---
title: "Sporadic case, cluster or outbreak? How Legionnaires' disease is classified and why it matters"
source_url: https://legionella.io/articles/sporadic-case-cluster-or-outbreak-legionella-classification/
canonical_url: https://legionella.io/articles/sporadic-case-cluster-or-outbreak-legionella-classification/
pillar: "Legionella Basics & Science"
summary: "Sporadic case, cluster or outbreak, travel- or healthcare-associated: what each Legionnaires' label means and why even one case can trigger a search"
primary_keyword: "Legionella cluster vs outbreak definition"
date_published: 2026-06-27
date_reviewed: 2026-06-27
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote, adapt or republish with attribution to REMOTE TECH LTD and a link to source_url."
license_url: https://creativecommons.org/licenses/by/4.0/
---

# Sporadic case, cluster or outbreak? How Legionnaires' disease is classified and why it matters

One confirmed case of Legionnaires' disease and a linked group of ten can appear in the same surveillance report under very different labels, and the label decides what happens next. Sporadic, cluster and outbreak are not loose synonyms. They are working definitions that public health teams use to decide whether to start hunting for a source, and how hard.

If you manage a building, these words tend to arrive secondhand, in a phone call or a news report, when the stress is already high. Knowing what each one means before that day comes lets you read the situation calmly instead of reacting to a headline.

## The three words, plainly

The classifications turn on one question: are these cases connected to each other?

A **sporadic case** is a single confirmed case that has not been epidemiologically linked to any other. Most Legionnaires' cases reported in the UK are sporadic in this sense. The person was infected somewhere, but no second case has been tied to the same time and place, so there is no pattern yet to point at a shared source [1].

A **cluster** is where two or more cases are linked by time and place, or by a shared exposure, in a way that suggests they may have a common source. Linking cases is the work of surveillance: a public health team notices that two people who fell ill within a similar window both visited, stayed at, or live near the same location [1].

An **outbreak** is, in practice, a cluster where a common source is suspected or has been confirmed, and where public health formally treats it as an incident to be investigated and controlled. The word carries weight because it triggers a coordinated response: an outbreak control team, environmental sampling, and action to remove the suspected source [2].

The thresholds and exact wording sit with the surveillance bodies and can be read differently for, say, a healthcare setting than for the community, so treat the counts above as the commonly used logic rather than a fixed legal test [1].

## Where it was caught: the acquisition categories

Alongside how cases connect, surveillance records where the person is thought to have been exposed. This second layer of labels matters just as much, because it points investigators at different kinds of system.

**Community-acquired** covers cases with no identified link to travel or healthcare. The exposure happened in the course of ordinary life, which can make the source hard to pin down, as the person may have passed many possible sites in the incubation period [1].

**Travel-associated** means the person stayed away from home, commonly in hotel, campsite or similar accommodation, within the period before symptoms began. These cases are reported into a European network so that guests who fall ill after the same stay and then scatter back to different countries can still be connected [3].

**Healthcare-associated** (sometimes called nosocomial) covers cases where the likely exposure was in a hospital or other healthcare facility. These are taken especially seriously because patients are often more susceptible, and because the water system is one the organisation directly controls and is expected to manage under recognised guidance [2][4].

A single case can therefore carry two labels at once: a sporadic, travel-associated case, or a sporadic, healthcare-associated one. The acquisition category often drives the response faster than the sporadic-or-cluster split does.

## Why one confirmed case can still start a source hunt

The common assumption is that nothing happens until there is an outbreak. That is not how it works.

A single confirmed case can prompt a source investigation on its own merits when the setting raises the stakes. A healthcare-associated case may be enough to launch a full investigation of the building's water systems, because one nosocomial infection can signal a failure that could affect other vulnerable patients [4]. A travel-associated case at named accommodation can prompt a risk assessment of that site, partly to protect later guests and partly because the same accommodation may already sit in a cluster being assembled across borders [3].

Even a sporadic community case can lead investigators to an identifiable man-made source nearby, such as a cooling tower or spa, if the geography and timing fit. The trigger is not a magic case count. It is the judgement that a controllable source might be making people ill, weighed against who else is exposed [1][2].

## What nobody tells you about the labels

Here is the part that rarely makes it into the plain-language explainers, and it cuts two ways.

First, "outbreak" is a statement about epidemiological linkage and public-health response, not a verdict on how badly your building was run. A site can be drawn into an outbreak investigation because it is one of several places a group of cases happened to share, then be cleared by sampling. Equally, a serious failing in a water system might only ever produce isolated, sporadic cases that are never connected to each other and never escalate to the outbreak label at all. The absence of the word does not mean the absence of a problem.

Second, and more uncomfortably, most sporadic community cases never have a source confirmed. By the time someone is diagnosed, weeks may have passed and the trail through dozens of possible exposures has gone cold. So if you are ever told your building is "a possible source" of a sporadic case, understand that confirmation is the exception, not the rule, and that the investigation is as much about excluding risk to others as about proving where this one person was infected. The reassuring corollary is the sobering one: a building can be contributing to the national figures quietly, one unlinked case at a time, without ever earning a label that would warn you. That is the argument for continuous control, not for waiting to be named.

This is general background on how cases are classified, not a substitute for the advice you will receive from a public health team during a live incident, and it is not legal or medical guidance. How any of it applies to your premises depends on a competent, site-specific risk assessment of your own water systems carried out by a suitably trained person.

## What this means for you, and what to do first

You do not control the labels. Public health applies them. What you control is whether your building can answer the questions an investigator will ask, whichever label arrives.

The first practical step is to know where the records are. If you received a call tomorrow saying a confirmed case may be linked to your site, could you produce a current risk assessment, recent temperature and monitoring logs, and your scheme of control within the hour? That readiness is what turns a frightening phone call into a manageable one. Pull those documents now and confirm they are current, because the day you need them is not the day to start looking.

## FAQ

### Can a single case be called an outbreak?

Usually not on its own. An outbreak generally describes two or more linked cases sharing a suspected common source. A single case is normally recorded as sporadic. The important caveat is that one case, especially a healthcare-associated or building-linked one, can still trigger a full source investigation, so the practical response can look much like the start of an outbreak even before that word is used [1][4].

### Who decides whether something is a cluster or an outbreak?

The relevant public health body, working with local partners, makes that call, not the building owner or their contractor. In England that sits with UKHSA and local health protection teams, with equivalent bodies in Scotland, Wales and Northern Ireland. They apply the surveillance definitions to the actual cases and decide when to convene an outbreak control team. Verify the precise definitions against current UKHSA guidance [1].

### What does "travel-associated" mean for a hotel or holiday park?

It means a confirmed case stayed at your accommodation within the period before they became ill. Because guests disperse afterwards, these cases are pooled across countries through the European network so that a second or third linked case at the same site can be spotted. A single travel-associated case can be enough to prompt a request for your risk assessment and a sampling visit, so the response is often quick [3].

### If there is no outbreak, does that mean my building is safe?

No. An outbreak label reflects that cases have been linked to a common source, not the overall condition of your water system. Many cases stay sporadic and unlinked even where a source exists, simply because connecting them is hard weeks after exposure. Control is judged by your risk assessment, monitoring and records, not by whether your site has ever been named in an incident [2].

## Related reading

- [How UK Legionnaires' disease surveillance works](https://legionella.io/articles/how-uk-legionnaires-disease-surveillance-works-four-nation/)
- [ELDSNet explained](https://legionella.io/articles/eldsnet-european-legionnaires-surveillance-travel-network/)
- [How Legionnaires' outbreaks are detected](https://legionella.io/articles/how-legionnaires-outbreaks-are-detected-lessons-for-duty-holders/)
- [How to read UK Legionnaires' disease figures](https://legionella.io/articles/how-to-read-uk-legionnaires-disease-figures/)

## Sources

[1] UK Health Security Agency, "Legionnaires' disease: guidance, data and analysis". https://www.gov.uk/government/collections/legionnaires-disease-guidance-data-and-analysis
[2] HSE, HSG274 Part 2 (2024), “Operation and inspection of hot and cold water systems”, p.70. https://www.hse.gov.uk/pubns/books/hsg274.htm
[3] European Centre for Disease Prevention and Control, "Legionnaires' disease and the European Legionnaires' Disease Surveillance Network (ELDSNet)". https://www.ecdc.europa.eu/en/legionnaires-disease
[4] NHS England, "Health Technical Memorandum 04-01: Safe water in healthcare premises". https://www.england.nhs.uk/publication/safe-water-in-healthcare-premises-htm-04-01/