Insights

Managing Legionella Risk: What Your Water Management Plans Need to Include

Topics

Regulatory & Compliance

Industry

Data Center, Brewery, Distilleries, Food & Beverage, Commercial & Institutional

Managing Legionella Risk: What Your Water Management Plans Need to Include

A Water Management Plan (WMP) is a documented, facility-specific program for identifying where Legionella and other waterborne pathogens could grow or spread, applying control measures, monitoring those controls, and documenting corrective actions when control limits are not met. It is not simply a binder on a shelf. A strong plan shows how a facility manages risk day-to-day and provides the records needed to demonstrate that the program is being implemented. For a growing number of facilities across the country, maintaining one is also becoming a legal requirement.

For facility managers, plant engineers, healthcare leaders, hospitality operators, and building owners, the practical question is no longer whether Legionella risk should be managed. The question is whether the facility has a water management program that is specific to its systems, aligned with recognized standards, and supported by monitoring records, test results, corrective action documentation, and team accountability.

The legal landscape is moving quickly. New Jersey’s Senate Bill S2188, signed into law in September 2024, now requires covered facilities to develop an ASHRAE 188-aligned Legionella water management plan by September 12, 2026, and have it fully implemented by December 12, 2026, making it the most comprehensive state-level Legionella mandate in the country. It's part of a broader wave of state and federal requirements raising the bar on Legionella risk management nationwide.

Building the Foundation

What a Water Management Plan Should Include to Manage Legionella Risk

ASHRAE 188 is a risk management standard for Legionella in building water systems. It does not prescribe one universal treatment method for every facility. Instead, it requires facilities to create a program that reflects their actual systems, operating conditions, and occupant risk. The CDC toolkit describes the same approach in practical terms and breaks the process into seven essential steps.

A complete program should include the following elements:

Water management team. Identify the people responsible for developing, implementing, and maintaining the program, including individuals with authority to act when corrective measures are needed.
Building water system description and flow diagrams. Document all building water systems, create text descriptions and flow diagrams, map water entry to all endpoints, identify heating, storage, and recirculation, and record water treatment equipment.
Hazard analysis. Identify where Legionella could grow or spread, including areas with warm temperatures, low flow, stagnation, inadequate disinfectant residual, scale, sediment, corrosion, biofilm, or aerosol-generating equipment.
Control measures and control limits. Define the actions used to manage risk, such as temperature management, disinfectant residual maintenance, flushing, cleaning, and treatment, along with measurable limits that indicate whether each control is operating as intended.
Monitoring procedures. Establish what will be measured, where it will be measured, how often monitoring will occur, who will perform it, and how results will be recorded.
Corrective actions. Define the response when control limits are not met, including escalation steps, documentation requirements, and criteria for returning the system to control.
Verification, validation, documentation, and communication. Confirm that the program is being implemented as written, evaluate whether it is effective, retain records, and communicate responsibilities and results to the appropriate stakeholders.

The difference between a defensible program and a weak one is usually documentation. Regulators, surveyors, insurers, and legal teams will not rely only on the existence of a plan. They will look for monitoring logs, test results, corrective action records, review notes, and evidence that the water management team is actively maintaining the program.

Who It Applies To

Who Needs a Water Management Plan?

Facilities generally fall into two groups: those that are legally required to maintain a water management program and those that should maintain one because of building complexity, occupant vulnerability, or the presence of systems that can grow and aerosolize Legionella.

Healthcare facilities have the clearest federal expectation. CMS requires hospitals, critical-access hospitals, and long-term care facilities that participate in Medicare or Medicaid to implement policies and procedures that reduce the risk of Legionella and other opportunistic pathogens in building water systems. Those programs are expected to be consistent with ASHRAE 188 and informed by CDC guidance.

Even where a specific state mandate does not apply, a water management plan is strongly recommended for buildings with cooling towers, evaporative condensers, centralized hot water systems, decorative fountains, whirlpool spas, misters, humidifiers, or other equipment that can release water aerosols. Buildings with complex plumbing, large storage tanks, dead legs, low-use areas, or extended shutdowns also have conditions that can increase risk.

In practice, ASHRAE 188 is increasingly used as a benchmark for responsible water system management. Waiting for a new state law can leave a facility reacting under pressure rather than building a measured, well-documented program in advance.

Regulatory Requirements

The Regulatory Landscape: What's Required and What's Coming

The regulatory landscape is expanding, but the direction is consistent: facilities are being asked to manage Legionella risk through documented, standards-based water management programs.

At the federal level, ASHRAE 188 provides the recognized framework for Legionella risk management, while the CDC toolkit provides practical implementation guidance. CMS requirements make water management programs mandatory for many healthcare facilities, and the CDC recommends that building owners and managers assess whether their buildings or specific devices need a program.

At the state level, New Jersey's S2188 represents a major expansion, as it applies ASHRAE 188-aligned water management requirements to a broad range of building types. It covers hospitals, nursing homes, assisted living and residential care facilities, correctional facilities with centralized hot water systems, hotels and motels with 25 or more units sharing a centralized water heater, residential high-rise buildings with six or more floors, and any building containing cooling towers, whirlpool spas, decorative fountains, misters, humidifiers, or other equipment that releases water aerosols. Covered facilities must develop a program by September 12, 2026, and fully implement it by December 12, 2026. The law also requires premises notice and addresses new or repurposed buildings before commissioning. This is the first state law to require ASHRAE 188-aligned water management plans across all building types, not just healthcare or cooling tower-specific applications.

New York has long regulated cooling towers through state rules and New York City requirements, including registration, maintenance plans, and routine testing. Other states, including Michigan, Virginia, and California, have adopted requirements for specific facility types such as healthcare facilities, public schools, or state-owned and leased properties.

Michigan has required healthcare facilities to create water management programs based on the CDC toolkit and ASHRAE 188 since February 2020. Virginia's SB 410, effective since July 2021, requires public schools to implement water management programs including Legionella testing. California's SB 1144 applies similar requirements to properties owned or leased by public schools or state agencies.

Because requirements vary by jurisdiction and continue to evolve, facilities should confirm their obligations with state and local health departments, CMS guidance when applicable, and qualified compliance advisors. The broader trend is clear: documented water management is moving from best practice to expected practice.

The Industry Standard

ASHRAE 188: The Standard Behind the Regulations

ASHRAE 188 matters because it defines the structure of an effective program. The standard establishes minimum requirements, but each facility must determine how those requirements apply to its systems and risks.

ASHRAE 188 is not a one-size-fits-all treatment manual. It does not dictate a single chemical program, testing frequency, or operating temperature for every building. Instead, it requires a systematic process for identifying risk, selecting appropriate controls, monitoring performance, responding to deviations, and maintaining records.

That process begins with a water management team and a clear description of the building water systems. The team then identifies hazardous conditions, determines where control measures are needed, sets measurable control limits, establishes monitoring and corrective action procedures, and documents verification and validation activities. This structure is why the CDC toolkit is useful: it turns the standard's framework into a practical roadmap for implementation.

For healthcare facilities, AAMI ST108 (published in 2023) establishes additional water quality requirements specific to medical device processing and sterile processing departments. It's a complementary standard, separate from ASHRAE 188 in scope, but healthcare facilities should be aware of both.

Taking Action

What Facilities Should Be Doing Now

Whether a facility is preparing for a legal deadline, strengthening an existing program, or starting from scratch, the immediate priorities are the same: understand the water system, identify risk points, control hazardous conditions, and document the work.

Inventory and map the water systems. Include incoming water, domestic hot and cold water, water heaters, storage tanks, recirculation loops, cooling towers, evaporative condensers, decorative fountains, humidifiers, misters, and other aerosol-generating devices.
Identify hazardous conditions. Look for temperatures that support Legionella growth, stagnant or low-flow areas, inadequate disinfectant residual, scale, sediment, corrosion, biofilm, and equipment that can disperse contaminated water droplets.
Build or update the water management plan. Confirm that the plan includes team roles, system diagrams, control measures, control limits, monitoring procedures, corrective actions, verification, validation, documentation, and communication practices.
Put monitoring and recordkeeping into routine practice. A program is defensible only if the facility can demonstrate that monitoring was completed, results were reviewed, deviations were addressed, and corrective actions were documented.
Use qualified support where needed. Many facilities benefit from a water treatment or water safety partner with experience in Legionella risk assessment, building water system operations, sampling strategy, data interpretation, and compliance documentation.

The cost of inaction can be high. A single outbreak can lead to illness, operational disruption, regulatory scrutiny, litigation, insurance challenges, and reputational harm. A documented water management program helps facilities reduce risk before an incident forces a response.

Common Questions

View All FAQs

Frequently asked questions

What must be included in a Legionella water management plan?

A water management plan should include a water management team, descriptions of building water systems and flow diagrams, a hazard analysis, control measures and measurable control limits, monitoring procedures, corrective action steps, verification and validation activities, documentation, and communication practices. The CDC toolkit provides a practical step-by-step framework for developing these components.

Is a water management plan required by law?

It depends on facility type and location. CMS requirements apply to many Medicare- and Medicaid-participating healthcare facilities. New Jersey's S2188 applies to a broad range of covered buildings and systems, with development and implementation deadlines in 2026. New York, Michigan, Virginia, California, and other jurisdictions have requirements for specific building types or devices. Even where no explicit mandate applies, ASHRAE 188 is widely used as the benchmark for responsible Legionella risk management.

How often should a water management plan be reviewed and updated?

The water management team should review and update the plan whenever building water systems change, when control measures are not performing as intended, after construction or commissioning activities, following extended shutdowns, and after any Legionella-related event. Facilities should also schedule routine reviews at intervals appropriate to their risk profile, commonly at least annually.

What is ASHRAE 188 and does it apply to my facility?

ASHRAE Standard 188, Legionellosis: Risk Management for Building Water Systems, establishes minimum requirements for managing Legionella risk in building water systems. It may apply when a building has complex plumbing, centralized hot water, cooling towers, whirlpool spas, decorative fountains, humidifiers, misters, or other systems that can support the growth or spread of pathogens. The best way to determine applicability is to complete a building and device risk assessment using ASHRAE 188 and the CDC toolkit.

What happens if a facility doesn't have a water management plan?

A facility without a documented program may face regulatory findings, enforcement actions, litigation exposure, insurance complications, operational disruption, and reputational damage if an outbreak or investigation occurs. More importantly, the absence of a program can mean the facility has not systematically identified and controlled conditions that allow Legionella to grow or spread.