Legionella 360

Every organisation operating a building with a water system — a hospital, a hotel, a care home — is legally required to assess and control Legionella risk. In Italy that obligation demands a formal, versioned risk assessment document, evidence that control measures are actually working, periodic water sampling, temperature logs, and a defensible audit trail for each one. In practice, most of this runs on spreadsheets and Word documents: a consultant managing thirty client sites keeps thirty folders, and when an inspector asks whether a specific cooling tower was treated on schedule, answering takes hours of archaeology.

Three failures compound from this. Compliance is invisible until it is too late — nobody knows a risk assessment has expired until someone opens the folder. Evidence and assessment drift apart — the assessment says a biocide treatment is in place, but whether it actually happened last quarter lives somewhere else entirely. And risk scoring is inconsistent — two consultants assessing the same building produce different numbers because the calculation lives in their heads. That last one is a defensibility problem the moment a score is challenged.

The core modelling decision was to represent the real-world structure directly: business → company → facility → floor, wing, room and zone → asset → control measure → dated assessment record. Each user role gets a genuinely different first screen, driven by role-based permissions: risk consultants see their whole client portfolio ranked by compliance status; facility managers see one building's risk position and what is expiring; compliance officers get the regulatory view of deadlines and gaps; service contractors get a work-oriented view and log interventions against the record instead of emailing PDFs afterwards. Beneath the dashboards sit more than twenty distinct assessment form types — temperature checks, thermal disinfection, flushing, dipslide, bacterial and Legionella sampling, TMV servicing, calibration records and more — plus maintenance logging, document management, a floor-plan module for locating assets spatially, automated generation of the formal risk assessment PDF, and a full audit log.

The genuinely difficult work was not the CRUD — it was the risk engine. The regulation defines risk as probability × severity, which looks simple until you read the specification: probability is derived from a base value per hazardous event (there are seventeen), adjusted by historical sampling data, modified by occupant-vulnerability triggers, and constrained by conservative defaults whenever information is missing. The specification itself arrived in versions — v0.1, v0.2, v0.3 — each adding a layer, so the engine was built in bounded phases against a moving target rather than waiting for a final document that was never going to arrive.

The platform is a deliberately conventional layered Spring Boot 3.4 / Java 21 service behind an Angular 20 SPA — the domain complexity is high, so the infrastructure complexity does not need to be. Tenant isolation is enforced at the persistence layer through a three-level scoped-entity hierarchy with Hibernate filters populated per-request from the authenticated principal: a developer adding a new entity gets isolation by inheritance rather than by remembering a WHERE clause, which is the difference between tenant safety by design and a cross-tenant leak waiting for one forgotten line. Deletion is soft throughout, because compliance records must remain auditable after removal from the working view.

The risk calculation itself is a pure function — inputs in, result out, no repository access inside the calculation path — making it directly unit-testable against the worked examples in the specification. For a component whose output is a compliance figure, that testability is the entire point: a miscalculation does not crash, it produces a wrong number that looks right.

After eight months of active development by a three-developer team, the core platform is complete and operational: the full hierarchy, multi-tenancy, role-based access, the assessment and maintenance suite, document generation, and all four role dashboards — roughly 52,000 lines across 585 Java and TypeScript files. The inherent risk engine is fully implemented; the residual-risk layer (a 38-measure catalogue with a seven-step reduction algorithm) is specified and in phased delivery. Two open items are recorded deliberately: the regulatory specification itself is still maturing, and the expert calibration values are a first calibration pending field testing — the architecture anticipates both, holding each as data the system loads rather than logic it embeds.