CQC Water Safety Compliance: What Providers Must Show
To meet CQC expectations on water safety, you need a current Legionella risk assessment, a named person responsible for controlling it, completed actions from that assessment, and records that prove the controls are working. CQC assesses this mainly under Regulation 12 (Safe care and treatment) and Regulation 15 (Premises and equipment). This guide sets out what that means in practice for care homes, dental and GP surgeries and other registered services in England, and which records to have ready on inspection day.
TL;DR
CQC expects a legal Legionella risk assessment, a responsible person, completed remedial actions and records of maintenance, temperatures, cleaning and remedial work.
Accountability stays with the duty holder. You can hire contractors, but you cannot hand the responsibility to them.
Review the risk assessment at least annually, and sooner after specified changes or a suspected case.
Keep monitoring and test records for at least five years, and other records such as risk assessments for at least two years after they stop being current.
Schools, colleges and offices fall outside CQC, but the same Health and Safety Executive (HSE) duties apply to them.
Table of Contents
What CQC actually expects
CQC’s own guidance on Legionella is short and clear. Providers must have a legal Legionella risk assessment, assign someone to be responsible for control, complete the actions the assessment identifies, and keep records of the assessment, maintenance, temperature monitoring, cleaning and remedial work. The same page says the assessment should be reviewed annually, or sooner when specified changes or a suspected case occur.
Care homes and oral health services must also submit a Legionella risk assessment with their registration application. If you are applying to register a new location, the assessment has to exist before you open, not after.
The wider test sits in Regulation 12: providers must do all that is reasonably practicable to mitigate risks, and should follow good-practice guidance. In water safety terms, “good practice” means the HSE and healthcare technical documents covered below.
The laws and guidance behind the inspection
CQC does not write its own Legionella rules. It inspects against existing law and guidance. The main pieces are:
Source | What it covers | Who it matters to |
Health and Safety at Work etc. Act 1974 and COSHH | The legal duty to assess and control the risk from Legionella | Every employer and person in control of premises |
HSE L8 approved code of practice and HSG274 | How to identify, assess and control the risk in water systems | All premises with water systems |
Safe water in healthcare premises | Hospitals, clinics, surgeries and other healthcare settings | |
Code of practice for Water Safety Plans | Premises with water systems that pose a risk |
CQC assesses against Regulations 12 and 15 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. A Legionella failure is therefore never only an HSE matter for a registered provider. It is also a question about whether care and treatment is safe and whether the premises and equipment are fit for purpose.
Who is responsible
This is where many providers get caught out. Under HTM 04-01, the statutory duty holder, meaning the employer or person in control of the premises, holds ultimate responsibility. Accountability cannot be delegated, even when staff or contractors carry out the work, and a competent person should be appointed.
Two practical points follow:
Leased premises do not remove the duty. CQC states that a provider that does not own or manage its building is still responsible for Legionella control. If your landlord says the water system is theirs, agree in writing who does what, and keep a copy.
The responsible person needs real authority. HSE’s code says the appointed person should have sufficient authority, competence and knowledge of the installation to make sure procedures are carried out effectively and on time. A name on a form is not enough if that person cannot book a contractor or approve remedial work.
In larger healthcare organisations, HTM 04-01 goes further and recommends a Water Safety Group to commission, develop, implement and review a Water Safety Plan.
What a compliant risk assessment and control programme includes
CQC says a risk assessment should map your water systems, identify risks such as stagnation and inadequate temperatures, and describe the controls, including flushing and temperature monitoring. A good assessment is specific to your building: it names outlets, tanks, calorifiers and TMVs, and says what is to be done, how often, and by whom.
Temperature control
HTM 04-01 recommends keeping cold water below 20°C and storing hot water at 60°C or higher, with hot water reaching outlets at 55°C within one minute. Those figures are the baseline your monitoring records should be measured against. Where thermostatic mixing valves protect vulnerable residents or patients from scalding, they need regular servicing as well, because a valve that is not maintained can become a place where bacteria grow.
Stagnation and flushing
Stagnant water favours Legionella growth. HSE advises removing dead legs and flushing infrequently used outlets at least weekly. This matters for rooms that are empty for stretches: a spare bedroom in a care home, a treatment room used one day a week, or a sluice that is rarely run. Our guide on why stagnant water causes Legionella explains how to spot these outlets on a site walk.
Water Safety Plans
BS 8680:2020 describes a Water Safety Plan as the most effective way of consistently ensuring water safety, covering biological, chemical, physical and radiological hazards. Not every small provider needs a full plan, but the thinking is useful: treat Legionella as one hazard within a wider approach to water quality.
Sampling
Risk assessments and temperature checks show whether controls are in place. Sampling shows whether they are working. For NHS sites, the sampling pattern under HTM 04-01 is covered in our post on when NHS sites must sample under HTM 04-01. For other providers, the risk assessment should say whether, where and how often to sample.
Records inspectors may ask to see
CQC says inspectors may request the risk assessment, maintenance logs, temperature records, cleaning and disinfection schedules, and remedial action plans. It also expects evidence that staff are trained to recognise risks, carry out basic checks and report issues promptly.
A simple inspection-ready file looks like this:
The current Legionella risk assessment, with the date and the name of the assessor.
The action plan from that assessment, with each item marked open, scheduled or closed, and the date.
Your written scheme: who checks what, and how often.
Temperature records for hot and cold outlets, plus calorifier and tank readings where relevant.
Flushing records for low-use outlets.
Cleaning and disinfection records for tanks, showerheads and hoses.
TMV service records.
Sampling results and what you did about any failures.
Training records for the responsible person and staff who carry out checks.
On retention, HSE’s code says the significant findings of a risk assessment must be recorded where you have five or more employees. It also says monitoring and test records should be kept for at least five years, and other records, such as risk assessments, for at least two years after they stop being current. A tidy Legionella logbook keeps these in one place, so you are not hunting through emails when an inspector asks.
What happens if you fall short
The consequences are not theoretical. CQC says it can prosecute for a breach of Regulation 12 where a failure results in avoidable harm or significant risk of harm, and it may take other regulatory action as well. In practice, the usual first sign of trouble is a finding in an inspection report that your assessment is out of date, actions are open, or records have gaps. Those are all avoidable with a routine.
Care providers versus schools, colleges and other premises
CQC only regulates providers of health and social care. Care homes, dental practices, GP surgeries, clinics and similar services have to show CQC that they are controlling Legionella. A school, college, university or office is not inspected by CQC on this, but the same legal duty applies: the employer or person in control of the premises must assess and control the risk under health and safety law, following the HSE’s approved code of practice.
The differences in practice are these:
Guidance. Healthcare providers also work from HTM 04-01, written for healthcare premises. Schools and offices work mainly from L8 and HSG274.
Who checks. For CQC-registered services, the inspector can ask for your water safety evidence during an assessment. For education and commercial premises, enforcement comes through the HSE or the local authority, and the pressure often comes from insurers, governors and landlords.
Vulnerability of users. Residents and patients are more likely to be vulnerable to infection, so expect a higher bar on monitoring, sampling and TMV management in care settings.
Occupancy patterns. Schools and colleges have long holidays, which creates a stagnation risk. Plan a flushing and temperature check before reopening, and keep a record of it.
If you run a mixed site, for example a care home with an office wing, treat the whole water system as one and assess it together. Our page on Legionella compliance for offices and commercial premises covers the non-clinical side.
A practical annual routine
Compliance is a routine, not a project. A simple rhythm:
Weekly: flush low-use outlets and record it.
Monthly: check temperatures at representative hot and cold outlets, and at tanks and calorifiers. Record exceptions and what you did.
Quarterly or as the assessment says: inspect showerheads and hoses, descale and disinfect where needed, and service TMVs on the schedule your assessment sets.
Annually: review the risk assessment. See our guide to reviewing a Legionella risk assessment for what a good review covers.
After any change: a refurbishment, a change of use, a new tank or a suspected case should trigger an earlier review.
The exact frequencies must come from your own assessment, because they depend on your system. Treat the list above as a pattern, not a substitute.
Perspective
Most CQC water safety problems we see are not about a failed test. They are about a gap in the paperwork: an assessment that has not been reviewed, actions that were agreed and never closed, or temperature checks done but never written down. That is why we build our work around the evidence trail. A risk assessment tailored to your site tells you what to do. A logbook system, ongoing consultancy and, where it suits, automated temperature monitoring keep the proof of it in one place, ready when an inspector asks. Compliance does not need to be complicated. Know your systems, name a responsible person who has the authority to act, close actions promptly and keep the records. Do those four things and an inspection becomes a conversation about what you already do. Sammi
How Bespoke Compliance Solutions can help
We provide specialist Legionella and water hygiene support to organisations across the UK, including healthcare providers, housing associations, schools and commercial sites. Our Legionella risk assessments start from £185 one-off, and our water testing and analysis starts from £55 per sample.
[
Beyond the assessment, we can support the work that closes your action plan: Legionella awareness training for the staff who do the checks, automated water temperature monitoring for continuous records, and tank cleaning, disinfection and ongoing maintenance contracts. TMV servicing and general remedial works are on our compliance services page. Talk to us before your next inspection, not after it.
FAQ
Does CQC require a Legionella risk assessment?
Yes. CQC expects providers to have a legal Legionella risk assessment, to act on what it finds and to keep records. Care homes and oral health services must submit one with their registration application.
How often should the risk assessment be reviewed?
CQC expects at least an annual review. You should review it sooner after specified changes to the water system or building, or after a suspected case of Legionnaires’ disease.
Can we pass responsibility to our landlord or contractor?
No. Even if you do not own or manage your premises, you remain responsible for Legionella control. You can appoint contractors to do the work, but accountability stays with the duty holder.
How long should we keep water safety records?
HSE’s code says to keep monitoring and test records for at least five years. Keep other records, such as risk assessments, for at least two years after they stop being current.
Does this apply to schools and colleges?
CQC does not inspect schools or colleges, but the same health and safety duty to assess and control Legionella applies. They follow HSE’s code of practice and guidance rather than healthcare-specific CQC expectations.
Sources
Recommended
Comments