Public health tracking: how Legionella outbreaks are investigated

When two people end up in hospital with Legionnaires’ disease and the only thing they share is a postcode, a public health team starts working backwards — from the patients, through the places they breathed, to the water systems that could have turned tap water into a fine mist. If one of those systems sits in your building, the first thing investigators ask for is not a water sample. It is your paperwork.

That is the part most duty holders never picture. An outbreak investigation interrogates your records as hard as it inspects your plant. Knowing how it unfolds tells you exactly what the logbook in your plant room is really for.

It starts with the patients, not the building

Legionnaires’ disease is diagnosed and reported by clinicians, and UKHSA runs the surveillance that pulls individual cases together, investigating clusters and outbreaks where a pattern appears [1]. A single confirmed case triggers a detailed questionnaire about where the person has been. Several cases linked by time and place become a cluster. When investigators can tie those cases to a shared source, it is treated as an outbreak — and the exact thresholds for each are defined in the UKHSA framework rather than chosen on the day.

The reason the questioning reaches back so far is the incubation period. The illness develops over days rather than hours, usually appearing within roughly two weeks of exposure [2], so investigators ask each patient to reconstruct that fortnight: the hotel they stayed in, the office they visited, the spa, the garden centre, the route past a building with a cooling tower humming on the roof. Anywhere a system throws water into the air is a candidate.

None of this happens in isolation. UKHSA publishes annual surveillance for England and Wales, which means case numbers are read against the longer trend, and a small local rise can stand out quickly [3].

How a building gets into the frame

Geography does most of the early work. When confirmed cases cluster around the same few streets, investigators look for sources that could plausibly reach all of them. Cooling towers and evaporative condensers carry disproportionate weight here, because they aerosolise water over a wide area and can seed cases across a neighbourhood — which is also why UK law requires them to be notified to the local authority in the first place [4]. Those notified systems become an obvious first list to work down, alongside the other higher-risk systems the HSE flags [5].

Once a candidate building is identified, the environmental side begins. Investigators want the current risk assessment, the written scheme of control, temperature records, cleaning and disinfection logs, sampling history and contractor reports — and they take their own water samples so the strain found in the system can be compared against the strain isolated from the patients [6]. Sampling for that comparison follows a recognised method rather than a quick dip [7].

This is the moment your records either earn their keep or expose the gap.

An illustrative investigation, from the duty holder’s chair

The following is a composite scenario, drawn together to show how the pieces fit — not a real, named incident.

A mid-size town-centre office runs a roof-mounted cooling tower. Over a fortnight, three people who live within a mile of each other are diagnosed with Legionnaires’ disease. Two of them have no connection at all beyond the high street the building stands on. UKHSA maps everyone’s movements, the tower appears on the local authority’s notified list, and the building becomes one of several candidate sources.

The duty holder gets the call and pulls the file. The risk assessment is current and competent — a good start. But the temperature logs have a six-week hole over the summer, exactly when the maintenance contractor changed and nobody owned the handover. The tower’s most recent clean is recorded as a single word, “done”: no date, no biocide reading, no signature. Environmental samples are taken and sent off.

Whatever the lab eventually reports, the investigation has already found the thing that matters most. There is a stretch of weeks where no one can demonstrate the tower was under control. The danger was never that control had definitely failed. It is that the records could not show it had not — and during a live investigation, an unprovable period is treated as a real one.

What the scenario should change on Monday

The transferable lessons are unglamorous, and that is the point.

• Treat records as evidence, because that is what they become. Every entry needs a date, the actual reading, and a name. “Done” tells an investigator nothing and protects you from nothing.
• Know your notifiable plant. If you operate a cooling tower or evaporative condenser, confirm in writing that it is notified to the local authority [4]. An un-notified tower is both a compliance failure and a red flag the moment an investigation begins.
• Map the reporting chain before you need it. A case of Legionnaires’ disease linked to a work activity can be reportable under RIDDOR, and you want to know who makes that judgement and how, not discover it mid-crisis [8].
• Write down the decision, not just the task. Record why a control exists, what result is acceptable, and what happens when it drifts — for example, that a missed cooling-tower dip escalates to the responsible person and a repeated miss triggers a review. That turns a tick-box into a defensible decision.
• Be ready to hand over a clean pack in hours. Investigations move fast. A duty holder who can produce a current, signed record set the same day is in a very different position from one reconstructing it under pressure.

A negative result, incidentally, does not end the story on its own — and understanding why is worth its own read on the limits of lab testing. Building that mindset across a whole team, not just the named person, is the harder and more durable win; making prevention everyone’s job is where that starts.

Where this guidance stops

You are not the investigator, and reading this does not make you one. Diagnosing patients, linking cases and declaring an outbreak sit with clinicians and UKHSA; the legal duties that follow sit between you, the HSE and your local authority. Take this as orientation, not a procedure. The controls, sampling regime and reporting decisions that actually apply to your building come from a competent, site-specific risk assessment owned by the named duty holder and your appointed water-safety adviser. If you are ever contacted as part of a live investigation, get that adviser involved early — well before you start hunting for last summer’s missing readings.

FAQ

Will I be told if my building is being looked at as a possible source?

Usually, yes, because investigators need site access and your records to make any progress. But a handful of cases rarely points at one building with certainty, so you may be one of several candidate sources assessed at the same time, particularly in an area with multiple cooling towers. The constructive response is to cooperate, hand over a complete record set, and let the strain comparison do the work of ruling systems in or out.

Does a clean water sample clear my building during an investigation?

Not by itself. Legionella can be patchy in a system, and a sample captures one location at one moment — so a negative result is supportive evidence, not proof the system was controlled in the weeks the patients were actually exposed. Investigators weigh it alongside your temperature, cleaning and treatment records, and sampling frequency follows the system and risk assessment rather than a fixed schedule [6].

Do I have to report a suspected case myself?

Most cases are picked up clinically and fed into UKHSA surveillance, so you are not expected to diagnose anyone. The duty that can fall to you is different: where illness is linked to a work activity, separate reporting under RIDDOR may apply [8]. If you suspect a connection to your site, take advice promptly rather than waiting to be approached.

Sources

[1] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks [2] NHS, “Legionnaires’ disease”. https://www.nhs.uk/conditions/legionnaires-disease/ [3] UKHSA, “Legionellosis in residents of England and Wales: 2024”. https://www.gov.uk/government/statistics/legionellosis-in-residents-of-england-and-wales-2024/legionellosis-in-residents-of-england-and-wales-2024 [4] HSE, “Other duties: RIDDOR and notification of cooling towers or evaporative condensers”. https://www.hse.gov.uk/legionnaires/what-you-must-do/duties.htm [5] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [6] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [7] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1 [8] HSE, “RIDDOR - Reporting of Injuries, Diseases and Dangerous Occurrences Regulations”. https://www.hse.gov.uk/riddor/