Preventing Cryptosporidiosis: Water and Outbreaks

Of all the parasites that make people sick, Cryptosporidium — the cause of cryptosporidiosis, often shortened to "crypto" — is almost purpose-built to cause waterborne outbreaks. It is shed in enormous numbers in the stool of an infected person or animal; the form it sheds, a tough little egg-like capsule called an oocyst, is infectious the instant it leaves the body; it takes only a tiny number of these oocysts to make someone ill; and, crucially, the oocyst shrugs off the chlorine used to disinfect drinking water and swimming pools. That single fact — chlorine resistance — is why crypto behaves so differently from most germs, and why it has caused the largest documented waterborne disease outbreaks in history, including the landmark 1993 outbreak in Milwaukee, Wisconsin. This page explains, in plain terms, why this parasite spreads so well through water, and exactly what you can do — at the tap, at the pool, on the farm, and at the sink — to keep yourself and your family safe.

The Hardy Oocyst
Why Chlorine Does Not Work
The Milwaukee 1993 Outbreak
Recreational Water: Pools and Splash Pads
Protecting Your Drinking Water
Person-to-Person and Daycare Spread
Zoonotic Exposure: Farms and Petting Zoos
Food-Borne Spread
Extra Precautions for Weakened Immunity
Practical Takeaways
Key Research Papers
Featured Videos

1. The Hardy Oocyst

To understand why Cryptosporidium spreads through water so effectively, you have to understand its travelling form: the oocyst. When the parasite completes its life cycle inside the gut of an infected person or animal, it packages itself into thick-walled oocysts, each only about four to six micrometres across — far too small to see, smaller than a grain of flour dust. These oocysts pour out in the stool, sometimes by the billions per day during the worst of the illness.

Three properties of the oocyst make it a near-perfect waterborne pathogen, and it is worth taking them one at a time:

It is infectious the moment it is shed. Many parasite eggs need days or weeks in soil or water to "ripen" before they can infect a new host. Cryptosporidium does not. The oocyst comes out of the body already fully mature and ready to infect the next person who swallows it. There is no delay, no safe window — fresh stool is immediately contagious.
The infectious dose is very low. You do not need to swallow many oocysts to get sick. Careful studies in healthy adult volunteers found that even small numbers of oocysts could establish infection, with the dose that infected half of the volunteers measured in the low tens to low hundreds of oocysts depending on the strain (DuPont and colleagues, 1995). In practical terms, a mouthful of contaminated water — even one that looks perfectly clear — can carry more than enough parasites to make you ill.
It survives for months in water and moist places. The oocyst's tough outer wall is a survival suit. In cool water, lakes, streams, moist soil, and on damp surfaces, oocysts can remain alive and infectious for weeks to months. They tolerate cold well and persist through a wide range of conditions that would quickly kill most bacteria and viruses.

Put those together — immediately infectious, takes very few to sicken you, and long-lived in the environment — and you have an organism almost designed to ride water from one person to the next. The only thing that would normally stop such a germ in a public water supply is disinfection. And that is exactly where Cryptosporidium has its most dangerous trick.

2. Why Chlorine Does Not Work

This is the single most important fact on the page, so it is worth stating plainly: Cryptosporidium oocysts are highly resistant to chlorine. They withstand the levels of chlorine routinely used to disinfect drinking water and to keep swimming pools and hot tubs clean — concentrations that rapidly kill almost every other waterborne germ, including the bacteria and viruses that cause most diarrheal disease. Chlorine is the workhorse of safe water, and against crypto it largely fails.

The reason lies in the oocyst's thick, layered wall, which shields the living parasite inside from chemical attack. In controlled laboratory work, Korich and colleagues (1990) compared several disinfectants and found that conventional chlorine and chloramine were strikingly poor at inactivating Cryptosporidium parvum oocysts, whereas ozone and chlorine dioxide were far more effective. Later studies confirmed that achieving meaningful kill with free chlorine requires concentrations and contact times far beyond anything practical for a swimming pool — on the order of many hours at pool-strength chlorine, which is why a single fecal accident in a pool can keep the water infectious long after the chlorine "should" have handled it.

Because chemistry alone cannot be relied upon, modern water safety controls Cryptosporidium by other means:

Physical removal by filtration. If you cannot kill the oocyst chemically, you can strain it out. Properly operated drinking-water treatment plants use coagulation, settling, and fine filtration to physically capture oocysts and remove them from the water before it reaches the tap. This is the primary defense for municipal supplies — and, as the Milwaukee story shows, when filtration falters the consequences can be enormous.
Ultraviolet (UV) light. UV disinfection does not poison the oocyst; it damages the parasite's DNA so it cannot reproduce and cause infection. UV is highly effective against Cryptosporidium at practical doses and has become a standard barrier in many water systems precisely because it works where chlorine does not.
Ozone. Ozone is a far more powerful oxidant than chlorine and can inactivate oocysts, which is why some treatment plants use it as an additional barrier.

The take-home message for the public is simple but important: the smell of chlorine in a pool, or the knowledge that tap water is "chlorinated," tells you the water is protected against most germs — but it does not mean it is safe from crypto. That protection comes from filtration, UV, and good practices, not from chlorine.

3. The Milwaukee 1993 Outbreak

If you want to understand why public-health authorities take Cryptosporidium so seriously, you only need one example: Milwaukee, Wisconsin, in the spring of 1993. It remains the largest documented waterborne disease outbreak in United States history, and it was, at its heart, a failure of water filtration.

During March and April 1993, one of the two treatment plants serving the city was producing water that no longer adequately removed Cryptosporidium oocysts — the filtration barrier had degraded, allowing oocysts that had entered the source water to pass through into the public supply. Because the parasite resists chlorine, the routine disinfection downstream did nothing to stop it. People across the greater Milwaukee area began drinking, brushing their teeth with, and cooking in water laced with infectious oocysts.

The scale was staggering. The investigation led by Mac Kenzie and colleagues, published in the New England Journal of Medicine in 1994, estimated that about 403,000 people developed cryptosporidiosis as a result. The implicated treatment plant was shut down on April 9, 1993, after which new cases dropped sharply — powerful confirmation that the water plant was the source. For most healthy residents the illness was a miserable but self-limited bout of watery diarrhea; but the outbreak was far from harmless. Thousands required hospital care, and follow-up work by Hoxie and colleagues (1997) documented dozens of deaths from the outbreak, concentrated among people with AIDS and other severe immune impairment — a tragic illustration of how a "stomach bug" for the healthy can be life-threatening for the immunocompromised (a theme explored on the Cryptosporidiosis in the Immunocompromised page). The economic toll was later estimated by Corso and colleagues (2003) at roughly $96 million in combined medical costs and lost productivity.

Milwaukee changed the way the United States regulates and monitors drinking water. It drove tighter rules on filtration performance and turbidity (water cloudiness, a proxy for how well a plant is removing particles), more rigorous monitoring for Cryptosporidium in source waters, and the broader adoption of additional barriers such as UV. The lesson is one of defense in depth: because no single step is perfect, safe water depends on layered protections, and a lapse in any one of them — here, filtration — can let a chlorine-proof parasite reach hundreds of thousands of homes.

4. Recreational Water: Pools and Splash Pads

While the Milwaukee disaster was about drinking water, the leading source of Cryptosporidium outbreaks in the United States today is recreational water — swimming pools, water parks, splash pads, hot tubs, and natural sites such as lakes and ponds. The same chlorine resistance that made the parasite so dangerous in a water main makes it the number-one cause of treated-pool-water outbreaks, because the chlorine that quickly clears other germs simply does not work fast enough against crypto.

The mechanism is uncomfortable but worth being honest about. A swimmer who is ill with cryptosporidiosis — or who recently was, and is still shedding oocysts — can release the parasite into the water, especially through a fecal accident or simply from trace fecal contamination on the body. Because oocysts resist chlorine and the infectious dose is so low, a single ill swimmer can contaminate an entire pool and infect many others who swallow even small amounts of water. Surveillance studies, such as the multi-state investigation reported by Hlavsa and colleagues (2007) and the recurring national outbreak summaries, repeatedly trace crypto outbreaks to pools and water playgrounds.

The good news is that prevention here is squarely in the public's hands, and the rules are simple and effective:

Don't swim — and don't let children swim — while sick with diarrhea. This is the single most important rule. One person following it can prevent an entire outbreak.
Stay out of the water for two weeks after diarrhea has stopped. People recovering from cryptosporidiosis can keep shedding infectious oocysts for weeks after they feel better. Waiting two weeks past the last episode of diarrhea protects everyone else in the pool.
Don't swallow the water. Teach children to keep pool, lake, and splash-pad water out of their mouths.
Take frequent bathroom breaks and change diapers in a bathroom, not poolside. Check young children often, and rinse off in a shower before getting in.

For pool operators, controlling crypto means more than maintaining normal chlorine: it relies on good filtration, and on hyperchlorination (raising chlorine to very high levels for an extended period) to decontaminate the water after a known fecal incident, because ordinary pool chlorine cannot do the job in any reasonable time.

5. Protecting Your Drinking Water

For the vast majority of people on a well-run public water system in the United States, tap water is safe, and the lessons of Milwaukee have made it safer still. But it is worth knowing how to protect your drinking water — both as a general precaution and, especially, if you have a weakened immune system or are dealing with a local "boil water" advisory after a treatment failure or flood.

Here is what actually works against Cryptosporidium, in order of reliability:

Boiling is the most reliable method. Bringing water to a rolling boil for one minute (longer at high altitude) reliably kills Cryptosporidium oocysts along with essentially every other waterborne pathogen. Heat is the parasite's clear weakness. If you are ever in doubt — during an advisory, while travelling, or if you are immunocompromised — boiling is the gold standard. Let the water cool, and store it covered.
Point-of-use filters rated for cyst removal. A filter can physically strain out oocysts, but only if it is fine enough. Look for a filter with an absolute pore size of about 1 micron or smaller, or one labeled "tested and certified for cyst removal / reduction" or to NSF/ANSI Standard 53 or 58 (reverse osmosis) for cyst reduction. A coarse pitcher filter sold only for taste and odor is not enough. Replace cartridges on schedule, because a clogged or bypassed filter offers false security.
The limits of chemical disinfection. This bears repeating in the drinking-water context: chemical disinfectants you might add to water — ordinary chlorine bleach and standard iodine tablets — do not reliably kill Cryptosporidium. They work against many bacteria and viruses, but the oocyst resists them. If you are treating questionable water and crypto is a concern, boil it or use a properly rated filter; do not rely on chlorine or iodine alone.

Bottled water from a protected source is another option when boiling and filtering are not practical. The overarching point is that crypto turns the usual advice on its head: against most germs, "disinfect it"; against this parasite, "boil it or filter it."

6. Person-to-Person and Daycare Spread

Water gets the headlines, but a great deal of cryptosporidiosis spreads the old-fashioned way: directly from one person to another by the fecal-oral route. Microscopic traces of stool from an infected person reach another person's mouth — on hands, on surfaces, on shared objects — and because the infectious dose is so low, it does not take much.

The classic high-risk setting is the daycare or childcare center, where diapered children, frequent diaper changes, shared toys, and developing toilet habits combine to move the parasite efficiently among children and the adults caring for them. Households with a sick family member, and anyone caring for someone with diarrhea, face the same route of spread.

Hand hygiene is the defense — but there is a critical catch that catches many people out:

Alcohol-based hand sanitizers do NOT reliably kill Cryptosporidium oocysts. The same tough wall that defeats chlorine also defeats alcohol gels. A squirt of sanitizer may give a false sense of cleanliness while leaving infectious oocysts on the hands.
Soap and water are what you need. Thorough handwashing with soap and running water physically removes oocysts from the skin and rinses them away. Wash for at least 20 seconds — especially after using the toilet, after changing diapers, before preparing or eating food, and after contact with anyone who has diarrhea.

For childcare settings, the practical rules follow directly: enforce rigorous soap-and-water handwashing for staff and children, change diapers in a dedicated area with a cleanable surface, clean and disinfect surfaces and toys appropriately, and keep children with diarrhea out of the center until they have recovered. Because oocysts can persist on surfaces, ordinary tidiness is not enough — deliberate hand hygiene is the linchpin.

7. Zoonotic Exposure: Farms and Petting Zoos

Cryptosporidium is not only a human parasite — it is also a zoonotic one, meaning it passes between animals and people. The species that most often infects humans, Cryptosporidium parvum, is common in young livestock, and contact with infected animals is a well-recognized route of human infection (Fayer, 2004).

The animals of greatest concern are young calves and other young livestock — lambs, goat kids, and the like — which are frequently infected and shed large numbers of oocysts. People become infected by getting traces of animal stool into their mouths after handling these animals or their environment. The classic settings are:

Farms and agricultural work, especially anyone caring for newborn calves during calving season, when scours (calf diarrhea) is common and often caused by crypto.
Petting zoos, county fairs, and farm-visit attractions, where children — who are most susceptible — pet animals and then put their hands in their mouths. Outbreaks have been repeatedly linked to such venues.

Prevention is, once again, mostly about hands. After touching animals or anything in an animal area, wash thoroughly with soap and water (not just sanitizer) before eating, drinking, or touching the face. Supervise young children closely at petting zoos, keep food and drink — and pacifiers, bottles, and sippy cups — out of animal areas entirely, and use the handwashing stations that well-run venues provide. Farmers handling sick calves should wear gloves and wash carefully, and should be aware that they can carry the parasite home to their families.

8. Food-Borne Spread

Less common than water, person-to-person, or animal spread, but real, is food-borne transmission. The pattern almost always traces back to the same fecal-oral principle: food becomes contaminated with oocysts somewhere along the way and is then eaten without a step that would kill the parasite.

The main routes are:

Fresh produce — fruits, vegetables, and leafy greens — that were irrigated or washed with contaminated water, or handled by an infected person, and are eaten raw. Salads and uncooked items carry the most risk because there is no cooking step to destroy oocysts.
An infected food handler who does not wash hands adequately after using the toilet and then prepares food others eat.
Unpasteurized ("raw") milk and apple cider, and shellfish harvested from contaminated water, which can concentrate oocysts.

The protective steps are the familiar pillars of food safety, now with a clear reason behind each: wash fruits and vegetables well under running water (recognizing that washing reduces but cannot guarantee removal of every microscopic oocyst); cook foods thoroughly when possible, since heat reliably kills the parasite; choose pasteurized milk and cider over raw; and insist on rigorous handwashing by anyone preparing food. People who are ill with diarrhea should not prepare food for others.

9. Extra Precautions for Weakened Immunity

For most healthy people, cryptosporidiosis is an unpleasant but temporary illness, and ordinary precautions are enough. But for people with a weakened immune system, crypto can become a severe, prolonged, even life-threatening infection — as the Milwaukee deaths so painfully showed. This group includes people with advanced HIV/AIDS, organ-transplant recipients on anti-rejection medication, people on chemotherapy or high-dose steroids, and those with certain inherited immune disorders.

If you or someone you care for falls into this category, it is reasonable to take extra, deliberate steps beyond the general advice above:

Take drinking water seriously. Consider boiling tap water for one minute for drinking and for making ice, especially during any local advisory, or use a filter properly rated for cyst removal (about 1 micron absolute / certified to NSF/ANSI 53 or 58 for cysts). Treat this as a routine habit, not just an emergency measure.
Avoid recreational water you might swallow — pools, water parks, splash pads, lakes, and rivers — where chlorine offers no protection against crypto.
Be especially careful around young livestock and petting zoos, and around anyone (including young children in diapers) who has diarrhea.
Wash hands rigorously with soap and water — remembering that hand sanitizer alone will not do — after the toilet, after animal contact, and before eating.
Favor cooked food and pasteurized drinks, and wash all raw produce carefully.

Anyone with a weakened immune system who develops persistent or severe watery diarrhea should seek medical care promptly, because in this group crypto warrants specific evaluation and management rather than watchful waiting. The companion pages on Nitazoxanide and Treatment and Supportive Care and Rehydration describe what treatment involves.

10. Practical Takeaways

There is a lot here, but it distills into a short, reassuring list. Cryptosporidium is genuinely good at spreading through water — yet because we know exactly how it does so, ordinary people can block almost every route with simple, low-cost habits:

Remember the headline fact: chlorine does not kill crypto. Filtration, UV, ozone, boiling, and soap-and-water are what work.
At the pool: never swim with diarrhea, wait two weeks after it stops, and don't swallow the water.
At the tap (especially if immunocompromised, or during an advisory): boil for one minute, or use a filter rated to about 1 micron / certified for cysts. Don't rely on chlorine or iodine drops.
At the sink: wash hands with soap and water — not just hand sanitizer — after the toilet, diaper changes, and animal contact.
On the farm and at petting zoos: keep food, drink, and hands-in-mouths away from young animals, and wash up thoroughly afterward.
In the kitchen: wash produce, cook food, choose pasteurized, and don't prepare food for others while you have diarrhea.

The story of crypto is a hopeful one in the end. Milwaukee was a catastrophe, but it taught a generation of water engineers and public-health officials precisely how this parasite gets through — and the layered defenses built since have made large drinking-water outbreaks far rarer. For your own household, the parasite's one great strength, chlorine resistance, is matched by a handful of equally simple defenses. Knowing which ones actually work is most of the battle.

Key Research Papers

Landmark outbreak investigations, disinfection studies, infectious-dose experiments, and waterborne-outbreak reviews on Cryptosporidium. Journal names appear as plain text; the year/volume/pages link opens the full citation via DOI.

Mac Kenzie WR, Hoxie NJ, Proctor ME, et al. A Massive Outbreak in Milwaukee of Cryptosporidium Infection Transmitted through the Public Water Supply. New England Journal of Medicine. 1994;331(3):161–167.
Korich DG, Mead JR, Madore MS, Sinclair NA, Sterling CR. Effects of Ozone, Chlorine Dioxide, Chlorine, and Monochloramine on Cryptosporidium parvum Oocyst Viability. Applied and Environmental Microbiology. 1990;56(5):1423–1428.
DuPont HL, Chappell CL, Sterling CR, Okhuysen PC, Rose JB, Jakubowski W. The Infectivity of Cryptosporidium parvum in Healthy Volunteers. New England Journal of Medicine. 1995;332(13):855–859.
Hoxie NJ, Davis JP, Vergeront JM, Nashold RD, Blair KA. Cryptosporidiosis-Associated Mortality Following a Massive Waterborne Outbreak in Milwaukee, Wisconsin. American Journal of Public Health. 1997;87(12):2032–2035.
Corso PS, Kramer MH, Blair KA, Addiss DG, Davis JP, Haddix AC. Costs of Illness in the 1993 Waterborne Cryptosporidium Outbreak, Milwaukee, Wisconsin. Emerging Infectious Diseases. 2003;9(4):426–431.
Checkley W, White AC, Jaganath D, et al. A Review of the Global Burden, Novel Diagnostics, Therapeutics, and Vaccine Targets for Cryptosporidium. The Lancet Infectious Diseases. 2015;15(1):85–94.
Hlavsa MC, Watson JC, Beach MJ (reporting CDC investigation). Cryptosporidiosis Outbreaks Associated With Recreational Water Use — Five States, 2006. JAMA. 2007;298(13):1507–1508.
Gharpure R, Perez A, Miller AD, Wikswo ME, Silver R, Hlavsa MC. Cryptosporidiosis Outbreaks — United States, 2009–2017. Morbidity and Mortality Weekly Report (MMWR). 2019;68(25):568–572.
Baldursson S, Karanis P. Waterborne Transmission of Protozoan Parasites: Review of Worldwide Outbreaks — An Update 2004–2010. Water Research. 2011;45(20):6603–6614.
Efstratiou A, Ongerth JE, Karanis P. Waterborne Transmission of Protozoan Parasites: Review of Worldwide Outbreaks — An Update 2011–2016. Water Research. 2017;114:14–22.
Fayer R. Cryptosporidium: A Water-Borne Zoonotic Parasite. Veterinary Parasitology. 2004;126(1–2):37–56.
Putignani L, Menichella D. Global Distribution, Public Health and Clinical Impact of the Protozoan Pathogen Cryptosporidium. Interdisciplinary Perspectives on Infectious Diseases. 2010;2010:753512.

Live PubMed Searches

Each link opens a live PubMed query so results stay current as new papers are indexed.

Back to Table of Contents

Connections