It takes a lot to convince the US Environmental Protection Agency to limit how much of a toxin can legally show up in America’s drinking water. The threshold for determining probable human harm is very high, and even if harm is detected, the toxin has to show up in enough public water sources with enough frequency, and at levels sufficiently high, before the EPA considers it significant enough to regulate. And even after all the exhaustive studies are done, the decision ultimately comes down to “the sole judgment of the Administrator,” the head of the agency, who may or may not be swayed by the data.

Under the Safe Drinking Water Act, the EPA is responsible for determining when a chemical needs to be regulated in the US water supply, but it hasn’t added a new toxin to its list since 1996. (Even the Government Office of Accountability thinks that’s a sign of a broken system.) In the past two decades, tens of thousands of new chemicals have come onto the market, and plenty of others that pre-date 1996 have been discovered to harm human health.

For example, newly released lab results show perfluorooctanoic acid, or PFOA (an ingredient in Teflon, the chemical used to make non-stick cookware) is far more prevalent in American drinking water than previously thought. Exposure to PFOA has been linked to a range of health risks including cancer, immune system issues, and developmental problems in fetuses.

The EPA’s official estimate is that PFOA is in about 1% of US water supplies. A reanalysis by the same lab that helped the EPA reach that number did a reanalysis of the underlying data and found the real number is more likely in the 20% range. And about 28% of water supplies are contaminated with some member of the perfluorinated compound family.

In 2013, as part of the effort to decide whether to regulate six perfluorochemicals, including PFOA (and perfluorooctane sulfonate or PFOS, a widely used flame retardant), the EPA required every water authority nationwide serving more than 10,000 people to test for the compounds. The EPA hired three labs to perform the tests, including California-based Eurofins Eaton Analytical, which was responsible for about a third of the 36,000 total tests done at the time. Eaton Analytical’s results showed some contamination, but it didn’t look particularly widespread.

But it turns out that was because of the threshold the EPA was using; Back then, the EPA decided only samples that tested positive for 20 parts per trillion (ppt) or higher of PFOA should be counted and only 40 ppt or higher of PFOS, after deciding that was the lowest amount of the chemicals the labs could reliably detect in samples. But Eaton Analytical told the EPA it was able to test for the chemicals at much lower levels—as low as 2.5 ppt.

According to Andrew Eaton, the technical director of Eaton Analytical, the EPA’s PFOA and PFOS thresholds were set so high because the other two labs hired to do the testing in 2013 couldn’t reliably detect the chemicals at as low levels as his lab could. Eaton says those dramatic differences should have made the agency look harder for capable labs. “That should have given the EPA pause to say ‘Hmm, why were there such big differences here?’” Eaton told the Bucks County Courier Times earlier this month. “If you’re not seeing something because you looked too high, you’re not really doing your due diligence,” he said.

The lab recently went back and re-mined its 2013 data, using lower thresholds than the EPA previously said they wanted to hear about. That’s when they found that 20% of the samples contained the toxin, which means the EPA may be vastly underestimating how widespread contamination from this class of toxins really is.

Research also suggests that the toxins harm human health at much lower levels than the EPA threshold. According to David Andrews, a senior scientist at the Environmental Working Group, there is debate in the toxicology community as to whether, like lead, there is actually no safe level of exposure, particularly in children who can accumulate more of it than adults and where some studies have suggested an association with behavioral and developmental problems.

PFOA is not currently regulated by the EPA, so state or local governments aren’t required to test for them. The EPA does set a recommended maximum exposure level for PFOA at 70 parts per trillion. But it’s nonbinding: states can choose to comply or not. In New Jersey, the local environment department has set the “acceptable” level at 14 ppt, the most stringent in the country (there is a lot of PFOA in New Jersey’s drinking water—the Environmental Working Group calculated the EPA’s testing method would have missed 75% of the contamination in that state).

AP Photo/Mike Groll High levels of PFOA were found in the upstate New York village of Hoosick Falls in 2016. It had likely been in the water there for 30 years

PFOA and PFOS keep turning up in drinking water supplies in US towns and cities. Both are cancer-causing toxins, and in some cases, residents may have been drinking one or the other in their water supply for decades—like in Hoosick Falls, New York, where Teflon was long manufactured, and where a resident found high levels of PFOA in the drinking water. The EPA named the area New York’s newest Superfund site last year. Before that, PFOA was found to be heavily contaminating the groundwater in a cancer-riddled town in West Virginia, home to a large factory where Dupont made Teflon.

Contamination has been so widespread in the past, Andrews says, that “everyone in the US already has these chemicals in our blood. You really don’t want to add more to that.”

After years of debate and a major scientific report connecting PFOA to two cancers and several other serious diseases, the EPA was rumored to start regulating it this year. That hasn’t happened, and the policies of the people currently running the agency don’t bode well for a rule in the future. As the New York Times reports, a scientist who worked for the chemical industry now shapes policy on hazardous chemicals at the EPA. She has moved to change how risks from chemicals are evaluated, requiring the agency to look only at hazards associated with specific “conditions of use” of a chemical, rather than at all hazards posed by all routes of exposure to the chemical regardless of what it was used for. The change makes it harder to evaluate risk—and therefore to regulate—toxins like PFOA.

Eaton told Quartz he gave a presentation about his new conclusions to EPA employees this year. He says they agreed with him that their agency might have missed something. “EPA has seen the presentations—their initial reaction was, ‘Gosh, we set the reporting limits based on what the science told us at the time, and you’re right, we probably should have looked more closely at what the science told us about reporting limits.’”

EPA spokesperson Enesta Jones defended the EPA’s approach to the study, telling the Courier Times this month that the “EPA is aware that some laboratories are able to achieve [lower] reporting limits,” but that the limits were “established so that a national array of laboratories could meet them and were based on looking at the capability of multiple commercial laboratories.”

Jones said the EPA is expected to reach a decision about the toxin in 2021.