The Water Safety Plan Pursuant to Ministerial Decree 14.06.2017: Application to Campus Bio-Medico University Hospital of Rome

The Water Safety Plan Pursuant to Ministerial Decree 14.06.2017: Application to Campus Bio-Medico University Hospital of Rome

Annunziata D’Orazio* Leo Poggi

Dipartimento di Ingegneria Astronautica, Elettrica ed Energetica, Sapienza University of Rome, Via Eudossiana 18, Roma 00184, Italy

Campus Bio-Medico University Hospital of Rome, Via Alvaro del Portillo 200, Roma 00128, Italy

Corresponding Author Email:
20 March 2021
12 June 2021
30 June 2021
| Citation



The paper illustrates the design and drafting of the Water Safety Plan (WSP) of a health facility, particularly with regard to water intended for human consumption.

The components already present in the water and sanitary system as well as the control measures already provided, are described and critically discussed. Following the hazards identification and risk assessment related to the plant, some corrective measures and actions that have been proposed and implemented, are discussed.


water safety plan, domestic cold water, domestic hot water, contamination, risk assessment, risk control, legionella

1. Introduction

The innovation introduced in Italy by Ministerial Decree 14.06.2017 [1], transposing Directive (EU) 2015/1787 (amending Annexes II and III of Directive 98/83 / EC on the quality of water intended for human consumption) and relating to modification of annexes II and III of legislative decree 02.02.2001 n.31 [2], replaces the previous reactive type approach, applied to the entire drinking water chain, with a proactive type based on prevention and control, replacing the reactive type approach, applied on the entire hydro-drinking chain prior to the decree, with a proactive type.

The Water Safety Plan (WSP) is a tool with the aim of ensuring the healthiness of water intended for human consumption, by adopting a risk management approach applied to all stages, from supply to treatment and distribution to the final consumer. The WSP entails the identification of risks to human health and the implementation of checks to guarantee that risk levels are maintained below acceptable values. The water supply company is responsible for drafting and implementing the WSP for the part of the supply chain up to the point of supply to the building; the building owner is liable for the healthiness of the circulating water and will therefore be responsible for the development of the building's WSP. For a long time, the prevailing tendency has been neglecting the management of water healthiness, taking for granted the actual quality provided by the supply company and underestimating the potential risk of chemical and microbiological contamination within the water system of the structure. Through the WSP it is possible to prevent epidemics, related to the mismanagement of water systems in buildings, with different clinical manifestations (from gastrointestinal diseases to legionellosis), overcoming the limitations of the previous monitoring regime based on the control of a limited number of parameters.

To make the plan to be successful, all influencing factors must be taken into account when drafting it (use of the buildings, existence of other types of water supply, possible additional treatments of water supplied by the supply company at the entry point of the building, connection of the drinking water system to facilities that use water for technical purposes, state of health of the people present inside the building); in relation to this, the complexity of the plan depends essentially on the size and nature of the building and the population exposed inside. Among the buildings dedicated to care and health, the case of a polyclinic presents a distribution network quite complex, with water subjected to further treatments of various kinds, mainly used by and for people in a less than perfect state of health, and in the presence of a section where the water is used for the fire-fighting system.

The development of a WSP involves a number of phases [3, 4], shown in the diagram in Figure 1, which at the same time represent its structure, starting with the description of the water system in its current state (plant, uses and users). The subsequent assessment involves first of all the identification of the hazards associated with the various sections of the system, and that of the existing control measures for each identified hazard, for which a validation of effectiveness is carried out; this allows the definition of a risk matrix associated with the hazards and the identification of any additional or improvement control measures. The control of risks consists in the implementation of control measures according to what is established in the WSP, but also the periodic evaluation of the efficiency of the provided measures, and therefore the design of monitoring programs and the possible definition of corrective actions; the control of risks also includes the verification that what is reported in the WSP is put into practice, according to the prefixed scheme, and that this implies the expected consequences, among which above all the achievement and maintenance of the indicator parameters of quality of water intended for human consumption. An integral part of a WSP is the identification of the team responsible for its implementation.

This paper refers to the activity of development and drafting of the WSP of the Campus Bio-Medico University Hospital of Rome, which took place in the first six months of 2018.

2. Structure and Articulation of a Water Safety Plan

As shown in Figure 1, the development of a WSP begins with the description of the water system. The description of the water system, to be reported in a dedicated document, includes information about the characteristics of the water, drawn at the entry points and delivered to the points of use, and the features of the building’s occupants in terms of population typology. The information, deriving from archives, databases and inspections, concerns the quality specifications of the water arriving at the distribution, the characteristics of the storage phases, the treatments carried out, the description of the distribution process, the connection between the networks, the mixing and storage methods, the materials used in the distribution system, or in any case in contact with the water resource, the physical separation between the cold and hot water distribution systems, the insulation of the pipes, the description of the components (valves, anti-backflow devices, temperature regulating devices etc.), the presence of intermittent and seasonal use areas and / or of dead branches, the description of the population groups accessing the resource, with particular attention to the most vulnerable.

The evaluation of the system starts with the identification of hazards, which may lead to adverse events at each stage of distribution.

Regarding the contamination hazards, from microbiological, chemical and physical to radiological nature, the dangerous events can occur at different sites of the system and have various origins, such as a discontinuous distribution, a bad quality of the water supplied by the company, the bad conditions of the distribution system, the events occurring inside the building (e.g. cross connection of water of different quality, unintentional connections during maintenance, inadequate prevention of backflow at the point of use, with possible contamination with substances used by the equipment, dispersion of chemicals, inadequate protection of storage tanks).

With regard to microbiological contamination, there are two possible origins: it can be faucal (bacteria, viruses, protozoa) and occur through the public network and specific pipelines, due to internal failures (open storage tanks, connections with recycled water) and poor hygiene of the points of use, or related to environmental microorganisms (such as Legionella, Klebsiella and Pseudomonas Aeruginosa), whose growth is favored by certain conditions of flow and components (such as gaskets, thermostatic valves and drains) thanks to the development of biofilm.

As regards the conditions associated with microbial growth and biofilm, in the case of cold water these are related to low flow and stagnation, some temperature ranges, presence of scale, corrosion, suspended particulate matter (possible nutrient for the microbial population), poor maintenance or infrequent use of the devices. In the case of hot water, the favorable conditions for microbial proliferation and biofilm development are related to low temperature (due to ineffective heating, inadequate control, poor insulation, incorrect positioning of thermostatic mixing valves), poor flow, corrosion, scaling and inadequate maintenance. As concerns chemical contamination, the related pollutants come mainly from environmental sources, water treatment and materials in contact with water. In conditions of complete control of the quality of the circulating water in the system, and in the presence of specific quality requirements imposed on the supplying company, that delivers the water with quality indications, it is worth considering the possibility that equipment present in the building and using chemicals may be the site of back siphoning, and that further treatments, to improve the quality of the water compared to that supplied, or to meet demands for special purposes (e.g. dialysis), usually filtration, disinfection, softening, may also be a source of chemical hazard. The release of substances (the concentration of which can be high in the presence of low flow or stagnation conditions), is due to release from materials or corrosion phenomena, the latter favored by pH, chlorine, disinfectants, hardness, by materials of poor quality or not compatible with the water, water stagnation and temperature.

Figure 1. Development stages and articulation of a water safety plan

The identified hazards may give rise to risks whose level must be assessed (for instance with the usual construction of a risk matrix, starting from an assigned probability of the hazard and the severity of the consequences), also and above all in relation to the number and vulnerability of the people present, and, if necessary, controlled. For example, the probability of an event can be ranked from level 1 (related to events that have not occurred in the past) to level 5 (related to events that are practically certain, as they have occurred frequently in the past), through intermediate levels, as level 3 (related to plausible events, occurring under realistic conditions). For the magnitude of effects, the ranking can range from level 1 (related to insignificant effect on safety and organoleptic water quality) to level 5 (related to clear effect on health) through level 3 (related to non compliance of parameters, without health consequences) [5]. The risks considered unacceptable are assigned a priority of intervention (additional or corrective mitigation measures).

How risk assessment or prioritization is done varies with the size of the building. If for a small building one can rely on the judgment (and experience) of the WSP team, a more structured approach should be used for more complex buildings [3]. The assessment should be developed on the basis of what is available in the scientific literature and the knowledge of the WSP team, and should be site-specific, without extrapolation from “similar” situations; in relation to hazards for which there are significant uncertainties, the assessment should be precautionary; risks considered to be serious should be examined in relation to the validation of control measures.

Among control measures, the related activities and processes can be preventive, as treatment (such as filtration, softening, etc.), technical (such as temperature control, maintenance), and behavioural (how water is used). They should be defined specifically and precisely for all significant risks and adapted to the actual case. Once their effectiveness has been assessed, they can be modified and / or accompanied by additional measures. Validation is the process, which may take the form of intensive monitoring or of analysis of published data and studies provided by the company responsible for the distribution, or may use information derived from the implementation of similar measures in other buildings, which demonstrate the effectiveness of the adopted measures in achieving the expected results.

Control measures to reduce microbial contamination include treatment at the point of entry (especially in healthcare facilities), such as filtration, disinfection, softening, and often at points of use (e.g. with carbon filters). Physical separation of systems, related to different types of water, should be ensured in the building and they should be marked to verify the possible occurrence of cross contamination. For systems and devices connected to the drinking water network, an anti-backflow device must be provided (the decree makes explicit reference to UNI EN 1717 [6] and UNI CEN / TR 16355 [7] which establish criteria to prevent backflow and proliferation of Legionella).

In order to prevent the growth of microorganisms such as Legionella and Pseudomonas aeruginosa control measures should be provided in the building water system. These measures are based on proper design (avoiding stagnation and low flow, dead branches, incorrect distribution through the branches) and management of the limit temperature of biofilm development; additional filtration units can be installed at points of use, such as showers and taps, in case of high risk (e.g. for intensive care).

With regard to materials, corrosion can be reduced with suitable materials, by avoiding contact between different metals and preventing biofilm formation as well as with water treatments able to remove corrosive ions (chloride) and to add corrosion inhibitors.

To evaluate the effectiveness and performance of each existing or additional measure, risk control requires to establish specific monitor procedures. Each control measure should include operating limits and / or ranges, defining acceptable performance, which should be discussed and identified also with health management; control measures are considered effective if the monitoring results meet the limits. The monitoring plan provided in a WSP establishes: what, how, where, when and how often should be monitored; who performs the analyses, who receives the results, and who is responsible for implementing any corrective actions. It takes the form of a planned sequence of inspections of the selected observable characteristics, with even simple field measurements (such as checking water turbidity, temperature, chlorine concentration), on the basis of the assumption that the more tests are carried out in the field fast and cheap, the less expensive and time-consuming laboratory tests (chemical or microbiological) are required.

All the aspects of the WSP, described so far, are documented in a management plan.

3. The Campus Bio-Medico University Hospital of Rome

The Campus Bio-Medico University Hospital of Rome is located in the south of Rome and operates both in agreement with the National Health Service (NHS) and privately. It has a capacity of 400 beds and 18 operating theaters, including outpatient services, day-hospital, day-surgery and inpatient wards organized by intensity of care.

With regard to the design of the WSP, the Health Management and the Prevention, Protection and Environment Service have decided to proceed by successive steps, limiting the design to aspects related to water intended for human consumption.

3.1 Description

The water is distributed by rings, placed on the ceiling of the -2 level of the building, from which all the upright columns start; inside, each upright column feeds at each floor two bathrooms placed specularly. The rings distribute cold, hot and recirculating water. Rings and distribution network are entirely made of copper, a better inhibitor for the development of Legionella than stainless steel, PVC and cross-linked polyethylene [8]; galvanized steel and stainless steel are used in the water and heating centrals. The water central feeding the distribution rings is located at floor -2 and, starting from the connection to the aqueduct (with an anti-backflow system to avoid contamination of the public network), includes filtration treatments, subsequent pressurization with a pumping group and autoclave, softening and, for domestic hot water, preparation. In addition to the rings, cold water is sent to the network section dedicated to the plants (evaporative towers, refrigeration central etc.). Into the water central there are the demineralizers and subsequent pressurization groups for the treatment of water intended for sterilization, laboratories, steam production. What is described is shown in the scheme of Figure 2. Some of the main technical characteristics are reported in Table 1.

The initial filtration is carried out to eliminate any sediments, sand, rust etc. by a group of four multiple cartridge filters, with AISI316 L stainless steel container. Softening - which reduces the hardness of water for human consumption to 15° f and, with a subsequent stage, that of water for technical use to about 2° f - is carried out by double column softeners; each device consists of two containers of resins for ion exchange, suitable for contact with food substances, with maneuver batteries for automatic control of production and regeneration. There is a BASIC 80 type system for disinfecting the resins during regeneration, with a metering pump (nominal flow rate 8 l/h) controlled by the softener and a container for the storage of sodium hypochlorite. For the preparation of water for technical use (supply of central heating and steam substation, sterilizers, laboratories), adequate chemical conditioning is provided where required, and the demineralization system is reverse osmosis. The general pressurization group is equipped with four vertical multistage centrifugal electric pumps (stage chamber and external casing in stainless steel) and with suction and delivery manifolds in galvanized steel.

For the two stainless steel autoclaves, each with a capacity of 2000 liters, it was not possible to retrieve the technical data from the available documentation.

Immediately upstream of the pressurization unit, there are 19 vertical storage tanks for drinking water (6760 l, 6 bar in operation) of type at floor, made of galvanized steel inside and outside and with external anti-condensation insulation in closed-cell polyethylene and sky coating, and with shut-off level indicator, drain cock, pressure gauge on 3-way cock, air bleed valve for pressurized tanks; the water outlet at 15℃ is at the bottom, the inlet is at the top.

For the preparation of domestic hot water in the water central, 3 stainless steel boilers are available, each of 5000 liters; also in this case it was not possible to trace the technical characteristics through the available documentation.

Figure 2. Water central scheme

Table 1. Main equipment characteristics of the water central



Initial filtration

For each unit: nominal flow rate 43.2 m3 / h, maximum operating pressure 8 bar, 9 cartridges 40 'long, filtration degree 20µm


For each exchange column: 1904 liters of resin, 243/367 m3 / cycle treated, 150/328 kg of regeneration salt, max flow rate 114 m3 / h, max pressure drops 1.2 bar, operating pressure 2-7 bar, regeneration time 70 minutes, 8.6 m3 regeneration drains, 1900 kg salt in container


Reverse osmosis with pre-filter in AISI316 L stainless steel with multiple cartridges; automatic silica sand dechlorinator filter with container in electro-welded steel sheet, treated against corrosion with non-toxic epoxy paint and thermosetting polyester; control battery of the operating phases (5 hydropneumatic Noryl valves diaphragm with pipes and fittings in non-toxic PVC for potable use); final filter in AISI316 L stainless steel with multiple cartridges; reverse osmosis desalinator with 3 units - each with multistage centrifugal pump in AISI 316 stainless steel, group of osmotic membranes in polyamide aromatic in pressure tanks in reinforced glass fiber, hydraulic unit in PVC (low pressure part) and AISI 316 stainless steel (high pressure part), support frame in electro-welded carbon steel protected against corrosion


MVI 5004 electric pumps, GG 25 pump body, max fluid temperature -15℃ + 120℃, flow rate 4 * 40 m3 / h, head 50 meters of water column, max operating pressure 16 bar, motor power (P2) 4 * 11 kW, number rpm 2950; pressure switch (one per pump) for operation in the event of a frequency converter failure.

Chemical conditioning

For central heating power supply: suction and delivery kit (suction filter, soft suction pipe, semi-rigid delivery pipe, injection valve); nominal flow rate 8 liters / hour, max counter pressure 8 bar, polypropylene body, pump head and polypropylene / PTFE membrane, polypropylene delivery and suction connections, PTFE seals, Viton lip valves, CHEM B34 conditioning product.

For steam generators supply: suction and delivery kit (suction filter, soft suction pipe, semi-rigid delivery pipe, injection valve); nominal flow rate 8 liters / hour, max counter pressure 8 bar, polypropylene body, pump head and polypropylene / PTFE membrane, polypropylene delivery and suction connections, PTFE seals, Viton lip valves, CHEM B32 conditioning product.

3.2 Assessment

The system of the Bio-Medico Campus of Rome corresponds to the C7 system of UNI CEN / TR 16355, mixed hot and cold water, accumulation upstream of the mixing valves, no recirculation of mixed water. In the case of the C7 system, the temperature of the hot water must not be below 55℃ for the whole day or be, at least 1 hour per day, not lower than 60℃. For disinfection, it must be possible to increase the temperature up to 70℃ at any point in the system. To avoid the risk of scalding, it must be verified that thermostatic valves compliant with UNI EN 1111 [9] or UNI EN 1287 [10] are installed just before use. The temperature of cold water must not exceed 25℃, otherwise it must be drained and disinfected. Systems should be designed to prevent stagnation areas under typical conditions of use; to avoid long periods of stagnation, water in all parts of the system in any case should be removed at least weekly; cut ends should be as short as possible (in any case less than twice the internal diameter of the pipe); blind sections should be removed or disconnected and converted to cut ends; rarely used pipes should be insulated with a shut-off device (the pipe between the device and branch should be as short as possible and in any case no longer than 150 mm) or drained regularly.

To prevent biofilm formation, sediment should be removed regularly from tanks, water heaters and expansion vessels and its formation should be prevented by respecting the design parameters given in literatures [11, 12].

For the backflow conditions, the subject of the study [6], both by back-siphoning (for pressure drop in the drinking water system) and by pressure backflow (back pressure in the non-potable water system), the analysis leads to an installation matrix (of the type in Table 2), in which fluid categories and pressures involved are associated, and subsequently to the selection of appropriate protection units (based on the degree of risk coverage that each unit can guarantee for the different fluid categories). An element of prevention with respect to backflow conditions is the separation between fluids with single or double walls, with neutral intermediate zones, containing gas, or porous inert material or a fluid of category <4. Double wall is used in case of category 4 or 5 of fluids.

For the identification of hazards and risk assessment, the guidelines and regulations were taken into account.

It should be mentioned that the water supplied by the company has concentrations of Pseudomonas Aeruginosa and Klebsiella equal to 0 CFU / 100 ml. The possible presence of microorganisms in the system is mainly due to incorrect distribution, crossing points between different types of water and failure to prevent backflow at the points of use. Note that the filtration group can represent a hazard if filters are absent or improperly maintained. Following the path of the water starting from the aqueduct, the critical points, if any, for backflow locations are identified. Once the system in its components and its functioning has been clearly identified and described, Table 3 has been constructed, reporting all the identified hazards, the corresponding category (chemical or microbiological), the underway control measures, the indications relating to risk assessment, the risk index, the further investigations required and the new control measures to be implemented.

With regard to hazard 1, adverse circumstances arose during an inspection procedure. Such procedure involves the inspection of the 19 tanks carried out over a period of six months by deactivating a line fed by 3 thanks every month (so that 18 thanks are inspected in 6 months); one tank was found to be completely oxidized, most likely due to the imperfect integrity of the material from the start due to a manufacturing defect (although the tanks are galvanized, for the use and maintenance carried out on them they should not be oxidized). The Polyclinic has chosen to intervene with the installation of a special protective film, the specifications of which have not been provided, capable of isolating oxidation and allowing the re-insertion of the accumulation in the specific line.

Hazard 2 is related to the water temperature that must be not lower than 55℃ along the entire path (UNI CEN / TR 16355, system C7), up to the thermostatic valve, to prevent the proliferation of Legionella throughout the system. The first check consists of evaluating the temperature immediately after leaving the boiler (and immediately before returning for recirculation). The thermostatic mixing valve is placed immediately upstream of the user, to avoid burns to the patient and ensure a temperature at the tap of 45℃. The temperature is checked by bypassing the cold line, so that only hot water flows in the circuit. In the presence of temperatures lower than that indicated by the standard, microbiological analysis (Legionella) and, if necessary, thermal disinfection are carried out.

Table 2. Installation matrix: Pressures involved for each category of fluid









Water intended for human consumption, taken directly from the drinking water distribution system

Fluid that does not imply a danger to human health, i.e. fluid taken directly from the drinking water system whose smell, taste and color may have changed or whose temperature may have changed

Fluid dangerous for human health due to the presence of harmful substances

Fluid dangerous to health due to the presence of toxic, radioactive, carcinogenic substances

Fluid that constitutes a health hazard due to the presence of microbiological or viral elements



Stagnant water, ice water, steam, hot sanitary water, demineralized water

Water and antifreeze, water and solid elements, water and detergents

Water and coolant, water and surfactants

Toilet water, swimming pool water

P = Patm






P > Patm






Table 3. Hazard identification and risk assessment










Water contamination due to tank material degradation

T <55℃ upstream of the thermostatic mixing valve

Temperature stratification in the boilers and presence of sediments

Contamination of the bedpan washer system

Stagnant water after maintenance of branch

Presence of microorganisms at water tap in immunosuppressed rooms

Hazard Category









Control measure

Inspection with emptying and cleaning every six months

T control through the bypass (hot water flows into the circuit avoiding mixing and verifying effective T)

Sediment check (with visual inspection of water transparency).

Every 6 months cleaning with acid

Bedpan washer installed according to current legislation

Check T <25℃ in that section

Implement measures of WSP to ensure maximum quality at the tap

Indication for risk assessment

Accumulated water that will be distributed inside the system

T <55℃ promotes the development of Legionella

Temperature stratification promotes the proliferation of Legionella

If installation is not carried out in accordance with the regulations, it is likely a backflow situation with contamination of the drinking water system

Stagnant water condition promotes growth of microorganisms (especially Legionella)

Presence of microorganisms even in concentrations acceptable for normal hospital rooms implies a high risk for immunosuppressed patients

Risk level







Other investigations

Check the state of wear of the tank

Water analysis to verify the presence of Legionella





New control measures

Replace old tank or use protective film

In the presence of Legionella disinfection

Specific anti-legionella installations (molybdenum austenitic stainless steel, tube bundle facing downwards).

Bleeding of a certain number of liters per month

Adapt to the standard (anti-backflow system)

Carry out emptying and flushing

Absolute filters installation

Hazard 3 concerns the stratification of the thermal field inside the boilers. The Polyclinic did not originally install boilers with tube bundles facing downwards, in order to avoid sedimentation and proliferation of Legionella (in thermally favorable areas), but has provided for purging every 6 months and subsequent cleaning with acid; this counteracts sedimentation (with the onset, however, of a chemical risk) but not the proliferation of Legionella. The choice to proceed with small purges (a few liters) of the boiler every month can be a valid alternative to what is already done (not wanting to proceed to the replacement of the boilers with anti-legionella ones).

Hazard 4, contamination of the system as a result of incorrect installation of the bedpan washer, represents a risk only in the case of installations and maintenance that are not compliant with the standard, an event that has been ruled out following verification.

Hazard 5 concerns the stagnation of water in some sections of the network, immediately after maintenance interventions, with an increased risk of proliferation of microorganisms, especially Legionella. In this case, the only guarantee, a necessary but not sufficient condition for non-proliferation, is represented by the temperature of the circulating water at values lower than 25℃ (so-called cellar values), which presumably should not be exceeded, given the fact that the outlet temperature of the storage tanks is around 15℃ and that the entire distribution network is insulated.

Hazard 6 relates to the risk of contamination in the presence of immunosuppressed patients, for which an individual case is assessed. In the rooms assigned to them (and not for normal hospital rooms) an absolute filter must be installed in correspondence of the supply tap.

Regarding the reduction of the risk of cross contamination between two fluids, adequate protection units have been installed according to UNI EN 1717: between water intended for human consumption (cat.1) and technical water (cat.2), protection units of BA type (controllable disconnectors with reduced pressure zone), for example in correspondence of the reverse osmosis unit; between waters of the same category (cat.1), check valves, for example in correspondence of the initial filtration or pressurization group and autoclaves.

In particular, with regard to hazards 2, 3, 5 and 6, the Health Department has deemed it appropriate to immediately implement what was suggested.

4. Conclusions

The work illustrated the methods of design and drafting of the Water Safety Plan, according to Italian Ministerial Decree 14.06.2017, for the Campus Bio-Medico University Hospital of Rome, with particular reference to water intended for human consumption. The WSP was developed on the basis of all technical documentation available in the Polyclinic related to the water-sanitary system, and following inspections at the water central and the heating central, essential to compare what is documented with what is actually present and verify the state of wear of materials and arrangement of components. The set of hazards inherent in water intended for human consumption have been detected and control measures have been identified, some already provided for by the current management, others not yet taken into consideration and included in the final document made available to the Health Management.


[1] DM 14/06/17. (2017). Transposition of (EU) Directive 2015/1787 which amends Annexes II and III of Directive 98/83 / EC on the quality of water intended for human consumption. Modification of annexes II and III of the legislative decree 2 February 2001, n. 31. Ministry of Health, Rome, Italy.

[2] D.Lgs 02/02/01 n. 31. (2001). Implementation of Directive 98/83 / EC relating to the quality of water intended for human consumption, President of the Republic, Rome, Italy.

[3] Lucentini L., Achene L., Fuscoletti V., Nigro Di Gregorio F., Pettine P. (2014). Guidelines for risk assessment and management in the supply chain of water intended for human consumption according to the Water Safety Plan model, ISTISAN Reports 14/21, National Institute of Health, Rome, Italy

[4] Romano Spica, V., Bonadonna, L., Fantuzzi, G., Liguori, G., Vitali, M., Gurnari, G., Pedullà, S. (2012). Water safety in buildings, Istisan Report 12/47, National Institute of Health, Rome, Italy.

[5] WHO. Water safety in distribution systems. (2014). World Health Organization, Geneva, Switzerland.

[6] EN 1717:2000. (2000). Protection against pollution of potable water in water installations and general requirements of devices to prevent pollution by backflow. European Committee for Standardization, Brussels, Belgium.

[7] CEN/TR 16355:2012. (2012). Recommendations for prevention of Legionella growth in installations inside buildings conveying water for human consumption. Technical report 16355. European Committee for Standardization, Brussels, Belgium.

[8] Finzi, G., Aparo, U.L., Cacciari, P., Pelissero, G., Finzi, A., Nepa, D., Villani, S. (2010). The waters in the health sector: characteristics, uses, problems and indications on control methodologies, Edicom, Milan.

[9] EN 1111:2017. (2017). Sanitary tapware - Thermostatic mixing valves (PN 10) - General technical specification. European Committee for Standardization, Brussels, Belgium.

[10] EN 1287:2017. (2017). Sanitary tapware - Low pressure thermostatic mixing valves - General technical specification. European Committee for Standardization, Brussels, Belgium.

[11] EN 806-2:2005. (2005). Specification for installations inside buildings conveying water for human consumption - Part 2: Design. on. European Committee for Standardization, Brussels, Belgium.

[12] EN 806-3:2006. Specifications for installations inside buildings conveying water for human consumption - Part 3: Pipe sizing - Simplified method. European Committee for Standardization, Brussels, Belgium.