A method is provided for automatically identifying a disease outbreak indicative of a potential bio-terror attack. Patient records are mined from structured and unstructured clinical sources. The patient records are then analyzed by correlating selected patient data contained in the patient records with disease indicia for each of a plurality of diseases. A probability of a disease outbreak is estimated at least in part based on these correlations. Suspicion may also be indicated if anomalous disease clusters are found. If any of the estimated probabilities exceeds a threshold value, a disease outbreak alert is outputted. The disease indicia may be defined by disease progression models, which may be stored in a disease knowledge base.