What Is a Legionella Water Management Plan?
A Legionella water management plan is a written program that identifies where Legionella and other waterborne pathogens could grow in a building's water system, sets measurable control limits at those locations, and documents the monitoring and corrective actions that keep the system inside those limits.
The important word is written. A water management plan is not a piece of equipment you install. It's a document, a team, and a routine that a facility maintains and can hand to a surveyor on request.
That distinction matters, because most of the buying pressure in this category points the other way. Facility managers are usually approached with treatment hardware or testing services first and the program second. Regulators reversed that order. They ask for the program, and they leave most of the technical choices inside it to you.
If you run a hospital, a critical access hospital, a nursing home, or a senior living property, this is the instrument you're surveyed against.
Key Takeaways
The Plan Is the Deliverable
CMS Does Not Require Testing
Temperature Is the First Control
Treatment Supports, It Does Not Replace
Who Has to Have One
In the United States, the requirement lands hardest on Medicare and Medicaid certified healthcare facilities. The Centers for Medicare and Medicaid Services set the expectation in a survey memo to state agencies, QSO-17-30, originally issued in June 2017 and revised in July 2018. It applies to hospitals, critical access hospitals, and long-term care facilities.
Those building types were not chosen at random. Citing a review of US outbreaks from 2000 to 2014, CMS notes that 19 percent were associated with long-term care facilities and 15 percent with hospitals. Large, complex water systems with long distribution runs and extended low-use periods are simply where the conditions concentrate.
The memo itself is survey guidance. The legal hook underneath it is the infection control Conditions of Participation. For skilled nursing and nursing facilities, 42 CFR 483.80 requires the facility to establish and maintain an infection prevention and control program designed to provide a safe, sanitary, and comfortable environment and to help prevent the development and transmission of communicable diseases and infections. Hospitals carry a parallel obligation under 42 CFR 482.42, which requires an infection prevention and control program that includes maintaining a clean and sanitary environment to avoid sources and transmission of infection. Critical access hospitals carry theirs under 42 CFR 485.635.
CMS was explicit that the 2018 revision clarified existing expectations for hospitals and critical access hospitals rather than adding new ones. For those facilities the obligation was already there in the Conditions of Participation. The memo told surveyors what to look for.
Outside healthcare, the reach is wider than most building owners expect. ANSI/ASHRAE Standard 188-2021 applies to human-occupied commercial, institutional, multi-unit residential, and industrial buildings. Single-family homes are excluded. The standard is written in enforceable language specifically so codes and jurisdictions can adopt it, and some have. Per ASHRAE's own summary of the standard, the Uniform Plumbing Code has referenced Standard 188 since 2021, Michigan requires health facilities to implement a water management program consistent with the standard, and New York requires building owners with cooling towers to maintain a program and plan developed in accordance with it. Check your own state and local code, because adoption varies and the edition referenced varies with it.
What CMS Actually Requires, and What It Does Not
This is where the marketing around Legionella and the regulation diverge, so it's worth reading the memo closely rather than a summary of it.
The four things a plan must document
CMS states that facilities must have water management plans and documentation that, at a minimum, ensure each facility does four things:
- Conducts a facility risk assessment to identify where Legionella and other opportunistic waterborne pathogens could grow and spread in the facility water system. CMS names Pseudomonas, Acinetobacter, Burkholderia, Stenotrophomonas, nontuberculous mycobacteria, and fungi alongside Legionella.
- Develops and implements a water management program that considers the ASHRAE industry standard and the CDC toolkit, which the memo footnotes as CDC's water management program toolkit.
- Specifies testing protocols and acceptable ranges for control measures, and documents the results of testing and the corrective actions taken when control limits are not maintained.
- Maintains compliance with other applicable federal, state, and local requirements.
Read item three carefully. The requirement is that you specify your protocols and ranges, document what you measured, and document what you did when a measurement fell outside the range. The regulation is about the discipline of that loop, not about one specific number.
What CMS does not require
CMS does not require water cultures for Legionella or other opportunistic waterborne pathogens. The memo says so directly, and adds that testing protocols are at the discretion of the provider.
The surveyor expectation for long-term care is similarly narrow. LTC surveyors expect a water management plan that includes a facility risk assessment and testing protocols to be available for review, but they won't cite the facility based on the specific risk assessment or testing protocols in use.
That's a meaningful distinction, and it isn't an argument against sampling. Plenty of facilities test, and many have good reasons to. It means the citation risk sits with not having a documented, followed program, rather than with choosing the wrong sampling frequency. A facility that samples quarterly and never records what it did with the results is in worse shape than one that samples rarely and documents its control limits, its readings, and its corrective actions every single time.
How to Run the Legionella Risk Assessment
The risk assessment is the first of the four required items, and it's the one that determines everything downstream. Control locations, limits, and monitoring schedules all fall out of it. Done properly it's a walk of the building with a drawing in hand, not a form filled in at a desk.
The working sequence most programs follow:
- Draw the system. Map potable cold, potable hot, and the hot water return from the service entrance to the last fixture, including storage, heaters, mixing valves, boosters, and every branch. Non-potable systems that aerosolize, including cooling towers, decorative fountains, and misters, come onto the map too.
- Inventory the wetted assets. CMS's own list is a good starting checklist: storage tanks, water heaters, expansion tanks, water-hammer arrestors, pipes, valves and fittings, water filters, manual and electronic faucets, aerators, flow restrictors, showerheads and hoses, humidifiers and misters, eyewash stations, ice machines, hot tubs, decorative fountains, cooling towers, and medical devices that hold water.
- Find the conditions, not just the equipment. At each point, ask whether water sits still, whether it lands in the growth temperature window, whether disinfectant residual has been used up by the time it gets there, and whether scale or sediment has built a surface for biofilm.
- Name the control locations. These are only the points where you can actually do something: heater setpoints, return loop balancing, mixing valve outlets, flush points on low-use branches, and the treatment equipment itself.
- Set a limit and an owner for each one. A control location with no number attached and no name against it is where programs fail on survey.
Then write down what you found, including the places you decided not to control and why. A documented decision not to act is defensible. A silent gap is not.
The ASHRAE 188 Program Elements
Standard 188 is the framework CMS points to, and it reads like a food safety plan applied to plumbing. You build a team, map the system, find the places where the hazard can develop, decide what "in control" means at each of those places, watch them, and fix them when they drift.
| Program element | What it means in practice |
|---|---|
| Program team | Facilities, engineering, infection prevention, and administration, with a named owner |
| System description and flow diagram | A schematic of the potable and non-potable water systems from the service entrance to every fixture |
| Hazard analysis | Where in that system conditions could let organisms grow or spread |
| Control locations | The specific points where you can actually influence those conditions |
| Control limits | The measurable range each control location has to stay inside |
| Monitoring | Who checks each control location, how, and how often |
| Corrective action | What happens, and who does it, when a reading falls outside the limit |
| Verification and validation | Confirming the program is being followed, and confirming it's working |
| Documentation | The written record of all of the above |
Two notes on currency, because citing the wrong edition is common in this field. The current standard is 188-2021, though the 2018 CMS memo references the 2015 edition and some state rules are written against specific earlier editions. ASHRAE also publishes Guideline 12-2023 as a supplement with system-specific guidance.
There's a newer piece worth knowing about. ASHRAE describes its Standard 514 as pulling back from Legionella specifically to address microbial risk in building water systems more broadly, along with the physical and chemical hazards that come with mitigating it, and it carries sections dedicated to health care facilities. If you're building a program from scratch rather than patching an old one, it's worth reading before you lock your framework.
The Water-Side Conditions a Program Has to Hold
Once the framework is in place, the program lives or dies on a handful of physical conditions in the building. These are the control locations that show up in nearly every plan.
Temperature
Temperature is the primary control in most building water systems, and it's the one a plan will name first. EPA's literature review puts ideal growth conditions in warm water between 35 and 46 degrees C (95 to 115 degrees F), and describes thermal control as keeping hot and cold water systems outside that range. The same review reports that growth has been found to be more abundant, with few exceptions, in hot water systems held below 45 degrees C (113 degrees F), and that several published reports suggest hot water reach outlets above 50 degrees C (122 degrees F) in health care facilities and nursing homes.
One binding US example is more concrete than any of those suggestions. The review notes that the Veterans Health Administration requires its facilities where patients, residents, or visitors stay overnight to hold hot water systems at 51.1 degrees C (124 degrees F) or higher. If you want a defensible starting point for a control limit rather than a range from the literature, a federal healthcare operator's own requirement is a reasonable place to begin the conversation with your engineer.
Those figures come with a caveat the review is explicit about: it's a non-regulatory summary of published studies, not a recommendation, and delivering hotter water at the outlet raises scald risk and energy use. That tension is exactly why mixing valves and balanced return loops exist, and why the number your plan sets is a facility decision documented in the plan rather than a figure anyone can hand you.
The engineering problem underneath it is consistency. Long recirculation loops, undersized return lines, and mixing valves set for scald protection all pull a system toward the middle of that window, and they do it worst at the far end of the building. Balancing the loop so the last fixture holds temperature is usually the highest-value fix in the entire program.
Disinfectant residual
Municipal water arrives with a disinfectant residual, and the building consumes it. Every foot of pipe, every fitting, every tank, and every hour of stagnation costs you some of it. A plan that sets a residual target at the point of entry and never measures it at the far end of the building isn't measuring the thing that matters. Residual at the distal fixture is the honest number.
Stagnation and dead legs
Water that doesn't move is the single most common condition a risk assessment turns up. Capped stubs left behind by a renovation, patient rooms or guest rooms held out of service, seasonal wings, decommissioned equipment still connected to the loop, and low-use fixtures all create it. Flushing programs exist because most buildings can't eliminate every dead leg, so they manage them on a schedule instead.
Scale, sediment, and biofilm habitat
This is where water quality feeds back into the program. Scale and sediment give organisms surface area and shelter inside pipes, tanks, and heaters, and biofilm consumes the disinfectant residual that was supposed to reach the far end of the building. It's the same mechanism that the long, narrow, low-flow tubing in dental unit waterlines makes visible at small scale, and the same reason cooling towers and boiler feedwater get their own scale and sediment control regimes. Controlling hardness and particulate does not control pathogens directly. It removes habitat and protects the residual that does the work.
Where Water Treatment Fits, and Where It Does Not
Now the honest part, and the reason a water treatment manufacturer should be careful writing about this topic at all.
What EPA's review does and does not say
The EPA published a scientific literature review, Technologies for Legionella Control in Premise Plumbing Systems, covering six treatment technologies: chlorine, monochloramine, chlorine dioxide, copper-silver ionization, ultraviolet light, and ozone. It also discusses superheat-and-flush, hyperchlorination, and point-of-use filtration as emergency remediation approaches.
Three things about that document set the boundary for everyone selling in this space:
- It is explicitly non-regulatory, and EPA states it does not recommend any particular technology.
- EPA is not requiring the installation of treatment in premise plumbing systems for Legionella control.
- It does not address risk associated with cooling towers, which are governed separately in the jurisdictions that regulate them.
There is also a regulatory consequence that catches facilities off guard. EPA does not regulate premise plumbing systems unless treatment is added to them. A facility that adds a secondary treatment system can end up defined as a public water system, which brings its own obligations. EPA's guidance to owners and operators considering added treatment is to consult their drinking water primacy agency about applicable requirements before installing anything. If a vendor proposes secondary disinfection for your building and never raises that conversation, that's the question to ask.
When CMS enumerates the components of a building water system where Legionella can grow, water filters appear on the list, alongside storage tanks, water heaters, expansion tanks, pipes and valves, aerators, showerheads, ice machines, humidifiers, eyewash stations, decorative fountains, and cooling towers. Filtration equipment in a building water system is a control location the program has to manage, not a control by itself.
That's the correct way to think about it. Crystal Quest doesn't market its systems as Legionella controls, and no responsible manufacturer should.
What treatment actually contributes
The barrier claims in this category belong to point-of-use devices validated for bacterial retention, typically a 0.2 micron absolute rated filter installed at the fixture with a short, strictly enforced change-out interval. That's a different product class with a different job, and it's usually deployed as a temporary measure while the underlying system problem gets fixed.
What treatment genuinely contributes is the supporting half of the program:
- Sediment and scale control that removes habitat and protects the disinfectant residual the plan depends on, which is the same commercial softening and pretreatment logic that applies to any large building.
- Carbon and specialty media chosen with the residual in mind. This one cuts both ways and the plan has to account for it. Carbon removes chlorine and chloramine, which is exactly why it's used, and it's also why point-of-entry carbon can strip the residual your program is counting on downstream. Catalytic and standard carbon behave differently with chloramine, and where either sits in the building relative to your control locations is a design decision, not a detail.
- Equipment sized and placed so it doesn't become the problem. Any vessel holds water. Oversized tanks, bypassed legs, and units on low-use branches turn treatment equipment into the stagnation volume the risk assessment was looking for.
Pretreatment doesn't replace the program. It makes the program's control limits easier to hold.
How Crystal Quest Approaches Building Water Projects
Crystal Quest has manufactured water treatment systems in the United States since 1994 under an ISO 9001 certified quality management system, and its commercial systems run in dialysis and medical facilities, hotels and hospitality properties, laboratories, and food and beverage production. ISO 9001 is worth naming precisely here: it covers documented, repeatable process discipline in how equipment is built, and not any pathogen control claim.
On a building project, the useful questions are narrow ones. What is the incoming water chemistry, and what does it do to residual as water travels through the building? Where does treatment equipment sit relative to the control locations the risk assessment named? Is that equipment sized so it holds flow without creating a stagnation volume of its own? What is the service interval, and who owns it inside the plan?
Those are answerable questions, and they are the ones worth asking a manufacturer. Whether your program controls Legionella is answered by your water management team, your control limits, and your documentation, not by a piece of equipment. A vendor who tells you otherwise is selling past the regulation.
Facilities weighing broader waterborne pathogen and contaminant questions, purpose-built clinical water such as dialysis treatment trains, or scale and guest-facing water in hospitality properties, will find those pieces cover the adjacent ground.
Frequently Asked Questions About Legionella Water Management Plans
Is a Legionella water management plan required by law or is it only guidance?
Both, depending on which document you're looking at. The CMS memo QSO-17-30 is survey guidance issued to state survey agencies, but it interprets binding Conditions of Participation at 42 CFR 482.42, 483.80, and 485.635, which are federal regulation. A certified facility that can't demonstrate measures to reduce risk is exposed to a citation for non-compliance under those regulations.
Do senior living communities that don't participate in Medicare need a plan?
They fall outside the CMS memo, but not necessarily outside everything else. ASHRAE Standard 188 covers human-occupied commercial, institutional, and multi-unit residential buildings regardless of payer status, and several states and local jurisdictions have adopted Legionella requirements of their own, particularly for cooling towers. Independent and assisted living operators generally check state and local rules before assuming they're exempt.
How often should a water management program be reviewed?
The program should be reviewed whenever the building changes in a way that changes the water system, and on a fixed schedule otherwise. Renovations, wing closures and reopenings, equipment replacement, occupancy changes, and any change in the incoming water supply all alter the hazard analysis the plan was built on. An annual review is common practice, but a renovation that caps six fixtures is a trigger on its own.
What's the difference between verification and validation?
Verification confirms you're doing what the plan says you'll do, meaning the monitoring is happening on schedule and the corrective actions are being carried out. Validation asks the harder question of whether the program is actually achieving control. They're separate activities, and a program can pass one while failing the other, which is why the standard treats them as distinct elements.
Who should be on the water management program team?
At minimum, someone who owns the physical plant and someone who owns infection prevention, plus an administrative sponsor with authority to fund corrective actions. Buildings with cooling towers, complex recirculation, or specialty clinical water usually add engineering and the relevant service contractors. The common failure is a team that exists on paper with no named owner for the corrective action step.
Does adding filtration to a building change anything from a compliance standpoint?
It can. Adding treatment to premise plumbing is the trigger that brings a building's water into EPA's regulatory scope, and a facility that adds secondary treatment may be defined as a public water system. EPA advises owners and operators to consult their drinking water primacy agency about applicable requirements before adding treatment. The equipment also becomes a control location in your own plan, with a service interval and a named owner.
Sources
- Centers for Medicare and Medicaid Services, QSO-17-30-Hospitals/CAHs/NHs, issued June 2, 2017, revised July 6, 2018
- 42 CFR 482.42, 42 CFR 483.80, and 42 CFR 485.635, Electronic Code of Federal Regulations
- US EPA, Technologies for Legionella Control in Premise Plumbing Systems: Scientific Literature Review
- ANSI/ASHRAE Standard 188-2021 and the ASHRAE water system risk management guidance covering Standard 514 and Guideline 12-2023
Get the water-side half of your program right.
Crystal Quest designs and builds commercial water treatment in the USA, sized to your building, your incoming water chemistry, and the control locations your risk assessment named. Tell our specialists what you are working with and they will spec it honestly.
