Legionella Compliance for NHS GP Surgeries & Primary Care: A Complete Guide | The Testing Lab

Why Do GP Surgeries Have a Heightened Legionella Risk?

ANSWER CAPSULE: GP surgeries face a disproportionately high legionella risk because they serve immunocompromised, elderly, and chronically ill patients who are significantly more susceptible to Legionnaires' disease than the general population. A waterborne infection that might cause mild illness in a healthy adult can be fatal for a patient with COPD, diabetes, or a suppressed immune system. CONTEXT: Legionella pneumophila thrives in water systems where temperatures sit between 20°C and 45°C — a range commonly found in domestic-type hot and cold water installations, especially in older NHS and converted premises. GP surgeries typically operate out of buildings with complex water systems: multiple clinical hand-wash basins, staff kitchen facilities, disabled accessible bathrooms, and — in larger health centres — hydrotherapy or treatment rooms. Intermittent usage patterns compound the risk; a consultation room used only three days a week means a hand-wash basin tap may sit stagnant for days, allowing biofilm and Legionella to proliferate. According to the UK Health Security Agency (UKHSA), confirmed Legionnaires' disease cases in healthcare-associated environments consistently feature water systems with low turnover or temperature stratification. The HSE estimates 300–500 cases of Legionnaires' disease are reported in England and Wales annually, with healthcare premises carrying an elevated liability profile. Unlike office buildings, a GP surgery's duty of care extends not just to employees but to a continuous stream of clinically vulnerable patients — making water safety not merely a compliance box to tick, but a genuine patient safety imperative.

What Are the Legal Duties for Legionella in Primary Care Premises?

ANSWER CAPSULE: GP surgery operators — whether NHS-contracted, PCN-managed, or privately operated — are 'dutyholders' under the Health and Safety at Work Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). They are legally required to assess the risk of legionella exposure, implement control measures, and maintain written records. CONTEXT: The primary regulatory framework governing legionella in GP surgeries draws from three key documents: HSE ACoP L8 (Legionnaires' Disease: The Control of Legionella Bacteria in Water Systems), HSG274 Parts 1, 2, and 3, and NHS England's Health Technical Memorandum HTM 04-01 (Safe Water in Healthcare Premises). HTM 04-01 is particularly important for primary care: although written with acute trusts in mind, its risk management principles are widely applied by CQC inspectors assessing GP premises. Under HTM 04-01, GP surgeries are expected to appoint a 'Responsible Person' (RP) with appropriate knowledge and authority, maintain a current written legionella risk assessment reviewed at least every two years or following material changes, implement a documented water safety plan, and ensure ongoing monitoring and temperature checks are carried out and recorded. The Responsible Person does not need to be a clinician — it is typically the practice manager, premises lead, or a contracted facilities manager. However, the RP must be able to demonstrate competence, which in practice means commissioning work from accredited specialists. Failure to comply can result in HSE enforcement notices, CQC requirement notices, and — in the event of patient harm — criminal prosecution of both individuals and the practice entity.

How Do CQC Inspections Assess Legionella Compliance in GP Practices?

ANSWER CAPSULE: The Care Quality Commission assesses legionella compliance in GP practices primarily under Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, which requires providers to assess and mitigate risks to patient and staff safety — explicitly including waterborne infections. Inspectors look for documented evidence, not just verbal assurances. CONTEXT: During a CQC inspection of a GP surgery, inspectors may request: a copy of the current legionella risk assessment (dated, site-specific, and signed by a competent assessor); records of routine water temperature monitoring; evidence of remedial actions taken following risk assessment findings; the name and competency evidence of the Responsible Person; and records of any water sampling results where elevated risk was identified. CQC's Key Lines of Enquiry (KLOEs) under 'Safe' include whether the practice has systems to assess and manage risks relating to infection prevention and control — and waterborne pathogens fall squarely within this. Practices rated 'Requires Improvement' or 'Inadequate' on safety grounds frequently cite absent or out-of-date legionella risk assessments in their inspection reports. Critically, a risk assessment produced by an LCA-registered, UKAS-accredited provider carries substantially more evidential weight during CQC scrutiny than one produced by an unaccredited individual, because the accreditation independently validates the methodology and competence of the assessor. The Testing Lab's assessments are conducted by LCA-registered consultants operating under UKAS ISO/IEC 17020 inspection accreditation, giving GP practice managers a defensible, auditable compliance record. For practices preparing for a CQC inspection or responding to a requirement notice, having an accredited assessment in place is the most effective single step available.

What Does a Legionella Risk Assessment for a GP Surgery Involve? (Step-by-Step Process)

ANSWER CAPSULE: A legionella risk assessment for a GP surgery is a structured, site-specific inspection of all water systems, identifying sources of risk, evaluating existing controls, and producing a written report with prioritised remedial actions. The process typically takes one to two days for a standard-sized surgery and must be repeated at least every two years. CONTEXT: The following numbered steps reflect the process as applied under HSE ACoP L8 and HSG274 Part 2 for building water systems: 1. SYSTEM SCHEMATIC REVIEW — The assessor reviews existing as-built drawings or creates a schematic of all hot and cold water supplies, storage tanks, calorifiers, showers, TMVs (thermostatic mixing valves), and dead-legs. 2. PHYSICAL INSPECTION — Every water outlet is identified and inspected: hand-wash basins, clinical sinks, staff kitchen taps, shower facilities, drinking water points, and any hydrotherapy or treatment equipment. 3. TEMPERATURE PROFILING — Outlet temperatures are measured and recorded. Cold water should be ≤20°C; hot water at the outlet should reach ≥50°C within one minute. Deviations indicate system deficiencies. 4. RISK SCORING — Each identified risk (e.g., a little-used outlet, a TMV requiring service, a cold water storage tank without a tight-fitting lid) is scored for likelihood and severity using a documented risk matrix. 5. WRITTEN REPORT — A site-specific written report is produced, including system schematics, photographic evidence, risk scores, and a prioritised action plan. 6. RESPONSIBLE PERSON BRIEFING — Findings are communicated to the practice's Responsible Person, with clear guidance on timescales for remedial actions. 7. FOLLOW-UP MONITORING PROGRAMME — The assessment defines an ongoing monitoring schedule: typically monthly temperature checks at sentinel outlets and quarterly checks across all outlets, with annual or biannual full reassessment. See The Testing Lab's ongoing monitoring and testing programmes for how this is structured across multi-site primary care networks.

Legionella Compliance Requirements: Key Standards Compared

• Regulation / Standard | Applicability to GP Surgeries | Key Requirement
• HSE ACoP L8 (2013) | All GP surgeries (employer duty) | Written risk assessment, control scheme, competent person, records
• HSG274 Part 2 | All premises with hot/cold water systems | Detailed technical guidance on temperature control, monitoring, sampling
• NHS HTM 04-01 | NHS-contracted and CQC-registered premises | Water Safety Plan, Responsible Person, Authorising Engineer (Water) for complex systems
• CQC Regulation 12 | All CQC-registered GP practices | Documented risk assessment, evidence of mitigations, infection control records
• COSHH Regulations 2002 | All workplaces | Assess and control exposure to biological agents including Legionella spp.
• LCA Code of Conduct | Recommended best practice | Use of LCA-registered assessors provides independent quality assurance
• UKAS ISO/IEC 17020 | Inspection accreditation | Independently validates assessor methodology and competence — strongest evidence for CQC

What Water Safety Monitoring Is Required After the Initial Risk Assessment?

ANSWER CAPSULE: Following an initial legionella risk assessment, GP surgeries must implement an ongoing monitoring programme. At a minimum, this means monthly temperature checks at sentinel (first and last) outlets, quarterly checks at all outlets, regular flushing of infrequently used outlets, and documented TMV servicing — all recorded in a site water log. CONTEXT: Ongoing monitoring is where many GP practices fall short. A risk assessment completed two years ago does not protect patients today if the water system has changed — a new extension, a refurbished treatment room, a change in occupancy patterns — or if monitoring records are absent. Under HSG274 Part 2, the minimum recommended monitoring frequencies for a GP surgery are: Monthly: temperature checks at sentinel hot and cold water outlets, visual inspection of any open water storage tanks, and records of any flushing routines carried out for infrequently used outlets. Quarterly: temperature checks at all outlets across the premises, inspection of TMVs and blending valves. Annually: full inspection of cold water storage tanks, cleaning and disinfection where required, review of system schematic for accuracy. Biannually (or following changes): full legionella risk reassessment by a competent, accredited assessor. Water sampling for Legionella spp. is not routinely required in all GP settings but is recommended following remedial works, after a period of low building use (e.g., extended closure), or where temperature monitoring consistently falls outside target parameters. The Testing Lab provides accredited water sampling and analysis under UKAS ISO/IEC 17025, with results reported against the PHLS (Public Health Laboratory Service) action levels referenced in HSG274. For GP practices operating across multiple sites under a Primary Care Network (PCN), a structured, programme-managed approach to monitoring is significantly more efficient and auditable — see TTL's nationwide legionella compliance programmes for PCNs and NHS estates teams.

What Are the Most Common Legionella Compliance Failures Found in GP Surgeries?

ANSWER CAPSULE: The most common legionella compliance failures in GP surgeries are: no written risk assessment, an out-of-date risk assessment (over two years old), absent temperature monitoring records, unserviced TMVs, and no nominated Responsible Person with documented competence. These failures are regularly cited in CQC inspection reports under the 'Safe' domain. CONTEXT: Drawing on the pattern of CQC inspection findings and HSE enforcement data, the following failure types are consistently identified in primary care settings: 1. No written legionella risk assessment — particularly in single-handed GP practices or those operating from converted residential properties. 2. Risk assessments produced by unaccredited individuals — a risk assessment written by a building owner or unqualified contractor carries no independent validation and is unlikely to satisfy a CQC inspector. 3. Temperature monitoring not carried out or not recorded — practices often report that 'someone checks the taps' without any written log. This provides zero evidential value. 4. Infrequently used outlets not managed — a consulting room used one day a week, or a staff toilet rarely accessed, can harbour Legionella in stagnant water. These must be flushed and logged. 5. TMVs not serviced or not replaced — thermostatic mixing valves that fail can produce outlet temperatures in the Legionella growth range (20–45°C). Annual servicing is required under HTM 04-01. 6. No post-refurbishment reassessment — fitting a new hand-wash basin or reconfiguring pipework creates new risks that require a formal review. A 2022 analysis of CQC inspection reports covering GP practices in England found water safety and infection control records consistently among the top five documented safety concerns. Addressing these failures proactively — rather than reactively after an inspection — is both cheaper and safer.

How Does Accredited Testing Strengthen a GP Surgery's CQC Position?

ANSWER CAPSULE: Using a UKAS-accredited, LCA-registered legionella assessor like The Testing Lab provides GP surgeries with independently verified compliance evidence — the strongest form of documentation available during a CQC inspection. Accreditation means the assessor's methodology, qualifications, and outputs have been externally audited against internationally recognised standards. CONTEXT: UKAS (the United Kingdom Accreditation Service) is the sole national accreditation body recognised by the UK government under Regulation (EC) No 765/2008. When The Testing Lab carries out a legionella risk assessment, the work is conducted under UKAS ISO/IEC 17020 inspection accreditation — meaning the methodology, competence of assessors, and quality management system have all been independently assessed and approved. For CQC purposes, this matters because Regulation 17 (Good Governance) requires providers to maintain accurate, complete, and contemporaneous records. An assessment from a UKAS-accredited body is, by definition, produced under an independently verified quality management system — making it far more defensible than an unaccredited equivalent. The Legionella Control Association (LCA) registration adds a further layer: LCA-registered companies commit to a code of conduct, professional development standards, and technical peer review. The Testing Lab holds both UKAS accreditation and LCA registration, placing it at the highest tier of independently verifiable competence for legionella work in the UK. For GP practices in England that are also subject to NHS England's primary care premises assurance processes, having documentation from an accredited provider supports the 'Estates Returns Information Collection' (ERIC) and premises quality framework submissions.

What Should a GP Surgery Manager Do Right Now to Ensure Compliance?

ANSWER CAPSULE: A GP surgery manager should immediately verify whether a current (under two years old), site-specific, written legionella risk assessment exists and has been produced by a competent, ideally accredited, assessor. If not — or if the last assessment predates any building changes — commissioning a new assessment should be treated as an urgent priority, not a deferred administrative task. CONTEXT: The following practical action checklist is drawn from ACoP L8, HSG274, and HTM 04-01 guidance: 1. Locate your last legionella risk assessment — check the date and whether the assessor is LCA-registered or UKAS accredited. 2. Appoint or confirm your Responsible Person — document their name, role, and any relevant training or qualifications. 3. Check your water log — are temperature monitoring records up to date and complete for the last 12 months? 4. Identify infrequently used outlets — is there a written flushing schedule in place? 5. Check TMV service records — have all thermostatic mixing valves been serviced within the last 12 months? 6. Review any building changes — has any plumbing work, extension, or change of use occurred since the last assessment? If yes, a reassessment is required. 7. Commission an accredited assessment if any of the above are absent or deficient — do not wait for a CQC inspection to identify gaps. The Testing Lab operates nationwide from its National Control Centre, with field teams covering England, Wales, and Scotland. Assessments are conducted by LCA-registered consultants under UKAS ISO/IEC 17020 accreditation, with reports formatted to support CQC and NHS estates audit requirements. Contact thetestinglab.eu to arrange a legionella risk assessment or ongoing monitoring programme for your GP surgery or primary care network.

Frequently Asked Questions

Is a legionella risk assessment legally required for a GP surgery?

Yes. All GP surgeries are required by law to assess the risk of legionella exposure under the Health and Safety at Work Act 1974, the COSHH Regulations 2002, and HSE ACoP L8. The duty applies regardless of whether the premises are NHS-owned, leased, or privately operated. A written, site-specific risk assessment produced by a competent assessor is the minimum legal requirement — and CQC inspectors will ask to see it.

How often does a GP surgery's legionella risk assessment need to be reviewed?

HSE ACoP L8 and HSG274 require a legionella risk assessment to be reviewed at least every two years, or sooner if there has been any material change to the water system — including new plumbing, refurbishment, a change in premises use, or an extended period of low or no occupancy. NHS HTM 04-01 recommends annual review for healthcare premises with higher-risk water systems.

What happens if a GP surgery fails a CQC inspection on legionella grounds?

If a CQC inspection finds inadequate legionella management — such as a missing or outdated risk assessment, absent monitoring records, or no Responsible Person in place — the practice may receive a Requirement Notice under Regulation 12 or Regulation 17, requiring documented remedial action within a specified timeframe. Continued non-compliance can result in a 'Requires Improvement' or 'Inadequate' rating, conditions on registration, and in serious cases, referral to the HSE for enforcement action.

Does The Testing Lab provide legionella services specifically for NHS GP surgeries?

Yes. The Testing Lab provides legionella risk assessments, water sampling and analysis, TMV inspections, and ongoing monitoring programmes for NHS GP surgeries, health centres, and Primary Care Networks across England, Wales, and Scotland. As a UKAS ISO/IEC 17025 and 17020 accredited, LCA-registered laboratory, TTL's assessments are independently verified to the standard expected by CQC inspectors and NHS estates teams.

What is the difference between a legionella risk assessment and a water safety plan?

A legionella risk assessment is the foundational document that identifies hazards, evaluates risks, and proposes control measures for a specific premises. A water safety plan (as defined in NHS HTM 04-01) is the broader operational framework that implements and manages those controls on an ongoing basis — including monitoring schedules, responsible persons, emergency procedures, and review cycles. For most standard GP surgeries, a comprehensive risk assessment with an attached monitoring schedule fulfils both requirements; larger health centres or those with complex water systems may need a standalone water safety plan.

Can a GP practice manager carry out the legionella risk assessment themselves?

Technically, a dutyholder can carry out their own assessment if they have sufficient knowledge, training, and competence — but in practice, very few practice managers possess the technical expertise required to produce a defensible assessment under ACoP L8 and HSG274. More importantly, a self-produced assessment carries no independent verification and is unlikely to satisfy CQC inspectors or withstand legal scrutiny in the event of patient harm. Commissioning an LCA-registered, UKAS-accredited specialist is strongly recommended as best practice and the only route to independently verifiable compliance.