NFPA 99 Risk Assessment in Health Care Facilities

Shaine Grogan

With the construction of health care facilities, the risk is too high to not have a thorough understanding of NFPA 99

Share this post

NFPA 99, Health Care Facilities Code is frequently misunderstood or misapplied. For those in planning, design and construction of health care facilities, the risk is too high to not have a thorough understanding of NFPA 99 for proper application of the code.

NFPA 99 establishes risk-based criteria to help ensure health care facility compliance and protect patients, staff, and property from fire, explosion, and electrical hazards. The code is applicable to all health care facilities other than home care. The term “health care facility” must not be confused with occupancy classifications and is defined by NFPA 99 as “buildings, portions of buildings, or mobile enclosures in which medical, dental, psychiatric, nursing, obstetrical, or surgical care is provided.”

The Centers for Medicare & Medicaid Services (CMS) requires health care facilities to comply with the 2012 edition of NFPA 99 with exception to Chapter 7 (Information Technology and Communications Systems for Health Care Facilities), Chapter 8 (Plumbing), Chapter 12 (Emergency Management), and Chapter 13 (Security Management).

Scoping of NFPA 99 – New vs. Existing Systems

The scoping in NFPA 99 clarifies that the intent of the code including Chapter 4 Risk Assessments, is to apply predominantly to new construction and new equipment. However, the 2012 edition of NFPA 99 Section 1.3.2.3 also states, “an existing system that is not in strict compliance with the provisions of this code shall be permitted to be continued in use, unless the authority having jurisdiction has determined that such use constitutes a distinct hazard to life.”

Where existing systems and/or components of existing systems are altered, renovated or modernized, only the work being performed is required to meet NFPA 99 – unless the work adversely affects the existing performance of a system or component, in which case, upgrades would be required. Clearly the documented Chapter 4 Risk Assessments are required for all new systems and renovations, however, applicability to existing systems is determined by each AHJ.

Risk Categories

Chapter 4 of NFPA 99 establishes categories of building systems in health care facilities based on the risk of injury to the patients and caregivers. These risk categories are critically important to proper application of NFPA 99, just as occupancy classifications are in NFPA 101, Life Safety Code®.

A risk assessment is conducted to determine the applicable risk category (category 1-4) for each system. The risk categories are defined as:

  • Category 1 – Facility systems in which failure of such equipment or system is likely to cause major injury or death of patients or caregivers
  • Category 2 – Facility systems in which failure of such equipment is likely to cause minor injury to patients or caregivers
  • Category 3 – Facility systems in which failure of such equipment is not likely to cause injury to patients or caregivers but can cause patient discomfort
  • Category 4 – Facility systems in which failure of such equipment would have no impact on patient care

Risk Assessment Methodology

Health care facilities should define their risk assessment methodology to ensure coordination is happening in the planning/early design phases. As stated in the CMS Final Rule, the submission of a formal risk assessment is not required, but CMS will confirm that facilities are using risk assessment methodologies. The Final Rule further clarifies that they do not require the use of any particular risk assessment procedure.

NFPA 99 Section A.4.2 proposes risk assessments to follow procedures such as those outlined in the following: ISO/IEC 31010, Risk Management – Risk Assessment Techniques; NFPA 551, Guide for the Evaluation of Fire Risk Assessments; and SEMI S10-0307E, Safety Guidelines for Risk Assessment and Risk Evaluation Process. In addition to these references, the American Society for Health Care Engineering (ASHE) offers a risk assessment tool.

Early coordination is necessary to ensure that building systems and components are designed to appropriately meet the health care facility’s needs. This includes the establishment of a multidisciplinary team with knowledge of the facility’s space use, patient care services, clinical practices and other areas to ensure the design appropriately considers the risk category that will be applicable for the life of the building system. For example, if a health care facility builds a new outpatient medical building, the patient care services could be limited based on the designer’s determination of the risk category per NFPA 99.

Let Us Help with Your Facility’s Risk Assessments

Our team at Jensen Hughes works with health care facilities and includes members on the NFPA 99 committee. Learn more about how Jensen Hughes can support your project or facility in implementing risk assessments.

Headshot of Shaine Grogan

About the author

Shaine Grogan
Shaine has six years of experience in the fire protection engineering and construction industry.

Get in Touch

By completing the above form and checking this box you confirm that you have read, understood and accept our Privacy terms as well as our Cookie terms. Read our Privacy Policy.

Jensen Hughes ensures non-discrimination in all programs and activities in accordance with Title VI of the Civil Rights Act of 1964. If you need more information or special assistance for persons with disabilities or limited English proficiency, contact the Jensen Hughes Compliance Team at 410-737-8677 or compliance@jensenhughes.com. 

More blog posts from Jensen Hughes


Preventing Surgical Fires in Operating Rooms

Dec 1, 2022

Imagine waking up in a post-anesthesia care unit (PACU) after you just went under for a normal, routine surgery only to be told that a fire occurred while you were under anesthesia.

Read more
Cybersecurity Tips for the Holiday Season

Nov 30, 2022

The time of year is quickly approaching when our thoughts shift to family, friends and enjoying all that the holiday season brings. Unfortunately, cyber-criminals know this as well.

Read more
Police Staffing Analysis: A Strategic Window into Resource Allocation

Nov 29, 2022

City government leaders and police executives across the country are regularly challenged by the seemingly simple question: “How many officers does your police department need to fulfill its mission?”

Read more