Legionella Water Management Plans for Buildings

Picture the call coming from a health department investigator, not a tenant. A resident of a 14-story apartment building has Legionnaires’ disease. The investigator asks three questions. Does the building have a Legionella water management plan? What were the hot water temperatures last month? Who services the cooling tower? A building that can answer in an hour is in a very different position from one that has to search old email for a vendor report.

Outbreak investigations show how often the answer is no. CDC reviewed the Legionnaires’ disease outbreak investigations it led from 2015 to 2019. Of the water management deficiencies it found, 43% were buildings with no program at all. Another 40% were programs that existed but were not followed. CDC concluded that a complete program, actually carried out, could have prevented every deficiency it found.

This guide is the owner’s version of that program for commercial and multifamily buildings: who needs one, how ASHRAE 188 and the CDC toolkit structure it, the control limits CDC publishes, when testing helps, what records to keep, and what DC, Virginia and Maryland require as of October 2026. It is written from the operator’s side, the same side we work from in our commercial plumbing services.

What is a Legionella water management program?

It is a written, building-specific process to find where Legionella could grow and spread in your water systems, control those conditions, check the controls on a schedule, and fix problems when a check fails. CDC calls an effective program the primary strategy to control Legionella and prevent Legionnaires’ disease.

Owners search for a “plan.” CDC and ASHRAE say “program,” and the difference matters. The plan is the document. The program is the document plus the monitoring, corrective actions, records and annual review. CDC’s outbreak numbers show what a plan on a shelf is worth.

What Legionella is. CDC describes Legionnaires’ disease as a serious type of pneumonia caused by Legionella bacteria. People get sick when they breathe in mist that contains the bacteria. Legionella lives naturally in fresh water. It becomes a building problem when it grows in building water systems and devices spray it into the air.

Where it grows. CDC’s control toolkit sums up the growth factors as STAR:

• Sediment and biofilm. Biofilm shelters Legionella from heat and disinfectant. Scale and sediment use up disinfectant.
• Temperature. Legionella grows best between 77°F and 113°F, and may grow as low as 68°F.
• Water age. Water sitting in dead legs, unused fixtures and vacant floors drifts into the growth range and loses disinfectant.
• Residual disinfectant. Heating, storage and filtration use up the chlorine or chloramine the water arrived with.

The reference documents. ANSI/ASHRAE Standard 188 sets minimum Legionella risk management requirements for building water systems; the 2021 edition is the one ASHRAE pointed owners to in August 2025. ASHRAE Guideline 12-2023 is its companion, with system-by-system guidance. CDC’s water management program toolkit turns the standard into plain steps.

Does your building need a water management program?

Yes, if it answers yes to any question on CDC’s eight-question screening worksheet. Questions 1 to 4 cover the whole building’s hot and cold water. Questions 5 to 8 cover devices, which need a program even when the building does not.

CDC worksheet question	If yes
1. Overnight healthcare, or houses or treats people with chronic illness or weak immunity?	Whole building
2. Primarily houses people over 65?	Whole building
3. Multiple housing units on a centralized hot water system?	Whole building
4. More than 10 stories, including basement levels?	Whole building
5. Cooling tower?	That device
6. Hot tub not drained between uses?	That device
7. Decorative fountain?	That device
8. Centrally installed mister, atomizer, air washer or humidifier?	That device

Source: CDC, Identify Buildings with Increased Legionella Risk.

Two points trip owners up. Question 3 can capture multifamily buildings of any height: CDC’s examples are hotels and high-rise apartments, but the test is multiple units on a central hot water system. And a two-story office with a rooftop cooling tower needs a program for the tower even though its plumbing screens out.

ASHRAE 188’s scope is wider still: human-occupied commercial, institutional, multiunit residential and industrial buildings, excluding single-family homes. If you answer no to all eight questions, CDC still says to maintain water systems to manufacturer recommendations.

Who belongs on the water management team?

The team is a set of skills, not a committee of titles. CDC lists seven: overseeing the program, communicating about it, knowing the water systems, setting control locations and limits, monitoring and documenting, taking corrective action, and confirming the program works.

Who	What they usually own
Owner or asset manager	Authority, budget, sign-off
Property or facility manager	Program lead, schedules, records
Building engineers	Readings, flushing, first response
Water treatment professional	Tower and supplemental treatment chemistry
Consultant (industrial hygienist, microbiologist)	Hazard analysis, sampling plans
Accredited laboratory	Legionella analysis
Healthcare additions	Infection prevention, a clinician, accreditation expert

CDC adds one rule worth adopting: people should not verify their own work. If one engineer logs the water heaters and another logs the cooling tower, each reviews the other’s log.

How do you map your water systems and find the hazards?

Write a plain description of how water enters, moves through and leaves the building, then draw a simple process flow diagram from it. CDC says the diagram should be easy for every team member to read, not as detailed as the plumbing drawings.

The description should cover:

• The service entry, meter and backflow preventers (see our backflow testing guide)
• Branches to sprinklers, cooling towers, fountains, ice machines and spas
• Water heaters, storage tanks, set points and the floors each serves
• Recirculating and non-recirculating hot water lines
• Mixing valves, filters, softeners and any added treatment
• Dead legs, low-use fixtures, eyewash stations and vacant space

Then mark each place a hazardous condition could occur and give it a control point, a control measure and a control limit.

Location	Hazardous condition	Typical control point
Incoming service	Main breaks, low residual	Residual at entry
Heaters and storage	Temperature drop, sediment	Outlet and tank temperature
Hot water return	Return cooling into growth range	Return temperature
Distal fixtures	Stagnation, lukewarm water	Far-tap temperature and residual
Dead legs, vacant floors	Water age	Flushing log
Tower, fountain, spa	Warm water, spray, biofilm	Residual and visual check

An accurate asset list for heaters, mixing valves and tanks, tied to your preventive maintenance program, gives the team the inventory the diagram needs.

What control measures and control limits should you set?

Set a measurable limit for each control point, with a minimum and a maximum where possible, plus who checks it and how often. CDC publishes reference values, shown below. They are CDC examples, not a prescription for your building. Your team sets its own limits.

Parameter	CDC reference value
Stored hot water	Above 140°F (60°C)
Circulating hot water	Not below 120°F (49°C)
Cold water	Below 77°F (25°C)
Municipal disinfectant	Detectable residual throughout
pH	About 6.5 to 8.5, where disinfectants work best
Dead legs, low-flow runs	Flush at least weekly
Cooling tower water	Lowest practical temperature, outside 77–113°F

Three practical notes:

• Scald control. Water hot enough to limit Legionella can scald. CDC’s answer is hot piping plus thermostatic mixing valves as close to fixtures as possible, within local anti-scald rules.
• Measure the gap. CDC suggests comparing the residual where water enters with the residual at fixtures. A large drop points to water age, biofilm or warm pipes.
• Added treatment has strings attached. EPA does not regulate premise plumbing unless treatment is added. The Virginia Department of Health warns that on-site treatment may bring an owner under the Waterworks Regulations. Call the drinking water agency first.

How do monitoring and corrective actions work?

Monitoring confirms each control stays within its limit. A corrective action is the pre-written response when it does not. CDC recommends monitoring representative fixtures near to and far from the central distribution point, not every tap, and checking more often when results vary.

CDC’s examples show the logic. A floor closed for renovation gets daily flushing at the end-of-hall fixtures, and its temperature and chlorine checks move from weekly to daily. A slimy lobby fountain is shut off, drained, scrubbed, refilled and checked for residual. Each action is logged and reviewed.

The calendar below is illustrative. Where it says “team sets,” the frequency comes from your hazard analysis.

Task	Frequency	Basis
Flush dead legs and low-flow runs	At least weekly	CDC
Flush eyewash stations, rarely used fixtures	Regularly	CDC
Hot water temperatures, heater to far taps	Team sets; weekly in CDC example	CDC example
Residual at entry and representative taps	Team sets; weekly in CDC example	CDC example
Cooling tower oxidizing residual	Measurable all day, automated	CDC
Tower and fountain visual check	Team sets; weekly in CDC examples	CDC example
Hot tub disinfectant and pH	At least twice a day	DC Health
Humidifier tanks	Empty and clean daily	CDC
Tower offline cleaning and disinfection	At least annually	CDC
Full program review	At least annually	CDC

Each corrective action should name the trigger, the first step, who acts, who is told, and the follow-up check. If a case of Legionnaires’ disease may be linked to the building, CDC says to work with the health department, notify affected people if it asks, remediate if needed and revise the program.

When should you test for Legionella?

Test to validate the program, not to replace daily controls. CDC separates two checks. Verification asks whether people are doing what the plan says; reviewing temperature logs does that. Validation asks whether the program actually controls Legionella. CDC’s toolkit names routine Legionella testing over time as the best validation method.

The team decides whether to test. CDC says it matters more when a building struggles to hold limits, has a history of linked cases, or serves people at higher risk. Inpatient healthcare facilities should test routinely; other facilities serving vulnerable people should consider it. Write the sampling plan before the first sample.

CDC’s routine testing guidance gives these anchors:

• Lab. Look for accreditation such as ISO/IEC 17025. CDC’s ELITE program documents labs that pass its Legionella proficiency test.
• Method. Culture typically reports in 7 to 14 days. Molecular tests report in 2 to 48 hours but may not distinguish live from dead bacteria.
• Results. Under 1 CFU/mL in potable water, or under 10 CFU/mL in cooling towers, suggests good control. At or above those levels, or after a 10-fold rise, start response activities. Any viable Legionella in a hot tub or fountain needs a response.
• Limits. There is no known safe amount, and results do not predict disease.
• After remediation. Wait at least 48 hours after normal operation resumes, then retest.

Cost depends on sample count, method and lab. A 2026 Maryland legislative fiscal note cited about $400 per sample for commercial testing. Testing during a disease investigation is different: CDC says to do it with the public health authority.

What records should you keep?

Keep the written program and the evidence that it runs. CDC’s minimum written program covers the team, the building, the water systems with flow diagrams, the control measures, and the verification and validation steps.

1. Team roster with roles and contacts
2. Building and water system descriptions and the current flow diagram
3. Hazard analysis with control points, measures and limits
4. Monitoring logs: temperatures, residuals, pH, flushing, visual checks
5. Corrective actions with dates, results and follow-up checks
6. Cooling tower log sheets, procedures, service reports and results, kept on site
7. Water treatment vendor reports and chemical feed records
8. Sampling plans, chain-of-custody forms, lab reports and lab accreditation
9. Remediation records and retests
10. Annual review notes and every revision, with the reason
11. Training records
12. Utility notices about main breaks or treatment changes

Review at least once a year. CDC also triggers a review when limits are persistently missed, after construction or equipment changes, when treatment products or water use change, when the municipal supply changes, when a case is suspected, and when laws or standards change. Put the review on your building compliance calendar.

What do cooling towers need?

A cooling tower needs its own section of the program, even in a building whose plumbing screens out. CDC notes that tower drift can carry Legionella for miles, and that open and closed-circuit towers carry similar risk. From CDC’s cooling tower module:

• Automate disinfectant, anti-scale and anti-corrosion feed, and keep oxidizing residuals measurable throughout each day
• Automate blowdown to hold water quality
• Take the tower offline to clean and disinfect at least annually
• In wet standby of less than five days, keep treatment running and circulate three times a week
• Balance run time across towers or cells so none sits stagnant
• In new designs, use high-efficiency drift eliminators and keep towers at least 25 feet from air intakes
• Follow manufacturer procedures for startup, idling and shutdown
• Keep logs, procedures, service reports and results on site

The water treatment vendor runs the chemistry. The owner owns the program, the schedule and the records. Our HVAC preventive maintenance checklist covers the mechanical tower tasks, from basin inspection to spring startup and winterization.

How do you reopen a building after low occupancy?

Treat any long period of low use as a hazard. CDC says a “prolonged period” for Legionella may be weeks or months. Its reopening guidance sets out eight steps, condensed here:

1. Have a water management program in place.
2. Service the water heater and set it to at least 140°F, with scald protection.
3. Flush hot and cold water through all points of use until hot water reaches its maximum temperature, ideally 120°F or more at the tap. Minimize spray.
4. Clean fountains, refill them and confirm disinfectant levels.
5. Clean and disinfect hot tubs before use.
6. Confirm cooling towers are free of slime and debris before startup.
7. Flush eyewash stations, safety showers and sprinkler systems.
8. Ask the utility about recent disruptions, then resume routine monitoring.

CDC also says people at higher risk should talk to a medical provider before flushing or tower cleaning. Stagnation can raise lead and copper levels too, which is a separate drinking water question.

How do construction and renovation change the risk?

Construction can knock a well-run program off balance. CDC lists vibration and pressure changes that dislodge biofilm, and renovations that leave dead legs. Vacant floors during a fit-out add stagnation. Build these into project scopes:

• Tell the water management team before any shutdown, tie-in or riser work
• Remove abandoned branches back to the main rather than capping them in place
• Flush and monitor closed floors on a schedule, as in CDC’s renovation example
• Flush and check temperatures and residuals before handover; consider sampling
• Update the flow diagram, control points and limits, then retrain staff

ASHRAE 188 covers design, construction and commissioning as well as operation. Add the updated diagram to the closeout package.

Are there Legionella rules in DC, Virginia and Maryland?

As of October 2026, we found no general mandate in DC, Virginia or Maryland requiring an ordinary commercial or multifamily building to have a Legionella water management program or to register a cooling tower. The verified requirements are narrower.

Jurisdiction	What we could verify
DC	DC Health says owners should use a program; healthcare facilities must
Virginia	Public school buildings must have one, validated annually
Maryland	A 2026 bill to require programs did not pass

DC. DC Health publishes checklists for buildings, cooling towers, hot tubs and fountains, and its program will review water management programs on request. Its checklist notes that DC has seen more legionellosis cases in September, October and November in recent years.

Virginia. Va. Code § 22.1-138(C) requires a program at each public school building, validated at least annually, with files kept for review. It took effect July 1, 2021, and the Virginia Department of Health notes it does not cover private schools. For a private school, the case for a voluntary program is the same as for any other building (see below).

Maryland. In the 2026 session, HB 204 and its cross-file SB 264 would have required owners of buildings meeting ASHRAE 188-2018 criteria to implement a program by October 1, 2027. Neither moved past a committee hearing before the session ended in April. The fiscal note says Maryland statute is silent on Legionella. Maryland does require legionellosis cases to be reported, and state and local health departments investigate them. Watch for the bill to return.

For contrast, New York City. Local Law 77 of 2015 requires owners to register cooling towers with the NYC Department of Buildings, follow health department inspection, testing, cleaning and disinfection rules, and certify every year. Failing to register or certify can bring a fine of up to $10,000. We found nothing like it in the DMV.

Healthcare. CMS’s 2017 memo, revised in 2018, told hospitals, critical access hospitals and nursing homes to have water management policies that consider ASHRAE 188 and the CDC toolkit. CMS’s index now lists that memo as expired, but nursing home surveyor guidance (tag F880) still describes a documented program. Healthcare facilities should confirm current survey and accreditor standards.

Why everyone else still needs one. ASHRAE 188 is the industry standard, and health department investigators may ask whether a building has a program. Ask your insurance broker and counsel how your policies treat Legionella and what records they expect. This guide is general information, not legal or engineering advice.

How should you work with water treatment vendors and consultants?

Hire specialists for specialist work and keep ownership of the program. Water treatment professionals run tower and supplemental treatment chemistry. Qualified consultants lead hazard analysis and sampling design. Accredited labs analyze samples. ASSE International’s 12080 Legionella Water Safety and Management Specialist certification is one credential to ask about.

Put these in vendor scopes:

• Control points, limits and test frequencies that match the written program
• Same-day notice of any out-of-limit reading and the action taken
• Service reports you can file against each asset
• Lab name, accreditation and chain-of-custody for samples
• Startup, shutdown and offline disinfection procedures for towers
• A named contact for after-hours events such as main breaks

Programs often fail in execution, as CDC’s 40% figure shows. The weak points are handoffs: a vendor report nobody reads, a temperature log on a clipboard, a renovation the team never heard about. That is the layer Levaru handles. We coordinate the specialists, schedule tasks as preventive maintenance work orders in our in-house CMMS, photo-document the work, and keep the work-order history in one record owners can see in the client portal. The water treatment specialist, consultant and accredited lab still do the specialist work. For the routine plumbing tasks that feed the program, see our commercial plumbing maintenance checklist.

Frequently asked questions

Is a Legionella water management program required by law in DC, Virginia or Maryland?

Not for ordinary commercial or multifamily buildings, as far as we could verify as of October 2026. Virginia requires programs in public school buildings. DC Health recommends programs and says healthcare facilities must have one. Maryland considered a broad requirement in 2026, but it did not pass. Healthcare facilities face CMS survey expectations. For everyone else, ASHRAE 188 and the CDC toolkit set the industry standard, and investigators may ask whether you follow them.

What is the difference between ASHRAE 188 and ASHRAE Guideline 12?

ASHRAE Standard 188 sets minimum requirements for managing Legionella risk in building water systems, written in enforceable language so codes can adopt it. Guideline 12 is its companion. It gives system-by-system guidance for potable water, cooling towers, spas, fountains and humidifiers. Use Standard 188 to structure the program and Guideline 12 to set the details for each system.

What temperature should a water heater be set to for Legionella control?

CDC’s reference values are hot water stored above 140°F and circulating hot water that does not fall below 120°F. Its reopening guidance also says to set water heaters to at least 140°F. Because water that hot can scald, CDC recommends thermostatic mixing valves close to fixtures. Your team sets its own limits within local anti-scald rules.

How often should a building test for Legionella?

No single frequency fits every building. CDC leaves the decision to the water management team and treats testing as validation. It says inpatient healthcare facilities should test routinely and other facilities serving vulnerable people should consider it. Testing matters more when a building struggles to hold limits or has a history of cases. After remediation, retest at least 48 hours after normal operation resumes.

Does a building without a cooling tower need a water management program?

It may. CDC’s worksheet flags buildings over 10 stories, buildings with several housing units on central hot water, healthcare facilities and senior housing, whatever their equipment. A building with none of those but with a hot tub, decorative fountain or central humidifier needs a program for that device. A building that screens out entirely should still maintain its water systems to manufacturer recommendations.

Who can write a Legionella water management plan?

CDC says you do not need special certification to use its toolkit, though you may need outside expertise. In practice, the facility team builds it with a water treatment professional, plus a consultant such as an industrial hygienist for complex or high-risk buildings, which matches CDC’s team list. Healthcare teams add infection prevention staff. Whoever writes it, the building’s own staff must be able to run it.

How often should a water management program be reviewed?

At least once a year, according to CDC. Also review it when limits are persistently missed, after construction or equipment changes, when treatment products or water use change, when the municipal supply changes, when a case is suspected, and when laws or standards change. Each review should update the flow diagram, control points, limits and corrective actions, and retrain the staff who run them.

Does CMS still require water management programs for hospitals and nursing homes?

CMS’s 2017 Legionella memo is now listed as expired in its memo index. The expectation remains in surveyor guidance: nursing home infection control guidance under tag F880 describes a documented water management program based on national standards. Hospitals and nursing homes should treat a program as expected and confirm the current survey guidance and accreditor standards that apply to them.