Legionella Risk Assessment: Legal Duties, Controls and Records Explained

Legionnaires' disease is a serious, sometimes fatal form of pneumonia caused by breathing in fine water droplets contaminated with Legionella bacteria. The bacteria occur naturally in rivers and lakes but become a workplace hazard when they multiply in man-made water systems, particularly where the water is warm and stagnant. Any business with a hot and cold water system, cooling tower or other water-based plant has a legal duty to assess and control the risk, regardless of size or sector.

The Legal Framework

The duty to manage Legionella risk sits under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), which treat Legionella as a biological agent. The Management of Health and Safety at Work Regulations 1999 also require a suitable and sufficient risk assessment covering all significant hazards, including Legionella.

The Approved Code of Practice L8 and the technical guidance in HSG274 explain how to comply. HSG274 is published in three parts: evaporative cooling systems such as cooling towers, hot and cold water systems, and other risk systems such as spa pools. Make sure your risk assessment and written scheme refer to the current versions, as some older documents still cite outdated ones.

Duty holders must identify and assess sources of risk, prepare and implement a written scheme to prevent or control it, manage that scheme through a clearly accountable person, monitor and review the controls, and keep records showing all of this.

Who Is Responsible

The legal duty holder is normally the employer, or whoever controls the premises and the water system, such as a landlord, managing agent or building owner. The duty holder must appoint a "responsible person" with enough authority, competence and knowledge of the system to manage the scheme day to day. In a small business this is often the person with overall health and safety responsibility; in a larger organisation it may be a facilities manager supported by a water treatment specialist.

Many risk assessments are carried out by a water hygiene specialist, which is entirely appropriate, but the duty holder cannot hand over the paperwork and forget it. They remain responsible for making sure the scheme is followed, that the responsible person has the time and training to do the job, and that remedial actions are closed out rather than left open on a report. If you are unsure who should hold this role, a review as part of a wider health and safety consultancy engagement can clarify roles and close gaps.

Where the Risk Comes From

Not every building needs the same depth of assessment, but these systems commonly present a risk and should always be considered:

• Hot and cold water systems, especially those with calorifiers, storage tanks or long pipe runs
• Cooling towers and evaporative condensers
• Spa pools, hot tubs and hydrotherapy pools
• Humidifiers, air washers and misting systems
• Dental equipment and other medical water systems
• Vehicle wash systems, indoor fountains and decorative water features

Legionella multiplies most readily in water between roughly 20 and 45 degrees Celsius. The risk rises where that temperature band combines with stagnation (redundant pipework, little-used outlets, oversized tanks), biofilm and scale on internal surfaces, and nutrients such as rust, sludge or sediment. Aerosols from showers, spray taps, cooling towers or spa pools are how the bacteria then reach someone's lungs.

Empty units, seasonal premises, buildings under refurbishment and sites recovering from a period of closure are a particular concern, because water left standing in pipework for weeks is one of the most common precursors to a problem.

Anyone can contract Legionnaires' disease, but people over 45, smokers, heavy drinkers, and those with chronic respiratory or kidney disease or a weakened immune system are at significantly higher risk of severe illness. That is why Legionella management is taken particularly seriously in care homes and other settings housing older or vulnerable people.

How we can help COSHH Awareness Training Talk to a chartered consultant based in Leicestershire. Free, no-obligation advice. Find out more

Control Measures That Work

Temperature control is the most effective measure in most hot and cold water systems. Hot water should be stored at 60 degrees Celsius or above and should reach 50 degrees Celsius at the outlet within one minute of running (55 degrees in healthcare settings). Cold water should be kept below 20 degrees Celsius, which usually means insulating pipework that runs near heat sources and avoiding cold water tanks in warm plant rooms.

Alongside temperature, good system management matters just as much:

• Flush little-used outlets weekly, and remove any that are genuinely redundant
• Identify and remove dead legs and disused pipework rather than simply capping them off
• Clean and descale shower heads and outlets regularly to prevent scale and biofilm build-up
• Disinfect calorifiers, tanks and cooling systems on the schedule set out in the written scheme

Monitoring then confirms the controls are working. Temperatures at representative outlets are normally checked monthly, and the frequencies for other checks, such as tank and calorifier inspections, are set out in HSG274 and should be written into your scheme. Cooling towers have a more demanding regime under HSG274 Part 1, including routine water sampling. None of this should be a one-off exercise; it needs a routine that someone owns.

What a Proper Risk Assessment Looks Like

A competent Legionella risk assessment is a site-specific document, not a generic template with the company name changed. It should identify every water system on site, including easily forgotten ones such as eye wash stations, decorative features or little-used outbuildings, describe the system schematically, assess where stagnation, temperature or aerosol risks exist, and set out control measures with named responsibilities and frequencies, not vague statements like "monitor regularly".

There is no fixed legal interval for reviewing the assessment, but it must be kept under review and revisited whenever circumstances change. Many organisations also set a routine review date, commonly every two years. Triggers for an earlier review include a change of water supply or system layout, a period of disuse, the results of remedial works, a change of responsible person, or any sign the scheme is not being followed. Treating the routine date as a tick-box exercise, without checking what has changed, is a common failing.

Records: What to Keep and for How Long

Good record keeping is not bureaucracy for its own sake; it is the evidence that your scheme is being followed, and it is usually the first thing requested if something goes wrong. As a minimum, keep the risk assessment and any review, the written scheme, records of temperature checks, cleaning and disinfection, water sampling results where applicable, and details of who holds the responsible person role and what training they have had.

Check the retention periods in current guidance, and keep the risk assessment and written scheme for as long as they remain current. Many organisations keep monitoring records for several years so a reviewer can see trends over time. Paper log sheets left in a plant room are a common weak point; make sure someone outside the maintenance team can access the records too.

Where This Commonly Goes Wrong

In our experience advising organisations across housing, care and education, the same issues recur. Risk assessments cite outdated guidance. Responsible persons are named on paper but have never seen the written scheme or been trained in it. Remedial actions from the last assessment are still open a year later. And in communal buildings, such as those run by housing associations and almshouses, tenants or residents flush outlets inconsistently because nobody has explained why it matters.

If you manage buildings with communal water systems, the practical answer is usually a competent water hygiene specialist for the technical assessment and monitoring, plus clear internal ownership of the scheme so it does not lapse between visits. Where COSHH awareness is weak in your organisation, our COSHH Awareness training course is a useful way to build understanding of biological and chemical hazards among staff who manage premises.

If you are not confident your current Legionella arrangements would stand up to scrutiny, or you simply need an independent review of your wider health and safety compliance, get in touch with Integral Safety. We work with organisations across Coalville and the wider East Midlands to identify gaps before they become incidents.