Vulnerability Assessment and Emergency Response Plan Updates Community Water Systems Serving Populations Greater Than 3,300 - Frequently Asked Questions

Q1: What is the background behind the Vulnerability Assessment (VA) and Emergency Response Plan (ERP) requirements? Why I am being required to update these documents?

A: Since 1990 Part 5-1.33 of the State Sanitary Code and Public Health Law §1125 required all community water systems with an annual operating revenue greater than $125,000 to prepare an ERP that included a vulnerability analysis to determine the vulnerability of water system components to a water supply emergency. In June of 2002, then President Bush signed similar legislation that required each community water system that serves 3,301 people or more to prepare a VA that addresses terrorist attack. On August 13, 2002, legislation was signed in New York that revised the public health law to require an analysis of vulnerability to terrorist attack.

Public Health Law §1125 and Part 5-1.33 of the State Sanitary Code requires community water systems with annual gross operating revenue in excess of $125,000 to comply. Consistent with the more recent federal and state legislations, an administrative decision was made to require ERPs and VAs under the State program for community water systems serving populations of 3,301 or greater. All community water systems serving population 3,301 or greater are required to submit VA/ERP to the Commissioner of at least once every five years and within thirty days after major water facility infrastructure changes have been made.

Q2: What sections of the VA and ERP should be updated?

A: Community water systems should review their VA and ERP to confirm that each plan contains accurate emergency contact information for management and staff, infrastructure, treatment techniques, service area and vulnerabilities. The VA should be revised to reflect which vulnerabilities have been corrected, and any vulnerability that has been identified since the VA was approved.

Q3: Who do I send copies of the updates to?

A: Copies of your VA and ERP should be sent to your local health department by certified mail, courier such as Federal Express, UPS, DHL, etc., or hand delivered. VAs are to be bound separately from ERPs. VAs and confidential versions of ERPs will contain security sensitive information and are to be prominently marked "CONFIDENTIAL" and "DO NOT COPY". VAs are not to be subject to public review under Part 5-1.33(d) nor released in response to FOIL requests. Your local health department will review your submittals and then forward these to the Bureau of Water Supply Protection for review and approval. Revisions should not be submitted to EPA.

Q4: Can I send my local health department copies of the VA and ERP by e-mail?

A: A water system may submit electronic copies for review purposes, but only if such copies are provided on compact disk or other physical information storage device, and are not transmitted by any means of electronic transmission (i.e., e-mail, internet, wireless, facsimile, etc.). No electronic versions of VAs or ERPs shall be accepted, required, requested or transmitted by the New York State Department of Health or local health departments.

Q5: There are very few changes to my VA and ERP. Do I need to send the entire documents, or will you accept only pages that have been updated?

A: It is important that your local health department and the Bureau of Water Supply Protection have the most current edition to review. If you have made significant content or format changes, or if you think it is possible that interim changes were made to your VA and ERP that were not forwarded to your local health department and the Bureau of Water Supply Protection, you should send new documents. If your VA and ERP require only minor content changes, you may be able to submit only those changes. Your local health department must determine if they can complete their review with only revised pages submitted. Please contact your local health department to discuss their policy.

Q6: My water system has implemented corrective actions for several of the vulnerabilities identified in our previous VA. Should I remove these items as vulnerabilities?

A: If your corrective action eliminated the vulnerability, it may be removed from your VA. If the corrective action mitigated, but did not eliminate the vulnerability, it should be noted as such in your VA.

Q7: What is the deadline to submit my VA and ERP?

A: Because VA/ERP submittal deadlines were set in Public Health Law for January 1, 2003, many water systems are due to submit revised VA/ERP to their local health department by January 1, 2013. All water systems are encouraged to update and resubmit their VA/ERP by this date, however your actual submittal deadline will depend on when you actually submitted your last VA/ERP and if there have been any significant modifications to your facility. Please contact your local health department if you are unsure of your submittal deadline.

Q8: Under the Federal Submission Requirements, I was required to submit a VA Certification to EPA by December 31, 2003 and an ERP Certification by June 30, 2004. Does this letter mean I have to submit VA/ERP updates to EPA?

A: No. Updated documents should not be submitted to EPA. All systems in New York State that were subject to the Public Health Security and Bioterrorism Act of 2002 are currently in compliance and EPA does not require updated VAs and ERPs be resubmitted.

Q9: My water system has recently constructed additional storage, and a water filtration plant. Do I need to rewrite my VA and ERP?

A: All water system infrastructures must be addressed in your VA and ERP. If you have made significant changes to your water system, it will be necessary to prepare a new VA and ERP. If you need assistance with completing your VA and ERP requirements, please contact your local health department. Assistance may be available through your local health department or the Bureau of Water Supply Protection.

Q10: I have only made minor changes to my VA and ERP. Do I need to make these changes available for public review and comment?

A: ERPs are to be provided for public review in accordance with the requirements of PHL §1125 and 10 NYCRR Section 5-1.33. However, the confidential volumes of ERPs are to be excluded from this public review. If you have made changes to the confidential volume of the ERP that carry over to the public review copy of the ERP, the public review copy of your ERP must be made available for public review in accordance with 10 NYCRR Section 5-1.33 (h). Please note that the VAs are not subject to public review.

Q11: Are confidential volume of the ERP or VA subject to public review or FOIL (Freedom of Information Law)?

Vulnerability Assessments and the confidential volumes of ERPs shall not be provided in response to Freedom of Information Law requests nor during formal public review under Part 5 1-33(d). Unauthorized disclosure of either of these confidential volumes is considered a security risk to the operation of the community water system, and shall be exempt from public review in accordance with 10 NYCRR Section 5-1.33(h).

Q12: I was not required to submit a VA and ERP previously, but I received this letter. Why do I have to complete a VA and ERP now?

A: The population for your water system is entered into a statewide database by your Local health department. This database accounts for the population your water system serves directly, as well as the population of any water system you sell to. If the sum of the populations that receive your water is greater than 3,300, you are required to complete a VA and ERP. Many areas of the State have experienced significant growth in the last several years, requiring that total populations served by community water suppliers be adjusted. If you received a letter from the NYS Department of Health or your Local Health Department about the need to update your VA and ERP and you believe these were sent to you in error, please contact your local health department.

Q13: I prioritized the actions and listed a scheduled date of completion in my previous VA. That date is since past, and the vulnerability has not yet been corrected. How should I address this in the update?

A: You should review your VA to determine if the completion dates listed are feasible. New estimated completion dates should be listed in the VA if the previous date has passed, and no corrective action has been made to the vulnerability.

Q14: My water system is operated by a regional water authority. The infrastructure associated in my water system was previously incorporated into the water authority's VA and ERP. Do I need to complete a separate VA and ERP for my own water system?

A: Contact the regional water authority to ensure all infrastructures from your water system is included in the water authority's VA and ERP. If the information is complete, there is no need for you to complete separate VA and ERP documents. Simply document to your local health department by letter or e-mail that your VA and ERP requirements have been satisfied by the regional water authority's VA and ERP.

Q15: My water system has recently been purchased by a regional water authority. I prepared my own VA and ERP in 2002, but I no longer own or operate the water system. Do I still need to update the VA and ERP?>

A: If the regional water authority now owns your water system, or is responsible for operation and maintenance via a lease agreement, information on your water system should be incorporated into their VA and ERP. Contact the regional water authority to ensure all infrastructure from your water system is included in the water authority's VA and ERP. Then, simply document to your local health department by letter or e-mail that your VA and ERP requirements have been satisfied by the regional water authority's VA and ERP.

Q16: Is there funding available to complete my VA and ERP updates?

A: No. Technical assistance may be available from your local health department, the Bureau of Water Supply Protection or New York Rural Water Association. Infrastructure improvements are eligible for reimbursement under the Drinking Water State Revolving Fund program and USDA Rural Development.

Q17: Do I need to submit a copy of my operation and maintenance manual with my VA and ERP?

A: If you have an operation and maintenance manual, it does not have to be submitted with your VA and ERP. If you do not have this manual it should be noted as a vulnerability in your VA and you should begin work on it as soon as possible.

Q18: Will the local health department or Bureau of Water Supply Protection provide my VA to EPA or USDA Rural Development to meet the VA requirements of their programs?

A: No. All water systems in New York State have met EPA's VA and ERP requirements. Under the document protection protocols followed by local health departments and the Bureau of Water Supply Protection, we cannot copy a VA and ERP on a water system's behalf to meet the VA or ERP requirements of outside agencies or lenders.

Q19: Where can I obtain a copy of the New York Rural Water Association VA and ERP templates?

A: Copies of the templates are available online from New York Rural Water Association. Templates are also available from the Bureau of Water Supply Protection and many local health department offices.