Legionella incident reporting: your complete UK guide
- May 9
- 10 min read
Legionella incident reporting is one of those areas where even experienced facilities managers and compliance officers can find themselves uncertain about what they must do, when, and to whom. The consequences of getting it wrong are serious: regulatory action, reputational damage, and most critically, preventable harm to the people who use your buildings. Two distinct legal frameworks govern reporting obligations in the UK, and they operate independently of each other. This article breaks down both systems, clarifies the statutory triggers, and explains how reporting fits within your wider Legionella management responsibilities.
Table of Contents
Key Takeaways
Point | Details |
Two reporting routes | Facilities managers must distinguish between clinical case reporting and workplace incident notification for Legionella compliance. |
Statutory triggers | You are legally obliged to report only diagnosed legionellosis in people or specific work-related exposures, not all test results. |
Reporting is not enough | Maintaining risk assessments, written schemes, and monitoring are essential ongoing duties for Legionella safety. |
Outbreak response | Authorities actively investigate, conduct testing, and enforce control measures during a reported Legionella outbreak. |
Clarity prevents pitfalls | Understanding the difference between mandatory notifications and internal precautions prevents both over- and under-reporting errors. |
Understanding Legionella reporting: two distinct routes
To start, let us clarify the two separate frameworks at play when it comes to reporting Legionella incidents in the UK.
The first framework concerns public health notification. Legionellosis is notifiable by medical practitioners and must be reported to the UK Health Security Agency (UKHSA) under the Public Health (Control of Disease) Act 1984 and associated Notification Regulations. This obligation falls on the diagnosing clinician, not on you as the building manager. However, you will almost certainly be contacted as part of any subsequent investigation.
The second framework is workplace-specific. RIDDOR requires reporting of legionellosis in employees who have been exposed to contaminated water systems as part of their work. This obligation falls squarely on the responsible person, which is typically the employer or duty holder for the premises.
Understanding which route applies in a given situation is not always straightforward. Here is a quick summary:
UKHSA notification: Triggered by a confirmed or probable clinical diagnosis of legionellosis in any person. Reported by the diagnosing doctor.
RIDDOR notification: Triggered when an employee contracts legionellosis that is attributable to workplace exposure. Reported by the responsible person (employer or duty holder).
Both may apply: If an employee is diagnosed with legionellosis linked to their work on a water system, both the clinical and workplace routes are activated simultaneously.
Neither may apply: If environmental testing detects Legionella bacteria in your water system but no one has been diagnosed, neither statutory route is triggered.
“The distinction between a public health notification and a RIDDOR report is not just administrative. Each triggers a different investigation pathway, involves different authorities, and carries different legal weight for the duty holder.”
Pro Tip: Prepare a reporting flowchart before any incident occurs. Map out who contacts whom, under what circumstances, and within what timeframe. Store it in your Legionella logbook so it is accessible when you need it most. Consider pairing this with Legionella awareness training so your team understands the triggers instinctively.
Statutory obligations: when and what to report
With the main frameworks established, let us unpack exactly what the law requires you to report in practical terms.
Notifiable diseases must be reported to UKHSA under law, and legionellosis sits firmly on that list. Clinicians have a legal duty to notify the local authority’s Proper Officer, who in turn feeds data to UKHSA. As a facilities manager, your role begins once an investigation is launched and you are asked to provide access, records, or water samples.
For RIDDOR, responsible persons must make reports, not members of the public. This is a critical distinction. If a maintenance engineer contracted to work on your cooling tower develops legionellosis, the duty to report under RIDDOR rests with their employer, not with you as the building owner, unless you are also their employer.
What to report | To whom | By whom | When |
Confirmed or probable legionellosis in any person | UKHSA via local Proper Officer | Diagnosing clinician | Within 3 days of diagnosis |
Legionellosis in an employee linked to workplace exposure | HSE via RIDDOR online portal | Employer or responsible person | As soon as practicable |
Environmental Legionella detection (no illness) | Internal records only | Responsible person | Immediately, internally |
Outbreak involving multiple cases | UKHSA and HSE jointly | Clinicians and responsible persons | Immediately |
Here is a practical step-by-step workflow for statutory reporting:
Receive notification that an employee or building user has been diagnosed with legionellosis.
Establish whether workplace exposure is likely by reviewing recent maintenance records, water system logs, and risk assessments.
Contact your legal or compliance adviser immediately to confirm RIDDOR obligations.
Submit the RIDDOR report via the HSE online portal if workplace exposure is confirmed or suspected.
Cooperate fully with UKHSA and local public health teams during their investigation, providing access to records and the premises.
Preserve all documentation including water test results, maintenance logs, and risk assessments. Do not alter or destroy any records.
Review your Legionella risk assessment in light of the incident and update your written scheme accordingly.
For healthcare and high-risk environments, the reporting stakes are even higher. Legionella outbreaks in NHS settings illustrate how quickly an incident can escalate when vulnerable populations are involved, making pre-planned reporting procedures absolutely essential.
Pro Tip: Assign a single named individual as your reporting lead before any incident occurs. This person should know the RIDDOR portal, hold copies of all relevant documentation, and have direct contact details for your local UKHSA health protection team.
Control duties beyond reporting: your legal compliance framework
Reporting requirements tell only part of the compliance story. At heart, they sit within a broader set of legal obligations that you must maintain continuously, not just in response to an incident.
ACOP L8 requires risk assessment, a written scheme of control, ongoing monitoring, and competent personnel as core duties that exist entirely independently of incident reporting. In other words, you cannot fulfil your legal obligations simply by knowing how to file a report. The duty to prevent Legionella growth in the first place is primary.
Your ongoing compliance framework should include:
A current, site-specific Legionella risk assessment reviewed at least every two years or following significant changes to the water system.
A written scheme of control detailing the control measures in place, monitoring frequencies, and responsible persons.
Regular water temperature monitoring to ensure hot water is stored above 60°C and delivered at 50°C within one minute, and cold water is maintained below 20°C.
Routine inspection and cleaning of cooling towers, evaporative condensers, and other high-risk plant.
Water sampling and analysis at defined intervals, with results recorded and acted upon promptly.
Maintenance records for all water system interventions, including TMV servicing, tank cleaning, and disinfection events.
Competent person designation ensuring someone with appropriate knowledge and training oversees the control programme.
“The written scheme is not a document you produce once and file away. It is a living record of how your water systems are managed, and it is the first thing investigators will ask to see following any incident.”
Keeping a well-maintained Legionella logbook is one of the most practical ways to demonstrate ongoing compliance. It provides a clear, auditable trail of all monitoring, maintenance, and corrective actions taken across your sites.
Pro Tip: Do not wait for an incident to test your procedures. Run a tabletop exercise at least once a year where your team works through a simulated Legionella notification. Identify the gaps before an investigation does.
Outbreak investigations and control: what happens next?
When a report is made, what practical steps can you expect from authorities and how should you prepare?
UKHSA coordinates outbreak investigations and may implement immediate environmental controls including site visits, environmental sampling, and precautionary measures such as shock-dosing of cooling towers or hot water systems. These actions can happen quickly, sometimes within 24 to 48 hours of a report being received.
Understanding the roles of each stakeholder during an investigation helps you respond efficiently rather than reactively.
Stakeholder | Primary responsibilities during investigation |
Building management / duty holder | Provide access, records, and water system documentation; implement control actions; communicate with staff and occupants |
UKHSA | Lead epidemiological investigation; coordinate public health response; advise on environmental controls |
HSE | Investigate workplace exposure; assess RIDDOR compliance; consider enforcement action if duties have not been met |
Local authority | Environmental health officers may conduct site inspections; enforce statutory notices if required |
Occupational health / clinicians | Diagnose and notify cases; provide clinical information to investigators |
During an active investigation, you should expect and prepare for:
Unannounced site visits from environmental health officers or HSE inspectors.
Requests for immediate water sampling from multiple points across your system.
Instructions to take specific plant offline or to carry out emergency disinfection.
Communication duties to building occupants, staff, and potentially the media.
A formal incident report or improvement notice if control failures are identified.
Statistic callout: According to UKHSA surveillance data, the majority of Legionella cases in England and Wales are sporadic rather than outbreak-related, but when clusters do occur, investigations typically involve multiple agencies simultaneously, and the response timeline from notification to site inspection can be as short as 24 hours.
For office and commercial premises, the pressure of an active investigation while maintaining normal business operations is significant. Having pre-agreed communication plans and designated points of contact for each authority makes an enormous practical difference.
Common misunderstandings and practical scenarios
To round out the guidance, let us clear up the common missteps and seemingly grey areas that trip up even diligent compliance teams.
The most persistent misunderstanding is conflating environmental test results with statutory reporting triggers. Statutory reporting is linked to diagnosed cases, not environmental test results alone. Finding Legionella bacteria in your water during routine environmental testing does not automatically trigger a RIDDOR report or a UKHSA notification. It does, however, trigger your internal control procedures immediately.
Here is how to handle the most common scenarios:
Positive water test, no illness reported: Initiate your written scheme’s remedial action plan immediately. Increase monitoring frequency. Document all actions. No statutory notification required, but internal escalation is mandatory.
Employee reports flu-like symptoms after working on a cooling tower: Do not wait for a formal diagnosis. Alert your occupational health team, review exposure records, and prepare your RIDDOR documentation in readiness. If legionellosis is subsequently confirmed, submit the report without delay.
A building user is hospitalised with pneumonia and Legionella is suspected: Cooperate fully with the treating clinician and public health team. Begin gathering your water system records. If the person is not your employee, RIDDOR does not apply to you, but your records will be central to the investigation.
Multiple cases linked to your building emerge over a short period: This is a potential outbreak. Contact UKHSA proactively. Do not wait to be approached. Early, voluntary engagement with authorities is always viewed more favourably than a reactive response.
Common errors in practice include over-reporting, where managers submit RIDDOR reports for positive environmental tests with no associated illness, and under-reporting, where confirmed employee cases are not reported because the connection to workplace exposure is considered uncertain. Both carry risk. When in doubt, seek specialist advice before deciding not to report.
Expert perspective: why getting Legionella reporting right protects everyone
Here is a broader view on why thorough and practical reporting, and what comes after, matters so much for genuine water safety.
In our experience working across commercial, healthcare, and facilities management sectors, the facilities teams that struggle most during Legionella investigations are not those who filed the wrong report. They are those who had no clear internal process at all. The statutory reporting frameworks are relatively straightforward once you understand them. The real vulnerability lies in the gap between knowing the rules and having a functioning system that enacts them under pressure.
There is a tendency in compliance culture to treat reporting as the destination. File the form, close the incident, move on. But a RIDDOR report or a UKHSA notification is actually the beginning of a process, not the end of one. What follows, the investigation, the enforcement review, the remedial programme, is where your prior level of diligence becomes visible. If your records are incomplete, your risk assessment is out of date, or your written scheme has not been reviewed since the last refurbishment, no amount of prompt reporting will protect you from the consequences.
We also see a genuine risk in the focus on edge cases and statutory triggers. Teams spend time debating whether a specific scenario meets the RIDDOR threshold when they would be better served by ensuring their water temperature logs are complete, their TMVs are serviced on schedule, and their responsible persons actually understand what they are responsible for. A real-world case study illustrates this point clearly: the incidents that lead to enforcement action are rarely those where the reporting was imperfect. They are those where the underlying management culture was absent.
Our honest advice is this: invest as much energy in your day-to-day control programme as you do in understanding your reporting obligations. The two are inseparable, but prevention is always the more powerful safeguard.
Supporting your compliance journey
If robust reporting and compliance still feels overwhelming, there are specialised services ready to assist.
At Bespoke Compliance Solutions, we work with facilities managers and compliance officers across the UK to make Legionella management genuinely manageable. Whether you need clarity on your reporting obligations or a fully structured control programme, we provide practical, site-specific support that removes the guesswork.
Our Legionella compliance solutions cover everything from initial risk assessments and written scheme development through to ongoing monitoring and incident support. We can help you get your staff trained so that reporting triggers, control duties, and escalation procedures become second nature across your team. Our reliable water testing services ensure that your environmental monitoring is robust, documented, and ready to support any investigation. When an incident occurs, you want to be the organisation that already had everything in order.
Frequently asked questions
What are the statutory reporting triggers for Legionella incidents in the UK?
Reporting is required for confirmed or probable legionellosis in people and for employees exposed to contaminated systems in the workplace, with each route activating a different notification pathway.
Who is responsible for making a RIDDOR report after a Legionella incident?
The employer or duty holder must submit the RIDDOR report, as responsible persons make reports, not members of the public or building users.
Does a positive Legionella test in water mean I must file a statutory report?
No; statutory reporting requires diagnosed cases, not environmental detection alone, though a positive result does trigger your internal remedial action procedures immediately.
What immediate actions might authorities take during a Legionella outbreak investigation?
UKHSA coordinates outbreak investigations with control measures including site visits, environmental sampling, and precautionary interventions such as emergency disinfection of suspect systems.
Recommended
Comments