Legionella Outbreak Response: What Dutyholders Must Do in the First 24 Hours

A suspected Legionella outbreak or a strongly positive sample puts a dutyholder into a narrow window where decisions matter. The first 24 hours shape everything that follows: the health outcome for exposed users, the regulator’s view of your competence, the scope and cost of remediation, and the defensibility of your records if the case escalates. A measured, well-documented legionella outbreak response is the single biggest predictor of whether an incident stays contained or becomes a serious enforcement matter.

This is an hour-by-hour operational guide for responsible persons, facilities managers, landlords and managing agents. It covers what to do in the first hour, how to isolate systems without creating new risks, who to notify under RIDDOR, HSE and UKHSA rules, how to run disinfection and remedial action correctly, and how to communicate with occupants and vulnerable users. The aim is simple: to help a dutyholder act decisively, stay within ACOP L8 and HSG274, and document every step so the response holds up under scrutiny.

If you are reading this mid-incident, go straight to the first-hour section and work forward. If you are preparing in advance, read in full and use it to pressure-test your written scheme of control before you need it.

Why the First 24 Hours of a Legionella Outbreak Matter

Legionella bacteria multiply in warm, stagnant water and cause harm when aerosolised water reaches the lungs. Once a system is confirmed as colonised, every shower run, cooling tower cycle, spa jet or tap opening is a potential exposure event. The clinical picture makes the time pressure obvious. Legionnaires’ disease has an incubation period of roughly 2 to 14 days, which means today’s exposure becomes next week’s hospital admission. The earlier you stop aerosol generation from a suspect source, the smaller the exposed population and the narrower the public health investigation.

There is also a regulatory dimension. The Health and Safety Executive expects dutyholders to act on microbiological results and clinical signals promptly. Under the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002 and the Approved Code of Practice L8, you are expected to control risk so far as is reasonably practicable. Delay, indecision or an incomplete response are exactly the failures that appear in enforcement cases and fatal accident findings.

The commercial reality matters too. Insurers, corporate clients, local authorities and housing regulators all look at how quickly you recognised the issue, how you contained it, who you notified, and whether your written scheme of control and logbook reflect what actually happened. A strong 24-hour response protects people first and reputations second, but both are at stake.

Recognising an Outbreak Versus a Single Positive Sample

Not every positive result is an outbreak, and treating them the same either wastes resources or understates the risk. Dutyholders need to distinguish between a routine control failure, a significant positive result, and a clinical outbreak, because the required response differs.

A legionella positive sample action plan starts with the count and the species. HSG274 Part 2 provides the widely used action levels for hot and cold water systems:

• Counts between 100 and 1,000 cfu/litre in fewer than 20% of samples generally indicate the system is under control but requires review of control measures.
• Counts between 100 and 1,000 cfu/litre in more than 20% of samples, or any single result above 1,000 cfu/litre, require immediate investigation, resampling and typically disinfection.
• Counts above 10,000 cfu/litre demand urgent action, including isolation, disinfection, system review and serious consideration of whether to restrict use.

Cooling towers and evaporative condensers have their own thresholds under HSG274 Part 1, with action required from 100 cfu/litre upwards and immediate action from 1,000 cfu/litre. Any Legionella pneumophila serogroup 1 result should be treated more seriously than a non-pneumophila result because of its prominence in clinical cases.

An outbreak is a different situation. UKHSA defines an outbreak as two or more confirmed cases of Legionnaires’ disease occurring in the same area within a short time, or a single case linked epidemiologically to a specific source such as a hotel, hospital, care home, workplace or cooling tower. If a public health team contacts you about a suspected case linked to your premises, treat that as an outbreak situation from the first conversation, even before environmental sampling confirms the link.

The practical point is this: a single high count triggers remediation. A clinical case or cluster triggers remediation plus formal notification, a coordinated investigation with the authorities, and far more extensive record-keeping. Recognising which situation you are in, in the first hour, sets the tempo for everything else.

The First Hour: Immediate Containment and Internal Escalation

The first hour is about stopping exposure and getting the right people involved. It is not the moment for long meetings or drafting communications. Treat it as you would a fire alarm: a small number of defined actions, taken in parallel, by named people.

Within the first hour, the dutyholder or appointed responsible person should aim to:

• Confirm the trigger in writing. Record the sample result, clinical notification or regulator contact that prompted the response, with time and source.
• Identify the implicated system or systems. This might be a specific calorifier, a run of showers, a cooling tower, a spa pool, a cold water storage tank or a section of dead-leg pipework.
• Stop aerosol generation from the suspect source. For showers, that means taking them out of service. For cooling towers, stop the fans and, if safe, the pumps. For spa pools and features, close and drain as soon as practicable.
• Brief the senior accountable person. The dutyholder, director, estates lead or registered manager needs to know within the first hour, not at the end of the day.
• Contact your water hygiene contractor or legionella consultant. Make clear you are dealing with a live incident and need site attendance and technical support, not a routine callout.
• Start an incident log. Every decision, action, time and person from this point onwards goes into one controlled record.

Avoid two common first-hour mistakes. The first is flushing the suspect system before the authorities or consultants have advised, which can destroy sampling evidence and spread contamination through the building. The second is informal containment, where a maintenance team takes action without documenting it, leaving the dutyholder unable to demonstrate what was done when the regulator asks.

If clinical cases are involved, assume that UKHSA and the local HSE inspector will be on site or on a call within 24 to 48 hours. The first hour is where you either start building a defensible timeline or start losing control of the narrative.

Isolating Affected Systems Without Creating Secondary Risk

Isolation sounds simple. In practice it is the stage where dutyholders create new problems: bypass pipework that seeds contamination elsewhere, partial shut-offs that create stagnant loops, or full building shutdowns that damage the heating system and sterile supplies. Good isolation is specific, considered and fully documented.

Before turning any valve, map what the system actually does. Most commercial water systems have a mix of cold water storage, calorifiers, hot and cold distribution, return loops, secondary circulation pumps, and outlets serving mixed occupancy. A cooling tower shares a cooling circuit with chillers that may support critical processes. A care home’s hot water supplies bathing facilities used by high-risk residents. Isolation decisions must weigh the legionella risk against scalding, loss of drinking water, loss of heating, and clinical or operational consequences.

Water Systems In Buildings

For hot and cold water systems, isolation usually takes one of three forms. The first is outlet-level isolation, where individual showers or taps are taken out of service with clear signage and physical means such as removed shower heads, capped outlets or locked-off valves. The second is zonal isolation, where a floor, wing or riser is taken out of service at a valve. The third is full system isolation, which is rare outside a significant outbreak and typically requires alternative supplies, particularly for drinking water and clinical use.

Whichever approach is used, avoid creating dead legs. An outlet taken out of service with water left standing behind a closed isolation valve becomes a future problem. Where possible, drain back to a safe point. Where draining is not possible, mark the dead leg on the schematic and include it in the remediation plan.

Cooling Towers And Evaporative Systems

Cooling towers demand particular care because aerosol drift can travel hundreds of metres. Stop the fans first to reduce aerosol generation, then consider whether to continue recirculation for the purposes of biocide dosing and disinfection. Do not simply switch everything off and leave a warm, stagnant, contaminated system standing. Notify the local authority under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992 if the system is not already registered, and update the registration if the status changes.

Spa Pools, Features And Other Aerosol Sources

Spa pools, decorative fountains, humidifiers, vehicle wash systems and similar aerosol generators should be taken out of service immediately on a credible signal. They are disproportionately represented in outbreak reports and the controls are rarely robust enough to justify continued operation during an investigation.

Record every isolation action with time, location, valve reference, signage used and the person who carried it out. Photograph signage and locked valves. This evidence matters both for the investigation and for the eventual return-to-service decision.

Notification Duties Under RIDDOR, HSE and UKHSA

Notification is the area where dutyholders most often get into difficulty, either by under-reporting or by reporting the wrong thing to the wrong body. The rules are clearer than they look, but they depend on what you actually have: a positive sample, a suspected clinical case, or a confirmed case linked to your premises.

A positive environmental sample on its own is not a RIDDOR-reportable event. There is no general legal duty to notify the HSE or UKHSA simply because a count exceeds an action level. The duty is to act on it under ACOP L8 and HSG274. However, there are specific notification triggers that dutyholders must understand:

• Under RIDDOR 2013, a confirmed case of Legionnaires’ disease in a worker whose job involves work on or near a system that could be the source is reportable as a case of disease. This is the principal HSE legionella notification route for workplace exposure.
• Legionnaires’ disease is a notifiable disease under the Health Protection (Notification) Regulations 2010. The clinician treating the patient makes that notification to UKHSA. Dutyholders are not usually the first notifier, but you will be drawn into the UKHSA legionella reporting process once a link to your premises is suspected.
• Cooling towers and evaporative condensers must be registered with the local authority. A change in circumstances, such as decommissioning during an incident, should be notified.
• Sector-specific duties apply in healthcare, care homes and social housing, where CQC, the Regulator of Social Housing and housing ombudsman frameworks create additional reporting expectations.

When a case is linked to your premises, expect contact from a UKHSA Health Protection Team, the local authority environmental health officer, and an HSE inspector if there is a workplace angle. They will usually want to see your written scheme of control, recent risk assessment, monitoring records for the last 12 months, maintenance records, and a clear account of the first 24 hours. Treat these requests as a priority and route all responses through one named coordinator to avoid inconsistent information.

Useful background on statutory duties is available through the HSE’s legionella pages, and you can find a practical summary of the regulatory framework in our guide to legionella regulations and guidance.

Two practical warnings. First, do not report speculatively to multiple bodies to appear proactive: an inaccurate RIDDOR submission creates its own problems. Confirm the facts, take advice, and report accurately. Second, keep a written log of every call with a regulator, including the time, the officer’s name and the substance of the conversation. Verbal instructions from regulators carry weight, and you will need to evidence that you followed them.

Disinfection, Flushing and Remedial Action in the First 24 Hours

Disinfection must start promptly but must also be done correctly. A rushed legionella disinfection procedure that misses sections of pipework, uses the wrong concentration, or fails to hold contact time produces a false reassurance that is often worse than doing nothing. The approach depends on the system type and the nature of the contamination.

Chemical Disinfection Of Domestic Water Systems

For hot and cold water systems, the standard approach under BS 8558 and HSG274 Part 2 is chlorination at 50 mg/l free chlorine held for one hour, or 20 mg/l held for two hours, throughout the system including every outlet. The critical steps are:

• drain down where necessary, clean tanks physically, and remove obvious biofilm and debris
  
• introduce the disinfectant and circulate through every outlet until target concentration is confirmed at each one
  
• hold the contact time with periodic checks to confirm the residual is maintained
  
• flush thoroughly to remove the disinfectant, then verify water quality before returning outlets to service
  
• resample at representative points after a suitable recovery period, typically 2 to 7 days
  

Thermal disinfection is an alternative for hot water systems, raising temperatures so that every outlet delivers at least 60°C for a defined period. It is effective but carries significant scalding risk and must be managed with care, particularly in healthcare and care environments. Chlorine dioxide, monochloramine and other dosing regimes may be appropriate for ongoing control but are not usually the first tool for incident disinfection.

Cooling Towers

Cooling tower disinfection is a specialist operation. It typically involves online disinfection with a suitable biocide at elevated concentration, followed by a drain-down, mechanical clean of the tower pack, sump, drift eliminators and distribution, then a second disinfection before recommissioning. Access, PPE and RPE requirements are significant, and only competent contractors should carry this out. Do not restart fans until the disinfection sequence is complete and verified.

Flushing And Interim Controls

Flushing has a role but is not a substitute for disinfection where counts are high. Use flushing to maintain turnover in parts of the system that remain in use during the incident, and to clear standing water from dead legs identified during isolation. Record flushing times, durations and temperatures in the same incident log.

What Not To Do

Avoid piecemeal disinfection of only the outlet that produced the positive sample. Legionella colonisation is usually systemic, and treating only one shower or tap leaves the reservoir intact. Avoid domestic-grade products, bleach poured into tanks without calculation, or contractors who cannot produce method statements, COSHH assessments and competency evidence. The disinfection you do in the first 24 hours is the one the regulator will examine most closely.

Communicating With Occupants, Staff and Vulnerable Users

Communication during a legionella incident is a balance between transparency, accuracy and avoiding unnecessary alarm. Getting this wrong damages trust even when the technical response is sound. Getting it right reassures occupants and gives the regulator confidence in your management.

Identify who needs to know and in what order. A typical priority list includes senior management, staff working with or near the affected system, occupants who may have been exposed, vulnerable users such as elderly residents, immunocompromised patients or people with underlying respiratory conditions, visitors and contractors, and finally clients, tenants or commercial counterparties where relevant.

Each communication should cover the essentials without speculating:

• what has been found or suspected, in plain language
  
• which parts of the building or which services are affected
  
• what action you have taken, including isolation and disinfection
  
• what the person receiving the message should do, such as avoiding certain outlets or watching for symptoms
  
• who to contact for questions and where to get medical advice if they feel unwell
  

Brief staff before they start their next shift. Contractors arriving on site need specific instructions, particularly where hot work, confined spaces or water system access is involved. Vulnerable users need clear, sensitively delivered information, and in care and healthcare settings this should be coordinated with clinical leads.

For Legionnaires’ disease specifically, the practical message is that people with symptoms resembling pneumonia, particularly fever, cough, muscle aches and shortness of breath, should seek medical advice and mention the possible exposure. You can signpost occupants to background information on Legionnaires’ disease and Legionella bacteria for context, but do not attempt to provide clinical guidance yourself.

Keep communications factual, dated and issued through one coordinator. Avoid parallel messaging from different managers saying slightly different things. If the press become involved, brief one spokesperson and stick to facts the dutyholder is willing to see in print.

Evidence, Record Keeping and the Written Scheme of Control

Documentation is not paperwork for its own sake. In a live incident, your records are the evidence that dutyholder responsibilities for legionella have been discharged competently. If an investigation follows, they are the difference between a manageable inquiry and a prosecution.

At a minimum, the incident file should contain:

• the trigger event, time, source and the person who received it
  
• the current legionella risk assessment and written scheme of control, with any revisions issued during the incident
  
• system schematics showing what was isolated, where, when and by whom
  
• sampling records, laboratory reports and chain-of-custody documentation
  
• disinfection method statements, COSHH assessments, concentration and contact time records, and post-disinfection sampling results
  
• all correspondence and file notes of calls with HSE, UKHSA, local authority and other regulators
  
• communications issued to occupants, staff and contractors, with versions and dates
  
• contractor competency evidence, including training certificates and insurance
  
• decisions made and the reasoning behind them, particularly where a risk-based judgement was exercised
  

The written scheme of control is central. ACOP L8 compliance rests on having an up-to-date scheme that identifies the system, its risks, the controls in place, who is responsible, and how performance is monitored. During and immediately after an incident, review the scheme in light of what the event revealed. If the incident exposed a dead leg, an unmonitored outlet, a calorifier running below control temperature or a failing TMV regime, that finding must feed back into the scheme and the risk assessment. Showing the regulator a scheme that has been updated as a result of the incident is a strong indicator of competent legionella risk management.

Retain records for at least five years, and longer where clinical cases are involved or where sector-specific rules apply. A well-organised incident file, supported by a compliance logbook such as our legionella compliance book, significantly reduces the pressure on dutyholders during regulatory follow-up.

Where Dutyholders Most Often Get Legionella Outbreak Response Wrong

Patterns repeat across incidents. Knowing where others have failed is one of the most practical ways to strengthen your own response.

The most common failure is delay. A lab result arrives on a Friday afternoon, sits in an inbox over the weekend, and the response starts on Monday morning. By then, two days of exposure have passed. Build escalation routes that work outside office hours, including a named on-call decision-maker and a water hygiene contractor with 24-hour callout.

The second failure is partial action. Disinfecting one outlet, ignoring the dead leg, restarting a cooling tower before the second disinfection, or skipping post-disinfection sampling all leave the hazard in place. Treat the water system as a whole, not as a collection of outlets.

The third is poor documentation. Actions happen, but nobody writes them down at the time. When the HSE inspector asks for a timeline, the account is reconstructed from memory and email fragments. Start a single, shared incident log from hour one.

Other recurring issues include:

• using contractors without verified competency or insurance
  
• relying on a risk assessment that is more than two years old or does not reflect changes to the building
  
• treating temperature monitoring as the only control and ignoring flushing, tank cleaning and outlet management
  
• communicating inconsistently with occupants, so the message changes between shifts
  
• failing to close the loop after disinfection, with no post-disinfection sampling, no scheme update and no lessons-learned review
  
• assuming the incident is over once counts return to acceptable levels, rather than monitoring more intensively for several months
  

A good response is not heroic. It is ordinary, well-rehearsed activity carried out promptly and recorded properly. The dutyholders who handle incidents well are the ones who prepared before the incident, not the ones who improvised during it. Reviewing published legionella case studies is a useful way to see where similar organisations have succeeded or struggled.

When to Bring in Specialist Remediation Support

Some incidents can be managed with existing in-house resources and a competent water hygiene contractor. Others need specialist remediation support from the first hour. Knowing which situation you are in is part of a competent response.

Bring in specialist legionella remediation support when any of the following apply:

• a clinical case of Legionnaires’ disease has been linked or potentially linked to your premises
  
• counts are above 1,000 cfu/litre in water systems or any detectable level in a cooling tower where control has previously been poor
  
• multiple systems are implicated, or the extent of colonisation is unclear
  
• the building serves high-risk occupants such as hospital patients, care home residents or immunocompromised tenants
  
• HSE, UKHSA or local authority officers have formally engaged with the incident
  
• your existing contractor does not have documented competency for outbreak-level disinfection
  
• the written scheme of control, risk assessment or monitoring records are out of date or incomplete
  
• you need independent verification of the response for insurers, clients or regulators
  

A specialist remediation provider brings three things that matter in the first 24 hours: technical capability to design and execute a full water system disinfection safely, familiarity with regulator expectations and the evidence they want to see, and the capacity to attend site quickly with the right equipment and competent people. They should also be able to support the longer tail of the incident, including enhanced monitoring, scheme revision, training for site staff and follow-up risk assessment.

Choose on competency, not price. Ask for recent similar incident experience, method statements, accreditations such as those listed in our accreditations, and references from dutyholders who have been through a comparable event. The cost of getting remediation wrong is always higher than the cost of getting it right.

If you are dealing with a positive result, a clinical case linked to your premises, or a regulator enquiry, Acorn Safety Services (Legionella) supports dutyholders, landlords, facilities managers and managing agents with rapid response risk assessment, system isolation advice, disinfection and remediation, regulator liaison and written scheme of control revision. Contact us today for a free, no-obligation quote.