Before anyone opens a valve on a disinfection job, two documents have to exist: a RAMS pack — the risk assessment plus the method statement setting out exactly how the work runs — and, for the high-hazard parts, a permit-to-work that nobody starts without a signature. RAMS for water hygiene is not box-ticking. It is the safe system of work that keeps a tank entry, a chlorination dose or a hot purge from injuring the person doing it.

The hazards here are not the everyday ones of routine monitoring. You are putting a person inside a tank, handling drums of oxidising chemical, or driving scalding water out to taps the public normally use in safety — and a single disinfection can stack all three into one afternoon, each governed by its own duty.

What follows is the whole pack: what the documentation must contain so the work is controlled, legal and recordable, with the procedures themselves left to the method articles they belong in.

What the safe-system-of-work pack has to cover

Treat the list below as a pre-start audit of the paperwork, not the procedure. Read it against the actual RAMS in front of you and flag every line that is generic, missing or blank.

The risk assessment — the “RA” in RAMS

  • Name the hazards of this specific job, not disinfection in general: confined-space entry, hazardous chemicals, scalding water, working at height over an open tank, lone working, and live services struck during isolation.
  • Record who is exposed at each stage — the operatives, building occupants, and anyone downstream of a treated outlet.
  • Set a control and a residual-risk rating against each hazard, so the method statement has something to implement.

Under ACoP L8 this is planned, supervised, recorded work for competent people, not an improvised job with the immersion turned up [1].

The method statement — the “MS”

Permit-to-work — the formal go/no-go

  • Decide which elements need a permit. Confined-space entry almost always does; chemical disinfection and a hot purge do where the risk assessment calls for one.
  • Get both signatures — an authorised, competent issuer and the operative accepting. One signature is not a permit.
  • Define the task, time window, isolations, precautions and hand-back on the permit itself. Anything outside that scope is not authorised.
  • Close the permit at hand-back. An open permit nobody signed back is the commonest paperwork failure on these jobs.

A permit-to-work is a control measure arising from the risk assessment, not a separate legal document — but on high-hazard work it proves the right person confirmed the controls before anyone started.

Confined-space controls for tank entry

  • Confirm whether the space is legally a confined space. A cold-water storage tank or large calorifier someone climbs into to scrub and inspect usually qualifies — substantially enclosed, with a foreseeable specified risk.
  • Apply the hierarchy: avoid entry if the work can be done from outside; if not, work to a documented safe system; and put emergency arrangements in place before anyone enters.
  • Specify the entry controls — atmosphere testing where required, ventilation, harness and tripod, a dedicated attendant, and communications.
  • Write a rescue plan that works on its own, not one assuming a 999 call arrives in time. A tank entry with no rehearsed rescue is not ready to start.

Chemical controls for chlorination

  • Hold a COSHH assessment for every substance — typically sodium hypochlorite or a chlorine dioxide system, plus any neutraliser — each tied to its current safety data sheet.
  • Specify the controls: PPE, eyewash, spill kit, ventilation, and separation of incompatible chemicals (never mix acids with hypochlorite).
  • Set dosing strength and discharge neutralising by the method statement and procedure article, not by numbers invented on site.

Isolation and lock-off

  • Isolate and lock off the section being worked on. Lock and tag the valves so the treated zone cannot be back-fed or drawn from, and take the affected outlets out of use with occupants warned and taps labelled.
  • Isolate and prove dead the electrical supplies to immersion heaters, pumps and trace heating before entry or draining — a live immersion in a tank you are about to enter is a serious hazard.
  • Keep a lock-off register so every isolation is restored at hand-back.

Scald risk during thermal disinfection

  • Treat the hot purge as the main hazard of the day. Water hot enough to pasteurise pipework scalds exposed skin in seconds, and you are deliberately sending it to outlets people use safely the rest of the week [3].
  • Control the TMV bypass. Thermostatic mixing valves block the very heat a purge delivers, so bypassing them removes scald protection — only do it with access control, signage and out-of-hours working.
  • Restore tempering and prove it before re-occupation. Reinstate every bypassed TMV and confirm safe outlet temperatures before the area goes back into use [3].

Emergency response and hand-back

  • State the first-aid response for chemical exposure and scalds, the confined-space rescue arrangement, and the spill-response steps.
  • Make hand-back a defined event: isolations removed, the system restored to its normal regime, TMVs reinstated and proven, and the disinfection record or certificate issued [2].

The lines people leave blank

Three failures show up again and again. The first is the lifted template — a RAMS copied from the last job with the address changed, describing a disinfection in the abstract rather than your tank, your chemical and your isolation points. Generic paperwork is the tell an auditor looks for first.

The second is the rescue plan that doesn’t exist. Tank-entry permits get issued with the emergency arrangements left as “call the supervisor”, when the law expects a workable, rehearsed means of getting an unconscious person out without the rescuers becoming casualties too.

The third is the live immersion. Entering a calorifier or tank while its supply is merely switched off, not locked off and proved dead, turns a routine clean into a fatal-risk job. Choosing a contractor who treats all three as standard is itself a competence test — see Working with contractors: ensuring Legionella compliance, and use a provider working to a recognised service-provider code of conduct [4].

This is general guidance on the documents and controls a disinfection needs, not a method statement you can lift and use. The actual hazards, chemical choices, confined-space rescue plan and isolation points are specific to your building and belong to a competent person’s site-specific assessment. Nothing here is legal, medical or design advice.

FAQ

Do I need a permit-to-work for every disinfection, or only for tank entry?

Confined-space tank entry should always sit under a permit. For a chemical disinfection or a hot purge, your risk assessment decides — a permit suits high-hazard work, or jobs where a separate client and contractor must formally hand the work across. A small in-line disinfection by one competent person on their own system may run on the method statement alone.

Is a generic RAMS template good enough for a chlorination job?

No. A template is a starting point, not the document. A usable method statement names your outlets, the actual chemical and its safety data sheet, your isolation and lock-off points, and the rescue arrangement for your tank. A RAMS that could be handed to any site unchanged has not been assessed for yours — exactly what an auditor flags.

Who signs the permit — the water-hygiene contractor or the client?

Both, in different roles. An authorised, competent person — frequently on the client or duty-holder side — issues the permit, confirming the isolations and precautions are in place. The operative signs to accept the scope and limits, then signs the area back for the issuer to confirm it is safe and restored. One party verifies the safe conditions; the other works within them.

Does a cold-water storage tank really count as a confined space?

Often, yes. A confined space is defined by being substantially enclosed with a foreseeable specified risk, not by its size — a storage tank someone climbs into to clean and inspect commonly qualifies through the restricted access, residues and chemicals, and the risk of inrush. If in doubt, treat it as one and apply the hierarchy.

What to do before you start

Pull the RAMS for your next disinfection and read it against this list. Go straight to two lines: the rescue plan for any tank entry, and the close-out signature on the permit. If the rescue arrangement is a phone number rather than a method, or the permit has a start signature but no hand-back, the job is not ready to start — fix that before the operative is on site.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [4] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/