HSG282: controlling legionella in spa pools and hot tubs
On this page
Key points
- HSG282 is the HSE guidance "The control of legionella and other infectious agents in spa-pool systems" (2017). It is the dedicated companion to HSG274 for spa pools and hot tubs.
- It covers more than legionella. Spa pools also breed Pseudomonas aeruginosa and other infectious agents, which HSG282 addresses directly.
- It applies to any business operating a spa pool for others: hotels, gyms, spas, holiday lets and display tubs on a retailer's shop floor.
- A holiday-let hot tub is in scope even though the setting looks domestic; a genuinely private home hot tub is not.
- The regime is continuous disinfection, filtration, regular water dilution, daily chemical checks and microbiological monitoring, all recorded and backed by a risk assessment.
HSG282 is the Health and Safety Executive's guidance on running spa pools and hot tubs safely. Its full title is "The control of legionella and other infectious agents in spa-pool systems", it was published in 2017, and it was written with Public Health England and the pool-water treatment industry. It is the document an inspector will reach for if a spa pool at your premises makes someone ill.
Spa pools are a high-risk setting for a simple reason: they hold warm water, they aerate it heavily, and they create clouds of breathable spray. That is close to a perfect environment for legionella in hot tubs and spa pools and other bacteria. This page explains what HSG282 is, who it applies to, the control regime it sets out, and why a hot tub at a holiday let counts as a commercial system even when it sits in a domestic-looking garden.
What HSG282 is and what it covers
HSG282 is technical guidance, not a law in itself. The legal duties come from the Health and Safety at Work etc. Act 1974 and the COSHH Regulations, and are framed by ACOP L8. HSG282 describes one recognised way to meet those duties for spa-pool systems specifically, in far more detail than the general guidance can.
Crucially, HSG282 is not only about legionella. Warm, continuously used spa water is also a breeding ground for Pseudomonas aeruginosa, which causes skin and ear infections, and for other infectious agents. The guidance treats the whole microbiological risk of a spa pool, which is why it exists as a separate document rather than a chapter inside the wider hot and cold water guidance.
The term "spa pool" in HSG282 is broad. It covers hot tubs, whirlpool spas, hydrotherapy pools and any similar system that recirculates and heats water for people to sit in. It applies whether the water is filtered and recirculated continuously or drained and refilled between users.
Who HSG282 applies to
HSG282 applies to any business or organisation that operates a spa pool or hot tub for use by other people. That is a wide net, and it deliberately catches settings that owners do not always think of as "commercial":
- Hotels, health clubs, gyms and leisure centres with a spa or whirlpool.
- Dedicated spas and beauty premises offering hydrotherapy.
- Self-catering cottages, holiday lets, glamping sites and B&Bs providing a hot tub for guests.
- Retailers running a filled, working display hot tub on the shop floor.
- Care settings and hospitals with hydrotherapy pools.
If you provide the water for others as part of a work activity, you are the duty holder, and the full HSG282 regime applies. The size of the tub does not change that.
The domestic versus commercial line
This is the single point that catches operators out, so it is worth stating plainly. A hot tub used purely privately, by a household in its own home, is outside the scope of HSG282. There is no work activity and it is not provided for others.
The moment that tub is let out to paying guests, it becomes a commercial spa pool, regardless of the fact that it sits in a garden and looks identical to a private one. A holiday-let hot tub is in scope. So is a tub shared between multiple guest parties, or offered for hire. The domestic appearance is irrelevant; what matters is that people other than the owner's household are using water the owner is responsible for.
The control regime HSG282 sets out
HSG282 requires a layered set of controls that work together. No single measure is enough on its own, which is the same principle that runs through all HSE legionella guidance.
- Continuous disinfection. The water is dosed continuously, normally with bromine or chlorine, and held at a residual high enough to deal with the heavy bather load and warm temperature. Spa pools need higher residuals than swimming pools for this reason.
- Filtration and circulation. Water is filtered and turned over quickly so contamination is removed and disinfectant reaches every part of the system, including the balance tank and pipework.
- Dilution and dumping. Fresh water is added continuously to dilute pollutants, and the whole system is periodically drained, cleaned and refilled. Warm spa water cannot simply be topped up indefinitely.
- Daily chemical checks. Disinfectant residual and pH are tested several times a day and logged, so problems are caught within hours rather than weeks.
- Microbiological monitoring. Routine samples are taken for aerobic colony counts and, on a risk-based schedule, for legionella and pseudomonas.
All of this sits on top of a written risk assessment, a named competent person, and records that show every check was done. The records are what an inspector examines first.
| Control check | Typical frequency |
|---|---|
| Disinfectant residual (bromine or chlorine) | Continuous dosing, tested at least three times a day |
| pH level | Tested at least three times a day, held around 7.0 to 7.6 |
| Fresh-water dilution | Continuous, at a rate set by bather load |
| Full drain, clean and refill | Periodic, based on use (small tubs often need it far more frequently) |
| Filter backwash | Daily or as the risk assessment specifies |
| Aerobic colony count sampling | Monthly (more often if results are poor) |
| Legionella and pseudomonas sampling | Quarterly or as the risk assessment specifies |
The exact figures come from the risk assessment for your specific system. A busy commercial spa and a lightly used holiday-let tub will not be on identical schedules, but both need the full set of controls in place.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
How HSG282 fits with HSG274 and ACOP L8
These three documents form a family. ACOP L8 is the Approved Code of Practice that sets the legal framework and carries special standing in court. HSG274 is the general technical guidance for water systems, published in three parts. HSG282 is the specialist guidance for spa pools that pulls the spa-specific detail into one place.
In practice, if you run a hotel with a spa, HSG282 governs the spa pool while HSG274 still governs the building's hot and cold water services, and both are ways of meeting the duties described in ACOP L8. Following HSG282 for your spa pool is how you show an enforcing officer that this high-risk system is properly controlled.
The enforcement reality
Spa pools are not a theoretical risk. Display hot tubs, holiday-park spas and leisure-centre whirlpools have all caused fatal legionella outbreaks in the UK, and operators have been prosecuted under the Health and Safety at Work etc. Act 1974 after guests fell ill or died. A working display tub on a shop floor has been the source of a fatal outbreak, which is exactly why HSG282 names retailers explicitly.
Because a spa pool aerosolises water so effectively, a single lapse in disinfection can expose many people at once, and the consequences are severe. The pattern in the case record is consistent: no proper risk assessment, gaps in the daily chemical checks, and no evidence the water was being managed. You can see the outcomes of these failures in our legionella enforcement tracker, which records the prosecutions and penalties that have followed spa-pool and other legionella incidents.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Frequently asked questions
What is HSG282?
HSG282 is the HSE guidance document "The control of legionella and other infectious agents in spa-pool systems", published in 2017. It was produced with Public Health England and the pool-water treatment industry, and it sets out how to design, operate and manage a spa pool or hot tub so it does not spread legionella, Pseudomonas aeruginosa or other waterborne infections. It sits alongside the wider HSE legionella guidance in HSG274 and the Approved Code of Practice, ACOP L8.
Does HSG282 apply to my holiday let hot tub?
Yes. A hot tub provided at a holiday let, self-catering cottage or B&B is treated as a commercial spa pool under HSG282, even though the setting looks domestic. Because you are providing it for use by others as part of a business, you are the duty holder and the full control regime applies: continuous disinfection, daily chemical checks, regular water changes and microbiological monitoring. This is one of the most commonly misunderstood points, and it is exactly where enforcement action tends to land.
What does HSG282 require?
HSG282 requires the water to be continuously disinfected, usually with bromine or chlorine held at the correct residual, together with proper filtration and circulation, regular dilution and periodic draining of the water, daily checks of disinfectant level and pH, and routine microbiological sampling. It also requires a written risk assessment, a named competent person, records of every check, and a scheme for cleaning and maintaining the whole system including pipework and balance tank.
Is a home hot tub covered by HSG282?
A hot tub used purely privately in a family home is outside the scope of HSG282, because there is no work activity and it is not provided for others. Good hygiene is still sensible, but the legal duties do not apply. The moment that same tub is let out, shared with paying guests, or offered for use by the public, it becomes a commercial spa pool and the HSG282 regime applies in full.
What is the difference between HSG282 and HSG274?
HSG274 is the HSE's general technical guidance on controlling legionella in water systems, published in three parts covering cooling towers, hot and cold water, and other risk systems. HSG282 is the dedicated, more detailed guidance for spa pools and hot tubs specifically. If you run a spa pool you follow HSG282 for that system, while HSG274 still governs the building's other hot and cold water services. Both are recognised ways of meeting the duties set out in ACOP L8.
Who enforces HSG282 and what happens if you ignore it?
The HSE and local authority environmental health officers enforce the underlying law, using HSG282 as the benchmark for what good control looks like. Spa pools and display hot tubs have caused several fatal legionella outbreaks in the UK, and operators have been prosecuted under the Health and Safety at Work etc. Act 1974 following deaths and illness. Failing to follow HSG282 without an equally effective alternative leaves you exposed to enforcement, fines and, in the worst cases, corporate manslaughter proceedings.
Related water hygiene products and services from trusted UK providers will appear here.