Learn More

What does the PHAST acronym stand for?

The acronym stands for Public Health Applied Surveillance Tools. 

What does "open source" mean?

Open source software is code designed to be publicly accessible, allowing anyone to inspect, modify, and redistribute it freely. We share the code with anyone who wants it at no cost, but we use the Consortium model to maintain governance of the main branch of code. 

As an open source software suite, how are modifications to the applications' code vetted for security?

Merge requests have to come from an agency that has submitted a CLA (Contributor license agreement.) This usually vets the submitters but then we also process code through security and automated testing scans before we push to the main branch. We check for vulnerabilities in the code, but the individual Public Health Authority (PHA) is responsible for hosting/environment security.

How are application updates performed? How often?

Each member of the Consortium can submit merge requests to update the code. Utah is the code steward for the Consortium. They take the merge requests and process them into the main branch. The main branch is typically updated every other Wednesday.

How do vendors interact with and contribute to the Consortium?

  Some PHAs choose to contract with a vendor to host their local instances of the software. If the PHA contracts with a vendor to develop code for the applications, it is the responsibility of the PHA to contribute that code to the Consortium. We also have vendors who do not work with a specific PHA but who have signed the CLA and can contribute code directly to the Consortium. 

How much does it cost?

There is no cost for the software, any of the development shared by the Consortium, or for Consortium participation, but each jurisdiction must host it themselves. 

How much staffing do you need to support the PHAST suite?

It depends on your hosting method. If your PHA chooses to vendor host, day to day operations may require only a few people. If you choose to self host, either on prem or in the cloud, more staff will be required.

How much time is spent maintain the system? What does this involve?

The PHAST Suite is a self-hosted application. This is a strength and resource drain for any PHA looking to implement the software. Unlike some other options available in the sphere, if a PHA is looking to standup their own instance of the PHAST suite they would need to host/maintain the system themselves. The software is mature enough that it does not require much (if any) time spent to maintain/monitor the system. The largest demand on time is incorporating changes either from the Consortium or user-base.  (e.g. "Update a form to accommodate new disease requirements." or "Troubleshoot how a case was deleted from the audit log.")

Is hosting the PHAST applications agnostic? 

Yes. We currently have instances on AWS, Azure, and Google clouds. We also have a member jurisdiction that self hosts on prem.

How long does it take to deploy the PHAST suite in a new jurisdiction?

Our recommendation is to set up a test environment before moving to production and to include a training period. On average, member jurisdictions have taken around 8 months to fully deploy using these components.

How are decisions made by the consortium?

By vote. Each Contributing Member PHA appoints one person to act as their Product Owner. This person acts as the voting member for their jurisdiction. Only Public Health Authorities can vote. If there is an improvement or change to the core functionality of an application, the vote needs to be unanimous. 

When was EpiTrax created?

EpiTrax was developed based on an open source applicatoin developed by Utah in 2009 called TriSano. In 2015, the Utah Department of Health (UDOH) began upgrading Trisano and rebranded it as EpiTrax. The EpiTrax Community Consortium was also formed in 2015. EMSA was developed before the EpiTrax upgrade and went live in 2013. In 2025, the 3 applications (EMSA, EpiTrax, and CENDS) were rebranded as one suite called Public Health Applied Surveillance Tools (PHAST) and the Consortium was renamed to match. 

What kinds of user restrictions does EpiTrax have?

There are 3 levels of restrictions; conditioned based, agency restriction, and a role base restriction customizable to the local installation. 

Is EpiTrax person based or case based?

EpiTrax is person based. One person can have unlimited case morbidity reports (CMRs). Multiple conditions can be linked back to one person. Comorbidities can be assigned. A single person can be investigated by multiple local jurisdictions if needed.