Cooling Tower Compliance: Legionella Prevention, Water Treatment, and ASHRAE 188 Requirements

Cooling towers are among the most efficient methods for rejecting heat in large commercial HVAC systems — and among the most closely regulated mechanical assets in a facility. The reason is straightforward: a cooling tower can create the conditions that Legionella bacteria need to grow and spread. Warm recirculating water, combined with fine water droplets expelled as drift, can carry Legionella into building air intakes or surrounding outdoor areas.

For commercial facility managers, the stakes are high. Legionnaires' disease outbreaks linked to cooling towers have led to new laws, enforcement, and litigation. This guide covers the compliance framework: ASHRAE Standard 188, CDC guidance, water treatment and monitoring practices, and key state, local, and federal requirements — with attention to what regulators actually review.

Why Cooling Towers Create Legionella Risk

Legionella is a naturally occurring bacterium found in freshwater environments. In the built environment, it becomes dangerous when water systems allow it to grow and then spread it as an aerosol that people can inhale.

Cooling towers present three compounding risk factors:

1. Temperature: CDC identifies 77–113°F (25–45°C) as Legionella's favorable growth range, and cooling tower water often falls in or near that range.
2. Nutrients and biofilm: Scale, corrosion, sediment, and biofilm in tower components protect and feed bacteria.
3. Aerosolization: Cooling towers generate drift, fine water droplets that can travel beyond the tower and be drawn into building air intakes, windows, or occupied outdoor areas.

CDC's review of Legionnaires' disease outbreaks from 2000 to 2014 found that cooling towers were the source of 22 percent of investigated outbreaks (6 of 27), and that cooling tower outbreaks tended to be larger, with a median of 22 cases compared with 10 for potable water outbreaks. The same review found that 85 percent of investigated outbreaks involved problems a water management program could have addressed. Reported cases of Legionnaires' disease have been increasing since the early 2000s; a CDC analysis found that age-standardized incidence rose more than fivefold between the 1992–2002 average and 2018.

ASHRAE Standard 188: The Core Compliance Framework

What ASHRAE 188 Requires

ANSI/ASHRAE Standard 188-2021, Legionellosis: Risk Management for Building Water Systems, establishes minimum legionellosis risk management requirements for building water systems. The 2021 edition replaced permissive language with enforceable language so the standard can be adopted into codes and regulations. It applies to human-occupied commercial, institutional, multi-unit residential, and industrial buildings, excluding single-family homes, and covers both potable and non-potable water systems, including cooling towers and evaporative condensers.

At its core, the standard requires building owners to establish a water management program that identifies where hazardous conditions can occur and puts control measures, monitoring, corrective actions, and documentation in place. ASHRAE Guideline 12-2023 is a companion document with more detailed guidance for specific building water systems.

ASHRAE 188 is not itself a federal law, but it is referenced by regulators. New York State requires cooling tower maintenance programs developed in accordance with ASHRAE 188, Michigan requires health facilities to implement water management programs consistent with it, and CMS directed Medicare-certified healthcare facilities to consider it when developing water management programs.

The Water Management Program: Seven Steps

CDC's water management program toolkit, which is designed to help building owners implement ASHRAE 188, organizes the work into seven steps:

Which Buildings Need a Water Management Program

ASHRAE 188-2021 applies broadly to human-occupied commercial, institutional, multi-unit residential, and industrial buildings. CDC's toolkit also includes a yes/no worksheet to help owners decide whether a building or specific devices, such as cooling towers, need a water management program.

Separately from ASHRAE 188, a building may be required to have a cooling tower program under state or local law (such as New York State and New York City), under CMS expectations for healthcare facilities, or by insurance requirements.

Cooling Tower-Specific Requirements and Guidance

System Documentation

A water management program should describe the cooling tower system clearly enough that someone new to the site can follow it. Useful elements include:

• Water flow paths, including supply and return lines
• Chemical feed points
• Drift eliminator location and type
• Bleed-off (blowdown) and make-up water connections
• Sump, basin, and fill locations
• Any bypass arrangements or dead-leg piping

Update this documentation whenever the system is modified, and keep it available to the program team and to regulators.

Inspection and Maintenance Frequencies

ASHRAE 188 requires the program to define monitoring and inspection frequencies, but the specific intervals come from your program, the manufacturer, and applicable regulations. Examples of frequencies set by CDC guidance and by New York rules:

Startup, Shutdown, and Disinfection

CDC recommends cleaning and disinfecting cooling towers as directed by the manufacturer before commissioning, before startup, when idling, and after shutdown, and removing towers from service for cleaning and disinfection at least annually. During wet standby (water remains in the system and shutdown lasts less than 5 days), CDC recommends maintaining the water treatment program and circulating water three times a week.

When a public health authority suspects a tower is linked to illness, CDC's guidance calls for offline emergency cleaning and disinfection. That protocol includes adding an oxidizing disinfectant to reach at least 20 ppm free available oxidant, maintaining 10 ppm for at least 24 hours, and a later disinfection step that holds at least 10 ppm for one hour. Follow the full CDC procedure, the tower manufacturer's instructions, and any direction from the health department.

Document each cleaning and disinfection event with the date, personnel, chemicals and dosages, and test results.

Water Treatment Requirements

Chemical Treatment Parameters

Effective cooling tower water treatment addresses three related problems: microbial growth (including Legionella), scale, and corrosion. Your program should set specific control limits with your water treatment provider and document monitoring results. CDC's cooling tower guidance includes these points:

• Maintain measurable disinfectant residuals (for example, free chlorine or bromine) throughout each day, using the provider's or manufacturer's recommended range
• Keep pH below 8.0 when using chlorine-based disinfectants and below 8.5 for bromine-based disinfectants, since high pH reduces disinfectant effectiveness
• Adjust monitoring frequency based on how stable water quality and performance indicators are
• Operate at the lowest practical water temperature outside Legionella's favorable growth range

Other parameters commonly tracked in cooling tower programs include conductivity (to control cycles of concentration), corrosion and scale inhibitor levels, non-oxidizing biocide applications, and general microbial counts such as dip slides or heterotrophic plate counts. Set the target ranges for these in your program based on your water chemistry and equipment.

Blowdown and Cycles of Concentration

As water evaporates from a cooling tower, dissolved minerals concentrate in the recirculating water. Blowdown (controlled discharge of concentrated water, replaced by fresh make-up water) keeps mineral levels in check. Without it, scale and corrosion increase and create surfaces where biofilm can form.

Target cycles of concentration depend on make-up water quality and treatment chemistry. In California, the Title 24 energy code requires cooling towers with a rated capacity of 150 tons or more to have conductivity or flow-based controls that maximize cycles of concentration based on local water quality, with the maximum cycles documented using an approved calculator.

Legionella Testing: Methods and Action Levels

Two primary methods are used for Legionella testing in cooling tower water:

Culture testing: Water samples are cultured on selective media and results are reported in colony-forming units per milliliter (CFU/mL). Culture is the method referenced in New York State and New York City cooling tower rules, which set action levels in CFU/mL.

Quantitative PCR (qPCR): Faster results that detect Legionella DNA. qPCR can be useful for rapid screening, but the New York action levels are based on culture results, so programs subject to those rules still need culture testing.

New York City's cooling tower rules are a useful example of how action levels work:

New York State similarly requires owners to notify the local health department within 24 hours of a Legionella culture result that exceeds 1,000 CFU/mL. Outside New York, set action levels in your program with your water treatment professional and confirm any state or local requirements.

Physical Design and Engineering Controls

Drift Eliminators

Drift eliminators capture water droplets entrained in the airstream before they leave the tower, reducing the amount of aerosolized water that can carry Legionella to surrounding areas. CDC recommends using high-efficiency drift eliminators.

Some codes set performance levels. For example, California's Title 24 requires drift eliminators on cooling towers of 150 tons or more that reduce drift to 0.002 percent of circulated water volume for counterflow towers and 0.005 percent for crossflow towers. Verify drift eliminator specifications at installation and inspect them for damage, missing sections, or gaps that allow bypass.

Tower Placement and Air Intake Separation

CDC recommends locating cooling towers at least 25 feet from building air intakes. Where the layout makes this separation impractical, document additional controls and the rationale in the water management program, and consider prevailing wind direction and nearby operable windows and occupied outdoor areas.

State and Local Regulations

New York City: The Most Comprehensive Local Framework

New York City enacted its cooling tower law (Local Law 77 of 2015) in August 2015, after a series of Legionnaires' disease outbreaks that included the summer 2015 South Bronx outbreak. CDC researchers counted 138 cases in that outbreak, the largest on record in the city, and a hotel cooling tower was identified as the source.

Core NYC requirements include:

• Registration of cooling tower systems with the NYC Health Department through the Cooling Tower Registration Portal
• A Maintenance Program and Plan for each cooling tower system
• Compliance inspections by a Qualified Person at least every 90 days during operation
• An Annual Certification (or Statement of Non-operation) submitted through the portal by November 1 each year
• Disinfection at least twice a year and at startup, plus a summertime hyperhalogenation between July 1 and August 31
• Records of cooling tower water maintenance activities kept for at least three years

Monthly Legionella sampling (Local Law 159 of 2025): Beginning May 8, 2026, NYC requires Legionella sampling every month during operation, with no more than 31 days between samples, and results reported to the portal within five days of collection. This replaced the previous 90-day interval. Facility managers with NYC cooling towers should confirm that their programs and water treatment contracts reflect monthly sampling.

Penalties: The Health Department can issue summonses for violations. Check the Health Department's current rules for penalty amounts.

New York State Requirements

New York State's cooling tower regulation (10 NYCRR Subpart 4-1) applies statewide, and towers in New York City must also register with the city. Key state requirements include:

• Registration in the New York State Cooling Tower Registry, with updates every 90 days while the tower is operating
• A maintenance program and plan developed in accordance with ASHRAE 188
• Legionella culture sampling within 14 days of seasonal start-up and at intervals not exceeding 90 days while in use, plus bacteriological sampling at intervals not exceeding 30 days
• Inspection before seasonal start-up and every 90 days while in use
• Annual certification by November 1
• Notification of the local health department within 24 hours of a result above 1,000 CFU/mL

CMS Expectations for Healthcare Facilities

In 2017, CMS issued memo S&C 17-30 (revised July 6, 2018 as QSO-17-30-Hospitals/CAHs/NHs), which expects hospitals, critical access hospitals, and long-term care facilities to have water management policies and procedures to reduce the risk of Legionella and other waterborne pathogens. Under the memo, facilities should:

• Conduct a facility risk assessment to identify where Legionella and other opportunistic waterborne pathogens could grow and spread
• Develop and implement a water management program that considers the ASHRAE industry standard and the CDC toolkit
• Specify testing protocols and acceptable ranges for control measures, and document results and corrective actions
• Maintain compliance with other applicable federal, state, and local requirements

The memo states that it clarified existing expectations under the infection control conditions of participation rather than creating new requirements, that CMS does not require Legionella cultures (testing protocols are at the provider's discretion), and that facilities unable to show measures to reduce Legionnaires' disease risk are at risk of citation. CMS's website now lists the memo as expired, so confirm current survey expectations with your state survey agency or accrediting organization; the underlying infection control requirements remain in effect.

OSHA Requirements

OSHA does not have a specific standard for legionellosis. OSHA states that it may enforce the General Duty Clause (Section 5(a)(1) of the OSH Act), which requires employers to provide a workplace free from recognized serious hazards, where workers face a recognized hazard such as occupational exposure to Legionella in water systems.

Building a Compliance Program: Practical Steps for Facility Managers

Step 1: Conduct a System Inventory

Walk your facility and document every cooling tower, evaporative condenser, and closed-circuit cooler. Record make, model, age, capacity, and operating schedule. Note the location of each tower relative to building air intakes, operable windows, and occupied outdoor spaces.

Step 2: Engage a Qualified Water Treatment Professional

Your program team needs people with water treatment and Legionella risk management experience. For cooling tower programs, this typically means a water treatment provider with specific Legionella experience. Look for providers whose service agreements reference ASHRAE 188 and CDC guidance explicitly, and in New York, confirm the credentials required for Qualified Persons and disinfection work.

Step 3: Develop or Update Your Written Water Management Program

The program must be site-specific. Generic templates are a starting point only; the document must reflect your actual systems, occupancy and risk profile, treatment parameters, and local requirements. Review it on a set schedule and whenever significant system changes occur.

Step 4: Establish Your Monitoring and Documentation System

Log every water chemistry test, Legionella result, inspection, and corrective action in a retrievable format. Keep records at least as long as your regulators require; New York City, for example, requires at least three years.

Step 5: Train Responsible Personnel

Facility staff who perform water quality checks, add chemicals, or respond to alarms should be trained on the program procedures and on Legionella hazards. Document the training and refresh it periodically.

Step 6: Establish a Response Plan for Elevated Results

Before you receive a high Legionella result, have a written plan for what happens next: who gets notified, what enhanced treatment is applied, when the system is retested, and when the health authority must be contacted.

Common Compliance Gaps

Outbreak investigations and inspections repeatedly identify the same types of problems. CDC's 2000–2014 outbreak review found inadequate disinfectant levels in 70 percent of investigated outbreaks and water temperatures favorable to Legionella in 52 percent. Common program gaps include:

• No written program, or one that does not reflect the current system configuration
• Inadequate documentation: monitoring logs with gaps, missing corrective action records, or results not linked to specific towers
• Infrequent or inconsistent Legionella testing: relying on annual testing where quarterly or monthly sampling is required
• Seasonal startup without cleaning and disinfection
• Damaged drift eliminators left uncorrected
• Water chemistry out of range, particularly disinfectant levels below the program's control limits
• No defined corrective actions in the program

Conclusion

Cooling tower compliance rests on a written, site-specific water management program backed by consistent monitoring and documentation. Use ASHRAE 188 and CDC's toolkit as the framework, then layer on the specific sampling, inspection, reporting, and registration rules that apply in your jurisdiction and, for healthcare facilities, CMS and accreditor expectations.

Sources and References