What you must do

If you are an employer, or someone in control of premises, including landlords, you must understand the health risks associated with legionella. This section can help you to control any risks.

Duties under the Health and Safety at Work etc Act 1974 (HSWA) extend to risks from legionella bacteria, which may arise from work activities. The Management of Health and Safety at Work Regulations (MHSWR) provide a broad framework for controlling health and safety at work and more specifically the Control of Substances Hazardous to Health Regulations 2002 (COSHH) provide a framework of duties designed to assess, prevent or control the risk from bacteria like Legionella and take suitable precautions.

Legionnaires’ disease: The control of Legionella bacteria in water systems (L8) contains practical guidance on how to manage and control the risks in your system.

As an employer, or a person in control of the premises, you are responsible for health and safety and need to take the right precautions to reduce the risks of exposure to legionella. You must understand how to:

• identify and assess sources of risk
• manage any risks
• prevent or control any risks
• keep the correct records
• carry out any other duties you may have

Identify and assess sources of risk

Carrying out a risk assessment is your responsibility. You may be competent to carry out the assessment yourself but, if not, you should call on help and advice from either within your own organisation or from outside sources, e.g. consultancies.

You or the person responsible for managing risks, need to understand your water systems, the equipment associated with the system such as pumps, heat exchangers, showers etc, and its constituent parts. Identify whether they are likely to create a risk from exposure to legionella, and whether:

• water is stored or re-circulated as part of your system
• the water temperature in all or some parts of the system is between 20–45 °C
• there are sources of nutrients such as rust, sludge, scale and organic matters
• the conditions are likely to encourage bacteria to multiply
• it is possible for water droplets to be produced and, if so, whether they can be dispersed over a wide area, e.g. showers and aerosols from cooling towers
• it is likely that any of your employees, residents, visitors etc are more susceptible to infection due to age, illness, a weakened immune system etc and whether they could be exposed to any contaminated water droplets

Your risk assessment should include:

• management responsibilities, including the name of the competent person and a description of your system
• any potential risk sources
• any controls currently in place to control risks
• monitoring, inspection and maintenance procedures
• records of the monitoring results and inspection and checks carried out
• a review date

If you decide that the risks are insignificant and are being properly managed to comply with the law, your assessment is complete. You will not need to take any further action, but it is important to review your assessment periodically in case anything changes in your system.

Managing the risk

As an employer, or person in control of premises, you must appoint someone competent to help you meet your health and safety duties, i.e. take responsibility for managing the control scheme.

A competent person is someone with the necessary skills, knowledge and experience to manage and control the scheme effectively. You could appoint one, or a combination of:

• yourself
• one or more workers
• someone from outside your business

If there are several people responsible for managing risks, e.g. because of shift-work patterns, you need to make sure that everyone knows what they are responsible for and how they fit into the overall risk management of the system.

If you decide to employ contractors to carry out water treatment or other work, it is still the responsibility of the competent person to ensure that the treatment is carried out to the required standards. Remember, before you employ a contractor, you should be satisfied that they can do the work you want to the standard that you require. There are a number of external schemes to help you with this, for example, A Code of Conduct for service providers .

The British Standards Institute have published a standard for legionella risk assessment.

Preventing or controlling the risk

You should consider whether you can prevent the risk of legionella in the first place by looking at the type of water system you need, e.g. identify whether it is possible to replace a wet cooling tower with a dry air-cooled system. The key point is to design, maintain and operate your water services under conditions that prevent or adequately control the growth and multiplication of legionella.

If you identify a risk that you are unable to prevent, you must introduce a course of action that will help you to manage the risk from legionella by implementing effective control measures, by describing:

• your system, e.g. develop a written schematic
• who is responsible for carrying out the assessment and managing its implementation
• the safe and correct operation of your system
• what control methods and other precautions you will be using
• what checks will be carried out, and how often will they be carried out, to ensure the controls remain effective

You should:

• ensure that the release of water spray is properly controlled
• avoid water temperatures and conditions that favour the growth of legionella and other micro-organisms
• ensure water cannot stagnate anywhere in the system by keeping pipe lengths as short as possible or removing redundant pipework
• avoid materials that encourage the growth of legionella (The Water Fittings & Materials Directory references fittings, materials, and appliances approved for use on the UK Water Supply System by the Water Regulations Advisory Scheme);
• keep the system and the water in it clean;
• treat water to either kill legionella (and other microorganisms) or limit their ability to grow.

Keeping records

If you have five or more employees you have to record any significant findings, including any groups of employees identified by it as being particularly at risk and the steps taken to prevent or control risks.

If you have less than five employees, you do not need to write anything down, although it is useful to keep a written record of what you have done.

Records should include details of the:

1. person or persons responsible for conducting the risk assessment, managing, and implementing the written scheme
2. significant findings of the risk assessment
3. written control scheme and details of its implementation
4. results of any inspection, test or check carried out, and the dates
5. This should include details of the state of operation of the system, i.e. in use/not in use.

These records should be retained throughout the period for which they remain current and for at least two years after that period. Records kept in accordance with (d) should be retained for at least five years.

Other duties

Under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, you must notify your local authority, in writing, if you have a cooling tower or evaporative condenser on site, and include details about where it is located. You must also tell them if/when such devices are no longer in use. Notification forms are available from your local environmental health department.

In addition, under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR), you must report any cases of legionellosis in an employee who has worked on cooling towers or hot water systems that are likely to be contaminated with legionella.

Specific risk systems

You will also need to consider technical and further information on the following risk systems:

• Cooling Towers
• Hot and cold water systems
• Spa Pools
• Other risk systems