5NITED3TATES

%NVIRONMENTAL0ROTECTION

!GENCY

2ESPONSE0ROTOCOL4OOLBOX

0LANNINGFORAND2ESPONDINGTO

$RINKING7ATER#ONTAMINATION

4HREATSAND)NCIDENTS

)NTERIM&INAL
!UGUST

2ESPONSE'UIDELINES
Response Protocol Toolbox: 

Planning for and Responding to 

Drinking Water Contamination Threats and Incidents 

Response Guidelines 

Interim Final - August 2004 

Is Threat 

Threat Warning 

Is Threat 

Credible? 

Is Incident 

Confirmed? 

Site Characterization and 

Sampling 

Initial Threat Evaluation 

THREAT EVALUATION 

PROCESS 

Possible? 

PLANNING AND PREPARATION 

Immediate Operational 

Response Actions 

Public Health Response 

Actions 

Sample Analysis 

Remediation and Recovery 

EXPANDED 

RESPONSE ACTIONS 
RESPONSE GUIDELINES 

TABLE OF CONTENTS


INTRODUCTION .......................................................................................................................................................3


1 COMMUNICATIONS AND NOTIFICATIONS............................................................................................4


1.1 INITIAL NOTIFICATIONS ..............................................................................................................................4


1.2 CONTACT LIST ............................................................................................................................................5


2 THREAT EVALUATION.................................................................................................................................6


2.1 THREAT EVALUATION PROCESS ..................................................................................................................6


2.2 EVALUATING THREAT WARNINGS ..............................................................................................................7


2.3 THREAT EVALUATION WORKSHEET............................................................................................................8


2.4 SECURITY INCIDENT REPORT FORM ..........................................................................................................13


2.5 WITNESS ACCOUNT REPORT FORM...........................................................................................................16


2.6 PHONE THREAT REPORT FORM .................................................................................................................20


2.7 WRITTEN THREAT REPORT FORM .............................................................................................................23


2.8 WATER QUALITY/CONSUMER COMPLAINT REPORT FORM........................................................................26


2.9 PUBLIC HEALTH INFORMATION REPORT FORM .........................................................................................28


3 SITE CHARACTERIZATION AND SAMPLING.......................................................................................30


3.1 SITE CHARACTERIZATION PROCESS ..........................................................................................................30


3.2 EMERGENCY WATER SAMPLE COLLECTION KIT .......................................................................................31


3.3 SAMPLE CONTAINERS................................................................................................................................32


3.4 SAMPLE COLLECTION GUIDELINES ...........................................................................................................34


3.4.1 Safety Guidelines .................................................................................................................................34


3.4.2 Sampling Procedures...........................................................................................................................34


3.4.3 Sample Holding ...................................................................................................................................35


3.4.4 Sample Transport.................................................................................................................................35


3.5 SITE CHARACTERIZATION PLAN TEMPLATE..............................................................................................36


3.6 SITE CHARACTERIZATION REPORT FORM..................................................................................................40


3.7 FIELD TESTING RESULTS FORM.................................................................................................................45


3.8 SAMPLE DOCUMENTATION FORM .............................................................................................................46


3.9 CHAIN OF CUSTODY FORM........................................................................................................................47


4 SAMPLE ANALYSIS......................................................................................................................................48


4.1 LABORATORY CONTACT LIST ...................................................................................................................48


4.2 GENERAL APPROACH FOR ANALYSIS OF UNKNOWNS IN WATER ..............................................................49


4.3 GENERAL CLASSES OF CHEMICALS, ANALYTE GROUPS, AND EXAMPLE CONTAMINANTS........................50


4.4 GENERAL CLASSES OF PATHOGENS, SPECIFIC ORGANISMS, AND SELECT AGENT STATUS .......................50


5 RESPONSE ACTIONS ...................................................................................................................................51


5.1 DECISION TREE FOR CONTAINMENT OPTIONS ...........................................................................................51


5.2 DECISION TREE FOR PUBLIC NOTIFICATION ..............................................................................................52


5.3 CONTAMINANT CHARACTERIZATION AND TRANSPORT WORKSHEET........................................................53


5.4 PUBLIC HEALTH RESPONSE ACTION WORKSHEET ....................................................................................59


6 APPENDICES ..................................................................................................................................................63


6.1 CRITICAL SYSTEM INFORMATION CHECKLIST...........................................................................................63


6.2 INFORMATION RESOURCES........................................................................................................................64


6.3 THREAT MANAGEMENT MATRICES...........................................................................................................65


6.3.1 Security Breach....................................................................................................................................65


6.3.2 Witness Account...................................................................................................................................67


6.3.3 Direct Notification by Perpetrator.......................................................................................................68


6.3.4 Unusual Water Quality or Consumer Complaints ...............................................................................70


6.3.5 Notification by Public Health ..............................................................................................................72


2 Interim Final – August 2004 
RESPONSE GUIDELINES 

Introduction 

The EPA released the interim final Response Protocol Toolbox: Planning for and Responding to 

Drinking Water Contamination Threats and Incidents (the Response Protocol Toolbox) in winter 

of 2003 and spring of 2004 to help the water sector effectively and appropriately plan for and 

respond to contamination threats and incidents. Since its release, EPA has received feedback and 

suggestions from several sources concerning improvements in the Response Protocol Toolbox. 

These Response Guidelines have been developed to provide an easy to use document for field 

and crisis conditions. While the Response Protocol Toolbox provides detailed information, the 

Response Guidelines are to be viewed as the application of the same principles during an actual 

incident. 

As stated in the definition of Response Guidelines in Module 1, Section 4.3 of the Response 

Protocol Toolbox, Response Guidelines are different from an Emergency Response Plan in that 

they are essentially a “field guide” for responding to contamination threats and can be developed 

in many different formats. 

This document is intended to be an action oriented document to assist drinking water utilities, 

laboratories, emergency responders, state drinking water programs, technical assistance 

providers, and public health and law enforcement officials during the management of an ongoing 

contamination threat or incident. The Response Guidelines are derived from the content of the 

six full modules of the Response Protocol Toolbox. 

The Response Guidelines are not intended to replace the Response Protocol Toolbox and they do 

not contain the detailed information contained within the six complete modules. Finally, users 

are encouraged to adapt the Response Guidelines as necessary to meet their own needs and 

objectives. 

3 Interim Final – August 2004 
RESPONSE GUIDELINES 

1 Communications and Notifications 

1.1 Initial Notifications 

'Possible' stage evaluation by utility 'Credible' stage evaluation by utility 

li

Uni

Pl

Utility Head 

xxx-xxx-xxxx 

Information Officer 

from water utility 

xxx-xxx-xxxx 

Police, Fire, FBI 

xxx-xxx-xxxx 

Pub c Health Contact 

xxx-xxx-xxxx 

HAZMAT contact 

xxx-xxx-xxxx 

Other 

Liaison Officer 

from water utility 

xxx-xxx-xxxx 

Safety Officer 

from water utility 

xxx-xxx-xxxx 

Site Characterization 

team leader 

xxx-xxx-xxxx 

SCADA coordinator 

xxx-xxx-xxxx 

t Operator 

xxx-xxx-xxxx 

Utility Plant Manager 

xxx-xxx-xxxx 

Key Personnel 

xxx-xxx-xxxx 

Section Heads 

xxx-xxx-xxxx 

Laboratory PoC 

xxx-xxx-xxxx 

Utility Operations 

Chief 

xxx-xxx-xxxx 

WUERM 

xxx-xxx-xxxx (home) 

xxx-xxx-xxxx (cell) 

wuerm@xxx.xxx (text messenger) 

Utility Head 

xxx-xxx-xxxx 

Information Officer 

from water utility 

xxx-xxx-xxxx 

Safety Officer 

from water utility 

xxx-xxx-xxxx 

ant Manager 

xxx-xxx-xxxx 

Utility Operations 

Chief 

xxx-xxx-xxxx 

WUERM 

xxx-xxx-xxxx (home) 

xxx-xxx-xxxx (cell) 

wuerm@xxx.xxx (text messenger) 

24/7 Call Center 

xxx-xxx-xxxx 

'Confirmed' stage evaluation by unified command 'Credible' stage evaluation by unified command 

SCADA Coordinator 

xxx-xxx-xxxx 

Unit Operator 

xxx-xxx-xxxx 

Utility Plant Operator 

xxx-xxx-xxxx 

Key Personnel 

xxx-xxx-xxxx 

Section Heads 

xxx-xxx-xxxx 

Laboratory PoC 

xxx-xxx-xxxx 

Key Personnel 

xxx-xxx-xxxx 

Public Works Interface 

xxx-xxx-xxxx 

Maintenance Head 

xxx-xxx-xxxx 

EOC Staff 

xxx-xxx-xxxx 

Water Utility Emergency Operations Center (WUEOCM) 

xxx-xxx-xxxx (home) 

xxx-xxx-xxxx (cell) 

wuerm@xxx.xxx (text messenger) 

Technical Specialists 

(Water Utility) 

Agency Representative from Utility (WUERM) 

xxx-xxx-xxxx (home) 

xxx-xxx-xxxx (cell) 

wuerm@xxx.xxx (text messenger) 

SCADA Coordinator 

xxx-xxx-xxxx 

Unit Operator 

xxx-xxx-xxxx 

Utility Plant Operator 

xxx-xxx-xxxx 

Key Personnel 

xxx-xxx-xxxx 

Section Heads 

xxx-xxx-xxxx 

Laboratory PoC 

xxx-xxx-xxxx 

Technical Specialists 

(Water Utility) 

Agency Representative from Utility (WUERM) 

xxx-xxx-xxxx (home) 

xxx-xxx-xxxx (cell) 

wuerm@xxx.xxx (text messenger) 

4 Interim Final – August 2004 
RESPONSE GUIDELINES 

1.2 Contact List 

TO BE COMPLETED 

Agency Name Location Phone E-mail 

5 Interim Final – August 2004 
RESPONSE GUIDELINES 

2 Threat Evaluation 

2.1 Threat Evaluation Process 

6 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.2 Evaluating Threat Warnings 

The first critical step in evaluating a contamination threat is recognition of a threat warning (i.e., 

an unusual situation that may have presented the opportunity for contamination of the drinking 

water). The utility will likely be in the best position to observe a threat warning and evaluate 

whether or not the activity is suspicious (i.e., first decision point in the Threat Evaluation 

process). This section briefly describes factors to consider when evaluating various types of 

threat warnings. 

The common types of threat warnings include: 

x Security breaches: A security breach is an unauthorized intrusion into a secured facility 

that may be discovered through direct observation, an alarm trigger, or signs of intrusion 

(e.g., cut locks, open doors, cut fences). Security breaches may be the most common 

threat warnings, but in most cases are related to day-to-day operation and maintenance 

within the water system. Other security breaches may be due to criminal activity such as 

trespassing, vandalism, and theft rather than attempts to contaminate the water. 

o Security Incident Report Form o Section 2.4 

x Witness account: A threat warning may come from an individual who directly witnesses 

suspicious activity, such as trespassing, breaking and entering, or some other form of 

tampering. The witness could be a utility employee, law enforcement officer, citizen, etc. 

o Witness Account Report Form o Section 2.5 

x Direct notification by perpetrator: A threat may be made directly, verbally or in 

writing, to the water utility, the news media, law enforcement, or a government agency. 

Verbal threats made over the phone are historically the most common type of direct 

threats from perpetrators; however, there have also been written threats to contaminate 

the drinking water supply. 

o Phone Threat Report Form o Section 2.6 

o Written Threat Report Form o Section 2.7 

x Unusual water quality or consumer complaints: Unusual water quality results or an 

unexplained or unusually high incidence of consumer complaints may serve as a warning 

of potential contamination. In order to evaluate this type of warning, it will be necessary 

to carefully track routinely monitored water quality data and/or consumer complaints 

such that significant deviations from an established baseline might be observed. 

o Water Quality and Consumer Complaints Report Form o Section 2.8 

x Notification by public health agency: Notification from a public health agency 

regarding increased incidence of disease or death is another possible threat warning. A 

threat triggered by a public health notification is unique in that at least a segment of the 

population has presumably been exposed to a harmful substance. In this case, public 

health officials may launch an epidemiological investigation in an attempt to identify the 

source of the outbreak, during which the utility may be expected to play a support role. 

o Public Health Information Report Form o Section 2.9 

7 	 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.3 Threat Evaluation Worksheet 

INSTRUCTIONS 

The purpose of this worksheet is to help organize information about a contamination threat warning that 

would be used during the Threat Evaluation Process. The individual responsible for conducting the 

Threat Evaluation (e.g., the WUERM) should complete this worksheet. The worksheet is generic to 

accommodate information from different types of threat warnings; thus, there will likely be information that 

is unavailable or not immediately available. Other forms in the Appendices are provided to augment the 

information in this worksheet. 

THREAT WARNING INFORMATION 

Date/Time threat warning discovered: 

Utility Name and Address: 

Name/Number of person who discovered threat warning: 

Type of threat warning: 

 Security breach  Witness account  Phone threat 

 Written threat  Unusual water quality  Consumer complaints 

 Public health notification  Other 

Identity of the contaminant:  Known  Suspected  Unknown 

If known or suspected, provide additional detail below 

 Chemical  Biological  Radiological 

Describe 

Time of contamination:  Known  Estimated  Unknown 

If known or estimated, provide additional detail below 

Date and time of contamination: 

Additional Information: 

Mode of contamination:  Known  Suspected  Unknown 

If known or suspected, provide additional detail below 

Method of addition:  Single dose  Over time  Other 

Amount of material: 

Additional Information: 

8 Interim Final – August 2004 
RESPONSE GUIDELINES 

Site of contamination:  Known  Suspected  Unknown 

If known or suspected, provide additional detail below 

Number of sites: 

Provide the following information for each site. 

Site #1 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

Site #2 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

Site #3 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

9 Interim Final – August 2004 
RESPONSE GUIDELINES 

ADDITIONAL INFORMATION 

Has there been a breach of security at the suspected site?  Yes  No 

If “Yes”, review the completed ‘Security Incident Report’ (Section 2.4) 

Are there any witness accounts of the suspected incident?  Yes  No 

If “Yes”, review the completed ‘Witness Account Report’ (Section 2.5) 

Was the threat made verbally over the phone?  Yes  No 

If “Yes”, review the completed ‘Phone Threat Report’ (Section 2.6) 

Was a written threat received?  Yes  No 

If “Yes”, review the completed ‘Written Threat Report’ (Section 2.7) 

Are there unusual water quality data or consumer complaints?  Yes  No 

If “Yes”, review the completed ‘Water Quality/Consumer Complaint Report’ (Section 2.8) 

Are there unusual symptoms or disease in the population?  Yes  No 

If “Yes”, review the completed ‘Public Health Report’ (Section 2.9) 

Is a ‘Site Characterization Report’ available?  Yes  No 

If “Yes”, review the completed ‘Site Characterization Report’ (Section 3.4) 

Are results of sample analysis available?  Yes  No 

If “Yes”, review the analytical results report, including appropriate QA/QC data 

Is a ‘Contaminant Identification Report’ available?  Yes  No 

If “Yes”, review the completed ‘Sample Analysis Report’ (Section 4.3) 

Is there relevant information available from external sources?  Yes  No 

Check all that apply 

 Local law enforcement  FBI  DW primacy agency 

 Public health agency  Hospitals / 911 call centers  US EPA / Water ISAC 

 Media reports  Homeland security alerts  Neighboring utilities 

 Other 

Point of Contact: 

Summary of key information from external sources (provide detail in attachments as necessary): 

10 Interim Final – August 2004 
RESPONSE GUIDELINES 

THREAT EVALUATION 

Has normal activity been investigated as the cause of the threat warning?  Yes  No 

Normal activities to consider 

 Utility staff inspections  Routine water quality sampling 

 Construction or maintenance  Contractor activity 

 Operational changes  Water quality changes with a known cause 

 Other 

Is the threat ‘possible’?  Yes  No 

Summarize the basis for this determination: 

Response to a ‘possible’ threat: 

 None  Site characterization  Isolation/containment 

 Increased monitoring/security  Other 

Is the threat ‘credible’?  Yes  No 

Summarize the basis for this determination: 

Response to a ‘credible’ threat: 

 Sample analysis  Site characterization  Isolation/containment 

 Partial EOC activation  Public notification  Provide alternate water supply 

 Other 

Has a contamination incident been confirmed?  Yes  No 

Summarize the basis for this determination: 

Response to a confirmed incident: 

 Sample analysis  Site characterization  Isolation/containment 

 Full EOC activation  Public notification  Provide alternate water supply 

 Initiate remediation and recovery 

 Other 

11 Interim Final – August 2004 
RESPONSE GUIDELINES 

How do other organizations characterize the threat? 

Organization Evaluation Comment 

 Local Law Possible 

 Credible 

 Confirmed 

Enforcement

 FBI Possible 

 Credible 

 Confirmed 

 Public Health Possible 

 Credible 

 Confirmed 

Agency

 Drinking Water Possible 

 Credible 

 Confirmed 

Primacy Agency 

Other Possible 

 Credible 

 Confirmed 

Other Possible 

 Credible 

 Confirmed 

SIGNOFF 

Name of person completing this form: 

Print name Phone Number 

Signature Date/Time: 

12 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.4 Security Incident Report Form 

INSTRUCTIONS 

The purpose of this form is to help organize information about a security incident, typically a security 

breach, which may be related to a water contamination threat. The individual who discovered the security 

incident, such as a security supervisor, the WUERM, or another designated individual may complete this 

form. This form is intended to summarize information about a security breach that may be relevant to the 

threat evaluation process. This form should be completed for each location where a security incident was 

discovered. 

DISCOVERY OF SECURITY INCIDENT 

Date/Time security incident discovered: 

Name of person who discovered security incident: 

Mode of discovery: 

 Alarm (building)  Alarm (gate/fence)  Alarm (access hatch) 

 Video surveillance  Utility staff discovery  Citizen discovery 

 Suspect confession  Law enforcement discovery 

 Other 

Did anyone observe the security incident as it occurred?  Yes  No 

If “Yes”, complete the ‘Witness Account Report’ (Appendix 8.4) 

SITE DESCRIPTION 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

BACKGROUND INFORMATION 

Have the following “normal activities” been investigated as potential causes of the security 

incident? 

 Alarms with known and harmless causes  Utility staff inspections 

 Routine water quality sampling  Construction or maintenance 

 Contractor activity  Other 

13 Interim Final – August 2004 
RESPONSE GUIDELINES 

Was this site recently visited prior to the security incident?  Yes  No 

If “Yes,” provide additional detail below 

Date and time of previous visit: 

Name of individual who visited the site: 

Additional Information: 

Has this location been the site of previous security incidents?  Yes  No 

If “Yes,” provide additional detail below 

Date and time of most recent security incident: 

Description of incident: 

What were the results of the threat evaluation for this incident? 


 ‘Possible’  ‘Credible’  ‘Confirmed’ 


Have security incidents occurred at other locations recently?  Yes  No 

If “Yes”, complete additional ‘Security Incident Reports’ (Appendix 8.3) for each site 

Name of 1st additional site: 

nd Name of 2 additional site: 

rd Name of 3 additional site: 

SECURITY INCIDENT DETAILS 

Was there an alarm(s) associated with the security incident?  Yes  No 

If “Yes,” provide additional detail below 

Are there sequential alarms (e.g., alarm on a gate and a hatch)?  Yes  No


Date and time of alarm(s): 


Describe alarm(s): 


Is video surveillance available from the site of the security incident?  Yes  No 

If “Yes,” provide additional detail below 

Date and time of video surveillance: 

Describe surveillance: 

14 Interim Final – August 2004 
RESPONSE GUIDELINES 

Unusual equipment found at the site and time of discovery of the security incident: 

 Discarded PPE (e.g., gloves, masks)  Empty containers (e.g., bottles, drums) 

 Tools (e.g., wrenches, bolt cutters)  Hardware (e.g., valves, pipe) 

 Lab equipment (e.g., beakers, tubing)  Pumps or hoses 

 None  Other 

Describe equipment: 

Unusual vehicles found at the site and time of discovery of the security incident: 

 Car/sedan  SUV  Pickup truck 

 Flatbed truck  Construction vehicle  None 

 Other 

Describe vehicles (including make/model/year/color, license plate #, and logos or markings): 

Signs of tampering at the site and time of discovery of the security incident: 

 Cut locks/fences  Open/damaged gates, doors, or windows 

 Open/damaged access hatches  Missing/damaged equipment 

 Facility in disarray  None 

 Other 

Are there signs of sequential intrusion (e.g., locks removed from a gate and hatch)?  Yes 

 No 

Describe signs of tampering: 

Signs of hazard at the site and time of discovery of the security incident: 

 Unexplained or unusual odors  Unexplained dead animals 

 Unexplained dead or stressed vegetation  Unexplained liquids 

 Unexplained clouds or vapors  None 

 Other 

Describe signs of hazard: 

SIGNOFF 

Name of person responsible for documenting the security incident: 

Print name 

Signature Date/Time: 

15 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.5 Witness Account Report Form 

INSTRUCTIONS 

The purpose of this form is to document the observations of a witness to activities that might be 

considered an incident warning. The individual interviewing the witness, or potentially the witness, should 

complete this form. This may be the WUERM or an individual designated by incident command to 

perform the interview. If law enforcement is conducting the interview (which may often be the case), then 

this form may serve as a prompt for “utility relevant information” that should be pursued during the 

interview. This form is intended to consolidate the details of the witness account that may be relevant to 

the threat evaluation process. This form should be completed for each witness that is interviewed. 

BASIC INFORMATION 

Date/Time of interview: 

Name of person interviewing the witness: 

Witness contact information 

Full Name: 

Address: 

Day-time phone: 

Evening phone: 

E-mail address: 

Reason the witness was in the vicinity of the suspicious activity: 

WITNESS ACCOUNT 

Date/Time of activity: 

Location of activity: 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

16 Interim Final – August 2004 
RESPONSE GUIDELINES 

Type of activity 

 Trespassing  Vandalism  Breaking and entering 

 Theft  Tampering  Surveillance 

 Other 

Additional description of the activity 

Description of suspects 

Were suspects present at the site?  Yes  No 


How many suspects were present? 


Describe each suspect’s appearance: 


Suspect # Sex Race Hair color Clothing Voice 

1 

2 

3 

4 

5 

6 

Where any of the suspects wearing uniforms?  Yes  No 

If “Yes,” describe the uniform(s): 

Describe any other unusual characteristics of the suspects: 

Did any of the suspects notice the witness?  Yes  No 

If “Yes,” how did they respond: 

Vehicles at the site 

Were vehicles present at the site?  Yes  No 

Did the vehicles appear to belong to the suspects?  Yes  No 

How many vehicles were present? 

17 Interim Final – August 2004 
1

2

3

4

5

6

RESPONSE GUIDELINES 

Describe each vehicle: 

Vehicle # Type Color Make Model License plate 

Where there any logos or distinguishing markings on the vehicles?  Yes  No 

If “Yes,” describe: 

Provide any additional detail about the vehicles and how they were used (if at all): 

Equipment at the site 

Was any unusual equipment present at the site?  Yes  No 

 Explosive or incendiary devices 


 PPE (e.g., gloves, masks) 


 Tools (e.g., wrenches, bolt cutters) 


 Lab equipment (e.g., beakers, tubing) 


 Other 


 Firearms 


 Containers (e.g., bottles, drums) 


 Hardware (e.g., valves, pipe, hoses) 


 Pumps and related equipment 


Describe the equipment and how it was being used by the suspects (if at all): 

Unusual conditions at the site 

Were there any unusual conditions at the site?  Yes  No 

 Explosions or fires  Fogs or vapors  Unusual odors 

 Dead/stressed vegetation  Dead animals  Unusual noises 

 Other 

Describe the site conditions: 

18 Interim Final – August 2004 
RESPONSE GUIDELINES 

Additional observations 

Describe any additional details from the witness account: 

SIGNOFF 

Name of interviewer: 

Print name 

Signature 

Name of witness: 

Date/Time: 

Print name 

Signature Date/Time: 

19 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.6 Phone Threat Report Form 

INSTRUCTIONS 

This form is intended to be used by utility staff that regularly answer phone calls from the public (e.g., call 

center operators). The purpose of this form is to help these staff capturer as much information from a 

threatening phone call while the caller is on the line. It is important that the operator keep the caller on 

the line as long as possible in order to collect additional information. Since this form will be used during 

the call, it is important that operators become familiar with the content of the form. The sections of the 

form are organized with the information that should be collected during the call at the front of the form 

(i.e., Basic Call Information and Details of Threat) and information that can be completed immediately 

following the call at the end of the form (i.e., the description of the caller). The information collected on 

this form will be critical to the threat evaluation process. 

Remember, tampering with a drinking water system is a crime under the SDWA Amendments! 

THREAT NOTIFICATION 

Name of person receiving the call: 

Date phone call received: Time phone call received: 

Time phone call ended: Duration of phone call: 

Originating number: Originating name: 

If the number/name is not displayed on the caller ID, press *57 (or call trace) at the end of the 

call and inform law enforcement that the phone company may have trace information. 

Is the connection clear?  Yes  No 

Could call be from a wireless phone?  Yes  No 

DETAILS OF THREAT 

Has the water already been contaminated?  Yes  No 

Date and time of contaminant introduction known?  Yes  No 

Date and time if known: 

Location of contaminant introduction known?  Yes  No 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

20 Interim Final – August 2004 
RESPONSE GUIDELINES 

Name or type of contaminant known?  Yes  No 

Type of contaminant 

 Chemical  Biological  Radiological 

Specific contaminant name/description: 

Mode of contaminant introduction known?  Yes  No 

Method of addition:  Single dose  Over time  Other 

Amount of material: 

Additional Information: 

Motive for contamination known?  Yes  No 

 Retaliation/revenge  Political cause  Religious doctrine 

 Other 

Describe motivation: 

CALLER INFORMATION 

Basic Information: 

Stated name: 

Affiliation: 

Phone number: 

Location/address: 

Caller’s Voice: 

Did the voice sound disguised or altered?  Yes  No 

Did the call sound like a recording?  Yes  No 

Did the voice sound?  Male /  Female  Young /  Old 

Did the voice sound familiar?  Yes  No 

If ‘Yes,’ who did it sound like? 

Did the caller have an accent?  Yes  No 

If ‘Yes,’ what nationality? 

How did the caller sound or speak? 

 Educated  Well spoken  Illiterate 

 Irrational  Obscene  Incoherent 

 Reading a script  Other 

21 Interim Final – August 2004 
RESPONSE GUIDELINES 

What was the caller’s tone of voice? 

 Calm  Angry  Lisping  Stuttering/broken 

 Excited  Nervous  Sincere  Insincere 

 Slow  Rapid  Normal  Slurred 

 Soft  Loud  Nasal  Clearing throat 

 Laughing  Crying  Clear  Deep breathing 

 Deep  High  Raspy  Cracking 

 Other 

Were there background noises coming from the caller’s end? 

 Silence 

 Voices describe 

 Children describe 

 Animals describe 

 Factory sounds describe 

 Office sounds describe 

 Music describe 

 Traffic/street sounds describe 

 Airplanes describe 

 Trains describe 

 Ships or large boats describe 

 Other: 

SIGNOFF 

Name of call recipient: 

Print name 

Signature 

Name of person completing form (if different from call recipient): 

Print name 

Date/Time: 

Signature Date/Time: 

22 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.7 Written Threat Report Form 

INSTRUCTIONS 

The purpose of this form is to summarize significant information from a written threat received by a 

drinking water utility. This form should be completed by the WUERM or an individual designated by 

incident command to evaluate the written threat. The summary information provided in this form is 

intended to support the threat evaluation process; however, the completed form is not a substitute for the 

complete written threat, which may contain additional, significant details. 

The written threat itself (e.g., the note, letter, e-mail message, etc.) may be considered evidence and thus 

should be minimally handled (or not handled at all) and placed into a clean plastic bag to preserve any 

forensic evidence. 

Remember, tampering with a drinking water system is a crime under the SDWA Amendments! 

SAFETY 

A suspicious letter or package could pose a threat in and of itself, so caution should be exercised if such 

packages are received. The US Postal Service has issued guidance when dealing with suspicious 

packages (http://www.usps.com/news/2001/press/pr01_1022gsa.htm). 

THREAT NOTIFICATION 

Name of person receiving the written threat: 

Person(s) to whom threat was addressed: 

Date threat received: Time threat received: 

How was the written threat received? 

 US Postal service  Delivery service  Courier 

 Fax  E-mail  Hand delivered 

 Other 

If mailed, is the return address listed?  Yes  No 

If mailed, what is the date and location of the postmark? 

If delivered, what was the service used (list any tracking numbers)? 

If Faxed, what is the number of the sending fax? 

If E-mailed, what is the e-mail address of sender? 

If hand-delivered, who delivered the message? 

23 Interim Final – August 2004 
RESPONSE GUIDELINES 

DETAILS OF THREAT 

Has the water already been contaminated?  Yes  No 

Date and time of contaminant introduction known?  Yes  No 

Date and time if known: 

Location of contaminant introduction known?  Yes  No 

Site Name: 

Type of facility 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

Name or type of contaminant known?  Yes  No 

Type of contaminant 

 Chemical  Biological  Radiological 

Specific contaminant name/description: 

Mode of contaminant introduction known?  Yes  No 

Method of addition:  Single dose  Over time  Other 

Amount of material: 

Additional Information: 

Motive for contamination known?  Yes  No 

 Retaliation/revenge  Political cause  Religious doctrine 

 Other 

Describe motivation: 

NOTE CHARACTERISITCS 

Perpetrator Information: 

Stated name: 

Affiliation: 

Phone number: 

Location/address: 

24 Interim Final – August 2004 
RESPONSE GUIDELINES 

Condition of paper/envelop: 

 Marked personal  Marked confidential  Properly addressed 

 Neatly typed or written  Clean  Corrected or marked-up 

 Crumpled or wadded up  Soiled/stained  Torn/tattered 

 Other: 

How was the note prepared? 

 Handwritten in print  Handwritten in script  Computer typed 


 Machine typed  Spliced (e.g., from other typed material) 


 Other: 


If handwritten, does writing look familiar?  Yes  No 

Language: 

 Clear English  Poor English 

 Another language: 

 Mixed languages: 

Writing Style 

 Educated  Proper grammar  Logical 

 Uneducated  Poor grammar/spelling  Incoherent 

 Use of slang  Obscene 

 Other: 

Writing Tone 

 Clear  Direct  Sincere 

 Condescending  Accusatory  Angry 

 Agitated  Nervous  Irrational 

 Other: 

SIGNOFF 

Name of individual who received the threat: 

Print name 

Signature Date/Time: 

Name of person completing form (if different from written threat recipient): 

Print name 

Signature Date/Time: 

25 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.8 Water Quality/Consumer Complaint Report Form 

INSTRUCTIONS 

This form is provided to guide the individual responsible for evaluating unusual water quality data or 

consumer complaints. It is designed to prompt the analyst to consider various factors or information 

when evaluating the unusual data. The actual data used in this analysis should be compiled separately 

and appended to this form. The form can be used to support the threat evaluation due to a threat warning 

from unusual water quality or consumer complaints, or another type of threat warning in which water 

quality data or consumer complaints are used to support the evaluation. 

Note that in this form, water quality refers to both specific water quality parameters and the general 

aesthetic characteristics of the water that might result in consumer complaints. 

Threat warning is based on:  Water quality  Consumer complaints  Other 

What is the water quality parameter or complaint under consideration? 

Are unusual consumer complaints corroborated by unusual water quality data? 

Is the unusual water quality indicative of a particular contaminant of concern? For example, is the 

color, order, or taste associated with a particular contaminant? 

Are consumers in the affected area experiencing any unusual health symptoms? 

What is ‘typical’ for consumer complaints for the current season and water quality? 

Number of complaints. 


Nature of complaints. 


Clustering of complaints


What is considered to be ‘normal’ water quality (i.e., what is the baseline water quality data or 

level of consumer complaints)? 

What is reliability of the method or instrumentation used for the water quality analysis? 

Are standards and reagents OK? 


Is the method/instrument functioning properly?


Based on recent data, does the unusual water quality appear to be part of a gradual trend (i.e., 

occurring over several days or longer)? 

Are the unusual water quality observations sporadic over a wide area, or are they clustered in a 

particular area? 

What is the extent of the area? A pressure zone. A neighborhood. A city block. A street. A 

building. 

26 Interim Final – August 2004 
RESPONSE GUIDELINES 

If the unusual condition isolated to a specific area: 

Is this area being supplied by a particular plant or source water? 


Have there been any operational changes at the plant or in the affected area of the system? 


Has there been any flushing or distribution system maintenance in the affected area? 


Has there been any repair or construction in the area that could impact water quality?


SIGNOFF 

Name of person completing form: 

Print name 

Signature Date/Time: 

27 Interim Final – August 2004 
RESPONSE GUIDELINES 

2.9 Public Health Information Report Form 

INSTRUCTIONS 

The purpose of this form is to summarize significant information about a public health episode that could 

be linked to contaminated water. This form should be completed by the WUERM or an individual 

designated by incident command. The information compiled in this form is intended to support the threat 

evaluation process. 

In the case of a threat warning due to a report from public health, it is likely that the public health agency 

will assume incident command during the investigation. The drinking water utility will likely play a support 

role during the investigation, specifically to help determine whether or not water might be the cause. 

PUBLIC HEALTH NOTIFICATION 

Date and Time of notification: 

Name of person who received the notification: 

Contact information for individual providing the notification 

Full Name: 

Title: 

Organization: 

Address: 

Day-time phone: 

Evening phone: 

Fax Number: 

E-mail address: 

Why is this person contacting the drinking water utility? 

Has the state or local public health agency been notified?  Yes  No 

If “No,” the appropriate public health official should be immediately notified. 

DESCRIPTION OF PUBLIC HEALTH EPISODE 

Nature of public health episode: 

 Unusual disease (mild)  Unusual disease (severe)  Death 

 Other: 

Symptoms: 

 Diarrhea  Vomiting/nausea  Flu-like symptoms 

 Fever  Headache  Breathing difficulty 

 Other: 

Describe symptoms: 

Causative Agent:  Known  Suspected  Unknown 

If known or suspected, provide additional detail below 

 Chemical  Biological  Radiological 

Describe 

Estimate of time between exposure and onset of symptoms: 

28 Interim Final – August 2004 
RESPONSE GUIDELINES 

Exposed Individuals: 

Location where exposure is thought to have occurred 

 Residence  Work  School 

 Restaurant  Shopping mall  Social gathering 

 Other: 

Additional notes on location of exposure: 

Collect addresses for specific locations where exposure is thought to have occurred. 

Is the pattern of exposure clustered in a specific area?  Yes  No 

Extent of area 

 Single building  Complex (several buildings)  City block 

 Neighborhood  Cluster of neighborhoods  Large section of city 

 Other: 

Additional notes on extent of area: 

Do the exposed individuals represent a disproportionate number of: 

 Immune compromised  Elderly  Children 

 Infants  Pregnant women  Women 

 Other: 

 None, no specific groups dominate the makeup of exposed individuals 

EVALUATION OF LINK TO WATER 

Are the symptoms consistent with typical waterborne diseases, such as gastrointestinal 

disease, vomiting, or diarrhea?  Yes  No 

Does the area of exposure coincide with a specific area of the system, such as a pressure 

zone or area feed by a specific plant?  Yes  No 

Were there any consumer complaints within the affected area?  Yes  No 

Were there any unusual water quality data within the affected area?  Yes  No 

Were there any process upsets or operational changes?  Yes  No 

Was there any construction/maintenance within the affected area?  Yes  No 

Were there any security incidents within the affected area?  Yes  No 

SIGNOFF 

Name of person completing form: 

Print name 

Signature Date/Time: 

29 Interim Final – August 2004 
RESPONSE GUIDELINES 

3 Site Characterization and Sampling 

3.1 Site Characterization Process 

30 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.2 Emergency Water Sample Collection Kit 

Item Quantity Notes 

Field Resources and Documentation 

Field guide 2 Resource for field personnel 

Health and safety plan 2 If required for the site 

Sample labels 48 Waterproof (filled out in advance, if possible) 

Sample documentation forms 24 For recording sample information 

Custody tape (or seals) 2 rolls Used on sample or shipping containers 

Chain of custody forms 24 For documenting sample custody 

Lab marker 2 Waterproof, 1 red, 1 black 

General Sampling Supplies 

Sample containers Table 3-2 For collecting samples 

Device for grab sampling 1 For sampling large water bodies 

10 liter HDPE container 4 For collection of large volume water samples 

Lab grade tape 3 rolls For temporary labeling in the field 

Miscellaneous glassware N/A Beakers, graduated cylinders, spatula, etc. 

Collapsible cooler 1 For sample storage 

Rigid shipping container 1 For shipping by overnight service if needed. 

1 qt. zippered freezer bags 1 pack100 For double bagging ice and sample containers 

Thermometer 2 For checking water temperature 

Paper towels 2 rolls Wiping wet containers and containing spills 

Pathogen Sampling Supplies 

Tubing and clamp 1 For sample tap flushing, etc. 

Stopwatch & graduated cylinder 1 For measuring flow rate 

Ultrafiltration apparatus 1 For concentrating pathogen samples 

Reagents (may need to be kept separate from the rest of the kit) 

Laboratory grade water 5 liters For sample dilution in the field 

Sodium thiosulfate crystals 100 grams For water sample dechlorination 

Ascorbic acid 100 grams For water sample dechlorination 

Sodium sulfite crystals 100 grams For water sample dechlorination 

Potassium dihydrogen citrate 100 grams For carbamate preservation 

6 Molar ACS grade hydrochloric 

acid (HCl) 

25 mL In dropper bottle for preservation of samples for 

organic analyses 

6 Molar trace metal-grade nitric 

acid (HNO3) 

25 mL In dropper bottle for preservation of samples for 

trace metals analysis 

10 Normal Sodium hydroxide 

(NaOH) 

25 mL In dropper bottle for preservation of samples for 

cyanide analyses 

pH paper in ranges from 0 - 4 and 

10 - 14 

50 strips For checking the pH of samples preserved with 

acid or base (sensitive to 0.5 pH units) 

Safety Supplies 

Splash resistant goggles 2 One per individual (minimum) 

Disposable gloves 6 pairs Nitrile or polyethylene, powder-free 

Disposable shoe covers 2 pairs One pair per individual (minimum) 

Disposable laboratory coats 2 One per individual (minimum) 

Clear, heavy duty plastic trash bags 4 For disposal of lab coat, gloves, etc. 

Rinse water 20 liters For general use and first aid 

Antiseptic wipes 1 container For cleaning hands, sample containers, etc. 

Bleach solution (at least 5%) 1 gallon For decontamination if necessary 

Squirt bottle 2 For use with rinse water or lab grade water 

First aid kit 1 For general first aid 

Flashlight/headlamp 3 For working at night or in dark locations 

31 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.3 Sample Containers Sample Type Container 

Size 

Container Type 

No. Dechlorinating 

Agent 

Preservative Analytical 

Technique 

Reference Methods 

CHEMISTRY - BASIC SCREEN (Established Techniques) Organic Analytes Volatiles 40 mL Glass w / Teflon 

faced septa 

5 Ascorbic acid 1:1 HCl to pH < 2 

See method. 

P&T – GC/MS EPA 524.2, 

8260B 

P&T – GC/PID/ELCD 

EPA 502.2, 8021B 

Semi-volatiles 1 L Amber w / 

Teflon-lined screw caps 

4 Sodium sulfite 6M HCl. See 

method. 

SPE GC/MS 525.2, 

8270D/3535 

Quarternary nitrogen compounds 

1 L Amber PVC or 

silanized glass 

4 Sodium 

thiosulfate 

Sulfuric acid to pH 2 SPE HPLC - UV 549.2 

Carbamate Pesticides 

40 mL Glass w / Teflon 

faced septa 

4 Sodium 

thiosulfate 

Potassium dihydrogen citrate sample pH to ~3.8 

HPLC-fluorescence 531.2 

Inorganic Analytes Metals/Elements 125 mL Plastic 

(i.e. HPDE) 

2 None Trace metal grade 

nitric acid. See method. 

ICP-MS 200.8 ICP-AES 200.7 

AA 200.9 

Organometallic compounds 

125 mL Plastic 

(i.e. HPDE) 

2 None Nitric acid to pH <2. 

See method. 

AA – cold vapor manual 

245.1 

AA – cold vapor automater 

245.2 

Cyanide 1 L Plastic 2 Ascorbic acid Sodium hydroxide to 

pH 12. See method. 

Titrimetric Spectrophotometric 

335.2 

Colorimetric UV 335.3 

Radiological 2 L Plastic 2 None None - mark samples 

not preserved 

Gross alpha, gross beta, gamma isotopes, specific radionuclides 

900 Series 

32 Interim Final – August 2004 
RESPONSE GUIDELINES 

Sample Type Container 

Size 

Container Type 

No. Dechlorinating 

Agent 

Preservative Analytical 

Technique 

Reference Methods 

CHEMISTRY - EXPANDED SCREEN (Exploratory Techniques) Unknown organics (volatile) 

40 mL Glass w / Teflon 

faced septa 

5 None None - mark samples 

not preserved 

P&T-GC/MS See Module 4 

Unknown organics (general) 

1 L Amber Glass 4 None None - mark samples 

not preserved 

Prep: SPE, SPME, micro LLE, direct aqueous injection, headspace 

See Module 4 

Analysis: GC/MS, GC, HPLC, LC-MS 

Unknown inorganics 

1 L Plastic 2 None None - mark samples 

not preserved 

ICP-MS See Module 4 

Immunoassays 1 L Amber Glass 2 Consult 

manufacturers instructions 

Consult manufacturers instructions 

Consult manufacturers instructions 

None 

PATHOGENS - EXPANDED SCREEN (Established and Exploratory Techniques) Pathogens - culture 100 mL HDPE (plastic) 2 Thiosulfate TBD Per target pathogens See Module 4 Pathogens - PCR 100 mL HDPE (plastic) 2 Thiosulfate TBD Per target pathogens See Module 4 BASELINE WATER QUALITY PARAMETERS (See Section 3.4) Water quality: bacteria 

250 mL Plastic 1 Thiosulfate None Fecal coliforms, Ecoli, Standard methods 

Water quality: chemistry 

1 L Plastic 1 None None - mark samples 

not preserved 

Conductivity, pH, alkalinity, hardness, turbidity 

Standard methods 

Surrogates 1 L Amber glass 2 None None - mark samples 

not preserved 

Total organic carbon, ultraviolet absorbance, color, chlorine demand 

Standard methods 

Toxicity 125 mL Glass 2 Consult 

manufacturers instructions 

Consult manufacturers instructions. 

Rapid toxicity assay (several vendors) 

None 

Interim Final – August 2004 33 
RESPONSE GUIDELINES 

3.4 Sample Collection Guidelines 

3.4.1 Safety Guidelines 

1.	 Do not enter the site to perform sampling until cleared. Hazardous materials response 

units may perform safety screening before allowing other responders to enter the site. 

Note that field safety screening does not generally include testing for pathogens. 

2.	 Do not eat, drink, or smoke at the site. 

3.	 Do not taste or smell the water samples. 

4.	 Do use general personal protective equipment (PPE) such as splash-proof goggles, 

disposable gloves, proper footwear (i.e., no open toe or open heel shoes), a chemical 

resistant, disposable lab coat, and long pants. (Note that this level of PPE is only 

intended to minimize incidental contact with the water or chemical reagents used during 

sample collection or field testing.) 

5.	 Avoid all skin contact with the water, and if incidental contact does occur, immediately 

flush the affected area with clean water brought to the site for that purpose. 

6. 	 Fill sampling containers slowly to avoid volatilization or aerosolization of contaminants. 

7.	 Minimize the time that personnel are on the site and collecting samples. 

3.4.2 Sampling Procedures 

1. 	 Pre-label sample containers with a waterproof marker. Information should include: 

analyte class (pathogen, chemical, or radionuclide), specific analyte (if sample is being 

collected for a specific target), sample identification number, utility name, location of 

sample collection, sample collection date and time, and sampler’s initials. 

2. 	 Check for the presence of any in-line filters (e.g., home treatment devices) that might 

interfere with sampling. Remove such devices if present. 

3. 	 If the sample tap is the suspected point of contaminant introduction, collect swab samples 

from the tap before flushing the tap and collecting water samples. 

4. 	 Flush sample taps for a time sufficient to displace the water in connecting lines in order 

to obtain a sample that is representative of the water of interest. Keep the flow rate from 

the sample tap sufficiently low in order to avoid splashing and aerosolizing water 

droplets. Divert water to a drain if possible. 

5. 	 Carefully collect samples in the specified containers (see Section 3.3). If a reagent needs 

to be added to the sample, allow enough headspace in the container to add the proper 

amount of preservative. Cap then gently mix the contents to ensure that the reagent is 

properly mixed with the sample. Test the sample with a strip of pH paper to ensure 

preservation to the proper pH. Do not insert the pH paper into the sample container. 

Pour a small portion of the mixed sample into the container cap then pour from the cap 

onto the pH paper to verify 

6. 	 For chlorinated samples, VOCs should be collected into a secondary 8-oz. glass container 

(prepared with ascorbic acid - see footnote 1, Table 3.3). Gently mix the sample and 

transfer to 3, 40-ml VOA containers (triplicate). Fill the 40-ml container above the top to 

form a meniscus. Close the container with the Teflon side of the septa facing the water 

sample, gently invert the sample container several times, and verify that there are no air 

bubbles in the container. Once each container is tagged, the three 40-ml containers 

34	 Interim Final – August 2004 
RESPONSE GUIDELINES 

should be inserted into a plastic whirlpack bag (provided) and sealed prior to sample 

storage. 

7. 	 Wipe the outside of the sealed containers with paper towel. 

8. 	 Attach custody seal to the sample container. 

9. 	 Place the sealed container into a rigid cooler and pack with frozen ice packs (preferred) 

or sealable freezer bags filled with ice. 

10. Tag each sample and record all necessary information on “Sample Documentation” and 

“Chain of Custody” forms. 

11. After all samples have been collected, preservative blanks and temperature blanks should 

be prepared and tagged. A preservative blank should be prepared for each preservative 

used during the sampling event. The preservative blank can be prepared by adding the 

appropriate amount of preservative to the preservative blank containers, and tagging the 

sample for the appropriate analysis (i.e., HNO3 preservative blank should be analyzed for 

metals). Additionally, a temperature blank container should be placed in each cooler 

containing samples. 

3.4.3 Sample Holding 

1. 	 When samples are not in the possession of designated personnel, they should be secured 

(e.g., locked in a secure area) and only accessible by designated personnel. In the field, 

samples may need to be locked in a vehicle. 

2. 	 Samples should be chilled, but protected from freezing. 

3. 	 Samples should be held at the drinking water utility lab until shipped to a lab for analysis 

or until it is determined that they are not needed. 

4. 	 Samples that are held longer than the approved holding times for contaminant analysis 

may no longer be useful. 

3.4.4 Sample Transport 

1. 	 Sample integrity and chain of custody must be maintained. All factors that might 

compromise sample integrity (e.g., storage containers, excessive transit time, 

temperature, pressure, physical disturbance, etc.) should be considered and appropriate 

measures taken to avoid compromising samples. 

2. 	 Sample packaging must be in compliance with shipping regulations. 

3. 	 Samples may be screened by law enforcement and/or ICs prior to sample transport to the 

laboratory. 

4. 	 Samples will be transported to the appropriate laboratory in coordination with law 


enforcement using appropriate air and ground assets. 


35	 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.5 Site Characterization Plan Template 

INSTRUCTIONS 

This form is intended to support the development of a customized site characterization plan 

developed in response to a specific water contamination threat. The incident commander and 

site characterization team leader should develop this plan jointly if possible. The completed 

form will be used to guide site characterization activities in the field; however, it may be 

necessary to revise the initial plan based on initial observations at the site. A form should be 

completed for each investigation site that will be characterized. 

THREAT WARNING INFORMATION 

Consult Module 2, Appendix 8.2 “Threat Evaluation Worksheet” for details about the 

threat. 

INVESTIGATION SITE 

Site Name: 

Type of facility: 

 Source water  Treatment plant  Pump station 

 Ground storage tank  Elevated storage tank  Finished water 

reservoir 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Additional Site Information: 

INITIAL HAZARD ASSESSMENT 

Are there any indicators of an explosive hazard?  Yes  No 

If “Yes,” notify law enforcement and do not send a team to the site. 

Initial hazard categorization 

 Low hazard  Chemical hazard 


 Radiological hazard  Biological hazard 


If the initial hazard assessment indicates a chemical, radiological, or biological hazard 

(as described in Module 3, Section 4.1.3), then only teams trained to deal with such 

hazards should be sent to the site. 

36 Interim Final – August 2004 
RESPONSE GUIDELINES 

SITE CHARACTERIZATION TEAM 

Name & Affiliation of Site Characterization Team Leader: 

Drinking water utility staff: 

 Water quality specialist Name: 

 Security specialist Name: 

 Operations specialist Name: 

 Other Name: 

Representatives from other agencies: 

 Local law enforcement  Fire department  HazMat 

 US EPA  FBI  Other 

COMMUNICATION PROCEDURES 

Mode of communication: 

 Phone  2-way radio  Digital 

 Facsimile  Other 

Reporting events: 

 Upon arrival at site  During approach  Site entry 

 After site evaluation  After field testing  Site exit 

 Other 

FIELD SCREENING CHECKLIST 

8 Parameter1 Screen2 Meter/Kit ID3 Check Date4 Reference Value5 

Radiation Both 

Chlorine residual Water 

pH / conductivity Water 

Cyanide Water 

Volatile 

chemicals 

Safety 

 Chemical 

weapons 

Both 

Biotoxins Water 

Pathogens Water 

1. List the parameters that will be evaluated as part of field screening (examples are listed). 

2. Screening may be conducted for safety, rapid water testing, or both. 

3. Report the unique identifier for the meter or kit used during screening. 

4. Report date of last calibration, last equipment check, or expiration date as appropriate. 

5. List any reference value that would trigger a particular action, such as exiting the site. 

37 Interim Final – August 2004 
RESPONSE GUIDELINES 

SAMPLING CHECKLIST 

8 Analyte1 No. 

Samples 

Sample Preservation2

 Standard VOCs 

 Semi-volatiles 

 Quartenary nitrogen 

compounds 

Cyanide 

 Carbamate pesticides 

Metals/elements 

 Organometallic compounds 

Cyanide 

Radionuclides 

 Non-target VOCs 

 Non-target organic 

compounds 

 Non-target inorganic 

compounds 

Immunoassays 

 Pathogens – culture 

 Pathogens – PCR 

Water quality – bacteria 

Water quality – chemistry 

1. 	List the parameters that will be sampled during site characterization (examples are 

listed). 

2. 	List preservatives and dechlorinating agents and indicate if they are to be added in the 

field. 

EQUIPMENT CHECKLIST 

 Completed Site Characterization Plan  Additional documentation 

 Emergency Water Sampling Kit (Table 3-1)  Field Testing Kit (Table 3-3) 

 Reagents (if stored separately)  Bags of ice or freezer packs 

 Laboratory grade water (5 gal)  Rinse water (20 liters) 

 Special equipment for the specific site  Disposable camera 

 Other 

38	 Interim Final – August 2004 
RESPONSE GUIDELINES 

SAMPLE HANDLING INSTRUCTIONS 

Sample delivery: 

 Return samples to water utility 

 Ship samples to specified location 

 Deliver samples to specified recipient (e.g., laboratory, law enforcement, shipping co., 

etc.) 

Name of recipient: 

Phone No.: Fax No.: 

Delivery address: 

Sample storage and security: 

Describe any special precautions or instructions related to sample storage and security: 

SIGNOFF 

Incident Commander (or designee responsible for developing Site Characterization Plan): 

Print name 

Signature Date/Time: 

Site Characterization Team Leader: 

Print name 

Signature Date/Time: 

39 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.6 Site Characterization Report Form 

INSTRUCTIONS 

Members of the site characterization team can use this form to record their observations at the 

investigation site. It also serves as a checklist for notifying incident command at key points 

during the characterization. Additional checklists are included in this form for sample collection 

and exiting the site. The completed form can also be used as a component of the site 

characterization report. A form should be completed for each investigation site that is 

characterized 

GENERAL INFORMATION 

Date: Time arrived investigation at site: 

Name of Site Characterization Team Leader: 

Phone No.: Fax No.: 

LOCATION OF INVESTIGATION SITE 

Site Name: 

Type of facility: 

 Source water  Treatment plant  Pump station 

 Finished water reservoir  Elevated storage tank  Ground storage tank 

 Distribution main  Hydrant  Service connection 

 Other 

Address: 

Weather Conditions at Site: 

Additional Site Information: 

40 Interim Final – August 2004 
RESPONSE GUIDELINES 

APPROACH TO SITE 

Time of Approach to Site: 

Initial Field Safety Screening (as listed in the “Site Characterization Plan”): 

 None  Radiation  Volatile chemicals 

 HAZCAT  Chemical weapons  Biological agents 

 Other 

Report results of field safety screening in Section 3.7 “Field Testing Results Form.” 

If any field safety screening result is above the corresponding reference value, 

immediately notify incident command and do not proceed further into the site. 

Initial Observation and Assessment of Immediate Hazards 

 Unauthorized individuals present at the site 

 Fire or other obvious hazard 

 Signs of a potential explosive hazard (e.g., devices with exposed wires) 

 Signs of a potential chemical hazard (e.g., dead animals, unusual fogs, unusual odors) 

 Unusual and unexplained equipment at the site 

 Other signs of immediate hazard 

If there are any indicators of immediate hazard, immediately notify incident command 

and do not proceed further into the site. 

Report initial observations and results to incident commander. 

Approval granted to proceed further into the site?  Yes  No 

SITE INVESTIGATION 

Time of Entry to Site: 

Repeat Field Safety Screening 

 None  Radiation  Volatile chemicals 

 HAZCAT  Chemical weapons  Biological agents 

 Other 

Report results of field safety screening in Section 3.7 “Field Testing Results Form.” 

If any field safety screening result is above the corresponding reference value, 

immediately notify incident command and do not proceed further into the site. 

Signs of Hazard: 

 None  Unexplained dead animals 

 Unexplained dead or stressed vegetation  Unexplained clouds or vapors 

 Unexplained liquids  Other 

Describe signs of hazard: 

41 Interim Final – August 2004 
RESPONSE GUIDELINES 

Unexplained or Unusual Odors: 

 None  Pungent  Irritating 

 Sulfur  Skunky  Bitter almond 

 Sweet/Fruity  New mown hay  Other 

Describe unusual odor: 

Unusual Vehicles Found at the Site: 

 Car/sedan  SUV  Pickup truck 

 Flatbed truck  Construction vehicle  None 

 Other 

Describe vehicles (including make/model/year/color, license plate #, and logos or 

markings): 

Signs of Tampering: 

 None  Cut locks/fences 

 Open/damaged gates, doors, or windows  Open/damaged access hatches 

 Missing/damaged equipment  Facility in disarray 

 Other 

Signs of sequential intrusion (e.g., locks removed from a gate and hatch)? 

 Yes  No 

Describe signs of tampering: 

Unusual Equipment: 

 None  Discarded PPE (e.g., gloves, masks) 

 Tools (e.g., wrenches, bolt cutters)  Hardware (e.g., valves, pipe) 

 Lab equipment (e.g., beakers, tubing)  Pumping equipment 

 Other 

Describe equipment: 

42 Interim Final – August 2004 
RESPONSE GUIDELINES 

Unusual Containers: 

Type of container: 

 None  Drum/Barrel  Bottle/Jar 

 Plastic bag  Box/Bin  Pressurized cylinder 

 Test Tube  Bulk container  Other 

Condition of container: 

 Opened  New  Damaged/leaking 

 Unopened  Old  Intact/dry 

Size of container: 

Describe labeling on container: 

Describe visible contents of container: 

Rapid Field Testing of the Water 

 None  Residual disinfectant  pH / conductivity 

 Cyanide  Radiation  VOCs and SVOCs 

 Pesticides  Biotoxins  General toxicity 

 Other 

Report results of rapid field testing of the water in Section 3.7 “Field Testing Results 

Form.” 

If any field test result is above the corresponding reference value, immediately notify 

incident command and wait for instruction regarding how to proceed. 

Report findings of site investigation to incident commander. 

Approval granted to proceed with sample collection?  Yes  No 

SAMPLING 

Time Sampling was Initiated / Completed: / 

Implement Sampling Procedures Appropriate for the Hazard Conditions at the Site: 

 Low hazard  Chemical hazard 


 Radiological hazard  Biological hazard 


If the site is characterized as a chemical, radiological, or biological hazard, then special 

sampling and safety procedures should be followed. 

43 Interim Final – August 2004 
RESPONSE GUIDELINES 

Safety Checklist: 

 Do not eat, drink, or smoke at the site. 

 Do not taste or smell the water samples. 

 Do use the general PPE included in the emergency water sampling kit. 

 Avoid all contact with the water, and flush immediately with clean water in the case 

of contact. 


 Slowly fill sample bottles to avoid volatilization and aerosolization. 


 Minimize the time that personnel are on site and collecting samples. 


General Sampling Guidelines: 

 Properly label each sample bottle.


 Carefully flush sample taps prior to sample collection, if applicable. 


 Collect samples according to method requirements (e.g., w/o headspace for VOCs). 


 Add preservatives or dechlorinating agents as specified. 


 Carefully close sample containers and verify that they don’t leak. 


 Wipe the outside of sample containers with a mild bleach solution if needed. 


 Place sample containers into a sealable plastic bag. 


 Place samples into an appropriate, rigid shipping container. 


 Pack container with frozen ice packs. 


 Complete “Sample Documentation Form” (Section 3.8). 


 Complete “Chain of Custody Form” (Section 3.9). 


 Secure shipping container with custody tape. 


 Comply with any other sample security provisions required by participating agencies. 


EXITING THE SITE 

Time of Site Exit: 

Site Exit Checklist 

 Verify that hatches, locks, etc. are properly secured. 


 Remove all samples, equipment, and materials from the site. 


 Verify that all samples are in the cooler and properly seal the cooler. 


 Remove all PPE at site perimeter. 


 Place disposable PPE and other trash into a heavy-duty plastic trash bag. 


 Verify that the perimeter has been properly secured before leaving the site. 


 Ensure that all documentation has been completed before leaving the site perimeter. 


 Comply with any site control measures required by participating agencies. 


 Contact incident commander and inform them that the team is leaving the site. 


SIGNOFF 

Site Characterization Team Leader: 

Print name 

Signature Date/Time: 

44 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.7 Field Testing Results Form 

Date of Field Testing: Site Name: Field Tester: Phone No. 

Parameter Units Screen1 Meter/Kit ID2 Testing Location3 Testing Time4 Results5 Ref. Value6 

1: Screening may be conducted for safety, rapid water testing, or both. 2: Report the unique identifier for the meter or kit used during screening. 3: Report the specific location where the field testing was conducted. 4: Report the specific time at which the test was performed. 5: Results of field testing should include replicate analysis where appropriate. 6. Results should be compared with a reference value, if available, to determine whether or not the levels detected pose a hazard. 

45 Interim Final – August 2004 
RESPONSE GUIDELINES 

3.8 Sample Documentation Form Collection Date: Site Name: Sampler: Phone No. 

Sample ID No. Bottles Sampling Time Sampling Location Sample Description Analysis Sample Additives1 

1: Report preservatives, dechlorinating agents, acid/base for pH adjustment, and any other sample additives. 

46 Interim Final – August 2004 
3.9 Chain of Custody Form 

Site Name: Sampler: 

Sampler Phone No.: Signature: 

Sample ID Collection Date No. Bottles Analysis 

Relinquished by: Received by: Date/time: 

Relinquished by: Received by: Date/time: 

Relinquished by: Received by: Date/time: 

Relinquished by: Received by: Date/time: 

Relinquished by: Received by: Date/time: 

Dispatched by: Date/time: Received for Laboratory by: Date/time: 

Method of Sample Transport: 

Shipper: Phone No.: Tracking No.: 

47 Interim Final – August 2004 
4 Sample Analysis 

4.1 Laboratory Contact List 

Analysis Laboratory Physical Address Contact Person Phone 

Pathogens 

Chemical 

Chemical 

Radiological 

CW Agents 

48 Interim Final – August 2004 
4.2 General Approach for Analysis of Unknowns in Water 

Review the Site 

and Biologicals NO 

YES 

Chemicals or 

NO 

YES 

Perform Confirmatory 

YES 

NO 

Is additional 

NO 

YES 

Characterization Report 

Contaminant class 

known or suspected? 

Perform Screening for 

Chemicals 

Specific contaminant 

tentatively identified? 

Perform Screening for 

Biologicals 

Analysis 

Presence of 

contaminant 

confirmed? 

Revise/Expand 

Analytical Approach 

Analysis Complete. 

Report Results. 

screening 

necessary? 

49 Interim Final – August 2004 
4.3 General Classes of Chemicals, Analyte Groups, and Example Contaminants 

Chemical 

types 

Analytical Group Example Contaminants* 

Organic Volatiles Acetone, acrylonitrile, chloroform, methyl t-butyl ether, 

tetrachloroethene, toluene, 

Semivolatiles Organophosphates (e.g., malathion, mevinphos, dichlorvos, etc.), 

cyanazine, chlorinated insecticides, chlordane, pentachlorophenol 

Non-volatiles Sodium trifluroacetates, surfactants 

Carbamate compounds Aldicarb, carbofuran, oxamyl 

Quaternary nitrogen compounds Diquat, paraquat 

Pharmaceuticals Nicotine, illicit drugs 

Inorganic Trace metals Mercury, lead, cobalt 

Nonmetals Arsenic salts 

Organometallics Organomercury compounds 

Cyanides Cyanides Cyanide salts, cyanogen chloride 

Radionuclides Radiologicals Cesium-137, Cobalt-60, Strontium-92 

CW Agents Schedule 1 only (e.g., VX, sarin, nitrogen and sulfur mustards, Lewsites) 

* Not every contaminant in a particular analytical group is listed in this column. 

4.4 General Classes of Pathogens, Specific Organisms, and Select Agent Status 

Pathogen general class Organism Select Agent* 

Bacteria (non-spore forming) Brucella spp. 

Burkholderia pseudomallerei 

Campylobacter spp. 

E. coli 0157:H7 

Francisella tularensis 

Salmonella spp. 

Shigella spp. 

Vibrio cholerae 

Yersinia pestis 

Yes 

Yes 

Yes 

Yes 

Bacteria (spore forming) Bacillus anthracis 

Clostridium botulinum A 

Yes 

Yes 

Bacteria (Rickettsia) Coxiella burnetti Yes 

Protozoa Cryptosporidium parvum 

Entamoeba histolytica 

Giardia intestinalis 

Toxoplasma gondii 

Viruses Enteroviruses 

Hepatitis A 

Hepatitis E 

Noroviruses 

Rotavirus 

Variola 

VEE 

VHF 

Yes 

Yes 

Yes 

* See http://www.cdc.gov/od/sap/docs/salist.pdf 

50 Interim Final – August 2004 
5 Response Actions 

5.1 Decision Tree for Containment Options 

‘credible’ or 

‘confirmed’ 

Review existing information 

Determine whether 

the contaminated area 

can be estimated 

Estimate spread of 

contaminant 

Determine whether 

the impacts of containment 

will be minimal 

Determine whether 

the contaminated area 

can be contained 

Threat is ‘possible’ 

Threat is 

Develop and implement a 

containment strategy 

Develop and implement a 

containment strategy 

51 Interim Final – August 2004 
5.2 Decision Tree for Public Notification 

Assess threat 

Is 

supply for consumption 

NO 

inhalational 

exposure? 

NO 

response actions 

adequate? 

NO 

NO 

credibility and public 

health consequences 

contaminant 

known? 

YES 

Consider alternate water 

Consult with appropriate 

officials regarding public 

notification options 

Is boiling 

effective and 

advisable? 

YES 

Is there a 

risk of dermal or 

YES 

Issue a “do not use” notice 

Issue a “boil water” notice 

Issue a “do not drink” notice 

Are operational Public notification may 

not be necessary YES 

Consider alternate water 

supply for consumption, 

sanitation, and other uses 

Evaluate ability of operational 

response actions to provide 

adequate public health protection 

52 Interim Final – August 2004 
5.3 Contaminant Characterization and Transport Worksheet 

INSTRUCTIONS 

The purpose of this worksheet is to help organize information that will lead to the identification of the 

contaminant to facilitate decisions on appropriate operational responses and provide more accurate 

information for public communication/notification. Contaminant identification will most likely first be a 

presumptive identification followed by more lengthy procedures to verify the identity of the contaminant. 

While validated analytical results are typically the most reliable means of contaminant identification, other 

information collected during the threat evaluation and site characterization may provide valuable 

insight regarding the identity of the contaminant. 

SITE CHARACTERIZATION/THREAT EVALUATION SUMMARY 

Describe the contaminant's odor, if applicable. 

Describe the reported taste of the contaminant, if applicable. 

Caution: Do NOT taste the water. 

What was the physical form of the contaminant? 

 Solid  Liquid  Gas 

 Slurry  Powder  Granules 

 Other 

What color was the contaminant? 

Summarize additional information obtained during site characterization/threat warning that is relevant to 

contaminant identification. 

Summarize the on-line monitoring data, consumer complaints, or witness accounts that are relevant to 

contaminant identification. 

Field Analysis Summary 

Summarize the results of the field analysis for the following parameters: 

Radiation 

Chlorine residual 

pH, conductivity 

Cyanide 

Volatile chemicals 

Chemical weapons 

Biotoxins 

Pathogens 

Other 

53 Interim Final – August 2004 
Public Health Information 

Have death or disease in the population been reported?  Yes  No  Unknown 

Type/symptoms 

Is there information on unusual sales of pharmaceutical supplies (e.g., diarrhea medication)? 

Number of people affected 

Number of fatalities 

Location/area affected 

Was an epidemiological investigation conducted? 

Results 

 Yes  No  Unknown 

Was a clinical investigation conducted? 

Results 

 Yes  No  Unknown 

Is the contaminant acutely toxic and what are the acute effects? 

Describe 

 Yes  No  Unknown 

LABORATORY ANALYSIS SUMMARY 

Results of analysis 

Reporting units 

Analytical method 

Minimum reporting level 

Precision (relative standard deviation) 

QA/QC (e.g., recovery of matrix spikes, standard checks, etc.) 

Summarize additional information obtained during laboratory analysis that is relevant to contaminant 

identification. 

54 Interim Final – August 2004 
CONTAMINANT CHARACTERISTICS 

What is the class of the contaminant? 


 Biological  Chemical  Radiological 


 Unknown 


Can any conclusions regarding the contaminant properties be made? (Place an ‘X’ in the appropriate 

column) 

Yes No Unk Comment/Additional Information 

Is the contaminant susceptible to 

disinfection or chemical oxidation? 

Does the contaminant hydrolyze into 

less toxic products? 

Does the contaminant hydrolyze into 

more toxic products? 

What are pKa values for chemicals? 

Is the contaminant water soluble? 

Does the contaminant have a 

discernable taste, odor, or color? 

Is the contaminant volatile or semivolatile? 

Does the contaminant impact the pH? 

Does the contaminant impact 

conductivity? 

Does the contaminant impact other 

water quality parameters? 

Does the contaminant react with 

certain disinfectants (i.e., chlorine, 

chloramines, etc.)? 

What is the contaminant’s half life? 

Contaminant Public Health Effect Information 

What are the primary routes of exposure? 


 Ingestion  Inhalation  Dermal Contact 


 Unknown 


What are the acute health effects for the exposure routes identified? 

What is the contaminant’s LD50/ID50? 

What is the length of time to first onset of symptoms after exposure? 

What are the chronic health effects associated with exposure to the contaminant? 

55 Interim Final – August 2004 
Does the contaminant have a method of secondary transmission?


 Yes  No  Unknown 


Describe 


Is an approach available to prevent undesirable health effects from the contaminant? 


 Yes  No  Unknown 


Describe 


Are there treatments available for individuals exposed to the contaminant?


 Yes  No  Unknown 


Describe 


Are health standards for the contaminant available?


 Yes  No  Unknown 


Describe 


By which exposure route(s)? 

 Ingestion  Inhalation 

 Dermal  Ocular 

List the levels for each exposure route. 

Contaminant Treatment Information 

Treatment Types Could be used to Degradation products Rating of effectiveness 

treat the formed as a consequence (poor, fair, good) of percent 

contaminant? of treatment effectiveness 

Lime softening Yes No 

Reverse osmosis Yes No 

Standard chlorination Yes No 

Enhanced Yes No 

chlorination 

Standard filtration Yes No 

Enhanced filtration Yes No 

Membrane filtration Yes No 

Nanofiltration Yes No 

Electrodialysis Yes No 

Cation exchange Yes No 

resin 

Anion exchange resin Yes No 

Activated alumina Yes No 

Chloramine Yes No 

Chlorine dioxide Yes No 

Standard UV Yes No 

Enhanced UV Yes No 

Standard ozone Yes No 

Enhanced ozone Yes No 

Standard GAC Yes No 

Enhanced GAC Yes No 

Standard air stripping Yes No 

Enhanced air Yes No 

stripping 

Other Methods Yes No 

56 Interim Final – August 2004 
Access to contaminant information (effects and properties) 

In-house information 

Contact/phone no. 

Internal database 

Public Health officials 

Contact/phone no. 

Web site/database 

US EPA Water Contaminant Information Tool 

Web site/access code 

x US EPA water contaminant information tool (WCIT). 

x US EPA’s List of Drinking Water Contaminants & MCLs: 

http://www.epa.gov/safewater/mcl.html#mcls. 

x Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov. 

x CDC Emergency Preparedness and Response: www.bt.cdc.gov. 

x Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line 

Reference Guide: www.WaterHealthConnection.org. 

x Physician Preparedness for Acts of Water Terrorism: 

www.waterhealthconnection.org/bt/index.asp. 

x Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html. 

x Risk Assessment Information System (RAIS), which contains information taken from US EPA's 

Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables 

(HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and 

other information sources: http://risk.lsd.ornl.gov/index.shtml. 

x United States Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical 

Management of Biological Casualties Handbook: 

http://www.usamriid.army.mil/education/bluebook.html. 

x WHO: www.who.int/search/en/. 

x WHO’s “Public health response to biological and chemical weapons:” 

www.who.int/csr/delibepidemics/biochemguide/en/index.html. 

CONTAMINANT TRANSPORT 

Summarize what is known regarding the location of contaminant introduction. 

How much material was used (lbs., tons, gal, etc.) 

How was it added?  Single dose  Over time  Unknown 

Time period of suspected contaminant introduction. 

Elapsed time. 

Method of estimating the spread. 

 Manual calculations  Hydraulic model  Water flow analysis 

 GIS  Field analysis  Areas of customer complaints 

 Areas of people with health-related symptoms 

 Other 

Estimate the contaminated area. 

Estimate the population affected. 

57 Interim Final – August 2004 
Identify any customers with special needs that are within the affected area. 

 Critical Care Facilities 

 Hospitals  Clinics 

 Nursing Homes  Dialysis Centers 

 Other 

 Schools 





Day Care Facilities 

 Businesses 







Food and Beverage Manufacturers 

Restaurants 

Power Generation Facilities 





Commercial Ice Manufacturers 

 Agricultural Operations 

 Other 

SIGNOFF 

Name of person completing form 

 Print name 

Signature Date/Time: 

58 Interim Final – August 2004 
5.4 Public Health Response Action Worksheet 

INSTRUCTIONS 

The purpose of this form is to help organize information to aid in the evaluation of containment options 

and public notification options. The objectives of public health response actions (operational and public 

notification) are to prevent or limit public exposure to potentially contaminated water by either restricting 

further propagation of the contaminant through the distribution system or restricting use of the water 

through public notification. This worksheet assumes that the “Contaminant Characterization and 

Transport Worksheet” in Section 5.3 has been completed to the extent possible. 

ASSESSMENT OF PUBLIC HEALTH IMPACT 

Identity of the contaminant  Suspected  Known  Unknown 

Describe 

Contaminant properties (if known): 

Toxic or infectious dose (LD50/ID50): 

Route of exposure: 

 Ingestion  Inhalation  Dermal Contact 

 Other 

Symptoms of exposure to high dose: 

Symptoms of exposure to low dose: 

Other: 

EVALUATION OF CONTAINMENT OPTIONS 

Describe the location and extent of the contaminated area. 

Containment options 

 Valve closures 

 Isolate zone(s) 

 Other 

 Reverse flow conditions  By-pass 

Critical equipment within contaminated area 

 System equipment  Zones 

 Hydrants  Other 

 Pump stations 

Customers with special needs within contaminated area 

 Critical Care Facilities 







 Hospitals 

 Nursing Homes 

Other 





 Clinics 

 Dialysis Centers 

 Schools 

 Businesses 







Food and Beverage Manufacturers 

Restaurants 

Power Generation Facilities 





Commercial Ice Manufacturers 

 Agricultural Operations 

 Other 

59 Interim Final – August 2004 
Effectiveness of containment options 

 Complete contaminant isolation  Reduction in spread of contaminant 

 Unknown  Other 

Is containment expected to provide adequate public health protection? 

 Yes  No  Unknown 

Timeline for implementation of containment options 

Containment procedures to begin: 

Containment procedures to end: 

EVALUATION OF PUBLIC NOTIFICATION OPTIONS 

Is public notification necessary?  Yes  No 

Collaboration Agencies (identified in Public Health Response Plan and Utility’s ERP) 

 Public health agencies  Police departments  Fire departments 

 Hospitals/clinics  Laboratories  Drinking water primacy agency 

 Regional Poison Control Center 

 Other 

Type of notification (Follow steps shown) 

Is the contaminant known?  Yes  No 

If no, issue a “ Do Not Use” notice. 

- If yes, is boiling effective and advisable?  Yes  No  Unknown 

If yes, issue a “Boil Water” notice. 

- - If no or unknown, is there a risk of dermal or inhalation exposure?  Yes  No  Unknown 

If no, issue a “Do Not Drink” notice.


If yes or unknown, issue a “ Do Not Use” notice. 


Content of public notification 

 Has the contamination incident been confirmed?  Yes  No 

 Is the contaminant known?  Yes  No 

 If yes, identity of the contaminant 

 Characteristics of the contaminant 

 Restrictions on use 

 Ingestion exposure  Inhalation exposure  Dermal exposure 

 Exposure symptoms 

 Medical treatments 

 Transmission mode (if biological) 

 Duration of restriction 

 Alternate water supply 

 Additional instructions to consumers 

 Other information about the incident 

 Other 

60 Interim Final – August 2004 
Notification to customers with special needs 

 Critical Care Facilities 







 Hospitals 

 Nursing Homes 

Other 





 Clinics 

 Dialysis Centers 

 Schools 

 Businesses 







Food and Beverage Manufacturers 

Restaurants 

Power Generation Facilities 





Commercial Ice Manufacturers 

 Agricultural Operations 

 Other 

Are there subpopulations that will be affected at a greater rate than general population? 


 Yes  No  Unknown 


Describe 


Notification to consecutive system. 

 Yes  No  Not Applicable 

Method of dissemination 

 Broadcast media (radio and television)  Government access channels 

 Web site  Listserve email 

 Newspaper  Letters by mail 

 Newsletters (water utility or partner organizations)  Phone banks 

 Broadcast phone messages  Broadcast faxes 

 Posting in conspicuous locations  Mass distribution through partners 

 Hand delivery  Door-to-door canvassing 

 Town hall meetings  Conference calls 

 Other 

Notification/restriction timeline 

Notification/restriction to begin: 

Notification/restriction to end: 

ALTERNATE WATER SUPPLY NEEDS 

Is an alternate water supply needed? 

 Drinking water  Fire fighting 

 Other 

Where can customers obtain the alternate water supply? 

 Bottled water provided by local government agencies 

 Bottled water provided by local retailers 

 Bulk water provided by certified water haulers 

 Bulk water transported or provided by military assets 

 Bulk water providing by neighboring water utilities 

 Water treated at plant and hauled to distribution centers (i.e., in the case of distribution system 

contamination) 

 Other 

61 Interim Final – August 2004 
What customers with special needs should be notified of the alternate water supply availability? 

 Critical Care Facilities 

 Hospitals  Clinics 

 Nursing Homes  Dialysis Centers 

 Other 

 Schools 

 Businesses 







Food and Beverage Manufacturers 

Restaurants 

Power Generation Facilities 





Commercial Ice Manufacturers 

 Agricultural Operations 

 Other 

SIGNOFF 

Name of person completing form 

 Print name 

Signature Date/Time: 

62 Interim Final – August 2004 
6 Appendices 

6.1 Critical System Information Checklist 

 Population Served and Service Connections 

 Distribution Network Map (including pressure zones) 

 Pressure Zone Map 

 Treatment Process Flow Diagram 

 Chlorination Stations (location and quantity of chlorine on site) 

 Chemical Handling and/or Storage Facilities and Release Impact Analysis 

 Booster Pump Stations (location, capacity, and power requirements) 

 Supervisory Control and Data Acquisition systems 

 Site Staffing Rosters and Employee’s Duties and Responsibilities 

 Vulnerability Assessments 

 Backup Equipment and Power Generation 

63 Interim Final – August 2004 
6.2 Information Resources 

x Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov.


x AOAC. 2003b. “Rapid Test Kits Test Kit Database”


http://www.aoac.org/testkits/TKDATA2.HTM. 

x CDC Emergency Preparedness and Response: www.bt.cdc.gov. 

x CDC. 2003f. “List of Select Biological Agents” http://www.cdc.gov/od/sap/docs/salist.pdf. 

x CWC. 2003b. “The Chemical Weapons Convention – A Quick Guide, CWC-002” 

http://www.cwc.gov/Industry_Outreach/Publications/002/cwc-b0001_html. 

x FEMA, Hazardous Materials Guide for First Responders. http://www.usfa.fema.gov/fireservice/hmgfr3.cfm 

x Physician Preparedness for Acts of Water Terrorism: 

www.waterhealthconnection.org/bt/index.asp. 

x Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line 

Reference Guide: www.waterhealthconnection.org. 

x Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html. 

x Risk Assessment Information System (RAIS), which contains information taken from the US 

EPA Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables 

(HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and 

other information sources: http://risk.lsd.ornl.gov/index.shtml. 

x US Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical Management 

of Biological Casualties Handbook: http://www.usamriid.army.mil/education/bluebook.html. 

x US Army. 2002. “Toxic Chemical Agent Safety Standards” 

http://www.usapa.army.mil/pdffiles/p385_61.pdf. 

x US Coast Guard. 2001. “Chemical Hazards Response Information System” 

http://www.chrismanual.com. 

x US EPA’s List of Drinking Water Contaminants & Maximum Contaminant Levels (MCLs): 

http://www.epa.gov/safewater/mcl.html#mcls. 

x US EPA. 2000. “EPA Radiological Emergency Response Plan” 

http://www.epa.gov/radiation/rert/docs/rerp-1-00.pdf. 

x US EPA. 2003c. “EPA Environmental Technology Verification Home” http://www.epa.gov/etv/. 

x US EPA. Undated c. Compendium of Environmental Testing Laboratories. 

http://www.epa.gov/compendium 

x US National Library of Medicine. 2001. Toxicology Tutor I - Basic Principles. May 14. 

http://www.sis.nlm.nih.gov/ToxTutor/Tox1/a12.htm 

x WaterISAC, which contains information on contaminants including various contaminant fact 

sheets as well as the United Kingdom Water Industry Research (UKWIR) database: 

www.waterisac.org. 

x WHO’s “Public health response to biological and chemical weapons” 


www.who.int/csr/delibepidemics/biochemguide/en/index.html.


x WHO. 2001. “Health Aspects of Biological and Chemical Weapons” 


http://www.who.int/emc/pdfs/BIOWEAPONS_FULL_TEXT2.pdf 

64	 Interim Final – August 2004 
6.3 Threat Management Matrices 

This section presents a “contamination threat management matrix” for each of the threat 

warnings described in Section 2.2. Each matrix is a tabular summary that lists the following at 

the ‘possible,’ ‘credible,’ and ‘confirmatory’ stages of the threat evaluation: 

x Information considered during the threat evaluation. 


x Factors considered during the threat evaluation. 


x Potential response actions. 


6.3.1 Security Breach 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

Information 

x

x

x

x

x

Location of security breach. 

Time of security breach. 

Information from alarms. 

Observations when security 

breach was discovered. 

Additional details from the 

threat warning. 

x Results of site characterization at 

location of security breach. 

x Previous security incidents. 

x Real time water quality data from 

the location of security breach. 

x Input from local law enforcement. 

x

x

x

x

Results of sample analysis. 

Contaminant information. 

Results of site characterization 

at other investigation sites. 

Input from primacy agency 

and public health agency. 

Evaluation 

x

x

x

Was there an opportunity for 

contamination? 

Has normal operational 

activity been ruled out? 

Have other “harmless” 

causes been ruled out? 

x Do site characterization results 

reveal signs of contamination? 

x Is this security breach similar to 

previous security incidents? 

x Does other information (e.g., 

water quality) corroborate threat? 

x Does law enforcement consider 

this a credible threat? 

x

x

x

Were unusual contaminants 

detected during analysis? Do 

they pose a risk to the public? 

Do site characterization results 

reveal signs of contamination? 

Is contamination indicated by a 

“preponderance of evidence?” 

Notifications 

x

x

Notifications within utility. 

Local law enforcement 

agencies. 

x Drinking water primacy agency. 

x State/local public health agency. 

x FBI. 

x

x

x

Emergency response agencies. 

National Response Center. 

Other state and federal 

assistance providers. 

Response 

x

x

x

x

Isolate affected area. 

Initiate site characterization. 

Estimate spread of suspected 

contaminant. 

Consult external information 

sources. 

x Implement appropriate public 

health protection measures. 

x Plan for alternate water supply. 

x Analyze samples. 

x Perform site characterization at 

additional investigation sites. 

x

x

x

x

Characterize affected area. 

Revise public health protection 

measures as necessary. 

Provide alternate water supply. 

Plan remediation activities. 

Security breaches may be the most common type of threat warning encountered by a utility since 

they may result from trespassing, vandalism, theft, or failure to re-secure facilities following 

legitimate activities. The purpose of the threat evaluation under this scenario is to distinguish 

between these more frequent, yet relatively harmless security breaches, and those few that might 

be considered ‘credible’ contamination threats. 

At the ‘possible’ stage of the threat evaluation, information about the security breach will be 

available. Specifically, the location of the security breach will be known, which will likely be 

established as the initial investigation site. Other information may be available from alarms 

65 Interim Final – August 2004 
(including surveillance footage), which may help to establish the time of the security breach. 

The evaluation at this stage should consider whether or not there was an opportunity for 

contamination at the site of the security breach. Furthermore, “normal” activity should be 

considered and investigated at this stage as a potential cause of the security breach (e.g., was a 

utility crew recently at the site and potentially forgot to re-secure the area?). Potential response 

actions to a ‘possible’ threat may include isolating areas of the system that could be affected, 

initiating site characterization activities to collect more information in support of the threat 

evaluation, and initiating the process to estimate the spread of the suspect water through the 

system. 

Information that may be available at the ‘credible’ stage includes the results of site 

characterization, an assessment of previous security incidents, real-time water quality data in the 

area of the security breach, and an assessment of the threat by law enforcement. The evaluation 

at this stage will consider whether or not signs of contamination were discovered during site 

characterization, including unusual results from field testing or unusual observations during the 

site investigation. Consideration should also be given to whether or not the new information 

available at this stage corroborates the information about the threat. If the threat is determined to 

be ‘credible,’ response actions may include measures to limit or prevent exposure of the public to 

the suspect water, such as public notification. Actions taken to continue the investigation at this 

point may include analysis of samples collected from the site, continued site characterization 

activities, and an analysis to estimate the spread of the contaminant. 

The new information available at the confirmatory stage may include the results from laboratory 

analysis, including QA/QC data to support the interpretation of the results. If a specific 

contaminant is identified, then additional information about that contaminant can be used to 

further evaluate the nature of the threat as well as implications to public health. The findings of 

continued site characterization activities may also help to confirm the incident. The basis for 

confirming a contamination incident can be analytical results that identify a specific contaminant 

or other definitive evidence that a contaminant is present in the water. If a contaminant has been 

identified, consideration should be given to the health effects associated with exposure to that 

contaminant. It may be necessary to revise the sampling and analysis plans if a contaminant was 

not positively identified through laboratory analysis but the threat is still deemed ‘credible.’ 

Response actions potentially initiated once a contamination incident has been confirmed include 

characterization of the contaminated area, revision to public health protection measures, 

provision of alternate water supplies, and planning for remediation and recovery activities. 

66 Interim Final – August 2004 
6.3.2 Witness Account 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

Information 

x

x

x

Location of the suspicious 

activity. 

Witness account of the 

suspicious activity. 

Additional details from the 

threat warning. 

x Additional information from the 

witness. 

x Results of site characterization at 

location of suspicious activity. 

x Previous security incidents. 

x Real time water quality data from 

the location of suspicious activity. 

x Input from local law enforcement. 

x

x

x

x

Results of sample analysis. 

Contaminant information. 

Results of site characterization 

at other investigation sites. 

Input from primacy agency 

and public health agency. 

Evaluation 

x

x

x

x

Was there an opportunity for 

contamination? 

Is the witness reliable? 

Has normal operational 

activity been ruled out? 

Have other “harmless” 

causes been ruled out? 

x Do site characterization results 

reveal signs of contamination? 

x Is the suspicious activity similar 

to previous security incidents? 

x Does other information (e.g., 

water quality) corroborate threat? 

x Does law enforcement consider 

this a credible threat? 

x

x

x

Were unusual contaminants 

detected during analysis? Do 

they pose a risk to the public? 

Do site characterization results 

reveal signs of contamination? 

Is contamination indicated by a 

“preponderance of evidence?” 

Notifications 

x

x

Notifications within utility. 

Local law enforcement. 

x Drinking water primacy agency. 

x State/local public health agency. 

x FBI. 

x

x

x

Emergency response agencies. 

National Response Center. 

Other state and federal 

assistance providers. 

Response 

x

x

x

x

x

Isolate affected area. 

Initiate site characterization. 

Estimate spread of suspected 

contaminant. 

Consult external information 

sources. 

Interview witness for 

additional information. 

x Implement appropriate public 

health protection measures. 

x Plan for alternate water supply. 

x Analyze samples. 

x Perform site characterization at 

additional investigation sites. 

x

x

x

x

Characterize affected area. 

Revise public health protection 

measures as necessary. 

Provide alternate water supply. 

Plan remediation activities. 

From the perspective of the threat management process, a threat triggered by a witness account is 

similar to one triggered by a security breach. One of the few significant differences is the use of 

information collected directly from the witness throughout the evaluation, particularly during the 

‘possible’ and ‘credible’ stages of the threat evaluation. The reliability of the witness must be 

considered when making these determinations, and additional evidence collected during the 

investigation should be evaluated to determine whether or not it corroborates the witness 

account. 

67 Interim Final – August 2004 
6.3.3 Direct Notification by Perpetrator 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

Information 

x

x

x

x

Transcript of phone (or 

written) threat. 

The who, what, where, 

when, and why of the threat. 

Additional details from the 

threat warning. 

Vulnerability assessment. 

x Law enforcement assessment. 

x Primacy agency assessment. 

x Previous threats at this utility or 

other utilities. 

x Results of site characterization at 

selected investigation sites. 

x Real time water quality data. 

x Reports from ISAC, EPA, etc. 

x

x

x

x

x

FBI assessment. 

Results of sample analysis. 

Contaminant information. 

Results of site characterization 

at other investigation sites. 

Input from primacy agency 

and public health agency. 

Evaluation 

x

x

x

x

x

Is the threat feasible? 

Has the water already been 

contaminated? 

Is the location known or 

suspected? 

Is the identity of the 

perpetrator known or 

suspected? 

Have there been personnel 

problems at the utility? 

x Do site characterization results 

reveal signs of contamination? 

x Does other information (e.g., 

water quality) corroborate threat? 

x Does law enforcement consider 

this a credible threat? 

x Does the primacy agency consider 

this a credible threat? 

x

x

x

Were unusual contaminants 

detected during analysis? Do 

they pose a risk to the public? 

Do site characterization results 

reveal signs of contamination? 

Is contamination indicated by a 

“preponderance of evidence?” 

Notifications 

x

x

x

Notifications within utility. 

Local law enforcement. 

Drinking water primacy 

agency. 

x FBI. 

x State/local public health agency. 

x EPA Criminal Investigation 

Division. 

x

x

x

Emergency response agencies. 

National Response Center. 

Other state and federal 

assistance providers. 

Response 

x

x

x

x

Isolate affected area if 

identified in the threat. 

Identify sites and initiate site 

characterization. 

Consult external information 

sources. 

Gather information from law 

enforcement assessment. 

x Implement appropriate public 

health protection measures. 

x Plan for alternate water supply. 

x Analyze samples. 

x Perform site characterization at 

additional investigation sites. 

x Estimate spread of suspected 

contaminant. 

x

x

x

x

Characterize affected area. 

Revise public health protection 

measures as necessary. 

Provide alternate water supply. 

Plan remediation activities. 

Threats to contaminate the water made via direct notification by a perpetrator need to be taken 

seriously. However, the majority of such direct threats are hoaxes that may be intended to cause 

panic or disruption, gain attention, or fulfill a personal vendetta. Thus, the focus of the threat 

evaluation for this type of threat warning is to identify any credible threats amongst the larger 

number of hoax notifications. In any case, direct threats against the water supply should be 

reported to local law enforcement. 

A key source of information that may support the threat evaluation under this scenario is 

provided directly by the perpetrator making the threat. In the case of a phone threat, it is 

important to collect information about the threat from the caller to support the threat evaluation. 

Similarly, a written notification should be carefully reviewed for details about the threat. 

Additional information collected throughout the investigation should be evaluated against the 

details of the threat notification, and it corroborates the details of the notification, then the threat 

is more likely to be deemed ‘credible.’ 

68 Interim Final – August 2004 
One of the potential challenges in managing a threat triggered by direct notification from a 

perpetrator is identification of an investigation site that will be the focus of site characterization 

activities. Unless a location is named in the threat, it will be necessary to use other information, 

such as that derived from vulnerability assessments or unusual water quality data/consumer 

complaints, to identify investigation sites. 

69 Interim Final – August 2004 
6.3.4 Unusual Water Quality or Consumer Complaints 

Unusual Water Quality 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

Information 

x

x

x

x

Unusual water quality data. 

Baseline water quality data. 

Real time water quality data. 

Operational information 

corresponding to the time of 

the unusual water quality. 

x Results of site characterization at 

selected investigation sites. 

x Previous threat warnings triggered 

by water quality. 

x Contaminant information. 

x Reports of consumer complaints. 

x

x

x

x

Results of sample analysis. 

Contaminant information. 

Results of site characterization 

at other investigation sites. 

Input from primacy agency 

and public health agency. 

Evaluation 

x

x

x

x

Is the unusual water quality 

significantly different from 

an established baseline? 

Could operational changes 

be the cause? 

Could changes in source 

water quality be the cause? 

Are there similar results at 

other monitoring locations? 

x Do site characterization results 

reveal signs of contamination? 

x Is this unusual data substantial 

different from other water quality 

episodes? 

x Is the unusual data indicative of a 

specific contaminant? 

x Are the unusual water quality 

clustered in a specific area? 

x Are there any unusual consumer 

complaints in the area? 

x

x

x

Were unusual contaminants 

detected during analysis? Do 

they pose a risk to the public? 

Do site characterization results 

reveal signs of contamination? 

Is contamination indicated by a 

“preponderance of evidence?” 

Notifications 

x Notifications within utility. x Drinking water primacy agency. 

x State/local public health agency. 

x Local law enforcement. 

x FBI. 

x

x

x

Emergency response agencies. 

National Response Center. 

Other state and federal 

assistance providers. 

Response 

x

x

x

x

Identify sites and initiate site 

characterization. 

Begin analysis of available 

water quality data. 

Investigate unusual 

consumer complaints. 

Consult external information 

sources. 

x Estimate affected area and isolate 

if possible. 

x Implement appropriate public 

health protection measures. 

x Plan for alternate water supply. 

x Analyze samples. 

x Perform site characterization at 

additional investigation sites. 

x

x

x

x

Characterize affected area. 

Revise public health protection 

measures as necessary. 

Provide alternate water supply. 

Plan remediation activities. 

Consumer Complaint 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

x Compilation of consumer x Results of site characterization at x Results of sample analysis. 

complaints, including selected investigation sites. x Contaminant information. 

geographic distribution. x Summary of historic consumer x Results of site characterization 

x Recent water quality data complaints. at other investigation sites. 

Information 

that may be associated with 

complaints. 

x Results of consumer interviews. 

x Contaminant information. 

x Input from primacy agency 

and public health agency. 

x Operational information 

corresponding to the time of 

the unusual complaints. 

70 Interim Final – August 2004 
x Are the complaints unusual? x Do site characterization results x Were unusual contaminants 

x Could operational changes 

be the cause? x

reveal signs of contamination? 

Are other consumers in the area 

detected during analysis? Do 

they pose a risk to the public? 

x Could changes in source 

water quality be the cause? 

experiencing similar water 

quality? 

x Do site characterization results 

reveal signs of contamination? 

Evaluation

x

x

Are the complaints clustered 

in a specific area? 

Are complaints from 

habitual complainers? 

x

x

Are the unusual complaints 

significantly different from typical 

complaints? 

Are the complaints indicative of a 

specific contaminant? 

x Is contamination indicated by a 

“preponderance of evidence?” 

x Is there anything unusual about 

the water quality in the area? 

x Notifications within utility. x Drinking water primacy agency. x Emergency response agencies. 

x State/local public health agency. x National Response Center. 

Notifications 

x

x

Local law enforcement agency. 

FBI. 

x Other state and federal 

assistance providers. 

x Identify sites and initiate site x Estimate affected area and isolate x Characterize affected area. 

characterization. if possible. x Revise public health protection 

x Begin analysis of available x Implement appropriate public measures as necessary. 

water quality data. health protection measures. x Provide alternate water supply. 

x Interview consumers in area x Plan for alternate water supply. x Plan remediation activities. 

Response

with high numbers of 

complaints. 

x

x

Analyze samples. 

Perform site characterization at 

x Consult external information additional investigation sites. 

sources. 

A threat warning arising from unusual water quality data is significantly different from the 

other threat warnings previously discussed and thus should be handled differently during the 

threat evaluation. In determining whether or not the threat is ‘possible,’ it is necessary to 

evaluate the anomalous data relative to an established baseline. Furthermore, it is important to 

consider operational conditions, or potential impacts from changing source water quality or 

distribution system blending as possible explanations for the unusual water quality or complaint. 

If the unusual water quality data is determined to be significantly different from the baseline, and 

cannot be explained by other factors, then t contamination may be considered a possibility. 

Presumably, the unusual water quality data will be associated with a particular location in the 

system, which will help in the identification of investigation sites that will be the focus of site 

characterization activities. At this stage, it is important to verify the anomalous water quality 

data through additional testing using independent equipment. For example, if an incident was 

triggered by a rapid decrease in the free chlorine residual, as detected by online electrochemical 

monitors, additional testing could be performed with colormetric field kits to confirm the results. 

Additional rapid field testing might also help to determine the bounds of the affected area. 

Furthermore, specific information about particular contaminants should be considered at the 

‘credible’ stage as it might be used to identify potential contaminants that would impact the 

water quality parameter with anomalous readings. For example, contaminants with acidic 

functional groups might result in reduced pH. 

71 Interim Final – August 2004 
6.3.5 Notification by Public Health 

THREAT EVALUATION STAGE 

Possible Credible Confirmatory 

Information 

x

x

x

Details of notification from 

public health sector. 

Symptoms of disease and 

causative agent, if known. 

Contaminant information. 

x Geographic distribution of disease 

or death. 

x Recent water quality and 

operational data. 

x Reports of consumer complaints. 

x Contaminant information. 

x

x

x

x

Results of site characterization 

at selected investigation sites. 

Results of sample analysis. 

Contaminant information. 

FBI assessment. 

Evaluation 

x

x

x

Why is water under 

investigation as a possible 

source? 

Are the reported symptoms 

consistent with exposure to 

the contaminant via water? 

If causative agent is known, 

is it stable in water? 

x Is the geographic pattern of 

exposure consistent with exposure 

to contaminated water? 

x Is there a recent occurrence of 

unusual water quality data or 

consumer complaints? 

x Does additional information about 

the potential contaminant indicate 

water as a potential source? 

x

x

x

Has the public health agency 

concluded that water is the 

cause of the disease or deaths? 

Did sample analysis detect the 

causative agent? 

Was another contaminant 

detected during sample 

analysis that could be the cause 

of the disease or deaths? 

Notifications 

x

x

x

Notifications within utility. 

State/local public health 

agency. 

Drinking water primacy 

agency. 

x FBI. 

x Local and State law enforcement 

agencies. 

x

x

x

Emergency response agencies. 

National Response Center. 

Other state and federal 

assistance providers. 

Response 

x

x

Consult with public health 

agency and primacy agency. 

Consult external information 

sources. 

x Estimate affected area and isolate 

if possible. 

x Implement appropriate public 

health protection measures. 

x Plan for alternate water supply. 

x Identify sites and initiate site 

characterization. 

x Analyze samples. 

x

x

x

x

Characterize affected area. 

Revise public health protection 

measures as necessary. 

Provide alternate water supply. 

Plan remediation activities. 

Notification from public health officials regarding a potential water contamination incident is 

unique in that individuals have been exposed to a harmful substance resulting in illness, disease 

or death in the population. The threat evaluation in this case may be part of a larger 

epidemiological investigation to determine the cause of disease. It is critical that the utility work 

with the appropriate public health officials from the outset, since these officials will likely have 

information critical for the evaluation. For example, they may know or suspect the causative 

agent based on clinical information. This knowledge, in conjunction with information about the 

properties of the contaminant, may indicate whether or not contaminated water is even a 

possibility. For example, if the causative agent is known to immediately break down into 

harmless byproducts upon exposure to water, then the possibility of contaminated water might be 

dismissed. 

If water is considered a possible carrier for the contaminant, then further investigation should be 

conducted to determine if water is the most likely carrier of the contaminant (i.e., analogous to 

the ‘credible’ stage of the threat evaluation). Information that may help to make this 

determination will include additional findings from the larger epidemiological investigation, 

geographic distribution of exposure, recent water quality and operational data, and reports of 

72 Interim Final – August 2004 
consumer complaints. If this additional information indicates that water contamination is likely, 

response actions would likely include public notification and sampling for the contaminant. The 

sampling plan developed at this point may start with information about the geographic 

distribution of exposure; however, consideration must be given to the latency period of the 

disease, which could be from minutes to weeks, as well as the travel time within the system. The 

objectives of sampling and analysis at this point would include: 1) confirming the presence of the 

contaminant in the water; 2) determining if the contaminant is still present; and 3) determining 

the area affected. If water contamination is confirmed, and the contaminant is still present in the 

system, it will be necessary to begin planning for remediation and recovery efforts. If the 

contaminant is not found, extensive sampling would likely be necessary to demonstrate that the 

contaminant is indeed absent from the system. 

Office of Ground Water and Drinking Water 

Water Security Division 

EPA 817-D-04-001 

www.epa.gov/safewater/security 

August 2004 

73 Interim Final – August 2004 
Office of Ground Water and Drinking Water 

Water Security Division 

EPA 817-D-04-001 

www.epa.gov/safewater/security 

August 2004 Printed on Recycled Paper