When a Legionella prosecution reaches a UK court, the thing under examination is rarely the bacteria. It is the paperwork. An inspector opens the risk assessment, the written scheme and the logbook, then asks one blunt question: can you show you were managing this risk on the days that mattered? If the honest answer is no, the readings you did take stop proving control and start dating the lapse.

Here is the part most guidance steps around. You do not have to cause an outbreak to be prosecuted. The duty is to manage a foreseeable risk, and that duty can be breached in a building that never made a single person ill. The scenario below is a composite — assembled from patterns that recur in HSE enforcement, not a real named case — but every gap in it is one inspectors find for real.

How a prosecution usually begins

It rarely starts with an inspector. It starts with a patient. A clinician diagnoses Legionnaires’ disease, and UK Health Security Agency investigators begin tracing where that person could have inhaled contaminated aerosol — home, workplace, recent travel, a healthcare visit [3]. When the trail points at a particular building, the local authority or HSE gets involved, and the conversation shifts from public health to enforcement.

Some Legionella cases are reportable under RIDDOR, and certain systems carry standing duties of their own; a cooling tower, for example, must be notified to the local authority [4]. By the time an inspector arrives, they are not hunting for the source. They want the evidence that the risk was being controlled. The first request is almost always the same three things: the risk assessment, the written control scheme, and the monitoring records.

A composite case: the care home that “had a system”

Picture a 60-bed care home. On paper it did the right things. There was a Legionella risk assessment in a folder, a written scheme pinned up in the plant room, and a maintenance log with months of tidy temperature readings. Managers genuinely believed they were covered.

Then a resident was diagnosed with Legionnaires’ disease, and investigators came to look.

The risk assessment was three years old. A new wing had been added eighteen months earlier, and the assessment had never been revisited to include it. The written scheme named a responsible person who had left the company. The temperature log was neat — until six months back, when the entries simply stopped, around the time the maintenance contractor changed. Two ground-floor rooms had stood empty for most of the year, and their showers appeared in no flushing record at all. The thermostatic mixing valves had a service schedule on paper and no service history to match it.

No single failure was dramatic. Stacked together, they told one clear story: a control scheme that had quietly gone dormant while everyone assumed it was still running.

Where the case was actually lost

Notice what did not decide it. Nobody had to prove the resident’s infection came from a specific shower in that home — source attribution is often impossible, and the prosecution did not depend on it. The breach was the failure to manage a known, foreseeable risk to a vulnerable group. The duty holder could not show the scheme had been kept live, reviewed after a material change, or reassigned when the responsible person walked out the door.

That is the pattern worth fixing in your head. Enforcement reads your management system, not your microbiology. The records are not box-ticking. Under scrutiny they are the entire difference between “we controlled this risk” and “we lost track of it”.

Why L8 is read so closely

The Approved Code of Practice, L8, sits at the centre of all this. It is not ordinary guidance. An ACoP has a special legal standing, and a duty holder who has not followed it can be put in the position of having to demonstrate they achieved equivalent control some other way [1]. L8 sets out the management chain a court looks for: a suitable risk assessment, a written scheme of control, a competent responsible person, implementation, monitoring, record keeping and review [1]. HSE frames the core duties in the same shape — identify and assess the risk, put controls in place, keep records, and discharge any other relevant duties [2].

Read that list again the way an inspector would. Each item is something you either evidence or you don’t.

What to take back to your own site

You cannot rewrite the past, but you can make sure your own folder would survive being read aloud. A few honest tests:

  • Does the risk assessment reflect the building as it stands today, including every change since it was written? An extension, a re-plumbed kitchen, a decommissioned wing — each one is a review trigger, not an optional update.
  • Is the responsible person a current, named, contactable individual who could explain the scheme without reaching for the folder?
  • Do the records show decisions, not just tasks? Why an outlet is flushed weekly, what result is acceptable, and what happens when it isn’t.
  • Where readings or services stopped, is there a recorded reason and a recovery — rather than an unexplained silence that an inspector can date to the week?

The strongest position is not a flawless history. It is a demonstrably live system: one that notices its own gaps, escalates them, and writes down the fix. If you want to rehearse how that evidence gets examined, HSE audits and inspections: what to expect for Legionella covers what an HSE inspection actually asks for, and Scientific analysis of a Legionella outbreak shows how investigators reconstruct an outbreak after the fact.

So do one thing this week: open the logbook, find the most recent gap, and write down why it happened and what you changed. That single entry is what a live control scheme looks like on paper.

One caution before you use any of this. The scenario is a teaching composite, not legal commentary. Whether a case is reportable, how enforcement decisions get made, and what a court concludes all turn on the specific facts and on advice from people qualified to give it. Treat the story as a way to pressure-test your own evidence, not as a forecast of any outcome.

FAQ

Can you be prosecuted for Legionella if no one was made ill?

Yes. The duty is to manage a foreseeable risk, not merely to avoid harm. An inspection prompted by something else entirely can still find an uncontrolled system, and the fact that no one has been hurt yet is not a defence to the absence of control.

Does outsourcing the work to a contractor remove the risk of prosecution?

No. A competent contractor can carry out the tasks, but accountability stays with the duty holder. You are expected to appoint competently, brief clearly, check the work, and keep the records that prove you did [2].

What does HSE ask for first after a Legionella case?

Usually the risk assessment, the written control scheme and the monitoring records, together with evidence of review. A clean water sample does not close the question on its own — testing supports verification, but its frequency follows the system and the risk assessment, and it never replaces day-to-day control [5].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease — what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [3] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks [4] HSE, “Other duties: RIDDOR and notification of cooling towers or evaporative condensers”. https://www.hse.gov.uk/legionnaires/what-you-must-do/duties.htm [5] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm