Yes, digital water hygiene records are acceptable — if they're authenticated

Yes. Digital water hygiene records are acceptable, and nothing in HSE guidance says otherwise. The confusion comes from firms reading a duty to authenticate records as a duty to keep them on paper. Those are not the same thing, and the second one was never written down.

HSE's record-keeping guidance sets three tests, and paper only ever met them by convention. Records must be authenticated: the guidance says they should be "signed, verified, or authenticated by a signature or other appropriate means". They must be retained, monitoring records for at least five years and general records while current plus two years after. And they must be available, meaning readily accessible to everyone involved and ready to produce for an inspection. Meet those three and the format is your choice. Electronic legionella logbooks are an accepted practice the industry has been discussing for years.

The authentication test is the one that decides it

Read the phrase again: "signed, verified, or authenticated by a signature or other appropriate means". The words "other appropriate means" are the whole permission slip for digital. A wet-ink signature is one way to tie a record to a person. A login that stamps every reading with who entered it and when is another, and arguably a stronger one, because it also captures the when and resists a quiet edit later.

What the guidance is really asking is whether you can prove who stands behind a given record. A digital system passes when every entry carries an identity and a timestamp that the person entering it can't silently change afterwards. Paper passes only when someone remembered to initial it. The prosecution of BUPA Care Homes, fined £3,000,000 after a resident's death, turned partly on faked records and an untrained manager, which is the authentication test failing in the worst way, on paper, not a point against digital.

"Authenticated" doesn't mean a qualified electronic signature

There's a fear that runs the other way, that "authenticated" must imply some formal cryptographic signature scheme with certificates and legal machinery bolted on. It doesn't. The guidance says "other appropriate means", and the bar it sets is proof of who stands behind the record, not a particular technology. A named login that stamps the entry, on a system the engineer can't rewrite without trace, is an appropriate means. You don't need a qualified electronic signature, a notary, or a blockchain. Reaching for any of those is solving a problem the guidance never set, and usually at the cost of the one thing that matters in the field: an engineer being able to record a reading in thirty seconds with cold hands.

What a digital system has to do to clear the bar

Being electronic isn't enough on its own. To actually satisfy the three tests, a system needs to:

• Attribute every record to a named person, not to "the office" or a shared login.
• Timestamp at the point of capture, not the point of upload. A reading taken in a basement at 9am and synced at 5pm is a 9am reading.
• Resist silent editing. If a number is corrected, the correction is visible and attributed, and the original isn't overwritten without trace.
• Export cleanly, so an auditor or inspector can read the records without owning your software.
• Organise by site and by asset, so "show me this calorifier's history" is a query and not an afternoon.

A system that does these does everything paper did for authentication, and several things paper never could. Paper never timestamped a reading, and it never told you who rubbed a number out.

Where paper fails the same tests

It's only fair to hold paper to the identical standard, and it doesn't always pass:

• A monitoring sheet with no initials against half its rows fails the authentication test as surely as any database would.
• One paper copy, in one van, that left the company with the engineer who quit, fails the availability test.
• Thermal printouts that fade towards blank within a couple of years fail the retention test from the inside, quietly, while still sitting in the folder.

Paper has real virtues. It needs no battery and no signal, and anyone can read it without an account. But measured against HSE's own three tests, it passes out of habit rather than by design, and its failures tend to be invisible until someone goes looking.

Availability is tested in the room, not in theory

Availability has a test most firms never rehearse. An inspector or an assessor turns up, names a site, and wants the last two years of monitoring for it now, not emailed next week. Paper passes if the right folder is in the building and not in a van thirty miles away. A digital system passes if someone can log in and produce it on the spot, which also means the login has to work when the person who normally holds it is on leave. Knowing where records live, and making sure more than one person can reach them, is part of the availability duty rather than an afterthought. The medium doesn't decide this. Whether anyone rehearsed the "produce it now" moment does.

What auditors want, whatever the medium

An LCA assessor and an HSE inspector ask questions of the same shape: who did what, when, against which asset, and what happened next. Change the medium and the questions don't move. The last one, what happened next, is where both paper and weak software fall down, a failed temperature reading recorded with no trace of the action it should have triggered. Digital doesn't fix that by itself. It only makes the missing follow-up easier to spot. For the fuller picture of an audit day, see what the LCA auditor actually asks to see; for what the logbook itself must contain, our logbook requirements guide lays it out.

How BlueWave answers the three tests

BlueWave records carry a named identity and a capture-time timestamp on every entry, keep a visible history against each asset, and turn a completed visit into a PDF an inspector or assessor can read without touching the system (timestamps, per-asset history and export). Records are held well beyond the five-year duty rather than aged out on a timer. That is all three tests answered as a by-product of the work, so meeting them isn't a separate chore someone has to stay on top of.

The switch to digital becomes defensible the day your system can answer one question about a reading taken two years ago: who took it, and has anyone changed it since. Paper can usually manage the first half and almost never the second. When you do move, keep the retention clock running through the change rather than resetting it. We set out how not to break it in moving five years of paper records without breaking retention rules.