Attack Rate

Attack Rate in Outbreak Analysis and Vaccine Economics

An attack rate tells an analyst how much of an exposed population fell ill during an outbreak, and that one proportion often becomes the probability of infection in an economic evaluation of outbreak control or vaccination. The measure is a proportion rather than a true rate, and both the overall and secondary attack rate differ from the incidence rate and the basic reproduction number. Attack rates enter static and dynamic models in different ways, as an illustrative vaccination example shows, in which a fixed and a transmission-based attack rate give different costs per infection averted.

Why an attack rate is a proportion, not a rate

In outbreak work the term attack rate is used as a synonym for risk, meaning the chance that a person in a defined population develops the disease during a specified period, such as the duration of an outbreak. The CDC's teaching text on epidemiology lists attack rate as an incidence proportion and notes that incidence proportion is the more accurate name. The calculation is a count of new cases over the number of people at risk at the start, as follows.

$$AR = \frac{A}{N}$$

where $AR$ is the attack rate for the stated period, $A$ is the number of new cases that meet the case definition during that period, and $N$ is the number of people at risk at the start of the period. The result is usually reported as a percentage.

The measure is a proportion because everyone in the numerator is also in the denominator, so it lies between zero and one and has no units. A rate in the stricter sense is expressed per unit of time. The person-time incidence rate divides new cases by the total time each person was observed, giving units such as cases per 1,000 person-years. An attack rate carries time only through its stated period, so 20% over a two-week outbreak and 20% over a winter are different quantities. It is a form of cumulative incidence over a short, defined window.

The denominator should be limited to the population at risk, meaning people who could become a case. For an infection, that means removing people known to be immune; leaving them in lowers the attack rate and makes the infection look less transmissible among susceptible people than it is.

Overall, food-specific and secondary attack rates

Several variants share the same structure and differ only in which group forms the denominator. The overall attack rate divides all new cases by the whole population at risk. A food-specific attack rate, used in foodborne outbreak investigations, divides the number of people who ate a given food and became ill by the number who ate that food. Dividing the attack rate among those exposed to a food by the attack rate among those not exposed gives a risk ratio, here an attack rate ratio, which measures the association between that food and illness.

The secondary attack rate measures spread from primary cases to their contacts in households, barracks or other closed settings, separating that transmission from spread in the wider community. The CDC text notes that the denominator is often taken as the total population of the households of the primary cases minus the primary cases themselves, as follows.

$$SAR = \frac{S}{H - P}$$

where $SAR$ is the secondary attack rate, $S$ is the number of cases among contacts that arise after the primary cases (for example, within one incubation period), $H$ is the total number of people in the households of the primary cases and $P$ is the number of primary cases. With illustrative figures, 20 primary cases living in 20 households with 80 members leave 60 contacts; if 12 contacts become ill, the secondary attack rate is 12 / 60 = 0.20, or 20%.

Attack rates measured in vaccinated and unvaccinated groups also give vaccine effectiveness, which the CDC defines as the proportionate reduction in risk among vaccinated people, as follows.

$$VE = 1 - \frac{AR_v}{AR_u}$$

where $VE$ is vaccine efficacy (in a trial) or effectiveness (in field conditions), $AR_v$ is the attack rate among vaccinated people and $AR_u$ is the attack rate among unvaccinated people. The ratio $AR_v / AR_u$ is the risk ratio, so the same formula can be written as one minus the risk ratio. Halloran and colleagues show that the comparison groups chosen decide whether such a ratio reflects the effect of vaccination on an individual or the indirect, total or overall effects of a programme, which matters when the estimate becomes the vaccine effect in a cost-effectiveness model.

Attack rate, incidence rate and the basic reproduction number

These three measures answer different questions. An attack rate is the share of a defined population that became ill over a period, and an incidence rate is how fast new cases arise per unit of person-time. The basic reproduction number, written $R_0$, describes the expected number of further infections that one case produces in a completely susceptible population. Delamater and colleagues stress that it is best described as cases per case and says nothing about how quickly those cases occur.

Attack rate and $R_0$ are linked through the final size relation of the simple susceptible, infectious and recovered model. For a well-mixed population in which almost everyone is susceptible at the start, the proportion ever infected by the end of the epidemic satisfies the following.

$$z = 1 - e^{-R_0 z}$$

where $z$ is the final attack rate (the proportion of the population infected over the whole epidemic) and $R_0$ is the basic reproduction number. The relation assumes a large closed population with no births, deaths or migration during the epidemic, lasting immunity after infection, an epidemic seeded by a negligible number of cases, and homogeneous mixing. Ma and Earn review earlier work showing that it holds whatever the distribution of infectious periods, show that it also holds with a latent stage, and note that it fails under some heterogeneous mixing, such as a core group for sexually transmitted infections. Rearranged, it turns an observed final attack rate into an estimate of $R_0$, as follows.

$$R_0 = \frac{-\ln(1 - z)}{z}$$

where the terms are as defined above. This applies only to a completed epidemic in a population close to fully susceptible, and $z$ counts infections, so a clinical attack rate based on symptomatic cases understates it.

When part of the population is already immune, the same model gives a lower final size. Starting from the same equations with a fraction $s_0$ susceptible and the rest immune, the relation becomes the following.

$$z = s_0 \left(1 - e^{-R_0 z}\right)$$

where $s_0$ is the proportion of the population susceptible at the start and $z$ is now the proportion of the whole population infected. With prior immunity the estimate of $R_0$ becomes $R_0 = -\ln(1 - z/s_0)/z$. The product $R_0 s_0$ plays the part of the effective reproduction number at the start of the epidemic. The dynamic modelling task force states that, in a homogeneously mixing population, herd immunity requires vaccination coverage above a critical level $V_c$, with $V_c > 1 - 1/R_0$; this is the herd immunity threshold. For a fully protective vaccine given to a fully susceptible population before the epidemic, coverage $V$ leaves $s_0 = 1 - V$, so coverage at or above the threshold leaves $R_0 s_0$ at or below one and the epidemic cannot grow.

How attack rates enter economic evaluations

Attack rates are used in two ways in economic models of infectious disease, and the difference decides whether an evaluation captures the full benefit of an intervention. In a static model, such as a decision tree or a Markov model, the attack rate is an input. It is treated as the probability that an unprotected person is infected over the model period, and it is multiplied by costs and health losses per case. The ISPOR and SMDM task force on dynamic transmission models describes static models as assuming a constant risk of infection, or force of infection.

In a dynamic transmission model the attack rate is an output, because the risk to each susceptible person depends on how many people are infectious, so preventing some infections lowers the risk to everyone else. The task force recommends a dynamic model when an intervention changes transmission in the target population or alters the mix of strains, and accepts a static model when the intervention is unlikely to change the force of infection, for example when coverage is very low or the targeted group contributes little to transmission. It also notes that ignoring indirect effects can make cost-effectiveness ratios look worse than they are, and that indirect effects are not always beneficial. Lower infection risk raises the average age at infection, which for some diseases raises the risk of complications.

Secondary attack rates play the same part in evaluations of outbreak control. An evaluation of prophylaxis for household contacts needs the probability that an untreated contact becomes ill, and the secondary attack rate supplies it; contact cases averted are then the contacts treated, multiplied by the secondary attack rate and by the effectiveness of the measure. That count covers first-generation cases only and leaves out the further cases those contacts would have caused, the same limitation as a static model.

The period also matters in a model with fixed cycles. Standard probability-to-rate conversion rescales a probability from one period to another by assuming a constant underlying rate, but outbreak risk rises and falls with the epidemic curve, so spreading a seasonal attack rate evenly across monthly cycles misplaces when cases and costs fall.

Worked example of a vaccination programme with fixed and dynamic attack rates

The figures below are illustrative. A population of 100,000 faces a single epidemic of a newly emerging infection with $R_0 = 2$. Everyone is susceptible before the programme, vaccination at 30% coverage is completed before the epidemic starts, and the vaccine is assumed to give complete protection. The programme costs £50 per person vaccinated, so 30,000 people vaccinated cost £1,500,000.

1. Attack rate with no programme. Solving $z = 1 - e^{-2z}$ by iteration gives $z \approx 0.797$. Checking, $e^{-2 \times 0.797} = e^{-1.594} \approx 0.203$, and one minus 0.203 is 0.797. The expected number of infections is 100,000 × 0.797 = 79,700.

2. Static estimate with a fixed attack rate. A static model applies the 79.7% attack rate to everyone left unvaccinated and assumes vaccination does not change it. The 30,000 vaccinated people avoid 30,000 × 0.797 = 23,910 infections, and the 70,000 unvaccinated people still have 70,000 × 0.797 = 55,790 infections. The programme cost per infection averted is £1,500,000 divided by 23,910, or about £62.74.

3. Dynamic estimate from the final size relation. With 30% immune, $s_0 = 0.7$ and the effective reproduction number at the start is 2 × 0.7 = 1.4. Solving $z = 0.7(1 - e^{-2z})$ gives $z \approx 0.358$, since $e^{-0.716} \approx 0.489$ and 0.7 × 0.511 = 0.358. Infections fall to 100,000 × 0.358 = 35,800, and infections averted are 79,700 − 35,800 = 43,900. The cost per infection averted is £1,500,000 divided by 43,900, or about £34.17.

4. Split the infections averted. Of the 43,900 infections averted, 23,910 are averted among vaccinated people and 43,900 − 23,910 = 19,990 are averted among unvaccinated people (the indirect effect). In the terms used by Halloran and colleagues, the reduction among vaccinated people is the total effect of the programme on them, not a pure direct effect. The attack rate among the unvaccinated falls from 79.7% to 35,800 / 70,000, about 51.1%.

5. Interpret the result. The static model counts 23,910 of the 43,900 infections averted, about 54%, because it holds the attack rate among the unvaccinated fixed when vaccination lowers it. At 50% coverage, which is the threshold for $R_0 = 2$, the epidemic in this simple model cannot grow and nearly all 79,700 infections are averted, whereas a static model would count only 50,000 × 0.797 = 39,850. An attack rate observed at one coverage level is therefore not a fixed property of the infection that can be carried into a model of a different programme.

Choices that change a reported attack rate

The same outbreak can yield quite different attack rates depending on choices made by the investigators. The case definition decides who enters the numerator, including whether confirmed, probable or possible cases count and whether symptomatic illness or laboratory evidence of infection is needed. A clinical attack rate counts illness, an infection attack rate counts everyone infected, and the gap between them grows with the share of infections that cause no symptoms.

The denominator decides who counts as at risk, and the period decides whether late cases or a second wave are included. Ascertainment also matters, and the dynamic modelling task force notes that natural history estimates built from surveillance data are likely to understate incidence and overstate severity, because surveillance tends to capture people ill enough to seek care. A model that pairs an attack rate from reported cases with a cost per reported case can be internally consistent yet still miss mild illness and lost work among people never counted.

Common misreadings of attack rates

The most frequent error is to treat an attack rate as a rate per unit of time. A second error is to confuse it with $R_0$. An attack rate of 25% among household contacts is a proportion of contacts infected, not a number of cases per case, and one converts into the other only under the assumptions of a specific model.

Holding an attack rate fixed for an intervention that changes transmission can make a programme look less cost-effective than it is where indirect effects are beneficial, as the worked example shows. A related error occurs when an attack rate observed under high coverage or strong control measures is taken to show the risk that would apply without them, which it understates. Effect estimates from individually randomised trials have a similar limitation, and the task force notes that neither arm experiences a reduced force of infection, so indirect effects are not captured and effectiveness is underestimated.

Sources

• Centers for Disease Control and Prevention. Principles of Epidemiology in Public Health Practice, 3rd ed. Lesson 3: Measures of Risk, Section 1 (Frequency measures), Section 2 (Morbidity frequency measures), Section 5 (Measures of association) and Section 6 (Measures of public health impact). Atlanta: CDC; 2006, page last reviewed 2012. https://archive.cdc.gov/www_cdc_gov/csels/dsepd/ss1978/lesson3/section2.html
• Delamater PL, Street EJ, Leslie TF, Yang YT, Jacobsen KH. Complexity of the basic reproduction number (R0). Emerging Infectious Diseases. 2019;25(1):1-4. https://doi.org/10.3201/eid2501.171901
• Miller JC. A note on the derivation of epidemic final sizes. Bulletin of Mathematical Biology. 2012;74(9):2125-2141. https://doi.org/10.1007/s11538-012-9749-6
• Ma J, Earn DJD. Generality of the final size formula for an epidemic of a newly invading infectious disease. Bulletin of Mathematical Biology. 2006;68(3):679-702. https://doi.org/10.1007/s11538-005-9047-7
• Pitman R, Fisman D, Zaric GS, Postma M, Kretzschmar M, Edmunds J, Brisson M. Dynamic transmission modeling: a report of the ISPOR-SMDM Modeling Good Research Practices Task Force-5. Value in Health. 2012;15(6):828-834. https://doi.org/10.1016/j.jval.2012.06.011
• Halloran ME, Struchiner CJ, Longini IM. Study designs for evaluating different efficacy and effectiveness aspects of vaccines. American Journal of Epidemiology. 1997;146(10):789-803. https://doi.org/10.1093/oxfordjournals.aje.a009196
• Fleurence RL, Hollenbeak CS. Rates and probabilities in economic modelling: transformation, translation and appropriate application. PharmacoEconomics. 2007;25(1):3-6. https://doi.org/10.2165/00019053-200725010-00002
• Briggs A, Claxton K, Sculpher M. Decision Modelling for Health Economic Evaluation. Oxford: Oxford University Press; 2006.