Legionella Water Management Plan: The ASHRAE 188 Elements CMS Requires

A Legionella water management plan (WMP) is not a policy statement — it is the compliance document a hospital produces to satisfy the Centers for Medicare & Medicaid Services’ requirement, issued via Survey & Certification memo S&C 17-30 / QSO-17-30 (June 2, 2017, still in force), that Medicare-certified hospitals, critical access hospitals, and long-term care facilities maintain water management policies and procedures consistent with ASHRAE Standard 188, Legionellosis: Risk Management for Building Water Systems, and the CDC’s companion toolkit. Surveyors do not ask whether a facility knows about Legionella risk in the abstract; they ask to see the document, and the document has to contain specific, structured elements or it fails the review.

This guide is written for hospital infection preventionists, patient safety officers, quality directors, and risk managers who own or co-own that document — not a general Legionella-prevention overview. It walks through the ASHRAE 188 program elements in the order a surveyor or an internal auditor actually checks them, what each one has to contain to hold up, and what changes once a single healthcare-associated case is confirmed. It sits inside CASRAI’s patient safety cluster.

Why This Is a Named CMS Requirement, Not Just Good Practice

ASHRAE 188 is a voluntary consensus standard on its own — ASHRAE has no enforcement authority. It became a Medicare condition-level expectation because CMS’s S&C 17-30 memo names it directly: facilities must develop and adhere to a water management program that reduces the risk of growth and spread of Legionella and other opportunistic waterborne pathogens (Pseudomonas, non-tuberculous mycobacteria) in building water systems, and the program has to be consistent with the ASHRAE 188 framework and the CDC toolkit built on it. The Joint Commission folded the same expectation into its Environment of Care standards (EC.02.05.02, water management risk assessment) around the same period, so a hospital’s surveyors may be CMS-contracted state agency staff, a CMS-deemed accrediting organization, or both, and either one will ask for the same underlying document.

The practical consequence: this is not a page about reducing Legionella risk in general. It is about producing and defending one specific artifact — the written water management plan — against a specific external review, using the ASHRAE 188 structure as the checklist for what that artifact has to contain.

The ASHRAE 188 Program Elements, Mapped to What a Surveyor Checks

ASHRAE 188 does not use HACCP terminology, but its structure is a HACCP-style process, and the CDC toolkit that operationalizes it for healthcare facilities breaks it into the same seven working elements most water management teams actually build their document around:

1. Establish a water management program team. Named individuals with defined roles — typically facilities/engineering, infection prevention, and an executive sponsor with authority to approve capital spending on remediation. A one-person “plan” with no documented team is a common survey finding.
2. Describe the building water systems. A written description and a process flow diagram of every water system that could support Legionella growth: the potable hot and cold water system from the point of entry, water heaters and storage tanks, and non-potable systems — cooling towers, decorative fountains, humidifiers, eyewash stations, ice machines. The diagram has to show flow direction, temperatures at key points, and every location water can stagnate.
3. Identify areas with Legionella growth and transmission potential. Using the diagram from step 2, the team flags conditions that favor growth (stagnation, temperatures between roughly 77-108°F / 25-42°C, scale and biofilm, inadequate disinfectant residual) and transmission (aerosol-generating fixtures — showers, decorative fountains, cooling towers — near patient care or high-risk populations).
4. Decide where control measures should be applied, and how. For each hazard identified in step 3, the plan states the control measure (temperature management, disinfectant residual maintenance, physical maintenance like flushing low-use outlets) and the specific control limit that measure has to stay within.
5. Establish ways to verify the program is running as designed. Routine monitoring — who checks what, how often, and what instrument or method — against the control limits set in step 4.
6. Establish corrective actions for when limits are exceeded. A predefined escalation path, not an improvised response the first time a reading comes back out of range.
7. Document and confirm the program is implemented as designed. Ongoing records (monitoring logs, corrective-action logs, periodic plan review) plus periodic validation — typically environmental Legionella culturing of the water system to confirm the control measures are actually working, not just being performed on paper.

A surveyor working through a hospital’s plan is, in practice, checking that all seven elements exist, that they connect to each other (the diagram feeds the hazard list, the hazard list feeds the control measures, the control measures have limits, the limits are monitored, the monitoring has a corrective-action trigger), and that the records prove the plan is a living document rather than a binder produced once for accreditation and never updated.

The Building Water System Diagram: What It Actually Has to Show

Element 2 is where the most citable deficiencies happen, because “a diagram” is easy to produce badly. A diagram that will hold up needs to show, at minimum:

• The point of entry to the building and any water treatment applied by the municipal supplier or on-site (e.g., supplemental chlorination).
• Every water heater and storage tank, with design and actual operating temperatures noted.
• Hot and cold water distribution branches down to representative point-of-use fixtures, including any dead legs, low-use branches, or sections taken temporarily offline during renovation — these are the highest-risk stagnation points and the ones most often missing from an early-draft diagram.
• Every non-potable water feature separately: cooling towers and their basins, humidifiers, decorative water features, eyewash/emergency shower stations, ice machines, and any point-of-use filters or devices already installed as controls.
• Aerosol-generating fixtures flagged explicitly, since those are the transmission-risk points, not just the growth-risk points.

The diagram is a living document, not a one-time deliverable: any plumbing renovation, water heater replacement, addition of a cooling tower, or extended outage of a wing has to trigger an update, because a stale diagram that no longer matches the actual building is one of the more obvious things a surveyor can catch simply by walking the unit the plan describes.

Control Measures, Control Limits, and Monitoring

The specific numeric control limits a facility sets belong to its own risk assessment and should be confirmed against the current ASHRAE 188 edition and the facility’s own engineering judgment rather than copied from any single external source — but the commonly documented control-measure categories, drawn from the CDC toolkit’s guidance on operationalizing ASHRAE 188, are:

Control measure	What it targets	Typical monitoring approach
Hot water temperature at the heater/tank	Storage above the range where Legionella proliferates fastest	Continuous or daily temperature log at the source, with anti-scald mixing valves managing point-of-use delivery temperature separately
Hot water temperature at representative point-of-use fixtures	Confirming heat is actually reaching the ends of the distribution system, not just the tank	Periodic spot checks at outlets furthest from the heater and at known low-use branches
Cold water temperature	Keeping cold branches below the range that supports growth	Periodic spot checks, especially where cold lines run near heat sources
Disinfectant residual (chlorine, chloramine, or chlorine dioxide depending on the supplemental treatment system in use)	Maintaining an active biocide level through the distribution system	Scheduled residual testing at defined sampling points, logged against the plan’s stated control limit
Cooling tower biocide and physical maintenance	Biofilm and scale control in a system that aerosolizes by design	Scheduled biocide dosing records plus routine physical inspection and cleaning per the tower manufacturer/ASHRAE Guideline 12
Flushing of low-use or seasonal outlets	Preventing stagnation in branches that don’t see regular flow	A documented flushing schedule tied to the specific outlets identified as low-use on the diagram

Every row in a working plan needs three things spelled out, not just described in prose: the exact control limit (a number or defined range), who takes the reading, and how often. “Monitor hot water temperature periodically” is not survey-ready; “facilities engineering records point-of-use hot water temperature at four representative outlets weekly, logged in [system], control limit stated in Section X” is.

Corrective Actions: What Has to Happen When a Limit Is Exceeded

Element 6 is the plan’s escalation path, and it has to be predefined — decided in advance, not improvised the first time a reading comes back out of range. A defensible corrective-action section typically specifies, for each control measure:

• The immediate first step (e.g., re-test to rule out a sampling or equipment error before escalating).
• Who is notified and within what timeframe if the out-of-range reading is confirmed.
• The remediation options available (thermal flushing, hyperchlorination, point-of-use filtration, taking a fixture or branch out of service) and who has authority to order each one.
• The re-testing plan that confirms the corrective action worked before the branch or fixture is returned to normal monitoring.
• What gets logged — every step of the corrective action becomes part of the record that element 7 requires, and it is frequently the first thing a surveyor asks to see, because it demonstrates the plan is actually operating rather than sitting in a binder.

What Changes on a Single Healthcare-Associated Case

A confirmed healthcare-associated Legionnaires’ disease case — meaning the patient was hospitalized for all or part of the 2-10 day incubation period before symptom onset — is treated differently from a routine out-of-range monitoring reading. CDC and CMS guidance both direct facilities to respond as though a single confirmed case may indicate an active environmental source, not to wait for a cluster before acting, because Legionnaires’ disease is substantially under-detected relative to actual incidence and a second case can follow quickly if the source isn’t controlled. In practice that means:

• Immediate notification to the local or state health department — Legionellosis is a reportable condition in every US state, and case investigation typically involves the health department directly.
• An environmental assessment of the case’s known locations within the facility, cross-referenced against the water system diagram, to identify plausible exposure points rather than assuming the routine monitoring schedule already covered the relevant fixture.
• Targeted environmental (water) sampling at the suspected exposure points, distinct from routine validation sampling, ideally before any remediation is performed so the sample reflects the conditions the patient was actually exposed to.
• A documented decision on interim control measures (e.g., restricting use of a suspect fixture, hyperchlorination, filtration) pending sample results, and a record of when and why those measures were lifted.
• A retrospective look-back for any other patients who may have had compatible exposure and symptom onset in the same window, coordinated with infection prevention surveillance rather than treated as a facilities-only issue.

This response sequence is also where the plan’s earlier elements pay off or expose gaps: a stale or incomplete water system diagram makes it materially harder to identify plausible exposure points quickly, which is one more reason element 2 is not a one-time deliverable.

Where This Gets Surveyed

Expect the plan to be requested, and cross-checked against monitoring/corrective-action records, during standard CMS Life Safety Code and Environment of Care survey activity, and — separately — during a Joint Commission or other CMS-deemed accrediting organization survey under the Environment of Care water management risk assessment standard. Both reviews are checking the same underlying substance: does the written program match ASHRAE 188’s structure, and do the facility’s own records show the program is actually being run, not just held on file. Related environmental-control documentation infection prevention teams are commonly asked to produce alongside the water management plan includes an infection control risk assessment (ICRA) for construction and the facility’s ASHRAE 170 ventilation compliance documentation — surveyors reviewing the physical environment often ask for all three in the same visit.

Frequently Asked Questions

Is ASHRAE 188 itself a legal requirement?

No — ASHRAE 188 is a voluntary consensus standard. It becomes a de facto requirement for Medicare-certified healthcare facilities because CMS’s S&C 17-30 / QSO-17-30 memo requires a water management program consistent with it, and CMS-deemed accrediting organizations have incorporated the same expectation into their own survey standards.

Does every water system in the building need to be in the plan?

Yes — the CDC toolkit approach behind ASHRAE 188 is explicit that the water system description in element 2 has to cover potable hot and cold water and every non-potable water feature (cooling towers, decorative fountains, humidifiers, eyewash stations, ice machines), not just the systems considered highest-risk. A plan that only documents the cooling tower because that’s the historically infamous Legionella source is incomplete.

How often does the plan itself need to be reviewed and updated?

ASHRAE 188 calls for periodic review, and any material change to the building’s water systems — renovation, a new wing, a water heater replacement, an extended outage — should trigger an update to the diagram and hazard analysis rather than waiting for a scheduled annual review to catch up.

Who should own the water management program team?

Facilities/engineering and infection prevention need to be represented, since one owns the physical system and the other owns the clinical risk interpretation, and the team needs an executive sponsor with the authority to approve remediation spending — a plan that requires a capital request to fix a confirmed hazard, with no one on the team able to approve it, stalls exactly when speed matters most.

What’s the difference between routine validation sampling and the sampling done after a confirmed case?

Routine validation sampling (element 7) is scheduled, confirms the ongoing program is working as designed, and follows the plan’s normal protocol. Post-case sampling is unscheduled, targeted at the specific locations the patient was exposed to based on the environmental assessment, and is ideally taken before remediation so it reflects the actual exposure conditions rather than the conditions after the facility has already responded.