Can this policy be signed electronically?

Yes. Electronic signatures meet legal standards under the ESIGN Act (15 U.S.C. §7001) and state UETA statutes when intent, consent, attribution, and retention are documented; ensure the platform supports audit trails and retention.

How do I ensure HIPAA compliance?

Limit access to patient-identifiable investigation records, execute a Business Associate Agreement with vendors that handle PHI, and retain documents in a secure, access-controlled storage system consistent with 45 CFR §164.530(j).

Who must sign the policy?

Typical signatories include the Infection Prevention Director and Facilities Manager; include clinical leadership, risk management, and an executive approver where required by organizational policy.

What if testing returns positive results?

Follow the remediation section: isolate affected systems where feasible, implement engineering controls or disinfection, notify public health per local rules, and document actions and confirmatory testing.

How long should records be kept?

Retain monitoring and remediation records for at least the active term plus three years; HIPAA-related records require six years (45 CFR §164.530(j)); state rules may extend these periods.

Do I need a specific eSign vendor capability?

Use a vendor offering secure PDF records, audit trails, and HIPAA support (BAA available). Platforms such as signNow provide these capabilities and integrations; verify the BAA and required security controls before use.

Electronic Signature
Templates
Healthcare
Healthcare Legionella Policy

Healthcare Legionella Policy

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE LEGIONELLA POLICY

Facility Name: Facility Address:

Effective Date: Policy Owner:

Purpose

This policy establishes the facility's Water Management Program to reduce the risk of Legionella species proliferation and transmission through potable and building water systems. The policy sets forth roles, responsibilities, control measures, monitoring, corrective actions, and recordkeeping requirements necessary to manage Legionella risk in all facility-operated water systems.

Scope

This policy applies to all buildings and services operated by the facility where water is used or distributed, including clinical areas, patient care units, administrative spaces, ancillary services, cooling towers, decorative water features, and any leased or contracted spaces where the facility controls water management activities.

Definitions

For purposes of this policy, the following definitions apply: "Water Management Program (WMP)" means the documented set of procedures and actions to control Legionella risk; "Water Management Team (WMT)" means the multidisciplinary group responsible for implementing and sustaining the WMP; "Control Limits" are measurable parameters that indicate acceptable system performance.

Responsibilities

The facility is responsible for establishing, maintaining, and enforcing the WMP. The Water Management Team is responsible for performing risk assessment, defining control measures, monitoring performance, initiating corrective actions when control limits are exceeded, maintaining required documentation, and ensuring staff training and competency.

Water Management Team Lead WMT Lead Title WMT Lead Contact

Water Management Team Members

The WMT will include representatives from facilities/engineering, infection prevention, environmental services, clinical leadership, and laboratory services. At minimum, complete the following roster.

Member 1 — Name and Role Member 2 — Name and Role Member 3 — Name and Role

Risk Assessment — Systems Present

Identify building water systems that will be managed under this policy. Check all that apply.

Domestic hot water systems
Cooling towers / evaporative condensers
Decorative fountains and water features
Misting / aerosol-generating devices
Showers, faucets and clinical outlets
Other (specify in risk description)

Risk Assessment Summary

Control Measures and Targets

The WMT shall define and document control limits for each managed system. Enter primary control targets below.

Domestic Hot Water Target Temperature Cold Water Target Temperature Flushing Frequency for Low-Use Outlets Primary Disinfection / Control Methods

Thermal treatment (raising hot water)
Chlorine / chloramine residual maintenance
Supplemental biocide dosing
Point-of-use filtration / UV
Other (describe in monitoring plan)

Monitoring and Verification

Monitoring shall be performed to verify control measures and documented in logs. Provide primary monitoring parameters and frequencies.

Primary Monitoring Parameter 1 Frequency and Acceptance Criteria Verification Activities (e.g. calibration, independent sampling)

Sampling and Laboratory Testing

Sampling requirements shall be specified in the WMP. Sampling locations, frequency, methods, and laboratory acceptance criteria must be documented and approved by the WMT.

Designated Sampling Coordinator Approved Laboratory or Testing Provider

Corrective Actions

When monitoring indicates control limits are not met or when an environmental or clinical case linked to building water is suspected, the WMT shall initiate corrective actions immediately. Corrective actions shall include notification, isolation of affected outlets/systems, remediation, and follow-up verification sampling.

Corrective Action Procedure

Notification and Reporting

The WMT must notify facility leadership and infection prevention immediately upon any exceedance of control limits, detection of Legionella in environmental samples, or association of clinical cases with the facility. The threshold for notification is set as:

Primary Notification Contacts (names and titles)

Training and Competency

Staff with responsibilities under this policy shall receive training at hire and refresher training at least annually or more frequently when procedures change. The WMT is responsible for maintaining training records.

Training Frequency Training Record Location

Recordkeeping and Retention

All WMP documentation, monitoring logs, sampling results, corrective action records, and training documentation shall be retained in the facility records for the period specified below.

Record Retention Period (years)

Policy Review and Revision

The WMT shall review the WMP and this policy at least annually and following any event that may affect water system risk (e.g. building renovation, system modification, outbreak investigation). Revisions shall be documented and approved by the facility policy approver.

Next Planned Review Date

Authority and Enforcement

The facility maintains the authority to require actions necessary to reduce Legionella risk. Failure to comply with this policy or to perform assigned duties may result in corrective action, up to and including disciplinary measures consistent with facility policies and applicable law.

Acknowledgment

By signing below, the approver certifies that the Water Management Program described by this policy has been reviewed, that resources necessary for implementation have been identified, and that the facility will adhere to the monitoring, corrective action, and recordkeeping requirements set forth herein.

Policy Approver — Printed Name

Title / Department

Signature

Date

What a Healthcare Legionella Policy Covers

A Healthcare Legionella Policy is a written facility-level program that defines responsibilities, water system controls, monitoring, testing, and corrective actions to prevent Legionella growth and Legionnaires' disease. It covers building water systems, risk assessment, sampling protocols, remediation steps after positive results, recordkeeping, and staff training. In healthcare settings the policy aligns with infection prevention goals and local public health reporting requirements while documenting procedures used to reduce patient and occupant exposure to Legionella in potable and non-potable water systems.

Why a Formal Policy Matters for Healthcare Facilities

A formal policy reduces patient risk, standardizes response after positive Legionella findings, supports regulatory compliance, and documents due diligence for infection control programs. It clarifies roles and timelines so facilities can act quickly to protect patients, staff, and visitors while demonstrating an organized approach to public health authorities and legal reviewers.

Core Elements Every Policy Should Include

A complete policy combines risk assessment, operational controls, testing protocols, response actions, documentation, and review cycles to create a continuous water management program tailored to the facility.

Risk Assessment

Identify vulnerable patient populations, building hot/cold water systems, cooling towers, and other aerosol-generating outlets; use this analysis to prioritize monitoring and control points.

Water Management Team

Designate members from facilities, infection prevention, clinical leadership, and engineering with defined responsibilities and alternates for uninterrupted program oversight.

Monitoring Plan

Specify parameters to monitor (temperature, disinfectant residuals, flow), target ranges, measurement frequency, and action limits tied to corrective steps.

Sampling and Testing

Define when and how to collect samples, chain-of-custody, accredited laboratory use, test methods, and reporting thresholds for Legionella species.

Remediation Procedures

Prescribe immediate containment, engineering controls, system disinfection, and retesting protocols after confirmed positive results to verify effectiveness.

Documentation and Review

Maintain logs for monitoring, corrective actions, training, and annual program review with version control and responsible signatories.

Stepwise Completion Checklist

Follow these sequential actions to prepare, approve, and activate the Healthcare Legionella Policy.

01

Assemble Team: Identify infection prevention, facilities, microbiology, and clinical leads.
02

Document Scope: Define buildings, systems, and vulnerable populations covered.
03

Set Controls: Specify monitoring parameters, frequencies, and action limits.
04

Approve and Distribute: Obtain signatures and publish to responsible staff and contractors.

How to Configure an Online Policy Workflow

Configure the digital workflow to match your review, approval, and distribution needs before sending for signatures.

Field	Configuration
Authentication	Email + optional SMS or MFA for higher trust
Field Types	Signature, date, conditional checkboxes, file attachments
Conditional Logic	Show remediation fields only when a positive test is recorded
Notifications	Email reminders and completion receipts to team members

Typical Routing and Submission Flow

A standard submission path moves the draft policy from the author through review, approval, signing, and archival steps.

Upload Policy: Author uploads the document and attaches schematics.
Assign Reviewers: Route to infection prevention and facilities for edits.
Sign Off: Authorized leaders add signatures and dates.
Publish: Distribute final policy and store audit trail.

Technical Requirements for eSubmission and Records

Choose a platform that supports secure document formats, audit trails, and integrations needed to route, sign, and archive the policy.

File Formats: PDF and DOCX support for signed, tamper-evident records
Integrations: Connectors for EMR, document storage, and ticketing (Salesforce, Microsoft 365, NetSuite, Box)
Security: TLS in transit and AES-256 at rest

Ensure the provider can support HIPAA compliance (BAA), produce a complete audit trail (timestamps, IP, signer identity), and export signed records for long-term archival and inspections.

eSignature Vendor Comparison for Policy Signing

Compare common eSignature options for executing and preserving policy approvals. signNow is listed first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Yes	Yes	Yes	Yes
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Essential Data Elements to Record

Facility Name: Legal facility name

System Map: Plumbing and equipment schematic

Sampling Logs: Dates, locations, results

Remediation Records: Actions and verification tests

Responsible Parties: Names and contact details

Training Logs: Staff training dates

Who Prepares and Uses the Policy

Multiple roles contribute to and rely on the Healthcare Legionella Policy; clear assignment ensures timely action and compliance.

Facility managers and engineers who maintain water systems and controls
Infection prevention staff who align clinical risk and reporting
Environmental services and contractors who perform testing and remediation

Cross-functional collaboration between clinical, facilities, and administrative teams is essential for effective implementation and ongoing compliance.

Primary Signatories and Approvers

Infection Prevention Director

Leads clinical risk assessment, reviews monitoring thresholds, and attests the policy aligns with patient safety objectives. Often signs as clinical approver and coordinates reporting to public health.

Facilities Manager

Owns operational controls, oversees sampling and remediation, and signs to confirm engineering measures are in place and maintained according to the policy schedule.

Common Preparation Pitfalls to Avoid

Unclear roles and no alternates lead to delays during incidents and reduce effectiveness of remediation.
Vague monitoring criteria or unspecified action limits create inconsistent responses and audit exposure.
Relying on non-accredited labs or poor chain-of-custody procedures can invalidate results in investigations.
Failure to document training, revisions, and version control undermines legal defensibility and regulatory inspections.

Top Risks If the Policy Is Deficient

Patient Harm: Increased infection risk

Regulatory Fines: State public health penalties

Litigation: Civil lawsuits and damages

Reputational Damage: Trust and referral loss

Operational Disruption: Service limitations and closures

PH Reporting Failures: Mandatory-reporting violations

Typical Timelines and Review Cadences

Establish clear timeframes for initial implementation, routine monitoring, and post-event actions to ensure responsiveness and compliance.

Initial Implementation:

Complete baseline risk assessment within 60–90 days of policy adoption

Routine Review:

Perform a full program review at least annually

Post-Positive Sampling:

Begin corrective actions immediately and retest per protocol

Notification to Health Department:

Notify public health as required by state and local rules

Training Refresh:

Conduct annual staff training and after major revisions

Practical Examples of Policy Use

These short cases illustrate how facilities apply the policy in real situations and the outcomes of following established procedures.

Hospital Outbreak Response

A mid-sized hospital detected Legionella in a cooling tower during routine monitoring

Immediate isolation and disinfection were executed per policy
Follow-up testing confirmed control, documentation supported public health reporting, and the documented process shortened remediation time and limited patient exposures.

Long-Term Care Prevention

A long-term care facility instituted monthly residual and temperature checks and staff training

Staff followed escalation thresholds quickly after abnormal readings
Proactive maintenance reduced positive test frequency and provided audit evidence for regulators.

Frequently Asked Questions

Answers to common questions about creating, signing, and maintaining a Healthcare Legionella Policy in U.S. healthcare settings.

Need help? Contact support

Can this policy be signed electronically?
Yes. Electronic signatures meet legal standards under the ESIGN Act (15 U.S.C. §7001) and state UETA statutes when intent, consent, attribution, and retention are documented; ensure the platform supports audit trails and retention.
How do I ensure HIPAA compliance?
Limit access to patient-identifiable investigation records, execute a Business Associate Agreement with vendors that handle PHI, and retain documents in a secure, access-controlled storage system consistent with 45 CFR §164.530(j).
Who must sign the policy?
Typical signatories include the Infection Prevention Director and Facilities Manager; include clinical leadership, risk management, and an executive approver where required by organizational policy.
What if testing returns positive results?
Follow the remediation section: isolate affected systems where feasible, implement engineering controls or disinfection, notify public health per local rules, and document actions and confirmatory testing.
How long should records be kept?
Retain monitoring and remediation records for at least the active term plus three years; HIPAA-related records require six years (45 CFR §164.530(j)); state rules may extend these periods.
Do I need a specific eSign vendor capability?
Use a vendor offering secure PDF records, audit trails, and HIPAA support (BAA available). Platforms such as signNow provide these capabilities and integrations; verify the BAA and required security controls before use.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now