Updated September 30, 2026.
Medicare-certified hospitals, critical access hospitals, and most long-term care facilities must run a documented Legionella water management program aligned with ANSI/ASHRAE Standard 188-2021 and the CDC toolkit. Joint Commission–accredited hospitals and critical access hospitals now address the same expectations under Physical Environment standard PE.04.01.05 (effective January 1, 2026). The program combines system mapping, risk assessment, control limits, monitoring, corrective action, and annual review—not a binder on a shelf.
By William Tygart · Originally published March 18, 2026 · Water Quality
Why healthcare water systems matter
Legionella is an environmental organism. Drinking water is not the usual exposure route; inhalation of contaminated aerosols is. Cooling towers, hot-water loops, decorative fountains, humidifiers, showers, and clinical equipment that aerosolizes water can all amplify risk. Immunocompromised and elderly patients pay the highest price when control fails.
Conditions that favor growth
- Temperature: Growth is fastest near 35–37°C; it slows below ~20°C and above ~50°C in most systems.
- Biofilm and sediment: Organisms persist in pipe biofilm where disinfectants penetrate poorly.
- Stagnation: Dead legs, low-flow wings, and idle equipment hold water long enough for amplification.
- Complexity: Heat exchangers, storage tanks, and long distribution runs make uniform temperature control hard.
ASHRAE 188-2021: the technical backbone
ANSI/ASHRAE Standard 188-2021 (Legionellosis: Risk Management for Building Water Systems) sets minimum requirements for risk management across the building water lifecycle—design through maintenance. Many state codes and the 2026 FGI Hospital Code continue to reference ASHRAE 188 and strengthen expectations around waterborne pathogens. ASHRAE Guideline 12-2023 adds practical, system-specific implementation detail and pairs with 188 in the field.
For broader utility context, see Healthcare Water Quality and Medical Utilities: The Complete Professional Guide (2026).
What the risk assessment must cover
- Inventory of potable and non-potable systems (heaters, towers, fountains, showers, humidifiers, dialysis loops, etc.).
- Risk ranking based on aerosol potential, patient susceptibility, temperature control, and maintenance history.
- Identification of stagnation points, dead legs, and low-use outlets.
- Control measures: temperature targets, biocide strategy, filtration, flushing, and equipment maintenance.
- Verification and validation activities tied to control limits—not testing for its own sake.
Typical risk tiers (facility-specific)
Higher concern: open cooling towers, ornamental water features, aerosol-generating HVAC humidification, transplant/oncology shower zones, and large-volume clinical water such as dialysis and instrument reprocessing zones where splash and aerosol matter.
Moderate concern: domestic hot water held below effective control temperatures, general-care showers, and dental/clinical units with biofilm-prone small-bore tubing.
Lower concern (when consistently controlled): cold water kept below growth-friendly temperatures, hot water maintained at control setpoints throughout distribution, and well-flushed, chlorinated municipal supply with minimal stagnation.
CDC toolkit: seven habits that actually ship
The CDC’s Legionella resources for healthcare mirror ASHRAE 188 structure. Treat them as operational checklists, not optional narrative.
- Assign a water management team and an accountable lead.
- Describe the building water systems with a flow diagram.
- Identify control locations, limits, and monitoring methods.
- Establish corrective actions when limits are missed.
- Document verification, validation, and program changes.
- Communicate roles to clinical, engineering, and contractor staff.
- Define response steps when legionellosis is suspected—coordinated with infection control and epidemiology.
Control measures that hold up in surveys
Temperature management
Hot-water control remains the default strategy: storage often targets ≥60°C with distribution designed to deliver ≥51°C (≈124°F) at outlets, recognizing local scalding-mitigation policies. Patient-care areas frequently cap thermostatic mixing near 49°C; when you trade temperature for scald prevention, compensate with engineering controls (point-of-use 0.2 µm filtration, supplemental disinfection, or localized heating).
Filtration and flushing
Sediment filters on incoming lines reduce load to downstream biofilm. Terminal 0.2 µm filters protect high-risk outlets during remediation or for vulnerable populations. Flushing low-use outlets on a written schedule is basic preventive maintenance—it belongs in the CMMS with work orders, not on a sticky note.
Supplemental disinfection
Chlorine, monochloramine, copper-silver ionization, and other modalities can work when selected for the system you actually have. Biofilm shielding limits any single chemical pass; expect combination approaches during outbreaks.
| Method | Typical role | Survey talking point |
|---|---|---|
| Hot-water temperature control | Baseline for domestic systems | Show trend logs at representative outlets |
| 0.2 µm point-of-use filters | High-risk zones or interim control | Document change schedule and breach protocol |
| Copper-silver / UV | Where temperature alone fails | Validation data after commissioning |
| Hyperchlorination / flush | Corrective action | Before/after sampling plan if used |
| Routine flushing | Stagnation control | Map of low-use outlets and completion records |
Testing and monitoring
Neither ASHRAE 188 nor Joint Commission PE.04.01.05 mandates universal Legionella culture for every hospital. Testing is a tool when your risk assessment or validation plan requires it—commissioning, after major plumbing work, when control limits fail repeatedly, or during epidemiologic investigation.
- Culture on selective media: Still common for environmental samples; slow turnaround.
- PCR / qPCR: Faster detection of DNA; interpret alongside viability and clinical data.
During construction or shutdowns, align water plans with infection-control risk assessment and interim life-safety measures so stagnant loops are not reopened blindly.
CMS, Joint Commission, and state surveyors
CMS Quality, Safety & Oversight Memorandum QSO-17-30 (June 2017, revised July 2018) requires affected Medicare-certified hospitals, critical access hospitals, and long-term care facilities to implement water management policies that consider ASHRAE 188 and the CDC toolkit. CMS may label the memorandum “expired” on its website, but surveyors still evaluate whether facilities meet underlying Conditions of Participation for infection control and environment of care—documented programs remain the practical bar. See CMS Conditions of Participation: Environment of Care Requirements for Hospitals.
For Joint Commission–accredited hospitals and critical access hospitals, water management moved to PE.04.01.05 under Accreditation 360 on January 1, 2026 (nursing care centers retain EC.02.05.02). Elements of performance still require a team, flow diagram, risk-based plan, monitoring with corrective action, and annual review. Detail on the PE reorganization is in Joint Commission Accreditation 360: The 2026 Physical Environment Standards.
State health department surveys apply the same documents with local emphasis; keep diagrams, logs, and corrective-action records ready alongside other environment-of-care binders.
Outbreak response and remediation
Suspected healthcare-associated legionellosis triggers parallel clinical and environmental tracks: case finding, exposure window assessment (often roughly 2–10 days before symptom onset), and targeted sampling of patient-relevant zones. Engineering response may include isolating equipment, thermal disinfection flushes, elevated biocide regimens, filter deployment, dead-leg removal, and recommissioning. Cooling-tower incidents also require coordination with outdoor air intakes—see Healthcare HVAC Design: ASHRAE 170 Ventilation Requirements for how tower plumes relate to ventilation intakes.
Immunocompromised populations
Transplant, oncology, and similar units may need engineered water at the point of use until immune recovery. Document medical director agreement and staff education so nursing knows which outlets are protected.
Frequently asked questions
Programs typically store hot water at about 60°C (140°F) and verify that distribution delivers at least ~51°C (124°F) at distal outlets, adjusted for scalding policies. Your written plan should state setpoints, monitoring locations, and corrective actions when readings drift.
Yes, in controlled circumstances—often near 49°C at patient taps when 0.2 µm filters are maintained on schedule and the risk assessment documents equivalent protection. That trade must be deliberate, not a silent drift from deferred maintenance.
No universal mandate exists. CMS expects a program that considers ASHRAE 188 and CDC guidance; Joint Commission PE.04.01.05 requires monitoring suited to your plan and does not force environmental culture unless your plan or law requires it. Many facilities test selectively for validation or investigation.
Activate your corrective-action protocol: clinical notification, exposure assessment, enhanced controls (flush, disinfection, filtration), and follow-up verification. Immunocompromised patients may need restricted outlets until data support release.
Yes for Medicare-certified hospitals, critical access hospitals, and covered long-term care facilities, and for Joint Commission–accredited organizations under PE.04.01.05 or EC.02.05.02. Surveyors expect diagrams, control limits, logs, corrective actions, and annual review—not an unsigned policy template.
Related resources
- Dialysis Water Quality: AAMI Standards, RO System Design, and Microbiological Monitoring
- Medical Gas Systems: NFPA 99, Bulk Oxygen, Vacuum, and Medical Air Compliance
Standards and references: ANSI/ASHRAE Standard 188-2021; ASHRAE Guideline 12-2023; CDC Legionella guidance for healthcare; CMS QSO-17-30; 2026 FGI Hospital Code; The Joint Commission PE.04.01.05 (hospitals/CAH, effective January 1, 2026) and EC.02.05.02 (nursing care centers).