Canadian officials have declared the outbreak over there but the U.S. has added seven people in two states to its count Wednesday.
"The likely source of the outbreak in the United States appears to be leafy greens, but officials have not identified a specific type of leafy greens eaten by people who became ill," the CDC said in a statement Wednesday.
And acting too soon to blame one particular crop might leave people at risk in case it turns out something else, or something additional, is spreading the bacteria, Williams said.
"One of the things we worry about is we don't know the source of contamination," Williams said in an interview with NBC News.
"How do you know it's over? Without knowing the source, it's hard to know."
Canadian health authorities said they'd traced the bacteria to romaine lettuce but have not identified the actual source, such as a farm or distribution center.
Related: FDA starts sweeping food-related reforms
"We haven't linked this to a specific food," Williams said. "Not everyone says they had romaine. Some people said they have. Some people said they haven't."
But the CDC and the Food and Drug Administration have come in for some heavy criticism from Consumer Reports, which acted on its own to warn people not to eat romaine, and from Connecticut Rep. Rosa DeLauro, who accuses the agencies of endangering people.
"CDC's stunning lack of guidance to consumers regarding this outbreak is unconscionable," said DeLauro, a Democrat who serves on a food safety subcommittee in the House.
"When it comes to food safety, American consumers deserve more than this slow and insufficient response. Families from coast to coast have been affected by this most recent outbreak, and many more are now left wondering if the food they are eating is safe," she added.
Just last month, the Office of Inspector General at the Health and Human Services Department said the FDA does not always work fast with food recalls.
"FDA did not always have an efficient and effective food-recall process that ensured the safety of the Nation's food supply. Specifically, we found that the FDA could not always ensure that firms initiated recalls promptly," the report reads.
Consumer groups have often criticized the FDA, saying they think the agency is far too cozy with the companies it regulates. The FDA says it's far better to get companies to trust them and cooperate.
But in this case, it's just too soon to blame any single farm or distributor, Williams said.
Genetic fingerprinting shows the E. coli strain that has sickened people in the U.S. is the same strain that made more than 40 people ill in Canada and killed one.
Related: FDA expands recalls in 2015 due to E. coli
"What we have been doing: step one is reaching out to the people who are ill," Williams said.
"We ask about foods they ate, places they ate in during the week before they got sick," he added. "Where did you have it? Did you have it at home, have it in a restaurant, get it in a grocery store?"
But because it's been weeks, it can be hard to remember. And not everyone who got sick remembers having ever eaten romaine lettuce or even eating raw leafy greens, Williams said.
Not everyone who gets sick goes to a doctor, either, and not every doctor takes a stool sample to see what's causing the illness. Plus, lettuce has a short shelf life, meaning almost all samples that could be tested have been tossed out by now.
"We are trying to connect what people may have had in common across the entire country."
So many, many more people could have been infected but the CDC doesn't have the material it needs to help track down the source.
The cases are scattered across 15 different states from coast to coast: California, Connecticut, Illinois, Indiana, Maryland, Michigan, Nebraska, New Hampshire, New Jersey, New York, Ohio, Pennsylvania, Virginia, Vermont and Washington.
"We are trying to connect what people may have had in common across the entire country," Williams said.
So far, the CDC has found out enough to know that no single point of sale, such as a grocery store or restaurant, is involved. So now they have to trace it back further, to a distributor or perhaps even to a single farm somewhere.
Foodborne illnesses are extremely common. The CDC estimates that each year, 48 million Americans are made sick by a foodborne illness. Of those, 128,000 are sick enough to be hospitalized, and 3,000 die.
E. coli is only one of many causes. It can get into food when someone touches it, when it goes through processing equipment, or at a farm, perhaps if it mixes with some other contaminated source such as water used to clean off a whole batch of produce.
"Contamination can take place any time, from farm to fork."
It's almost impossible to wash off something like E. coli from a lettuce leaf and sometimes it's taken up inside the leaf itself.
"Contamination can take place any time, from farm to fork," Williams said.
In 2006, an outbreak of E. coli in spinach was eventuallytraced to wild pigs that had wandered through fields of fresh produce in California.
If a similar situation caused this outbreak, then a fresh wave of E. coli cases could be looming, said Williams.
Romaine lettuce, for instance, is being harvested now in California and Arizona.
"How do you know the field next door didn't get contaminated also, and it's now starting to get harvested?" he asked.