Legionella compliance for data-center cooling towers: which rule binds, what each result triggers, and what it does to the plant

The monthly culture result lands at 08:40: 1,300 CFU/mL from the condenser-water system on chiller plant A, sampled eleven days earlier. Read against New York City's Table 8-1 that is a Level 4, which means more biocide within 24 hours, a full remediation within 48, and the health department told by tomorrow morning. Plant A is the running plant, and this scene is a composite.

Legionella compliance for a cooling tower means a written water management program of the kind ASHRAE Standard 188 prescribes, control measures that follow ASHRAE Guideline 12 and the CDC toolkit, and, where a jurisdiction has adopted rules, registration, routine culture testing by a certified laboratory and fixed actions at fixed counts. The US jurisdictions with cooling-tower law are New York State and New York City, and since May 2026 the City requires a culture sample at least every 31 days in operation and a full remediation within 48 hours at 1,000 CFU/mL. Every obligation acts on a live condenser-water plant, which the City's rule defines to include the chillers.

• ASHRAE 188-2021 sets no Legionella count and does not require Legionella testing unless the program team decides to. The counts and cadences come from the jurisdictions that adopted it, and in the United States that is New York State and New York City.
• New York City's Table 8-1 acts at 10 CFU/mL and notifies at 1,000 CFU/mL. The UK's HSG274 acts at 100 and 1,000 CFU per litre, which is 0.1 and 1 CFU/mL. The two scales are 1,000 apart and every explainer quotes them as one.
• A Level 4 result obliges a hyperhalogenation, drain, clean and flush of the cooling tower system within 48 hours, and the rule's definition of that system includes the chillers, condensers, pumps and controllers. On a data-center plant that is a redundancy event, not a rooftop one.
• The idle redundant cell is the compliance object a data-center plant creates by design. Three days without circulation in any part of the system triggers the risk procedures, and five days triggers a clean and disinfect before it runs again.

What is Legionella compliance for a cooling tower?

Legionella pneumophila is a bacterium that lives in natural water and multiplies in warm, wet, sheltered places. The Cooling Technology Institute's guideline puts the growth range at 68 °F (20 °C) to 113 °F (45 °C), with no survival above 140 °F (60 °C) and an optimum at 37 °C, and notes that biofilm and the protozoa living in it shield the organism from biocide concentrations that would otherwise kill it. A cooling tower is exactly that environment, with a fan on top.

The fan is why a tower is regulated and a chiller is not. Drift leaving a tower carries droplets, and the CDC's cooling-tower toolkit states that if Legionella is present the aerosolized water can spread the bacteria over miles, which is why its design rules start with high-efficiency drift eliminators and a tower at least 25 feet from any building air intake. The people at risk are rarely the people who own the tower.

Legionellosis

Two diseases caused by the bacterium: Legionnaires' disease, a pneumonia, and Pontiac fever, a milder illness. ASHRAE's fact sheet cites a National Academies estimate of 52,000 to 70,000 US cases a year against far fewer reported.

Cooling tower system

New York City's definition: all components with a wet surface during circulation, including chillers, water-cooled condensers, heat exchangers, pumps, treatment devices, chemical controllers and piping. Not the box on the roof.

Water management program

ASHRAE 188's written program: a team, a description of each system, a hazard analysis, control measures and control limits, monitoring, corrective actions, confirmation and documentation. New York calls it the maintenance program and plan.

Control limit

The value a monitored parameter must stay inside, set by the program team. Disinfectant residual and pH are the usual ones. ASHRAE 188 sets none for Legionella itself.

Action level

A Legionella culture count at which a rule or guideline obliges a defined response. Quoted in CFU/mL in the United States and CFU per litre in the UK.

Qualified person

New York City's term for who may write the plan and inspect: a licensed professional engineer, a certified industrial hygienist, a certified water technologist or an environmental consultant with two years of water management experience.

ELAP laboratory

A laboratory certified by the New York State Environmental Laboratory Approval Program. The State rule requires one for every Legionella culture, and since 2026 the City rule does too.

Hyperhalogenation

An online disinfection at a raised free halogen residual. New York City's corrective version is 5 to 10 ppm for at least one hour; the summertime version is required on every operating tower between 1 July and 31 August.

Operation period

Reported at registration in New York City as annual, seasonal or on demand. A data-center tower is annual, which removes the seasonal startup every other rule is written around.

Two lines in the source documents place a data center inside all of this. OSHA's technical manual lists fluid coolers as rejecting heat from industrial processes and computer-room air conditioners among the systems that create the exposure, and the CDC states that Legionella risks are similar for open and closed-circuit cooling towers, which takes in the closed-circuit and hybrid coolers on many data-hall roofs. A closed-circuit tower can run dry in cool weather and generate no aerosol, which is a control measure the open kind does not have.

Which standard or regulation actually binds your tower?

ASHRAE Standard 188-2021 establishes minimum legionellosis risk management requirements for building water systems, and the 2021 edition replaced permissive language with enforceable language so that codes and regulators could adopt it. It binds a building only where somebody has adopted it, by law, by code reference or by a customer's contract. On its own it is the shape of the program, not a legal duty.

The standard also sets no Legionella count. The National Academies' review of the regulatory landscape states that ASHRAE 188 does not specify that monitoring of Legionella in the building water system is necessary unless the program team decides that it is, and that the standard's focus is on the physical and chemical factors, temperature and disinfectant residual, rather than on culture results. The counts, the cadences and the deadlines all come from the layer below it.

New York State's rule is the one with the widest reach. Its regulator's summary requires every owner to register their towers in the New York State Cooling Tower Registry, prepare and implement a Maintenance Program and Plan, test their towers for Legionella, clean and disinfect them, to have that plan developed in accordance with ASHRAE 188, to inspect before seasonal startup and every 90 days in use, and to notify the local health department within 24 hours of a result above 1,000 CFU/mL. The National Academies counted about 11,000 registered towers in the State and 6,100 in the City by 2019.

New York City's rule changed on 8 May 2026. After the Central Harlem cluster of August 2025, which the City records as 118 cases, 92 hospitalisations and seven deaths, Local Law 159 of 2025 raised the culture cadence, and the Health Department's release states that owners must now test every 31 days when operating, increased from the previous 90-day requirement. The same amendment moved the rule's ASHRAE reference from sections 5, 6 and 7.2 of the 2015 edition to the latest edition, which is what ASHRAE's president had asked the City for in a letter dated 11 August 2025.

Outside New York the binding instruments are mostly indirect. ASHRAE's own fact sheet records that the state of Michigan requires health facilities to implement a water management program consistent with Standard 188, that the Centers for Medicare and Medicaid Services directed certified health facilities to keep water management policies in 2017, and that the Uniform Plumbing Code has referenced 188 since 2021. A data center in most states is bound by its own water management program, its insurer and its customers' audits, and by New York's rules the moment it has a tower in New York.

What Legionella count triggers action, and in which units?

Three scales are in circulation and the explainers quote them as one. New York, OSHA and CTI count colony-forming units per millilitre. The UK counts per litre. One CFU/mL is 1,000 CFU/L, and the table below puts every band on both scales so the numbers can be compared rather than collected.

New York City's Table 8-1 is the one with deadlines attached, so its wording matters. The 2026 rule text requires, at Level 4, that the owner initiate disinfection by increasing biocides within 24 hours and within 48 hours perform full remediation of the tower by hyperhalogenating, draining, cleaning and flushing, then retest within 3 to 7 days and keep retesting under the table until Level 1 is reached. The same rule sets the corrective hyperhalogenation at 5 to 10 ppm free halogen residual for at least one hour at a pH that makes it effective.

OSHA's numbers carry their own caveat. The technical manual's appendix presents 100 and 1,000 CFU/mL for cooling towers as adapted from a 1991 consultancy bulletin and says the guidelines are based on limited data, and the National Academies notes that OSHA no longer suggests guideline values at all. The UK's HSE takes the opposite position on interpretation: its guidance warns that failure to detect legionella should not lead to relaxation of control measures and monitoring, because a colonised system can return low counts between high ones.

A result of 5 CFU/mL is a Level 1 in New York and an immediate-action result in Britain. Both are right on their own scale, which is why the scale has to be on the page.

How does a culture result travel from the sample point to a closed record?

A compliance obligation is a path with clocks on it, and the clocks start at different people. The sample date belongs to the qualified person, the count belongs to the laboratory, the deadline belongs to the owner, and the notification belongs to the health department. The diagram follows one result under the New York City rule from the basin to the file.

Two more clocks run beside the culture. A weekly bacteriological indicator, a heterotrophic plate count or a dip slide, is read against Table 8-2, and a count at or above 10,000 CFU/mL obliges residual monitoring three times a day until the target biocide residual has held for 24 hours, with a Legionella sample if that takes more than three days. And the rule names four conditions that oblige an extra culture sample outside the calendar: a power failure long enough for growth, a loss of biocide treatment long enough for growth, a failure of conductivity controls to hold the cycles of concentration, and a request from the Department.

Those first three triggers are plant states. A tower that lost power, a biocide feed pump that stopped, and a conductivity controller that failed to bleed are all things a BMS or a water-treatment controller records as they happen. The rule makes each one a sampling obligation, and nothing in the stack connects the alarm to the obligation.

What does each obligation do to a running plant?

This is the table the result set does not have. The rules are written for a tower on an office block that starts in May and drains in October, and a data-center tower does neither. Its operation period is annual, its cells are N+1 by design, and the rule's definition of the cooling tower system reaches down through the condenser-water pumps to the chillers, so an obligation that reads as rooftop housekeeping is, on this plant, a decision about heat rejection.

The offline rows are the ones that meet the redundancy label. The CDC's control table says to remove from service, clean, and disinfect at least annually, and New York City says twice a calendar year, so a plant with N+1 tower cells spends two service windows a year with its spare consumed, per cell, and the redundancy arithmetic is the same as for a chiller on a permit. A plant with a single basin serving both chillers has no spare to consume and has to schedule the clean against the load instead.

The idle cell is the other half of the same problem. The CDC's operating rule is to balance operating times among cooling towers to prevent stagnation when multiple cells exist, and the UK guidance is more specific: systems held on wet standby should be dosed with an appropriate biocide and circulated to ensure thorough mixing at least once a week, duty and standby pumps should all run during that circulation, and a system out of use for over a month should be drained. The 2026 City rule now requires the plan to cover every operating configuration that results in low flow or no flow, with a valve schedule for each, which is a description of an N+1 cell rotation written as a compliance document.

Back to the composite scene. Plant A's Level 4 means the condenser-water system on plant A is drained and cleaned within 48 hours, which under the rule's definition includes plant A's condensers, so the load transfers to plant B before the applicator arrives. That transfer is the same decision as the one a preventive maintenance permit makes when it takes a unit off, and it belongs to a named person, not to the laboratory.

What do the BMS, the water-treatment controller and the CMMS already hold?

Each system holds one input to the obligation and none holds the obligation. The gap is not that the systems fail to talk. It is that the calendar, the level, the plant state and the permit live in four places, and the person who assembles them is the qualified person, on a visit, every 90 days.

The 2026 amendment sharpened the consequence of that gap. The rule now states that failure to provide required records to the Department upon request shall be considered prima facie evidence that such required records do not exist and that the corresponding requirements were not satisfied, and the penalty for a missed or unrecorded Legionella sample is 2,000 dollars on the first violation and 4,000 on a repeat. A record that exists in the controller's memory and nowhere the owner can produce is, for the inspector, no record.

How to map your tower's obligations to the plant this week

The work is a mapping, not a checklist. Take each obligation the binding rule imposes and write beside it what it does to the plant, who is allowed to do it and what record proves it was done. The order below produces one page per tower system that the shift, the qualified person and the auditor can all read.

• Decide which instrument binds each tower. A tower in New York State is under Subpart 4-1; in the City it is also under Chapter 8. Elsewhere, write down what adopted 188 for you: a code reference, an insurer, a customer audit or your own program, and which edition.
• Draw the cooling tower system the way the rule defines it. List every component with a wet surface during circulation, from the basin to the condenser barrels, so that a Level 4 on that system names the chillers it will take with it.
• Write the operation period as annual and delete the seasonal assumptions. The twice-yearly clean has no autumn to hide in; give each cell its two windows and the spare that covers it, and treat each window as a permit that consumes redundancy.
• Inventory every configuration that leaves part of the system without flow, per cell and per valve position, and give each a circulation and dosing rule and a valve schedule. The idle N+1 cell is the first entry.
• Put the three plant-state sampling triggers into the alarm philosophy as conditions with a consequence: loss of biocide feed, conductivity control failure and power loss each raise an extra culture, with the deadline and the person who samples.
• Attach the deadlines to the levels on the work order template. Level 2 and 3 carry 24 hours and a retest window; Level 4 carries 24 hours, 48 hours, the notification and the plant transfer that has to happen before the drain.
• Name the people. The qualified person who signs the plan and inspects, the certified applicator who doses, the ELAP laboratory that counts, and the shift lead who decides the transfer. A result with no named responder is a result with no deadline.
• Decide where the record lives and prove it can be produced. The daily readings, the weekly indicator, the monthly report with its chain of custody and the declarations have to come out of the building on request, as a file the inspector can read.

The startup row deserves one more sentence, because a data-center tower does start: at commissioning, after a cell is returned from cleaning, and after any five-day stop. The City rule treats a system as in operation from the moment water is in it, requires municipal fill water and a clean within the 15 days before, and wants a culture within 3 to 14 days, which is a sampling step the commissioning checklist should carry beside its Level 5 tests.

Who is allowed to do the work?

The rules name the responders, and none of them is the nearest technician. New York City's qualified person is a New York State-licensed professional engineer, a certified industrial hygienist, a certified water technologist or a certified environmental consultant with two years of experience in water-quality management, and only that person writes the plan, certifies it annually, inspects every 90 days and supervises a startup. New York State adds that any person who disinfects a tower must be a certified commercial pesticide applicator or pesticide technician, using a biocide registered with the State for cooling towers.

A third responder is the laboratory. Under both rules a Legionella count exists only if an ELAP-certified laboratory produced it, with a signed chain of custody and the certification number on the report, so a field test kit read by the shift is a useful number and a non-existent record. The fourth is whoever signs the permit that drains plant A, which no rule names and every plant has.

What the layer would do is read and hold. It would see the biocide feed stop and raise the sampling obligation with its deadline, see the 31-day calendar run down on a cell that has been isolated for nine days and raise the five-day clean, and put a Level 4 on the work order with the chillers the definition drags in and the transfer that has to precede the drain. It would not dose anything, open a valve, start a fan or a pump, change a setpoint, or file anything with a health department.

What this cannot do

A page assembled from the CDC toolkit, New York's rule texts, ASHRAE's own summaries, the UK's technical guidance and the OSHA and CTI documents is not your water management program and not legal advice. ASHRAE 188 and Guideline 12 were not opened for this page, only the standard owner's descriptions of them and the sections New York cites, and the New York State regulation is quoted through its regulator's summary. Every figure carries its source on the sentence that makes it.

Nothing here predicts a positive result or diagnoses why one happened. A decision layer that holds the obligations can say that plant A went to Level 4 at 08:40, that the drain is due by 08:40 the day after tomorrow, that plant A's condensers go with it and that plant B must carry the load first. It cannot say the count will fall, and it does not dose, drain, isolate or transfer anything. A qualified person, a certified applicator and a laboratory do the work the rule names, and a named person signs the permit.

Which guides sit beside this one?

• Cooling redundancy, N+1 versus 2N: the arithmetic of the spare a cleaning window consumes.
• CRAC and CRAH preventive maintenance checklist: the permit that takes equipment off, and what covers it.
• Cooling commissioning checklist: where the startup sample and the fill-water rule belong.
• Critical environment technician qualification: the confined-space entry a tower cell interior requires.
• MTBF on cooling equipment: the tower's own field failure rate, and what it does not predict.

Answered