departments to prevent and control outbreaks of foodborne illness. In 2019, the intergovernmental Joint Response to Antimicrobial-Resistant Bacteria project was initiated. This was based on the understanding that combating antimicrobial resistance requires an integrated approach focused on humans, animals, and the environment.[5]

Despite these intergovernmental programs to strengthen surveillance systems, a framework to ensure sustained coordination among government departments has yet to be established. Coordination among departments for temporary programs often is not sustained over the long term. To facilitate rapid detection and response to public health threats, systematic coordination of departments is vital. The United States has led implementation of biosurveillance systems involving coordination among multiple agencies, and other countries are rapidly following suit.[6,7]

In the ROK, infectious disease surveillance is carried out by the KCDC under the Ministry of Health and Welfare. Infectious disease surveillance involves the continuous collection and analysis of data, mostly from reports of medical personnel.[8] Traditional infectious disease surveillance, including the existing system in the ROK, focuses on human diseases and does not incorporate the concept that disease outbreaks can be spread by nonhuman vectors.[9] To address these limitations of the current infectious disease surveillance system of the ROK, means of strengthening the current system should be explored in the context of biosurveillance. Unlike infectious disease surveillance, which tends to target only identified cases, biosurveillance requires the integration of dispersed data on human and animal health.

Such integration requires coordination among various stakeholders to achieve early detection and mount a response to any biological threat. Because the concept of biosurveillance is relatively new to the public health disciplines, it is often misunderstood as a massive compilation of data available in various government agencies. Rather, it is recommended that the regulations mandating jurisdictional collaboration be examined to enable integration of relevant information in different agencies, if not across the government.

Examination of legislation provides insight into how a nation ensures public health and safety.[5] Assessing existing legislation also enables understanding of the current status of surveillance systems and their limitations, allowing legal tools to be used to strengthen the public health system.[8] In this study, we assessed the Infectious Disease Prevention and Control Act of Korea (IDCPA) to understand the current infectious disease surveillance system of the ROK in terms of its utility for biosurveillance. In addition, to learn from previous experience, we examined the relevant US and World Health Organization (WHO) regulations.

Methods

To examine the elements and process of biosurveillance in current legislation of the ROK pertaining to infectious disease control, the most recent version (finalized on December 31, 2018) of the IDCPA[10] was reviewed. The 2005 International Health Regulations (IHR) of the WHO and US biosurveillance-related legislation were examined to enable understanding of how biosurveillance is arrayed in the jurisdictional landscape.

The IHR was analyzed because of its influence on national legislation.[11] Notably, the regulations in the IHR were included in the IDCPA of the ROK.[3] Legislation relating to biosurveillance in the United States was included in the analysis, as the United States leads the development of biosurveillance systems.[12] US legislation relating to biosurveillance was identified by searching the congressional website.[13] Legislation that included the term “biosurveillance” was selected, including the Implementing Recommendations of the 9/11 Commission Act of 2007 (IRCA),[14] the FDA Food Safety Modernization Act (FSMA),[15] and the Pandemic and All Hazards Preparedness Reauthorization Act of 2013 (PAHPRA).[16] The independent analysis of legislation was based on the elements and processes of biosurveillance of the IRCA. The IDCPA and IHR were also independently analyzed as to how they encompass the components of the surveillance system.

Elements of Biosurveillance

The US biosurveillance system was enhanced after the September 11 attack.[4,17,18] During the first period of development, biosurveillance systems detected threats using an automated algorithm.[19] As the biosurveillance system expanded and a concrete framework was formed, it was acknowledged that to regard the system simply as a technical tool was no longer appropriate, and the term “biosurveillance” began to refer to a broader concept encompassing, for instance, technical tools, approaches, and governance.[19]

The key difference between public health surveillance and biosurveillance is that biosurveillance integrates information on risk factors related to humans, animals, and plants and the effects of interactions among those risk factors.[17] Biosurveillance focuses on uncategorized risk factors rather than known diseases. And biosurveillance encompasses threats to human health that occur beyond administrative lines.[20] Biosurveillance systems screen for risk factors, facilitating rapid detection of a response to unspecified threats. The ultimate goal of biosurveillance is to enable a timely response by integrating data obtained from multiple agencies and disciplines.[17,18] Integrated biosurveillance systems based on coordinated governance allow early detection and situational awareness of biological events, which would be difficult to achieve using dispersed information.[17]

There are numerous definitions of the purpose and basic functions of biosurveillance, but the generally agreed on functions include gathering, integrating, analyzing, interpreting, and disseminating data by means of coordinated governance.[4,12,17] Biosurveillance systems monitor incidents, threats, or activities related to human, animal, or plant health. In addition, environmental factors are also integrated.[9,14,16] The ultimate goal of biosurveillance is to enable early detection of a threat and mounting of an integrated response.[4,12,17,18] The process of biosurveillance is shown in Figure 1.

Figure 1.

The Process of Biosurveillance

Surveillance in individual departments refers to data collection, analysis, and reporting and other regular preventive and control measures. Activities of routine management, including data gathering, analysis, and reporting, are carried out accordingly in each department. Data integration involves the gathering and analyzing of information to assess the transfer of and interactions among risk factors. Data integration requires coordination and communication among involved agencies. Successful data integration leads to a synthesized view. A synthesized view enables stakeholders to visualize the integrated information using a shared platform, thus reducing the need for reporting and notification.[20,21] The risk is interpreted and tracked in near real-time. The final step of biosurveillance is an integrated response by stakeholders. The response is integrated as the members are naturally engaged in the process through a synthesized view of automated system.[22]

International Health Regulations (2005)

The WHO's International Health Regulations (IHR) were first defined in 1969. The IHR encouraged member states to follow guidelines for establishing preventive measures and preparedness for outbreaks of diseases that pose a threat at the international level.[23] However, the 1969 IHR had limitations, including a scope limited to quarantinable diseases.

The IHR was revised in 2005.[23] To broaden the scope, the revised IHR is not limited to specific diseases and can be applied to newly discovered diseases. The IHR emphasizes a nation's responsibility to prevent and control the spread of disease and its obligation to notify WHO of the potential international spread of a disease. Analysis of the responsibility and ability of a nation to prevent the international spread of a disease according to the IHR resulted in the process shown in Figure 2.

Figure 2.

The Process of Surveillance Derived from the International Health Regulations (2005)

Surveillance in the IHR differs from typical national health surveillance systems, as it focuses on threats of international importance. When a nation detects an incident that has a potential to spread beyond its borders, the member state is required to communicate continuously with WHO and provide relevant reports and information on the incident. Several reviews and verification are carried out by both WHO and the member state to confirm the risk. Once the risk is confirmed to be a potential threat to international public health, WHO provides temporary or provisional recommendations to the country. The ultimate goal of the IHR is to prevent and control disease that could spread internationally while minimizing unnecessary interference in international traffic and trade. The IHR emphasizes cooperation between the WHO and its member states.

Infectious Disease Prevention and Control Act of Korea

The IDCPA requires signatories to control and prevent the spread of infectious disease. It categorizes diseases into 5 groups, depending on their severity and the intensity of quarantine required. Infectious diseases that do not belong to any of the 5 groups are classified as follows: designated infectious diseases, infectious diseases under surveillance by WHO, infectious diseases spread through bioterrorism, sexually transmitted infectious diseases, zoonoses, and nosocomial infectious diseases.[10]

The IDCPA includes planning (annual strategy reports), reporting and notification, and epidemiologic investigation of suspected cases, as well as conducting surveys, handling of high-risk pathogens, vaccination, disinfection, and other preventive measures. It also encompasses planning and implementation of annual strategies and sustaining the workforce and facilities as preventive and control measures. The surveillance process in the act is shown in Figure 3.

Figure 3.

The Process of Surveillance Derived from the Infectious Disease Control and Prevention Act

The IDCPA process of infectious disease surveillance involves routine activities of planning and prevention by the KCDC. Once an infectious disease is identified by a physician during a medical examination or is self-reported by a patient, the appropriate health authorities must be notified. If the diagnosis of an infectious disease is obscure, epidemiologic investigation must be carried out. Once confirmed, the case is reported to higher-level authorities. The physician is required to notify the head of the medical institution, followed by the governor, the minister of health and welfare, the mayor, and the Ordinance of the Ministry of Health and Welfare. The response to infectious disease focuses on controlling further spread and managing infected patients. The ultimate goal of the IDCPA is to protect public health by managing and preventing infectious diseases. The term “prevention” is used in both the routine management and response phases, referring to efforts to reduce further spread of infectious disease rather than preventing its occurrence.

Implementing Recommendations of the 9/11 Commission Act of 2007

IRCA is the first law to mention the term “biosurveillance” and to establish biosurveillance systems and a management agency. It extended the scope, from public health or illness-based surveillance, by defining and embracing the term biosurveillance. While conventional public health surveillance is focused on preventing and controlling disease by continuous data collection and analysis,[24] IRCA expanded the scope of biosurveillance to include collecting all data relating to “human health, animal, plant, food and environmental” events [Section 316(b)(1)(A)]. IRCA allows screening for undefined risk factors, enabling faster detection than tracking of disease.

IRCA establishes the responsibilities of the National Biosurveillance Integration Center (NBIC), which coordinates and integrates biosurveillance data from member agencies. Figure 4 shows the process of biosurveillance according to IRCA.

Figure 4.

Biosurveillance Process Derived from the IRCA (Public Law 110-53)

The first step of the process is surveillance by individual agencies, regardless of the biosurveillance system. The biosurveillance-related data from each agency are sent to the NBIC for integration. The NBIC also searches for relevant data from private sources. By continuously integrating and interpreting the merged information, the NBIC can detect potential risk. Regarding the guidelines for early detection, IRCA states that the NBIC is to use the “best available statistical and other analytical tools to identify and characterize biological events” [Section 316(c)(3)]. Following detection of an event, the NBIC must report it to the relevant federal departments and a secretary for a final decision. Ultimately, IRCA aims to achieve real-time situational awareness by integrating as much useful information as possible, thus preventing or minimizing harm.

Among the 4 main processes outlined in IRCA, information integration is constantly emphasized. The Act provides for mutual exchange of information between the NBIC and its members by requiring the latter to provide their data to the NBIC, while the NBIC is obligated to provide interpreted results to its member agencies. According to the law, such information sharing should be channeled using a technical tool. As a byproduct of data integration and coordination, the law mandates that the NBIC reduce duplicative surveillance efforts among agencies and monitor the technical tools used by each agency to confirm its effectiveness.

FDA Food Safety Modernization Act

The 2011 amendment of the Food and Drug Administration's FSMA does not outline the concept of biosurveillance. However, Section 205(1)(I) of the Act states that foodborne illness data are to be integrated into biosurveillance systems.

Pandemic and All Hazards Preparedness Reauthorization Act of 2013

PAHPRA is the most recent act relating to biosurveillance. Section 204(a)(4)(B)(ii) of the Act expanded the scope of surveillance by including “novel emerging threats” in addition to preexisting disease outbreaks. The Act emphasizes the coordination and integration of information as fundamental elements of biosurveillance. The Act specifies that information flow between the stakeholders should be 2-way [Section 204(6)(A)].

Discussion

The IDCPA was examined to understand its potential for biosurveillance. In addition, the IHR and US legislation were compared with the IDCPA in terms of their biosurveillance content. While the 2005 revision of the IHR expanded the scope of surveillance by not restricting it to specific diseases, the IHR has limitations in terms of biosurveillance. The IHR does not propose guidelines on the means by which potential risks should be detected and does not mention the need to integrate dispersed data for early detection. Also, the IHR has 2 goals—protecting states from health risks, and minimizing interference in international transfer and trade—which may at times conflict.

In comparison, the US IRCA expanded the scope of existing surveillance systems and facilitated interpretation of integrated data. IRCA also emphasized the need for collaboration among participating government agencies to achieve effective data integration.

IRCA has several limitations. Although the law mentions connecting shared data through a protocol, it does not mandate a synthesized view to enable involved members to access integrated information simultaneously. Indeed, the Act explicitly states that the NBIC is to report any produced information to member agencies. A synthesized view would minimize such reporting and notifying activities. The lack of a synthesized view hampers an integrated response by necessitating manual reporting to relevant authorities. In contrast, a synthesized view facilitates multi-agency collaborative discussions about countermeasures.

Notably, the legal characteristics of biosurveillance in the US have expanded and adapted over time. PAHPRA uses the term “near real-time” to emphasize the rapidity of information gathering. This is different from “as early as possible” in IRCA. The requirement for near real-time information gathering results in realistic expectations on how far technologies and other necessary tools should be developed. Also, PAHPRA states that a network system for “2-way information flow” needs to be created. This is more refined than the preexisting concept of “data sharing,” as it requires that information flow among all involved members, instead of some members providing and others receiving information. The emphasis on data integration and a synthesized view is again evident in the National Strategy for Biosurveillance of 2012. The document calls for decision making at all levels compared to the more vertical decision-making system in IRCA.[25]

The IDCPA of the ROK has more similarities to the IHR than to US biosurveillance-related legislation. While the IHR involves several verification steps to determine the potential for interference with international trade and travel, the IDCPA requires an epidemiologic investigation and that a case definition of the disease be met, as subsequent procedures can be initiated only after the disease has been categorized.

The IDCPA has several limitations in terms of facilitating the early detection of and response to biological agents. First, although the categorization of infectious diseases may enable a consistent response to an incident, and the assignment of responsibilities, it hampers the detection of unknown or novel risks. While the IDCPA was modified after the 2015 MERS outbreak, categorizing it under “group 4 infectious disease,” it does not provide guidelines for new or emerging diseases that may threaten public health. The scope of IDCPA is narrower than that of biosurveillance-related US legislation in terms of targets of monitoring, integration of information and systems, and collaborative surveillance. The expansion of the scope is premised on integration of data.

Second, diseases are not detected as early as possible because the Act requires a clear medical diagnosis and, at times, further epidemiologic investigation. Third, the Act does not address the need for data integration. Without constant exchange and integration of data, detection of novel threats is difficult. Fourth, the Act does not include guidelines on detection of disease other than by voluntary reporting. Fifth, while an immediate response is problematic in the absence of early detection, it is further hampered by the multiple hierarchal levels of reporting mandated by the IDCPA. Finally, the legislation does not recognize the importance of collaborative governance. Although not analyzed in this study, there are other surveillance-related legislation and national strategies—notably, the Act on Counter-Terrorism for the Protection of Citizens and Public Security, and Guidelines on Bioterror Infectious Disease Preparedness and Responsiveness. However, these do not propose integration of data or collaboration among agencies.[26,27] Rather, they outline the agencies responsible for certain situations, which hampers timely response to unexpected or novel situations.

Our analysis was limited to the IDCPA of the ROK, the IHR, and US biosurveillance-related legislation. However, there are other laws that may influence biosurveillance or infectious disease surveillance systems, such as the Framework Act on the Management of Disasters and Safety or the Act on the Prevention of Contagious Animal Diseases. As the lead agency in the response to and preparation for public health emergencies, the Ministry of Health and Welfare is directly governed by the IDCPA. If any law or regulation is to be revised to address the need for biosurveillance, it should be the IDCPA. Also, this study analyzed legal codes, which may not represent reality.

Conclusion

Biological incidents, including infectious disease outbreaks, do not occur within jurisdictional boundaries. Hence, monitoring and control activities require a collaborative governance system. The IDCPA of the ROK does not include provisions essential for transitioning the current surveillance system to biosurveillance. It also does not provide guidance for early detection and response using integrated data and information-sharing systems. Revision of the IDCPA is thus critical not only in terms of infectious diseases but also bioterrorism. Further government efforts could focus on revising the law to reflect the need for situational awareness and early detection of risks to public health.