The worst time to meet your local health protection team is the day they ring about a confirmed case. By then the clock runs in hours, not weeks, and the only thing that shapes the conversation is whether your evidence already exists. Good collaboration with public health authorities is built long before any of that.

Most water safety leads picture the other side of that call as one faceless “authority”. It is not. It is a small network of people with different jobs and very different powers, and knowing who does what is half the work.

You are a witness, not the lead investigator

When a case of Legionnaires’ disease is diagnosed, the source investigation is run by public health, not by you. UK Health Security Agency health protection teams take the patient’s exposure history, look for links to premises, water systems and travel, and decide whether a cluster justifies convening an outbreak control team [1]. Your building may be one of several lines of enquiry. The duty holder’s role is to supply evidence, give access, and act on any precautionary measures the team asks for [2].

That distinction matters because the instinctive corporate response is the wrong one. Routing everything through legal, slow-walking records, treating the call as an accusation to be managed — all of it reads as obstruction and burns the goodwill you need. The pragmatic call is the opposite: fast, transparent, one named point of contact. If your system genuinely was not the source, the quickest way to show it is complete records handed over without friction.

Who actually picks up the phone

The clinician or hospital that diagnoses the case notifies it onward; legionellosis is a notifiable disease, so the report reaches UKHSA whether or not you ever hear about it. From there, three groups may end up in contact with you.

The health protection team is the hub. They hold the epidemiology — what the patient did, where they were, who else has fallen ill — and they drive the timeline. The enforcing authority is separate: for some premises that is the Health and Safety Executive, for many lower-risk workplaces such as offices, shops and hospitality it is the local authority’s environmental health team. Which body governs your site is worth knowing on a calm Tuesday, not discovering mid-incident. And in the background sits the laboratory, which can compare the strain isolated from the patient with any environmental isolates from your system to test whether they actually match [1]. A clean-looking logbook does not survive that comparison if the typing puts your water at the scene.

The investigation map, drawn before you need it

Spend ten minutes sketching the people, not the pipework, on a single sheet. Put your building and its evidence pack in the middle. Around it, draw five nodes and the arrows between them.

  • Top left, the diagnosing clinician or hospital. Arrow out to UKHSA: the case is reported the moment it is confirmed. You are not on this arrow, which is why the first you may hear of a case is the call itself.
  • Top centre, the UKHSA health protection team. This is the hub. Draw an arrow from it to you, labelled “records and access requested”, and a return arrow labelled “evidence supplied”.
  • Top right, the enforcing authority — local authority environmental health officer or HSE depending on your premises. Arrow to you labelled “powers to require information and inspect”; this node can act formally where the health protection team only requests.
  • Bottom, the reference laboratory. Arrows in from both the clinician (clinical isolate) and your contractor (environmental samples), meeting at a box labelled “do they match?”.
  • Centre, your evidence pack. Risk assessment, written scheme, temperature and monitoring logs, sampling history, asset register and schematic, recent remedial work, retained samples, and the names of the responsible person and contractor.

A blank or weak node is where the incident will hurt. If you cannot draw the arrow from “enforcing authority” because you do not know who yours is, fix that this week. If the centre box is a shoebox of paper rather than something you could email within the hour, that is the gap an investigation exposes. scientific anatomy of an outbreak shows how those laboratory arrows actually pin a source to a building.

What they will ask for in the first hour

The opening request is almost always documentary, and it is predictable. Have the current risk assessment, the written control scheme, recent temperature and monitoring data, your sampling history, and a schematic or asset register ready to hand as a single package. The failure mode is rarely that the records do not exist — it is that they are scattered across a contractor’s portal, a shared drive and a wall-mounted logbook, and nobody can assemble them quickly while a health protection team waits.

Sampling often follows. Be ready for a request to sample specific outlets, and resist the urge to flush or disinfect first to “tidy up” — that can destroy the very evidence the laboratory needs to confirm or clear your system. What sampling happens, where, and how often is driven by the investigation and your risk assessment rather than a fixed schedule [3]. Retaining isolates so the reference laboratory can attempt a match is part of cooperating, not an admission of anything.

The duties you action before anyone calls

Three things turn a cold-start scramble into a managed response.

First, know your statutory touchpoints. If you operate a wet cooling tower or evaporative condenser, it is notifiable to the local authority — a register that exists precisely so public health can find these systems fast when cases appear nearby [4]. Legionellosis caught through work can also be reportable under RIDDOR, which can put your organisation in front of the enforcing authority before any other contact [5]. Treat both as known obligations, confirmed against current guidance, not surprises.

Second, build the relationship in peacetime. A water safety group with clear ownership, a named single point of contact, and a water safety plan gives the investigators someone to talk to and a structure they recognise [6]. The first conversation goes very differently when you can say “here is our responsible person, here is our plan” rather than “let me find out who handles this”.

Third, keep your decisions on paper, not just your tasks. Recording why an outlet is flushed weekly, what result is acceptable, and what happens when it drifts turns a logbook into something that demonstrates active control. Anticipating where the duties themselves may shift is worth a look too — see on staying ahead of regulatory change.

When to bring in your own specialists

There is a genuine trade-off here. Your existing water treatment contractor knows the system, but their own work may be part of what the investigation scrutinises — an awkward position from which to advise you objectively. For a serious incident, independent technical support, someone whose only client is you, helps you understand findings and challenge a conclusion you think is wrong without obstructing the public health effort. Constructive challenge is allowed; stonewalling is not.

A note on limits

This is general guidance, not the instructions you will get on the day. An investigating health protection team has information about the case that you do not, and their direction takes precedence over any routine you had planned. It is also not legal advice on cooperation duties, RIDDOR reportability or notification thresholds — confirm those against the current regulations and, where a case is live, take them from the people running the investigation. The sampling, control actions and timescales that follow depend on your specific system and what the investigation finds.

Common questions

Does a single confirmed case linked to our building trigger all this, or only an outbreak?

A single confirmed case can be enough for public health to investigate potential sources; you do not wait for a cluster to form before the questions start [1]. An outbreak control team is convened when cases link together, but a records request to one implicated building can come off a single case.

Do we have to let an environmental health officer in and hand over our records?

In practice, yes, and quickly. The enforcing authority has powers to require information and inspect, and duty holders are expected to cooperate with a Legionella investigation [2]. Beyond the legal duty, fast and complete disclosure is simply your strongest position — incomplete or delayed records read far worse than whatever the records actually say.

We run a cooling tower. Is there something we must do before any incident?

Yes. Wet cooling towers and evaporative condensers are notifiable to the local authority, so the system is on record before any case appears in the area [4]. Check that your notification is current and that the details match the plant you actually operate; an out-of-date entry is the kind of thing an investigation notices.

Sources

[1] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks [2] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] HSE, “Other duties: RIDDOR and notification of cooling towers or evaporative condensers”. https://www.hse.gov.uk/legionnaires/what-you-must-do/duties.htm [5] HSE, “RIDDOR - Reporting of Injuries, Diseases and Dangerous Occurrences Regulations”. https://www.hse.gov.uk/riddor/ [6] BSI, “BS 8680:2020 - Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice