When the implementation of water safety plans fail: rethinking the approach to water safety planning following a serious waterborne outbreak and implications for subsequent water sector reforms

A water safety plan (WSP) is a tool or process for water suppliers to use in the provision of safe drinking water. WSPs identify and prioritise risks to drinking water supplies from source to the point of supply, and document actions that should be taken to reduce those risks (Gunnarsdottir et al. 2012). The World Health Organisation recommended the use of WSPs in 2005, and by 2016 up to 90 countries were at least in the process of adopting and implementing WSPs (Roeger & Tavares 2018).

In New Zealand, WSPs started out as Public Health Risk Management Plans (Taylor 2002; Ministry of Health 2005) with the aim of identifying each water supply's specific risks and associated controls, then determining management priorities balancing benefits and costs. This was the final part of a range of measures that the Ministry had introduced from 1992 including drinking water standards, public health grading of drinking water supplies, a compliance data management system, comprehensive guidelines for drinking water quality management, a published annual Report on the Microbiological Quality of Drinking Water Supplies in New Zealand and a capital funding subsidy scheme for drinking water supplies introduced in 2005 (Taylor 2002; Ministry of Health 2006; Stimpson & Co 2006).

The New Zealand Health (Drinking Water) Amendment Act 2007 and changes to the Health Act (1956) mandated a range of duties for drinking water suppliers, including phasing in the preparation of WSPs for supplies serving more than 500 people. The amendment to the Health Act also created the position of Drinking Water Assessor (DWA), within Public Health Units to provide regulatory services for drinking water suppliers (Bell 2017). The Act set out a range of powers and duties for DWAs including the authority to verify the adequacy of, and as an appropriate source to approve WSPs for drinking water. Approved WSPs were certified for their implementation as appropriate.

New Zealand water suppliers began preparing WSPs in 2005 (Ministry of Health 2005). The Ministry of Health provided guidance on what should be included in WSPs which were approved by DWAs if they closely followed the guidance (Ministry of Health 2014). In 2008, the Drinking Water Standards for New Zealand (Ministry of Health 2008) (now revoked) allowed reduced sampling requirements for supplies that provided water to less than 500 people if the supplier elected to prepare a WSP.

In August 2016, a waterborne illness outbreak in Havelock North in New Zealand's North Island resulted in between 6,260 and 8,320 cases of illness linked to contamination of the water supply and Campylobacter infection contributed to at least four deaths (Gilpin et al. 2020). The Hastings District Council (HDC) operated the Havelock North water supply. At that time, while the Havelock North drinking water supply was known to have a history of transgressions (Ministry of Health 2017) they nonetheless had an approved WSP.

The Government Inquiry into this outbreak (2017) found that there were fundamental problems with the existing regulatory regime and recommended the establishment of a ‘dedicated drinking water regulator’. In response, the Government established Taumata Arowai in 2021, an independent crown entity. The new agency is also a key component of New Zealand's wider water reform programme and is supported by a number of legislative and operational changes.

In this paper, we address the question of why the WSP in place at the time of the Havelock North outbreak failed to prevent it. While the systems continue to change, many of the key failings that occurred in 2016 provide valuable lessons for ongoing safe water supply.

At the time of the outbreak, the HDC had an approved WSP, dated January 2015. We have reviewed this WSP (HDC 2015), the New Zealand Ministry of Health Framework on How to Prepare and Develop Water Safety Plans for Drinking Water Supplies (2014), Drinking Water Safety Plan Framework (2018), Handbook for Preparing a Water Safety Plan (2019), Annual Drinking Water Reports (2013a, 2016, 2017), and the Government Inquiry (Government Inquiry into Havelock North Drinking Water 2017), in the context of the 2016 Havelock North outbreak (Gilpin et al. 2020), to address the question of why the WSP failed to protect public health. Quotes from the HDC WSP have been included in italics in the text.

The HDC operates the Hastings public water supply which in 2016 served a total population of 56,000 in the adjacent towns of Flaxmere (11,324), Hastings (34,391), and Havelock North (11,623) (Ministry of Health 2017). In 2014, the annual supply of 13.5 million cubic metres was pumped from aquifers using 12 operational wells, 6 pump stations, 7 storage reservoirs, and 480 km of water mains to 21,300 residential, commercial, and industrial connections (HDC 2015). There were five water supply zones (Flaxmere, Bridge Pa, Hastings East, Hastings West & Central, and Havelock North).

This water supply is sourced entirely from groundwater abstracted from gravel aquifers beneath the Heretaunga Plains (HDC 2015). The Heretaunga Plains aquifer system has five primary confining layers recharged by seepage from the Ngarutoro River to the north (HDC 2015). The majority of Hastings water supply bores are located in the second and third confining layers at depths of 55 and 70 m.

While the water for Havelock North could be sourced from the Hastings supply, since the mid 1980s the primary water source for Havelock North was three bores on Brookvale Road (HDC 2015). The Brookvale Road bores are in a separate aquifer at a depth of approximately 25 m. The bore heads for these three bores were below the ground level, and at risk of surface flooding. As a consequence, the bore heads were installed with alarms that would turn the abstraction pumps off if flooding of the well head chamber was detected. Separate pumps were present to remove flood water from the bore head. The HDC held a resource consent from the Hawkes Bay Regional Council (HBRC) which allowed for a maximum draw of 200 L/s from the three bores.

In 2000, HDC sought to renew the existing consent for the Brookvale Road bores and extend the abstraction by an additional 50 L/s. HBRC only granted a 10-year renewal (expiry 2018) due to claims of potential adverse effects on flows in the nearby Mangateretere Stream which is located 100 m from bore 1. Expectations were that the permitted draw would be reduced to 90 L/s, a level that could be supplied by Brookvale bore 3. Therefore, HDC planned to decommission Brookvale bores 1 and 2. There was no treatment of the water, and a chlorine residual was not maintained as a barrier to contamination in any part of the network. However emergency chlorination injection systems had been installed at all except the smallest capacity pump station (which was to be turned off in a contamination event, or an emergency system installed) so that in the event of contamination, within 6 h the entire network could be chlorinated (HDC 2015).

On the weekend of the 5 and 6 August 2016, a severe weather event occurred in the Hawkes Bay region with 165 mm of rainfall, resulting in considerable flooding and power cuts. Prior to this there had been very little rainfall, with the Mangaterere stream effectively dry, and no flow recorded. The adjacent farmland, which was normally used for horticultural purposes, was at the time being used to fatten up several thousand sheep. Two mechanisms of contamination occurred, both related to farm runoff contaminated with sheep faeces. The first was the bore heads for Brookvale Road bores 1 and 2, which were being used at the time, which were flooded with the runoff from the paddocks with sheep.

Second, power cuts that occurred because of snowfall stopped the bore pumps operating, but also meant the pumps installed to remove water from the bore head were only reactivated when the power resumed. While it is likely some contamination entered the bores via this route, the primary source of contamination was likely to be via the Mangaterere stream (Gilpin et al. 2020). Runoff into the stream from adjacent paddocks was drawn into the aquifer because of the hydraulic gradient created by the bore pumps. It is hypothesised that remains of willow tree roots in the Mangaterere Stream created a pathway for water to penetrate the impermeable layer above the aquifer. Subsequent dye testing demonstrated that within 24–48 h of fluorescein dye being added to the stream, it could be detected in water pumped from the bore.

Consequently, the water supply was contaminated with E. coli and Campylobacter jejuni from Monday 7 August, with the first cases definitively connected to the outbreak experiencing symptoms beginning Tuesday 8. The outbreak was recognised on Friday 12 August, with chlorination instigated that day. By the early hours of Saturday 13 August, a chlorinated network was achieved, and there was no evidence for additional clinical cases occurring because of drinking water from this point on.

HDC had an approved WSP for the Hastings water supply. Following a series of workshops with Council staff, a consulting company prepared the first draft of a WSP for the HDC in May 2012. A second draft was approved in July 2013, and in January 2015, the 1st Audit of the WSP was approved, after an implementation review by the district health board.

The WSP covered catchment management (aquifers), source protection (bore heads), the distribution network and emergency response. In this section a number of potential issues with the WSP are identified.

Perhaps the most important component of the WSP was the Risk Register, which identified potential events that could influence the water supply and public health risk. A risk rating for each event based on likelihood of the events and consequence or outcome if the event occurs was prepared (Table 1). Where impact affected both public health and continuity of supply, the higher impact would be used.

It is notable that the likelihood and consequence scales and the risk matrix used in the WSP (Table 1) were significantly different to those provided in the Ministry of Health's A Framework on How to Prepare and Develop Water Safety Plans for Drinking-water Supplies (2014) i.e., there were fewer risk combinations resulting in ‘high’ or above in the table adopted. In the WSP a risk rating of ‘high’ was agreed upon as the threshold for treating the risk as a priority (HDC 2015).

For the risks identified, it is not stated in the risk tables whether the risk related to public health impacts or continuity of supply – a combined risk was reported. Of the consequences likely related to public health risk, 21 were classified as insignificant, 23 as minor and 2 as moderate. When adjusted by likelihood none met the criteria of high. Subsequent to this outbreak, The Ministry of Health Framework and Handbook (Ministry of Health 2018, 2019) gave much more detail in the description of likelihood and consequence for the risk assessment process.

The Hastings WSP risk register did identify risks that occurred during the Havelock North outbreak including those related to security of source water, bore head security (presence of animals near bores, flooding of the bores), and extreme events but mitigative actions were not implemented.

Throughout the WSP it is apparent that there was an unwavering belief in the absolute security and quality of the ground water. At the time this was the basis for secure status of the bores, and not chlorinating the supply: ‘Water sourced from wells with proven secure status will not be treated’ (HDC 2015 p16). However, this was yet to be confirmed: ‘All supply wells in the Hastings and Havelock North area are believed to be capable of achieving secure status… although formal confirmation from the Ministry of Health needs to be sought’ (HDC 2015 p16). The Brookvale bores did not have a current secure status classification, and in the absence of this the water should have been treated. The Ministry of Health (2008) stated ‘Where a treatment plant receives water from both secure and non-secure bore water, the supply must be classified as arising from non-secure bore water while the non-secure bore water is contributing to the treatment plant’ (Ministry of Health 2008 p45) and ‘Apart from bore waters confirmed as secure bore water, all source waters are assumed to contain faecal bacteria, so require some form of disinfection or process that will reliably remove bacteria’ (Ministry of Health 2008 p15).

The Ministry of Health (2008) explained three security criteria: (1) demonstrating that the bore water is not directly affected by surface or climate influences (e.g. age-dating), (2) showing that the bore head provides satisfactory protection and (3) demonstrating the absence of E. coli (for between 1 and 5 years depending on the depth, i.e. length of the casing to the shallowest screen). Ongoing compliance requirements for secure bore water and responses to E. coli detection in bore water were also required. Drinking water standards at the time (Ministry of Health 2008) required only monthly source water sampling for secure bore water supplies, a security requirement that was not met by the Brookvale bores, as noted above.

The security of the aquifer was assessed by age-dating which suggested the Havelock North water was at least 20 years old and therefore ‘the aquifers are considered secure’ (HDC 2015 p8). In contrast, the WSP highlighted that the operation of the Brookvale bores impacted flows in the Mangateretere Stream, and in another part of the network, that the Portsmouth Road bore had potential depletion effects on the Irongate Stream (HDC 2015). The implication here is that at least some of the stream flow is from recharge from the aquifer. If the water can flow from the aquifer to the stream, then failing to recognise flow in the reverse direction, particularly when pumping creates hydraulic gradients, was a serious oversight. The age-dating was performed every 5 years and is unlikely to have coincided with intermittent conditions when water from the Mangateretere Stream was entering the aquifer. Subsequent age-dating work has suggested that while most of the aquifer water was greater than 20 years old, a small, but significant proportion could be less than 48 h old.

The WSP stated that ‘all the bores supplying the Hastings supply can be considered secure’ (HDC 2015 p26) despite identifying risks, e.g. ‘The well head chambers at Brookvale have been prone to surface flooding’ (HDC 2015 p11). To avoid contaminated water entering the well, should the chamber be flooded, alarms were fitted to prevent pump operation, and there were also submersible pumps to remove any water that should enter the bore head. However the risk was dismissed:

The criterion for bore head protection at the time required that animals were excluded from within 5 m of the bore head (Ministry of Health 2008). The WSP identified that while the other bores were more than 5 m from land where farming or stock animals are permitted, the Brookvale 1 and 2 bores were located only 2.5 m from adjacent farmland.

The validity of a 5-m setback providing sufficient protection when surface flooding is identified as the issue is arguable, but perhaps the bigger issue is the failure to instigate more proactive steps for monitoring or controlling livestock introduction.

The drinking water standards at that time (Ministry of Health 2008 p23) clearly stated ‘E. coli must not be present in drinking-water leaving the water treatment plant or in the distribution zones’. If present, the immediate responses specified included inspection of the plant and source, sampling at the plant and in the distribution at the original and adjacent sites, investigating the cause and taking remedial action and providing a record of the remedial actions provided to the DWA. For ‘secure’ bore water if E. coli was found in any sample of drinking water entering the distribution system, additional steps included checks that the bore head provided adequate protection and additional E. coli monitoring (Ministry of Health 2008 p46).

As noted in the WSP, there had been an E. coli detection in the source water, and multiple detections in the reticulated water (Table 2).

However, despite these recurring detections being primarily in the Havelock North network, they were largely dismissed as demonstrated by these comments.

This inaccurately optimistic interpretation of the importance of these detections had significant influence on decisions to not treat the drinking water.

This is another example of a narrow interpretation of how to satisfy the guidelines is insufficient for effective management of drinking water risks and is something that WSPs are intended to overcome.’

In the Hastings WSP risk tables (HDC 2015 p33–70) responses to detection of E. coli in source water monitoring included to follow the ‘water supply E. coli contamination protocol’ HDC 2015 p5) but the defined event ‘Contaminated water getting into the bore/ well from the surface’ (HDC 2015 p38–40) didn't reference the water supply E. coli contamination protocol.

Underestimating the risks from the Mangaterere stream on the integrity of the aquifer is perhaps understandable based on the limited hydrological understanding at the time. In light of observations that over 50% of waterborne outbreaks worldwide are related to heavy rainfall and flooding (Cann et al. 2013), a greater emphasis on extreme weather events would have been prudent. The Ministry of Health Guidelines at the time (Ministry of Health 2013 p103) highlighted ‘The classification of a bore water as secure is not necessarily a permanent status. Signs that a supply may lose its secure status include: extreme events, such as floods or droughts, which may affect groundwater quality’. There are multiple references in the Hastings WSP to needing to develop contingency plans for contamination of water source/supply, but it is not clear that contingency measures were implemented in the event of heavy rainfall and flooding, or included reasonable steps such as increased E. coli sampling, inspections and precautionary measures such as chlorination, prior to E. coli being detected in routine sampling. These could have prevented or minimised this outbreak. There also needed to be recognition that chlorination alone would be insufficient in the event of Cryptosporidium entering the water supply.

One valuable feature of a WSP is that it provides insights into the logic, thinking and understanding of those who created the document. In a number of places, the WSP emphasises a narrow and somewhat optimistic compliance focus rather than a focus on assuring the risk to public health is adequately managed. For example:

The Havelock North Inquiry reported that WSPs in New Zealand were ‘largely treated as an exercise in compliance with the Health Act rather than as a valuable tool for a water supplier's management and operational staff to actively understand and manage public health risks’ (Government Inquiry into Havelock North Drinking Water 2017 p179). The Inquiry considered that the concept of water safety planning had not been properly understood by many water suppliers and cited issues including (Government Inquiry into Havelock North Drinking Water 2017 p180):’

• (a)

  ‘WSPs being prepared and then 'left on the shelf' rather than being part of everyday operations and the subject of constant feedback’.

• (b)

  ‘Preparation of WSPs being largely outsourced to consultants without appropriate contribution and ownership by the water supplier’.

• (c)

  ‘Failure to have appropriate personnel across the various levels of a water supplier involved in the development, implementation, and ongoing review of WSPs’.

• (d)

  ‘Failure to integrate WSPs into broader risk management, long-term planning, and resource allocation decisions to ensure that significant costs are planned for and project work undertaken’.

• (e)

  ‘Water suppliers either not allocating, or not being able to allocate, sufficient resources for the effective development, implementation, and review of WSPs’.

• (f)

  ‘Focus on achieving only the minima required by the Health Act, rather than improving over time in accordance with international best practice’.

This inherent tendency to complacency with rare, but high impact events, justifies a very high standard of care and diligence. At the time the Health Act referred to ‘the ‘all practicable steps’ test, and ‘affordability’ components which, in effect, made compliance discretionary in many cases. These undoubtedly affected the WSP. Both have been removed from current guidelines. The plans to decommission the Brookvale bores 1 & 2 are likely to have also influenced priority given to addressing issues. While rare events may only happen every 20 years, the event could be tomorrow and could, as in the Havelock North case, be catastrophic.

In a number of places the WSP makes statements which are attributed to external scientific experts. For example:

In addition to the second statement being incorrect, without identifying who the experts are, or providing references to these statements, a user or reviewer of the WSP is unable to verify whether the authors have correctly interpreted this expert commentary.

While under the mandate of a single supplier, the WSP grouped together a number of separate supply sources. The Flaxmere and Havelock North bores may have been higher risk than the other bores which supplied Hastings. This combining together of sites during risk assessment can effectively average risk estimates, and potentially underestimate risk posed from some supply sites. Dedicated risk assessments for each supply zone, and each bore, should be considered.

The Havelock North outbreak was not the first waterborne outbreak in New Zealand, with a number of previous outbreaks recorded (Ball 2006). An additional omission from both that review and the WSP was mention of a 1998 outbreak in Havelock North involving the Brookvale Road bores. In this outbreak there were a number of campylobacteriosis cases, and Campylobacter was isolated from the bores. The conclusion at the time was that water draining from a paddock stocked with sheep was able to drain into the bore (Anonymous 1998). The water supply contamination investigation at the time also noted that there was doubt regarding the confined status of the source aquifer for the Brookvale Road borefields (Clark 1998). It would appear that this was lost from corporate memory, highlighting the importance of documenting and preserving all previous contamination investigations.

Four years previously, in 2012, there were 138 cases of campylobacteriosis when the drinking water supply for the town of Darfield became contaminated, most likely from sheep faeces (Bartholomew et al. 2014). In that case, there was a breakdown in chlorination, compounded by rainfall events. The factors contributing to these outbreaks are common to many others worldwide, which as described by Hrudey et al. (2006) included ‘… inadequate knowledge of source water hazards, inadequate disinfection, extreme weather (heavy precipitation, runoff), .. livestock or wildlife faecal contamination …’. Undoubtedly these will be ongoing risks, which require learning from previous experiences to avoid outbreaks occurring (Hrudey & Hrudey 2019). Ongoing and prominent awareness of both the health impacts of these waterborne outbreaks, and the causes should be a high priority.

‘Havelock North outbreak was a collective failure of regulatory issues, and flawed expert advice compounded by affordability and all practicable steps tests of the Health Act which in effect, made compliance discretionary in many cases’ (Government Inquiry into Havelock North Drinking Water 2017, p70). These have now been removed from subsequent legislation. WSPs are key management tools to understand and manage risks to water supply. The Havelock North experience emphasises that the content must be to the forefront of mind of those managing the systems, particularly to recognise and respond to changes in the system (in this case an extreme weather event, sheep close to extraction point) which may tip the balance of risk assessment to that requiring a change in response. The establishment of a dedicated drinking water regulator in New Zealand, Taumata Arowai, provided an opportunity to re-set the approach to safe drinking water through a revised regulatory system. The Water Services Act 2021 facilitates a focus for Taumata Arowai based on the new policy direction of Te Mana o te Wai and a high standard of care and diligence by water suppliers to their consumers. The first duty of water supplies is to provide safe drinking water and Taumata Arowai has consistently and strongly directed water suppliers that it is the responsibility of the water supplier to ensure water supplied to consumers is safe.

Te Mana o te Wai (Taumata Arowai 2022) is a uniquely New Zealand approach that seeks to embed the intrinsic value of water and an understanding that water has value to and of itself and that we should afford it the consideration we would a living being. Hierarchy of importance is therefore the water itself, then use of water to sustain human life, and after that, commercial use of water. The Water Services Act 2021 requires water suppliers and people to give effect to Te Mana o te Wai when performing a function, power or duty under the Water Services Act.

Taumata Arowai seeks to change the water sector's culture around WSPs to a focus on an evidence-based, scientifically validated, risk-based, preventive management approach that emphasises continuous improvement. Taumata Arowai prioritises the capability of an organisation to manage risk, rather than just focus on their preparation of WSPs. The water supplier needs to be able to prepare and implement a WSP that would fit with other risk management activities they undertake and be integrated with other parts of their water operations. If an organisation understands risk management and has capability in this area, they should understand the changing nature of risk and the need to regularly revise and update their risk tools, including their WSP. The WSP would become an output of an effective risk management programme rather than a narrow compliance goal. Taumata Arowai will not relieve water authorities of their ultimate responsibilities by formally approving WSPs, but will review WSPs for compliance with legislative requirements, and lead conversations about how the organisation sees risk, manages risk and integrates risk management into their activities. The evaluation of the water utilities risk management capability through benchmarking drives continuous improvement (Pollard et al. 2013). Countries like Australia use a broad Total Quality Management (TQM) approach to drinking water quality and safety based on a commitment to continuous improvement and a series of elements related to system analysis and management, supporting requirements such as research and development and ongoing review (NHMRC 2004; Hrudey et al. 2006).

The waterborne illness events of Darfield in 2012 and Havelock North in 2016 and the establishment of Taumata Arowai in November 2021 have provided an opportunity to refocus the approach from a narrow preparation of drinking WSPs, to building the capability and capacity of water suppliers to understand risk, integrate risk awareness and management, and to develop comprehensive approaches to ensuring that the drinking water they provide is safe for consumers.

Key issues in the Havelock North WSP included limitations related to groundwater and bore security, risks to water sources from animal faeces, risks of waterborne outbreaks in non-chlorinated drinking water supplies, and failure to recognise and respond to extreme weather events. The influence of complacency on WSP development and implementation can be seen in a compliance focused WSP rather than one demonstrating a commitment to continuous improvement e.g., limitations to risk assessments and responses to historical detections of E. coli. It is hoped that the approach by the new regulator Taumata Arowai will change the focus of WSPs and water suppliers alike. The New Zealand experience provides a compelling cautionary lesson for other jurisdictions about the challenges of fully achieving effective risk management for drinking water systems to ensure safety.

All relevant data are included in the paper or its Supplementary Information.

The authors declare there is no conflict.