Here are my thoughts on risk mitigation. Exposure to risk is never eliminated but it can be reduced. In my mind there are different levels of risk. Level 1 is a run of the mill water system with no history of microbial contamination, or other contamination. Level 2 water systems those with no history or contamination but have a high potential to become contaminated due to well construction (either improper construction, or shallow depth). Level 3 water systems have a history of contamination that has been addressed via treatment. Level 4 water systems those with a history of contamination and have done little to nothing to address or treat the contamination. There are lots of systems out here in Level 3 and 4 with arsenic, uranium, nitrates, fluoride, e-coli and other contaminates. Common sense would say stay away from Level 3 and 4 systems however not all contaminates are equal nor are all levels of contamination are equal. Say you have a system with uranium that has a treatment system to remove the uranium great now the water is safe but what do you do with the waste stream or media that is full of uranium?
I'm not an attorney but do the following and believe it will reduce my exposure. This would apply to doing operations in house or out sourcing.
Documentation of following industry standard Best Practices must take place.
Maintenance and repair best practice example. Do you have a written Best practice in place for a pipe repair? It would be something like this: If possible repair the leak with out depressurizing the system. If system must be depressurized for repair excavate below the level of the pipe before cutting pipe to repair, spray 200 ppm chlorine solution into parts of pipe exposed to atmosphere, repair, being chlorinating entire water system, re-pressurize, flush lines, check for leaks, place area that was depressurized on boil water notice (place notices on all affected house doors) until results of coliform bacteria sample can be obtained from laboratory demonstrating no coliform bacteria is present. Continue system wide chlorination for 1 week if system does not already continuously chlorinate. Pipe repair is a common way bacterial contamination enters the system and most repairs are done under less than sanitary conditions in a hurry up and get the system back up because every one is complaining about being out of water.
Log all system activities, Log all customer contacts
Best Practice of maintaining documented history of sampling as required by regulator authority. The system being discussed above sounds like a non community system with minimal operational or sampling requirements.
A history of compliance shows professionalism and concern for customer. A history of noncompliance is an invitation for any person who gets sick for any reason to sue you.
Hiring a third party to operate a water system does provide a partial umbrella to liability assuming they are doing the above. However it does not provide a complete umbrella and the third party must be managed to assure compliance and best practices are maintained. The same way that a park manager cant be left to their own devises neither can a water system operator. How many stories have you heard about managers robing the park blind. There are operators (in house and out of house) putting the bulls-eye on the park by sloppy operation of the water sytem. Obviously the third part should have adequate liability insurance, workers comp insurance, vehicle insurance etc.
I have two standard clauses in my operation contracts. In the first one the system owner acknowledges that there are many possible sources of contamination to the water source, and that operator has no control over these. However by following industry best practices these can be identified, and reduced. The second clause is the ability to terminate the contract if the owner fails to follow industry best practices, or operators advice is ignored and this either does or has the potential to increase health risks, or violates any state or federal standard. These clauses theoretically reduce my risk exposure.
Hope this helps