Three months after Royal Papworth Hospital, a specialist heart and lung hospital in Cambridge, England, moved into its new building in May 2019, two lung transplant recipients tested positive for Mycobacterium abscessus — a bacterium that lives naturally in water, soil, and dust. The hospital launched an investigation, and whole-genome sequencing matched the patients’ cultures to a strain in the building’s own water system.
The investigation, published in Clinical Infectious Diseases by UK Health Security Agency and hospital investigators, counted 40 outbreak cases between May 2019 and June 2025: 11 lung transplant recipients, 11 cystic fibrosis patients, 14 patients with non-cystic fibrosis bronchiectasis, and 4 in other groups. Nineteen were diagnosed with nontuberculous mycobacterial pulmonary disease. A coroner’s inquest concluded that the infection contributed to the deaths of two of the transplant patients.
The controls worked where they were aimed. The hospital fitted point-of-use filters to basin taps and showers, dosed the incoming water with hydrogen peroxide, added ultraviolet treatment, and gave its most susceptible patients bottled water. Filtered outlets have never grown the organism, and annual incidence fell from 12.8 cases to 2.2. But the outbreak strain was never eliminated from the water system — and when UKHSA teams sampled the building again between 2022 and 2025, swabbing drains, showers, toilets, and taps and sampling the air above toilets after flushing, the remaining risk sat on the waste side of the fixture: drain traps and toilets. The filter had cleared the water leaving the tap. It could not touch the water that had already left.
Where does Mycobacterium abscessus live in a hospital water system?
Everywhere the water is — including where it drains. Nontuberculous mycobacteria are environmental organisms that colonize building water systems inside biofilm: the layer on pipe walls, in flexible hoses, at outlets, and in the standing water of traps and cisterns. At Royal Papworth, environmental sampling found the outbreak strain had persisted and disseminated throughout the hospital water system, with positive samples recovered from four different floors, while swabbed surfaces and medical equipment showed no sign of it. A reservoir like that is not a single contaminated tap. It is the whole wet map of the building — supply lines, outlets, shower drains, basin traps, and toilet bowls — and any sampling plan drawn smaller than that map will find the system cleaner than it is.
Why does a point-of-use filter protect the tap but not the drain below it?
Because a filter is a one-way barrier at a single point. A sterilizing-grade point-of-use filter — typically a 0.2-micron membrane — treats water at the moment it leaves the outlet, which is why Royal Papworth’s filtered taps and showers kept testing clean: nothing passed the membrane, so nothing grew from the water beyond it. But the drain just below the outlet is not downstream of the filter. It is downstream of the patient and the room. Trap water, drain biofilm, and the waste line never pass through the filter at all, and the filter exerts no force on them. A basin is really two water systems sharing one fixture — a supply side the filter can certify, and a waste side it cannot reach.
How do drains and toilets expose patients who never drink from them?
Through the air. Flushing a toilet generates a plume of fine droplets from the bowl water that can carry microorganisms into the room air — which is why the UKHSA sampling team at Royal Papworth collected air samples above toilets after flushing, alongside swabs and water samples from the drains and toilets themselves. Sink drains expose patients the same way at shorter range: water striking a colonized drain splashes droplets back onto the basin surround and nearby surfaces, a route documented in intensive care studies of sink-drain organisms. For most patients these exposures are trivial. For patients with transplanted lungs, cystic fibrosis, or bronchiectasis — 36 of the 40 Papworth cases — inhaled droplets are exactly the exposure that matters, and no outlet filter stands between a drain and a lung.
What did treating the incoming water miss?
Contact. Royal Papworth installed a hydrogen peroxide dosing plant and a UV treatment unit to cut bacterial counts in the water itself, and the investigation’s conclusion is the operational lesson: the control measures — point-of-use filters and biocide treatment together — reduced the incidence of infection but did not eliminate the outbreak strain from the hospital water. Disinfectant dosed at the plant arrives at a distant outlet diluted and decayed, and it flows past established biofilm rather than through it; a colony embedded in biofilm on a pipe wall or inside a trap can survive chemistry that would kill the same organism suspended in water. Treatment of the stream is not the same as control of the surfaces the stream touches, and the gap between the two is where this outbreak persisted.
What should a water safety plan sample besides the outlets?
The whole fixture, on both sides of the drain. A sampling map built on the Papworth evidence takes outlets first-draw and post-flush, showers and hoses, basin traps, shower drains, and toilet cisterns and bowls — and, where aerosol exposure is the question, the air above a toilet after flushing. It also samples again after any plumbing work, because opening a drain or replacing a trap disturbs the biofilm the plan is trying to monitor; that is the same reasoning behind a water-focused infection control risk assessment before plumbing and water system work begins. The Papworth investigators found surfaces and equipment negative and the water system positive. Sampling that follows the water — supply and waste together — is what turns a reassuring outlet result into an honest system result.
Which standards speak to this — and where do they stop?
The frameworks exist; their titles are narrower than the problem. In the United States, ASHRAE Standard 188 sets the water management program structure — hazard analysis, control locations, monitoring, corrective action — that healthcare facilities use, and ASHRAE 188, the CDC toolkit, and the CMS requirement together make that program mandatory in effect for Medicare-participating hospitals. In the UK, HTM 04-01 governs safe water in healthcare premises through a Water Safety Group and a written Water Safety Plan; Royal Papworth has said it followed the national guidance in place at the time. Both frameworks were built largely around Legionella. Mycobacterium abscessus is a different organism, but the program logic is the same — and the Papworth record is the documented case that the organism list and the sampling map are the facility’s own decisions to widen, drains included.
What can flushing and temperature control do — and what can’t they reach?
Flushing and temperature regimes manage the supply side, and they matter. Regular flushing keeps water moving through low-use outlets so disinfectant residual and temperature — the two standing controls in a hot and cold water system — actually reach the far ends of the loop instead of decaying in stagnant legs. The Papworth timeline ends the way it does for a reason: no further case has been identified since June 2025, coinciding with the hospital’s review of enhanced flushing. But a trap holds its water by design, and no flush volume or storage temperature reaches the biofilm inside a waste line. Flushing is a supply-side control. A plan that asks it to also govern the drainage side has assigned one tool to two systems.
The short version
A point-of-use filter certifies one point, in one direction: the water leaving an outlet. Royal Papworth’s filters did that job completely — and the outbreak strain remained in the building’s water system anyway, in the traps and toilets a tap-focused plan never samples. The design rule the record supports is simple: draw the water safety map at the size of the fixture’s whole life — supply, outlet, drain, and the air above all three — and sample to the map, not to the tap.
Sources: Heinsbroek E, et al. “Waterborne outbreak of Mycobacterium abscessus in a UK specialist heart and lung hospital 2019–2026: patients, mitigations and implications.” Clinical Infectious Diseases, 2026 (doi:10.1093/cid/ciag609); Royal Papworth Hospital NHS Foundation Trust, “Mycobacterium abscessus” (royalpapworth.nhs.uk); ScienceAlert, “40 Patients Were Infected by a Hospital’s Water Supply Across 6 Years,” October 6, 2026.