Providing water for mobile home park communities

We want every Coloradan to have safe drinking water, but when it comes to mobile home parks, the department does not have regulatory authority over most of these communities. While we cannot always address complaints and concerns we get from mobile home park communities, we work closely with other state agencies, counties, and cities to try to resolve them. 

The Department of Local Affairs (DOLA) oversees the Mobile Home Park Act. We partner with DOLA to share information to protect public health and ensure residents have a livable environment. DOLA and their Dispute Resolution and Enforcement Program is a useful resource for public drinking water system operators to know about. 

What does DOLA regulate at mobile home parks?

In 2019, the state legislature passed the Mobile Home Park Act, setting up a state registration program for mobile home parks and a complaint program. The Mobile Home Park Oversight Program within the Department of Local Affairs (DOLA) oversees the Mobile Home Park Act, registers mobile home parks, and runs the Dispute Resolution and Enforcement Program. 

Program activities include:

• Receiving and investigating complaints.
• Facilitating dispute resolutions between mobile home owners and their mobile home park managers. 
• Determining whether violations of the law have occurred and issuing a Notice of Violation when necessary.
• Registering all mobile home parks annually. 
• Conducting outreach and education on mobile home park laws, such as informing landlords of their responsibility to provide and pay for alternative sources of potable water and maintaining portable toilets no later than 24 hours after a service disruption begins, unless conditions beyond the landlord’s control prevent compliance.

Under the Mobile Home Park Act, “mobile homes” do not include camper coaches, camper trailers, fifth wheel trailers, motor homes, recreational park trailers, recreational vehicles, travel trailers, or truck campers. DOLA does not oversee these vehicles nor parks that rent space to these vehicles unless they also rent space to five or more “mobile homes” as defined in 8 CCR 1302-15-1.1.

What does CDPHE regulate at mobile home parks?

CDPHE is the regulatory authority under the Colorado Primary Drinking Water Regulations, Regulation 11(5-CCR 1002-11). Regulation 11 focuses on safe drinking water in accordance with the federal Safe Drinking Water Act. Our enforcement authority is limited to specific violations of Regulation 11, which does not address concerns with taste, odor, color or other issues that may not directly impact safety.

We regulate any entity that provides drinking water and meets the following criteria:

• Provides water to at least 25 people per day for at least 60 days per year or at least 15 service connections (trailers, buildings, etc) AND: 
• Has their own source of drinking water (well or surface water source); or
• Purchases water from another utility and they bill the residents specifically for water (e.g. their water bill fluctuates every billing cycle); or 
• Receives water from another utility and provides additional treatment to meet safety standards on site for the water.
• We do not regulate mobile home parks (or other entities) if:
• They receive water from another utility and do not bill the residents for water or water usage (e.g. included in rent, lease, or flat-rate utility billing).
• They do not serve water to at least 25 people per day for at least 60 days per year or at least 15 service connections.

What does this mean for water at mobile home park communities?

Most mobile home parks do not meet the criteria to be a regulated water provider. This means that the department does not have an inventory of these parks or regularly interact with them about drinking water. This typically leads to residents reaching out to DOLA or their local government when they have concerns about their water.

DOLA’s Dispute Resolution and Enforcement Program allows mobile home park residents, managers, and owners to file complaints about many different issues they may come across at the mobile home park. This includes issues with water safety, connection, and maintenance. DOLA then investigates the complaint and may issue a violation if necessary. Oftentimes DOLA’s investigation into water-related complaints turns up no concrete violation as the complaint stems from water smell, odor, or color which is not regulated by the department. 

In promoting a culture of health, we want to ensure that everyone has access to safe and enjoyable drinking water. We are building an open dialogue with DOLA so complaints and concerns they receive are addressed as quickly as possible to protect human health. We also share issues at mobile home parks we are alerted to so that DOLA can make sure the owner follows all required statutes for resident safety and livability.

For any disruptions of service, we will work with the public water system who provides water to the mobile home park or the certified water operator if the mobile home park is a regulated public water system.

State Revolving Fund can fund Water Rights Purchases!

At the end of 2019, EPA issued a class deviation to allow the drinking water state revolving fund (SRF) to finance the purchase of water rights. This is a big step forward!

Previously water rights purchases were only eligible in the SRF program for water system consolidation purposes. When the drinking water SRF program was established via amendments to the 1996 Safe Drinking Water Act, those amendments prohibited the use of SRF funds to purchase water rights. The reason for the prohibition was that EPA assumed the primary purpose for water rights purchases would be to supply future population growth. In statute, the SRF program does not allow funding projects where the primary purpose of the project is for future population growth.

However, in implementing the SRF program, the EPA began to receive requests for an exception to the water rights prohibition for projects where water rights purchases were required to protect public health. For example, a system may need to switch from an existing water source to a new source in order to ensure the system could reliably meet primary drinking water standards. In these situations, EPA agreed to issue a project specific deviation.

In the case of Oshkosh, Nebraska an EPA deviation was granted to fund water transfer permit fees to withdraw water from new wells in a different aquifer from existing ones that were contaminated with uranium and arsenic. This case is mentioned in the Policy and Technical Evaluation for a DWSRF Class Deviation for Purchase of Water Rights, EPA October 2019. The policy paper goes on to describe the conditions that must be met for an eligible project.

In summary, a SRF fundable water rights purchase must be for an existing population (not primarily for future growth), address a public health threat, be a cost-effective alternative, and need SRF funding to ensure the project proceeds. The 2022 SRF Eligibility Survey (Opened June 1st!) includes a question to indicate if your system may be planning for water rights purchases. Please include those projects in the survey. If you have any questions regarding funding water rights purchases through the SRF, or any other program questions please feel free to contact Mark Henderson at mark.henderson@state.co.us.

What Colorado Water Providers Need To Know About UCMR 5

UCMR stands for Unregulated Contaminant Monitoring Rule and it is a program that was developed with the amendments to the Safe Drinking Water Act in 1996. The program was established to monitor unregulated drinking water contaminants in a five year cycle that are chosen from the Contaminant Candidate List (CCL) and are known or anticipated to occur in public water systems. 

The latest installment, UCMR 5, was published in March 2021 and includes 30 new chemicals that will be monitored between 2023 and 2025. EPA is still accepting comments on the UCMR5 rule, and it will not be finalized until December 2021 so some things could change. The currently proposed list of chemicals include 29 per- and poly-fluoroalkyl substances (PFAS) and lithium. The systems that are required to participate in UCMR5 changed due to amendments in Section 2021 of America’s Water Infrastructure Act of 2018 (AWIA). The change requires that all systems within the 3,300 to 10,000 population range sample whereas in the past this population range was included in 800 randomly selected small systems under 10,000. Adding the additional systems will bolster the sample sets so EPA can make better informed decisions on regulating any of the tested contaminants in the future. The sample analysis cost will be paid for by EPA for all systems under 10,000 population, however, systems will be required to pull the samples and ship them to a designated laboratory. Prepaid sampling kits will be shipped to small systems under 10,000 people and will contain all of the necessary sampling equipment and instructions. If a system is surface water they are required to sample 4 times in an annual period and groundwater systems are required to sample 2 times within an annual period. Systems will receive their schedule from EPA for their starting year, month and week in which they begin sampling. Systems will have access to UCMR information and sampling tutorials on the state website in the near future.

Colorado has a Partnership Agreement (PA) with EPA to help with implementing UCMR. The PA identifies specific implementation activities for which State assistance may be provided. Colorado has agreed to review the State Monitoring Plan (SMP) and provide all water system inventory and contact information based on information in the Safe Drinking Water Information System (SDWIS). So please make sure we always have the most current information by updating your monitoring plans when you have changes. Participating systems will receive notices of initial requirements and the registration process for Safe Drinking Water Accession and Review System (SDWARS). SDWARS will be used for systems to sign their official notification letter, update their contact and inventory records in addition to monitoring their analytical results. Colorado will assist EPA in ensuring UCMR compliance by contacting PWSs concerning their monitoring responsibilities and addressing issues of noncompliance.

Participating water systems are subject to the Consumer Confidence Report (CCR) and the Public Notification (PN) rules. The CCR rule requires that community water systems report monitoring results when unregulated contaminants are detected. The PN rule requires that water systems notify the public that the results are available. All results will eventually be available to the public under Occurrence Data for the UCMR Rule. If a system has any additional questions they may contact the State’s UCMR Coordinator at daniel.romero@state.co.us.

Helping a rural school keep drinking water safe for kids

Cotopaxi School District RE-3 is a rural public water system serving over 290 children, staff, and visitors from Pre-K to adults. In 2017, the division conducted a sanitary survey inspection and identified a significant deficiency that could have led to a waterborne disease outbreak from the pathogens Giardia and Cryptosporidium. To confirm these findings, we assisted Cotopaxi School with a source investigation and determined that the water source needed filtration treatment. 

To help protect public health, the division working with Cotopaxi School: 

• Partnered with the Colorado School of Mines (CSM) to provide free engineering services via the CSM Capstone Program which provides senior level engineering students with real world project experience.
• Arranged for CSM student field trips to two different treatment plants near CSM so students could see functioning plants using different treatment technologies.
• Provided $25,000 in funding through the division’s assistance grant program to upgrade the treatment plant.
• Provided compliance assistance to help ensure that Cotopaxi School can conduct the required testing and reporting to maintain compliance with safe drinking water regulations. 
• Helped the school to create an emergency response plan that also included joining CoWARN. 

Upgrades were completed in 2020 and we will continue to monitor the system to make sure kids have access to safe water. Please see below for photos of their new treatment system.

Colorado’s Legislative Lead Sampling Program (2017-2020)

The Water Quality Control Division (Division) implemented the “Safe Water In Schools Act” for the period of July 2017 through June 2020 with legislative funding from HB17-1306 which helped schools with the cost of lead testing through grant funding. Lead testing in schools is especially important because of the increased risk of delays in physical and mental development, lower IQ levels, and brain damage in young children who may be exposed to lead. Because of the length of time children spend in schools and the serious health risks associated with lead exposure, it is critical that schools, particularly elementary schools, know if lead is present in their drinking water.

Under the Colorado Primary Drinking Water Regulations, Lead and Copper Rule (Regulation 11), regulated water suppliers are required to sample lead at designated sites which are typically single- or multi-family homes. A relatively small number of schools (42) are regulated as a public water system so they already test for lead in their facilities. These schools did not participate in the grant program. Similarly, some schools already tested for lead using the 1991 federal Lead and Copper Rule standards. Approximately 1,450 schools were eligible to participate in the legislative lead testing program.

During the state fiscal years of 2017-2020, 67 (41 Elementary and 26 non-Elementary) schools received funding for a total amount of $248,215.  The program funding supported sampling 3,877 fixtures that were tested for lead concentrations in drinking water.  The lead testing results were reported to be below the recommended action level of 15 parts per billion (ppb) in 3,731 samples (96.2%). The lead testing results reported above the recommended action level of 15 parts per billion (ppb) were 146 samples (3.8%). All testing results were provided to the local public health agency, the school’s water supplier, the school board, and the department as required by Section 25-1.5-203(1)(f)(IV), C.R.S. When samples exceeded the recommended action level of 15 ppb, grant recipients implemented corrective actions to reduce the lead exposure risk. These actions included replacing fixtures, taking fixtures out of service, shutting off valves, installing filters, or posting “Do Not Drink” signs.

The complete water quality test results are on the Water Quality Control Division’s historical state legislative lead testing program website. 

This program helped reduce lead exposure from tap water in participating schools. The data suggested that most of the lead action level exceedances are a result of fixtures, for which corrective actions are relatively inexpensive. The division sought and received a multi-year $1,200,000 Environmental Protection Agency Water Infrastructure Improvements for the Nation (WIIN) Grant to continue and expand testing at schools and daycare facilities. Funding will be provided to local public health departments and county governments to promote the program and facilitate testing in their local school districts. The EPA WIIN’s program is on hold due to COVID-19 closing down most schools while overwhelming local public health departments and local governments. The division is working with the EPA to extend the WIIN’s grant program and implement an effective strategy moving forward. This, along with the new lead and copper rule which requires water systems to test at schools, will continue to advance the goals of HB 17-1306.

Security: Roxborough Water and Sanitation emerged a champion of cybersecurity

In the Midst of a Ransomware Attack

Note: This article has been reposted with permission from Roxborough Water and Sanitation and Colorado Special Districts Property and Liability Pool (CSD). 

• Original article published on January 25, 2021 

• Learn more about CSD on their website 

At 4 a.m. on a Friday morning, Barbara Biggs, General Manager of Roxborough Water and Sanitation District, received word from the Director of Operations that they were in the midst of an ongoing cyberattack. This attack had started a few hours earlier when administrators overseeing the district network received an alarm alerting them to invasive action. As the day unfolded and the scope of the attack was fully realized, it became apparent that this was no simple hack—this was a ransomware attack. Their servers were encrypted and unusable, and the only way to get back online, it seemed, was to give in to the demands of cybercriminals.

First Steps

Initially, Barbara described her reaction to hearing the news as one of panic. Understandably, when the workday begins ahead of schedule with the discovery that water and wastewater treatment facilities, billing systems, and servers are all locked and encrypted, it is never a good thing. Although Barbara did not know who targeted the district—and still does not—she knew she was dealing with a ransomware attack from what she found on affected computers.

The urgency was apparent in the cybercriminals’ demands, as well as in the district’s need to make sure they could still operate as normal. As soon as they had discovered they had become the victims of an attack, the district’s operations team worked to swiftly and safely bring the water treatment plant and wastewater conveyance systems back online. “Our number one priority was making sure we could provide safe water and efficient wastewater treatment operations for our members,” Barbara explained.

Once at the plant, the team discovered that all the tools they typically used to automate processes were affected by ransomware. As a result, they had to revert to their procedures outlining how to operate manually. “We lost our automatic eyes to see the plant’s operations, so we kept our physical eyes on the plant,” Barbara said.

Barbara explained that she and her team were focused on ensuring that services went uninterrupted. “We had to perform manual calculation[s] for chemical doses. We had to physically drive around service areas to check tank levels visually,” she said. “We lost alarms, so we performed 24 hour drive-bys to make sure there were no problems. It took two weeks to get all alarms back online.”

After the Dust Settled

Once Barbara and her team were able to confirm that they could still function effectively and provide uninterrupted service to customers, the staff turned their attention to dealing with the ransomware. “My first reaction was to reach out to the [CSD] Pool and authorities,” she said.

By 10 a.m. that same Friday, Barbara was on the phone with Vicki Sullivan, the CSD Pool’s Member Relations Coordinator, as well as Sedgwick’s claims administration, and Norton Rose Fulbright US LLP, a law firm provided to the district by the CSD Pool’s free member resource, eRisk Hub, created by cybersecurity and industry experts at NetDiligence. Through the resources in NetDiligence’s eRisk Hub, Barbara was put in contact with a team of cyber coaches, which included a forensics investigation team, ransom negotiation experts, and a data recovery team.

“[The team provided by NetDiligence’s eRisk Hub] are literally the most responsive people I’ve worked with in my life. Their whole business is negotiating with these threat actors.”

Barbara was in communication with individuals from the CSD Pool and her contacts at Norton Rose Fulbright almost two times a day all the way through the following weekend. Shortly after contacting the CSD Pool, Barbara reported the cyberattack to the local Sheriff’s office, who sent it up the chain to the region’s Department of Homeland Security (DHS).

By 3:00 pm that same afternoon, Barbara received her first response back from DHS. The incident was also reported to the Federal Bureau of Investigation.

What Happened Next

As they waited for their network to come back online, Barbara and her staff worked hard to determine how to move forward with a compromised system. They came together as a team, outlined next steps, and, as they learned more about what had happened in this particular instance, developed strategies for preventing future cyberattacks, all while maintaining both support and communication with their customers. “We all pulled together and got through it; we tried to keep information flowing to the customers,” she said.

The cyber forensics investigation team determined there was no evidence that data had been stolen, just encrypted by cyberattackers, whose identities remain unknown. In addition to the damage wreaked on their operational infrastructure, Roxborough Water and Sanitation also discovered extensive harm done to their billing system.

“All we could do in the early weeks is put [the news of this event] on our website, Facebook page, and social media,” Barbara said. “Customers have been incredibly patient with us.”

They had to rebuild their billing system which contained thousands of accounts, working with a software company that was able to take the last billing reports and reverse engineer them to create a brand new billing system.

Moving Forward

As the team at Roxborough Water and Sanitation, along with countless other government entities and utility providers have learned, cybercriminals are ramping up their attacks on critical infrastructure. As a result, public entities are under increased pressure to prepare for and meet this threat.

“I think they target critical infrastructure because they know we have to operate. They know we have to absolutely get back online,” Barbara said. “I know they have been focusing on smaller water and wastewater utilities because we don’t have big IT departments.”

In many ways, Roxborough Water and Sanitation was maintaining adequate security procedures prior to the situation. Firewalls were kept up to date, virus protection was available on servers and emails, and some staff had been religious in shutting down and taking their devices offline at the end of day.  Other updates that have been implemented at the district include the addition of servers to ensure redundancy of the district’s systems.

Best practices have been expanded to include a robust password policy, full and current inventory of their environment, and tighter security surrounding online bill pay. They also regularly perform hard drive and cloud backups. “You have to have multiple backups because you don’t know how long [the cybercriminals] have been in your system,” Barbara said.

The Aftermath

Roxborough Water and Sanitation is back up and running—now stronger and more secure than ever. But this ordeal still has residual effects on the district. Through this experience, some internal vulnerabilities came to light at the district. This has led them to create new plans, procedures, and practices to better manage their systems going forward.

Above all, Barbara and her team at Roxborough Water and Sanitation understand firsthand how communication, education, and preparedness can make the difference when dealing with cybersecurity. Barbra finished by stating that “You may have to make sure people understand how critical it is.”

Simple Fixes: Avoiding Wellhead Issues

Sanitary defects associated with wellheads are among the most frequent findings cited by field service section staff during sanitary surveys. However, wellhead issues are often among the issues most easily corrected. So how can suppliers be proactive and avoid being cited for a wellhead sanitary defect finding in the first place, or worse - a waterborne disease outbreak?

First, be familiar with the following resources and refer back to them often:

• Drinking Water Policy DW010 provides examples of conditions at sources that are sanitary defects and could allow contamination to enter the source water. 

• Chapter 3 of the State of Colorado Design Criteria for Potable Water Systems (design criteria) specifies construction standards for groundwater sources. By reference, section 3.2.1.a of the design criteria requires that all wells must be constructed in accordance with the latest edition of the Division of Water Resources’ Water Well Construction Rules (2 CCR 402-2 Rules and Regulations for Water Well Construction, Pump Installation, Cistern Installation, and Monitoring and Observation Hole/Well Construction).

Next, regularly inspect and evaluate wellheads for sanitary defects.

What to check for and correct if found (the following wellhead conditions are not allowed):

• Well caps with missing or deteriorated seals or gaskets

• Well caps with loose or missing bolts

• Wellheads with broken electrical wiring conduits

• Cracks or holes in well casings or the well pad around well casings

• Improper grading around wellheads and/or standing water around well casings

• Wellheads that are in flooded well vaults or submerged under water (see above)

• Damaged screens on air vents (well caps with air vents must be properly screened)

Example 1 - Flooded Well Vault: The photo below shows a well and appurtenances in a Flooded Vault

Example 2 - Missing Seal or Gasket: The photo below shows a well cap without a gasket installed.

Example 3 - Broken Electrical Wiring Conduit: The photo below shows an example of a broken electrical conduit at a wellhead.

Example 4 - Unsealed Electrical Supply & Missing Air Vent Screen: The photo below shows a well with an unsealed electrical supply and missing a vent screen.

Example 5 - Damaged Air Vent Screen: The photo below shows a well with a damaged air vent screen.

During a sanitary survey, the supplier’s groundwater wells will be visually inspected during the onsite inspection portion of a sanitary survey. When wellhead sanitary defects are discovered during sanitary surveys they will be cited as significant deficiencies. Suppliers can avoid this by proactively inspecting groundwater sources on a regular basis and promptly fixing any sanitary defects identified.

Conclusion: Unprotected or improperly maintained wellheads can provide a pathway for contamination to enter the source water and can be a source of contamination. Protection of groundwater sources is a critical part of the multiple barrier approach to providing safe drinking water and is a safe and effective way of protecting our communities and promoting a culture of health.

Does your well have sanitary defects? If so, suppliers should proactively identify and promptly correct the sanitary defect(s) that were identified, before they are cited as significant deficiencies during sanitary surveys.

Please reach out to the field services section at cdphe_wqcd_fss_questions@state.co.us with any related questions.

Guidance & Resources: 

• Sanitary Defect Policy DW010

• State of Colorado Design Criteria for Potable Water Systems

• Division of Water Resources’ Water Well Construction Rules (2 CCR 402-2 Rules and Regulations for Water Well Construction, Pump Installation, Cistern Installation, and Monitoring and Observation Hole/Well Construction)

• DNR Division of Water Resources’ Well Construction & Inspection Resources

➽ by Monique Morey, PE, field services section