Why are hot tubs a legionella risk?
On this page
Key points
- Yes, you can catch legionnaires' disease from a hot tub. Spa pools are among the highest-risk water systems there are, because they combine warm water, breathable aerosol and biofilm all at once.
- The water sits at 30 to 40°C, the middle of the range where legionella multiplies fastest, and the jets fire a fine spray straight into the breathing zone of the people sitting in it.
- Bathers add nutrients. Sweat, skin and cosmetics feed the bacteria and use up the disinfectant, so a busy tub needs constant chemical attention.
- The control regime is continuous disinfection (typically 3 to 5 mg/l free chlorine, or an equivalent bromine level), daily testing, dosing checks, water dilution and a periodic drain-down and clean.
- A domestic-looking tub used by paying guests is a spa pool in law. Holiday-let owners who run it like a home hot tub are under-treating a commercial system.
Yes, you can get legionnaires' disease from a hot tub, and spa pools are one of the worst-case water systems for it. They hold water at 30 to 40°C, sit in the middle of the temperature range where legionella grows fastest, throw a fine aerosol straight into the air people breathe, and carry a heavy load of nutrients from bathers. Most water systems present one or two of those problems. A spa pool presents all of them together.
That combination is why the Health and Safety Executive publishes a whole document just for these systems, HSG282, alongside the general legionella guidance in ACOP L8 and HSG274. Understanding why the risk is so high makes the control regime, and why it cannot be relaxed, much easier to follow.
Why a spa pool is the worst case
Four things line up in a spa pool, and each one on its own would raise the risk.
The temperature is ideal for the bacteria. Legionella multiplies roughly 20°C to 45°C. A spa pool is usually run at 30 to 40°C for comfort, which is close to the optimum for growth. Unlike a hot water system, where you fight the risk by storing water at 60°C, you cannot heat a spa pool out of the danger zone because people have to sit in it. The temperature that makes it pleasant is the temperature that makes it dangerous. Our temperature chart shows where the growth range sits.
The jets make a breathable aerosol. Air blowers, water jets and the churning surface break the water into a fine mist. Legionella causes disease when that mist is inhaled and reaches deep into the lungs, whether that is full legionnaires' disease or the milder, flu-like Pontiac fever, both of which spa pools have caused in past outbreaks. A hot tub does not just create aerosol, it fires it directly at the faces of the people using it, at close range, for a sustained period. There is no more efficient way to deliver the bacteria to a human lung.
Bathers feed the system. Every person who gets in adds sweat, skin cells, urine, sun cream, make-up and other organic matter. That material does two things: it feeds the bacteria, and it reacts with and consumes the disinfectant. A hot tub has a very high ratio of bathers to water compared with a swimming pool, so the contamination per litre is far greater and the disinfectant is used up quickly.
The surfaces harbour biofilm. Warm, wet pipework, jets, filters and the balance tank are the perfect home for biofilm, the slimy layer that legionella lives inside. Biofilm shields the bacteria from disinfectant, so a tub can read an acceptable chlorine level in the water while a reservoir of legionella survives in the pipework and seeds the pool again. This is also why warm, low-flow fittings elsewhere in a building are a concern for the same reasons.
The routine that manages the risk
Because you cannot remove the heat, the nutrients or the aerosol, control depends on keeping a chemical disinfectant residual in the water at all times and physically refreshing the water. HSG282 sets out the routine for a commercial spa pool.
- Continuous disinfection. The water is dosed constantly, usually with chlorine or bromine, so a measured residual is present whenever anyone could be in the pool. It is not a "top up when it looks cloudy" system.
- Daily, often hourly, testing. The disinfectant level and pH are checked at least daily, and typically several times a day during use, then written down. pH matters because chlorine loses its power as the water becomes more alkaline.
- Regular dosing and equipment checks. Dosing pumps, probes and filters are inspected so the residual does not silently drift out of range.
- Water dilution. A proportion of the pool water is replaced with fresh mains water on a schedule driven by how many bathers use it. The more people, the more you dilute. This flushes out the dissolved contamination the disinfectant cannot remove.
- Periodic drain-down and clean. The whole system is drained, cleaned and refilled on a regular basis, commonly weekly for a well-used tub, so biofilm and debris do not build up in the pipework.
- Microbiological sampling. Water is sent to a laboratory at intervals to check for legionella and general bacterial levels, which verifies that the daily chemistry is actually working. See legionella testing for how sampling works.
All of this is recorded. A spa-pool log book holding the daily readings, dilution and cleaning dates and sample results is how you show the regime was actually run, not just intended.
You cannot heat a spa pool out of the danger zone, because the temperature that makes it comfortable is the temperature that makes it dangerous. Control depends on constant disinfection, not on heat.
What chlorine level the guidance uses
For a commercial spa pool, HSG282 works to a free chlorine residual of around 3 to 5 mg/l, held with the pH controlled to roughly 7.0 to 7.6 so the chlorine stays effective. Where bromine is used instead, an equivalent residual is maintained, commonly a little higher than the chlorine figure. These are higher and more tightly managed levels than a domestic tub's instructions usually quote, precisely because of the bather load and the aerosol. The exact target and the way it is dosed should come from your own risk assessment and the pool's operating manual.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
The holiday-let trap
This is where owners most often get caught out. The law does not classify a tub by how it looks. It classifies it by how it is used. A hot tub bought from a garden centre and installed at a holiday cottage, glamping site or bed and breakfast is being used by a succession of paying guests, which makes it a commercial spa pool, not a private domestic one. That triggers the full HSG282 duty and a legionella risk assessment under the Health and Safety at Work Act.
The danger is treating a commercial spa like a home one. A domestic tub sold to a family is designed to be used lightly by the same few people, with modest chemical dosing. Run that same tub for a changeover of guests every few days, with no continuous disinfection, no daily readings and no scheduled drain-down between lets, and you have a high-risk system managed to a domestic standard. Between guests the water often sits warm and unused for days, which is the exact condition that lets legionella bloom before the next family climbs in. If a holiday-let tub is only lightly used, the safest routine is usually to drain it down completely between bookings rather than leave warm water standing.
Where this sits in the guidance
Spa pools are covered specifically by HSG282, which sits under the general duty in ACOP L8 and the technical detail of HSG274. If you run a hot tub for anyone other than your own household, start by confirming whether you need a risk assessment, which for a spa pool used by others you almost certainly do, and read what to do if legionella is detected so you have a plan before a sample ever comes back positive. These pages explain, identify and record the duty. They do not certify any individual tub as safe, which only your own testing and controls, run properly and written down, can evidence.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Frequently asked questions
Can you get legionella from a hot tub?
Yes. Hot tubs and spa pools are one of the most efficient ways to catch legionnaires' disease, because the jets and bubbles turn the warm water into a fine aerosol that is inhaled directly by the people sitting in it. Legionella grows readily at spa-pool temperatures of 30 to 40°C, and outbreaks have been traced to spa pools, including display and demonstration tubs at exhibitions and showrooms that were filled but not properly disinfected. You do not have to swallow the water to be infected; breathing in the mist is enough.
How do you prevent legionella in a hot tub?
You cannot remove the warmth, the aerosol or the bathers, so control depends on keeping a disinfectant residual in the water at all times and physically refreshing it. That means continuous chlorine or bromine dosing, checking the disinfectant level and pH at least daily, diluting the water with fresh mains water in proportion to bather numbers, and draining down, cleaning and refilling the system on a regular schedule. Every reading and clean should be recorded in a log book, and water should be sent for periodic laboratory testing to confirm the chemistry is actually working.
What chlorine level should a hot tub be for legionella?
For a commercial spa pool, HSG282 works to a free chlorine residual of roughly 3 to 5 mg/l, with the pH held around 7.0 to 7.6 so the chlorine stays effective. Where bromine is used, an equivalent residual is maintained, usually a little higher. Domestic hot tub instructions often quote lower figures, but if the tub is used by paying guests or the public the higher, tightly controlled spa-pool levels apply, and the exact target should come from your own risk assessment and the pool's operating manual.
Are hot tubs in holiday lets a legionella risk?
Yes, and they carry a full legal duty. A hot tub used by a succession of paying guests at a holiday cottage, glamping site or bed and breakfast is a commercial spa pool in law, not a private domestic one, regardless of how it looks, so the HSG282 regime and a legionella risk assessment apply. The common mistake is running a commercial tub to a domestic standard, with light dosing and no drain-down between guests, which leaves warm water standing unused for days between bookings. Where a let's tub is used only occasionally, the safest approach is usually to drain it down completely between bookings.
Does chlorine kill legionella in a hot tub?
Yes, chlorine kills legionella when it is present at the right free residual and the pH is controlled, which for a commercial spa pool means roughly 3 to 5 mg/l held at a pH of about 7.0 to 7.6. The catch is that warm, aerated spa water and the sweat, skin and cosmetics from bathers use up that chlorine fast, so a level that reads fine at the start of the day can fall away within hours. Chlorine only protects you while it is actually in the water, so control depends on continuous dosing and frequent testing, not a single dose at fill. Chlorine also struggles to reach bacteria hiding inside biofilm in the pipework, which is why HSG282 pairs disinfection with dilution and regular drain-downs.
How often should a commercial hot tub be drained and cleaned?
HSG282 does not set one fixed interval for every tub; it ties the frequency to bather load, so a busy, well-used spa pool needs draining, cleaning and refilling far more often than a lightly used one. In practice a heavily used commercial tub is commonly given a full drain-down and clean about once a week, alongside daily dilution of a proportion of the water with fresh mains water in step with how many people have used it. The dilution flushes out dissolved contamination the disinfectant cannot remove, and the periodic full drain-down clears biofilm and debris from the pipework, jets and balance tank. Your own risk assessment and the pool's operating manual should set the exact interval for that specific tub.
Is a private home hot tub a legionella risk?
A hot tub used only by your own household is a lower risk than a commercial spa pool and sits outside the HSG282 regime, but the risk is still real, not zero. It holds the same warm water in the 30 to 40°C growth range and fires the same breathable aerosol from its jets, so poor upkeep can still make people ill. The sensible approach is to keep it clean, maintain a proper disinfectant residual and check it regularly, and never let it stand warm and stagnant for long spells between uses. If the tub is ever used by paying guests or the public, it stops being private and the full commercial spa-pool duty applies.
Related water hygiene products and services from trusted UK providers will appear here.