Your water utility is responsible for delivering water that meets water quality standards to your property line. What happens next is on you.
Municipal treatment ensures water arrives meeting drinking water quality standards—but your pipes, your temperatures, and your maintenance practices determine how water quality changes after it enters your building. Federal and/or state regulations apply to the Public Water Supplier (your utility provider), but generally do not apply in your building. Once water crosses your meter, building water quality is your responsibility. Without a Building Water Management Plan, you cannot confidently answer whether your water is of a quality that is acceptable to drink.
Internal building conditions—pipe materials, water age, water temperature, how often fixtures get used—determine whether drinking water quality remains acceptable. The gap between municipal delivery and tap water quality is where contamination develops. It’s also where your liability lives.
A Building Water Management Plan helps to bridge that gap. It transforms reactive worry into documented, defensible prevention.
Before we get to solutions, you need to understand why the regulations you assume protect your building actually may not.
Key Takeaways
- Municipal compliance ≠ building safety. EPA’s Safe Drinking Water Act regulates your utility, not your building. Once water crosses your meter, you inherit full responsibility for building water quality.
- Legionella is almost entirely a built environment problem. It thrives in warm (77–113°F), stagnant building water and the disease it causes can be fatal for roughly 1 in 10 people who contract it.
- Lead risk mostly depends on your plumbing, not your utility. Buildings constructed before 1986 may contain lead pipes and solder; first-draw water after stagnation carries the highest exposure risk.
- OSHA’s General Duty Clause applies to you. Courts have interpreted it to cover Legionella in the workplace—if employers know the risk and do nothing, they have liability.
- A Building Water Management Plan can help with prevention. Documentation demonstrates reasonable prevention.
- Stagnation, temperature, and aging pipes are the primary risk drivers. Prolonged stagnation can allow bacterial populations to grow, and temperature mismanagement can create ideal growth conditions.
The Regulatory Gap: Why EPA Rules Don’t Always Protect Your Building
EPA’s Authority Ends at Your Property Line
With few exceptions, the Safe Drinking Water Act regulates public water systems—your municipal utility. Once water crosses from the main into your building, the EPA has no direct authority to manage it.
Your utility is responsible for delivering potable water that meets federal and state water quality guidelines to your property. What happens inside your building is your responsibility.
Think of it like food safety: the USDA regulates the processing plant, but once you buy the meat, safe handling is on you. Your utility delivers a compliant product. Keeping it safe through your distribution system is your job.
Does the EPA regulate water inside buildings? No. The Safe Drinking Water Act covers utilities, not building owners. From your meter forward, maintaining safe drinking water is your responsibility.
The regulatory picture inside your walls looks different:
OSHA’s General Duty Clause is the federal hook most operators overlook. It requires workplaces “free from recognized hazards likely to cause death or serious physical harm.” OSHA has explicitly stated that this clause applies to occupational exposure to Legionella in water systems.² If you know the risk exists and do nothing, you’re exposed.
ASHRAE Standard 188 isn’t law—but it might as well be. When outbreaks occur, plaintiffs’ attorneys point to it as evidence of what you “should have known” and “should have done.” The CMS memorandum establishing water management requirements for healthcare facilities specifically references ASHRAE 188 as the industry standard.³ It’s the benchmark juries use to evaluate whether you acted reasonably.
Healthcare facilities have no ambiguity: CMS Conditions of Participation require water management plans for any facility receiving Medicare or Medicaid funding. Facilities unable to demonstrate measures to minimize Legionella risk face citation for non-compliance.
Why Self-Regulation Increases Your Exposure
No direct federal regulation doesn’t mean no liability. It may mean more.
When someone gets sick, the legal question becomes simple: did you follow available industry guidance? “We weren’t required to have a plan” collapses as a defense when ASHRAE 188 exists and you chose to ignore it.
Documentation matters beyond compliance. Legionella has a 2–14 day incubation period. By the time someone’s hospitalized, weeks have passed. Source-tracing is difficult. Your records become the evidence of what you knew, when you knew it, and what you did about it.
A documented Building Water Management Plan demonstrates reasonable care. Its absence suggests negligence.
Common Contaminants in Building Water Systems
Municipal water may arrive clean. Your building can change that. The following contaminants can develop—or concentrate—inside building plumbing when conditions allow:
Lead: What’s in Your Pipes Matters More Than What’s in the Main
Buildings constructed before 1986 may contain lead pipes, lead solder, or fixtures with lead components. Even “lead-free” fixtures under current standards can contain up to 0.25% lead by weighted average across wetted surfaces.
The practical insight: lead levels peak in “first-draw” water—the water that sat in your pipes overnight or over the weekend. That’s why testing protocols specify first-draw samples, and why morning flushing at drinking fountains and kitchen taps reduces exposure.
Your utility may deliver water with acceptable lead levels. Corrosive water chemistry plus stagnation can change that before water reaches the tap. For interpreting test results, see our guide to safe lead levels in drinking water.
PFAS: The Contaminant You Can’t Control at the Building Level
PFAS—the “forever chemicals”—typically enter through your municipal source water.⁴ Building-level treatment options exist (activated carbon, reverse osmosis) but remain limited for whole-building application.
The regulatory landscape shifted in April 2024 when EPA finalized the first-ever national drinking water standard for PFAS, setting Maximum Contaminant Levels for five individual compounds: 4 parts per trillion for PFOA and PFOS, and 10 parts per trillion for PFHxS, PFNA, and GenX chemicals. Your utility will address this at the source. Building operators with sensitive populations may need point-of-use treatment for specific applications.
Legionella: The Contaminant That’s Almost Entirely Your Problem
Legionella bacteria cause Legionnaires’ disease—a serious pneumonia with a 10% fatality rate. Around 6,000 cases are reported annually in the United States, though the actual burden is believed to be substantially higher—population-based estimates suggest 8,000–18,000 hospitalizations per year.
Unlike lead or PFAS, Legionella is almost exclusively a building problem. It is naturally found at low concentrations in environmental water sources, but building conditions enable the proliferation that leads to disease.⁶ It thrives where building conditions favor growth: warm water (77–113°F), stagnation, and biofilm.
Biofilm is the factor most operators underestimate. These bacterial communities form on pipe walls where sediment, scale, and organic matter provide habitat and nutrients for Legionella, while depleting the disinfectant residuals meant to control it. You cannot simply flush out an established problem—the biofilm remains, reseeding the water.
Cooling towers, hot water tanks, decorative fountains, showerheads, and rarely-used fixtures all present colonization opportunities. See our resources on Legionella FAQs, cooling towers, and Legionnaires’ disease.
What temperature controls Legionella? Store hot water above 140°F (60°C) at the heater and ensure hot water in circulation does not fall below 120°F (49°C) at fixtures. Thermal disinfection for active remediation requires elevated temperatures with sustained flushing at all outlets—consult a qualified water management professional for protocol specifics.
Disinfection Byproducts: When Protection Creates Problems
Chlorine reacting with naturally occurring organic and inorganic matter in water forms disinfection byproducts—trihalomethanes, haloacetic acids. Older pipes harboring organic buildup increase formation. An extended water age in building systems allows more reaction time.
Building Conditions That Allow Contamination to Develop
Aging Pipes Tell Their Own Story
Galvanized steel corrodes internally over time. Lead pipes and solder leach under certain water chemistries. Copper develops pinhole leaks. The signs show up at fixtures: discolored water, metallic taste, rust stains, and visible corrosion.
Buildings at highest risk include pre-1986 construction, facilities with inconsistent renovation history (where old and new plumbing connect), and buildings that have changed water sources or treatment.
Stagnation: The Silent Multiplier
Water sitting unused in pipes allows bacteria to multiply, concentrates leached metals, and depletes the disinfectant residual that protects water quality. Slowly moving or stagnant water increases water age, which provides opportunities for Legionella growth.
Prolonged stagnation—particularly beyond 72 hours—allows bacterial populations to reach concerning levels under favorable conditions.
Common stagnation risk factors:
- Fixtures unused for extended periods
- Dead-leg piping leading to removed or capped fixtures
- Oversized water heaters relative to actual demand
- Floors or wings with minimal occupancy
- Seasonal shutdowns without flushing protocols
Post-pandemic occupancy changes caught many buildings off guard. Reduced usage meant more stagnation. The risks haven’t disappeared just because occupancy recovered.
Temperature: The Thermostat Doesn’t Tell the Whole Story
Legionella grows best between 77–113°F (25–45°C). Hot water systems should store water above 140°F (60°C) and maintain above 120°F (49°C) in circulation.
The thermostat setting won’t tell you the full picture: large water heaters stratify. Water at the bottom of the tank, or during low-flow periods, may be significantly cooler than your setpoint indicates. Temperature monitoring at multiple points—not just the heater display—reveals actual conditions.
Cold water has risks, too. CDC guidance notes that when cold water temperatures rise above 77°F (25°C), there is potential for Legionella growth in the absence of other controls. Pipes running through warm mechanical spaces can heat “cold” water into that growth range.
When Things Go Wrong: Consequences of Inaction
Health Impacts Are Real
Lead exposure causes developmental and cognitive effects—EPA and CDC agree there is no known safe level of lead in a child’s blood.¹ Legionnaires’ disease is a serious condition with a 10% fatality rate, with elderly and immunocompromised individuals at the highest risk.
Legal Exposure Follows Outbreaks
Building operators have a duty of care. OSHA can cite employers under the General Duty Clause for failing to address known risks, including occupational exposure to Legionella in water systems. When litigation follows outbreaks, attorneys examine whether you followed ASHRAE 188 guidance.
The question isn’t whether regulations require a plan. It’s whether you met the standard of care that industry guidance defines.
Operations Suffer Too
Remediation after a Legionella incident can be time-consuming and costly. Business interruption, tenant confidence, and insurance implications compound the direct response costs. Media coverage of outbreaks leaves lasting reputational damage.
The financial case for prevention writes itself.
Not sure where your building stands? FACS offers comprehensive water system assessments to identify your specific risks and clarify your building water safety obligations. Contact us to schedule an evaluation.
Building Your Defense: The Water Management Plan
What It Is and Why It Matters
A Building Water Management Plan is a documented program that identifies hazards in your water system, establishes controls, and defines how you’ll monitor and respond. ASHRAE Standard 188 provides the framework, and CDC’s practical guidance outlines seven steps to developing an effective program.
Who needs one? Healthcare facilities are required to have plans under CMS. For everyone else, the calculation is straightforward: operating without documented water management creates liability exposure whenever an industry standard exists.
Important nuance: ASHRAE 188 is risk-based. A small office building doesn’t need the same program as a hospital serving immunocompromised patients. The standard guides you to match your program to your actual risk profile—not to over-engineer for risks you don’t have.
Key Steps to a Defensible Plan
- Assemble your team. Facilities manager, infection preventionist (healthcare), outside consultants where needed. Define who’s responsible for what. Document the structure.
- Map your water system. Accurate schematics matter. Identify sources, storage, distribution, and endpoints. Document equipment. Flag dead-legs and low-use fixtures.
- Conduct a risk assessment. Where are your hazards? Dead-legs, temperature problems, stagnation points, and areas serving vulnerable populations. Prioritize by likelihood and severity. See our guide to a defensible drinking water testing plan.
- Establish control measures. Temperature protocols. Flushing schedules. Disinfection where appropriate. Maintenance schedules for cooling towers and heaters. Smart monitoring for water quality can automate oversight and support Legionella prevention efforts.
- Implement monitoring and testing. What gets tested (Legionella cultures, lead, temperature, disinfectant residual), how often, and what triggers action. Testing frequency depends on building type and risk—healthcare tests more often than commercial offices.
- Define response procedures. What happens when results exceed thresholds? Who escalates? How do you communicate internally and externally? See why the first 24 hours matter for Legionella outbreaks.
- Document everything. If it isn’t documented, it didn’t happen. Maintain records for compliance, liability protection, and audits. Review and update annually.
Working With Your Utility’s Data
Your Consumer Confidence Report (CCR), published annually by your utility by July 1 each year, shows the quality of water delivered to your building.⁸ It cannot tell you anything about conditions inside.
One limitation worth understanding: CCRs reflect testing at distribution system monitoring points, which may be nowhere near your service connection. The report describes system-wide compliance, not what arrives at your specific meter.
Use the CCR as context for your source water—not as assurance of building water safety.
Your Path Forward
Municipal compliance does not equal building safety. That single fact reshapes how every facilities professional should think about the water flowing through their building.
EPA regulations govern your utility. From your meter forward, building water safety is your responsibility—legally, operationally, and ethically. OSHA’s General Duty Clause, ASHRAE 188, and CMS requirements all reinforce the same message: the standard of care exists, and it applies to you.
The regulatory gap creates real liability exposure, but it also creates a clear path to protection. A Building Water Management Plan is achievable. It protects your occupants. It creates defensible documentation. It establishes your standard of care, whether or not any regulation mandates it.
Three actions you can take this week:
- Know your building. Review age, plumbing materials, and existing water system documentation.
- Find your stagnation risks. Identify low-use fixtures and establish flushing protocols.
- Get expert eyes on it. Engage a qualified water management consultant to assess your current state and help you build a plan.
Ready to take the next step? FACS specializes in helping facilities teams develop and implement Building Water Management Plans tailored to your building and risk profile. Our industrial hygienists assess your water systems, identify gaps, and help you establish documentation for defensible compliance. Contact us to start your assessment – https://facs.com/contact-us/.