New York City Has Tough Cooling-Tower Rules. So Why Did So Many Test Positive for Legionella?

New York City has one of the country’s most detailed cooling-tower rulebooks. Yet the 2026 Upper East Side Legionnaires’ disease outbreak reached 72 confirmed cases and two reported deaths while preliminary PCR testing detected Legionella DNA at 76 addresses, about 42% of the 183 cooling-tower systems tested. The city later said all 76 listed buildings had drained, cleaned, and disinfected their towers. Those facts do not prove that every listed property caused an illness. They do show that prevention, compliance, enforcement, and public transparency require much harder scrutiny.

Why so many preliminary positive cooling-tower results are a serious public-safety warning

Cooling towers are designed to bring air and recirculating water into close contact. That process releases tiny water droplets outdoors. The CDC explains that cooling towers release aerosolized water and that, when Legionella is present, those aerosols can carry bacteria far beyond the roof where the tower is located.

That makes a broad contamination signal fundamentally different from a problem confined to a private pipe or a single mechanical room. A tower can potentially affect people who live, work, attend school, receive medical care, shop, exercise, or simply walk nearby. The risk is determined by the amount and type of bacteria, tower operation, weather, plume movement, duration of exposure, and the vulnerability of exposed people. It is not limited to occupants of the listed building.

The scale matters because the city’s July 14 list identified 76 addresses whose cooling-tower systems required emergency remediation in one dense neighborhood after people had already become sick. Even if culture testing ultimately shows that only a small number of towers contained viable outbreak-associated bacteria, the prevention system should not have to discover a neighborhood-wide signal during an active outbreak.

A well-functioning regulatory system does not promise that every water sample will always be sterile. Legionella is common in natural and built water environments. It should, however, keep growth and aerosolization under control, identify deteriorating conditions before illness occurs, and trigger corrective action before an outbreak forces public-health officials to inspect an entire neighborhood.

The positive rate is too large to dismiss as a technical footnote

Seventy-six of 183 inspected cooling towers is approximately 41.5%, or more than two out of every five towers inspected. PCR is a sensitive screening tool, and some detections may reflect dead organisms or low-level DNA after treatment. That scientific caution is important. It is not a reason to shrug off the result.

The city itself treated the findings as operationally significant by ordering owners of PCR-positive systems to drain, clean, and disinfect their towers. Public-health officials did not wait for every culture result because an outbreak was already underway and delay could allow additional exposure. According to the NYC Health Department’s July 18 update, all 76 listed buildings had confirmed completion of required remediation by July 16.

The most responsible interpretation is neither “all 76 buildings caused the outbreak” nor “PCR means nothing.” The responsible conclusion is that the neighborhood contained an unusually broad field of towers requiring urgent attention, while investigators continued the slower work of identifying viable bacteria and matching environmental evidence to patient evidence.

Two reported deaths make the accountability questions more urgent

By July 18, the NYC Health Department reported that two people had died in connection with the cluster. Officials did not release identifying details, and the deaths do not establish which cooling tower caused either infection. They do establish that this was not merely a technical compliance event. The outbreak produced fatal harm.

The deaths raise the stakes for evidence preservation and accountability. Owners, managers, water-treatment vendors, maintenance contractors, laboratories, and other responsible parties should preserve water-management plans, test results, chemical-feed records, alarms, inspection reports, remediation records, communications, and contractor files.

Families and investigators need those records to determine what was known, what should have been known, whether warning signs were missed, and whether preventable failures contributed to the illnesses and deaths.

New York’s cooling-tower requirements are detailed, specific, and mandatory

New York City’s Cooling Tower Health Code does not merely tell owners to “keep the tower clean.” It assigns owners a detailed prevention system. New York State’s cooling-tower regulations add registration, maintenance, testing, certification, and enforcement requirements.

These are not aspirational best practices. They are legal duties directed at the conditions that allow Legionella to multiply and spread: stagnant water, biofilm, sediment, scaling, corrosion, poor disinfectant control, inadequate cleaning, and uncontrolled aerosols.

The problem is not a lack of knowledge

The mechanics of prevention are not mysterious. The CDC cooling-tower control guidance identifies sediment, biofilm, temperature, water age, and disinfectant residual as key factors. It recommends automated treatment, control of stagnation, regular monitoring, cleaning and disinfection, high-efficiency drift eliminators, and detailed records. The CDC also calls an effective Legionella water management program the primary strategy for preventing growth and spread.

When a large building claims that Legionella risk was unforeseeable, the rulebook answers that claim. New York’s laws identify the hazard, assign responsibility, specify the people who must act, define testing and cleaning intervals, and require documentation. The open question is whether owners and their contractors actually perform the work with enough rigor, whether regulators verify that performance, and whether noncompliance carries consequences large enough to change behavior.

Prominent names do not reduce the seriousness of the findings

The city’s preliminary list includes addresses publicly associated with the Metropolitan Museum of Art, the Solomon R. Guggenheim Museum, the Chapin School, the Dalton School, the Spence School, Ramaz Middle School, Trevor Day School, Asphalt Green, Whole Foods Market, luxury apartment buildings, and many other residential and institutional properties. The official city list and public reporting about the expanded list provide the current address-level information.

Again, being listed does not establish that any named institution caused an illness or broke the law. The prominence of the locations matters for a different reason. These are not obscure systems operating beyond the reach of professional building management. Many are properties with substantial resources, sophisticated facilities teams, outside consultants, and large populations of residents, students, workers, members, or visitors.

Prestige is not a water management program. A famous museum, elite school, luxury building, or national retailer does not receive a biological exemption. In fact, a high-profile institution with substantial resources should be capable of setting a higher standard for preventive maintenance, documentation, contractor oversight, and public communication.

A plan on paper is not the same as a controlled cooling tower

Legionella regulation can fail when compliance becomes a paperwork exercise. A building can possess a binder labeled “water management plan” while failing to act on the plan’s control limits, alarms, test results, and recurring warning signs. Logs can be incomplete, copied forward, filled in late, or accepted without meaningful review. Contractors can perform scheduled visits without fixing the underlying hydraulic or treatment problem. An annual certification can describe compliance while the day-to-day system is drifting out of control.

That is why a real Legionnaires’ disease liability investigation does not stop at asking whether a plan existed. It asks whether the plan was site-specific, scientifically adequate, followed in practice, updated when the system changed, and supported by authentic contemporaneous records.

Owners also should not be allowed to outsource accountability. A water-treatment vendor, facilities manager, engineer, pesticide applicator, and property manager may each have assigned tasks. The owner still controls the premises and selects, supervises, and pays the team. A contract can allocate work. It cannot make the public-health duty disappear.

Public violation records make the broad PCR findings more concerning

The PCR results do not themselves prove regulatory violations. Separate public-record reporting, however, raises serious questions about the compliance environment in which this outbreak occurred. A New York Post review of city records reported that approximately 59% of cooling towers in the affected ZIP codes had been cited for violations between March 2025 and March 2026. Reported problems included failures involving monitoring, cleaning, chemical treatment, and submission of Legionella test results.

A violation is not automatically proof that a tower caused this outbreak. It is still relevant. Rules requiring monitoring, testing, treatment, and cleaning exist because failures in those areas can create or conceal the conditions in which Legionella grows. When a neighborhood has both a large outbreak investigation and a substantial history of documented compliance problems, regulators and owners should not treat the two bodies of information as unrelated.

The city’s own new enforcement figures reinforce the need for scrutiny. In its July 18 outbreak update, the Health Department reported nearly 1,600 cooling-tower inspections during the first six months of 2026, a 35% increase over the same period in 2025.

For Fiscal Year 2025, the agency reported issuing 1,337 cooling-tower violations, including 253 public-health hazards, 810 critical violations, and 274 general violations. It also reported collecting approximately $680,000 in cooling-tower-related fines.

The city said 77% of operators had submitted information required under the newer 31-day Legionella testing rule. That also means nearly one-quarter had not yet submitted the required information at the time of the update, although some systems may not have been operating or may not have begun seasonal operation. These figures show that the regulatory challenge is not theoretical. Compliance, verification, and enforcement remain active citywide problems.

The correct next step is a tower-by-tower review of maintenance plans, laboratory reports, water-treatment logs, inspection records, chemical-feed data, alarms, prior positive results, corrective actions, contractor invoices, and communications. The public should be told whether each listed system was in full compliance before the outbreak, not merely whether it was cleaned after investigators arrived.

Four-figure penalties are not enough for wealthy or repeat offenders

The city code lists many first-offense penalties in the $1,000 to $2,000 range, with repeat penalties commonly reaching $2,000 to $4,000. For example, the city penalty schedule lists a $2,000 first penalty and $4,000 repeat penalty for lacking a maintenance plan, failing to collect or report required Legionella samples, or failing to take required corrective action based on test results.

Those amounts may matter to a small operator. For a major institution, luxury property, large commercial building, or well-capitalized owner, they can become a manageable cost of doing business. A penalty that costs less than rigorous prevention, independent auditing, or a major system repair may not deter delay. It may reward it.

Meaningful enforcement should account for the size of the property, the duration of noncompliance, the number of missed obligations, prior violations, concealment or falsification, and the risk created for the surrounding community. Repeat violations should trigger escalating daily penalties, independent technical audits, and operational restrictions, not another modest ticket.

New York has already had a decade of warnings

The 2015 South Bronx outbreak led New York City and New York State to create cooling-tower registration, maintenance, testing, and inspection requirements. Those reforms were adopted because cooling towers had demonstrated their ability to spread a dangerous pathogen through a dense urban community.

The warning was renewed in 2025. A Central Harlem outbreak caused 114 diagnosed illnesses and seven deaths. The city ultimately identified cooling towers at Harlem Hospital and a nearby city public-health laboratory construction site as sources, according to Associated Press reporting on the official findings. Politico reported that the cooling tower at the public-health laboratory construction site had not been registered before the city inspected it.

A cooling tower at a public-health laboratory construction site should not reach an outbreak investigation before basic registration is completed. That failure is especially troubling because registration is the foundation for inspection and accountability. If a tower is absent from the system that regulators use to find towers, every later safeguard becomes harder to enforce.

The 2025 outbreak prompted discussion of more frequent testing, larger penalties, and additional technical staff. The 2026 Upper East Side outbreak now tests whether those lessons produced a genuinely stronger system or only another round of promises after people became sick.

Why the problem keeps coming back

1. Responsibility is fragmented, but risk is not

Modern properties divide cooling-tower work among owners, managers, engineers, water-treatment firms, maintenance contractors, laboratories, and pesticide applicators. Each may assume someone else is watching the whole system. Legionella exploits the gaps between those assignments. A strong owner identifies one accountable management team, verifies performance, and treats contractor reports as evidence to review rather than assurances to file away.

2. Testing is only a snapshot

A culture result describes a sample collected at a particular place and time. Conditions can change quickly with heat, heavy cooling demand, shutdowns, water stagnation, disrupted chemical feed, construction, debris, or a failed pump. Monthly testing is an improvement over longer intervals, but it cannot replace continuous process control and competent weekly monitoring.

3. Self-certification is vulnerable without aggressive verification

The rules rely heavily on owners and retained professionals to create plans, keep logs, conduct inspections, submit results, and certify compliance. That model can work when owners are diligent and regulators conduct meaningful audits. It fails when incomplete records are accepted, inspections become predictable, violations remain open, or regulators lack enough specialized staff to examine whether a tower is truly controlled.

4. Low penalties can normalize noncompliance

When the financial consequence of missing testing, cleaning, or corrective-action obligations is small compared with the cost of operating a major Manhattan property, enforcement loses its preventive force. Owners who invest in safety should not be placed at a competitive disadvantage against owners who defer work and pay occasional fines.

5. Heat, aging equipment, and dense development increase the challenge

Warm weather, older infrastructure, high cooling demand, and dense clusters of towers create favorable conditions for bacterial growth and community exposure. The city health commissioner has discussed climate-related risk, and reporting on the outbreak’s climate context describes how warmer conditions may increase the challenge. Climate is a risk multiplier, not an excuse. A foreseeable increase in risk requires stronger prevention, not lowered expectations.

6. Source confirmation is slow, which can postpone accountability

PCR provides fast screening, but culture testing can take up to two weeks. Matching a patient isolate to an environmental isolate may take longer and may be impossible if clinicians did not collect a respiratory specimen before antibiotics. During that delay, records can be lost, systems can be altered, and public attention can move on. Owners and regulators must preserve evidence immediately, even while the final source determination remains open.

Publishing the addresses is a major and overdue change

In prior community outbreaks, New York City’s public-facing communications generally identified the affected neighborhood, the number of positive towers, and eventually a confirmed source when laboratory and epidemiologic evidence supported one. Based on our review of prior public notices, the city did not routinely publish a contemporaneous address-by-address list of every tower with a preliminary positive screening result.

That changed during the Upper East Side investigation. Public pressure for greater transparency grew as the case count rose. City Council Speaker Julie Menin called for immediate action and greater disclosure. The Health Department first published 31 addresses and then expanded the official list to 76 addresses.

The city may previously have had legitimate concerns about unfairly stigmatizing a building before a source was confirmed. That concern can be addressed with precise labels and repeated caveats. It should not require withholding information that can help sick people, physicians, investigators, journalists, and the public understand a fast-moving neighborhood outbreak.

Why address-level transparency matters

• It helps patients reconstruct exposure. A person may not remember every building name, but an address list can help identify work, appointments, school visits, shopping, exercise, caregiving, deliveries, or time spent near a tower during the incubation window.
• It gives clinicians a more specific reason to test. A patient who says “I was on the Upper East Side” may be overlooked. A patient who can describe repeated time near an active investigation area may prompt a more focused Legionella evaluation and respiratory culture.
• It allows inspection history to be examined. Address disclosure lets the public compare preliminary findings with registration, sampling, violation, and remediation records.
• It prevents quiet remediation from becoming the end of the story. Emergency cleaning is necessary, but it should not erase questions about what happened before the outbreak and whether warning signs were missed.
• It improves accountability without deciding causation. Transparency does not require the city to accuse every listed owner. It requires the city to disclose what it found, explain what the finding means, and update the public as culture and epidemiologic evidence develops.
• It helps independent investigations. Attorneys, epidemiologists, engineers, and industrial hygienists can identify records that must be preserved before documents disappear and systems are materially changed.

The old secrecy created real disadvantages

When addresses were not published during an active investigation, property owners and government investigators possessed information that patients did not. Sick people had to reconstruct exposure with an incomplete map. Physicians had less context. Nearby workers and residents could not tell whether a tower they passed every day was among the systems under investigation. Journalists and lawyers had to rely on delayed record requests or unofficial leaks.

That information imbalance also protected poor performers. A property could complete remediation without public scrutiny of its prior testing, maintenance, violations, or contractor oversight. If the tower was not ultimately identified as the outbreak source, the public might never learn that it required emergency disinfection during the investigation.

Public disclosure changes that balance. It does not establish legal fault, but it makes it harder for owners, contractors, and regulators to treat a broad contamination signal as a private operational problem.

Transparency must remain accurate and fair

Address publication should not become a substitute for scientific source identification. Every list should clearly distinguish PCR screening from viable culture results, identify the sample date, report remediation status, explain whether the tower was operating, and state whether the building has been linked to any patient exposure.

The city should also correct errors quickly. Address aliases, shared cooling-tower systems, mixed-use properties, and neighboring lots can create confusion. A public dashboard should identify the registered tower system, building identification number, owner or responsible entity, sample type, culture result when available, remediation date, and current operating status.

The answer to incomplete information is better information, not silence.

What meaningful accountability should look like

• Immediate preservation orders. Owners and contractors should preserve original electronic logs, controller data, alarm histories, service reports, laboratory submissions, invoices, emails, photographs, and access records from before and during the outbreak.
• Independent audits of every listed tower. A post-cleaning certificate should not replace a review of whether the pre-outbreak program complied with law and controlled risk.
• A real-time public cooling-tower dashboard. Registration, test dates, violation status, corrective actions, and outbreak-related findings should be searchable without specialized record requests.
• Automatic escalation for missing data. A missed Legionella result, expired certification, unregistered tower, or overdue corrective action should trigger rapid inspection and meaningful enforcement.
• Penalties proportionate to the operator. Fines should be large enough that compliance is always cheaper than delay, especially for repeat offenders and large institutions.
• Accountability across the contracting chain. Owners, managers, water-treatment companies, engineers, laboratories, and maintenance contractors should each be answerable for the work they controlled.
• Public after-action reports. When the investigation ends, the city should publish what went wrong, which systems contained viable outbreak strains, what violations or control failures were found, and what changes will prevent recurrence.

Questions every listed owner and operator should be prepared to answer

1. Was the cooling tower registered and accurately described in the city system before the outbreak?
2. Was the maintenance program truly site-specific, current, and annually certified by a qualified person?
3. Were all monthly Legionella cultures collected on time and submitted to the city?
4. Did weekly inspections identify biofilm, sediment, scaling, corrosion, low chemical supply, equipment problems, or stagnant zones?
5. Were disinfectant residuals maintained throughout operation, and do controller data support the written logs?
6. Were prior positive cultures or elevated biological indicators followed by timely corrective action and retesting?
7. Was the annual summertime hyperhalogenation completed properly, documented, and followed by required culture testing?
8. Did the owner audit its water-treatment contractor, or simply accept service reports without verification?
9. Were drift eliminators, fill material, basins, sumps, nozzles, and low-flow components physically inspected and cleaned?
10. What changed between the last “compliant” certification and the emergency cleaning ordered during this outbreak?

These are the kinds of questions our Legionnaires’ disease legal team examines when determining who controlled a contaminated water system, what prevention measures were required, and whether failures contributed to illness.

What the address list means for people who became sick

People who developed pneumonia after living, working, or spending time in Carnegie Hill or Yorkville should not wait for the city to announce a final source before preserving evidence. The relevant exposure period generally precedes symptom onset, and the investigation can change as new cases, culture results, and patient interviews are added.

Seek medical care promptly and tell the provider about the Upper East Side outbreak. Ask whether both urinary antigen testing and a respiratory culture are appropriate. Our Legionnaires’ disease symptoms and diagnosis resource explains common symptoms and testing issues.

Write down every place you lived, worked, visited, exercised, shopped, received care, attended school, or spent substantial time during the two weeks before symptoms. Save calendars, receipts, transit records, delivery records, work schedules, phone location history, photographs, and names of witnesses. See what to do after contracting Legionnaires’ disease and the five steps our lawyers use to prove a Legionnaires’ disease case.

A preliminary positive address is not enough to prove a lawsuit. A final government source announcement is not always required before an independent investigation begins. Medical evidence, exposure history, epidemiology, wind and plume analysis, environmental testing, maintenance records, and evidence of regulatory noncompliance can all become important.

Property owners and contractors have immediate access to records that victims may need months later. Early legal action can help preserve those records and identify applicable deadlines, including shorter notice requirements that may apply to government entities. Learn more about Legionnaires’ disease lawsuits and compensation or contact Pritzker Hageman for a free consultation. Our national Legionnaires’ disease team handles serious illness and wrongful-death cases across the United States.

Contact the Pritzker Hageman Legionnaires’ legal team and find out how you can get compensation and justice

1-888-377-8900 (Toll-Free) | [email protected]

Name *

Phone

Email *

What Happened? *

We are not paid unless you win. Submitting this form does not create an attorney-client relationship.

Location

Comment

Submit Form

The broader lesson: prevention cannot begin after the ambulance arrives

New York deserves credit for testing every known cooling tower in the investigation zone, ordering rapid cleaning based on PCR screening, and finally publishing the addresses. Those actions may reduce additional exposure and provide the public with information it should have had earlier.

But emergency response is not the same as prevention. The purpose of a water management program, routine testing, inspections, corrective actions, registration, recordkeeping, and enforcement is to control Legionella before a cluster of pneumonia cases exposes the failure.

The Upper East Side findings should end any comfortable assumption that detailed regulations automatically produce safe towers. Rules matter only when owners follow them, contractors perform competent work, records reflect reality, inspectors verify performance, violations are corrected, and penalties are large enough to deter neglect.

If the final investigation identifies a specific source, the responsible parties should be held accountable. If it identifies several sources or a broader pattern of unsafe tower conditions, the response must be broader still. New Yorkers should not have to wait for another deadly outbreak to find out whether the city’s cooling-tower safety system works.

Frequently asked questions about NYC’s PCR-positive cooling-tower findings

Key sources and supporting resources

• NYC Health Department: Upper East Side Legionnaires’ disease cluster updates
• NYC Health Department: July 14 PCR-positive cooling-tower address list
• New York City Health Code Chapter 8: Cooling Towers
• New York State Subpart 4-1: Cooling Towers
• CDC: Controlling Legionella in Cooling Towers
• CDC: Legionella control toolkits and water management programs
• NYC Health Department: Second death, 72 cases, remediation completion, testing status, and enforcement data
• Associated Press: Second death reported in the Upper East Side Legionnaires’ disease outbreak
• Associated Press: Confirmed sources of the 2025 Central Harlem outbreak
• Pritzker Hageman: Current New York Legionnaires’ disease outbreaks and address directory

Awards & Recognition:

The Pritzker Hageman law firm and our attorneys have been recognized in:

U.S. News & World Report

Pritzker Hageman has been recognized as one of the best law firms for personal injury litigation by U.S. News & World Report every year the award has been given since 2012.

Super Lawyers®, Thomson Reuters

Attorneys at Pritzker Hageman have been awarded the peer selected Super Lawyers distinction every year since 2004.

America’s Top 100 Attorneys®

Lifetime Achievement selection to America’s Top 100 Attorneys®.

Three Time Attorneys of the Year

Pritzker Hageman lawyers have been named Attorneys Of The Year by Minnesota Lawyer three times.