The water entering your building meets every federal standard. The water leaving your taps might not—and that’s entirely your responsibility.

Federal water quality laws regulate municipal supplies but stop at the water meter. Once water crosses into your premise plumbing, you own the risk. No federal agency will inspect your pipes, test your cooling towers, or cite you for Legionella. But when an outbreak happens, plaintiffs’ attorneys and juries will ask what you knew and what you did about it.

What this guide covers:

1. The jurisdictional line: Where EPA authority ends and building owner water liability begins
2. The state patchwork: Which jurisdictions mandate testing, registration, and water management plans—and which leave you to figure it out
3. The liability framework: How “duty of care” creates legal exposure even without specific building water quality regulations
4. The defensive playbook: Building a water management program that protects occupants and your organization

This isn’t abstract compliance theory. Buildings with inadequate water management have paid settlements exceeding $4 million. Outbreaks have killed patients, guests, and workers. The regulatory gap between the meter and the tap is where those tragedies occur.

Key Takeaways

• Federal law does not regulate water inside your building. The Safe Drinking Water Act (42 U.S.C. § 300f) applies to public water systems—your utility—and jurisdiction ends at the water meter.
• You own the liability for premise plumbing. All internal pipes, fixtures, tanks, cooling towers, and water-using equipment between the meter and the tap are your legal responsibility.
• State regulations vary dramatically. New York, New Jersey, Michigan, Illinois, and Virginia have enacted explicit Legionella or water management requirements; many states have none.
• Duty of care applies even without a specific statute. Courts evaluate building owners against industry benchmarks—primarily ASHRAE Standard 188 and CDC guidance—regardless of whether a state mandates compliance.
• Healthcare facilities face federal expectations through CMS. Medicare-certified hospitals and long-term care facilities must implement water management programs that consider ASHRAE industry standards and the CDC toolkit. CMS QSO-17-30).
• Financial exposure is substantial. Legionnaires’ disease verdicts and settlements have ranged from $225,000 to over $5 million per case.
• Documentation is your legal shield. A water management plan provides no protection if you can’t demonstrate it existed and was implemented.

The Direct Answer: Federal Law Doesn’t Reach Your Pipes

The Safe Drinking Water Act applies to your water utility. Not to your building. Once water passes the meter, you’re responsible.

Most building professionals assume otherwise. They see their utility’s annual water quality report, note that everything meets EPA standards, and believe they’re covered. They’re not.

Premise plumbing—the pipes, fixtures, water heaters, tanks, and equipment between the meter and every tap in your facility—exists entirely outside federal oversight. The EPA doesn’t regulate it. No federal inspector will ever walk through your mechanical room checking temperatures or reviewing your maintenance logs.

The Regulatory Structure in Plain Terms

The gap between federal compliance and building safety isn’t a technicality. It’s where Legionella grows in underused pipes. Where lead leaches from aging solder joints. Where biofilm accumulates in cooling towers that haven’t been properly maintained.

Your municipal utility might deliver water meeting every EPA standard. By the time that water sits in your pipes, heats in your tanks, and aerosolizes through your showers and cooling towers, it can become a health risk. That transformation happens on your property, under your control, and creates your liability.

For technology solutions to monitor these risks, see Smart Monitoring for Water Quality.

Safe Drinking Water Act Buildings: What Federal Regulations Actually Cover

The Safe Drinking Water Act of 1974 created the framework for protecting public drinking water. It requires EPA to set contaminant standards and oversee the roughly 148,000 public water systems serving Americans.¹ The law works at what it was designed to do.

The limitation is structural, not accidental. SDWA defines “public water system” as the entity treating and delivering water. Your utility qualifies. Your building doesn’t. Under the statute (42 U.S.C. § 300f), EPA jurisdiction extends only to “the point of delivery.”

The agency has been explicit about this boundary. Federal regulations state that secondary contaminant levels apply to water “delivered to the free flowing outlet of the ultimate user”—but exclude “contaminants added to the water under circumstances controlled by the user” (40 CFR Part 143).

Translation: if contamination happens in your building, it’s not EPA’s concern. It’s yours.

The Lead and Copper Rule: Utility Obligations, Not Yours

The Lead and Copper Rule requires water utilities to test at high-risk residences, optimize corrosion control, and—under 2021 revisions—inventory and replace lead service lines. These obligations fall on utilities managing the distribution system.

Building owners aren’t directly regulated under the Lead and Copper Rule. But many states have layered their own requirements on top, particularly for schools and childcare facilities. Those mandates fall squarely on building operators.

For detailed guidance on lead testing thresholds, see Guide to PPB and Safe Lead Levels in Water.

Why This Gap Exists

The federal government regulates commerce and utilities. It doesn’t traditionally reach inside private buildings. When Congress passed SDWA, legislators focused on ensuring utilities delivered safe water—not on what happened after delivery. The assumption was that building owners would handle their own systems.

Many haven’t. The consequences have been severe.

When Building Water Systems Kill: Case Examples

These aren’t hypotheticals. Each case demonstrates what happens when premise plumbing failures meet the regulatory gap.

• South Bronx, 2015: A cooling tower on a building roof seeded Legionella across the neighborhood. 138 people fell ill and 16 died in one of the largest Legionnaires’ disease outbreaks in U.S. history.⁴ Investigators found inadequate maintenance protocols. This single outbreak prompted New York’s comprehensive cooling tower regulations.
• Oxford, Alabama, 2010: Two guests used the hot tub at a Wingate Inn. Both developed Legionnaires’ disease and were hospitalized with lasting health consequences. Investigation revealed the hotel failed to maintain proper water temperatures or cleaning schedules. A jury took less than an hour to return a $4.5 million verdict against the owner.⁵
• San Francisco, 2013: A child spent a month at UCSF Medical Center following a transplant, contracted Legionnaires’ disease, and died.⁶ Testing found Legionella in the hospital’s plumbing system, including the room where the patient had stayed. The case was settled out of court. It underscored why immunocompromised patients face particular danger from building water quality failures.
• Atlanta, 2019: The Georgia Department of Public Health confirmed Legionella in both the cooling tower and atrium fountain at the Sheraton Atlanta Hotel. Sixty-six people fell ill—11 lab-confirmed cases and 55 probable—and at least one person died.⁷ The investigation triggered lawsuits that remain ongoing.

The pattern repeats: federal regulations provided no protection because contamination occurred within building systems. The buildings’ operators—not their utilities—faced the consequences.

State Requirements: Legionella Regulations by State

Some states have responded to outbreaks with comprehensive requirements. Others have done almost nothing. A facilities manager in New York faces documentation mandates, registration requirements, and testing protocols. A counterpart in many other states operates with minimal specific guidance.

Where Explicit Requirements Exist

The CMS Backstop

Even without state requirements, healthcare facilities receiving Medicare or Medicaid reimbursement must comply with Centers for Medicare & Medicaid Services expectations for water management. CMS policy memorandum QSO-17-30 (issued June 2017, revised July 2018) made Legionella prevention a survey priority, requiring covered facilities to maintain water management policies consistent with ASHRAE 188 and the CDC toolkit. This federal policy reaches building operators directly—through reimbursement conditions rather than environmental regulation.

Local Authority Matters

Don’t overlook municipal requirements. Local health departments often have authority to investigate outbreaks, require building access, mandate testing, and order corrective actions. Some jurisdictions have adopted ASHRAE 188 by reference, making voluntary guidelines enforceable. New York City’s cooling tower regulations operate alongside state requirements.

The only safe assumption: check every jurisdiction where you operate. Requirements differ, and ignorance isn’t a defense.

For cooling tower-specific guidance, see Cooling Towers and Legionnaires’ Disease: What Every Facility Manager Needs to Know.

Legal Liability: Why Regulations Are Only Part of the Picture

Here’s what many building owners miss: you don’t need to violate a specific regulation to face liability. You need only fail to act reasonably given foreseeable risks.

Duty of Care Water Quality: No Statute Required

Duty of care is the legal obligation to take reasonable steps to prevent foreseeable harm to people on your property. It applies to water quality whether or not your state has explicit building water regulations.

Plaintiffs suing over Legionnaires’ disease don’t need to cite a regulation you violated. They need to show you failed to act reasonably given known risks. Courts increasingly find that Legionella risk in building water systems is well-established and foreseeable.

Industry Standards Define “Reasonable”

What counts as reasonable? Courts and juries look to industry guidelines—particularly ASHRAE Standard 188 and CDC recommendations—as benchmarks.

ASHRAE Standard 188, published June 26, 2015, establishes requirements for:

• Surveying building water systems for risk factors
• Designating a program team with defined responsibilities
• Creating flow diagrams documenting water infrastructure
• Analyzing hazards where Legionella can grow and spread
• Implementing control measures addressing identified risks
• Monitoring to verify control measures work
• Taking corrective action when monitoring shows results are outside of control limits
• Documenting everything

The standard is voluntary, but it defines what knowledgeable building owners do. When litigation follows an outbreak, the question becomes: did you follow the standard of care that the industry itself established?

A building owner who implemented ASHRAE 188 compliance measures before an outbreak can demonstrate industry-standard precautions. One who didn’t faces difficult questions about why not—especially when the standard has existed since 2015.

For common questions about Legionella and liability, see Legionella & Legionnaires’ Disease FAQ.

The Financial Exposure Is Real

Settlement and verdict data from Legionnaires’ cases paint a clear picture of the financial risk. Reported verdicts and settlements have ranged from $225,000 to over $5 million per case.¹⁵ The Wingate Inn hot tub case produced a $4.5 million verdict.⁵ Multi-plaintiff outbreaks can generate aggregate liability in the tens of millions.

Beyond litigation costs, consequences can include regulatory fines where requirements exist, insurance coverage denials, premium increases, and reputational damage that lingers for years.

Building a Defensible Water Management Program

Proactive management isn’t just risk mitigation—it’s your primary legal protection. A documented water management plan demonstrates you took the risk seriously and acted reasonably.

Water Management Plan Requirements: The Core Components

Following ASHRAE 188’s framework, an effective program documents:

• System inventory: Map every water system—domestic hot and cold water, cooling towers, decorative fountains, ice machines, emergency eyewash stations, anything using water.
• Risk assessment: Identify areas where Legionella can grow and expose building occupants . Look for stagnation points, temperature fluctuations, dead legs (abandoned pipe sections), and biofilm accumulation, aerosol-generating devices, and susceptible patient populations.
• Control measures: Define specific actions addressing each risk, with assigned responsibility. Temperature maintenance, flushing schedules, disinfection protocols—each hazard needs a countermeasure.
• Monitoring schedule: Determine what gets measured, how often, and by whom. Temperature checks, disinfectant residuals, and visual inspections should occur on defined schedules.
• Corrective action protocols: Pre-define responses when monitoring shows problems. Don’t wait for an outbreak to decide what to do when temperatures drift or Legionella is detected.
• Implementation: Records prove you implemented your plan. Undocumented actions might as well not have happened when litigation arrives.

The plan isn’t a binder that sits on a shelf. It requires annual review, updates after system modifications, and continuous implementation.

For implementation guidance, see How to Create a Simple and Defensible Drinking Water Testing Plan.

Testing: What, When, and Why

Testing provides objective data validating your control measures are effective. Frequency depends on system type, occupant vulnerability, and jurisdictional requirements.

Use laboratories certified for drinking water analysis. Follow proper sampling protocols—poor collection techniques invalidate results. Maintain chain-of-custody documentation.

The CDC emphasizes there is no known safe level or type of Legionella.¹⁶ Any detection should trigger your response protocols.

Aging Infrastructure: Prioritize by Risk

Older buildings present specific challenges. Lead solder (common before its prohibition under the 1986 SDWA amendment),¹⁷ abandoned pipe sections, oversized piping designed for higher water use, and complex layouts creating long residence times all contribute to water quality degradation.

Prioritize upgrades based on risk assessment, not simply age. A dead leg serving an abandoned wing poses more immediate danger than functional older piping with good flow. Any infrastructure changes should trigger water management plan reassessment—new equipment and modified flow patterns create new conditions.

Training: Plans Only Work If People Implement Them

Staff must understand their roles:

• Facilities and maintenance: System operation, monitoring procedures, warning sign recognition, response protocols
• Infection prevention (healthcare): Integration with infection control, surveillance, case response
• Building management: Oversight responsibilities, documentation requirements, escalation procedures

Document all training. Records demonstrate your organization took water safety seriously and equipped staff to execute your program.

When to Bring in Experts

Independent assessment identifies gaps before they become incidents:

• Gap analysis: Compare current practices against ASHRAE 188, CDC guidance, and applicable regulations
• Full program audit: Evaluate plan design, implementation, documentation, and effectiveness
• Post-outbreak support: Expert assistance during investigations, remediation planning, litigation preparation

Look for ASSE 12080 certification (Legionella Water Safety and Management Specialist), experience with your facility type, and capacity for ongoing support.

If you’ve detected Legionella, immediate guidance matters. See Legionella Found on Site: Your First 24-Hour Guide.

Need an objective assessment of your current program? FACS provides comprehensive gap analyses identifying risks before they become liabilities.

Frequently Asked Questions

Does the EPA regulate water quality inside my building?

No. EPA regulations under the Safe Drinking Water Act apply to public water systems—your utility—not buildings receiving water. Federal jurisdiction ends at the meter. Building owners are responsible for water quality in their premise plumbing.

What is premise plumbing?

Premise plumbing includes all internal pipes, fixtures, water heaters, tanks, and equipment carrying water from the meter to every tap and water-using device in a building. This encompasses domestic hot and cold water systems, cooling towers, decorative fountains, and emergency safety equipment.

What states have Legionella regulations?

States with explicit requirements include New York (comprehensive cooling tower and healthcare regulations since August 2015), New Jersey (water management requirements effective September 2024), Michigan (healthcare facility mandates since February 2020), Illinois (hospital testing policies since April 2021), and Virginia (school requirements since July 2021). Additional states have pending legislation or municipal requirements.

What is ASHRAE Standard 188?

ASHRAE Standard 188, “Legionellosis: Risk Management for Building Water Systems,” is the industry standard for preventing Legionella growth in building water systems. Published in June 2015, it requires risk assessments, control measures, monitoring programs, and documentation. While technically voluntary, courts increasingly treat it as the benchmark for reasonable care.

What happens if someone gets sick from my building’s water?

Building owners face potential civil liability for personal injury and wrongful death. Plaintiffs can recover medical expenses, lost wages, pain and suffering, and punitive damages in gross negligence cases. Settlements and verdicts in Legionnaires’ cases have ranged from $225,000 to over $5 million. Additional consequences can include regulatory fines, insurance complications, and lasting reputational damage.

Your Water, Your Responsibility

Federal law draws a clear line at your water meter—and everything beyond it falls to you.

That line isn’t moving. But the expectations on your side of it are. More states are adopting explicit building water quality regulations. CMS has made water management a healthcare compliance priority.
Courts have established that ASHRAE 188 represents the standard of care. And the case record leaves no ambiguity about the consequences of inaction: outbreaks, fatalities, multimillion-dollar judgments, and organizational damage that no amount of retroactive effort can undo.

The good news is that the path forward is well-defined. Three actions separate the buildings that weather scrutiny from those that don’t:

1. Know your requirements. Check every state and municipality where you operate. Requirements differ, change frequently, and apply whether or not you’re aware of them.
2. Implement ASHRAE 188. It’s the benchmark courts and regulators use to evaluate whether you acted reasonably. Voluntary compliance today prevents mandatory explanations later.
3. Document relentlessly. Your defensibility depends on proving what you did, when you did it, and why. The best water management program provides no protection if you can’t demonstrate it existed.

The regulatory gap between the meter and the tap is where risk lives—but it’s also where preparation, diligence, and documentation turn liability exposure into defensible practice.

FACS helps building owners navigate the intersection of water quality regulations and practical risk management. Contact our team to discuss your facility’s needs, or explore our Legionella and Water Systems Management services to learn how we can help you build a defensible program.