Most duty holders quietly assume that if their building made someone seriously ill. They would hear about it quickly. They wouldn’t. By the time a case is linked to a water system, the exposure is usually weeks old, the patient is a stranger to the building’s owner, and the link was spotted in a laboratory, not on site.
That gap, between when harm happens and when anyone connects it to your premises, is the single most important thing to understand about outbreaks. It reframes what your controls are actually for.
How a case becomes an outbreak on paper
Legionnaires’ disease is a pneumonia, and on its own it looks like other pneumonias. A patient feels unwell some days after breathing in contaminated aerosol; the incubation period is commonly cited as roughly two to ten days, which already separates cause from effect [1]. They see a GP or arrive at hospital. If a clinician suspects Legionella, a test, often a urinary antigen test, is ordered. A positive result is then notifiable, and the case is reported into public health surveillance [2].
Only at that point does pattern-matching begin. Public health teams hold the confirmed cases. They ask each patient where they have been, then look for overlap, the same hotel, the same town, the same hospital, the same stretch of road downwind of a cooling tower. An “outbreak” is declared when that overlap appears: two or more cases linked in time and place to a probable common source [3]. International travel clusters are found the same way, by cross-matching people who never met but stayed in the same accommodation [4].
So the building owner is almost never the detector. The detector is a clinician who thought to test, a laboratory that confirmed, and an analyst who saw two dots line up. You are downstream of all three.
An illustrative composite: the cluster nobody on site saw coming
Consider a mixed-use building, offices over a leisure suite, on a busy high street. Over a fortnight, three people fall ill: a delivery driver who passes daily, a visitor who used the spa once, and a resident from the flats opposite. None of them know each other. None complain to the building. Two are treated, recover, and are never formally linked to anything. The third is confirmed and notified, prompting a wider look that eventually flags the address.
This scenario is illustrative, not a real incident, but every mechanism in it is real. The exposure was shared; the experience was not. The people affected had no relationship with the premises and no reason to report back to it. And the cases that recovered without a confirmed Legionella diagnosis simply never entered the count. That is the texture of real surveillance, and it explains why a site can be a source and feel entirely normal from the inside.
The mistaken assumptions that leave duty holders exposed
The danger here is not malice or even neglect. It is a set of reasonable-sounding beliefs about how you would find out. Each one is wrong in a way that matters.
”We’d get a complaint or a warning first”
What it looks like: a duty holder treats the absence of complaints as evidence the water is safe.
Why it happens: in most building problems, a leak, a smell, a failure, the occupants tell you. Legionella breaks that feedback loop. The people exposed are often transient or external, fall ill days later, and present to healthcare, not to your help desk.
The fix: stop reading silence as safety. Your assurance has to come from your own monitoring and temperature records, not from the inbox staying quiet.
”If there were an outbreak. It would be obvious”
What it looks like: an expectation of a dramatic, simultaneous event.
Why it happens: the word “outbreak” suggests many people at once. In reality cases trickle in over weeks, scattered across unconnected individuals, and a substantial share of community cases are never traced to a specific source at all. Case numbers are widely regarded as an undercount of true incidence [2].
The fix: assume detection is partial and slow. Plan your controls for the cases you will never hear about, not just the cluster that might one day make the news.
”Our last clear sample proves we’re fine”
What it looks like: a single satisfactory water sample, or one risk assessment from two years ago, treated as an all-clear.
Why it happens: a clear result feels conclusive. But sampling is a snapshot of one outlet at one moment, and conditions change, a TMV fails, a wing is mothballed, a calorifier drifts, between visits [5].
The fix: lean on continuous control, temperature regime, flushing of little-used outlets, and the maintenance of records, rather than on a date-stamped certificate.
”Detection is the public health team’s job, so it’s their problem”
What it looks like: comfort that surveillance exists, so the responsibility sits elsewhere.
Why it happens: it is genuinely true that UKHSA and clinicians do the detecting. The error is concluding that this protects you. By the time they detect, the harm has already occurred and your records are about to be read backwards.
The fix: recognise that even a single confirmed case can trigger an environmental investigation of a suspected source [6]. What you can influence is everything before that, the assessment, the regime, the evidence, not the moment of detection.
”We’d have time to sort the paperwork if a case appeared”
What it looks like: an intention to tidy logbooks and assessments once there is a reason to.
Why it happens: compliance feels like something you can produce on demand. Under ACoP L8 it is not, because the duty is to have managed the risk continuously, and your contemporaneous records are the proof you did [7].
The fix: treat the logbook as the thing an investigator will read first, and keep it current now, because it cannot be created retrospectively.
The lesson underneath all of it
Detection is downstream and delayed. Your defence is upstream and continuous. Everything that protects you, and the people your aerosols can reach, exists before any case is ever linked to your building: a competent risk assessment, a controlled temperature regime, monitoring that actually happens, and records that show it [7]. You cannot improve detection. You can make detection irrelevant by removing the conditions that let the bacteria amplify in the first place.
This article is general guidance, not a diagnosis of your building or clinical advice for anyone unwell, who should speak to NHS 111 or a clinician. The conditions, controls and frequencies that apply to your site can only be set by a competent, site-specific risk assessment carried out by someone qualified to make those judgements.
FAQ
How long after exposure would a Legionnaires’ case even appear?
Symptoms commonly develop somewhere in the region of two to ten days after exposure, so a case confirmed today reflects conditions in a water system a week or more ago [1]. Confirm the current incubation range against NHS guidance, but plan on the assumption that any warning you receive is already historical.
Why might my building never be identified as a source even if it caused illness?
Because tracing depends on a clinician suspecting Legionella, ordering a confirmatory test, the case being notified, and an analyst finding a geographic or temporal overlap with other cases [3]. If a patient recovers without that specific diagnosis, or has no obvious shared location with anyone else, the link to your premises may never be drawn. Many cases go untraced.
Does one confirmed case actually lead to my site being investigated?
It can. A single confirmed case associated with a premises may be enough to prompt an environmental assessment of a suspected source, because one case can signal a wider problem [6]. Public health and the regulator will then look at your assessment, regime and records, which is why those have to be in order before a case ever arises.
If sampling can’t be relied on for early warning, what should I trust instead?
Treat sampling as confirmation of control, not a smoke alarm. Day-to-day assurance comes from your temperature monitoring, flushing of infrequently used outlets, and the upkeep of plant such as calorifiers and TMVs, all recorded as you go [5][7]. Use a provider working to a recognised service-provider code of conduct for any sampling or remedial work [8].
What to do before you start
Pull your current logbook and your latest risk assessment today and ask one question of each: if a confirmed case were linked to this building tomorrow, would these documents show continuous control, or a gap? Read the temperature records and the dates of the last assessment review first. If either is stale or patchy, that is the thing to fix now, because you will not get advance notice that the clock has started.
Sources
- NHS, “Legionnaires’ disease”. https://www.nhs.uk/conditions/legionnaires-disease/
- UK Health Security Agency, “Legionnaires’ disease: guidance, data and analysis”. https://www.gov.uk/government/collections/legionnaires-disease-guidance-data-and-analysis
- UK Health Security Agency, “Legionnaires’ disease: surveillance and outbreak management”. https://www.gov.uk/government/collections/legionnaires-disease-guidance-data-and-analysis
- European Centre for Disease Prevention and Control, “Legionnaires’ disease”. https://www.ecdc.europa.eu/en/legionnaires-disease
- HSE, HSG274 Part 2 (2024), “Operation and inspection of hot and cold water systems”, p.70. https://www.hse.gov.uk/pubns/books/hsg274.htm
- Centers for Disease Control and Prevention, “Legionella (Legionnaires’ Disease and Pontiac Fever)”. https://www.cdc.gov/legionella/
- HSE, ACoP L8 (2013), “Managing the risk: management responsibilities, training and competence”, p.14. https://www.hse.gov.uk/pubns/books/l8.htm
- Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrolassociation.co.uk/