NFPA 99: Risk Categories and the CMS Edition

If you are preparing for a Life Safety Code survey, the first question about NFPA 99 is not what the code says. LAC Health’s facilities-compliance glossary also has an NFPA 99 entry aimed at procurement rather than code-enforcement readers. It is which edition you are held to — and the answer is not the current one. CMS incorporates the 2012 edition of NFPA 99, Health Care Facilities Code, by reference at 42 CFR 482.41(c), together with Tentative Interim Amendments 12-2, 12-3, 12-4, 12-5 and 12-6. NFPA’s current edition is the 2024 one. A hospital complies with the adopted 2012 text, not the newest published text, and a surveyor cites against the adopted text.

That single fact determines whether the rest of your reading is useful or misleading. It also cuts four whole chapters out of scope: 42 CFR 482.41(c)(1) states that Chapters 7, 8, 12 and 13 of the adopted Health Care Facilities Code do not apply to a hospital. This guide covers the adopted edition, the risk-category model that replaced the old occupancy-based approach, and what Chapters 5 and 6 actually require of medical gas and essential electrical systems.

NFPA codes are copyrighted and sold. Nothing here reproduces the code text — the requirements are described and cited by chapter so you can find them in the real document. See reading the code without buying it below.

Which edition CMS actually enforces

CMS adopted the 2012 LSC and the 2012 HCFC by final rule on 4 May 2016 (Medicare and Medicaid Programs; Fire Safety Requirements for Certain Health Care Facilities, 81 FR, Vol. 81 No. 86), published in the Federal Register and effective 5 July 2016. CMS confirmed the operational detail in Survey & Certification memo S&C 16-29-LSC (20 June 2016), which supersedes S&C 03-21: surveyors began citing against the 2012 editions on 1 November 2016.

CMS’s own Life Safety Code & Health Care Facilities Code Requirements page still describes the 2012 edition as the operative one. There has been no subsequent rulemaking moving the incorporation forward to 2015, 2018, 2021 or 2024. Until CMS publishes a Federal Register document adopting a newer edition — which 482.41(e) commits it to doing — the 2012 text is the compliance baseline.

What is and is not incorporated

Document	Edition adopted	Where
NFPA 99, Health Care Facilities Code	2012, issued 11 Aug 2011, with TIA 12-2, 12-3, 12-4, 12-5, 12-6	42 CFR 482.41(c) and (e)(1)(i)-(vi)
NFPA 101, Life Safety Code	2012, issued 11 Aug 2011, with TIA 12-1, 12-2, 12-3, 12-4	42 CFR 482.41(b) and (e)(1)(vii)-(xi)
NFPA 110, Emergency and Standby Power Systems	2010, including TIAs to Chapter 7	42 CFR 482.15(e) — the emergency preparedness CoP, not 482.41
NFPA 99 Chapters 7, 8, 12, 13	Excluded for hospitals	42 CFR 482.41(c)(1)

The four excluded chapters are, in the 2012 edition, information technology and communications systems (7), plumbing (8), emergency management (12) and security management (13). Their exclusion from 482.41 does not mean the underlying subject is unregulated — hospital emergency management is separately and comprehensively required by the emergency preparedness Condition of Participation at 42 CFR 482.15, which is where the hazard vulnerability analysis and the rest of the emergency preparedness programme live. It means a surveyor cannot cite you to NFPA 99 Chapter 12 as a hospital.

The chapter-numbering trap

Between the 2012 and 2024 editions the chapter structure changed. In the 2024 edition, dental gas and vacuum systems occupies Chapter 15 and features of fire protection moved to Chapter 16; in the 2012 edition, features of fire protection is Chapter 15 and there are fifteen chapters, not sixteen. Chapters 1 through 14 carry the same subjects across both editions, but a citation above Chapter 14 taken from a current handbook does not map onto the enforced text. If a consultant, vendor datasheet or training deck cites a chapter above 14, confirm which edition it is written to before acting on it.

Two escape valves that genuinely exist

Waiver. 42 CFR 482.41(c)(2) allows CMS to waive specific HCFC provisions where compliance would impose unreasonable hardship, but only where the waiver does not adversely affect patient health and safety. Per CMS’s guidance, State Survey Agencies and Accreditation Organizations may recommend approval; only a CMS Location grants one. A recommendation is not a waiver.
State code in lieu. Under section 1863 of the Social Security Act, and 482.41(b)(3), the code does not apply in a state where CMS finds that a state-imposed fire and safety code adequately protects patients. The state submits the request with its enabling legislation; CMS headquarters makes the determination.

New versus existing occupancy

S&C 16-29-LSC sets the dividing line: buildings constructed before 5 July 2016, and buildings that received design approval or a building permit before that date, may meet Existing Occupancy requirements. All other construction must meet New Occupancy requirements. This matters more than it looks — a large share of survey disagreements are really disagreements about which of the two requirement sets a given wing falls under, and the answer is a documentary question about permit dates, not an engineering one.

Risk categories: what replaced the occupancy model

The 2012 edition is the one that stopped asking what kind of building is this? and started asking what happens if this system fails? Earlier editions applied requirements largely on the basis of facility type — hospital, nursing home, clinic, dental office. The 2012 edition moved to a risk-based model in Chapter 4 (Fundamentals), in which each system is assigned a category by the consequence of its failure:

Category	Consequence of failure	Practical effect
Category 1	Failure is likely to cause major injury or death of patients or caregivers	Full requirement set — redundancy, alarms, independent verification, the most testing
Category 2	Failure is likely to cause minor injury	Reduced requirement set relative to Category 1
Category 3	Failure is not likely to cause injury, but is likely to cause patient discomfort	Substantially lighter requirements
Category 4	Failure has no impact on patient care	Effectively outside the code’s system requirements

The thing people get wrong

The 1-4 scheme is used in two related but distinct ways, and conflating them is the single most common misreading of this code.

System categories (Chapter 4) classify a system — a piped medical gas system, an electrical distribution system — by consequence of failure.
Patient care space categories (Chapter 6) classify a space. This is where the old electrical vocabulary went: NFPA describes Category 1 spaces as what were previously called critical care rooms (special care patient rooms, operating rooms, cardiac catheterisation laboratories), Category 2 spaces as the former general care rooms (inpatient bedrooms, dialysis rooms, procedural rooms), and Category 4 spaces as the former support rooms (anaesthesia work rooms, sterile supply, laboratories, morgues, waiting rooms).

So “this is a Category 1 hospital” is not a sentence the code supports. A hospital contains spaces of several categories and systems of several categories at the same time, and the requirement that applies to a given outlet, valve or receptacle depends on the category of the space it serves and the system it belongs to — not on the fact that the building is a hospital. That is precisely the inversion the 2012 edition made, and it is why an occupancy-shaped mental model produces wrong answers in both directions: over-building support spaces and under-building procedural ones.

Who assigns the category

The code places the determination on the facility’s governing body, informed by a documented risk assessment carried out by qualified people. It does not mandate a single methodology — the annex material points to a defined risk-assessment process rather than prescribing one tool. Two consequences follow that are worth building into your compliance file:

The risk assessment is a record a surveyor can ask for. If you cannot produce the document that assigned a category, you have not so much failed a technical requirement as failed to demonstrate the decision was made at all.
The authority having jurisdiction can disagree. CMS’s guidance is explicit that the LSC and HCFC permit the AHJ to determine the adequacy of protection provided. Where a chapter’s applicability turns on a category your governing body assigned, that assignment is reviewable. Document the reasoning, not just the conclusion.

If your organisation is building the surrounding governance record, this connects directly to the QAPI plan and performance improvement documentation that CMS expects to see for any hospital-wide risk process, and to the risk-assessment discipline used in ligature risk assessment and infection control risk assessment for construction, both of which follow the same “assess, document, act, re-assess” shape.

Medical gas and vacuum systems (Chapter 5)

Chapter 5, Gas and Vacuum Systems, is the longest chapter in the code and is organised by category: 5.1 covers Category 1 systems, 5.2 Category 2, 5.3 Category 3. Almost every piped medical gas system in an acute-care hospital is Category 1, because failure of piped oxygen or medical air to an operating room or critical care unit is capable of causing death. That single classification pulls in the heaviest requirement set in the code.

What Chapter 5 governs, in substance:

Sources. Central supply systems for oxygen, nitrous oxide, medical air, nitrogen and instrument air, with the redundancy expectations that apply to Category 1 — a primary supply, a secondary supply and a reserve, so a single failure does not interrupt delivery.
Distribution and valves. Shutoff valves placed so that a section can be isolated without shutting down more of the hospital than necessary, and identified so that a person under pressure in an emergency can find and read them.
Alarms. Master alarms, area alarms and local alarms, with the monitoring points and the requirement that alarms be at continuously attended locations.
Materials and joining. Medical gas tubing brazed with an inert gas purge to prevent internal oxide formation. Brazing procedures and brazers must be qualified against the recognised welding standards the chapter references — this is one of the few places where a trade qualification is written into a health care code.
Installer and verifier credentials. Chapter 5 ties competence to the ASSE 6000-series credentials published by ASSE International — most relevantly ASSE 6010 for medical gas systems installers, ASSE 6030 for verifiers, and ASSE 6040 for maintenance personnel. Confirm the current credential list on ASSE’s own site; the series has been extended over time.
Independent verification. For Category 1 systems, installation and testing must be verified by a party independent of the installing contractor. This is a structural control, not a paperwork step: the point is that the entity certifying the system did not build it. A verification report signed by the installer is not compliant, and it is a recurring finding.

Where medical gas compliance actually fails

In practice the findings cluster in a small number of places, all of them operational rather than design issues:

Valves labelled at installation and never re-labelled after a renovation, so the label no longer describes what the valve isolates.
Area alarm panels silenced or with a failed sensor, discovered only at survey.
A renovation tie-in performed without the independent verification the category requires, because the work was small enough to feel like maintenance.
Cylinder storage handled to a different standard than the piped system. Cylinder-side requirements interact with the compressed-gas rules covered in compressed gas cylinder storage requirements and compressed gas cylinder safety, and with connection standards such as CGA Pamphlet P-1. NFPA 99 does not displace those; it sits alongside them.

Essential electrical systems (Chapter 6)

Chapter 6, Electrical Systems, defines the essential electrical system (EES) — the part of the distribution system that must survive a loss of normal power — and, like Chapter 5, scales it by category.

EES type	Where required	Branches
Type 1	Facilities with Category 1 spaces — i.e. acute-care hospitals with operating rooms and critical care	Three: life safety branch, critical branch, equipment branch
Type 2	Facilities whose highest classification is Category 2 spaces — historically nursing homes and limited care facilities	Two: life safety branch and equipment branch
Type 3	Facilities whose highest classification is Category 3 spaces	A single essential branch

The life safety branch carries egress lighting, exit signs, fire alarm and mass notification, and the systems needed to evacuate — its loads are fixed by the code and nothing else may be connected to it. The critical branch carries patient care task illumination and the selected receptacles and equipment that clinical care depends on. The equipment branch carries the large motor loads — medical air compressors, vacuum pumps, certain HVAC — which may be delayed-automatic rather than instantaneous.

For a Type 1 system, both the life safety and critical branches must be restored within 10 seconds of loss of normal power. That number is the reason generator and transfer-switch selection is not a purely commercial decision.

Wet procedure locations — the rule worth knowing

Chapter 6 requires special protection in wet procedure locations: either ground-fault circuit interrupter protection or an isolated power system. The distinction is consequential. Where an interruption of power cannot be tolerated during a procedure, GFCI is not an acceptable answer, because a GFCI’s correct behaviour is to open the circuit — and isolated power with a line isolation monitor is required instead, precisely because it alarms without cutting power.

Operating rooms are treated as wet procedure locations unless a risk assessment conducted by the health care governing body determines otherwise. That determination is a documented decision, and it is a decision a surveyor may ask to see. An OR with GFCI-only protection and no risk assessment on file is a defensible-looking installation with an indefensible paper trail.

Generator testing lives somewhere else

A common misallocation: the testing frequency for the generator itself is not in NFPA 99. It is in NFPA 110, Standard for Emergency and Standby Power Systems, which CMS adopts at the 2010 edition — and it does so through 42 CFR 482.15(e), the emergency preparedness Condition of Participation, not through 482.41. The same CoP requires that a hospital with an onsite fuel source have a plan for keeping emergency power operational unless it evacuates. If you are assembling the emergency-power evidence file, work from 482.15 and NFPA 110 Chapter 8, and see the CMS emergency preparedness rule guide for how that programme is structured. Equipment-level inspection, testing and maintenance records for the clinical devices fed by these branches are a separate obligation again — see biomedical equipment maintenance.

How this is actually surveyed

NFPA 99 compliance is not surveyed as a standalone event. It is folded into the Life Safety Code survey, and the mechanics are set out in the State Operations Manual, Appendix I — Survey Procedures for Life Safety Code.

The form. For hospitals and other health care occupancies, deficiencies are recorded on Form CMS-2786R, the Fire Safety Survey Report for Health Care under the 2012 Life Safety Code. Findings are expressed as K-tags; S&C 16-29-LSC records that the K-tag set and the ASPEN tracking system were both revised for the 2012 codes before the 1 November 2016 start date.
Who surveys. CMS works through State Survey Agencies and approved Accreditation Organizations. SAs frequently sub-contract to the State Fire Marshal. Only inspectors who have completed the required CMS training may conduct these surveys.
Timing. The LSC/HCFC survey may precede, follow or run alongside the health survey — the SA or AO decides. Do not assume the two arrive together.
Deemed status. Accredited hospitals are surveyed by their AO and validated by CMS. The accrediting body’s own standards sit on top of the federal requirement rather than replacing it; the differences between the main options are set out in DNV versus The Joint Commission.
Correction. A facility that meets the requirements, or that submits an acceptable plan of correction on Form CMS-2567, is in compliance. Where a physical environment finding is severe enough to be cited at the immediate jeopardy level, the removal process is a different and much faster exercise — see the immediate jeopardy removal plan.

A useful framing for anyone assembling the file: the surveyor is not testing whether your building is safe in the abstract. They are testing whether a specific, adopted, dated document’s requirements are met, and whether you can evidence it. Categories without a risk assessment, verifications without independence, and waivers that were only ever recommended are the three gaps that turn a well-built facility into a citation.

Where NFPA 99 stops

NFPA 99 is a systems and operations code. It is routinely confused with its neighbours, and the boundary matters because each is enforced through a different regulatory hook.

Code or rule	What it governs	Regulatory hook
NFPA 99 (2012)	Medical gas and vacuum, electrical systems and essential electrical, gas and electrical equipment, HVAC, hyperbaric facilities, features of fire protection	42 CFR 482.41(c)
NFPA 101 (2012)	Means of egress, construction type, compartmentation, sprinklers, occupancy classification, corridor doors and latching hardware	42 CFR 482.41(b)
42 CFR 482.41(a) and (d)	The plain-language physical environment requirements — emergency power and lighting in ORs, recovery, ICU, ED and stairwells; emergency gas and water; ventilation, light and temperature control	Direct CoP text, no code incorporated
42 CFR 482.15	Emergency preparedness programme, hazard vulnerability analysis, communications plan, training and testing	Separate CoP

Note the paragraphs of 482.41 that incorporate nothing at all. Paragraph (a)(1) independently requires emergency power and lighting in at least the operating, recovery, intensive care and emergency rooms and in stairwells, with battery lamps and flashlights available elsewhere; (a)(2) requires facilities for emergency gas and water supply; (b)(8) requires evacuation or a fire watch when a sprinkler system is down for more than 10 hours; (b)(9) sets outside window and sill height requirements. These are cited directly from the CFR, not from a code, and a facility that reads only NFPA 99 and NFPA 101 will miss them.

The wider environment-of-care programme — mass notification, hazardous materials, utilities management as a managed system rather than as individual code compliance — belongs with the emergency preparedness and environment material rather than here. See emergency notification systems and, for the ventilation and containment requirements that govern compounding areas specifically, USP <797> sterile compounding. Broader hospital quality and safety programme context sits on the patient safety pillar, alongside the National Patient Safety Goals, NDNQI nursing quality indicators and the CPHQ certification body of knowledge that quality directors are examined against.

Reading the code without buying it

NFPA codes are copyrighted and sold, which is why almost every free summary of NFPA 99 online is a paraphrase rather than the text. NFPA does provide free read-only online access to its codes and standards through its digital library at link.nfpa.org. A free NFPA account is required; the access is view-only — no printing, no download, no offline copy.

Two practical cautions:

Free access is oriented to current editions. Confirm that the 2012 edition — the one CMS enforces — is among the editions available to you before relying on the free tier for compliance work. If it is not, the 2012 edition has to be purchased or accessed through a library or your AHJ.
Because the code is copyrighted, no summary can substitute for it in a dispute. Use descriptions like this page to know where to look and what question to ask; read the adopted text before you commit money or write a plan of correction.

Frequently asked questions

Which edition of NFPA 99 does CMS enforce?

The 2012 edition, with Tentative Interim Amendments 12-2 through 12-6, incorporated by reference at 42 CFR 482.41(c) and (e). CMS adopted it by final rule on 4 May 2016, effective 5 July 2016, and began surveying against it on 1 November 2016. NFPA’s current edition is the 2024 one, but it has no regulatory force for Medicare and Medicaid participation until CMS adopts it by rule.

Do Chapters 7, 8, 12 and 13 apply to hospitals?

No. 42 CFR 482.41(c)(1) excludes them explicitly, and CMS’s S&C 16-29-LSC memo restates the exclusion. In the 2012 edition those chapters cover information technology and communications systems, plumbing, emergency management and security management. Emergency management is separately required under the emergency preparedness Condition of Participation at 42 CFR 482.15.

What are the NFPA 99 risk categories?

Four levels defined in Chapter 4 by the consequence of a system’s failure: Category 1 where failure is likely to cause major injury or death; Category 2 where it is likely to cause minor injury; Category 3 where injury is not likely but patient discomfort is; Category 4 where there is no impact on patient care. Chapter 6 applies the same 1-4 scheme to patient care spaces, replacing the older critical care, general care, basic care and support room labels.

Is my hospital a Category 1 facility?

The code does not classify facilities that way. Categories attach to systems and to spaces, not to buildings, which is the substantive change the 2012 edition made when it replaced the occupancy-based model. A single hospital will contain Category 1, 2 and 4 spaces simultaneously.

Who decides which category a system falls into?

The facility’s governing body, on the basis of a documented risk assessment performed by qualified people. The code does not mandate a specific methodology. The authority having jurisdiction may review the determination, so record the reasoning and not just the outcome.

Is an operating room a wet procedure location?

It is treated as one unless a risk assessment conducted by the health care governing body determines otherwise. Where power interruption cannot be tolerated, GFCI protection is insufficient and an isolated power system is required. Keep the risk assessment on file — the classification and the protection method are separate questions and a surveyor may ask about both.

How often must a Type 1 essential electrical system transfer?

The transfer performance requirement is that the life safety and critical branches be restored within 10 seconds of loss of normal power. The routine testing frequency for the generator set is not in NFPA 99 — it is in NFPA 110, adopted by CMS at the 2010 edition through 42 CFR 482.15(e).

Where can I read NFPA 99 for free?

NFPA offers free read-only online access to its codes at link.nfpa.org with a free account, subject to no printing or downloading. Check whether the 2012 edition is available to you before relying on it, since free access is oriented toward current editions.

Can NFPA 99 requirements be waived?

Yes, under 42 CFR 482.41(c)(2), where compliance would cause unreasonable hardship and the waiver would not adversely affect patient health and safety. State Survey Agencies and Accreditation Organizations may recommend a waiver, but only a CMS Location can grant one. Separately, under section 1863 of the Social Security Act the code does not apply in a state whose own fire and safety code CMS has found adequately protects patients.