Legionella Risk Assessment: A UK Guide for Employers and Landlords

This guide is for facilities managers, office and site managers, landlords and anyone who has been handed responsibility for a building’s water system. It covers who needs a legionella risk assessment, what goes into one, the temperatures HSE expects you to achieve, what records to keep and how often to look at it again.

What is a legionella risk assessment?

It is a structured look at your water systems to find out whether conditions exist for legionella bacteria to multiply, and whether people could breathe in contaminated water droplets. The result tells you which controls you need and who is responsible for them.

People catch Legionnaires’ disease by inhaling small droplets of water (aerosols) that contain the bacteria. Showers, spray taps, cooling towers and spa pools all create those droplets. HSE lists people over 45, smokers and heavy drinkers, and anyone with chronic respiratory or kidney disease, diabetes, lung or heart disease or an impaired immune system as more vulnerable. Early symptoms look like flu: a high temperature, chills, a cough, muscle pain and headache.

Is a legionella risk assessment a legal requirement?

Yes. HSE states that employers and people in control of premises, including landlords, must identify and assess sources of legionella risk, then prevent or control them. The duty comes from four places:

• the Health and Safety at Work etc. Act 1974, which extends to legionella risks arising from work activities
• the Management of Health and Safety at Work Regulations 1999, which require a suitable and sufficient risk assessment
• the COSHH Regulations 2002, which treat legionella as a biological agent that must be assessed and controlled
• the Approved Code of Practice L8, Legionnaires’ disease: the control of legionella bacteria in water systems, currently in its fourth edition (2013)

L8 explains how to meet those duties and, as an Approved Code of Practice, has special legal status. HSE’s technical guidance, HSG274, sits underneath it in three parts: Part 1 covers evaporative cooling systems, Part 2 covers hot and cold water systems, and Part 3 covers other risk systems such as spa pools and humidifiers. For most offices, shops, schools and rented homes, Part 2 is the relevant part.

You can read HSE’s own summary on its legionella duties page.

Who needs a legionella risk assessment?

Anyone who employs people, controls premises or lets property. In practice that means:

• employers, for any workplace with a water system
• building owners and managing agents who control shared plant
• landlords of residential property, including a room let in their own home
• self-employed people whose work could expose others to the risk

The size of the assessment should match the risk. A small office with a mains-fed cold supply and a combination boiler is a very different job from a hospital, a hotel or a factory with a cooling tower.

What should a legionella risk assessment include?

HSE says the assessment should consider whether conditions in your system favour bacterial growth and whether anyone could be exposed. Work through these questions for every part of the system:

1. Temperature. Is water in any part of the system between 20 and 45°C, the range in which legionella can grow?
2. Storage and recirculation. Is water stored in tanks or recirculated through the system?
3. Nutrients. Are rust, sludge, scale, organic matter or biofilm present?
4. Stagnation. Are there dead legs, redundant pipework or outlets that are rarely used?
5. Spray. Could droplets be created and spread, for example from showers or cooling tower drift?
6. People. Is anyone exposed more susceptible because of age, illness or a weakened immune system?

The written output should name the people involved, describe the system (an up-to-date schematic helps), record the significant findings, and set out a control scheme with clear actions and timescales. Our general guide to risk assessments covers the principles that apply to any assessment.

What temperatures does HSE expect?

Temperature control is the usual way to manage legionella in hot and cold water systems. Keep hot water hot, cold water cold, and keep it moving. HSE’s figures for hot and cold water systems are below.

Source: HSE, Hot and cold water systems: things to consider, and HSG274 Part 2.

Sentinel outlets are the taps chosen to represent the condition of water in the system. HSG274 says they are typically those nearest to and furthest from the tank or heater, with extra sentinels at the ends of long branches and, in circulating hot water systems, towards the end of each loop. Where you have thermostatic mixing valves to prevent scalding, the risk assessment needs to account for the blended water downstream of the valve, which HSG274 notes may provide an environment in which legionella can grow.

Who can carry out a legionella risk assessment?

Anyone who is competent. HSE describes a competent person as someone with sufficient training and experience or knowledge, and other qualities, to do the job properly. You can do it yourself if you are competent, use a trained member of staff, or bring in an outside consultant. For complex systems, such as those with cooling towers or large calorifiers, a specialist is usually the sensible route.

Separately from the assessor, L8 expects you to appoint a responsible person to manage the day-to-day control scheme. HSE says this should be someone with sufficient authority, competence, skills, knowledge of the system and experience. Where duties are split, for example across shifts, everyone needs to understand their own part and how it fits the whole.

If you use a water treatment contractor, the responsibility stays with you. Check that the contractor can deliver the standard you need before you sign them up.

Legionella risk assessments for landlords

Landlords must assess the risk, but HSE is clear that for most domestic lets this does not need to be an in-depth assessment. Most landlords can assess the risk themselves and do not need professional training or accreditation. If a simple assessment shows the risk is low and controlled, no further action is needed.

Two points come up often. HSE states that the law does not require a “legionella test certificate”, and that testing or sampling is not usually needed for domestic hot and cold water systems. Practical controls for a rented home include setting the hot water cylinder to store at 60°C, removing redundant pipework, fitting a tight lid on any cold water tank, and flushing the system before a new tenancy. Tell tenants not to change the cylinder temperature, to clean showerheads regularly, and to report hot water that is not heating properly. HSE’s landlords’ page has the full detail.

How often should a legionella risk assessment be reviewed?

There is no fixed legal interval. For landlords, HSE states the law does not prescribe an annual or two-yearly review. For workplaces, HSE says the assessment should be reviewed regularly and particularly when there is reason to suspect it is no longer valid. In practice, that means reviewing it when:

• the water system is altered, extended or partly taken out of use
• the use of the building changes
• new information becomes available about the risks or control measures
• monitoring shows temperatures or other controls are not being achieved
• key personnel change, such as the responsible person
• a case of Legionnaires’ disease is linked to the premises

L8 says the record should indicate when the assessment will be reviewed and what to consider. Many organisations set a planned review date in their policy so it does not drift. The interval is your choice, not a legal deadline.

What records do you need to keep?

If you have five or more employees you must record the significant findings. Below five, L8 says there is no statutory duty to write anything down, though it may be useful to keep a written record. Records should show:

• who carried out the assessment and who manages the control scheme
• the significant findings of the assessment
• the written control scheme and how it is being implemented
• whether the system is in use or shut down
• the dates and results of monitoring, inspections, tests and checks

L8 says these records should be kept for as long as they remain current and for at least two years after that. Records of monitoring and inspection results should be kept for at least five years.

Other duties linked to legionella

Two further duties catch people out. If your site has a cooling tower or evaporative condenser, you must notify your local authority in writing under the Notification of Cooling Towers and Evaporative Condensers Regulations, and tell them again when it goes out of use. And if an employee who worked on cooling towers or hot and cold water systems develops legionellosis, it is reportable under RIDDOR. Our RIDDOR reporting guide explains how to report.

Do you need to test for legionella?

Not usually for hot and cold water systems. HSE says routine microbiological sampling is not normally needed for these enclosed systems, but may be required if there is doubt about the control regime or target temperatures are not being consistently met. Open systems such as cooling towers are different: HSE expects routine testing at least quarterly. Where samples are taken, they should be analysed by a UKAS-accredited laboratory.

Frequently asked questions

Where to learn more

• Legionella Training: a one-day course on risk assessment, control schemes, monitoring and treatment, built around L8 and HSG274
• COSHH Regulations explained: the regulations that cover biological agents such as legionella
• Risk assessments: a UK guide
• KeyOstas consultancy: support with policies, audits and risk assessments