Standard 188 doesn’t tell you to test for Legionella every three months. It doesn’t hand you a number your water has to stay under, either. What it actually asks for is a written plan for managing the water systems in your building, one that spells out the risks and how you’ll control them. The standard leaves the testing schedule up to your own plan, and to whatever rules your city or state has already put in place.
This guide walks through the seven parts of that plan and shows exactly where lab testing fits into each one.
Key Takeaways
- Standard 188 is about managing Legionella risk in a building’s water systems. It’s a process to follow, not a pass or fail test.
- It applies to you either through a building survey, or through a law, code, or contract that points to it.
- The plan has seven parts, starting with your team and ending with proof that everything actually works.
- Lab testing mostly shows up near the end: checking your plan works, digging into problems, and following up after a fix.
- How often you test, what counts as a problem, and how long you keep records is up to your plan and your local rules.
What ASHRAE Standard 188 Actually Is
ANSI/ASHRAE Standard 188 sets the minimum rules for managing Legionella risk in building water systems. It spells out what a water management plan should include, who needs to be involved, and what needs to be written down and reviewed.
It’s a process standard, not a pass or fail test. There’s no score to hit. You don’t pass the standard just from a clean lab report, and you don’t fail it just from a Legionella detection.
What Does “Compliance” With ASHRAE 188 Actually Mean?
Complying with the standard means actually running the program it describes, not just ordering one test a year. A compliant building has a written plan with clear ownership. Someone has looked at the water systems and set real limits, like safe temperature ranges. Someone checks those limits on a schedule, knows what to do when something goes wrong, and reviews the whole thing over time.
Testing supports some of that, but it can’t replace it. The most common problem auditors find is a folder with a lab report inside and nothing else behind it, no monitoring logs, no plan.
Which Buildings It Applies To
Whether you need a program depends on your building and who’s in it, not your industry. Some of the most common triggers are:
- Apartment or condo buildings taller than about ten stories.
- Any building with a cooling tower or evaporative condenser.
- Hospitals and long-term care facilities.
- Buildings where most residents are 65 or older, or otherwise at higher risk.
- Any building with a whirlpool spa.
There’s a second way the standard can apply to you, even if none of that fits: someone else requires it. CMS expects a water management program at certified healthcare facilities. Some city codes point directly to the standard, and some insurance companies write it into their policies. If your building is more industrial than residential or medical, and it runs cooling towers or process water systems, our industrial water testing services cover that same territory.
Start With the Building Survey Before Assuming the Standard Applies
Don’t guess whether you need a program based on a label like office building or hotel. The standard asks you to do a building survey first, one that looks at which water systems you actually have, who uses the building, and what equipment creates mist or spray.
Some buildings have to build a program since they meet the standard’s criteria. Others follow the same framework by choice, for their own risk, an insurance requirement, or company policy.
Who is Responsible for ASHRAE 188 Compliance?
The building or the company that runs it holds the responsibility. Hiring a water treatment company, a lab, or a consultant doesn’t hand that responsibility off to them.
Your team can lean on outside experts for design, treatment, and testing. But your plan still needs to say, in writing, who runs each control, who checks it, who acts when something’s off, and who reviews everything.
The Seven Elements of a Water Management Program
Here’s what each part requires, and where a lab fits in.
1. Form the Program Team
Write down who’s on the team and what they’re responsible for: facilities and engineering staff, operations, infection prevention staff if your building has them, your water treatment contractor, and your lab. Include contact information and a plan for who to call when a result comes back out of range.
Naming your lab in this document matters more than it sounds. It shows a reviewer that you lined up testing support ahead of time instead of scrambling for it after something goes wrong.
2. Describe the Building Water Systems
Draw out how water moves through your building, from the point it enters to every place it comes out. That means showing the incoming water line, backflow devices, softeners and filters, water heaters and storage tanks, recirculation loops, cooling towers, spas, fountains, and any branches that don’t get much use.
Tie every risk you find later, every control point, and every sample location back to a spot on this map.
3. Analyze the Hazards
Walk through the systems you just mapped and look for the conditions Legionella likes. Start with warm water sitting outside the safe temperature range, plus stagnant water and dead-end pipes. Then look for sediment, scale, and biofilm, along with spots where it’s hard to keep disinfectant active. Finally, mark anywhere that creates mist or spray, since that’s how people actually get exposed.
A round of baseline testing sometimes helps with this step. Either way, what you’re building is a list of the spots that matter, not a clean bill of health.
4. Determine Control Locations and Limits
Pick specific locations in your system and set real limits for them. Temperature and disinfectant levels do most of the work in a plumbing system: hot water needs to stay above the range where Legionella grows, and cold water needs to stay below it.
Write down actual numbers and actual locations, then decide how often each one gets checked. A limit with no location and no schedule attached can’t really be audited.
5. Monitor the Control Limits
Monitoring is the day-to-day work: taking temperature readings at your control points, checking disinfectant levels, keeping an eye on tower chemistry, and writing it all down with a date and a name attached.
Lab testing for Legionella supports this step, but it doesn’t replace it, and it usually tells you more about long-term control than about what’s happening today. Our Legionella sampling guide walks through sample points and testing methods.
6. Establish Corrective Actions
Decide your response before something goes wrong, not after. For every control limit you set, write down what happens if it’s missed: who gets notified, what changes operationally, and what follow-up confirms things are back on track, including a retest if your plan calls for one.
Then document the whole thing, from the moment you spot the problem to the moment it closes out. Auditors read these records closely, since this is where a program shows whether it actually works.
7. Confirm the Program Works
Two last steps close the loop. Verification checks that you’re actually doing what your plan says, using logs, reviews, and sign-offs. Validation asks a harder question: is the plan actually keeping Legionella under control?
Validation is usually where lab testing for the organism itself comes in, since it measures Legionella directly instead of the temperature and chemical levels used to control it. Your logs prove the controls ran. Your test results show what those controls actually achieved.
Where Does the Laboratory Fit Across the Seven Elements?
A lab’s job clusters around four things: testing that validates your controls are working, testing when something looks off, follow-up testing after a fix, and reports for your compliance file. A lab doesn’t replace your program team, draw your water system diagrams, set your control limits, or handle daily monitoring, unless you’ve hired them separately to do that.
Does ASHRAE 188 Require Legionella Testing?
No, not on a fixed schedule. The standard doesn’t set a testing calendar or a concentration limit you have to hit. What it requires is a program that finds hazards, controls them, monitors those controls, and proves the whole thing works.
That last part usually needs lab results, since temperature and disinfectant logs only describe your controls, not the organism itself. So testing isn’t required everywhere, but it’s often the clearest way to show your program is actually working.
Monitoring and Legionella Testing Are Not the Same Thing
Routine monitoring tracks your controls: temperature, disinfectant levels, tower chemistry. Lab testing measures Legionella itself, and it can support validation, troubleshooting, a baseline check, or follow-up after a fix. Don’t let “water testing” become one blurry phrase covering both jobs. CDC’s own guidance keeps monitoring separate from verification and validation, and your paperwork should too.
When Does Legionella Testing Make Sense Under a WMP?
- Setting a baseline, if your program calls for one.
- Checking that your controls are actually working over time.
- Looking into a control failure or unusual system behavior you can’t explain.
- Investigating a suspected source, working with public health if anyone has gotten sick.
- Checking results after a fix or a major change to the system.
- Meeting a requirement from a regulator, accreditor, or contract.
Decide why you’re testing, and what result would trigger action, before anyone collects a sample. CDC treats environmental testing as a tool that supports your decisions, not something every building has to do.
Why a Negative Legionella Test Does Not Prove Compliance
A negative result only tells you about the spots you sampled, under the conditions that day, at the limits of that particular test. It says nothing about the wing you skipped, or the loop that ran too cool last month. Compliance comes from running the program and proving it, through monitoring logs, corrective actions, documentation, and review. A clean report can’t stand in for a program nobody is actually using.
How CMS, States and Insurers Change the Answer
The standard is the framework. The rules that actually have teeth come from whatever sits on top of it. CMS expects a water management program at certified healthcare and long-term care facilities. Some cities regulate cooling towers directly, with their own registration, testing, and reporting rules. Insurance companies ask for records at renewal.
These requirements change by city, state, and building type, so check your own state, city, accreditation body, and insurance policy instead of relying on any summary, including this one.
ASHRAE 188 Sets the Framework, but Local Rules Can Be More Specific
Local laws can pin down exactly what the standard leaves open: how often to sample, what qualifies a lab, when reports are due, and who’s allowed to be the responsible person on paper.
Here’s a real example. New York City now requires cooling tower sampling at least every 31 days while a tower is running, a change made in May 2026 from the old 90-day rule. Rules like that move, so recheck anything regulatory once a year.
Do Not Assume a Federal Healthcare Memo Is Still Current
Regulations and guidance change, and sometimes they expire outright. The older CMS memo on Legionella, S&C 17-30, is now marked expired on CMS’s own website, which points people to the current version instead.
So check CMS’s actual Conditions of Participation and current survey guidance yourself, along with your state’s rules, rather than trusting a quoted requirement secondhand. Put a date on every regulation you reference in your program file, including anything you pull from this guide.
What If Your Insurer or Corporate Policy Requires More Than ASHRAE 188?
Your insurance contract, corporate standards, or accreditation body can all ask for more testing or documentation than the standard’s bare minimum. When that happens, follow whichever rule is stricter, and write down where it came from. That note helps the next person understand why you’re sampling more often than the standard alone would suggest.
How to Turn ASHRAE 188 Into a Working Annual Compliance Cycle
A program that just sits in a binder fails quietly. Run it like a yearly cycle instead.
- Review the building survey and your program document, and confirm who’s still on the team.
- Update your system diagrams after any change to the water systems.
- Look at your hazard list again against the updated diagrams.
- Keep monitoring your control limits on schedule, and log every reading.
- Look into anything that falls outside your limits, and run your planned response.
- Do your validation work the way your program describes it.
- Write down what corrective actions you took and what happened afterward.
- Hold a program review, note the date, and record what you found.
Review the Program After Building or System Changes
Renovations, new equipment that uses water, plumbing changes, long shutdowns, a change in who’s using the building, or a new treatment approach can all shift your hazard list. Update your program and your diagrams as soon as something like this happens, instead of waiting for your next scheduled review. The update is quick if your diagrams are current. It’s painful if they’re three renovations behind.
Use Deviations to Trigger Corrective Action, Not Just Extra Paperwork
When a control limit gets missed, that should set off the response you already planned, then get written down. Depending on the problem, that might mean adjusting operations, flushing a line, changing your treatment approach, investigating further, or running a lab test. Logging a problem with no action attached turns a good program into paperwork for its own sake.
Documentation That Survives an Audit
- The program document, with version dates and the current team roster.
- Water system diagrams, updated after any changes.
- Monitoring logs for temperature, disinfectant levels, and other controls.
- Lab reports with chain-of-custody records attached.
- Corrective action records, from the moment you found the problem to when it closed.
- Notes from your program reviews, with dates and what changed afterward.
Our chain of custody guide covers what a lab report needs to hold up under review.
Keep Evidence of Implementation, Not Just the Written Program
A well-written program document proves someone sat down and wrote a program. It doesn’t prove your building actually follows one. Your records need to show real measurements, anything that fell out of range, the actions you took, your validation work, review dates, and any updates you made.
Organize your file so a reviewer can follow one problem from start to finish without needing you to walk them through it. That does more for your credibility than a hundred clean readings ever will.
What Should a Legionella Lab Report Add to the Compliance File?
A good report lists the sample locations, collection details, the testing method, the results, and the units those results are measured in, plus chain-of-custody paperwork if it’s required. Then connect that report back to whatever it was for. Note whether it was part of a validation check or a corrective action, and which one. That way, whoever reads it later can see exactly why the sample was taken and what happened next.
How Long Should You Keep ASHRAE 188 Records?
There’s no single answer here. How long you need to keep records can depend on the standard itself, local rules, your accreditation, company policy, your insurance terms, and even legal considerations.
Set your own retention policy and write it into your program. Then double-check whether a local rule sets a minimum you have to follow anyway.
A Practical Compliance Checklist
- Building survey done, and whether the standard applies is documented.
- Program team named, with roles and contact info.
- Water system diagrams complete and current.
- Hazard analysis written up against those diagrams.
- Control locations, limits, and check-in schedules set.
- Monitoring logs in use and up to date.
- A planned response ready for every control limit.
- Verification and validation work defined.
- A lab lined up, with method and containers confirmed.
- Records organized, a retention policy set, and a review date on the calendar.
Download the checklist to work through with your team.
Before You Call the Laboratory
A few things worth nailing down first. Know why you’re testing, and confirm your sample locations using your system map. Figure out which method fits what you’re trying to learn. Check whether your city or insurer requires a specific kind of lab, then decide ahead of time what result would actually trigger action. Getting this settled first keeps your lab work tied to your program, instead of just producing numbers with no plan behind them.
Frequently Asked Questions
Is ASHRAE 188 mandatory?
Not by itself. On its own, it’s a voluntary standard that experts agreed on. It becomes mandatory when a code, law, contract, or accreditation requirement points to it directly, which happens often in healthcare and in cities that regulate cooling towers. Check what your city, state, and insurer have adopted before assuming it doesn’t apply to you.
How often should we sample under a water management program?
Your own program sets that schedule, based on your systems, who’s in the building, and your risk level. Practice varies a lot. Some city rules call for monthly cooling tower testing. Others go quarterly, and lower-risk buildings often test once a year or after something changes. Any local rule wins over general practice.
Who can write a water management program?
The standard asks for a team, not one person with a specific certification. That team usually includes facilities and engineering staff, operations, infection prevention staff where relevant, and your water treatment company. A lot of buildings bring in a consultant to build the first version, then keep it updated in-house once the diagrams and logs are in place.
What is the difference between ASHRAE 188 and Guideline 12?
Standard 188 tells you what your program has to include. Guideline 12 tells you how to actually do it, with more detail on specific systems. Codes and regulators point to the standard, since a guideline is just advice, not a requirement. Most teams end up using both: the standard for structure, the guideline for the how-to.
Do small buildings need a program?
That depends on your systems and who lives or works there, not on square footage. A small building with a cooling tower, a whirlpool spa, or older residents can still fall under the standard, while a bigger building without those things might not. Even where the standard doesn’t technically apply, following its framework is still a smart way to manage risk.
Does ASHRAE 188 set an acceptable Legionella CFU limit?
No. There’s no single number written into the standard, since it’s built around controlling the system rather than hitting a specific count. Any action level you use for your test results should come from your own program, along with whatever public health or regulatory guidance applies to you.
Does ASHRAE 188 require a certified Legionella laboratory?
That depends on why you’re testing and which rules apply to your situation. A city or state may require an approved or accredited lab even though the standard itself doesn’t set one universal rule. Confirm the method and the lab’s accreditation before you collect anything.
How often should an ASHRAE 188 program be reviewed?
On whatever schedule your standard or program calls for, and again any time something meaningful changes in the building or how it’s used. Treat the review as a real check that your program still matches reality, not a formality. A review that just updates a date on the cover page isn’t worth doing.
Do we need to test after a corrective action?
Sometimes. Lab testing makes sense where your program uses it to confirm a fix worked or to validate that control has returned. Not every deviation needs a Legionella sample. Follow whatever corrective action and validation steps your program already spells out, plus any outside requirement that applies to your building.
Build the Program, Then Prove It Works
Verification and validation are really the whole point here. A program you can actually prove is running, with monitoring records, corrective actions, and test results all tied back to real events, protects the people in your building and protects your organization. Paperwork by itself isn’t worth much. The discipline behind it is worth a lot.
If you want help building the testing side to fit your program, send us your water system diagrams and control locations. We’ll help you figure out sample points, methods, and reports that slot right into your documentation, whether that means a standalone Legionella panel or a broader look at your water tests. Talk to ETR Laboratories today.