Applying NFPA 99 to health care facilities

The impact of applying NFPA 99: Health Care Facilities Code to hospitals and health care facilities, fire and life safety systems varies depending on the level of care provided.
By Chris Moran, PE; Eric Rosenbaum, PE; and Ajay Prasad, PE; JENSEN HUGHES June 30, 2017

This article is peer-reviewed.Learning Objectives:

  • Identify major changes to the 2015 edition of NFPA 99: Health Care Facilities Code that impact fire protection engineers.
  • Determine the impact of NFPA 99 on hospitals and health care facilities.
  • Learn about NFPA 99’s adoption by the Centers for Medicare & Medicaid Services (CMS) and how it affects fire and life safety requirements.

NFPA 99: Health Care Facilities Code identifies criteria applicable to heath care facilities including hospitals and nursing homes. The impact of applying NFPA 99 to health care facilities varies depending on the level of care provided. NFPA 99-2015 is the latest edition, but there are few changes from the 2012 edition focused on fire protection other than editorial revisions. NFPA 99-2012 is more widely used due to its adoption by the Centers for Medicare & Medicaid Services (CMS). Editions prior to the 2012 edition of NFPA 99 were limited in their application since they were not individually adopted by CMS. However, limited portions of NFPA 99-1999 were referenced by applicable CMS criteria. Changes to NFPA 99 from earlier editions to both the 2012 and 2015 editions will be discussed as they apply to fire protection and life safety, with changes specific to the 2015 edition identified in each section.

Figure 1: This flowchart illustrates a simple qualitative risk assessment approach based on yes/no answers to the level of patient and caregiver impact. All graphics courtesy: JENSEN HUGHESNFPA 99 has taken on a new level of importance in the past year due to the CMS issuance of CMS-3277-F, Medicare and Medicaid Programs; Fire Safety Requirements for Certain Health Care Facilities. The rule revised 42 CFR Parts 403, 416, 418, 460, 482, 483, and 485, which address program requirements for hospitals, long-term care facilities, ambulatory surgical centers, and others. The final rule became effective July 5, 2016, with enforcement beginning Nov. 1, 2016. As part of this rule, CMS adopted the 2012 editions of NFPA 99 and NFPA 101: Life Safety Code along with all associated tentative interim amendments (TIAs) issued prior to April 16, 2014. CMS reviews the fire and life safety provisions of the final rule through Form 2786, with K-Tags (deficiency number identifiers) starting with 900 being those applicable to NFPA 99 requirements.

NFPA 99 consists of 15 chapters, from general building requirements to criteria that affect the various building systems including fire protection systems. CMS does not require compliance with chapters 7 (information technology systems), 8 (plumbing systems), 12 (emergency management), and 13 (security management), as these chapters were not adopted in the final rule. CMS has enacted an emergency-preparedness rule (CMS-3178-F) in lieu of adopting Chapter 12, whereby compliance with the emergency-preparedness rule is required by Nov. 16, 2017. Where local jurisdictions do not require compliance with NFPA 99, the excluded chapters noted provide pertinent information in regards to designing and maintaining the building systems and could be used as a reference.

The risk assessment in NFPA 99

One of the changes to NFPA 99-2012 and later editions is the move to a risk-based approach for determining applicable requirements rather than the former prescriptive approach based on facility type. NFPA 99 now requires a risk assessment to determine the applicable risk category for each building system. The risk category is then applied to chapters 5 through 11 of NFPA 99 as appropriate for the system. The main focus is seen in Chapter 5 (gas and vacuum systems) and Chapter 6 (electrical systems). Although this requirement has caused concern, the process can be simple since the failure of the system is assumed without human intervention. Each building system is to be categorized into one of the following four categories:

  • Category 1—Systems in which failure is likely to cause major injury or death. Systems are required to be available at all times to support patient needs. Examples might include life-support ventilation equipment, emergency power for operating rooms, and medical-gas systems in intensive care units. Category 1 systems are likely to be found in intensive care units, operating rooms, delivery rooms, and areas dealing with general anesthesia.
  • Category 2—Systems in which failure is likely to cause minor injury. Systems are expected to provide a high level of reliability; however, limited failures can be tolerated without significant impact on patients. Examples might include cooling systems in the southern U.S., resident emergency-call systems, heating systems in the northern U.S., and lighting or potable water in patient-care areas. Category 2 systems are likely to be found in general-care rooms, such as inpatient bedrooms and dialysis rooms.
  • Category 3—Systems in which failure is unlikely to cause injury. Failure of the system does not have an immediate impact on patients or their safety. Examples might include cooling systems in the northern U.S., lighting and potable-water systems outside of patient-care areas and plumbing/sanitary systems. Category 3 systems are likely to be found in basic-care rooms, such as treatment or exam rooms.
  • Category 4—Systems in which failure has no impact on patient care. Examples might include lawn sprinklers, television service, and the public-address system. Category 4 systems are likely to be found in support rooms, such as waiting rooms and lounges.

The risk assessment is required to be performed by following and documenting a defined process, as described in NFPA 551: Guide for the Evaluation of Fire Risk Assessments  or ISO/IEC 31010: Risk Management – Risk Assessment Techniques. The process can be as simple as depicted in Figure 1. The process identified in Figure 1 is a qualitative approach based on yes or no answers for each building system’s impact. It does not address the probability of failure similarly to that used in NFPA 551 nor require in-depth knowledge of the systems and possible failures. It is important that those performing the assessment are knowledgeable in the procedures, equipment, and systems being evaluated. Appropriate personnel could include building engineers, caregivers, and administrators. Documentation of the risk assessment should include the risk assessment process used, all participants of the assessment, and all systems with assigned risk categories. CMS does not require the risk assessment to be submitted, but it is required to be kept onsite and available at the time of the survey. K-Tag 901 is used to cite a missing risk assessment. NFPA 99-2015 notes that the risk assessment does not have to be performed for any system assigned a Category 1 classification. Category 1 systems have the most stringent requirements; therefore, documentation is only required for those systems in lower-risk categories to show that those systems are appropriately assigned.

Existing facilities

Existing facilities will not see major changes with the application of NFPA 99-2015 with the exception of inspection, testing, and maintenance (ITM) requirements. In general, existing building systems are permitted to remain, even if they are not in strict compliance with the code, unless the authority having jurisdiction (AHJ) determines that their continued use constitutes a distinct hazard to life. This allowance of existing systems provides a basis that existing facilities do not have to upgrade their medical-gas/vacuum, electrical, and HVAC systems, along with other utility infrastructure, to meet the requirements of the new edition. The wording of this requirement leaves the AHJ with latitude to potentially require updates to building systems, such that facilities should review the status of their systems conservatively to ensure that no surprises occur during inspections. When systems are replaced, the systems may need to meet the requirements for new systems as noted in the applicable code(s). At the beginning of several chapters, including chapters 5 and 6, the code specifies which criteria are applicable to existing facilities. It is important that each facility identify which requirements are applicable, especially those relating to ITM, to ensure compliance with the code. Where a building has a mixture of new and old systems due to alterations and renovations, the determination of applicable requirements becomes more complex, and it is important that the basis for the determination is well-documented.

NFPA 99 requirements

Chapter 15 of NFPA 99 contains the fire protection requirements applicable to new and existing facilities. Most of the fire protection and life safety requirements are not specifically included in this chapter, but references are made to other NFPA codes including:

  • Facilities that contain laboratories using chemicals
  • The storage and handling of flammable and combustible liquids or gases
  • Elevators and emergency or standby power systems.

NFPA 99 also relies on NFPA 101, or the fire code enforced by the local AHJ, for building construction and compartmentation, fire alarm and smoke-detection systems, and fire suppression systems. This language was revised from NFPA 99-2012 to state “applicable code” in lieu of listing the various building and fire code possibilities.

NFPA 99-2015 specifies additional criteria for fire alarm systems in addition to those required by NFPA 101 or the local fire code. The majority of requirements in Section 15.7 are referenced from NFPA 101, and the requirements are reiterated for clarity. Each facility should confirm that these requirements do not contradict those within the local fire code. For example, NFPA 99 permits a single manual pull station where the fire alarm system monitors and activates automatically upon sprinkler waterflow or smoke detection. The local fire code may not include this exception, and the more stringent approach should be applied between the applicable codes.

NFPA 99-2015 states that in facilities with a defend-in-place response to a fire, the fire alarm and sprinkler zones should coincide with the smoke compartments of the facility unless otherwise specified in the facility fire plan. Notification signals provided through the fire alarm system should identify the floor and zone within the building so that it is clear where a staff response is required to support patient evacuation. Zoning these systems together simplifies the process of providing accurate information during a fire event.

Table 1: This table is a summary of NFPA 25 inspection, testing, and maintenance (ITM) frequency changes from the 2011 edition to the 2014 edition.

Private operating mode, as defined in NFPA 72: National Fire Alarm and Signaling Code, is permitted within the health care and ambulatory health care areas of the facility. In private operating mode, audible and visible signals are only required to notify those persons who implement the fire-safety plan. Direct notification through the fire alarm system is not required for building occupants who are not responsible in the implementation of the fire-safety plan. Additionally, critical care areas are permitted to have visible notification in lieu of audible notification based on patient concerns. Similarly, visible signals are not required inside surgical operating rooms, patient sleeping rooms, or psychiatric-care areas where the flashing could interfere with patient treatment. Other areas are also permitted to remove strobe coverage where the facility fire plan requires staff to respond.

Automatic sprinklers are typically required in all new health care occupancies as defined by NFPA 101. NFPA 99-2015 permits sprinklers to be omitted from certain closets in patient sleeping rooms and in hospital areas that are smaller than 6 sq ft. When introduced in prior editions of NFPA 99, this provision was not yet recognized in NFPA 13: Standard for the Installation of Sprinkler Systems; however, this requirement has now been incorporated into the latest editions of NFPA 13 and NFPA 101. This exception is limited to hospitals due to the relative light fuel load of their small closets and does not apply to other facilities, such as nursing homes, due to the much higher concentration of combustibles typically found. NFPA 99 also permits hose and hose outlets that are not required by the applicable local building and fire codes to be removed.

Rooms that contain compact, movable storage units with an area greater than 50 sq ft are required to be protected as hazardous areas per NFPA 101. In addition, NFPA 99 requires smoke detection and automatic sprinkler protection for these rooms. Additional requirements are also provided for facilities with operating rooms. The primary takeaway of requirements applicable to operating rooms is that formal procedures and training need to be in place for all personnel who work in the area. This would include training on fire hazards within the space, development of emergency procedures, and regular updates to the procedures and plans in place.

Inspection, testing, and maintenance

Table 2: This table is a summary of NFPA 72 inspection, testing, and maintenance (ITM) frequency changes from the 2010 edition to the 2013 edition. While most facilities have a procedure in place to inspect, test, and maintain their fire systems, be aware that the frequencies of these requirements have changed in NFPA 99-2015. Updates to NFPA 99 include references to other codes that incorporate additional requirements. Section 15.12 states that NFPA 25: Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems is required to be followed for all water-based fire protection systems while non-water-based systems shall be maintained in accordance with the applicable standard. Inadequate maintenance of fire protection systems, such as fire alarms, fire extinguishers, and automatic sprinklers, is one of the most frequent CMS-identified deficiency types. Another common deficiency identified is lack of appropriate documentation that maintenance has been performed. These common deficiencies are easily remedied but require the facility to understand the current requirements and responsibility to maintain proper documentation. 

Many requirements have been updated in NFPA 25 from earlier editions, including several new additions to the 2014 edition (as referenced by NFPA 99-2015). Table 1 includes a summary of these changes with some specific examples including heat-trace inspections and air-leakage tests for dry systems. Additional changes were incorporated into the 2011 edition of NFPA 99 and should be reviewed by facilities following CMS requirements.

The frequency of ITM requirements for NFPA 72 have also changed in the latest edition referenced by NFPA 99-2015. Relevant changes to health care facilities are identified in Table 2. The general trend with these changes is that the frequency of inspections and testing decreases, but additional requirements are added as technology changes or previous issues are identified.

Portable fire extinguishers are required to be selected, installed, and maintained in accordance with NFPA 10: Standard for Portable Fire Extinguishers, 2013 Edition. This is consistent with NFPA 101 and typical fire code requirements. No major changes occurred in the ITM requirements for portable fire extinguishers from the previous edition. The hazards of the facility should be evaluated when selecting fire extinguishers. For example, a Class K extinguisher is required within 30 ft of any commercial kitchen appliances that use combustible cooking media (oils and fats). Additionally, spaces with MRI or similar equipment should be provided with nonferrous components due to the nature of the equipment when operating. Additional guidance can be found in annexes A and D of NFPA 10-2013.

Power taps

The presence of multiple outlet connections (power taps) is a consistent life safety issue with facilities due to the variety of interpretations from AHJs. The requirement to provide a means to keep additional devices or nonmedical equipment from being connected to multiple outlet extensions after leakage currents have been verified was removed from NFPA 99-2015 via TIA 1. Additional requirements regarding the leakage current and touch currents of fixed and portable equipment, respectively, have been relocated out of the testing section and into the performance section for clarity and would still be applicable for power tap use. NFPA 70-2014: National Electrical Code, Article 517, describes the requirements for receptacles in health care areas. Generally, if a power tap is used for medical equipment or is located in the patient-care vicinity, it must be a special-purpose relocatable power tap and comply with UL 1363A or UL 60601-1.

The fire protection requirements in NFPA 99-2015 have not changed significantly from NFPA 99-2012, but the 2015 edition does offer significant differences from the 1999 edition, portions of which were previously used by facilities that follow CMS guidelines. These differences are important to recognize due to the regular surveys that occur. The two most notable fire and life safety differences apply to the requirement of a risk assessment and the changes in ITM requirements for the building and fire protection systems.


Chris Moran is a fire protection engineer at JENSEN HUGHES with 10 years of experience providing code-related consulting support for health care clients’ life safety and fire protection issues—including compliance with NFPA 101 and NFPA 99 as adopted by the Centers for Medicare & Medicaid Services.

Eric Rosenbaum is vice president at JENSEN HUGHES with over 30 years of experience in fire safety. Rosenbaum is also a fellow of the Society of Fire Protection Engineers and a member of NFPA’s Board of Directors. As a member of the NFPA, he chaired NFPA 101’s technical committee on fire protection features for 9 years. He is also on the NFPA technical committee for health care occupancies and technical correlating committee for NFPA 101, and member of the technical committee for board and care facilities for NFPA 101.

Ajay Prasad is a director for fire/life safety and accessibility consulting services for JENSEN HUGHES in the Mid-Atlantic region. He has 23 years of experience in providing code consulting services to health care clients including architects, engineers, owners, facility managers and facility planners.