|
|
March 2025 Edition
The Pennsylvania Department of Environmental Protection (DEP) Bureau of Safe Drinking Water provides updates, information, and reminders in this edition of the Drinking Water News.
In this issue:
- Understanding DEP’s One-Hour Reporting Requirements
- Making Modifications? You Need a Permit
- Seasonal System Reminders
- Tier 1 Public Notification Requirements for Lead Action Level Exceedances
- Cybersecurity Corner: Is Your Organization at Risk of Phishing Attacks?
Your feedback and suggestions can be submitted to dagrube@pa.gov.
| |
|
| Understanding DEP’s One-Hour Reporting Requirements
John Cairnes, Compliance Specialist, DEP Southeast Region
| |
In a perfect world, water treatment plants would always work smoothly, and there would be no issues with water quality or distribution. However, in reality, problems can occur, and public water suppliers must handle these issues carefully to maintain safe drinking water. The Department of Environmental Protection (DEP) helps water systems deal with problems and respond to incidents that could affect water quality and public health. To help in these situations, water suppliers are required to notify the DEP within one hour if they become aware of problems that might affect water safety.
The DEP regulations outline several situations where water suppliers must notify the DEP, such as when drinking water standards are violated or there’s a risk of a problem affecting water quality. Not all of these situations will lead to violations, but reporting them to the DEP quickly can help prevent or minimize any issues. This could include things like a lab report showing contamination, a treatment plant breakdown, or a water main break. Water suppliers need to assess any situation that could affect the quality or safety of drinking water and decide if it meets the criteria for reporting.
When notifying the DEP, it’s important to speak directly to a person, not leave an email or voicemail. If you’re reporting after hours, you may need to call the emergency response line. Be ready to provide details about the incident, such as the cause and any corrective actions being taken. While it might seem like an extra step during an emergency, notifying the DEP helps ensure you receive the right guidance and support to solve the problem and stay compliant with regulations.
| |
| Making Modifications? You Need a Permit.
Gina Kellett, Compliance Specialist, DEP Northeast Region
| |
Public water system permits are official documents issued by DEP that allow public water suppliers to build and operate public water systems in Pennsylvania. These permits ensure that systems are built to meet safety standards and provide safe, clean drinking water to customers.
Permits are also required for any changes made to an existing water system. When a modification is needed, a permit amendment must be issued by DEP. There are two types of permit amendments: major and minor. A major amendment is needed for significant changes, like adding new water sources or changing treatment processes. A minor amendment is for smaller changes, such as altering treatment chemicals or replacing tank linings.
If you're unsure whether your modification requires a major or minor amendment, contact your local DEP office for guidance. Detailed information about permit requirements can be found in Subchapter E of 25 PA Code Chapter 109, Safe Drinking Water regulations.
Source: (25 PA Code Chapter 109, Subchapter E. Permit Requirements)
| |
| Seasonal System Reminders
Kim Bennett, Compliance Specialist, DEP Southwest Region
| |
With spring just around the corner, most seasonal water systems are preparing to open. Whether you are operating a food or snack bar at the local pool, or a summer camp, making sure your water system is prepared to open helps protect your customers.
A seasonal water system is defined as “a noncommunity water system that is not operated as a public water system on a year-round basis and starts up and shuts down at the beginning and end of each operating season.” Before opening each year, seasonal water systems must follow specific steps, including completing their Seasonal System Start-Up Procedure. Start-Up Procedures should be completed 1 to 3 weeks before the season start date. Start-Up Procedures for seasonal systems should include steps on shocking and flushing the system. Start-Up Procedures should also include steps on routine maintenance for disinfection treatment and other treatment components like water softeners, cartridge filters, and pressure tanks.
After completing the steps outlined in the Start-Up Procedures, seasonal systems must collect at least one Seasonal Start-Up (Type-A) sample within 30 days prior to the season start date from the sample tap(s) designated in the Start-Up Procedures. It is important to ensure samples are collected at the appropriate taps within the designated timeframe or the system will incur a violation that requires public notice.
If any of the Type-A sample results are coliform-positive, the steps in the Seasonal Start-Up Procedures need to be completed again, and another set of Type-A samples must be collected. Seasonal systems cannot operate and provide water to the public until the Type-A sample results are coliform-negative.
Once a set of Type-A sample results is coliform-negative, seasonal systems must complete the Seasonal Start-Up Certification Form, and submit it to their local DEP District Office prior to opening for the season. Failure to provide this certification to DEP before the season start date is a violation that requires Public Notification.
If a seasonal system changes its opening or closing date, a revised certification form must be submitted to DEP. This will allow the Department to adjust the season dates in PADWIS.
It is important for seasonal systems to also remember to collect routine (Type-D) coliform samples in each month the system is operating, even if the Type-A samples were collected in that first month. For example, a system with seasonal dates of June 15 to October 1 that collected the Type-A samples on June 4 still needs to collect a Type-D sample between June 15 and June 30. Additionally, this system needs to remember to collect a Type-D sample on October 1 prior to closing for the year. Failure to collect the Type-D samples in June and October will result in missed monitoring violations that require Tier 3 Public Notification.
Contact your DEP Sanitarian if you have any questions to avoid unnecessary violations.
| |
| Tier 1 Public Notification Requirements for Lead Action Level Exceedances
Sabrina Haydt, Water Program Specialist, DEP Central Office
| |
Starting October 16, 2024, any Community Water System (CWS) or Nontransient Noncommunity Water System (NTNCWS) with lead levels above 15 µg/L (ppb) must give a Tier 1 Public Notice (PN) within 24 hours.
Why is a Tier 1 PN required?
Lead is harmful at any level, so when a water system exceeds the lead limit, it must act to protect public health. A Tier 1 PN lets customers know about the problem so they can make informed health decisions. This rule is part of the federal lead and copper regulations updated in 2021.
When to issue the Tier 1 PN?
The PN must be sent within 24 hours of the water system learning about the lead problem. It must be given to:
- People using the water system
- The EPA at LeadALE@epa.gov
- The Pennsylvania Department of Environmental Protection (DEP). Use form 3930-FM-BSDW0560 to find the right DEP office.
- Also, within 10 days, water systems must confirm they’ve sent the notice and attach a copy. This can be done with form 3930-FM-BSDW0076.
When does the 24-hour clock start?
The clock starts when the water system receives an email from DEP about the exceedance. It’s important for DEP to have the correct email address for your system.
What must the Tier 1 PN include?
The PN must have:
- What happened
- When the lead exceedance occurred
- Health warnings for lead
- Whether alternative water supplies are needed
- What consumers should do
- What the system is doing to fix the problem
- When the system expects to resolve the issue
- A statement to share the notice
- Templates and instructions are available here: PN Templates
How to deliver the Tier 1 PN:
For CWS:
- Hand delivery
- Email
- Phone call systems
- Another method approved by DEP
CWS must also use media to notify transient and nontransient customers.
For NTNCWS:
- Hand delivery
- Email
- Posting in public places
- Another method approved by DEP
Important Note:
Many water systems must test for lead and copper in 2025, so it’s wise to prepare in case of an exceedance. Large systems especially need a plan to notify all customers within 24 hours.
For more information, read the EPA Fact Sheet.
| |
| Cybersecurity Corner: Is Your Organization at Risk of Phishing Attacks?
Scott Alderfer, Water Program Specialist, DEP Central Office
| |
Many computer users, especially in the utility sector, know about phishing. Cybersecurity experts warn that there are several types of phishing attacks that can give hackers access to a Public Water System’s (PWS) systems. Phishing tries to trick users into opening harmful emails, visiting infected websites, or responding to fraudulent messages, according to the Department of Homeland Security. Below are six common types of phishing threats targeting public water utilities' IT and Operational Technology (OT) systems.
| |
| HTTPS Phishing
“https://” in a URL used to mean a website was safe. Now, it can be used in phishing to trick users into visiting fake websites that look real. Phishing emails might ask you to open attachments or click links leading to malicious sites. To avoid this, don't trust attachments and avoid suspicious links.
Quishing (QR Phishing)
Quishing uses fake QR codes to trick victims into visiting harmful websites or downloading malware. Scammers may make you feel urgent to scan a QR code. To stay safe, only scan QR codes from trusted sources, check the link preview on your phone’s camera, and double-check URLs for mistakes.
Pharming
Pharming uses malicious code to redirect you to fake websites that look like real ones, like banking or shopping sites, to steal passwords or personal information. Always be cautious when typing sensitive information online.
Smishing
Smishing uses fake text messages to steal sensitive information or install malware. Texting has become a common target for cybercriminals, so be cautious of unexpected messages asking for information.
Spear Phishing
Spear phishing is a targeted attack, where the hacker customizes their message for a specific person or organization. These attacks are very convincing because they seem familiar and relevant to the recipient.
Whaling
Whaling targets high-level executives with emails, texts, or phone calls to trick them into authorizing large payments or sharing sensitive information. Attackers often pretend to be senior management to gain trust.
| |
Protecting Water Systems
Cybersecurity is crucial for water utilities as they are vital to public health and national security. Stay alert and teach staff about cybersecurity practices to protect IT and OT systems. The EPA offers a free cybersecurity assessment to help identify weak spots. Learn more at Cybersecurity Assessments | US EPA.
| |
Pennsylvania Department of Environmental Protection, 400 Market Street, Harrisburg, PA 17101
| |
|
|
|
|
|
|
