Legionella risk assessment in Ireland: what the law asks for, and what has to follow it

01

What a legionella risk assessment is, and the Irish law behind it

Legionella bacteria multiply in water that sits between about 20°C and 45°C, in stagnant water, and where there is sludge, scale, rust and biofilm. People catch Legionnaires' disease, a severe and potentially fatal form of pneumonia, by breathing in small water droplets contaminated with Legionella bacteria from a shower, a spray tap, a cooling tower or a spa pool. The risk assessment finds out whether the conditions for legionella growth exist in a building, how contamination could reach people, and decides what to do about them.

Temperature control is the usual first defence. The National Guidelines for the Control of Legionellosis in Ireland, 2009 say cold water should be kept below 20°C, and hot water stored at 60°C and distributed so that it reaches 50°C within one minute at the outlets, so the water temperature at the outlets is one of the first things an assessor checks.

No Irish statute is written only about legionella; the duty comes from general health and safety law:

• Section 19 of the Safety, Health and Welfare at Work Act 2005 requires every employer to identify the hazards in the place of work under their control, assess the risks, and "be in possession of a written assessment" of them. Section 19(5) extends the duty to anyone covered by section 12 (risks to people who are not their employees) or section 15 (a person who has control of a non-domestic place of work, including one obliged by contract or tenancy to maintain or repair it), to the extent of those duties.
• The Safety, Health and Welfare at Work (Biological Agents) Regulations 2013 (S.I. No. 572 of 2013) apply where exposure to a biological agent, deliberate or incidental, has occurred or may occur. Regulation 7 requires the employer to assess the nature, degree and duration of the risk and keep the assessment in written form. The HSA's biological agents legislation and Code of Practice page explains that the 2013 and 2020 Regulations build on the Act's general requirement.

The Health and Safety Authority's guidance on legionellosis sets out what that means in practice. As an employer or person in control of a place of work you must identify and assess sources of risk, prepare a scheme (a Legionella control plan) for preventing or controlling it, implement and manage the scheme with a person appointed to be managerially responsible (the responsible person), and keep records and check that what has been done is effective.

The technical guidance is the National Guidelines for the Control of Legionellosis in Ireland, 2009, published by the Health Protection Surveillance Centre (HPSC) and referred to by the HSA. Its chapter 4 says that where the assessment identifies a risk, the appropriate control measures should be put in place and a risk management plan adopted.

02

What a legionella risk assessment covers

The HPSC guidelines give the assessment three purposes: to identify and assess the risk of exposure to Legionella from work activities and water systems on the premises, to establish the preventive and control measures needed, and to give direction on which risks to deal with first. It should consider:

• the potential for Legionella seeding and growth;
• the potential for aerosol generation and exposure;
• the presence of susceptible people;
• the adequacy of the existing site management arrangements and records;
• the efficacy of the existing preventive and control measures.

In a complex building that means a site survey of all the water systems, from the incoming water supply and the cold water storage tanks to the outlets, with an asset register of the plant, pumps and strainers and an up-to-date schematic of the layout, including parts temporarily out of use. The system is looked at as a whole, dead legs and parts used only now and then included. Besides hot and cold water systems, the guidelines list cooling towers, evaporative condensers, spa pools, humidifiers, fountains and sprinklers among the systems that can present a risk. The assessor also asks whether vulnerable people, such as nursing home residents, could be exposed, and how many people for how long.

Where a risk is identified, chapter 4 says the significant findings should be recorded with the name of the person and organisation who carried out the assessment. A written risk assessment should include:

• the scope of the assessment;
• a description of the site and water systems, with details of design, operation and maintenance;
• the site's arrangements for managing and recording control of Legionella risks;
• an assessment of risk for each system and activity;
• recommendations for preventing or controlling the risks, including monitoring and remedial actions.

03

Who can carry out a legionella risk assessment

The employer or person in control must make sure the assessment is done, but need not do it personally. The HPSC guidelines say it is imperative that a competent person with the relevant skills, knowledge and experience carries it out. Section 2(2) of the 2005 Act defines a competent person as one who, having regard to the task and the size or hazards of the undertaking, "possesses sufficient training, experience and knowledge appropriate to the nature of the work to be undertaken".

No particular qualification is required by law. The guidelines add three expectations:

• Expertise, from outside if need be. Organisations and individuals carrying out risk assessments should ideally be members of a recognised professional body or association, and if that expertise is not available within the organisation it should be sourced externally.
• Independence. To prevent conflicts of interest, those who carry out the assessment should ideally be independent of those who implement the control measures, water treatment and cleaning and disinfection.
• Equipment and training. It is the employer's duty to make sure the assessor is competent, suitably trained and has the equipment to do the assessment safely and properly.

In a hotel with little-used rooms, a secondary school with sports hall showers or a nursing home, most premises and property managers bring in a specialist assessor. Many water hygiene businesses offer legionella risk assessments alongside water treatment services; the independence point above is the reason to ask who would carry out any remedial work. Two other roles sit beside the assessor:

• The responsible person, appointed for day-to-day Legionella control: a manager or someone of similar status with enough authority and knowledge of the installation, trained where the systems are medium or high risk, with arrangements so that they or an authorised deputy can be contacted at all times.
• Contractors. A water hygiene contractor's contract should state what they do and to whom they report, and employing them does not absolve the duty holder of responsibility.

In a shared building, the HSA's legionellosis guidance says employers, and landlords where applicable, need to agree who is responsible for the overall risk assessment for the premises and who carries out the checks in each employer's area, and record that in the overall Legionella control plan; section 21 of the 2005 Act requires employers sharing a place of work to co-operate. In an apartment development, the owners' management company usually controls the shared plant through its managing agent; who commissions that assessment should be written down.

04

How often a legionella risk assessment is reviewed

Section 19(3) of the 2005 Act requires the employer to review the risk assessment where there has been a significant change in the matters to which it relates, or there is another reason to believe it is no longer valid, and to amend it as appropriate. Regulation 7(1)(d) of the Biological Agents Regulations 2013 adds that it is reviewed as often as necessary and whenever conditions at the place of work change in a way that may affect exposure.

The HPSC guidelines are more specific: once the risk assessment is complete and documented, it should be kept under regular review, at least annually, and reviewed and updated after significant changes to the water distribution system or to operational procedures, with a written record of the review, and an indication of when to review it and what to review should be recorded. Their reasons for an earlier review include:

• changes in the water system or its use;
• changes in the use of the building in which the water system is installed;
• new information about risks or control measures;
• the results of checks showing that control measures are no longer effective;
• a case of Legionnaires' disease or legionellosis associated with the system.

Separately, a competent person completely independent of those who run the control regime should audit the whole programme at least every two years.

The fourth reason is the one the routine record shows best: sentinel temperatures drifting below target, or weekly flushing that stopped over the summer holidays, mean the assessment is due for review.

05

From the assessment to the control plan and the records

Where the assessment finds a risk, the HPSC guidelines say the person with the corporate or statutory obligation appoints the responsible person and puts in place a written scheme, which the HSA calls the Legionella control plan, including:

1. an up-to-date schematic of the plant, building or system, including parts temporarily out of use;
2. a description of correct and safe operation;
3. the precautions to be taken, and the checks to show the scheme is working and how often;
4. the remedial action to take if the scheme is shown not to be effective.

The HSA's Legionella risk assessment template No. 32, written for schools, asks whether the plan says which checks are carried out, by whom, when and with what records, whether a responsible person and deputy are named, and whether little-used outlets are flushed at least weekly or purged safely before use, for example before reopening after the summer holidays.

Point three is where the assessment becomes routine work: weekly flushing, monthly temperature checks at the sentinel outlets, quarterly showerhead descaling and annual tank inspections, covered in our guide to legionella checks in Ireland. Each recommended action in the assessment needs an owner, a priority and a date as well. The relevant parts of the control plan go into each employer's safety statement, which section 20 of the Act bases on the risk assessment.

The responsible person keeps the records: who is responsible for each task, the schematics, the significant findings, the scheme and how it is implemented, every monitoring result, inspection, test or check with its date, and contractors' visits and remedial work. The guidelines say test and inspection records must be kept for five years, signed by the people who did the work.

06

Where the record fails, and what SiteClara does about it

The assessment itself is rarely where things go wrong. The failure comes afterwards: nobody owns the weekly flush of the empty third-floor guest rooms once the maintenance person leaves; the sentinel readings stop when the school closes for July; a hot tap reading 44°C is written down and never passed on. At the annual review the assessor finds a log book with gaps, or one filled in neatly a page at a time.

SiteClara is aimed at that gap between the control plan and the routine. The building puts a printed QR poster, with an NFC tag if staff prefer to tap, at the places the plan names: the little-used water outlets, the sentinel taps, the calorifier and the tank room. Staff scan with their own phone, with no app to install, and see the checks due at that spot. They mark each one done, or say what stopped them, with a photo when one is asked for, such as the thermometer in the stream. The time and the person are recorded as it happens.

A supervisor sees which checks are due, done and missed, and can record the reason for a miss. A fault found on a check goes on the team's list of jobs until someone closes it. Each day the supervisor approves a report that goes to nominated management or client contacts the next morning. When the assessment is reviewed or audited, that record shows which controls were carried out, where, by whom and when.

07

Questions people ask

Is a legionella risk assessment a legal requirement in Ireland?

Yes: section 19 of the Safety, Health and Welfare at Work Act 2005 requires every employer to hold a written risk assessment of the hazards in the place of work under their control, and regulation 7 of the Biological Agents Regulations 2013 applies that to incidental exposure to biological agents such as Legionella.

Can I do my own legionella risk assessment?

Only if you are competent: the National Guidelines for the Control of Legionellosis in Ireland, 2009 say it is imperative that a competent person with the relevant skills, knowledge and experience carries it out, and that if the expertise is not available within the organisation it should be sourced externally.

How often should a legionella risk assessment be done?

Reviewed at least annually, with a written record of the review, under the National Guidelines for the Control of Legionellosis in Ireland, 2009, and sooner after a significant change to the water system or the building's use, or when checks show the controls are no longer working. Section 19(3) of the 2005 Act requires a review whenever there has been a significant change or there is reason to believe the assessment is no longer valid.

Is legionella testing mandatory in Ireland?

Not routinely for an ordinary hot and cold water system: the National Guidelines for the Control of Legionellosis in Ireland, 2009 say routine monitoring for Legionella there is not normally required unless problems arise, such as control temperatures or biocide levels not being consistently achieved, or an outbreak is suspected. Cooling towers are different: the guidelines say they should be sampled for Legionella at least quarterly.

What temperature does Legionella grow at?

Between about 20°C and 45°C: the National Guidelines for the Control of Legionellosis in Ireland, 2009 say water temperatures in that range favour growth, that the bacteria do not appear to multiply below 20°C and are killed within a few minutes above 60°C, and so recommend keeping cold water below 20°C and storing hot water at 60°C so that it reaches 50°C within one minute at the outlets.

Is Legionnaires' disease contagious?

No: the National Guidelines for the Control of Legionellosis in Ireland, 2009 say infection is usually by breathing in aerosols contaminated with Legionella bacteria, and that there is no evidence of person-to-person transmission, which is why the controls are on the water systems.

08

Further reading, and a list to take away

Start with the HSA's legionellosis page. The National Guidelines for the Control of Legionellosis in Ireland, 2009 set out the risk assessment in chapter 4 and the control scheme and records in chapter 5, and the HPSC's legionellosis guidance page lists the 2015 guidelines for water systems in healthcare facilities and checklists for hotels, leisure centres and hostels. The law is on the Irish Statute Book.

For the legionella risk assessment in your building, check that:

• every water system you control has a current written assessment by someone competent;
• it names who carried it out and its next review date, at least annually;
• in a shared building, the control plan says who owns the assessment and each check;
• its recommendations have owners and dates;
• a Legionella control plan sets out the checks, their frequency, who does them and what happens when one fails;
• a responsible person and a deputy are named;
• the review is brought forward after a change to the system or a failed check, and the programme is independently audited at least every two years;
• test and inspection records are kept for five years.