Most property operators have never thought about Legionella as a compliance question, and for good reason: the coverage of it is written for hospitals and large institutional campuses, and it reads as somebody else's problem. That instinct is right for a lot of buildings and wrong for a specific and growing set of them. Whether a water management obligation applies to a given building does not turn on whether it is a hospital. It turns on what water systems the building contains and which jurisdiction it sits in, and a multifamily or mixed-use operator can cross into a genuine requirement without ever deciding to.

This article covers what actually triggers the obligation, why a cooling tower is the feature most likely to trigger it, and how to tell whether the question applies to you before an inspector or an outbreak answers it for you. One note first: this is a summary of public guidance and policy, not legal or public-health advice, water safety law is intensely local, and the specific rule for any building is a question for counsel or a qualified water-management professional in that jurisdiction.

What the Risk Actually Is, Briefly

Legionella is a bacterium that occurs naturally in fresh water and becomes a problem when it amplifies inside a building's engineered water systems and is then inhaled as a mist or aerosol. It causes Legionnaires' disease, a potentially fatal pneumonia, and the Environmental Law Institute notes that reported case numbers have risen since 2000 and that community-acquired cases carry a fatality rate of roughly one in ten. This is not a nuisance-mould situation; it is a serious illness with a real death rate, which is why the regulatory attention exists.

The conditions that let it grow are specific and, importantly, are ordinary building conditions gone slightly wrong. The CDC explains that stagnant water lets hot-water temperatures fall into the Legionella growth range of roughly 77 to 113°F and lets disinfectant levels drop toward zero, which is exactly what happens in a pipe that is not being used. It can grow in building water systems when conditions allow, including water heaters, storage tanks, decorative fountains, hot tubs, cooling towers, and plumbing fixtures such as showerheads and faucet aerators.

That list is the key to the whole compliance question, because it means the risk, and the obligations that follow it, attach to particular pieces of equipment rather than to a building's category.

Why This Is Not a Universal Rule

Here is the thing most coverage gets wrong by omission. There is no single national law requiring every building to have a Legionella water management program. The Environmental Law Institute, surveying the policy landscape, states plainly that only a relatively small number of jurisdictions have policies establishing a primary-prevention approach, and that those policies vary in the facility types and water systems they cover. The obligation is a patchwork, not a blanket.

The engineering standard underneath most of these Legionella water management policies is ASHRAE Standard 188, the consensus standard for managing the risk in building water systems. It matters here for one detail in particular: ELI notes the standard is designed for use in most building types except single-family homes. So the framework explicitly reaches multifamily and commercial buildings, but it is a voluntary consensus standard, not a law, until a government adopts it. It becomes binding only where a jurisdiction writes it, or something like it, into its own rules.

That produces the situation this article is really about. Whether a building carries a water management obligation depends on the combination of two things: what water systems it contains, and what the state or city it sits in has chosen to require. Neither of those is "is it a hospital," and both are knowable in advance.

The Cooling Tower Is the Usual Trigger

If there is one feature that most reliably pulls an ordinary commercial or residential building into a real, enforceable obligation, it is a cooling tower.

Cooling towers are the highest-profile Legionella risk because they do exactly the dangerous thing: they hold warm water and generat e an aerosol, which can carry the bacterium a considerable distance on the wind. That is why they sit at the centre of the jurisdictions that have acted. The ELI survey shows the pattern clearly. New York State, after a series of outbreaks, adopted a 2016 regulation requiring owners of all cooling towers to register, test, inspect, and certify them and to maintain a maintenance program for each one. New York City has its own city law, first passed in 2015 and amended since, requiring cooling tower owners to register, inspect, clean, disinfect, and test. New Orleans adopted a mechanical-code amendment requiring water management plans for cooling towers and other aerosol-producing equipment. Garland, Texas requires owners of multifamily buildings and lodging establishments with cooling towers to test annually and file the results with the city.

Read that list from an operator's chair. These are not hospital rules. They are rules that attach to a cooling tower on any building, including multifamily and mixed-use property, in the jurisdictions that have them. If a building has a cooling tower and sits in one of those places, the obligation is already live, complete with registration, testing, and filing requirements that carry the same missed-deadline exposure as any other compliance regime. And an operator who thinks of this as a hospital issue is exactly the operator who does not realise the rooftop equipment on their apartment building is the regulated object.

Cooling towers are the clearest trigger, but they are not the only one. Some jurisdictions reach decorative fountains and other aerosol-generating equipment; healthcare and residential-care facilities face their own layer of requirements in states like Michigan, Ohio, and Illinois; and reclaimed-water systems carry conditions of their own in states such as California and Colorado. The specific triggers vary. The principle does not: the obligation follows the equipment and the jurisdiction.

The Trigger Nobody Registers: Reduced Occupancy

There is a second trigger that is not about a permanent feature at all, and it is the one most likely to catch a residential operator off guard, because it is created by ordinary operational events.

Legionella risk rises sharply when water sits still. The CDC's guidance on this is built around exactly the scenario property operators create routinely: a building, or part of one, that has been through a prolonged period of low or no water use. The CDC notes that after such a period, stagnant water in the plumbing can drop into the bacterium's growth range and lose its disinfectant residual, and it lays out an eight-step remediation sequence, flushing every outlet until the hot water reaches temperature, cleaning decorative features, servicing cooling towers, and checking water heater settings, before reoccupation.

Think about how often property operations produce that condition without labelling it. A unit vacant for a season between tenants. A wing of a building closed during a slow period. A seasonal property shut for the off-season. A newly built or renovated building that sat plumbed but unoccupied for months before lease-up. Each of these is a stagnation event, and each recreates the conditions the CDC guidance is written to address. The obligation here is less often a formal filing and more often a duty of care, but it is real, it is documented by a federal health authority, and it is the kind of thing that becomes a liability question precisely when someone falls ill and the records are examined.

How to Tell Whether the Question Applies to You

The practical work is a triage, and it is not onerous. It comes down to a small number of questions asked per building.

First, what aerosol-generating or water-holding systems does the building contain? Specifically: is there a cooling tower or evaporative condenser, a decorative fountain, a hot tub or spa, a misting system, or a large or complex hot-water system? A cooling tower is the single most important item on that list.

Second, what does the building's jurisdiction require? Cooling tower registration and testing regimes exist at state and city level in a growing set of places, and healthcare, residential-care, and school requirements exist in others. This is the part that has to be checked locally, because it is precisely where the patchwork lives.

Third, does the building routinely experience reduced-occupancy or stagnation events that would bring the CDC's reopening guidance into play?

Fourth, if any of the above is yes, is there a written water management program, and is it being followed and documented? Where an obligation exists, the program and its records are what discharge it, and the absence of records is what converts an incident into a liability.

For a single building, that is a short checklist. For a portfolio, it is the same checklist multiplied, and it becomes a tracking problem of the same shape as any other multi-jurisdiction obligation: which buildings have the triggering equipment, which sit in the jurisdictions that regulate it, when each registration or test is due, and where the documentation lives. Those facts, building location, installed equipment, inspection and maintenance history, are the ones an operator already holds, usually scattered. A system that keeps property, asset, and location records together, RIOO among them, is where a per-building, per-jurisdiction obligation like this can be tracked as a live schedule rather than reconstructed after an inspector asks or an illness is reported. The point is not that software manages the water; it is that knowing which buildings even carry the obligation is a data question before it is a plumbing one.

Conclusion

Legionella compliance is easy to file mentally under "hospital problem" and leave there, and for a single-family rental that instinct is broadly correct, since the main engineering standard deliberately excludes single-family homes. For most other buildings it is the wrong instinct, because the obligation does not track building category. It tracks equipment and jurisdiction. A cooling tower on a multifamily building in the wrong city is a registered, tested, documented object whether or not its owner thinks of themselves as being in the water-safety business.

The genuine risk for a property operator is not that these rules are onerous; where they apply, they are manageable maintenance and paperwork. The risk is not knowing the rules apply at all, discovering a registration requirement after the deadline, or facing an illness in a building that went through a long vacancy with no flushing and no records. All three are failures of awareness rather than of capability, which means they are the cheapest kind of risk to remove: it costs a triage, not a budget, to find out whether the question is yours.

The operators who handle this well are the ones who ask, building by building, whether they have the triggering equipment and the triggering jurisdiction before anyone else asks them.

FAQs

1. Does my building need a Legionella water management plan?
It depends on what water systems the building has and where it is. There is no single national rule requiring every building to have one. The main engineering standard, ASHRAE 188, is designed for most building types except single-family homes, but it is only mandatory where a state or city has adopted it or a similar requirement. A cooling tower is the feature most likely to trigger a formal obligation, because several states and cities regulate cooling towers directly.

2. What kinds of buildings are most affected?
Any building with a cooling tower or evaporative condenser is the clearest case, and in jurisdictions like New York State, New York City, New Orleans, and Garland, Texas, that includes multifamily and commercial buildings, not just hospitals. Healthcare and residential-care facilities face additional requirements in several states. Buildings with decorative fountains, hot tubs, misting systems, or large hot-water systems can also carry risk and, in some places, obligations.

3. Is Legionella compliance only a concern for hospitals?
No, and that is the common misconception. Healthcare facilities do face specific federal and state requirements, but cooling-tower registration and testing laws attach to the equipment on any building in the jurisdictions that have them. A multifamily or mixed-use property with a cooling tower can be subject to the same registration, testing, and filing rules.

4. Does a vacant unit or a seasonal closure create a water safety risk?
It can. The CDC's guidance addresses buildings that have gone through a prolonged period of low or no water use, where stagnant water can fall into the temperature range that favours Legionella growth and lose its disinfectant. The recommended response is to flush the water system thoroughly, along with cleaning decorative features and servicing cooling towers, before the space is reoccupied. This is a real consideration for seasonal properties, units vacant between tenants, and newly built buildings that sat unoccupied before lease-up.

5. How should a multi-property operator manage this?
As a triage followed by a tracking exercise. For each building, identify whether it has triggering equipment such as a cooling tower, determine what its jurisdiction requires, note whether it experiences stagnation events, and confirm that where an obligation exists there is a documented water management program being followed. Across a portfolio, the practical challenge is keeping track of which buildings carry the obligation and when each registration or test is due, which is a records and scheduling problem more than a plumbing one.