Author(s): Michael Crowley. Published on January 3, 2017.

Defining Risk

What health care providers, facility designers, and enforcers need to know about the risk-based approach of NFPA 99


July 5 was the first day that health care facilities across the country were required to comply with the 2012 edition of NFPA 101®, Life Safety Code®, as well as the 2012 edition of NFPA 99, Health Care Facilities Code. As reported in NFPA Journal and elsewhere, the move followed a four-year effort by the U.S. Centers for Medicare & Medicaid Services (CMS) to update the safety codes and standards for the facilities it oversees, which include all hospitals, nursing homes, ambulatory surgical centers, and related facilities that accept federal Medicaid and Medicare reimbursement. The CMS adoption of NFPA 101 and NFPA 99 means it can levy severe financial penalties and even shut down facilities that do not follow the codes. CMS field use and surveys utilizing the new criteria began November 1.

While the update from the 2000 edition to the 2012 edition of NFPA 101 is a significant one for thousands of health care facilities, the move from the 1999 edition of NFPA 99 to the 2012 edition presents an additional wrinkle, namely in the use of what’s known as “risk categories” to determine the level of protection required. Previous editions of NFPA 99 used occupancy type as the basis to determine the level of protection or type of system to provide. A major trend in health care delivery, however, has been to move procedures and treatments out of acute-care settings such as hospitals and into buildings or spaces with flexible use, such as office buildings and ambulatory care facilities. The 2012 edition of NFPA 99 allows for flexibility and cost savings for hospitals by matching the types of equipment and systems to the risks posed to patients by the procedures being provided rather than the building occupancy type where those procedures take place. Some new ambulatory care facilities and business occupancies containing facilities that provide health care procedures may see increases in cost. Under the new risk-based approach of NFPA 99, requirements matching the procedures will now require providers (who are also sometimes referred to as owner/operators), designers, and authorities having jurisdiction (AHJs) to discuss new projects based on the safety of patients and caregivers. Occupancy-based protection requirements have been deleted.

Chapter 4 of NFPA 99 addresses the risk and requires a risk assessment for new construction and equipment. Existing construction and equipment will need to follow the inspection, testing, and maintenance (ITM) of the risk category associated with the existing system or equipment. Existing systems or equipment may need evaluation to determine the proper risk category. The risk assessment will evaluate systems or equipment and help users assign one of four risk categories:

CATEGORY 1 is for facility systems or equipment in which failure of such equipment or system is likely to cause major injury to or death of patients or caregivers. Related text in Annex A describes the technical committee’s intent for major injury.

CATEGORY 2 is for facility systems or equipment in which failure of such equipment or system is likely to cause minor injury to patients or caregivers. Related text in Annex A describes the technical committee’s intent for minor injury.

CATEGORY 3 is for facility systems or equipment in which failure of such equipment or system is not likely to cause injury to patients or caregivers but can cause discomfort.

CATEGORY 4 is for facility systems or equipment in which failure of such equipment or system will have no impact on patient care.

A specific risk assessment method is not mandated in NFPA 99. Any method the provider is comfortable with is acceptable, but it must be a defined procedure and must be documented. Different systems or equipment serving the same area may have different risk categories assigned based on the risk assessment. CMS has indicated it will not require the submittal of risk assessments for review. However, if there is an issue or a question about construction features provided in the facility, the risk assessment will be a key document.

The CMS adoption of the 2012 edition of NFPA 99 omitted Chapters 7, 8, 12, and 13. CMS stated it did not have jurisdiction over Chapter 7 (information technology and communication systems), Chapter 8 (plumbing), and Chapter 13 (security management) and will not regulate those areas. Chapter 12 (emergency management) was deleted and replaced with a later CMS rule that included emergency management requirements that were published on September 16. While the deleted chapters are not required for CMS conditions of participation (CoP), they nevertheless contain important information regarding telecommunication/information technology, nurse call, grey water, black water, grease traps, security vulnerability assessments, security equipment, and security operation. Consider these chapters as added resources if you need to address those topics.

Other notable changes in the 2012 edition of NFPA 99 include the removal of anesthetizing location ventilation to prevent the recirculation of smoke, though NFPA 90A, Installation of Air-Conditioning and Ventilating Systems, is still required for the proper HVAC detection and control. In addition, all operating rooms are now considered wet-procedure locations, and electrical systems must be designed to address the wet-procedure designation; a risk assessment conducted by the health care governing body can be used to mitigate the wet-procedure definition. Also, health care laboratory requirements have been removed, and NFPA 45, Fire Protection for Laboratories Using Chemicals, is referenced for laboratory requirements.

Specific changes aside, it is the adoption of the new risk-based requirements of NFPA 99 that will likely generate the most questions in the coming months. The answer to the question “What do I need to do to comply?” depends on your role in the health care facility environment. To get you headed in the right direction, I can offer some preliminary guidance for three key groups—providers, designers, and AHJs.

Procedures and risk:

Providers are responsible for the day-to-day operations, renovations, additions, and new construction of health care facilities. They also must know the procedures planned for the facilities.

Providers typically employ health care engineers or facility managers, as well as project managers and construction managers, who are responsible for new construction or additions and the people who may be charged with developing or conducting risk assessments. This can be assigned to the designer, but the provider must offer the worst-case scenarios for procedures or treatments in the new construction or addition. Clinical staff should be consulted to confirm the type of procedures planned for the facility.


How a qualitative risk assessment is based on a few simple questions. Using a series of yes-or-no questions can be an effective health care facility risk assessment if the parties involved understand the procedures that will be performed in the facility, as well as the equipment or systems that will be used for those procedures.

In the event of a system loss, does a patient die?
YES The procedure is a Category 1 risk.
NO The next question to ask is...

In the event of a system loss, is a patient injured?
YES The procedure is a Category 2 risk.
NO The next question to ask is...

In the event of a system loss, does a patient experience discomfort?
YES The procedure is a Category 3 risk.
NO The next question to ask is...

In the event of a system loss, is there no impact on a patient?
YES The procedure is a Category 4 risk.

Limiting the types of procedures allowed is an option available to the owner/operator, and policies for controlling or limiting the types of procedures should be documented for future use. NFPA 99 allows the flexibility to limit the procedure type and thereby reduce the risk category. A Category 1 system in general will be more robust and expensive than a Category 2 system, and if the provider can limit the procedures, a lower risk category can be used.

The introduction of new procedures to an existing facility must be accompanied by a risk assessment. The newly introduced procedure may increase the risk category, such as moving from a Category 3 risk to a Category 2. This increase in risk will require compliance with the higher risk category for existing or new systems and for equipment associated with the new procedure. Risk assessment documentation for new equipment, procedures, and systems should include but not be limited to the risk assessment method and the persons or groups involved with the assessment. The conclusion of the risk assessment should be clearly stated with any assumptions or limitations listed. This process can be done in house or in concert with the designers.

Existing equipment or systems can pose unique challenges. Existing systems not in strict compliance with NFPA 99 are permitted to be continued in use as long as the AHJ has determined that such use does not constitute a distinct hazard to life. The extent and application of the NFPA 99 risk assessment methods for existing equipment or systems are not directly spelled out by the code, though Chapters 5 through 11 contain requirements stating which sections apply to existing equipment and systems. In general, these are the ITM and operational requirements.

Existing equipment or systems may never have had a risk category assigned, so to provide the correct risk category designation and resulting requirements, the provider will have to evaluate the existing system. This evaluation should determine the equipment or system arrangement and compare it to NFPA 99 requirements for Category 1, Category 2, and Category 3 levels of risk. A simple example would be to review the medical air system. If the system is not merely a single path supply and has the capability of redundant or parallel process, it is probably a Category 1 system, meaning the equipment’s ITM requirements need to match that level of risk. It was not the intent of NFPA 99 to require upgrades to existing systems unless the risk to patients has changed via a new procedure or as a result of new equipment.

Documentation for determining the existing equipment or system risk category should be retained unless you are following the Category 1 existing requirements. All the required ITM documentation must be available for AHJ review. For acute-care facilities such as hospitals, the ITM requirements and documentation have not changed from previous editions of the code. NFPA 99 still references the requirements for NFPA 10, Portable Fire Extinguishers; NFPA 13, Installation of Sprinkler Systems; NFPA 25, Inspection, Testing and Maintenance of Water-Based Fire Protection Systems; and NFPA 110, Emergency and Standby Power Systems.

The need for collaboration:

The 2012 edition of NFPA 99 also requires a new approach on the part of most designers of health care facilities. The requirements based on a risk assessment require an evaluation of the equipment or system and a determination of the risk posed by worst-case procedures, a process that should involve the provider, including clinical staff. Designers may be presented with the risk assessment by the provider, thus minimizing their involvement with the risk category determination. Designers involved with the risk assessment would offer the provider insight into the design options available and the cost implications of a lower risk category. Designers for new equipment and systems have the opportunity to reduce cost or provide flexibility to the provider based on their input into the risk assessment process. Once the risk category is determined and documented, the designer can select the category of equipment or system required for the facility. Facility design discussions will now include the provider (including clinical staff) and the designer for many more systems and equipment than under previous editions of NFPA 99. Collaboration will be needed on medical gas, vacuum, electrical distribution systems, electrical equipment, gas equipment, HVAC, and more.

Chapter 6 (electrical systems) has addressed the risk by adding new definitions on types of patient rooms. A critical care room, for example, is considered a Category 1 risk; a general care room is a Category 2 risk; a basic care room is a Category 3 risk; and a support room is considered a Category 4 risk. Type 1, Type 2, and Type 3 essential electrical systems correspond to risk categories 1, 2, and 3. The code allows a risk category assessment by room.

In the case of expansion of existing equipment or systems, designers will need to research the existing equipment or system to determine the existing risk category. Chapters 5 through 11 address the expansion of equipment and systems. The new portion of the equipment or system will comply with the requirements for new construction. A risk assessment will be required for the new section. Depending on the work, upgrades may be required in the existing system or equipment.

Designers should turn over any risk evaluation documentation for new or existing equipment or systems to the provider. Designers can also assist the provider in updating and revising a risk assessment already in place. New and expansion design documents should identify the risk category used for the system design. While CMS is not requesting the submittal of the risk assessment, local AHJs may require the risk assessment as part of the design submittal—you should check with the local and state AHJs for submittal requirements. Specific limitations should be listed and provided to the owner for Category 2 and 3 systems. This is not a requirement but would be helpful documentation for future changes or AHJ inspections.

Understanding risk

The new health care requirements will also affect AHJs. CMS is setting the requirements for conditions of participation, and most state licensing entities will follow the same rules. Local building departments will follow the reference requirements for the local building codes. In some cases, the referenced edition of NFPA 99 may be different from the 2012 edition required by CMS; in general, the most stringent requirements will apply unless the AHJ agrees to the CMS criteria.

Local AHJs may not have extensive experience with the application of the 2012 edition of NFPA 99. The local AHJ may have adopted all chapters of NFPA 99, which would require that facilities also be in compliance with Chapters 7, 8, 12, and 13, which are omitted under CMS requirements. For new construction, the local AHJs will have more oversight. Ongoing operation will require the AHJ to review the ITM documentation. CMS has not requested documentation submittal to review the risk assessment, but the local AHJ will most likely request the documentation to support the proposed new designs. CMS requires risk assessment documentation and expects it to be available during inspections.

AHJs should know that Chapters 14 and 15 do not require a risk assessment. Chapter 14 (hyperbaric facilities) covers new installations, ongoing operation requirements, and the documentation required to demonstrate compliance. (There are two levels of systems: one for single-patient hyperbaric chambers and one for multi-person chambers.) Chapter 15 (fire protection features) is a collection of requirements for the reference standards such as NFPA 10 and NFPA 13. The focus of Chapter 15 is on fire protection features that have presented compliance issues in the past. A section on fire loss prevention in operating rooms has been expanded to address fire prevention and emergency procedures. Orientation and training for the operating staff on operating room fires is new. Documentation of this training should be available to the AHJ.

AHJ inspections of acute-care facilities will not change significantly under the new referenced edition of NFPA 99. The required documentation will change to reflect the newly adopted reference standards. Documentation requirements for the equipment and systems solely regulated by NFPA 99 for acute care facilities will remain similar to previous editions. Fire loss prevention in operating rooms and emergency procedure requirements addressing operational criteria for use of flammable germicides and antiseptics are new.

The AHJ inspections for new non-hospital health care facilities will require an understanding of the various risk categories. Merely looking at the building occupancy type will not provide adequate information to determine the type of equipment or systems required by the 2012 edition of NFPA 99.

MICHAEL CROWLEY is a vice president of Jensen Hughes and chair of the NFPA 99 Correlating Committee. Top Photographs: Thinkstock