CMS Legionella Rule: Critical Healthcare Water Monitoring 2026

Since June 2017, the Centers for Medicare and Medicaid Services (CMS) has required hospitals, critical access hospitals, and long-term care facilities to develop and implement water management programs to reduce the risk of Legionella growth and transmission. Under CMS directive S&C 17-30, facilities must maintain water management policies and procedures that consider ASHRAE Standard 188 and the CDC toolkit for controlling Legionella in building water systems. Failure to comply with CMS Legionella rule requirements can result in sanctions including loss of Medicare and Medicaid certification.

The urgency of CMS Legionella rule compliance is demonstrated by ongoing outbreaks in healthcare settings. In August-September 2024, a Legionnaires’ disease outbreak at Peregrine Senior Living in Albany, New York resulted in four deaths and 20 hospitalizations. Attorneys representing affected families cited the lack of a proper water management plan as a contributing factor to the outbreak. The facility housed 109 residents, and the outbreak became one of the deadliest Legionella events in the Capital Region in decades, leading to class action lawsuits and multiple families transferring their relatives to other facilities.

This guide provides facility managers, infection preventionists, and healthcare compliance officers with comprehensive information on meeting CMS Legionella rule requirements. From understanding the water management program elements mandated by CMS to implementing continuous water system monitoring that documents control measure effectiveness, you will learn how proactive surveillance prevents Legionella transmission, protects vulnerable patient populations, and demonstrates regulatory compliance during CMS surveys.

What CMS Legionella Rule Requirements Apply to Healthcare Facilities

CMS directive S&C 17-30, issued in June 2017, requires covered healthcare facilities to develop and adhere to policies and procedures that inhibit microbial growth in building water systems. The directive applies specifically to hospitals, critical access hospitals, and long-term care facilities receiving Medicare or Medicaid funding. While the policy memorandum is directed at these facility types, CMS states it is also intended to provide general awareness for all healthcare organizations.

Water Management Program Elements

CMS Legionella rule compliance requires facilities to have water management policies and procedures that consider ASHRAE Standard 188-2015 and the CDC toolkit for controlling Legionella in building water systems. The water management program must include control measures such as physical controls, temperature management, disinfectant level control, visual inspections, and environmental testing for pathogens. Documentation of these activities must be maintained and available for surveyor review.

The program must address not only Legionella but also other opportunistic waterborne pathogens including Pseudomonas, Acinetobacter, Burkholderia, Stenotrophomonas, nontuberculous mycobacteria, and fungi. This all-hazards approach recognizes that healthcare facilities serve immunocompromised populations vulnerable to multiple waterborne pathogens that can colonize building water systems.

Facility Risk Assessment Requirements

CMS Legionella rule compliance requires facilities to conduct a risk assessment identifying where Legionella and other opportunistic waterborne pathogens could grow and spread in the facility water system. The risk assessment must evaluate the entire water distribution system including hot and cold water systems, cooling towers, decorative fountains, ice machines, hydrotherapy equipment, and any other water features that could aerosolize water droplets.

Risk factors to evaluate include water stagnation in dead legs or low-use areas, water temperature ranges that support bacterial growth (77-113°F is optimal for Legionella), inadequate disinfectant residual, biofilm accumulation in pipes and fixtures, and changes in municipal water quality. The risk assessment should be reviewed and updated whenever changes occur to the water system or when cases of healthcare-associated Legionnaires’ disease are identified.

How Continuous Monitoring Supports CMS Legionella Rule Compliance

While the CMS directive does not specifically mandate environmental testing for Legionella as part of routine water management programs, it does require facilities to specify testing protocols and acceptable ranges for control measures. Continuous monitoring of water temperature, disinfectant levels, and other control parameters provides documentation that the water management program is being implemented effectively. This data-driven approach demonstrates to CMS surveyors that facilities are actively managing Legionella risk rather than simply having a written plan.

Temperature Management and Documentation

Temperature is one of the most critical control measures for preventing Legionella growth in building water systems. Legionella grows best in warm water between 77°F and 113°F, with optimal growth occurring around 95°F. ASHRAE Standard 188 recommends maintaining hot water system temperatures above 140°F at the heater outlet and above 122°F at the point of use to inhibit Legionella growth. Cold water should be maintained below 68°F to prevent bacterial multiplication.

Continuous temperature monitoring throughout the water distribution system provides real-time verification that these parameters are being maintained. Automated systems can alert facility staff when temperatures drift into ranges that support Legionella growth, enabling rapid corrective action before bacterial colonization occurs. Temperature records also demonstrate to surveyors that the facility is maintaining documented control limits.

Control Limits and Corrective Action Documentation

CMS Legionella rule compliance requires facilities to specify acceptable ranges for control measures and document corrective actions taken when control limits are not maintained. This creates an ongoing documentation requirement that continuous monitoring systems are designed to address. When water temperature, disinfectant levels, or other parameters deviate from established limits, the system generates alerts and creates timestamped records of the deviation and subsequent corrective actions.

Jurisdictions reviewing water management programs have noted many instances where facility programs are very generic or lack documentation of corrective actions when control limits are exceeded. These programs appear to contain just enough information to check the compliance box without demonstrating effective implementation. Continuous monitoring with automated documentation provides the evidence that surveyors need to verify that water management programs are being actively implemented.

Integration with Joint Commission Requirements

The Joint Commission began enforcement of its updated water management standard EC.02.05.02 on January 1, 2022, adding another layer of requirements for healthcare facilities. The Joint Commission standard is focused on preventing Legionella in healthcare building water systems through implementation and ongoing operation of a water management program. While the language differs from CMS requirements, both point to ASHRAE Standard 188 as the foundational publication.

During inspections, The Joint Commission assesses whether facilities have effective water management plans that include Legionella risk assessments and appropriate corrective actions. Facilities that maintain continuous monitoring records and documented corrective actions can demonstrate compliance with both CMS and Joint Commission requirements using the same monitoring system data.

Case Study: Peregrine Senior Living Albany Outbreak (September 2024)

In late August 2024, residents at Peregrine Senior Living at Shaker in Albany, New York began experiencing symptoms consistent with Legionnaires’ disease. The Albany County Department of Health was notified of a cluster of cases on August 30, 2024, and launched an immediate investigation. By September 9, 2024, four people had died and 20 had been hospitalized, making it one of the deadliest Legionella outbreaks in the Capital Region in decades.

The Problem: Water System Contamination and Delayed Response

Water samples collected from the Peregrine facility tested positive for Legionella bacteria. According to meeting minutes from September 6, 2024, residents began feeling sick the weekend of August 24, but confirmed diagnoses of Legionnaires’ disease were not communicated to staff until August 30 when testing results came back. The facility housed approximately 109 residents, many of whom were elderly with compromised immune systems that made them particularly vulnerable to severe illness from Legionella exposure.

The facility implemented water restrictions, installed shower filters, and began providing bottled water to residents after the outbreak was identified. A monochloramine treatment system was installed by September 10 to continuously disinfect the water supply. However, attorneys representing affected families cited the lack of a proper water management plan as a factor contributing to the outbreak, leading to class action lawsuits filed against the facility.

The Consequences: Deaths, Lawsuits, and Resident Transfers

The four deaths at Peregrine Senior Living represented a significant tragedy for families who had entrusted their loved ones to the facility’s care. Albany County Interim Health Commissioner Maribeth Miller confirmed that all four fatalities were pneumonia deaths connected to the outbreak. Multiple families began transferring their relatives to other facilities in response to the outbreak, with one family member telling the Times Union that “people are moving family members out of there in force.”

Class action lawsuits were filed against the facility seeking to represent all persons who resided at or visited Peregrine Senior Living and suffered Legionnaires’ disease as a result of exposure to the facility’s water systems in August and September 2024. Attorney Jory Lange, who specializes in Legionnaires’ disease cases, stated that “one of the things we find in a lot of these cases is a lack of water management plan implemented by the building.”

Modern monitoring systems address these compliance challenges by providing continuous verification of water system parameters. Combined with proper written procedures and environmental monitoring, these systems create comprehensive evidence demonstrating that facilities are meeting their CMS Legionella rule obligations.

Implementation Timeline for CMS Legionella Rule Monitoring

Establishing comprehensive CMS Legionella rule monitoring can be accomplished efficiently with properly designed systems that integrate temperature monitoring with water management documentation requirements. The investment provides value through improved patient safety, regulatory compliance, and evidence of due diligence during surveys and potential litigation.

Phase 1: Risk Assessment and System Mapping (Days 1-5)

Implementation begins with a comprehensive risk assessment identifying all areas where Legionella could grow and spread in the facility water system. Map the entire water distribution system including hot water heaters, storage tanks, distribution pipes, dead legs, low-flow areas, cooling towers, decorative fountains, ice machines, and patient care equipment that uses water. Document water system components, their locations, and associated risk factors.

Identify high-risk areas including immunocompromised patient units, transplant units, oncology departments, and intensive care units where vulnerable patients may be exposed to aerosolized water. Evaluate existing temperature and disinfectant monitoring capabilities and identify gaps that must be addressed to meet CMS Legionella rule requirements.

Phase 2: Sensor Deployment and System Integration (Days 6-14)

Deploy temperature sensors at critical control points throughout the water distribution system. Key monitoring locations include hot water heater outlets, recirculation loops, cold water supply mains, and representative points of use in high-risk patient care areas. Alert thresholds are configured based on ASHRAE 188 recommendations and facility-specific control limits documented in the water management program.

Integration with existing building management systems enables centralized visibility into water system conditions across the facility. Network connectivity ensures real-time alerting when temperatures drift into ranges that support Legionella growth, enabling rapid corrective action before bacterial colonization can occur.

Phase 3: Training and Procedure Development (Week 3)

Train facilities management, infection prevention, and environmental services staff on the monitoring system, alert response procedures, and documentation requirements. Staff must understand the water management program, their roles and responsibilities, and the corrective actions required when control limits are exceeded. Document all training with participant signatures and dates.

Update written water management policies and procedures to incorporate continuous monitoring into the CMS Legionella rule compliance program. Define escalation procedures for temperature alerts, documentation requirements for corrective actions, and communication protocols with infection prevention when deviations occur. Ensure procedures are available for surveyor review.

Phase 4: Ongoing Monitoring and Program Verification (Week 4 and Beyond)

Continuous CMS Legionella rule monitoring enables ongoing verification that all water system areas maintain safe conditions. Trend analysis identifies patterns requiring attention, such as areas where temperatures consistently approach growth ranges or times when hot water temperatures drop below control limits. This data-driven approach supports continuous improvement and provides documentation for CMS surveys.

Regular program review ensures the water management program remains effective as facility conditions change. The CMS directive requires facilities to maintain documentation demonstrating active program implementation, and continuous monitoring records provide this evidence automatically. Integration with incident reporting systems enables correlation of any healthcare-associated Legionnaires’ disease cases with water system conditions.

The CDC reports that Legionnaires’ disease incidence has increased approximately 6.5-fold from 2000 to 2019, with the national incidence rate peaking at 3.04 cases per 100,000 population in 2018. Healthcare-associated cases are particularly concerning because they affect populations already vulnerable due to age, illness, or immunosuppression. Studies show that 1 in 10 people who contract Legionnaires’ disease will die from the infection, with mortality rates even higher among healthcare facility patients. This underscores the critical importance of CMS Legionella rule compliance in protecting the most vulnerable patient populations.

Frequently Asked Questions About CMS Legionella Rule Compliance