NFPA 99 Risk Assessment – PLEASE READ THIS

Q: I need to do the NFPA 99 risk assessment of my hospital. I was told by one of my consultants that I have do this risk assessment from a room-by-room perspective, and he provided me a form from ASHE that lists this assessment by room-by-room. Is this true…? Do I have to do this assessment for each room?

A: No… that’s not correct. Yes, ASHE does have a form that does imply a room-by-room assessment is needed for the Chapter 4 risk assessment, but that’s not required by Chapter 4. What is required is an assessment of building systems based on a defined risk assessment procedure. Chapter 4 does not define the risk assessment procedure that you should use, but the Annex section does identify three risk assessments that they suggest, and the ASHE room-by-room assessment form is not included in these three suggestions. To be sure, you may use the ASHE form if you wish, but then you can use any risk assessment form that you want.

The core of the risk assessment is to determine what level or category the following building systems falls under, in the event of a total catastrophic failure of that system:

  • Gas & Vacuum Systems
  • Electrical Systems
  • HVAC Systems
  • Electrical Equipment
  • Gas Equipment

There are 4 levels or categories:

  • Category 1:    Systems in which failure is likely to cause major injury or death of patients or staff
  • Category 2:    Systems in which failure is likely to cause minor injury to patients or staff
  • Category 3:    Systems in which failure is not likely to cause injury to patients or staff
  • Category 4:    Systems in which failure would have no impact on patient care or staff

The process in the assessment is to determine the level of risk to the patient or staff if there is a catastrophic failure of that particular system. Another way of saying this is “Worst case scenario”.

As an example, let’s take the hospital’s electrical system: The risk assessment must assume a catastrophic failure of the entire system. The normal power system fails, and then the emergency power system from the generators fail. In other words, you have no power whatsoever in the building. Now, what is the level of risk to your patients? It will probably be Category 1, right?

You then do that type of catastrophic failure risk assessment for each of the above listed systems. If you want, you can break this down into different assessments of systems that are the same type. Such as HVAC systems: If the HVAC system fails in patient care areas, then that would be a certain high-level of risk to the patients. But if the HVAC system fails in the Administration wing, it would not be a risk to your patients, and it would be a low risk to your staff.

For hospitals, the expectation would be all of the above systems would be assessed as a Category 1 or Category 2. But for a medical building that only has physician offices and administrative support areas, the expectation is the above systems would be assessed as a Category 3 or Category 4. All healthcare facilities must be assessed for the risk level to patients and/or staff.

You have to document your assessment using a defined process. You can down-load a simple one-page risk assessment from my website and see if that meets your expectations.

The ironic thing is, the NFPA 99-2012 Technical Committee on Chapter 4 did not intend for this risk assessment to be conducted on existing systems. I talked with two members of that committee and they said the committee believed it was obvious the way it is written that this risk assessment is only required for new construction, since most (not all) of NFPA 99 is for new construction.

But CMS did not get that message and they require all of their state agencies and accreditation organizations to evaluate the risk assessment during all surveys. In other words; They fully expect all CMS certified healthcare organizations to have the Chapter 4 risk assessments completed by now.

In my opinion, this risk assessment does not require a lot of time to conduct. As I said, CMS expects all hospitals to have Category 1 or Category 2 systems. This is something you and your staff can do.

Just last week I received a call from a friend of mine who is a facility manager in the Midwest. He returned from a regional ASHE meeting where one of his fellow facility managers was recently surveyed by a leading accreditation organization (AO). The surveyor for the AO cited them for not doing their NFPA 99 risk assessment in accordance with the ASHE form, and do a room-by-room assessment. Please understand that this surveyor was incorrect to make that citation.

There is no NFPA requirement, no CMS requirement, and no AO requirement for healthcare organizations to do a room-by-room assessment to be in compliance with Chapter 4 of NFPA 99-2012. As mentioned above, you can use whatever risk assessment format you wish. The only requirement is the risk assessment must be documented and the surveyors will expect it to be reasonable (meaning all systems in a hospital are Category 1 or Category 2 systems).