A building does not have to be busy to be dangerous. It has to be warm and still. Downtime is exactly when both conditions arrive together: the long bank-holiday weekend, the school summer break, a floor closed for refurbishment, a wing left half-occupied because most of the team now works from home. That is the moment temperature control quietly stops doing its job.

The plant usually keeps running. The calorifier still heats, the pumps still circulate if nobody has touched them. What changes is demand. With almost no water being drawn, hot legs cool between the boiler and the tap, cold water creeps up toward room temperature in pipes and roof tanks, and the unused stretches in between sit undisturbed at the lukewarm temperatures Legionella likes best. A system that read perfectly the Friday before a shutdown can be well out of control by the time someone turns the lights back on.

The trap is that none of this announces itself. The danger only shows up when you go looking, and by then the building is reopening.

Why an empty building drifts

Temperature is the control most sites lean on hardest, and the benchmarks are well established. HSE’s hot and cold water guidance describes keeping cold water below 20°C where practical, storing hot water at 60°C or above, and distributing it so outlets reach 50°C within a minute of running (55°C in healthcare premises) [1]. Those numbers assume one thing that downtime removes: water moving through the system often enough to carry the right temperature to the point of use.

Take that movement away and each part fails differently. Cold mains that stay cool only because they are constantly refreshed begin to equalise with the warm fabric around them, especially tanks and pipework in roof voids that bake through a summer closure. Hot water that is heated but never drawn loses temperature in the dead lengths to far outlets. Thermostatic mixing valves, fitted to prevent scalding, hold a reservoir of pre-blended tepid water at every unused basin and shower. Multiply that across a closed floor and you have dozens of small warm pockets, all incubating quietly.

Then there is the self-inflicted version. Closures are a natural moment to cut energy use, and a well-meaning instruction to “turn things down while we’re shut” can drop hot storage below the value the control scheme relies on, or switch off a secondary circulation pump so the loop stops returning hot water at all. Energy saving is legitimate, but lowering storage or circulation temperatures is a change to the water system, and that means the risk assessment should be consulted before, not after [2]. If your setback is driven by a building management system, make sure water-safety setpoints are protected from the energy schedule rather than overridden by it. (Using BMS for automated temperature control covers how to wire that distinction into automated control.)

A closure that read fine on paper

The following is an illustrative, composite scenario, not a real named incident, but every element of it is ordinary.

Picture a four-storey office let to a single tenant. Hybrid working had emptied the top two floors to a handful of desks, so those outlets already saw little use. Over the fortnight between Christmas and the new year the building closed entirely. To trim the gas bill, the energy contractor dropped the hot water storage setpoint and put the heating into deep setback for the holiday. Sensible, on the face of it.

Nobody owned the water system during the gap. The closure checklist covered alarms, the fridge in the staff kitchen and the post, but not flushing. The roof-tank cold feed sat undisturbed in a warm plant area for two weeks. The lowered storage temperature meant the hot outlets that did get a token run never quite reached their usual distribution temperature.

On the first morning back, a contractor took routine sentinel readings and found the picture you would expect: a cold sentinel above 20°C, hot sentinels slow to climb, and a fortnight with no flush records on the two low-use floors. No single fault was dramatic. The cold tank was a bit warm, the storage setpoint a bit low, the flushing simply absent. Stacked together over a closure, those small drifts had moved the whole system out of the controlled band — and staff were already filling kettles while the readings were being taken.

The decisions that actually mattered were made before the building ever closed: nobody had been named to keep the water system safe through the shutdown, and an energy change had been applied to the plant without anyone checking it against the written scheme. The thermometer on day one only confirmed a gap that had been designed in two weeks earlier.

Lessons to take into your own closures

The fix is not a sterner reminder. It is treating downtime as a planned state of the building with its own tasks and its own owner, the way you would treat any other operating mode.

Before the building empties, name who holds the water system through the closure, even if the answer is a contractor with an agreed scope. Settle the energy question deliberately: decide what, if anything, can be turned down, and confirm it does not breach the control values in your scheme. Identify the outlets and areas that will go from low-use to no-use, because those are where stagnation will concentrate.

During the downtime, keep water moving on the outlets that matter. Flushing little-used fittings is a standard control, but how often and which ones is a judgement your risk assessment makes for your building, not a fixed national number [2]. A long closure may justify a defined flushing rota; a four-day weekend may not need one at all. Write down the reasoning either way.

Before anyone returns, run a restart check rather than waiting for routine monitoring to catch up. Confirm hot storage and circulation are back to their normal setpoints, take sentinel temperatures across hot and cold, and flush through the parts that sat idle so the first water a returning occupant draws is not the water that has been standing all closure. For an extended or unusual shutdown your assessment may call for more than flushing before reoccupation — disinfection, or sampling to verify conditions before handover. Sampling supports that decision; it does not replace control, and the method and timing are choices in their own right (Culture vs rapid test kits: different Legionella testing methods compares the testing options).

The habit that ties it together is recording the decision, not just the task. “Storage left at normal setpoint over the closure; floors 3 and 4 flushed weekly by the FM contractor; full sentinel set and flush-through completed the morning before reopening” is evidence you held control through the gap. A blank fortnight in the logbook is the opposite, and it is exactly the gap an investigation would find first.

Where this guidance stops

Treat the temperatures and intervals here as the common UK starting points, not as rules for your site. How far you can safely set back the plant during a closure, which outlets need flushing and how often, and whether reopening warrants disinfection or sampling are all decisions for your written scheme and a competent assessor who knows the system. Downtime changes the risk picture; it does not suspend the duty holder’s responsibility to manage it [3]. This piece is general guidance, not legal or design advice.

FAQ

Can we lower the hot water temperature to save energy while the building is closed?

You can review the energy use, but lowering hot storage or switching off circulation changes the system the control scheme depends on. Storing below around 60°C or letting the loop stop returning hot water can move the system into the growth range [1]. Decide any setback in advance, against the risk assessment, and protect the water-safety setpoints from the energy schedule rather than treating them as negotiable.

How long can a building sit unused before flushing isn’t enough on its own?

There is no single national figure; it depends on the system, the water temperatures reached and what your assessment requires [2]. As a general expectation, short closures are usually managed by maintaining temperatures and flushing key outlets, while longer or repeated shutdowns can justify a defined rota during the gap and a restart regime, up to disinfection or sampling, before reoccupation. Your written scheme should state the threshold for your building.

Who is responsible for water hygiene while the premises are empty?

The duty holder, the same as when it is occupied. An empty building does not pause the duty; if anything it raises the risk, because the controls that rely on normal water use stop working [3]. Outsourcing the closure tasks to a contractor is fine, but the accountability and the records stay with the responsible person.

Sources

[1] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm