When a case of Legionnaires’ disease gets linked to a building you are responsible for, the first question is almost always the wrong one: “who do I have to phone?” The more useful framing is that reporting is not a single action. It is three separate channels, each with a different trigger, a different recipient, and a different person responsible for pulling it. Blur them together and you will either report something that was never yours to report, or miss the one duty that genuinely sits with you.

Hold onto this: keep the clinical notification, the RIDDOR report and your cooperation with the public health investigation as three distinct things. Get those straight and everything else is logistics.

The three channels, and which one is actually yours

Clinical notification — not yours. Legionnaires’ disease is a notifiable infection. The doctor or laboratory that diagnoses it reports the case to the local health protection team, which feeds UKHSA’s surveillance and investigation work [4]. This is how most incidents reach you: public health contacts you because a confirmed case names your site, not the other way round.

The RIDDOR report — sometimes yours. Under RIDDOR, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations, an employer or responsible person must report a case of legionellosis where there is reasonable evidence it was caused by exposure at work, and that report goes to the HSE [1][2]. The load-bearing word is work. This duty bites when the affected person’s exposure is tied to your undertaking — most clearly when the person is one of your own employees.

Cooperation with the investigation — always yours. Once a case is associated with your premises, the health protection team and HSE will want records, access, and usually samples. Handing them over promptly and honestly is not optional, and it is the point at which your logbook either rescues you or sinks you [3][4].

There is a quieter, fourth duty that sits before any incident: if you operate a cooling tower or evaporative condenser, it must already be notified to the local authority. That is a standing registration, not an incident report [2]. Forgetting it is a common gap that tends to surface at the worst possible moment — mid-investigation.

Has a reporting duty actually been triggered? Walk it through

Use this when you are told there may be a case, or when a result or event makes you wonder whether to report. Treat it as a prompt for a competent decision, not a replacement for one.

  • Is someone confirmed or suspected to have Legionnaires’ disease (legionellosis)?
    • No → No RIDDOR disease report is triggered. If you are looking at a high sample or a control failure rather than an illness, that is a control problem: log it, find the cause, act, and review the risk assessment.
    • Yes → keep going.
  • Is there reasonable evidence the exposure is linked to a work activity or premises you control?
    • No, or clearly not your site → You are not the RIDDOR reporter. You still cooperate fully if public health connects you, and you keep all evidence intact.
    • Possibly, or yes → keep going.
  • Is the affected person one of your employees, exposed through their work?
    • Yes → This is the clearest reportable scenario. Make the RIDDOR report to HSE without delay once the diagnosis and the work link are established [1].
    • No — a guest, resident, patient or other member of the public → The RIDDOR position is not automatic and turns on the specific circumstances. Take competent advice rather than assuming either way, and stay inside the investigation regardless [1][3].
  • Do you operate a cooling tower or evaporative condenser?
    • Yes → Confirm it is, and stays, notified to the local authority. That is separate from any incident report [2].

If a branch leaves you unsure, that uncertainty is the signal to get advice quickly — not to do nothing.

What the first 48 hours actually look like

The decision rarely arrives tidily. More often a health protection nurse calls about a confirmed case who stayed in, worked at, or visited your premises during the incubation window, and wants to know how your water systems are run. What you do in the next two days matters more than the eventual paperwork.

Brief the responsible person at once and open a single dated incident log: every call, name, decision and action in one place. Pull the live risk assessment, recent temperature and monitoring records, sampling history, and any open remedial actions. The outbreak control team will ask for exactly these, and scrambling for them later reads as loss of control.

Then resist the strongest instinct in the room. Do not immediately blitz the system with a shock disinfection. The aerosol-producing assets and the water sitting in them are the evidence the investigation needs to trace the source, and laboratory sequence typing can tie a patient’s clinical isolate to a specific environmental source — but only if the samples still exist when investigators arrive. Coordinate any emergency control measures with the health protection team rather than scrubbing the trail first. (For how that environmental-to-clinical matching is done, see Legionella genetics and source tracking.)

That balance has a hard limit, though. If an asset is a credible, active source and people are still being exposed, taking it out of use to protect them comes first. The aim is to coordinate and document — not to destroy evidence needlessly, and not to leave a known hazard running.

Where the duty really sits

Who actually pushes the button on a RIDDOR report? The duty holder — the employer or the person in control of the premises — not the contractor who happens to run your monitoring. A consultant can advise you and your service provider can help assemble records, but the legal report and the cooperation are yours to own [3]. If you cannot say with confidence who that responsible person is in your organisation, fix that ambiguity before anything else; UK Legionella compliance 101 sets out how the duty is allocated.

What this guidance can and cannot settle

This explains how the channels fit together. It cannot decide your specific case. Whether a particular illness is RIDDOR-reportable, and how quickly, depends on facts you may not have on day one — the confirmed diagnosis, the work link, the exposure window — and those are judgements for a competent person working with HSE and your local health protection team. When the call comes, write down what you were told and by whom, and check the current RIDDOR criteria directly rather than relying on memory or on this page.

FAQ

Do I report a Legionnaires’ case to the HSE or to UKHSA?

Usually the first report is neither of yours. The diagnosing clinician notifies public health, and UKHSA-linked teams run the investigation [4]. Your RIDDOR report to HSE is a separate duty that applies when there is reasonable evidence the illness came from exposure at your work [1]. Both can happen for the same case, through different people and for different reasons.

A guest, not an employee, may have caught it at our site. Is that a RIDDOR report for us?

Not automatically. RIDDOR’s disease reporting centres on work-related exposure, so a member of the public’s case does not map neatly onto the employer duty — but the circumstances decide it, so take competent advice. Either way you must cooperate with the investigation and preserve your records [1][3].

A sample came back high but nobody is ill — does that need reporting?

A high environmental result is not, by itself, a case of disease to report under the disease provisions. It is a control failure to investigate: identify the cause, act on it, and review the risk assessment. Whether anything else is reportable depends on the system and the circumstances, so record it and take advice if a dangerous occurrence or actual exposure is in question [1].

Do this now

Before any incident lands, write a one-page escalation card and pin it inside the logbook: the responsible person and their out-of-hours number, where the live risk assessment and records are kept, your local health protection team contact, and the single instruction “do not disinfect a suspected source before coordinating”. The day public health calls is the wrong day to be hunting for any of it.

Sources

[1] HSE, “RIDDOR - Reporting of Injuries, Diseases and Dangerous Occurrences Regulations”. https://www.hse.gov.uk/riddor/ [2] HSE, “Other duties: RIDDOR and notification of cooling towers or evaporative condensers”. https://www.hse.gov.uk/legionnaires/what-you-must-do/duties.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks