For Policymakers
Prevention starts where the laws are written...the evidence is settled. The requirement isn't.
Around 10,000 cases of Legionnaires’ disease are reported in the United States each year.
Three measures of the trend, each answering a different objection:
- Reported cases have risen roughly ninefold since 2000.
- Age-standardised incidence rose about fivefold — from 0.48 to 2.71 cases per 100,000 — so the rise is not simply a larger population.
- CDC cites an estimate that the true number of cases may be 1.8 to 2.7 times higher than reported, because the disease presents identically to other pneumonias and is only found when a clinician orders a specific test.
About one in ten people who get it die from the infection. Among those infected in healthcare settings, it is closer to one in four.
Sources: CDC, About Legionnaires’ Disease — https://www.cdc.gov/legionella/about/index.html · Barskey et al., Emerging Infectious Diseases 28(3), 2022 — https://doi.org/10.3201/eid2803.211435 · Emerging Infectious Diseases 31(1), 2025 — https://wwwnc.cdc.gov/eid/article/31/1/24-0916_article
The evidence on prevention
This is the finding that matters most for policy.
When CDC reviewed the Legionnaires’ disease outbreaks it investigated between 2015 and 2019, it concluded that every deficiency behind those outbreaks could have been prevented by a comprehensive, properly implemented water management programme. In 43% of cases the building had no programme. In a further 40%, it had one it did not follow.
The technical means of prevention are not in dispute, not experimental, and not expensive relative to the cost of an outbreak. They are published in ASHRAE Standard 188 and in CDC’s toolkit, and they have been available for years.
What is missing in most of the country is any obligation to use them.
Why voluntary adoption has not closed the gap
Water management is invisible when it works. It produces no revenue, no visible improvement and no complaints — only an absence of illness that nobody attributes to it. Deferring it produces no immediate consequence, and the consequence when it arrives lands on people who were never told the risk existed and had no way to check.
Buildings that adopt programmes voluntarily tend to be the ones already thinking about it. The buildings that most need one are, by definition, the ones that are not.
What effective legislation contains
The measures that appear in the strongest existing frameworks:
A water management programme requirement for defined categories of higher-risk building — healthcare facilities, care homes, hotels, large residential and commercial buildings.
Cooling tower registration. In most jurisdictions, authorities do not know where the cooling towers are. An investigation cannot begin with a survey of the neighbourhood.
Defined testing. A schedule and a method, rather than a general obligation to be careful.
Reporting and public disclosure of results. Testing that produces private information changes the incentives less than testing that produces public information.
Clinical reporting requirements with a defined timeframe, so health departments can act while an investigation is still possible.
An enforcement mechanism. A requirement with no consequence attached is guidance.
A working example
New Jersey put most of these into a single statute in 2024, and it is the closest thing available to a model. It is also the only one of them that regulates by risk rather than by building category — covering healthcare facilities, hotels above a size threshold, high-rise residential buildings, and any building operating a cooling tower or similar aerosol-generating system, rather than picking one sector and leaving the rest untouched. Its first compliance deadline fell in September 2026, so it is now in force rather than pending, and the questions a state would face in adapting it are answerable rather than hypothetical.
One provision is worth noting because no other state has it. Buildings covered by the law must post a written notice on the premises, somewhere occupants can see it, confirming that a water management programme is in place. It is the only requirement anywhere in the country that gives an ordinary person something observable — and it costs nothing to administer.
Read our analysis of the New Jersey statute →
What already exists
Healthcare facilities participating in Medicare and Medicaid operate under federal water management requirements. Several states and cities have adopted cooling tower registration and testing rules, most notably following the New York outbreaks of 2015. Coverage across the rest of the country is uneven.
Why voluntary adoption has not worked
Water management is invisible when it succeeds. It generates no revenue, no visible improvement and no complaints — only an absence of illness that nobody attributes to it. Deferring it carries no immediate consequence, and when the consequence eventually arrives it falls on people who were never told the risk existed and had no way to check.
Buildings that adopt programmes voluntarily are, as a rule, the ones already thinking about the problem. The buildings that most need one are by definition the ones that are not.
That is what legislation changes. Not the technical approach, which is settled — the question of whether anyone is required to take it.
What we advocate for
- A water management programme requirement for higher-risk buildings. Healthcare facilities, long-term care, hotels, large residential buildings, and any building operating a cooling tower, spa pool, decorative fountain or similar aerosol-generating system. Programmes to follow ASHRAE Standard 188 or an equivalent recognised standard.
- Cooling tower registration. In most jurisdictions, health authorities do not know where the cooling towers are. An outbreak investigation should not have to begin with a survey of the neighbourhood.
- Defined testing. A schedule and a method set out in the regulation, rather than a general obligation to be careful.
- Reporting and public disclosure of results. Testing that produces private information changes behaviour less than testing that produces public information. Occupants of a building should be able to establish whether its water has been tested.
- Clinical reporting within a defined timeframe, so health departments can act while an investigation is still possible.
- An enforcement mechanism. A requirement with no consequence attached is guidance.
Where things stand
A small number of states have adopted meaningful requirements. Most have none. Healthcare facilities participating in Medicare and Medicaid operate under federal water management requirements, which covers the most vulnerable population but leaves nearly everything else untouched.
How we can help
The Kopsi Foundation works with legislators and their staff on model language, briefing material and technical background. We do not charge for it.