Disinfection Byproducts in Your CCR

Disinfection byproducts (DBPs) form when the chemicals used to treat drinking water react with naturally occurring organic matter, and they appear in the Consumer Confidence Report of nearly every system that uses chlorine or chloramine. Two groups — total trihalomethanes (TTHM) and five haloacetic acids (HAA5) — have federal maximum contaminant levels and carry mandatory health-effects language that utilities are required by law to include whenever measured levels exceed those limits.

What disinfection byproducts are

Disinfection byproducts are chemical compounds produced as an unintended side effect of water treatment. When disinfectants such as chlorine, chloramine, or chlorine dioxide contact the organic matter naturally present in source water — leaf tannins, algae, soil particles — they react and produce a family of trace compounds.

Two groups dominate federal regulation:

Total trihalomethanes (TTHM) — the sum of four compounds: chloroform (trichloromethane), bromodichloromethane, dibromochloromethane, and bromoform. Each is a trihalomethane; the CCR reports their combined concentration. (40 CFR § 141.2 defines TTHM; Stage 2 DBPR monitoring at 40 CFR Part 141 Subpart V)

HAA5 — the combined concentration of five haloacetic acids: monochloroacetic acid, dichloroacetic acid, trichloroacetic acid, monobromoacetic acid, and dibromoacetic acid. (40 CFR § 141.2)

Both are regulated under 40 CFR Part 141: Stage 1 Disinfectants and Disinfection Byproducts Rule (D/DBPR) at Subpart H, and the more stringent Stage 2 D/DBPR at Subpart V. The statutory chain runs from the Safe Drinking Water Act 1996 amendments (Pub. L. 104-182) through the America's Water Infrastructure Act of 2018 (AWIA, Pub. L. 115-270) to the 2024 CCR Rule Revisions (89 FR 46013, May 24, 2024).

How they get into drinking water

DBP formation depends on three variables: the type and dose of disinfectant used, the amount and character of organic matter in the source water, and the time that water spends in the distribution system after treatment.

Surface water supplies drawn from rivers or lakes typically carry more natural organic matter than groundwater, so surface-water systems tend to produce higher DBP concentrations. Seasonal variation matters too: higher organic loads in late summer and fall, combined with warmer water temperatures, drive DBP formation upward even when disinfectant doses stay constant.

Utilities manage DBPs through treatment modifications — enhanced coagulation to remove organic precursors before disinfection, switching from free chlorine to chloramine for distribution-system residual, or adjusting contact time. But complete elimination is not a practical goal: the disinfectant residual that prevents microbial contamination is required by regulation at the point of delivery. The result is a trade-off between microbial protection and DBP exposure that the regulatory framework is designed to balance. See the related page on chlorine residual in your CCR for how disinfectant residual levels are reported and regulated separately from DBP byproducts.

Health effects

The CCR rule at 40 CFR § 141.154 and its Appendix A require utilities to include specific health-effects language whenever TTHM or HAA5 levels exceed the applicable MCL. The following text is required verbatim under Appendix A to Subpart O of Part 141.

Required health-effects language for TTHM (40 CFR § 141.154, Appendix A):

Some people who drink water containing trihalomethanes in excess of the MCL over many years may experience problems with their liver, kidneys, or central nervous systems, and may have an increased risk of getting cancer.

Required health-effects language for HAA5 (40 CFR § 141.154, Appendix A):

Some people who drink water containing haloacetic acids in excess of the MCL over many years may have an increased risk of getting cancer.

These statements appear only when monitored levels exceed the MCL. When levels are below the MCL, utilities report the measured concentration alongside the MCL in the contaminant table, but the boilerplate health-effects paragraph is not triggered. The CCR pillar page has a full overview of what goes into the annual report.

The MCLs and how compliance is measured

The current MCLs under the Stage 2 D/DBPR are:

| Contaminant | MCL | Basis | |---|---|---| | TTHM | 80 µg/L | Locational Running Annual Average (LRAA) | | HAA5 | 60 µg/L | Locational Running Annual Average (LRAA) |

(40 CFR § 141.64(b)(2) for Stage 2 MCLs)

Under Stage 2, compliance is measured using the Locational Running Annual Average (LRAA) rather than the Running Annual Average (RAA) used under Stage 1. The distinction matters because it changes where the compliance obligation attaches.

How LRAA works: each individual monitoring location must independently meet the MCL. The LRAA at a given site is the arithmetic average of the four most recent quarterly measurements taken at that site. If any single location's LRAA exceeds 80 µg/L for TTHM or 60 µg/L for HAA5, the system is in violation — even if the system-wide average is below the limit.

Why this is more protective than RAA: under Stage 1's Running Annual Average, a utility could average a high-DBP location against a low-DBP location and stay in compliance at the system level while one neighborhood's tap water consistently exceeded the MCL. The LRAA eliminates that offset: every monitoring site stands on its own. (71 FR 388, January 4, 2006 — Stage 2 D/DBPR final rule)

Monitoring frequency depends on system size and source water type, but most community water systems using surface water or systems with a history of elevated DBP levels monitor quarterly at each location. The LRAA is recalculated with each new quarterly sample, rolling off the oldest of the four values. Systems with consistently low DBP levels may qualify for reduced monitoring (annual rather than quarterly), subject to primacy agency approval. (40 CFR § 141.626 — Stage 2 monitoring requirements)

Reading the CCR table: when you see TTHM or HAA5 in your CCR's regulated contaminant table, the value reported is the highest LRAA from any individual monitoring location in the system. This is the number compared against the MCL for compliance purposes.

Stage 1 vs Stage 2 D/DBPR

The disinfection byproduct rules were promulgated in two phases.

Stage 1 D/DBPR (1998) — codified at 40 CFR Part 141 Subpart H. Stage 1 set the same MCLs still in use today (TTHM 80 µg/L, HAA5 60 µg/L) but measured compliance using a system-level Running Annual Average. A utility calculated one RAA across all its monitoring locations and compared it to the MCL. Stage 1 also introduced Maximum Residual Disinfectant Levels (MRDLs) for chlorine (4.0 mg/L), chloramines (4.0 mg/L as Cl2), and chlorine dioxide (0.8 mg/L). (40 CFR § 141.65)

Stage 2 D/DBPR (2006) — finalized at 71 FR 388 (January 4, 2006), codified at 40 CFR Part 141 Subpart V. Stage 2 replaced system-level RAA compliance with the locational LRAA standard, requiring each monitoring location to individually meet the MCL. Before Stage 2 compliance phased in, systems completed an Initial Distribution System Evaluation (IDSE) to identify the locations with the highest DBP concentrations — those became the compliance monitoring sites under the new rule.

The MCL numbers themselves did not change between Stage 1 and Stage 2. What changed was the compliance method: the shift from RAA to LRAA made the rule geographically precise rather than system-wide. California water systems and all other community water systems have been operating under Stage 2 LRAA compliance since their applicable compliance dates, which phased in from 2012 through 2014 depending on system size. (40 CFR § 141.620 — compliance dates)

What utilities must disclose on the CCR

Under 40 CFR § 141.153 and the reporting requirements in Subpart O (§§ 141.151–141.156), utilities must include the following in their annual Consumer Confidence Report:

Contaminant table entry. TTHM and HAA5 must appear in the regulated contaminant table with: the contaminant name, the unit of measure (µg/L), the MCL (80 µg/L for TTHM; 60 µg/L for HAA5), the MCLG (TTHM MCLG is 0; HAA5 MCLG is 0 — 40 CFR § 141.54), the highest LRAA detected during the reporting period, the range of individual monitoring results, and the likely source of the contaminant. (40 CFR § 141.153(d))

Health effects language. If measured levels exceed the MCL, the verbatim boilerplate from 40 CFR § 141.154, Appendix A is required (see the "Health effects" section above). If levels are below the MCL, the boilerplate is not required but may be included voluntarily as educational context.

Violation notice. If a system exceeded the TTHM or HAA5 LRAA MCL at any monitoring location during the reporting year, the violation must be prominently disclosed, including the dates of the violation, the contaminant and MCL, the potential health effects, and the corrective action taken. (40 CFR § 141.153(d)(6)–(8))

Disinfectant residual disclosure. A separate entry in the CCR must cover the disinfectant used and its residual concentration, governed by the MRDL framework rather than the MCL framework. This is reported alongside but distinct from the DBP table entries. See the MRDL glossary entry for how disinfectant residuals are classified and disclosed.

The 2024 CCR Rule Revisions (89 FR 46013) did not change the TTHM or HAA5 MCLs or boilerplate language, but they added the requirement for a mandatory summary section at the start of each CCR under § 141.156. If a system had any DBP MCL exceedances during the year, that information is expected to surface in the summary section as well. (40 CFR § 141.156(a))

Last reviewed: 2026-05-03. Next scheduled review: every 6 months or when EPA updates D/DBPR.