The email from the lab usually lands on an ordinary afternoon, and the number in it is rarely zero. The first instinct is to ask whether something has gone badly wrong. The more useful instinct is to read the result as a map. It tells you where, in a system you thought was under control, control quietly slipped.
A positive sample is not an outbreak, and on its own it is not a sign that anyone is ill — Legionnaires’ disease comes from breathing in contaminated aerosol, not from a figure on a report [1]. What the result does is point you at a location and a probable failure mode. Treat finding that failure as the actual work, and the paperwork follows. A positive Legionella result is a fault to find, not a box to re-tick.
Read the result before you react
The lab reports a count in colony-forming units per litre (cfu/l), tied to the specific outlets that were sampled. Two things shape everything that happens next: how high the count is, and how many outlets it shows up at. One low-count positive at a single tap is a different problem from the same count appearing across a wing.
HSE technical guidance (HSG274) sets out response bands keyed to the count. As a general expectation, a low detected count at one outlet with the rest of the system clear points to a localised issue and usually means review and re-sample; a higher count, or positives at several outlets, calls for review plus remedial action; a count in the region of 10,000 cfu/l or above typically triggers immediate action, including disinfection [2]. Confirm the exact figures and the response each one demands against current guidance and your own risk assessment before you act — the bands are a guide, not a tariff.
One more thing to note from the report: was the positive at a sentinel outlet (the ones nearest and furthest from where hot and cold water is generated) or at an everyday tap? Sentinels are chosen because they tell you about the system as a whole. A positive there carries more weight than a positive at a single dead-end fitting.
Trace it backwards
Start with the most likely cause, not the most alarming one. On the vast majority of sites, a positive result comes back to water that sat still or sat at the wrong temperature, in that order.
Walk the chain in reverse. Was the affected outlet being flushed, and is there a record proving it? What were its last few temperature readings — cold genuinely cold, hot genuinely hot? Did anything change on the system in the weeks before sampling: a section taken out of use, a pump swapped, a low-occupancy spell, building works that left a branch capped but connected? Only when none of that explains the result should you wonder about the sample itself. And if the same weakness shows up in more than one place, treat it as a system failure rather than a one-off defect.
Matching the result to the likely fault
Use the report to narrow the search rather than chase everything at once. The pattern of the positive usually tells you where to look first.
| What the result looks like | Most likely cause | The check that confirms it | The action |
|---|---|---|---|
| Low count at one far or low-use outlet, rest clear | Stagnation from missed or thin flushing | Flushing records and the last temperatures at that outlet | Reinstate or increase flushing, run it through, then re-sample |
| Positive on the cold side, worse in warm weather | Cold water drifting above the safe band | Cold temperature at the tank and at the outlet | Restore cold delivery, insulate or relocate the run, re-sample |
| Positive at hot outlets or a hot sentinel | Hot water not hot enough at generation or return | Calorifier flow and return temperatures, TMV blending | Correct generation temperature, check the return loop, consider thermal disinfection |
| Several unrelated outlets positive, or a high count | Systemic: biofilm load or a treatment/dosing failure | Whole-system temperatures, dosing logs, date of last clean | Bring in a specialist, plan system disinfection |
| One positive that fits no pattern, records otherwise clean | Possible sampling or transit issue, or a transient | Who sampled, the bottle and method, time to the lab | Re-sample to a consistent method before drawing conclusions |
The flow runs the same way each time: read the symptom, name the most probable cause, run the one check that confirms or kills it, then act. Resist jumping to system-wide disinfection for a single low-count outlet that simply stopped being flushed — that is over-treating a local problem and leaving the habit that caused it intact. Flushing little-used outlets is where most of these low-count positives are won or lost.
Putting it right
Separate containment from cure. If the count is high or the people using the outlet are vulnerable, the immediate move may be to restrict use of that outlet or area while you work — a precaution, decided with a competent person, not an admission of disaster. The cure is whatever closes the gap the trace exposed: restored temperatures, a proper flushing regime, descaling and cleaning, or disinfection carried out by someone competent to do it.
Then close the loop in writing. Update the risk assessment and the written scheme if the cause exposed something they missed, because the scheme is what HSE expects to define your controls and how you check them [3]. Record the decision, not just the task — for example, “outlet restored to weekly flushing because the void-room rota had dropped it; missed flushes now escalate to the responsible person.” That is the difference between fixing today’s number and managing the system, and a digital record-keeping tool makes that timeline far easier to reconstruct the next time a result comes in.
Re-sampling belongs at the end, not the start. Take the confirming sample to a consistent, representative method so the before-and-after comparison actually means something — BS 7592 covers how sampling points and methods are selected for routine monitoring and investigation [4]. A clean re-sample only closes the issue once you have also fixed what let the count rise. Otherwise you have verified a good day, not a controlled system, and HSE is explicit that testing frequency and value follow the system and the risk assessment rather than a fixed schedule [5].
When to escalate beyond the water team
Two situations move this out of routine remedial work. The first is a high count or widespread positives pointing to a systemic problem — specialist territory, because disinfecting your way out of a biofilm-laden system without competent help tends to buy a quiet few weeks and then the same result.
The second matters more. If anyone who uses the building is diagnosed with Legionnaires’ disease that might be linked to the premises, this stops being only a water-management question. It becomes a public-health one: UKHSA investigates confirmed cases, clusters and outbreaks, and a work-related case can bring reporting duties too [6][7]. Do not sit on a suspected link while you tidy the paperwork — raise it.
A note on judgement
The bands and triggers above are general guidance, not a fixed rulebook. The right response to a given count depends on who uses the outlet and how vulnerable they are, what your risk assessment already flagged, and what your written scheme commits you to. A competent person should sign off the remedial route, and any figure quoted here should be checked against current HSE guidance for your specific system before you act on it.
FAQ
Does one positive result mean I have to shut the building?
No. Whether to restrict an outlet or an area depends on the count, how many outlets are affected, and who is exposed. A high count serving a vulnerable group is a very different decision from a low count at a rarely-used tap. The call is guided by your risk assessment and a competent person, not by the word “positive” on its own.
Can a clean re-sample close the issue on its own?
Not by itself. A clean re-sample is good evidence for the conditions on the day it was taken, but it only closes the loop once you have corrected whatever allowed the count to rise — a temperature drift, a dropped flush, a stagnant branch. Re-sample after the fix, to a consistent method, so the result is actually comparable [4].
Who do I need to tell about a positive Legionella result?
Internally, the responsible person and the duty holder, with the decision and reasoning recorded. A positive water sample by itself is not generally an external reporting event. But if someone is diagnosed with Legionnaires’ disease that may be connected to the premises, that becomes a public-health matter and potentially a reportable one, and should be raised without delay [6][7].
Sources
[1] CDC, “How Legionella Spreads”. https://www.cdc.gov/legionella/causes/index.html [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [4] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1 [5] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [6] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [7] UKHSA, “Investigation of Legionnaires’ disease: cases, clusters and outbreaks”. https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks