Building water systems in healthcare facilities are a recognized reservoir for Legionella and other opportunistic waterborne pathogens, and a formal, risk-based water-management program (WMP) is now a Condition of Participation enforced by CMS and surveyed by the accrediting organizations. This Article covers the biology of the hazard, the ANSI/ASHRAE Standard 188 program framework, the engineering and operational control measures, environmental sampling strategy, and how the WMP threads through design, construction, commissioning, and activation of a new or renovated facility.

Why Legionella Is a Healthcare-Specific Problem

Legionella pneumophila and related species are gram-negative bacteria that live naturally in fresh water and proliferate in the warm, low-flow, biofilm-rich conditions found inside building plumbing. Infection occurs when a susceptible person inhales or aspirates contaminated water aerosolized from showers, faucets, decorative fountains, cooling towers, respiratory therapy equipment, ice machines, hydrotherapy tanks, or heater-cooler devices. Legionella is not transmitted person-to-person, and drinking the water is not the primary route — the hazard is the aerosol and the patient's lungs.

Two clinical syndromes matter:

Healthcare facilities concentrate exactly the population most at risk: transplant and oncology patients, those on immunosuppressive or anti-rejection drugs, ICU and ventilated patients, dialysis patients, neonates, surgical patients, and the elderly. A facility's water system is also large, hot-water-storing, and full of dead legs, oversized piping, and intermittently used outlets — an ideal amplification environment. The combination of a high-risk population and an amplifying system is why CMS singled out healthcare for mandatory water management.

Definitions that drive policy: a case is generally classified as definite healthcare-associated when the patient was continuously in the facility for the entire incubation period (commonly framed as roughly 10 days, occasionally up to 14), and possible/presumptive when part of that window was spent in the facility. A single definite case, or two or more possible cases within a defined period, typically triggers an outbreak investigation, environmental sampling, and public-health notification.

The Regulatory Stack

The water-management obligation is layered across federal coverage rules, consensus standards, and accreditation:

Authority Instrument What it requires
CMS Conditions of Participation + the Legionella S&C memo (QSO/survey-and-certification policy) Hospitals, critical access hospitals, and long-term-care facilities must develop and adhere to a water-management policy/program that reduces the risk of Legionella and other waterborne pathogens. Surveyors expect a written program, evidence of execution, and documentation.
ASHRAE/ASHE ANSI/ASHRAE Standard 188 — Legionellosis: Risk Management for Building Water Systems The consensus standard that defines the program structure: team, system description/flow diagram, hazard analysis, control measures, monitoring, corrective action, verification, validation, and documentation. CMS points to it as the recognized framework.
ASHRAE Guideline 12 — Managing the Risk of Legionellosis Associated with Building Water Systems Companion best-practice guidance — specific control techniques, temperature targets, design recommendations.
CDC Toolkit: Developing a Water Management Program to Reduce Legionella Growth & Spread in Buildings A practical, worksheet-driven implementation of the Standard 188 framework; widely used as the working template for the WMP.
The Joint Commission / DNV / accreditors Environment of Care / Physical Environment standards Survey the existence and execution of the WMP as part of accreditation; expect risk assessment, control limits, monitoring records, and response procedures.
CMS / facility guidelines FGI Guidelines for Design and Construction Require water-management planning to be integrated into design and commissioning; coordinate with infection-control risk assessment.
State / local AHJ + public health State licensing, local codes, plumbing code (IPC/UPC) May impose additional storage-temperature, scald-protection, and reporting requirements, and receive outbreak notifications.

The practical bottom line: a healthcare WMP is mandatory, written, executed, and auditable. It is not a design deliverable that gets filed at turnover — it is a living operations program that the building must be designed and commissioned to support.

Anatomy of an ASHRAE 188 Water-Management Program

Standard 188 prescribes a closed-loop program built around the same logic as HACCP (Hazard Analysis and Critical Control Points). The required elements:

  1. Program team. A designated multidisciplinary team — facilities/engineering, infection prevention, safety/EOC, clinical leadership, and typically a water-treatment vendor and/or industrial hygienist. The team owns the program, meets on a defined cadence, and is named in the document.
  2. System description and process flow diagram. A complete inventory and schematic of the building water systems in scope: domestic cold and hot water, hot-water recirculation, the points where water is heated, stored, treated, and aerosolized. Cooling towers and evaporative condensers, decorative water features, and clinical devices that use facility water are all mapped.
  3. Hazard analysis. For each segment and end-use, identify where conditions favor Legionella growth and where aerosols and susceptible people meet — and decide which points are control locations.
  4. Control measures and control limits. For each control location, define a controllable parameter (temperature, disinfectant residual, flushing frequency) and the acceptable range — the limits that keep the hazard suppressed.
  5. Monitoring. Define how and how often each control limit is measured, by whom, and with what instruments.
  6. Corrective action. Define exactly what happens when a control limit is exceeded — the response, the threshold for escalation, and who is notified.