Sample policy · Reg 12

Water Safety and Legionella Policy

Statutory anchor: Health and Safety at Work etc. Act 1974, with the Control of Substances Hazardous to Health Regulations 2002 (COSHH). This policy also engages Regulation 12 (safe care and treatment) and Regulation 15 (premises and equipment) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.2, 2026-07-21

1. What the regulation says

This policy is anchored to the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002. It also engages Regulation 12 (safe care and treatment) and Regulation 15 (premises and equipment) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, quoted verbatim below.

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way, (Reg 12(2)(d) (premises safety))

assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated, (Reg 12(2)(h) (infection control))

Regulation 15 adds the premises duties that this policy operationalises:

All premises and equipment used by the service provider must be ... clean, secure, suitable for the purpose for which they are being used, properly used, properly maintained, and appropriately located for the purpose for which they are being used. (Reg 15(1): the six criteria)

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/15. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. Regulation 12 lists the things you have to do, including assessing and mitigating risks, ensuring premises and equipment are safe and used safely, and assessing the risk of and controlling the spread of infection. Regulation 15 requires premises and equipment to be clean, secure, suitable for purpose, properly used and maintained, and appropriately located. Managing water safety, including Legionella, is part of keeping premises safe, controlling infection and running good governance.

3. Purpose

The purpose of this policy is to make sure that [Service Name] manages water safety risks, including Legionella, Pseudomonas aeruginosa, scalding and other water-related hazards.

Water safety is part of safe premises, infection prevention and control, and good governance. Even small services must understand their water system, assess risks, maintain controls, act on concerns and keep records.

This policy supports safe care and treatment, premises and equipment safety, infection prevention and control, health and safety duties and good governance.

4. Policy warning

The service must not assume that water systems are safe because the premises are small, modern, leased, serviced by a landlord or used only part-time.

The provider remains responsible for ensuring that premises used for regulated activity are safe for their intended purpose.

Where water safety controls fail, or where there is concern about Legionella, Pseudomonas, contamination, unsafe temperatures or scalding risk, the Registered Manager must act without delay and seek competent advice where required.

5. Scope

This policy applies to:

5.1 Local decisions before adoption

Before adoption, the service records:

Generic intervals in this template do not replace the service's risk assessment or competent advice.

6. Key risks

The service must consider risks from:

7. Responsibilities

The provider is responsible for ensuring that safe water arrangements are in place.

The Registered Manager is responsible for implementing this policy, maintaining records, escalating concerns and ensuring that actions are completed.

A competent person or contractor must be used where specialist water safety assessment, maintenance, testing or remedial work is required.

All staff are responsible for reporting water safety concerns, such as unusual odour, discolouration, poor flow, unsafe temperature, damaged outlets, blocked drains or unclean sinks.

8. Water safety assessment and control workflow

The Registered Manager and competent person use this workflow:

  1. Map the system and responsibility: identify outlets, stored water, low-use points, specialist systems and landlord or contractor boundaries.
  2. Assess people and exposure: identify vulnerability, aerosol, scalding, stagnation and clinical-use risks.
  3. Set the written controls: state what is checked, how, by whom, how often and what result triggers action.
  4. Run and record the controls: complete scheduled flushing, temperatures, cleaning, maintenance and any sampling required by the risk assessment.
  5. Act on failure: restrict affected outlets, protect people, obtain competent advice and assign remedial work with a deadline.
  6. Verify closure: retain completion evidence, confirm the control is effective and update the risk assessment, control scheme and risk register where needed.

8.1 Water safety risk assessment

The service must have a water safety risk assessment proportionate to the premises and service type.

The assessment must consider:

The assessment must be completed or reviewed by a competent person where the provider does not have the required knowledge.

9. Written control scheme

Where required by the risk assessment, the service must maintain a written water safety control scheme.

The control scheme should include:

The control scheme must be practical and understood by staff who have water safety duties.

10. Low-use outlets and flushing

The service must identify low-use outlets and manage the risk of stagnation.

Low-use outlets may include:

Flushing must be carried out according to the risk assessment and recorded where required.

If an area is closed or unused, the Registered Manager must consider whether additional flushing, isolation, cleaning or recommissioning is needed before reuse.

11. Temperature control

The service must manage water temperature risks according to the risk assessment and competent advice.

The arrangements must consider:

Staff must escalate water that is too hot, too cold, fluctuating, discoloured, odorous or otherwise unusual.

12. Thermostatic mixing valves

Where thermostatic mixing valves are used, the service must ensure that they are:

A faulty TMV may create scalding risk or infection-control risk and must be escalated immediately.

13. Cleaning and descaling

The service must clean, descale and maintain outlets according to the risk assessment.

This may include:

Cleaning must not compromise infection prevention and control.

Staff responsible for cleaning or descaling must be trained and must use suitable products safely.

14. Clinical sinks and hand hygiene

Clinical hand-wash facilities must be suitable and kept clean.

Staff must report:

Hand-wash basins must not be used as storage areas.

15. Dental, specialist or high-risk water systems

Where the service uses dental waterlines, specialist equipment, decontamination equipment, hydrotherapy, pools, birthing pools, endoscopy-related water systems, augmented-care areas or other high-risk water systems, the provider must have additional service-specific procedures.

These procedures must follow relevant specialist guidance and competent advice.

The generic water safety policy is not enough for specialist water systems.

16. Contractor and landlord arrangements

Where water systems are controlled, maintained or partly managed by a landlord, building manager or contractor, the provider must still obtain assurance that water safety is being managed.

The service must retain evidence such as:

The service must not assume that "the landlord deals with it" is enough for CQC evidence.

17. Water safety incidents

The following must be reported and escalated:

The Registered Manager must consider incident reporting, risk register entry, external advice, service restriction, CQC notification, safeguarding or health protection advice where relevant.

18. Outbreak or suspected infection link

Where there is concern that illness may be linked to the water system, the Registered Manager must seek urgent competent advice and consider contacting relevant external bodies.

The service must:

19. Records and evidence fields

The following fields must be recorded for each monitoring, maintenance or remedial activity: outlet or system, date and time, check completed, expected range or standard, result, person completing it, exception found, immediate action, escalation, action owner and closure evidence. Water safety records include:

Records must be clear enough to show what was checked, when, by whom, what was found and what action was taken.

20. Staff training

Staff with water safety duties must receive training appropriate to their role.

Training may include:

General staff must know how to report water safety concerns.

21. Audit

The Registered Manager must audit water safety records at least quarterly.

The audit must check:

Findings must be added to the action plan or risk register where required.

22. Related policies

This policy should be read with:

23. Review

This policy will be reviewed annually, or sooner following a water safety incident, water risk assessment update, premises change, service change, contractor change, CQC finding, infection-control concern, water outage or change in national guidance.

24. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

25. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

26. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Added local control decisions, an end-to-end water-safety workflow and auditable evidence fields.
v1.2 2026-07-21 Verivius (sample) Made the required monitoring, maintenance and remedial evidence fields explicit.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Water safety carries a risk that stays invisible until someone is unwell: Legionella and Pseudomonas grow quietly in the parts of a system nobody uses, and the first sign can be a chest infection in a frail or immunosuppressed person who simply used a shower in a room that had stood empty for weeks. The control is also a trade-off, because water kept hot enough to suppress bacterial growth is water hot enough to scald, which is why the thermostatic mixing valve on a bath or a clinical hand-wash basin is a care control and not a plumbing detail. Many services share a building, so the system is half theirs and half the landlord's, and the gap between those two halves is exactly where flushing quietly stops and nobody notices. A service that knows its own outlets, flushes the quiet ones and acts the same day a temperature comes back wrong is protecting the person in that room, not producing paperwork. The record trail matters because it is the only way to show that the empty bedroom was made safe before it was reoccupied, and it is what lets a well-led team see a system drifting before anyone is harmed.

  1. A water safety risk assessment exists and is current for these premises, and, where the provider does not hold the competence itself, a competent person completed or reviewed it, not a generic template adopted on trust with the printed intervals left unchanged.

    Strong evidence: The water safety risk assessment held in the records, showing it covers system layout, people vulnerable to infection or scalding, hot and cold temperatures, low-use outlets, storage and thermostatic mixing valves, with a competent-person sign-off where the provider lacks the knowledge (Sections 8.1, 19).

    Weak evidence: A downloaded template still carrying another organisation's name, with the printed intervals left exactly as supplied, no schematic or outlet list, and no named groups of people who are vulnerable to infection or scalding. Weak versions are often years old, signed off by the Registered Manager alone, with nothing on file to show who held the water safety competence or what they actually looked at.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Control of Substances Hazardous to Health Regulations 2002, reg 6(1) and reg 6(3); Management of Health and Safety at Work Regulations 1999, reg 3(1) and reg 7(1)

  2. Scheduled flushing, temperature and thermostatic mixing valve (TMV) checks are completed and recorded, and each record shows what was found and what followed, not blank or back-filled monitoring sheets.

    Strong evidence: The flushing, temperature and TMV monitoring records, each carrying the fields the policy sets: outlet or system, date and time, check completed, expected range, result, person completing it, exception found, immediate action, escalation, action owner and closure evidence (Sections 19, 21).

    Weak evidence: A monitoring sheet of identical ticks in one pen, temperatures written as "OK" or the same figure week after week, and holiday or half-term gaps filled in afterwards from memory. The giveaway is that no expected range is printed on the sheet, so an out-of-range reading looks normal, and nowhere on the record is there a line showing what was found or what happened next.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  3. The service keeps its own retained evidence that water safety is being managed where a landlord or contractor holds the system, because the provider stays responsible for keeping people using the premises safe, not the assertion that 'the landlord deals with it', which the policy states is not enough for CQC evidence.

    Strong evidence: The landlord and contractor pack the policy requires the service to retain: risk assessment, maintenance records, flushing and temperature records, sampling results, remedial-action records and contractor competence information (Section 16).

    Weak evidence: One email from the letting agent saying Legionella is "covered", or a certificate whose expiry date has already passed, with no copy of the landlord's risk assessment or flushing and temperature records held by the service itself. Nobody is named to chase the missing evidence, and there is no written record of which parts of the system the landlord controls and which the service controls.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  4. A failed temperature reading, a contaminated outlet or a suspected Legionella concern triggers action, the outlet is restricted, competent advice is sought and remedial work is assigned with a deadline and closed with evidence, not simply logged and left.

    Strong evidence: The remedial-action and incident records, sitting behind the workflow's act-on-failure and verify-closure steps that require restriction, competent advice and retained completion evidence before a control is signed off (Sections 8, 17).

    Weak evidence: The failed reading appears in the log and nothing else moves: the outlet stays in use with no restriction or signage, there is no incident record or risk register entry, and the action reads "reported to maintenance" with no owner and no date. Nothing on file shows that competent advice was sought, that the work was completed or that the reading was re-checked afterwards.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Low-use outlets and closed or unused rooms are flushed or recommissioned before reuse, and a faulty thermostatic mixing valve is escalated as a scalding and infection risk rather than left in service.

    Strong evidence: The flushing records for low-use outlets and the TMV checks and servicing records the policy lists among the water safety records (Sections 10, 12, 19).

    Weak evidence: An outlet list that does not separate low-use points from daily ones, no flushing record at all for the room closed for redecoration, and a bedroom or treatment room brought back into use on the day it is needed with no recommissioning note. Thermostatic mixing valves are logged as "checked" with no temperature captured, and a mixer already known to be faulty is left in service while a quote is awaited.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  6. The quarterly water safety audit is actually carried out and its findings reach the action plan or risk register, not an audit line that is never completed.

    Strong evidence: The completed quarterly audit record covering current risk assessment, flushing, temperature records, missed checks, contractor evidence and remedial actions, with findings carried into the action plan or risk register (Section 21).

    Weak evidence: The audit exists as a recurring calendar entry or a heading with last quarter's wording copied across, and records "no issues" while the temperature sheets plainly show missed weeks and the contractor evidence is out of date. Nothing from the audit reaches the action plan or risk register with an owner, so the same finding reappears unchanged the following quarter.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 21 July 2026