In short: A Legionella risk assessment for a hotel is the legal starting point for controlling Legionella under the Control of Substances Hazardous to Health Regulations (COSHH) and the HSE Approved Code of Practice L8 – not the control itself.
The duty is to act on it, maintain control measures and records and review them when conditions change, not simply commission a document. Hotels can carry higher risk than many commercial buildings because variable occupancy, seasonal closures and complex water systems create stagnation at scale.
A Legionella risk assessment in a hotel is the foundation for controlling waterborne Legionella, but genuinely effective management depends on what a hotel does with that assessment, not on the document alone.
Hotels can have complex water systems, especially where rooms, spa facilities and seasonal areas are served by different parts of the system, yet operators can underestimate the risk. A common failure mode is treating the assessment as a one-off compliance task rather than part of ongoing management, which matters more than any lack of awareness that Legionella exists.
The article is for hotel owners, general managers and the facilities and compliance teams accountable under UK law. It covers why hotels differ, what the law requires, why flushing is not enough, where the real risk sources sit and what to do when something goes wrong.
Hotels can carry greater Legionella risk than simple, consistently occupied offices. Their water systems are affected by changing occupancy, seasonal closures and aerosol-generating outlets such as showers and spa facilities. These conditions can let Legionella grow and reach guests through breathable water droplets.
A large hotel is rarely one simple water system. Different wings, floors, rooms and facilities can each develop their own risk profile, depending on how they are used and maintained. A standard routine can fail if it treats every part of the building as if it has the same level of use.
When rooms sit empty, outlets go unused and water stands in the pipework. Legionella risk rises where water sits between 20 and 45°C, contains nutrients such as scale or biofilm and can be released as breathable droplets.
In a partially occupied hotel, whole branches of pipework can receive little or no flow. The building may appear busy, while parts of the water system remain stagnant.
Seasonal closures add another risk. A wing closed during a quiet period can leave pipework unused for weeks, even while the rest of the hotel continues to operate.
These areas are easy to miss unless teams compare occupancy records with schematics, flushing logs and monitoring results.
Guest outlets turn stagnant water into direct exposure. Showers, spa baths and hot tubs release water droplets that guests can breathe in, but guests cannot know whether an outlet has been used, flushed or monitored before they arrive.
Larger resorts add further risks through cooling towers, decorative fountains, heating, ventilation and air conditioning (HVAC) humidification and spa pools. Each system needs to be assessed for how it stores water, creates droplets and exposes people.
Staff turnover creates another weakness. The person keeping flushing records this month may not be the person who kept them last month.
If a control process lives with one individual, it can disappear when that person changes role or leaves. Legionella control needs named responsibility, clear records and routines that continue when staff change.
UK law requires hotel operators to assess and control exposure to Legionella under the Control of Substances Hazardous to Health Regulations (COSHH, 2002). It requires active management, not a filed document. The HSE Approved Code of Practice L8 (HSE, 2013) gives guidance on how to comply, and HSG274 (HSE, 2024) provides practical technical guidance.
COSHH applies regardless of business size where a risk of exposure arises. The wider legal framework includes the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations, COSHH, L8 and HSG274.
L8 carries special legal status. If an operator does not follow it, they may need to demonstrate, if challenged, that they complied with the law in another way.
Operators must also appoint a competent responsible person – an owner, general manager, facilities manager or another named individual with the authority and competence to act. The contractor who performs the assessment does not take over that accountability, and holding a risk assessment is not the same as being compliant.
The law does not require an operator to commission an assessment and file it. It requires risks to be actively managed, records maintained and the assessment reviewed when conditions change – such as a shift in occupancy, building works or an incident. Reviews can be missed when no single person is responsible for triggering them, so a completed assessment can give a false sense that the duty is done while the ongoing work lapses.
Legionella risk in a hotel can arise wherever a water system supports bacterial growth and creates breathable droplets: showers, hot tubs and spa pools, cooling towers, decorative fountains, HVAC humidification, infrequently used outlets and calorifiers or hot water storage.
Showers are the most familiar risk, but other sources matter too. Decorative fountains and humidification systems produce aerosol and should be included in the assessment, because the HSE identifies them as possible Legionella risk systems.
The sources to map across a hotel estate are:
- Showers release warm water as aerosol directly to guests and are a particular risk in low-occupancy rooms and during quiet periods.
- Hot tubs and spa pools are warm, aerated and heavily used; for commercial-type systems HSG282 indicates pH and disinfectant checks at opening and every two hours in use, with monthly microbiological testing and quarterly Legionella testing.
- Cooling towers and evaporative condensers release aerosol in high volume, may trigger local-authority notification under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, and are covered by HSG274 Part 1.
- Decorative fountains and water features release aerosol in guest-facing areas and should be included in the assessment as possible risk systems.
- HVAC humidification systems introduce mist into indoor air and should be included as possible risk systems.
- Infrequently used taps and outlets hold stagnant water at 20 to 45°C, the range that supports growth.
- Calorifiers and hot water storage – the cylinders and tanks holding hot water – increase risk if hot water is not stored at the required temperature and distributed so that outlets reach the target temperature within the specified time.
In each case the route is the same. Warm water forms an aerosol that a person then breathes in. Where the risk assessment calls for it, testing and water analysis helps confirm whether control measures are working.
Flushing taps and showers can reduce the concentration of Legionella in a given outlet temporarily, but it does not remove the bacteria from the system, does not treat the water and does not constitute a Legionella control plan.
Hotels that rely on flushing alone address the appearance of control rather than the risk itself; flushing is one control measure within a plan, never the plan itself. When flushing is the only measure in place, problems can build up unnoticed. A flushing record may be kept faithfully for months, the staff member who kept it leaves, and the control lapses while the log still reads as complete. To an auditor, a complete log can look like diligence even when no underlying control plan exists.
A written scheme of control for a UK hotel will vary by system, but should typically include:
- Temperature management: hot water stored at 60°C at the calorifier and distributed above 50°C at outlets within one minute, with cold water kept below 20°C. These limits keep water outside the temperature range in which Legionella multiplies.
- Written flushing records for all infrequently used outlets, with dates, outlet identifiers and responsible staff names.
- Regular water temperature monitoring with documented results.
- Biocide dosing and testing records for hot tubs and spa pools.
- Scheduled review of the risk assessment, plus immediate review after any incident, significant building change or extended closure.
- Clearly assigned responsible persons – named individuals who understand what they are responsible for, not just a role title.
Outlets not used for seven days or more should be included in a flushing regime, normally weekly or as the risk assessment indicates, and checked before reuse where a room or area has been inactive; this is a control measure, not a control plan.
HSG274 Part 2 sets out the regime for hot and cold water systems, and managers should be familiar with the monitoring frequencies it recommends, not only aware that the guidance exists.
Where temperature control is difficult, competent advice may identify supplementary treatments such as chlorine dioxide or copper-silver ionisation, with validation, monitoring and maintenance as set out in HSG274.
The guests most at risk from Legionella in hotels include older people, smokers and those with certain underlying health conditions, and hotels accommodate such guests without knowing which individuals are vulnerable.
The HSE says susceptibility increases with age. Higher-risk groups include people over 45; smokers and heavy drinkers; those with chronic respiratory, kidney, lung or heart conditions or diabetes; and people with an impaired immune system.
Consistent controls matter because guests cannot know whether a particular outlet or spa system has been properly managed before they use it.
What makes hotels different is that guests cannot easily verify the condition of the water system before use, so control depends on the operator’s arrangements. The protective duty rests with the operator and the appointed responsible person rather than the guest.
Hotels should control spa-pool Legionella risk through water treatment, cleaning, bather-load control, disinfectant and pH checks, microbiological monitoring, record-keeping and closure and recommissioning procedures, following HSG282 (HSE, 2017), which applies to hotel spa facilities.
Spa pools and hot tubs are among the higher-risk amenities in a hotel and can be under-managed. Spa-pool water is usually heated between 30 and 40°C, which sits within the 20–45°C range associated with Legionella growth, and aeration and jetting break it into fine aerosol droplets that bathers inhale.
Bather load can be underestimated. For example, a test at opening may not reflect conditions later in the day if bather load rises and disinfectant residuals fall, so checks should be frequent enough to detect that under heavy use.
Controlling a hotel spa to HSG282 expectations means:
- Checking disinfectant and pH at opening and at set intervals through the day, with frequency based on HSG282 and the risk assessment.
- Carrying out Legionella testing on a documented, risk-based schedule, typically at least quarterly.
- Keeping closure and recommissioning records whenever the spa pool is taken out of service and brought back.
Spa pools are commonly controlled with recognised disinfectants such as chlorine or bromine, with the regime and limits set by HSG282, the manufacturer’s instructions and the risk assessment. A spa-pool assessment that does not take HSG282 into account is likely to be difficult to defend as suitable and sufficient.
If Legionella is detected, or a case is linked to a hotel, the responsible person should follow the site incident procedure, seek competent advice and take remedial action.
Reporting under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR, 2013) depends on the circumstances, such as a diagnosed employee case or occupational exposure that meets the reporting criteria.
The responsible person should understand this sequence in advance rather than work it out during a live incident:
- Report under RIDDOR where the criteria are met, such as a work-related employee case linked to contaminated water systems, and cooperate with the local authority, environmental health and public health teams where guest exposure is suspected.
- Identify and isolate the source through systematic sampling, testing and tracing.
- Communicate clearly with guests who may have been exposed, keeping the message factual, prompt and coordinated with environmental health authorities.
- Maintain a full investigation log; these records may later form part of the evidence in an investigation, so keep them accurate, complete and contemporaneous.
Vague or delayed guest communication can make an incident harder to manage and harder to account for afterwards. Communication tends to break down when no one is clearly responsible for the notification decision and when record-keeping competes with managing the incident itself. Because many teams rarely practise this kind of incident response, the procedure is seldom tested until it is needed, so assigning decision-making authority in advance helps keep the response orderly.
A hotel does not become safe the moment a Legionella risk assessment is signed off. A completed document does not make an unused wing safe, because the conditions in the pipework continue regardless of what has been recorded.
The assessment identifies risk; management controls, monitoring records and staff competence are what actually reduce it. In a hotel, occupancy fluctuates and the level of risk can change quickly, so the assessment should be reviewed and updated rather than left unchanged. The responsible person can delegate the actions but never the accountability.
Turning a Legionella risk assessment into a working control programme depends on the people who run it day to day. Human Focus’s Legionella Risk Management training helps responsible persons and facilities teams understand Legionella duties, risk assessment, control schemes and records; it supports competence but does not replace a site-specific risk assessment or competent water-systems advice.
