We already know that pools are gross, but hotel pools and hot tubs are especially gross, the Centers for Disease Control and Prevention reported today. In fact, the water can be so contaminated that it’s been making thousands of Americans sick.

The CDC sorted through nearly 500 outbreaks linked to pools, spas, and waterparks that made more than 27,200 people sick and killed eight people between 2000 and 2014. Roughly one-third of those outbreaks were traced back to hotels, motels, inns, and lodges, according to the CDC’s Morbidity and Mortality Weekly Report. That means that the managers at vacation spots still have to do better at keeping their aquatic facilities clean. And the public can help by remembering one simple rule, the CDC says: “Don’t swim or let your kids swim if sick with diarrhea.”

More than half of the outbreaks linked to hotel pools and spas were confirmed to be infections. Culprits included bacteria like Legionella, which can cause a dangerous pneumonia or a less-severe flu-like illness when people inhale contaminated water droplets, and Pseudomonas, which can cause skin rashes and swimmer’s ear when people touch tainted water. The other major culprit was a parasite called Cryptosporidium, which causes contagious diarrhea when people swallow water that has infected poop in it.

Outbreaks occur when these bugs escape the killing powers of chemical disinfectants. Chlorine and bromine are usually enough to kill Legionella and Pseudomonas, but these bugs can survive in dirty pools by forming a tough layer of gooey sludge known as a biofilm — especially when the disinfectants aren’t strong enough. The hardest to kill, though, is Cryptosporidium. At the concentrations of chlorine the CDC recommends, most bugs die in minutes, but Crypto can survive for more than seven days, the CDC says.

The best way to stop Crypto is to prevent contamination in the first place, which means stopping people with diarrhea from getting into the water. Local public health departments as well as the CDC have been working to raise awareness, and the good news is that it seems to be working: while outbreaks of Cryptosporidium climbed between 2000 and 2007, they plateaued after that. Skin rashes caused by Pseudomonas also seem to be dropping.

However, from 2000 to 2014, the number of diagnosed Legionella cases went up. That could be because public health officials and clinicians might be better at spotting infections with this particular bug. But it could also be because the number of people vulnerable to Legionella — people over 50, with compromised immune systems, or with lung disease — is climbing.

To be extra safe, the CDC recommends that people who know they’re at risk for Legionnaires’ disease avoid hot tubs. The CDC also suggests that swimmers do their own mini inspection before getting in the water, using chlorine and acidity tests you can buy at a pool supply store. But you have to wonder why this is up to the swimmer.

“State and local communities individually determine design, construction, operation, and maintenance standards for public pools, hot tubs, and water playgrounds,” Michele Hlavsa, chief of CDC’s Healthy Swimming Program, told The Verge in an email. And communities can “voluntarily adopt” the CDC’s guidelines for keeping recreational water facilities healthy and safe, Hlavsa says. Still, given the regular reminders the CDC sends out about how gross pools, spas, and water parks are — all these measures don’t seem like enough.