Since the intentional dissemination of anthrax through the US postal system in the fall of 2001, there has been increased interest in surveillance for detection of biological terrorism. More generally, this could be described as the detection of incident disease clusters. In addition, the advent of affordable and quick geocoding allows for surveillance on a finer spatial scale than has been possible in the past. Surveillance for incident clusters of disease in both time and space is a relatively undeveloped arena of statistical methodology. Surveillance for bioterrorism detection, in particular, raises unique issues with methodological relevance. For example, the bioterrorism agents of greatest concern cause initial symptoms that may be difficult to distinguish from those of naturally occurring disease. In this paper, the authors propose a general approach to evaluating whether observed counts in relatively small areas are larger than would be expected on the basis of a history of naturally occurring disease. They implement the approach using generalized linear mixed models. The approach is illustrated using data on health-care visits (1996-1999) from a large Massachusetts managed care organization/multispecialty practice group in the context of syndromic surveillance for anthrax. The authors argue that there is great value in using the geographic data.