Last reviewed 15 January 2020

Mike Sopp reminds duty holders of the importance of reviewing their current legionella management arrangements so as to ensure they are complying with their legal duties, in the light of revised guidance.

In late summer 2019, the Health and Safety Executive (HSE) published RR1118 Legionella Control in Evaporative Cooling Systems: Underlying Causes of Breaches in Health and Safety Compliance. Research found the underlying causes of breaches of health and safety compliance were lack of training, failure to maintain the cleanliness of cooling towers and the water within them, absence of, or inadequate, risk assessments, and absence of, or insufficiently detailed, written control schemes.

Although focused on cooling towers, the findings may also be applicable to other areas and can create the conditions for outbreaks to occur. As HSE guidance notes, “inadequate management, lack of training and poor communication are all contributory factors in outbreaks of legionnaire’ disease”.

Impacts of poor management

To comply with its legal obligations, the duty holder (ie the employer or those with responsibilities for the control of premises) should:

  • identify and assess sources of risk from the legionella bacteria

  • if appropriate, prepare a written scheme for preventing or controlling risks

  • implement, manage and monitor precautions

  • keep records of the precautions

  • appoint a competent person to assist in taking measures to ensure compliance.

However, it has been recognised that poor management practices can increase risks of outbreaks of legionnaires’ disease. High-profile cases have occurred over the years where poor management has been cited as a contributory factor in outbreaks.

In a recent case, G4S Cash Solutions was fined £1.8 million after failing to reduce the risk of legionnaires’ disease from its water systems. Although environmental health officers from the local authority were unable to prove that a worker had contracted legionnaires’ disease from the site in question, they did uncover a lack of compliance in maintaining water systems at the workplace.

Commenting on the prosecution, the local authority stated that “staff had received inadequate training and there were no up-to-date policies or suitable and sufficient risk assessments in place to safely operate or manage the building’s water systems” and that G4S did not take steps required to reduce the risk of legionnaires’ disease from its water systems “despite a long-standing duty, extensive guidance, advice from its own consultants and advice from Harlow Council.”

In another case, private healthcare group Bupa’s residential care arm was fined £3 million after an elderly man died of legionnaires’ disease at one of its nursing homes. The investigation found that Bupa Care Homes had failed to implement measures to control and monitor the hot and cold water systems at the nursing home during refurbishment works. In addition, it had failed to properly train staff responsible for overseeing legionella controls and measuring the temperature of the water.

Appointed competent person

Health and Safety Executive guidance in the form of L8 has given Approved Code of Practice (ACOP) status to “the specific role of the appointed competent person, known as the ‘responsible person’”.

ACOP status describes preferred or recommended methods that can be used to meet legislative compliance and, by following the advice, the duty holder “will be doing enough to comply with the law in respect of those specific matters on which the Code gives advice”.

If prosecution was to occur and it is proved that the duty holder did not follow the relevant provisions of the Code, it will need to show that it complied with the law in some other way, or a court will find the duty holder at fault. Previous guidance in the older L8 recommended the appointment of a responsible person to take day-to-day responsibility for controlling risks associated with legionella bacteria.

However, Paragraph 48 to the revised ACOP states that, where the assessment shows that there is a reasonably foreseeable risk associated with legionella bacteria, the duty holder should appoint “a competent person or persons to help undertake the measures needed to comply with the requirements in COSHH”.

The accompanying guidance then details that this appointment is known as the “responsible person” and that the appointee should “take day-to-day responsibility for controlling any identified risk from legionella bacteria” and should have “sufficient authority, competence and knowledge of the installation” to ensure operational procedures are undertaken.

In addition, guidance notes that the responsible person must be properly trained to a level that ensures tasks are carried out in a safe, technically competent manner. He or she should also have a clear understanding of the role, and the overall health and safety management structure and policy in the organisation.

The ACOP states that where the duty holder does not employ anyone with the necessary competence, it may need to appoint people from outside the organisation. In such circumstances, the duty holder should take all reasonable steps to ensure the competence of those carrying out work who are not under its direct control, and that responsibilities and lines of communication are properly established and clearly laid down.

Management and competency

Competence is a key component for the successful application of the management system adopted to control the risks from legionella. The ACOP states that the duty holder “must ensure that the person who carries out the risk assessment and provides advice on prevention and control of exposure must be competent to do so”.

It is recognised that competent advice may come from a third party and, as such, the duty holder should make “reasonable enquiries” on the competency of such third parties. In particular, they should know:

  • potential sources of legionella bacteria and the risks they present

  • measures and precautions to adopt to eliminate or reduce risks

  • measures to take to ensure controls remain effective.

Confidence that the potential service provider has the necessary technical competence to undertake the legionella risk assessment is obviously essential (eg through UKAS accreditation). However, organisations should also satisfy themselves that the potential service provider:

  • has adequate resources to undertake the assessment

  • works to relevant codes of conduct and standards for impartiality and integrity

  • has robust quality control systems in place

  • has appropriate safeguards such as liability insurance.

In terms of the application of any written scheme involving treatment, monitoring and cleaning of water systems, it is recognised in L8 that this may involve various stakeholders.

Again, where external contractors are involved, the duty holder is expected to make reasonable enquiries as to competency of third parties. Poor management of contractors and contract documentation has been identified as a failure of management control.

The employment of contractors or consultants does not absolve the duty holder of responsibility for ensuring that control procedures are carried out to the standard required to prevent the proliferation of legionella bacteria.

The use of the Legionella Control Association Code of Conduct will assist the duty holder in ensuring the service being provided is meeting best practice requirements.

Responsibilities and lines of communication need to be properly established and clearly laid down, as it has been found that many water treatment companies are only given a limited remit. This has resulted in some important areas of control not being implemented. It is also recommended that lines of communication are regularly audited.

The client (duty holder) needs to clearly identify all aspects of the work that it wishes the contractor to do. It is advisable that service level agreements are developed in accordance with the “Code of Conduct” from the Legionella Control Association.

Management of legionella risks does not end with the completion of a risk assessment or the development and application of a written scheme of control. The ACOP also requires the condition and performance of the water system to be monitored.

The ACOP states that this can be overseen and managed by the appointed responsible person or a third party. It states that the management system should involve:

  • checking the performance and operation of the system and components

  • inspecting the accessible parts for damage and signs of contamination

  • monitoring to ensure the treatment regime continues to control risks to the required standards.

The keeping of appropriate records is also an important element of the management system. The ACOP provides a useful list of records to be kept and states that these records should be retained throughout the period for which they are valid “and for at least two years afterwards”, with records of monitoring, inspection, tests or checks being kept for at least five years.

Further information

Legionnaires’ Disease — The Control of Legionella Bacteria in Water Systems (L8) (HSE)

Legionella Control Association: Conduct for Service Providers