Legionella in a dental practice: do you have to write it down, what to keep, and for how long (5 employees, 2 years, 5 years)

A dental practice is a small building with a lot of water in it: taps, a hot water cylinder or heater, the handpiece water supply, the chair units. Water between 20 and 45 degrees that sits still or recirculates is the textbook setting for Legionella bacteria, and a dental procedure makes a fine spray. Most practice managers know a Legionella risk assessment has to exist. The part that gets lost is the paperwork afterwards: what has to be written down, and for how long.

This guide reads what HSE says on its Legionnaires' disease pages, as read on 23 October 2026. It does not replace the Approved Code of Practice or your assessor's report.

What HSE says the employer is responsible for

HSE's page says an employer, or anyone in control of premises, is responsible for health and safety, and must:

• identify and assess sources of risk
• manage any risks
• prevent or control any risks
• keep and maintain the correct records
• carry out any other duties they have

It names four pieces of law: the Health and Safety at Work etc Act, the Management of Health and Safety at Work Regulations, COSHH, and the Approved Code of Practice L8.

On who does the assessment, HSE says carrying it out is the employer's responsibility. If you are not competent to do it, call on a competent person, from inside the organisation or outside, for example a consultancy. A competent person is someone with enough training, experience or knowledge to assist you properly. HSE lists what the assessment looks at: whether water sits between 20 and 45°C, whether it is stored or recirculated, whether there are nutrients such as rust, sludge, scale and biofilm, whether droplets can spread, and whether anyone exposed is more susceptible to infection.

The 5-employee line

This is the sentence that decides whether you must write things down. On the "Monitoring and keeping records" page HSE says: if you have 5 or more employees you have to record any significant findings. With fewer than 5 employees you do not need to write anything down, although HSE says it is useful to keep a written record.

Count the people you employ, not the chairs. A practice with a principal dentist who is self-employed, three nurses and a receptionist has a head count question for your adviser, because the page speaks of employees. We did not read how HSE treats self-employed associates, so do not assume they fall out of the count. Most dental practices will be at or over the line, and anyone near it is better off keeping the record anyway. HSE itself says it is useful.

What the record should hold

HSE lists:

1. the person or people responsible for the risk assessment, for managing it, and for carrying out the written scheme
2. the significant findings of the risk assessment
3. the written control scheme, and details of how it is being carried out
4. the state of the system (in use or not in use)
5. the results of any monitoring, inspection, test or check, with dates

How long to keep it

Two periods appear on the page. General records are kept throughout the period for which they remain current and for at least 2 years after that. Records of the results of monitoring inspections are kept for at least 5 years.

The dates in the second column are invented for the example. The sums are the point.

The hot water standard HSE gives

On the "Reviewing what you do" page HSE gives one performance standard as an example of checking a control: water at hot outlets should be at least 50°C, and 55°C for healthcare premises like hospitals, within 1 minute of running the water. HSE does not say there whether a dental practice counts as healthcare premises for the 55°C figure, and we did not read the guidance that settles it. Ask your assessor which figure applies and write the answer in the control scheme.

HSE's page on testing says microbiological monitoring of hot and cold water systems is not usually required, but may be where there is doubt about the control regime or the recommended temperatures are not consistently reached. Tests should use a UKAS-accredited laboratory.

What the paperwork adds up to

HSE does not tell you how often to read an outlet on the pages we read. The detailed intervals sit in HSG274 Part 2, which we have not read. So the count below is only an illustration of how big the file becomes, using a monthly reading as an example of ours.

Six hundred dated lines is not much if they are in one sheet, and a lot if they are on loose sheets that someone has to find during an inspection. The same applies to the file you open for a CQC visit: see the front desk evidence guide for the paperwork an inspector asks to see.

A checklist

1. Count employees. At 5 or more, the significant findings must be written down.
2. Put the names of the people responsible for the assessment and the control scheme on the first page.
3. Date every reading and test, and state whether the system was in use.
4. Mark each record with its keep-until date: 2 years after it stops being current, or 5 years for monitoring results.
5. Review the assessment regularly. HSE gives no fixed interval on the page we read, so ask your assessor for one and write it down.

Records of this sort also sit alongside the other dated duties of a practice, such as the X-ray registration with HSE and the sharps injury rules.

In the practice

Overlyft can set up AI staff who join the practice team and take over the water log: a sheet of every outlet, a prompt to the practice manager on the day a reading is due, a flag when a hot outlet reads under the figure the assessor set, and a keep-until date on every line. A person takes each reading, signs off every record and decides what to do about a low result, and nobody on the team is replaced.

This page is general information, not advice.