A dialysis patient sits in the same chair, in the same unit, three times a week, often for years, while their immune defences are anything but normal. That exposure profile is what makes the water serving a renal unit a higher-stakes problem than almost any other clinical system. And the part most people focus on — the reverse-osmosis loop itself — is usually the safest bit.

The honest position is this. The recirculating RO ring main is engineered against bacterial growth and its water is not sprayed into the air, so it is rarely the Legionnaires’ exposure route. The Legionella risk lives upstream, in the pretreatment feeding the RO, and around the patient, in the taps, basins and showers of the unit. Manage all three or you have managed none of them.

What follows is an implementation sequence for clinical engineers and estates leads who own these systems, assuming you already know what an RO plant is.

Before you start: the prerequisites

You cannot control a chain you have not drawn. Three things need to exist before any step below means anything.

A current schematic of the whole water chain, from the incoming main to each dialysis station drop and every outlet in the unit. A named responsible person and a water safety group that includes renal clinical engineering, not just general estates and infection prevention. And a written water safety plan that treats the renal unit as its own chapter, because HTM 04-01 frames healthcare water as a clinical risk question weighted to how vulnerable the patients at each point are [2], and dialysis patients sit near the top of that scale.

If those are missing, fix them first. The rest is detail hung on that frame.

How the water chain actually lays out

Read the system as a schematic, because the geography is where the risk hides.

Water enters from the incoming main into a break tank, often stored, sometimes warm. From there it passes pretreatment: multimedia and activated-carbon filters, then base-exchange softeners. The carbon stage strips the chlorine residual out — by design, to protect the RO membranes downstream — so everything after it has lost the disinfectant the rest of the building still enjoys. Treated water then hits the RO membranes, and the product is pushed around a recirculating ring main that drops off at each dialysis station and returns to the start, ideally never standing still. Many loops carry a heat or chemical disinfection facility on that return.

Now mark the danger points. The break tank: stored, tepid, a classic reservoir. The carbon filter beds: dechlorinated, organically rich, often sitting in a warm plant room — close to ideal for bacterial growth, including Legionella. The softeners and any stored intermediate water. The station drops, which become dead legs whenever the loop runs but a station sits idle overnight or across a weekend. And, off the drawing entirely, the unit’s hand basins, sluices and any showers — the only places here where water is reliably turned into breathable aerosol [3][4]. The loop is a microbial-quality problem; the aerosol-producing outlets around it are the Legionnaires’ problem.

The implementation sequence

1. Fix the boundary and the asset list. Walk the schematic against reality. List every asset from break tank to station drop, plus every outlet in the unit. Done when each asset and outlet has a line, a location and a flag for any dead leg or low-use point.

2. Risk-assess the pretreatment and feed as the Legionella source. Treat the break tank, carbon filters and softeners as where colonisation starts, and assess them on that basis, following the approach in BS 8580-1 [5]. The membranes themselves remove organisms; the kit in front of them grows them. Done when every pretreatment asset has a documented assessment and a control.

3. Define the loop’s disinfection and temperature regime. Whether the ring main is held hot, heat-disinfected periodically, or dosed chemically, the regime and its target are set by competent assessment of this plant, not copied from another unit [1][2]. Done when the regime is written down with its trigger conditions and recorded after every cycle.

4. Stand up monitoring and sampling. Two streams run in parallel: the loop’s own microbial and endotoxin counts under your dialysis water programme, and Legionella sampling across the feed and the unit’s outlets under HSG274 and BS 7592 [1][6]. You need both. Done when a sampling schedule is live, baselines are taken, and results route to a named reviewer.

5. Control the outlets that actually aerosolise. Set sentinel outlets, a flushing regime for anything low-use, and consider point-of-use filtration on the highest-risk taps and showers serving these patients [2]. Done when every aerosol-producing outlet has either routine use, a recorded flush, or a barrier.

6. Close the loop on records. Every temperature, every disinfection cycle, every flush and every sample needs a date, an operative and a result that an auditor can follow. Done when no control on the list relies on memory or a loose paper sheet.

Integration points and the gotchas that bite

The carbon-filter problem is the one that surprises people. You deliberately remove the chlorine residual to save the membranes, and in doing so you create a warm, dechlorinated, nutrient-rich bed in the plant room. It is doing its job and breeding bacteria at once. Its sanitisation schedule is not optional housekeeping.

Station drops turn into dead legs on a timetable. A loop that recirculates beautifully during clinic hours still has stub pipes at each chair that go stagnant when the unit closes for the night. The flushing regime has to be written for the closed unit, not just the busy one.

Commissioning after a refurbishment or membrane change is a distinct hazard window — new pipework, standing water, disturbed biofilm. Treat a return to service as a controlled event with its own clearance sampling.

And keep the two count systems separate. A pristine endotoxin result on the product water tells you the RO is doing its job. It tells you nothing about the Legionella in the basin tap two metres from the chair.

Verifying it works

Trends, not single samples. One clear Legionella result on one outlet on one day is a snapshot, not a verdict — your competent assessment, read across time, is what tells you the controls are holding [1]. Bring sentinel temperatures, disinfection records and sample trends to the water safety group as a pattern, and let an audit test whether the records match the pipework. The system is under control when the evidence is boring: predictable, complete and dull to read.

For the wider context these loops sit inside, on Legionella prevention in hospitals covers choosing controls by patient risk, and on HTM 04-01 and NHS guidance sets out the governance these steps assume.

A necessary caveat

This is general guidance to help you structure the work. It is not a design specification for a dialysis water plant, and it does not set your temperatures, dwell times, dosing levels or sampling frequencies — those come from a competent, site-specific risk assessment of this unit, these patients and this pipework, alongside HTM 04-01 and your renal water standards [1][2]. Where this article and your own assessment disagree, your assessment wins.

A next step for today

Pull your renal-unit schematic and mark, in one colour, every point where water is stored, dechlorinated or stands still, and in a second every outlet that produces a spray. If the second colour is missing, or your only record of flushing those outlets is a paper sheet in a plant room, that is the gap to close first — and moving those checks into a digital logbook, where a missed flush on a closed-unit weekend is visible rather than buried, is a defensible place to start.

FAQ

Can a dialysis patient catch Legionnaires’ disease from the RO loop water?

Direct infection from the loop is not the usual route, because Legionnaires’ disease is contracted by breathing in contaminated aerosol, and the recirculating product water is not sprayed into the air [3][4]. The realistic exposure for a renal patient is the same as for anyone in the building — the taps, basins and showers around the unit. The control effort belongs as much on those outlets as on the loop.

Why is the carbon filter a Legionella concern when it is cleaning the water?

Activated carbon removes the chlorine residual so it does not damage the RO membranes. That leaves the water beyond it without the disinfectant the rest of the system relies on, in a warm, organically rich bed — good conditions for bacterial growth [1][5]. The filter is doing its job; it just needs its own sanitisation regime so it does not become a reservoir.

Do the loop’s endotoxin and microbial counts cover Legionella monitoring?

No. The dialysis water counts confirm the RO plant is producing water fit for treatment. Legionella monitoring is a separate question about the feed water and the aerosol-producing outlets, sampled under the relevant guidance and read as a trend [1][6]. One does not replace the other.

Sources

[1] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [2] NHS England, “Health Technical Memorandum 04-01: Safe water in healthcare premises”. https://www.england.nhs.uk/publication/safe-water-in-healthcare-premises-htm-04-01/ [3] NHS, “Legionnaires’ disease”. https://www.nhs.uk/conditions/legionnaires-disease/ [4] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [5] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [6] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1