Every water hygiene task and how often, on one page
Written by The BlueWave team · Published 16 July 2026 · 5 min read
General information, not legal or regulatory advice — your duties need your own competent advice.
Ask what a water hygiene programme actually involves and you get the answer scattered across a dozen pages, each of which covers one task and then invites you to book that one service. Monthly temperatures on one site, showerhead cleaning on another, tank inspections on a third. Nobody puts the whole cadence in one place.
So here it is. The baseline monitoring regime for hot and cold water systems under HSG274 Part 2, plus the cooling tower duties from Part 1, in one table. Print it, argue with it, pin it up.
One caveat before the table, because it matters more than the table. These are the starting frequencies from HSE guidance. Your legionella risk assessment can tighten them, and for some systems it should — healthcare premises work to HTM 04-01 and generally run harder cadences. A frequency table is not a substitute for an assessment. It is what the assessment's output usually looks like.
The table
| Frequency | Task | The detail that gets missed |
|---|---|---|
| Weekly | Flush little-used outlets | An outlet counts as little-used after seven days without use. Healthcare and other high-risk settings often need twice-weekly. |
| Monthly | Sentinel outlet temperatures | Hot at the outlets nearest and furthest from the calorifier; cold at the nearest and furthest from the storage tank. Plus the calorifier flow and return. |
| Quarterly | Dismantle, clean and descale showerheads and hoses | "Or as indicated by the risk assessment" — dusty gym showers are not office kitchenettes. |
| Quarterly (rotating) | Temperatures at a representative selection of other outlets | The point is that every outlet gets covered over a defined period, rather than the same sentinels forever. |
| Annually | Inspect cold water storage tanks | Inspect, then remediate or clean as the condition demands. Lid on, insect screen intact, no stagnation. |
| Annually | Inspect calorifiers | Drain and check for debris and scale. |
| Annually | Service TMVs | Inspect, clean, descale and disinfect strainers and filters — annually or on the frequency your risk assessment sets. |
And for evaporative cooling systems under HSG274 Part 1:
| Frequency | Task |
|---|---|
| Monthly | Microbial activity check (dip slides) |
| Quarterly | Legionella sampling, judged against the action tables in HSG274 Part 1 |
| Once, within a month of installation | Notify the local authority — a legal duty under the 1992 notification regulations, and a criminal offence to skip |
The numbers behind the temperature checks
The monitoring only means something against the control values, so here they are. Legionella multiplies between 20°C and 45°C. Everything in the regime exists to keep water out of that band or moving through it quickly.
- Stored hot water: 60°C or above at the calorifier.
- Distributed hot water: 50°C or above within a minute at the outlet (55°C in healthcare).
- The return leg: 50°C or above.
- Cold water: 20°C or below within two minutes of running the outlet.
A reading inside the 20–45°C band is not a note for the file. It is a trigger for investigation, and the record of what you did next matters as much as the reading itself. We wrote up what to do when a reading fails separately, because almost nobody covers the exception path.
What "keep records" means in practice
Two retention rules, routinely confused:
- Monitoring records — the results, tests and checks above, with dates — must be kept for at least five years.
- General records — who is responsible, the significant findings, the written scheme — must be kept while current and for at least two years after they stop being current.
Both come from HSE's record-keeping guidance, which also says records should be "signed, verified, or authenticated by a signature or other appropriate means". That authentication phrase is what an auditor leans on when they find a temperature log with no initials against March. If your firm has five or more employees you must record significant findings; below that threshold you still have to assess and control, you just aren't required to write the findings down. Almost everyone should anyway.
For what the logbook itself must contain, see our logbook requirements guide.
The tasks are easy. The rhythm is hard
None of the individual tasks above is difficult. A competent engineer can check a sentinel outlet in minutes. What fails, in practice, is the rhythm: the monthly round that slips to six weeks in August because two engineers were on holiday, the quarterly showerhead clean that quietly becomes annual, the flushing log with a fortnight of gaps that nobody noticed until the auditor did.
The prosecutions bear this out. When HSE brought the case over the Legionnaires' death at HMP Lincoln, part of the finding was that water temperatures simply were not monitored in October and November 2017. Not monitored badly — not monitored. The gap is the offence.
This is the problem BlueWave was built around. Each task in the table becomes a recurring job against the actual assets on the site (this tank, these sentinel outlets, those TMVs), and the scheduler books the visits so a slipped month shows up as overdue work on a screen, not as a surprise in an audit three years later. The engineer's readings go straight into the record with a timestamp, and the five-year retention takes care of itself.
However you run it, software or spreadsheet or a very good wall planner, the test is the same. Pick a random outlet and a random month from two years ago, and see how long it takes to produce the reading. If the answer is "let me find the folder", the rhythm is already slipping.