A healthcare Legionella water management program sets risk-based controls, monitoring limits and corrective actions for building water systems. CMS guidance distinguishes hospital policies and procedures from nursing-home risk-reduction measures; CDC recommends programs for all healthcare facilities. Integral Healthcare Solutions (IHS) drafts program documents for hospitals, critical access hospitals and long-term care facilities.
Last updated: November 2026. Each linked source: page opened November 5, 2026.
What is a Legionella water management program?
Does CMS require a program, and is the 2018 memo still current?
CMS expects Medicare-certified hospitals to have water management policies and procedures; it says hospitals should consider implementing a program. The text began as CMS memorandum QSO-17-30, Requirement to Reduce Legionella Risk in Healthcare Facility Water Systems to Prevent Cases and Outbreaks of Legionnaires' Disease (LD), dated June 2, 2017 and revised July 6, 2018. CMS's page for the memo now carries the label EXPIRED, with no stated reason. The current State Operations Manual distinguishes the hospital and nursing-home expectations.
| Facility type | Current CFR section | CMS manual text opened |
|---|---|---|
| Hospitals | 42 CFR 482.42 | Appendix A, tag A-0750 (effective September 5, 2025). Hospitals "should consider implementing" a program that considers the ASHRAE industry standard and the CDC toolkit. Surveyors review program documentation "if a water management program has been implemented" for the risk assessment and water quality monitoring. |
| Nursing homes | 42 CFR 483.80 | Appendix PP, tag F880 (effective April 25, 2025). Facilities must be able to demonstrate their measures, such as by having a documented water management program. It must be based on nationally accepted standards and include an assessment and control measures with monitoring. |
| Critical access hospitals | 42 CFR 485.640 | The Appendix W text opened (Rev. 247) has no Legionella passage. |
The memo cites 42 CFR 482.42, 483.80 and 485.635(a)(3)(vi), and its quotation of 482.42 is older wording. In the eCFR text current to November 4, 2026, 482.42 and 485.640 carry the infection prevention and control standards, and 485.635(a)(3)(vi) concerns inpatient nutrition. Sections 482.42, 483.80 and 485.640 mention neither water nor Legionella. In IHS's reading as of November 5, 2026, the water expectation therefore sits in CMS guidance under those infection control rules.
What did the expired CMS memo say a program must contain?
The expired 2018 memo specifies four minimum elements. Appendix A addresses risk assessment, program considerations and monitoring; its program language is advisory.
- A facility risk assessment to identify where Legionella and other opportunistic waterborne pathogens could grow and spread in the facility water system.
- Development and implementation of a water management program that considers the ASHRAE industry standard and the CDC toolkit.
- Testing protocols and acceptable ranges for control measures, with results and the corrective actions taken when control limits are not maintained documented.
- Compliance with other applicable federal, state and local requirements.
Does CMS require water testing?
F880 does not require water cultures as part of routine nursing-home program validation, although cultures may be needed in some instances, such as a case of healthcare-associated legionellosis or a potential outbreak of legionellosis in the facility. The expired 2018 memo left testing protocols to providers.
CDC's Developing a Water Management Program to Reduce Legionella Growth & Spread in Buildings: A Practical Guide to Implementing Industry Standards (version 1.2, September 30, 2025) says that, because of the vulnerable population served, inpatient healthcare facilities should conduct routine testing to validate their program, and other facilities serving a vulnerable population should consider it. If the team tests, CDC says the protocol should be specified and documented in advance. For testing, CDC says to follow local and state regulations and accreditation standards; F880 also requires nursing homes to follow public health authority recommendations.
What are the steps of a water management program?
CDC's toolkit, downloadable from its cdc.gov page, lists seven steps: establish a team; describe the building water systems using text and flow diagrams; identify areas where Legionella could grow and spread; decide where control measures apply and how to monitor them; establish ways to intervene when control limits are not met; make sure the program runs as designed and is effective; and document and communicate all the activities.
For healthcare, CDC also recommends accreditation and licensing knowledge, infection-prevention expertise, a clinician with infectious-disease expertise, and risk and quality management staff.
Who needs a program and what triggers the work?
The 2018 memo applies to hospitals, critical access hospitals and long-term care, and is intended as general awareness for all healthcare organizations. CDC says all healthcare facilities should have a program. Common triggers:
- Survey preparation. Appendix A calls for review of program documentation if a hospital has implemented a program.
- A case or outbreak. The memo says outbreaks have been linked to poorly maintained water systems in buildings with large or complex water systems, including hospitals and long-term care facilities.
- Water quality changes. CDC recommends Legionnaires' disease testing for patients whose pneumonia begins at least 48 hours after admission, especially when the facility identifies water-quality changes that may promote Legionella growth, such as low disinfectant residuals or nearby construction.
- A state deadline, described next.
Do state rules add requirements?
New Jersey's P.L. 2024, c.66 took effect on approval, September 12, 2024. As enacted, section 6(a)(1)-(2) covers general or specialty hospitals providing inpatient services, nursing homes, assisted living facilities, comprehensive personal care homes, residential health care facilities and dementia care homes licensed under P.L.1971, c.136. Program development is due no later than 24 months after effectiveness, using ASHRAE 188-2018 or subsequent versions, or comparable standards adopted by a nationally recognized, accepted and appropriate organization. Section 6(f)(1) requires implementation no later than 27 months after effectiveness; newly constructed or repurposed facilities must confirm mitigation of potential human exposure before commissioning. By IHS's count, the deadlines are September 12, 2026 and December 12, 2026, respectively. Under section 6(b)(1), those healthcare facilities must include periodic bacterial sampling and testing under DOH rules if DOH or a local health authority determines association with a Legionnaires' disease outbreak, or CDC recommends periodic bacterial sampling. Section 6(b)(2) permits sampling and testing for programs outside that trigger. Section 6(h) exempts residential properties with four or fewer dwelling units from section 6.
This describes the act as enacted. IHS did not check later amendments or DOH rules, or any other state. Each state needs its own check; confirm current requirements with counsel.
How does IHS help?
IHS assesses gaps, maps evidence to CMS and CDC guidance, drafts content for client clinicians to approve, and provides mock review and readiness support through compliance program development. Thomas G. Goddard, JD, PhD, IHS founder and former URAC Chief Operating Officer and General Counsel, leads the work in IHS's Compliance Services practice.
What IHS drafts
- The program policy and team charter, including the healthcare roles CDC recommends above.
- A flow-diagram worksheet, a text description template, and a hazard and control-point worksheet.
- A monitoring log with fields for limit, reading, date, person and corrective action.
- A verification and validation plan template and a review calendar.
What you supply
Knowledge of your water systems and their measurements from facilities staff and a water consultant, test results, drawings, existing policies and recent survey findings on water.
The real limit
IHS drafts program documents. IHS does not sample or test water, design or treat water systems, interpret lab results, or communicate with CMS, a survey agency or a health department.
What should you have ready?
- Building and water-system descriptions, including devices that may grow or spread Legionella: CDC toolkit v1.2, pp. 24-25.
- Existing program and team roster: CDC toolkit v1.2, pp. 9, 24.
- Flow diagrams and risk assessment: CDC toolkit v1.2, pp. 10-13.
- How the program considers ASHRAE and CDC guidance: Appendix A, A-0750, Rev. 238.
- Control-measure records, including temperatures, disinfectant levels and inspections: Appendix PP, F880, Rev. 229.
- Testing protocols, acceptable ranges and results: Appendix A, A-0750, Rev. 238.
- Corrective-action records when control limits were missed: Appendix A, A-0750, Rev. 238.
- Recent water-related findings for IHS's review of identified infection-control issues: Appendix A, A-0750, Rev. 238.
The free introductory call is where IHS walks through the list with you.
How does a program compare with testing alone or a water treatment vendor?
| Approach | What the government text says | Note |
|---|---|---|
| Water management program | The expired CMS memo lists the four minimum elements described above, including program implementation and compliance with other applicable federal, state and local requirements. | Hospital surveyors review documentation if a program has been implemented. |
| Testing alone | F880 does not require cultures for routine nursing-home program validation; CDC recommends routine Legionella testing in inpatient healthcare facilities. | Results help assess effectiveness; they do not replace risk assessment or records. |
| Water consultant or vendor | CDC lists contractors and consultants, including water treatment professionals, as possible team members. | Sampling and treatment stay with them. |
What does it cost?
The CMS and CDC texts opened attach no fee to a water management program. IHS scopes each engagement after a free introductory call.
What this is not
- It is not legal or engineering advice. IHS is a consulting firm, not a law firm.
- It is not a guarantee of a survey result.
- It is not a statement that the 2018 memo is binding today. CMS labels it EXPIRED.
Frequently asked questions
Does CMS require a Legionella water management program?
For Medicare-certified hospitals, CMS expects water management policies and procedures and says hospitals should consider implementing a program. For nursing homes, F880 requires demonstrable risk-reduction measures, such as a documented program, with water management based on nationally accepted standards.
Is CMS memo QSO-17-30 still current?
CMS labels the memo page EXPIRED, with a note to check its downloads for the latest version, and gives no reason. IHS reads the hospital and nursing-home manual passages, as of November 5, 2026, as the CMS guidance for those facility types.
Does CMS require Legionella water cultures?
F880 does not require water cultures as part of routine nursing-home program validation, although cultures may be needed in some instances, such as a case of healthcare-associated legionellosis or a potential outbreak of legionellosis in the facility. The expired 2018 memo left testing protocols to providers.
What will a surveyor look for?
For hospitals, the manual's survey procedure reviews water management program documentation, if a program has been implemented, for the risk assessment and water quality monitoring. For nursing homes, the F880 guidance says facilities must be able to demonstrate their measures, such as by a documented program.
Is ASHRAE 188 mandatory?
Not named as mandatory in the CMS text opened, though the nursing home manual says water management must be based on nationally accepted standards, naming ASHRAE as an example. The memo and hospital manual say the program considers the ASHRAE industry standard and the CDC toolkit, and the hospital manual says hospitals should consider implementing such a program. IHS did not open the ASHRAE standard and says nothing about its content.
What should a monitoring log contain?
The control measure, the limit, the reading, the date, who took it and any corrective action. CMS's text asks the program to specify testing protocols and acceptable ranges and to document results and the corrective actions taken when control limits are not maintained. The column layout is an IHS design built to those points.
What counts as a healthcare-associated Legionnaires' disease case?
For surveillance, CDC describes a presumptive healthcare-associated case as at least 10 days of continuous stay in one or more healthcare facilities during the 14 days before symptom onset. A possible healthcare-associated case involves time spent in one or more healthcare facilities during that period and does not meet the presumptive-case criteria.
Does IHS test the water or contact CMS?
No. IHS does not sample or test water, design or treat water systems, or communicate with CMS, a survey agency or a health department. Your facilities staff and water consultant supply measurements; IHS drafts the program documents and the logs that hold the results.