Cryptosporidium and Your CCR

Cryptosporidium is a microscopic parasite that can survive standard chlorine disinfection, which is why federal law requires surface-water systems to achieve specific log-removal and inactivation targets rather than simply monitor against a concentration limit. When a system fails to meet those treatment targets, the Consumer Confidence Report must carry a specific health-effects statement — and immunocompromised customers need to know it.

What Cryptosporidium is

Cryptosporidium is a protozoan parasite that infects the gastrointestinal tract. It spreads through the fecal-oral route, primarily via contaminated water. Its defining trait for drinking-water regulators is its oocyst shell: a tough protective wall that makes Cryptosporidium highly resistant to chlorine and chloramine disinfection at doses used in municipal treatment. Ultraviolet light and ozone are effective at inactivating oocysts; conventional chlorination alone is not.

Because no safe exposure level has been established, the Maximum Contaminant Level Goal (MCLG) is zero — a statutory zero meaning no level of exposure is considered without risk. That zero cannot be made into an enforceable MCL in the conventional sense, because low-level oocyst monitoring in finished water is not always analytically feasible at treatment-relevant concentrations. Congress addressed this by authorizing EPA to regulate Cryptosporidium through a treatment technique instead.

Where it comes from in drinking water

Cryptosporidium oocysts enter source water through three primary pathways:

Agricultural runoff. Cattle and other livestock are major reservoirs. Manure from dairy and beef operations washed into watersheds is the most consistently documented contamination source in U.S. surface waters.
Wildlife. Deer, birds, and other wild animals also shed oocysts. Undeveloped watersheds are not inherently safe; wildlife pressure is present in most surface-water catchments.
Human sewage. Wastewater treatment plant effluent and combined sewer overflows contribute oocysts when treatment or containment fails. The 1993 Milwaukee outbreak — the largest documented waterborne disease outbreak in U.S. history, with over 400,000 people infected — traced to source-water contamination from upstream agricultural and sewage sources.

Cryptosporidium is a surface-water and groundwater-under-the-direct-influence-of-surface-water (GWUDI) concern. Groundwater systems that draw from confined aquifers with no surface-water hydraulic connection are not subject to LT2 ESWTR Cryptosporidium requirements.

Health effects

The following language is required by 40 CFR § 141.154(a) and must appear in every Consumer Confidence Report:

"Some people may be more vulnerable to contaminants in drinking water than the general population. Immuno-compromised persons such as persons with cancer undergoing chemotherapy, persons who have undergone organ transplants, people with HIV/AIDS or other immune system disorders, some elderly, and infants can be particularly at risk from infections. These people should seek advice about drinking water from their health care providers. EPA/CDC guidelines on appropriate means to lessen the risk of infection by Cryptosporidium and other microbial contaminants are available from the Safe Drinking Water Hotline (800-426-4791) or on EPA's website epa.gov/safewater."

This boilerplate appears in every CCR regardless of whether the system has detected Cryptosporidium. It is unconditional.

A separate, conditional statement applies when a system has failed to meet filtration or disinfection requirements. Under 40 CFR § 141.153(f)(2), the CCR must then include: "Inadequately treated water may contain disease-causing organisms. These organisms include bacteria, viruses, and parasites which can cause symptoms such as nausea, cramps, diarrhea, and associated headaches."

Additionally, 40 CFR § 141.153(e)(1) requires that if a system has performed Cryptosporidium monitoring and results indicate it may be present in source or finished water, the report must include a summary of those monitoring results and an explanation of their significance.

How it's regulated: TT not MCL, and why

EPA regulates Cryptosporidium under a treatment technique standard — not a maximum contaminant level. The distinction matters for how utilities report and how consumers read the CCR table.

An MCL is a numeric concentration limit in finished water. An MCL violation occurs when the measured level exceeds the limit. A treatment technique, by contrast, specifies a process requirement. Violation occurs when the system fails to meet the required performance standard — not when a specific concentration is detected.

EPA chose the TT model for Cryptosporidium for three reasons:

Analytical limits. Detecting oocysts at the low concentrations that pose a treatment risk requires labor-intensive methods (EPA Method 1623) that are impractical for continuous finished-water monitoring. A concentration-based MCL would be unenforceable in practice.
Dose-response at zero. No threshold of safe exposure has been established. The MCLG is zero. Setting an enforceable MCL at zero would require zero detections in finished water — a standard that existing treatment cannot guarantee and that monitoring methods cannot reliably verify.
Log-removal is the right metric. Treatment plants remove and inactivate pathogens by orders of magnitude. Measuring treatment performance as log-removal credit is more meaningful and verifiable than measuring finished-water concentrations that may be below detection limits whether treatment works or not.

The statutory chain is: SDWA 1996 (Pub. L. 104-182) authorized TT-based microbial regulation → AWIA 2018 (Pub. L. 115-270) directed EPA to revise the CCR rule → the resulting CCR Rule Revisions (89 FR 46013, May 24, 2024) govern how treatment technique violations are disclosed.

LT2 ESWTR: bin classification and additional treatment

The Long Term 2 Enhanced Surface Water Treatment Rule (LT2 ESWTR) was finalized on January 5, 2006 (71 FR 654) and is codified at 40 CFR Part 141 Subparts T and U (§§ 141.700–141.722). It applies to all public water systems that use surface water or GWUDI sources.

The LT2 rule uses a bin classification system to calibrate how much additional Cryptosporidium treatment each system must achieve, based on measured source-water contamination levels.

Source-water monitoring

Before bin assignment, systems must complete at least 24 months of source-water monitoring. Large systems (serving ≥ 10,000) monitor for Cryptosporidium directly. Smaller systems are permitted to monitor E. coli as a surrogate, with Cryptosporidium monitoring required only if E. coli levels exceed a trigger threshold.

Bin assignments and additional treatment requirements

| Bin | Mean source-water Cryptosporidium (oocysts/L) | Additional treatment required | |-----|----------------------------------------------|-------------------------------| | Bin 1 | < 0.075 | No additional treatment beyond existing Subpart H/P baseline | | Bin 2 | 0.075 to < 1.0 | 1.0-log additional inactivation/removal | | Bin 3 | 1.0 to < 3.0 | 2.0-log additional | | Bin 4 | ≥ 3.0 | 2.5-log additional |

Filtered systems classified in Bins 2–4 must achieve the specified additional treatment using approved "microbial toolbox" options under 40 CFR § 141.715 — these include UV disinfection, ozone, chlorine dioxide, bag/cartridge filters, membrane filtration, and watershed control programs, among others. Unfiltered systems face more stringent baseline requirements plus additional log-removal credits based on source-water Cryptosporidium means under 40 CFR § 141.712.

The additional treatment requirement is layered on top of the existing log-removal baseline already required by the Surface Water Treatment Rule (SWTR) and Interim Enhanced Surface Water Treatment Rule (IESWTR). A Bin 1 system already meets the combined baseline and needs no additional steps. A Bin 4 system must add 2.5 log beyond the baseline.

For reference on how this interacts with disinfection byproducts: increasing disinfection dose to address microbial risk tends to increase formation of trihalomethanes (TTHM) and haloacetic acids (HAA5). The LT2 ESWTR's toolbox model specifically provides options like UV and ozone that achieve Cryptosporidium inactivation without the chlorine-addition that drives DBP formation, giving utilities a path that balances both risks.

What utilities must monitor and disclose on the CCR

Monitoring: Systems covered by LT2 must complete initial two-year source-water monitoring to determine bin assignment. The first monitoring cycle began on dates staggered by system size between 2007 and 2010. A second monitoring cycle (to reassess bin placement) was required starting approximately 6 years after the first cycle's completion. Systems that trigger higher bin classification through the second cycle must achieve the additional treatment for that bin.

CCR disclosures required:

Universal boilerplate (§ 141.154(a)). Every CCR must include the vulnerable-populations statement quoted above. This is unconditional and appears regardless of Cryptosporidium levels or treatment status.
Monitoring results (§ 141.153(e)(1)). If the system has conducted Cryptosporidium source-water or finished-water monitoring and results indicate the parasite may be present, the CCR must summarize those results and explain their significance.
Treatment technique violation (§ 141.153(d)(4), (f)(2)). If the system fails to meet the LT2-required additional treatment or any filtration/disinfection treatment technique requirement, the CCR must explain: the violation, its duration, the potential adverse health effects, actions taken to address it, and the expected completion timeframe. The "inadequately treated water" language from § 141.153(f)(2) is required as part of that health-effects explanation.
Turbidity and filtration performance (§ 141.153(c)(4)). Surface-water systems must report turbidity data. Turbidity is the indicator metric that EPA uses as a proxy for filtration effectiveness, and hence for Cryptosporidium removal efficiency. High turbidity in finished water signals filtration impairment.

The CCR must describe Cryptosporidium in the regulated-contaminant table as a treatment technique regulated contaminant with MCLG = 0 and TT (not MCL) as the regulatory approach. See 40 CFR §§ 141.700–141.722 and Appendix A to Subpart O of Part 141 for the contaminant table entries.

What consumers can do (immunocompromised population specifically)

For most healthy adults, Cryptosporidium infection from treated municipal water that meets LT2 ESWTR requirements presents low but nonzero risk. Illness is typically self-limiting: watery diarrhea lasting one to two weeks.

For immunocompromised individuals, the calculus is different. Cryptosporidiosis can be severe, prolonged, or life-threatening in people with AIDS, organ transplant recipients on immunosuppressants, and patients receiving chemotherapy. This population is the reason § 141.154(a) boilerplate is unconditional — every CCR carries the advisory regardless of system performance.

Practical steps for immunocompromised individuals when their utility's CCR shows a treatment technique violation, elevated Cryptosporidium source-water levels, or turbidity exceedances:

Use a certified filter. NSF/ANSI Standard 53 or 58 certified point-of-use filters labeled for cyst removal (typically 1-micron absolute) physically remove oocysts. Boiling (1 minute at a rolling boil; 3 minutes above 6,500 feet elevation) also inactivates oocysts.
Consult your healthcare provider. The boilerplate language directs immunocompromised individuals here for individual risk assessment.
Use EPA/CDC guidance. The Safe Drinking Water Hotline (800-426-4791) and EPA's Safe Drinking Water resources provide current guidance on point-of-use options.
Read your CCR's turbidity table. Filtration performance is the leading operational indicator. A system that consistently meets its turbidity performance criteria under the LT2 ESWTR is providing effective Cryptosporidium removal even if oocysts are present in source water.

Even when a system is performing well — meeting all LT2 bin requirements, reporting low turbidity, achieving required log-removal — the § 141.154(a) advisory remains in the CCR. That's by design. It is not an indicator of a problem. It is a standing notice to the population that needs it most.

Last reviewed: 2026-05-03. Next scheduled review: every 6 months.