Legionella in Ireland: Employer Duties Under the HSA Biological Agents Regulations

Legionella is a bacterium that can grow in man-made water systems, and an employer who controls those systems in Ireland needs a written risk assessment and a plan to keep the bacteria in check. The Health and Safety Authority (HSA) treats Legionella as a group 2 biological agent, so the Biological Agents Regulations 2013 (S.I. No. 572 of 2013) apply alongside the Safety, Health and Welfare at Work Act 2005. This guide sets out what the HSA and the Health Protection Surveillance Centre (HPSC) say, for Dublin employers and for employers everywhere else in the State, because the law is national.

Many workplaces assume Legionella is a problem only for cooling towers or hospitals. The HSA's information sheet says otherwise: ordinary hot and cold water systems, showers and taps can be sources. If you already work from the Biological Agents Regulations as they apply to healthcare workers, this post applies the same framework to water systems.

What Legionella is and why it matters at work

According to the HSA's Legionnaires' Disease Information Sheet (published March 2008), Legionnaires' disease is a potentially fatal form of pneumonia. People catch it by breathing in aerosols or droplets that carry elevated concentrations of the bacteria. The sheet says it is not contagious and does not pass from person to person. The HPSC's legionellosis page (guidance last reviewed 20 July 2023, data updated 19 September 2025) also states there is no evidence of person-to-person spread, and that it is a notifiable disease in Ireland.

The HSA sheet says the bacteria occur in low numbers in natural water, so it is "virtually impossible" to stop them entering man-made systems. The aim is therefore to stop them multiplying and to limit the release of spray. It describes growth between 20°C and 45°C, with 60°C as a temperature that kills them. It says people at higher risk include those over 45, smokers, males and people with an impaired immune system.

Which legal duties apply

Three layers are relevant. The HPSC 2009 guidelines note that the 2005 Act does not specifically refer to Legionella.

• The 2005 Act. The HSA sheet explains that an employer's safety statement must be based on hazard identification and risk assessment, which should include the risk of Legionella exposure where relevant. Anyone in control of part of a workplace, such as a management company running building water services, must assess the risk to people who are not their employees. Our guide to the safety statement and risk assessment requirements covers that base duty.
• The Biological Agents Regulations 2013. The text of the Regulations on the HSA site defines biological agents in four risk groups and applies to activities where exposure "has occurred or may occur", whether deliberate or incidental. Regulation 7 requires the employer to assess any existing or potential risk, including its nature, degree and duration, to keep that assessment in written form, and to review and amend it as often as necessary, including when conditions change. The Regulations also require sufficient, appropriate information and training before work begins, and immediate notification to the HSA of an accident or incident that may have released a biological agent and could cause severe infection. The HSA's Code of Practice for the 2013 Regulations (published February 2014) lists Legionella pneumophila and Legionella spp. as group 2.
• The General Application Regulations 2007. The HSA sheet points to Part 2, Chapter 2, for inspection, testing and records for work equipment, including water systems, and says inspection and test records must be kept for five years from the inspection date. A separate HSA cooling tower sheet (January 2014) cites Regulations 29 and 30.

One caution. The HSA sheet and the HPSC national guidelines (2009) were written when the 1994 Biological Agents Regulations were in force and cite them. The 2013 Regulations replaced the 1994 Regulations, so quote those, and check the Irish Statute Book for the current version.

Carrying out the Legionella risk assessment

The HSA sheet says the assessment must be written, made by a competent person, and made in consultation with employees. The depth should match the system: simple for a low-risk set-up and very detailed for a complex one such as a cooling tower. It sets out a sequence:

• Identify sources. Look at the water supply, storage, pipework, condition and design, and infrequently used outlets. The sheet lists sources including hot and cold water systems (showers, eye washes, taps), wet cooling towers and evaporative condensers, spa pools, humidifiers, fountains, sprinkler and hose-reel systems and vehicle washes. It stresses that the whole system should be assessed, not one component.
• Decide who could be harmed. Consider susceptible employees, members of the public, and how long and how often people are exposed.
• Decide controls, record them and review. Write down the control scheme and the action to take if controls fail. Review after significant changes to plant, the building, water treatment or personnel.

The HPSC national guidelines (2009) add that the assessment should be written, include a system description and management arrangements, and be reviewed regularly, "at least annually", and also after changes or a related case. Both documents are dated, so check for current versions before adopting them.

Control measures that the sources describe

The HSA sheet lists these controls, starting with avoiding the risk where possible:

• Avoid the risk where possible, for example by replacing a wet cooling system with dry cooling.
• Remove dead legs and blind ends so water does not stagnate.
• Control aerosol release, for example with drift eliminators on cooling towers.
• Inhibit growth by insulating pipework, keeping cold pipes away from heat, avoiding growth temperatures, using biocides or other treatment where suitable, and keeping systems clean and free of scale and corrosion.
• Train staff and give clear instructions, appoint a person to manage the controls, and use competent contractors.

On temperatures, the Irish documents do not all use the same figures, and some are dated. The HSA school risk assessment template says to store hot water above 60°C, distribute it above 50°C and keep cold water below 20°C. The HSE healthcare water guidelines (approved October 2014) recommend hot water leaving the calorifier above 60°C, returning no lower than 50°C and circulating at 55°C, with cold water below 20°C. The HPSC 2009 guidelines state water should be below 20°C or above 50°C. Treat these as published guidance, not a statutory limit, and check the current figure on the official page before writing it into your plan.

For rooms or outlets that are rarely used, the HSA template suggests flushing at least weekly and recording it, or safely purging before use, such as after a holiday. The HSA's note on closed buildings says shut-down or lightly used systems in most cases cannot simply be used straight away and may require recommissioning as if new, which can include thorough flushing, cleaning and disinfection, and that a review of the risk assessment should also be considered.

A practical approach (our suggestion, not a legal requirement): keep a single log for temperature checks, flushing, tank inspections and contractor visits, and name a deputy for the responsible person so checks do not lapse during leave.

Cooling towers and other higher-risk systems

The HSA's cooling tower information sheet (January 2014) states that cooling towers can generate sprays that spread widely and that maintenance staff may face higher exposure. It names drift eliminators, chemical treatment and routine microbiological monitoring of the total viable count as important controls. The sheet gives no inspection or testing frequencies and says nothing about notifying an authority of a tower, so do not assume a fixed interval from this document alone. Seek competent advice for the design and monitoring plan.

Care settings and healthcare premises

For hospitals and long-stay facilities the HSE's guidelines on water systems in healthcare facilities (approved October 2014) go further. They say every facility should have a water safety plan with a risk assessment and up-to-date schematics, that the facility manager has overall responsibility, and that an Environmental Monitoring Committee should review performance at least annually and advise on at-risk locations. They recommend twice-yearly Legionella sampling at such locations, and daily flushing of rarely used outlets in augmented care units. They stress that immunocompromised and high-dependency patients are at greatest risk.

The excerpt we read did not set out requirements for small residential or nursing homes specifically, so smaller care providers should apply the general risk assessment duties, use the healthcare guidance as a reference, and ask their competent person which parts fit their premises.

Cases, incidents and records

Legionellosis is notifiable by clinicians and laboratories to the Medical Officer of Health under infectious disease notification rules, according to the HPSC. That is separate from your own duties. If an incident may have released a biological agent and could cause severe infection, the 2013 Regulations require immediate notification to the HSA. Whether a particular event also falls under general incident rules is explained in our guide to accident and dangerous occurrence reporting, and we recommend asking the HSA if you are unsure. Keep inspection and test records for at least five years from the date of inspection, as the HSA sheet and Regulation 30 of the General Application Regulations 2007 provide, and keep your written risk assessment and system schematic up to date and available to an HSA inspector.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is there an Irish law that specifically requires a Legionella risk assessment?

The HPSC guidelines note that the 2005 Act does not name Legionella. The duty comes from the general risk assessment requirement in the 2005 Act and from the Biological Agents Regulations 2013, which treat Legionella as a group 2 agent and require a written assessment.

How often must we review the assessment?

The 2013 Regulations require review as often as necessary and whenever conditions change. The HPSC 2009 guidelines suggest at least annually. The HSA sheet adds review after changes to plant, building, treatment or personnel.

Does a small office need to do anything?

The HSA says the level of detail should match the system. A simple system still needs a written assessment by a competent person. The sources reviewed do not set a different rule for small offices.

What temperature must hot water be stored at?

The sources give no single legal figure. HSA and HSE documents give guidance values, listed above and dated. Check the current figure on the official page.

Who should we ask for help?

The HSA sheet lists the HSA Workplace Contact Unit and the HPSC as contacts. A competent person with experience of water systems should carry out the assessment.

Managing Legionella comes down to knowing your systems, writing the assessment down, keeping water moving and out of the growth range, and keeping records you can show an inspector.