A fine for Legionella failures almost never starts with the moment someone fell ill. It starts months or years earlier, with a recorded warning nobody chased: a calorifier running cool, a redundant shower left live, a risk assessment that quietly went out of date. By the time a case reaches court, the argument is no longer about whether the bacteria were present. It is about why the duty holder had the evidence in front of them and let it sit.
That is the useful way to read any enforcement story. Not as a horror exhibit, but as a reverse-engineered list of the moments where control slipped and someone could have stepped in.
A composite case, and where it could have been stopped
The scenario below is illustrative. It is a composite built from the kinds of failures HSE guidance exists to prevent, not a report of a real named prosecution. The point is the shape of the failure, which is depressingly consistent from case to case.
A mid-sized employer occupies a 1980s office-and-light-industrial site: stored cold water in a roof tank, a calorifier feeding welfare showers and a kitchen, long pipe runs to a wing left half-empty after a restructure. A contractor carries out a risk assessment and flags three things — the cold tank sits in a warm plant room, two showers in the quiet wing are barely used, and the calorifier’s flow temperature looks low. The actions are written down.
Then nothing closes them. The facilities manager who commissioned the assessment moves on. Monthly temperature monitoring continues, but as a tick-box: readings drift low, get logged, and nobody escalates. The maintenance contract is re-tendered to the cheapest bidder, who is never asked the right competence questions. A sample comes back positive; a retest a fortnight later is clean, and the file is closed on the strength of the second result. Eighteen months later a worker in the quiet wing is diagnosed with Legionnaires’ disease.
Now the records work against the company instead of for it. The investigation pulls the assessment, the monitoring log, the contractor handover, the positive sample and the way it was closed out. Every drift is documented in the company’s own hand. That is what turns an outbreak into a prosecution: not the presence of Legionella, which is common, but a paper trail showing the risk was known, recorded, and left to run.
Read it backwards and the off-ramps are obvious. Closing the three original actions. Setting an escalation rule so an out-of-range reading triggered a response rather than just an entry. Asking the incoming contractor to demonstrate competence. Treating the positive sample as a reason to investigate the system, not a number to be cancelled out by a cleaner retest.
What enforcement actually turns on
When a Legionella legal case reaches court, the framework is the ordinary duty to assess and control foreseeable risk under health and safety law. HSE’s position is that water systems must be assessed, controlled, monitored and reviewed before anyone is harmed [1]. The Approved Code of Practice, L8, carries particular weight: it sets out what good control looks like, and a duty holder who departed from it is expected to show they reached the same standard by another route [2]. HSG274 fills in the technical detail, including the principle that monitoring frequency follows the risk assessment rather than habit or budget [3].
Three things tend to decide how badly a case goes.
Foreseeability. Was the risk knowable? A documented assessment that named the hazard removes any “we had no idea” defence — it proves the opposite.
Accountability. Who owned the controls? Outsourcing the tasks does not outsource the duty. If no named, competent person was steering the scheme, that absence is itself a failing.
Evidence of action. Records that show drift was spotted and acted on protect a company. Records that show drift was spotted and ignored convict it. The same logbook does either job, depending on what it documents.
Where a case is linked to actual illness, the clinical and environmental sides are pulled together by UKHSA, whose investigation process connects diagnosed cases back to a probable source [4]. That linkage is often what tips a quiet compliance gap into a formal enforcement matter.
The lesson worth keeping
The companies that get fined are rarely the ones that knew nothing. They are usually the ones that knew, wrote it down, and let the action rot. Generating evidence of a problem with no mechanism to resolve it is worse than useless — it manufactures the exhibit later used against you.
So the single highest-value habit is to record the decision, not just the reading. “Calorifier flow below target on three consecutive checks; escalated to the responsible person; contractor attending Thursday; recheck booked” is a sentence that defends you. A bare number in a column, repeated and untouched, is the sentence that does not.
If you want one concrete move this week, pull the last twelve months of monitoring records and find every reading that fell outside its acceptable range. For each one, see whether you can point to what happened next. Where you cannot, you have just found the gap an investigator would find first — and you have found it while you can still close it for nothing. For the formal warning stage that usually comes before a fine, see HSE improvement notices for Legionella explained.
A word on using this safely
This is general guidance, not legal advice on any specific situation, and the case above is a composite written to illustrate a pattern rather than a real prosecution. Whether a given failing leads to enforcement depends on the system, the people exposed, the harm caused and how the duty holder behaved — all judged through a competent, site-specific assessment. If you are already facing an HSE inspection or a notice, take advice from a competent professional on your actual circumstances rather than acting on a worked example.
FAQ
If we use a contractor, can they be prosecuted instead of us?
Possibly as well, but rarely instead. The duty to control the risk sits with the employer or person in control of the premises, and bringing in a contractor does not transfer it [1]. A contractor who did substandard work can face action too, but that does not move accountability off the duty holder. Choosing a competent provider — for example one signed up to a recognised code of conduct — is part of discharging your duty, not a substitute for owning it [5].
We had a positive sample and then a clean retest. Are we in the clear?
Not on that alone. One clean retest describes a single outlet at a single moment; it does not explain why the first result was positive or confirm the underlying conditions changed. Treating a positive as a prompt to investigate temperature, stagnation and cleanliness is defensible. Treating it as a number to be cancelled by a later sample is exactly the pattern that reads badly after an incident [3].
Do we have to report a case of Legionnaires’ disease linked to our site?
There can be a duty to report certain work-related cases under RIDDOR, and public health bodies will investigate a suspected source regardless of whether you report [6][4]. Do not wait to be contacted: if you suspect a link to your system, take advice and cooperate early, because how a duty holder responds after the event also features in how enforcement is weighed.
Sources
[1] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks [5] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/ [6] HSE, “RIDDOR - Reporting of Injuries, Diseases and Dangerous Occurrences Regulations”. https://www.hse.gov.uk/riddor/