Legionella and Water Hygiene — Practitioner Reference

This reference provides practitioner-level depth on UK legionella and water hygiene control — the L8 ACoP framework, HSG274 operational guidance, the Responsible Person duty, sentinel outlet methodology, sampling under BS 7592, specific risk areas including TMVs and expansion vessels, and the records regime. The layman version is at /legionella.

1. Legal framework

The duties:

• The Health and Safety at Work etc. Act 1974 (HSWA) — the parent duty under Sections 2, 3, and 4.
• The Control of Substances Hazardous to Health Regulations 2002 (COSHH) — legionella is a biological agent under COSHH; the regulations require assessment, control, monitoring, and review.
• The Management of Health and Safety at Work Regulations 1999 (MHSWR) — general risk assessment.
• The Notification of Cooling Towers and Evaporative Condensers Regulations 1992 — for notifiable systems.
• The Water Supply (Water Fittings) Regulations 1999 — for water supply installation and protection from contamination.

The supporting ACoPs and guidance:

• L8 (4th Edition) — "Legionnaires' disease: The control of legionella bacteria in water systems" (Approved Code of Practice and guidance).
• HSG274 Part 1 — "Legionnaires' disease: Technical guidance — The control of legionella bacteria in evaporative cooling systems."
• HSG274 Part 2 — "Legionnaires' disease: Technical guidance — The control of legionella bacteria in hot and cold water systems."
• HSG274 Part 3 — "Legionnaires' disease: Technical guidance — The control of legionella bacteria in other risk systems."

Relevant British Standards:

• BS 8580-1:2019 — Risk assessments for Legionella control. Code of practice. (Replaced BS 8580:2010.)
• BS 7592:2022 — Sampling for legionella bacteria in water systems. Code of practice.
• BS 8558:2015 — Guide to the design, installation, testing and maintenance of services supplying water for domestic use within buildings and their curtilages.

L8 has special legal status under HSWA Section 16. Compliance with L8 is presumptive evidence of compliance with the underlying duties; departure must be justified by an equivalent or better approach with the reasoning documented.

2. The duty holder framework

L8 places duties on the "duty holder" — the person with control of premises where legionella growth and exposure is foreseeable. In commercial contexts, the duty holder is typically the employer, building owner, landlord, managing agent, or facilities manager.

2.1 The Responsible Person

L8 requires the appointment of a Responsible Person to take day-to-day responsibility for legionella control. The appointment must be documented. The Responsible Person:

• Has sufficient authority, competence, and knowledge
• Understands the water system and its specific risks
• Oversees the control regime
• Coordinates with external contractors
• Maintains records
• Reports to the duty holder

The appointment cannot be wholly delegated to an external contractor. The duty holder retains responsibility; the external contractor delivers specified tasks under the Responsible Person's oversight.

2.2 Multiple duty holders

In multi-occupied premises, multiple duty holders typically exist:

• The landlord/freeholder for landlord-controlled systems (common water tanks, common parts plumbing)
• Each tenant for their demised systems
• Managing agents with devolved duties

Coordination is essential. The water system rarely follows lease boundaries — tenant-controlled outlets are supplied through landlord-controlled distribution. A coherent regime requires explicit allocation of responsibility for each part of the system, with cooperation under general HSWA principles.

3. Risk assessment under BS 8580-1

The L8 duty to assess is operationalised through BS 8580-1:2019. A compliant assessment covers:

3.1 System identification

• All water systems within scope (potable hot and cold, process water, cooling, humidification, decorative water features)
• System schematic showing distribution, storage, and outlets
• Materials and age of installation
• Temperatures throughout the system
• Flow patterns and frequency of use

3.2 Hazard identification

For each system component, identify factors supporting legionella growth:

• Water temperature in the growth range (20-45°C)
• Stagnation — infrequently used outlets, dead legs, oversized storage
• Biofilm, sediment, scale, organic material
• Materials supporting biofilm formation
• Aerosolisation points — showers, sprays, cooling towers, fountains, vehicle wash, humidifiers

3.3 Vulnerable populations

• Premises occupied by people with reduced immunity (healthcare, care homes)
• Premises with vulnerable users (children, elderly)
• Premises with prolonged occupancy (residential, hotels)
• Premises with public exposure (commercial premises, public buildings)

3.4 Risk evaluation

The assessment evaluates the likelihood of legionella proliferation and the consequence of exposure. Output:

• Risk score or rating per HSG274 methodology
• Identification of specific control requirements
• Sentinel outlet identification (Section 5 below)
• Monitoring regime specification

3.5 Action plan

• Prioritised actions with target dates
• Ownership
• Verification mechanism

3.6 Review

BS 8580-1 specifies:

• At least every two years (HSG274 baseline)
• Whenever there is reason to suspect the assessment is no longer valid
• Following significant changes to the system, building, or use
• Following any incident or near miss

Annual review is good practice even where two-yearly is the minimum.

3.7 Competence

Risk assessors should be competent:

• WMSoc (Water Management Society) registered legionella risk assessor
• LCA (Legionella Control Association) member organisation
• BICSc water hygiene qualifications
• Documented sector experience

Third-party accreditation under the LCA Code of Conduct provides additional assurance.

4. Temperature control

L8 and HSG274 establish temperature control as the primary defence against legionella in hot and cold water systems.

4.1 Hot water control parameters

• Calorifier flow temperature: 60°C minimum
• Calorifier return temperature: 50°C minimum
• Hot water at sentinel outlets: 55°C within one minute of running

At 55°C and above, legionella does not multiply. At 60°C, legionella is killed within minutes. At 50°C, legionella is killed within hours.

4.2 Cold water control parameters

• Cold water storage tank temperature: 20°C maximum
• Cold water at sentinel outlets: 20°C maximum within two minutes of running

Below 20°C, legionella does not multiply.

4.3 The growth zone

The temperature range 20-45°C is the "growth zone" where legionella can proliferate. Any part of the water system that sits in this range is a potential growth site. Common growth zone components:

• TMV bodies (38-43°C outlet, internal water dwells in growth zone)
• Calorifier coils approaching end-of-life
• Dead legs and infrequently used pipework
• Expansion vessels in hot water systems
• Showerheads and outlet fittings where water dwells

4.4 System design implications

Modern designs minimise growth zone exposure:

• Avoiding oversized hot water storage
• Minimising dead legs (recirculation loops, removal of redundant pipework)
• TMVs sited as close as practicable to outlets
• Recirculation systems for hot water distribution
• Insulation to maintain temperatures through distribution

5. Sentinel outlets

Sentinel outlets are representative outlets tested as proxies for the wider system. HSG274 Part 2 specifies sentinel selection.

5.1 Selection criteria

Sentinels are identified at risk assessment stage. Typical sentinel selection:

Hot water sentinels:

• The closest hot water outlet to the calorifier (proves leaving temperature)
• The furthest hot water outlet from the calorifier (proves temperature reaches end of distribution)
• Outlets representative of specific zones or floors in larger systems

Cold water sentinels:

• The closest cold outlet to the cold water tank (proves water leaves tank cold)
• The furthest cold outlet from the source (proves water arrives cold)
• Outlets representative of specific zones

Additional sentinels:

• Outlets identified by the risk assessment as warranting attention
• Outlets with TMVs (separate temperature verification needed at the TMV)
• Outlets representative of complex or vulnerable parts of the system

5.2 Documentation

Sentinels should be documented:

• Location specified by room and outlet
• Identified on a system schematic
• Listed in the monitoring records
• Reviewed at risk assessment update

"Check temperatures monthly" is too vague. "Check the outlets listed as sentinels in section X of the risk assessment" is the specific instruction the regime should give.

5.3 Sentinel rotation

For larger systems, additional outlets beyond the core sentinels may be tested on rotation — providing wider coverage over time without requiring monthly testing of every outlet. The rotation should be documented and ensure each outlet is tested at the specified frequency.

6. Monitoring regime — HSG274 Part 2

The operational regime for hot and cold water systems.

6.1 Daily

• Visual confirmation of normal system operation
• Review of alarm conditions on any monitoring equipment

6.2 Weekly

• Flushing of little-used outlets — typically 2 minutes per outlet, recorded
• The routine task most often missed in commercial premises

Little-used outlets include: guest room basins in hotels with low occupancy, guest washrooms, infrequently used office areas, plant room sinks, isolated outlets in mixed-use buildings.

6.3 Monthly

• Hot water temperatures at sentinel outlets
• Cold water temperatures at sentinel outlets
• Temperature of cold water storage tanks
• Visual inspection of accessible water tanks
• Recording of results against the assessment thresholds

6.4 Quarterly

• Descaling of showerheads (vinegar soak or replacement)
• Inspection of accessible water tanks for cleanliness, lid integrity, vermin exclusion
• Review of monthly results for trends

6.5 Annual (or as risk assessment specifies)

• Calorifier inspection and cleaning where required
• TMV disinfection
• Expansion vessel inspection
• Water tank cleaning where required
• Risk assessment review (every 2 years minimum)
• Sampling where the risk assessment specifies

6.6 Records

Each monitoring task should be recorded:

• Date and time
• Tester name
• Specific outlet or component
• Result
• Any deviations from expected and the action taken

Records should be reviewed periodically for trends — sustained drift in any direction indicates investigation is needed before it becomes exceedance.

7. Sampling under BS 7592

BS 7592:2022 is the operative standard for legionella sampling.

7.1 When sampling is appropriate

Sampling is not universally required. HSG274 Part 2 directs sampling where:

• The risk assessment identifies specific reasons (vulnerable users, healthcare)
• Temperature control cannot be reliably maintained
• The system has features warranting verification (TMVs, complex distribution, dead legs)
• Incidents have occurred or are suspected
• The system serves residential blocks (now a common expectation)

For low-risk commercial systems with strong temperature control, routine sampling adds little defensibility. The case for sampling should be made by the assessment.

7.2 Sample point selection

BS 7592 specifies sampling protocols:

• Pre-flush samples — taken first to capture water that has dwelled in the outlet
• Post-flush samples — taken after running to capture water from the distribution

Sample points typically include:

• Sentinel outlets
• Calorifier outlets
• Cold water storage tank outlet
• Specific high-risk outlets identified by assessment
• Outlets associated with positive results historically

7.3 Sample handling

• Sterile sample bottles with appropriate neutralisers (e.g., sodium thiosulphate for chlorinated water)
• Cool transport to laboratory
• Analysis at UKAS-accredited laboratory under ISO/IEC 17025
• Results within 10-14 days typically

7.4 Interpreting results

Result categories under HSG274:

• Below 100 CFU/litre — generally acceptable
• 100-1,000 CFU/litre — review the system, identify causes, plan remedial action
• Above 1,000 CFU/litre — immediate investigation, disinfection, retest

Action thresholds for hot and cold water systems may differ; specific values are set by the risk assessment.

7.5 The sampling defensibility question

A common practitioner observation: sampling is oversold in the commercial market. A regime built on strong temperature control and routine cleaning is more reliable than one built on frequent sampling. Sampling shows what was in the water at one moment; the regime around it determines what will be in the water tomorrow.

The defensible position: sample where the risk assessment justifies it, with a clear protocol for response to any exceedance. Sample as a check on the regime, not as a substitute for it.

8. Thermostatic mixing valves (TMVs)

TMVs are the most misunderstood single legionella risk in commercial premises.

8.1 The TMV function

TMVs blend hot and cold water to produce a safe outlet temperature, typically 38-43°C. Required in many premises types to prevent scalding — particularly care settings, schools, healthcare, any environment with vulnerable users.

8.2 The TMV risk

The TMV creates conditions for legionella growth:

• Outlet temperature in the growth zone (38-43°C)
• Water dwells in the body of the valve between uses
• Internal components provide surface area for biofilm
• The valve sits typically close to the outlet, creating a warm zone at the point of use

8.3 TMV maintenance

Best practice:

• Annual disinfection of the valve body (not just outlet temperature testing)
• Strainer cleaning
• Check valve verification
• Mixing performance verification (does it produce the specified outlet temperature)
• Replacement of failed components
• Documentation of each TMV by location with service history

The annual disinfection is the substantive control. Monthly outlet temperature checks confirm the mix is working today; annual disinfection addresses the internal contamination risk.

8.4 Common TMV deficiencies

• Outlet temperature checked monthly but TMV never serviced
• TMVs installed remote from outlets (creating extended dwelling sections)
• TMVs commissioned but no maintenance schedule
• TMVs replaced over time without documentation, producing inconsistent maintenance regimes

The defensible position: every TMV identified by location, included in an annual disinfection schedule, with the service record retained.

9. Expansion vessels — the overlooked risk

Expansion vessels are the most overlooked legionella risk in commercial hot water systems.

9.1 Why expansion vessels are a problem

• The vessel is in the hot water system (typically 40-50°C — growth zone)
• The water in the vessel does not flow during normal operation
• The diaphragm provides a substantial surface area for biofilm
• Pressure cycling pushes a small volume of contaminated water into the system at every cycle

9.2 Expansion vessel management

• Inspection at annual service — visual, pressure, diaphragm integrity
• Flushing per manufacturer recommendation
• Where practical, replacement with flow-through or through-flow vessels designed to minimise stagnation
• Documentation by location

9.3 The common deficiency

In most commercial hot water systems, the expansion vessel:

• Does not appear in monitoring regimes
• Is not sampled
• Is contributing to system contamination without anyone knowing
• Is only investigated when system-wide positive samples force tracing

Where the risk assessment identifies expansion vessels, the management plan should specify their inspection. Annual is the practical baseline.

10. Frequencies by building type

The L8 / HSG274 Part 2 regime is the baseline. Specific premises types warrant additional attention:

10.1 Offices and standard commercial

• L8 baseline regime
• 2-year risk assessment review (annual recommended)
• Sampling generally not required for low-risk systems

10.2 Hotels

• L8 baseline
• Higher attention to little-used outlets (guest rooms during low occupancy)
• Annual review
• Sampling commonly appropriate, particularly for premises with sleeping accommodation

10.3 Healthcare and care premises

• L8 baseline with enhanced sampling regime
• TMV maintenance critical given vulnerable users
• More frequent risk assessment review
• HTM 04-01 sector-specific guidance applies
• Specific protocols for hot water systems serving immunocompromised patients

10.4 Spas and swimming pools

• HSG274 Part 3 applies in addition to Part 2
• Spa pools: weekly sampling minimum, daily microbiological monitoring during use
• Pool water treatment integrated with the legionella regime
• Documentary regime separate from but integrated with pool water records

10.5 Industrial premises with cooling towers

• HSG274 Part 1 applies
• Cooling tower notification under the 1992 Regulations
• Significantly more demanding regime including:
  • Continuous biocide dosing
  • Routine sampling (typically monthly with specific frequencies for different determinands)
  • Cleaning and disinfection (typically twice yearly with comprehensive procedure)
  • Specific competence requirements for operators

10.6 Residential blocks (common parts)

• L8 baseline regime for landlord-controlled systems
• Particular attention to communal water storage
• Infrequently used outlets in unoccupied flats
• Sampling increasingly expected for premises with vulnerable residents

11. Cooling towers — HSG274 Part 1

Cooling towers and evaporative condensers warrant separate treatment given the higher risk profile and the specific regulatory regime.

11.1 Notification

The Notification of Cooling Towers and Evaporative Condensers Regulations 1992 require:

• Notification to the local authority of any cooling tower or evaporative condenser
• One-off notification with updates for changes (relocation, replacement, decommissioning)
• The local authority maintains a register accessible to fire and emergency services

A common deficiency at site acquisition is uncertainty about notification status. Practitioners should verify notification status as part of acquisition due diligence and following any plant change.

11.2 Operational regime

HSG274 Part 1 sets out the comprehensive regime:

• Risk assessment specific to the cooling system
• Written operational and management procedures
• Treatment regime (biocides, scale inhibitors, dispersants)
• Routine sampling and analysis
• Maintenance regime including cleaning and disinfection
• Records retention
• Competent persons for the technical management

11.3 Cleaning and disinfection

Cooling towers require periodic full cleaning and disinfection — typically twice yearly. The procedure under HSG274 Part 1 includes:

• Isolation and drain-down
• Mechanical cleaning of accessible surfaces
• Chemical disinfection at specified concentrations and contact times
• Flushing and rinse
• Recommissioning with biocide regime
• Sampling to verify

The cleaning and disinfection procedure is specialist work requiring competent contractors typically holding LCA membership and specific cooling tower expertise.

12. Competence framework

Persons working on water hygiene should be competent:

12.1 Risk assessors

• WMSoc (Water Management Society) registered legionella risk assessor
• LCA member organisation
• Sector experience appropriate to the premises (healthcare, care, residential, industrial)

12.2 Water hygiene contractors

• LCA member organisation (the principal trade body and certification)
• Documented training for operatives
• Specific qualifications for technical roles (cleaning and disinfection, chlorination, sampling)

12.3 Cooling tower contractors

• Specific cooling tower expertise beyond general water hygiene
• Documented experience with the specific tower type
• Chemical handling competence

12.4 Sampling and analysis

• Sampling by competent persons working to BS 7592
• Analysis at UKAS-accredited laboratory under ISO/IEC 17025

12.5 In-house competence

The Responsible Person should have sufficient competence to:

• Understand the regime
• Read and interpret the records
• Challenge contractor recommendations
• Identify when issues are arising
• Escalate appropriately

Typical training routes: City & Guilds Legionella Awareness, IWA (International Water Association) training, sector-specific courses through WMSoc.

13. Records — the documentary regime

Records that support defensibility:

• Current L8/HSG274-compliant risk assessment
• Documented Responsible Person appointment
• Monthly check records — temperatures with named tester
• Weekly flushing records for infrequently used outlets
• Quarterly check records — descaling, tank inspection
• Annual servicing records — calorifier, TMVs, expansion vessels
• Sampling results (where sampling is part of the regime)
• Records of remedial actions for any exceedance
• Training records for anyone involved in the regime
• Records of building or system changes affecting the assessment
• Cooling tower notification (where applicable)
• Cooling tower operational records (where applicable)

Retention should be minimum five years, longer where any incident has occurred. For Higher-Risk Buildings under BSA 2022, retention extends as part of the golden thread.

14. Common compliance deficiencies

Patterns in audited regimes:

• Risk assessment present but not matching the current water system
• No documented Responsible Person or appointment in name only
• Monthly checks recorded but sentinels not identified
• Weekly flushing absent in premises with little-used outlets
• TMV outlet temperatures checked but TMVs themselves never serviced
• Expansion vessels never inspected
• Calorifier flow recorded but return temperature ignored
• Sampling performed but no protocol for response to positive results
• Records held by water hygiene contractor with nothing on-premises
• Multiple contractors over time with fragmented records
• Cooling tower notification status unverified at site acquisition

The remediation pattern: refresh the risk assessment, identify the gaps, address them, rebuild records around a single named Responsible Person.

15. Enforcement and case law

HSE enforcement under HSWA and COSHH is active for legionella, particularly following confirmed cases of Legionnaires' disease.

15.1 Enforcement themes

Inadequate risk assessment. Premises where assessment was absent, outdated, or did not match the actual system.

Lapsed monitoring. Regimes where monitoring was specified but not delivered, identified during HSE inspection or post-incident.

Failure to act on findings. Risk assessments that identified specific risks (e.g., dead legs, TMV concerns, expansion vessel risks) where no remedial action was documented.

Cooling tower failures. Notification failures, treatment regime failures, or post-outbreak investigations finding inadequate management.

Healthcare incidents. Hospital and care premises with positive samples or confirmed cases triggering HSE investigation; sector-specific HTM 04-01 standards apply.

15.2 Sentencing

Sentencing follows the Sentencing Council Guideline for Health and Safety Offences. Where Legionnaires' disease cases result, particularly fatalities, sentencing reaches the higher tariffs. Recent corporate prosecutions involving legionella have produced six-figure fines and, in cases of culpable management failure, individual prosecutions under Section 37 HSWA.

This pillar should be read alongside the layman version at /legionella and the related professional pillars on health and safety risk assessment and gas safety.