Spatial Epi Public Health GIS

Environmental Exposure & Risk Surface Modeling for Health Studies

Environmental exposure modeling is the work of turning a handful of regulatory monitors, a stack of satellite rasters and a road network into one defensible number per person: the concentration, temperature or proximity that a study will treat as the cause. This section covers the whole chain an agency owns — building the surface, assigning it to residences, and carrying the error of both steps into the health model rather than quietly dropping it.

The chain has a failure mode that no amount of statistical sophistication in the health model can repair. If the exposure surface is wrong at the addresses where the cases live, the effect estimate is wrong, and the direction of the bias is usually toward zero — a real association looks null and the agency concludes there is nothing to act on. Every decision below is therefore judged by one question: does it make the exposure value at a residence closer to the truth, and does it tell you honestly how far off it still is?

The Exposure Assignment Chain A five-layer vertical pipeline. Layer one holds three measurement sources: a ground monitor network, satellite and raster products, and land use with road network data. Layer two harmonizes everything to one grid, one coordinate reference system and one averaging period. Layer three fans into four modeling families: geostatistical interpolation, land-use regression, remote-sensing index derivation, and proximity or hazard distance metrics. Layer four assigns the modeled surface to residential locations using buffers, zonal statistics and mobility histories. Layer five splits into the health effect model and the parallel uncertainty budget that carries prediction variance into that model. From scattered measurements to one defensible number at a residence — and its error bar Ground monitors few sites, long records Satellite rasters wide cover, coarse cells Land use and roads predictors, not measures Harmonize: one projected grid, one averaging window, one units convention every later comparison is meaningless until this layer is deterministic Interpolation kriging, inverse distance weighting Land-use regression buffer predictors fit to monitor values Remote-sensing index greenness, surface temperature, heat Proximity metrics distance to hazard, water system join Assign to residences: buffers, zonal statistics, mobility histories the only layer where geocode quality becomes exposure quality Health effect model rates, counts, survival, case-control Uncertainty budget prediction variance carried, not discarded

Two properties of this chain deserve naming up front. First, it is a modeling chain, not a measurement chain: outside the few hundred metres around a monitor, every exposure value is a prediction, and predictions have variance that belongs in the health model. Second, it is deterministic by construction or not defensible at all — the same monitor pull, the same raster vintage and the same configuration must reproduce the same surface, because a colleague who cannot regenerate your exposure file cannot check your finding.

Data Governance & Compliance Architecture

Exposure modeling looks like it sits outside the privacy perimeter — air quality and land cover are public data — and that impression is exactly what causes leaks. The protected element is never the environmental layer; it is the join key. Assigning a concentration to a residence requires the residence, which means full-precision geocoded addresses of people with a diagnosis. The moment the exposure step touches that table, the whole step inherits the same controls as the case file, and the output must be reviewed before it leaves the building.

Three architectural rules keep that manageable. Keep the exposure surface and the case table in separate stages with an explicit join. Build and validate the surface against monitors and land cover alone, in an environment with no protected data, then perform the join in the protected environment as a distinct, logged step. This lets the expensive modeling work be peer-reviewed openly while the identifying join happens once, under access control.

Never persist the intermediate that pairs an address with an exposure value unless the study needs it. The usual analytic requirement is a per-person exposure column keyed by study ID, not by address. Write the join so it emits that column and drops the coordinate in the same transaction, and the most disclosive artifact in the pipeline never exists at rest. Where a per-address file must persist for reanalysis, it inherits the retention schedule and access log of the case file, and the governing rules for that live in Compliance Mapping Frameworks.

Treat exposure values as potential quasi-identifiers in any release. A published exposure value is a coordinate in disguise: a high-resolution surface plus a released concentration narrows a residence to the contour band that produces it, and two such values from different pollutants intersect to a very small area. Released exposure columns therefore need the same disclosure review as any other geography — rounding to a band, or aggregating to an area — under the controls described in Privacy-Preserving Spatial Analytics.

The audit record for an exposure build is short but non-negotiable: the source datasets and their vintages, the projected coordinate reference system, the averaging window, the model form with every fitted coefficient, the cross-validation result, and a hash of the configuration that ties the released surface to the run that made it.

Spatial Data Preparation

Exposure work fails in preparation more often than in modeling, and it fails in ways that produce a plausible-looking surface rather than an error. Four gates catch nearly all of it.

Project before you measure. Every distance in this section — a buffer radius, a variogram lag, a distance-to-hazard — is a distance in metres, and degrees of longitude are not metres. Reproject monitors, rasters and addresses to one equal-area or local metric system before any geometric operation, following the selection logic in Coordinate Reference Systems for Public Health. Raster reprojection additionally requires a resampling decision: bilinear for continuous concentration fields, nearest neighbour for categorical land cover, and never the reverse.

Resolve the averaging window before the geometry. An annual mean, a warm-season mean and a 24-hour maximum are three different exposures with different spatial structure, and mixing them across monitors is a silent error. Fix the window, apply a completeness rule — a common convention requires 75% of the expected observations in a period before a mean is computed — and record how many sites the rule dropped.

Check the monitor network before trusting an interpolation. A network is only as good as its geometry: count the sites, measure the nearest-neighbour distance distribution, and look for whole regions with no site inside the correlation range. A surface interpolated across a 200 km gap is an extrapolation wearing a colour ramp.

Validate the raster stack the way you validate vector data. Confirm the nodata value is declared rather than a sentinel like −9999 silently entering a mean, confirm the grid alignment across bands, and confirm the units — a surface temperature band delivered in scaled integers of Kelvin becomes a nonsense exposure if the scale factor is skipped.

Four Preparation Gates and What Each One Catches Four gates arranged as a vertical sequence. Projection gate catches distances computed in degrees. Averaging window gate catches mixed temporal definitions across monitors. Network geometry gate catches interpolation across a region with no measurement inside the correlation range. Raster integrity gate catches undeclared nodata, misaligned grids and unapplied scale factors. To the right of each gate, the symptom it prevents is written out, showing that each failure produces a plausible surface rather than an error message. Each gate prevents a failure that produces a believable map, not an error 1 · Projection gate all layers in one metric system catches: a 500 m buffer that is actually 500 degrees-worth of ellipse 2 · Averaging window one definition, one completeness rule catches: annual means blended with warm-season means across sites 3 · Network geometry no gap wider than the range catches: a smooth surface painted over a county with no monitor 4 · Raster integrity nodata, alignment, scale factor catches: a fill value of minus 9999 averaged into a tract exposure

Core Methods Overview

The four modeling families in this section answer different questions, and the choice between them is driven by what you are measuring and how dense the measurement network is — not by preference.

Start with Interpolating Environmental Exposure Surfaces when you have direct measurements of the quantity you care about and enough of them that the spatial correlation is estimable. Geostatistical interpolation makes the strongest assumption — that the field is smooth and its covariance can be modeled — and pays you back with the one thing no other family provides for free: a per-location prediction variance you can propagate. It is the right default for regional pollutants with a reasonable monitor network, and the wrong tool for anything driven by a source at street scale.

Move to Land-Use Regression for Air Pollution Exposure when the pollutant varies sharply over short distances, as traffic-related pollutants do. Land-use regression abandons the assumption of smoothness and instead predicts concentration from the built environment around a point — road length within a buffer, industrial area, population density — fitting those predictors to the monitor values. It captures within-city gradients that interpolation smooths away, but it is estimated from few sites and many candidate predictors, which makes overfitting the central risk rather than an afterthought.

Use Remote Sensing Indices for Health Studies when the exposure is a property of the land surface itself — vegetation, surface temperature, imperviousness. Here there is no sparse network to interpolate from: the satellite measures everywhere, and the work moves to cloud masking, compositing, and choosing an index whose epidemiological meaning is defensible. The resolution is genuinely fine, which makes these indices the natural pairing for address-level assignment.

Reach for Hazard Proximity & Drinking Water Metrics when the exposure is a relationship to a discrete feature rather than a field — a distance to a facility, membership in a water system’s service area, a count of violations. These metrics are the crudest proxies in the section and also the most common in practice, because for many hazards there is no measurement network at all. Their weakness is that distance is not dose; their strength is that they are computable everywhere and easy to audit.

Whichever family produces the surface, Assigning Exposure to Residential Locations is the step that converts it to an analytic variable, and it is where the geographic precision of the case data finally binds. A surface at 30 m resolution assigned to an address geocoded to a ZIP centroid has 30 m of pretend precision and kilometres of real error, so the assignment step must read the geocode quality flags rather than ignore them — the diagnostics in Geocoding Quality & Address Standardization feed directly into this decision.

Finally, Exposure Measurement Error & Uncertainty is not an optional appendix. Every path through the chain produces a predicted exposure, and a predicted exposure used as if it were measured biases the health effect estimate in a direction that depends on the error structure. This topic is what makes the rest defensible.

Threshold Tuning & Validation

An exposure surface is validated against held-out measurements, never against its own fit. The reliable procedure is leave-one-site-out cross-validation: drop a monitor, rebuild the surface from the rest, predict at the dropped location, and repeat over every site. Three numbers come out of it — the root mean squared error in the units of the exposure, the coefficient of determination between predicted and observed, and the bias — and all three belong in the documentation of any study that uses the surface.

Two cross-validation mistakes are common enough to name. Random k-fold on spatially correlated data is optimistic, because a held-out point usually has a near neighbour in the training set and the model is effectively interpolating over a few kilometres. Leave-one-site-out, or a spatially blocked fold that removes a whole region at a time, reports the error that actually applies where there are no monitors. Selecting predictors on the full dataset and then cross-validating the selected model reports the error of a model that has already seen the held-out data; variable selection must happen inside each fold.

The practical threshold is set by the use, not by a convention. A surface with an out-of-sample coefficient of determination around 0.6 is unremarkable for a regional pollutant and perfectly usable for ranking areas; the same number is dangerous if the study will estimate a per-unit health effect, because the attenuation will be severe. Write down the intended use first, then decide what accuracy the surface must reach before it is allowed into the analysis.

Drift is the last validation axis. An exposure model fitted on one year’s monitor data and applied to a ten-year cohort inherits whatever changed — a retired monitor, a rebuilt highway, a fleet turnover that cut a pollutant by a third. Re-run the cross-validation for every year the surface is applied to, and treat a sharp change in error as a signal that the model needs refitting rather than extending.

Why Random Folds Flatter an Exposure Surface A chart with monitor spacing on the horizontal axis and prediction error on the vertical axis. The random k-fold curve stays low and almost flat as spacing grows, because a held-out point usually has a neighbour in the training set. The leave-one-site-out curve rises steeply once spacing exceeds the correlation range, which is the error that actually applies in the parts of the state with no monitor. The gap between the two curves is labelled as the amount by which random folds overstate surface quality, and a dashed vertical line marks the correlation range where the two curves separate. Random folds report the error of interpolating a few kilometres correlation range leave-one-site-out random k-fold overstatement dense typical state network sparse spacing between monitors Report the honest curve, because your cases do not live next to the monitors prediction error

Operationalization & Output Standards

An exposure product that is used once and cannot be regenerated is a liability. Four output conventions make it reusable.

Serialize the surface, not just the assigned values. Write the predicted field as a cloud-optimized GeoTIFF with the prediction variance as a second band, so a later study can re-assign it to different geographies without refitting. Where the product is a per-area summary rather than a raster, write GeoParquet with the area identifier, the predicted value, the variance and the count of contributing cells — the format trade-offs are covered in Spatial Data Types & Formats.

Ship provenance in the file, not in an email. The minimum set is the source dataset identifiers and vintages, the averaging window, the model form and fitted coefficients, the cross-validation statistics, the projected coordinate reference system, and the configuration hash. Anything less and the surface cannot be defended two years later when the analyst who built it has moved on.

Keep the geocode quality flag alongside every assigned exposure value. The assigned column should never travel without the match type that produced it, because downstream sensitivity analyses — restricting to rooftop-level matches, for example — become impossible once the flag is dropped.

Make the run reproducible end to end. Sort inputs on a stable key, seed every stochastic step, pin the library versions, and record them in the output metadata. The automation patterns for doing this on a schedule are in Surveillance Pipeline Automation & Spatial Data Quality.

Production Implementation Checklist

Frequently Asked Questions

Do I need an exposure surface at all, or can I just use the nearest monitor? Nearest-monitor assignment is a valid method and it is honest about what it is — but it produces large, spatially structured error as soon as residences sit far from the network, and it creates artificial discontinuities along the boundaries where the nearest monitor changes. It is reasonable for a coarse screening analysis in a dense urban network. It is not reasonable for a state-wide cohort, where most people live nowhere near a site.

Which family should I choose for a traffic-related pollutant? Land-use regression, or a hybrid that adds land-use predictors to a geostatistical model. Traffic pollutants fall off steeply within a few hundred metres of a road, so a smooth interpolated surface fitted to regulatory monitors — which are usually sited away from roadsides on purpose — systematically misses exactly the gradient the study is about.

How much does exposure error actually change a health effect estimate? Enough to reverse a conclusion. Classical error, where the assigned value scatters around the true personal exposure, attenuates the estimate toward the null roughly in proportion to the share of variance that is error. Berkson-type error, which is what area-level assignment mostly produces, leaves the estimate roughly unbiased but widens its confidence interval. Knowing which structure dominates is the reason the measurement-error topic exists.

Can I reuse a published national exposure surface instead of building my own? Often yes, and it is usually the better choice for a regional pollutant. What you must not do is inherit it without inheriting its validation: check its reported out-of-sample error in your study area specifically, confirm the averaging window matches your outcome window, and confirm its resolution is finer than the geographic variation you intend to estimate.

What resolution does the surface need to be? Finer than the exposure contrast you are trying to detect and no finer than your address data can support. A 1 km surface cannot express a roadside gradient; a 30 m surface assigned to ZIP-code centroids expresses nothing at all. Match the resolution to the weaker of the two constraints and say which one is binding.