NFPA 99 Risk Assessment Tool

An NFPA 99 risk assessment tool is a set of worksheets that lists every patient-care room, the systems and equipment it depends on, and the category each earns under Chapter 4 of the Health Care Facilities Code. In an NFPA 99 risk assessment the category follows the worst outcome of a failure, from Category 1, major injury or death, to Category 4, no impact. At 9:30 p.m. on July 13, 2025, a fire started in a second-floor resident room at Gabriel House, a 100-unit assisted living residence in Fall River, Massachusetts. Ten residents died and 53 were evacuated, more than half by ladder, and State Fire Marshal John Gavin’s findings of July 22, 2025 named two possible causes: a concentrator failure or smoking materials. Medical oxygen was present in the room of origin and elsewhere in the building, and Gavin said a fire in that environment ignites more readily, spreads faster, and burns hotter. The Fall River Fire Department’s after-action report of October 20, 2025 recorded no fire doors, blocked windows, and flames in the only elevator.

NFPA 99 Risk Assessment Tool: The Bottom Line
An NFPA 99 risk assessment tool is a worksheet set that records each room, system, and piece of equipment in a health care facility and assigns it a Chapter 4 category by asking what a failure would do to a patient: Category 1 major injury or death, 2 minor injury, 3 discomfort, 4 no impact.
The original of this article said NFPA 99 had three categories called major, minor, and injury to patients. It has four, numbered, and CMS surveyors cite against them.
Ten residents died at Gabriel House in Fall River, Massachusetts on July 13, 2025. The state fire marshal named an oxygen concentrator failure or smoking materials as the two possible causes and medical oxygen as the reason the fire spread as fast as it did.
CMS has enforced the 2012 edition since July 5, 2016 through K-tags in the 900 series. The Joint Commission surveys the same assessment under EC.02.05.01, cited in about 58 percent of hospital surveys in FY 2025.
ASHE’s tool has three worksheets: Systems, Equipment, and Emergency Management. The free workbook on this page follows that layout, adds the Category Key and a Sign-off tab, and calculates the category and inspection interval for you.
Re-run the assessment on renovation, change of use, new Category 1 equipment, a utility failure or near miss, a survey finding, or adoption of a new code edition.

  Gabriel House was an assisted living residence, so NFPA 99 did not apply to it as it applies to a hospital, and Fire Chief Jeffrey Bacon’s first recommendation was to hold such buildings to nursing-home rules. The same concentrator in a hospital room is a Category 1 item on the equipment worksheet of an NFPA 99 risk assessment.

What the NFPA 99 Risk Assessment Tool Records

The NFPA 99 risk assessment tool exists because the 2012 edition of NFPA 99 replaced occupancy-based rules with risk-based ones. Section 4.1 defines four categories by the effect of a system or equipment failure on patients and caregivers, and section 4.2 requires a documented NFPA 99 risk assessment to assign them. The American Society for Health Care Engineering built its worksheet to do exactly that. ASHE’s tool, first released for the 2012 edition and updated for 2021, has three worksheets. Facilities Net’s description of the original explains them: Systems lists critical rooms and the medical gas, electrical, IT, water, and HVAC systems each depends on; Equipment does the same per asset; Emergency Management records the hazards from the facility’s vulnerability analysis.

Category	Failure of the system or equipment is likely to cause	Typical examples	What the tool requires
Category 1	Major injury or death to patients, staff, or visitors	Medical gas to ICU and operating rooms; essential electrical system life-safety and critical branches; ventilators	Highest inspection frequency; redundancy; documented testing
Category 2	Minor injury to patients, staff, or visitors	Ward medical gas outlets; nurse call; monitors on stable patients	Scheduled inspection; documented maintenance
Category 3	Discomfort but not injury	Waiting-area HVAC; non-critical lighting	Manufacturer schedule; log of failures
Category 4	No impact on patient care	Office power; irrigation; decorative lighting	Ordinary building maintenance

In an NFPA 99 risk assessment, the category belongs to the failure in that room, not the equipment type. Jensen Hughes notes that the same oxygen outlet is Category 1 in an ICU and Category 2 in an exam room, and that Chapter 4 assessments apply to renovations. Our NFPA 99 assessment guide walks through Chapter 4 in full; this page is about the worksheet. Download the NFPA 99 risk assessment tool workbook (XLSX, five tabs), which follows ASHE’s three-sheet layout and adds a Category Key and a Sign-off tab. Enter the failure-outcome code for each system in each room and the sheet returns the category, the highest category per room, and the inspection interval you set on the key.

Tab	What you enter	What it calculates
Category Key	Your inspection interval per category (defaults: quarterly, semi-annual, annual, annual)	Feeds the Equipment tab
Systems	Room, occupancy, and a 1 to 4 outcome code for medical gas, vacuum, electrical, HVAC, plumbing, IT, and nurse call	Highest risk code and room category, colour-coded
Equipment	Asset ID, equipment, location, system, outcome code, last inspection date	Category, inspection interval, next due date
Emergency Management	Hazards from the HVA with probability, impact, and preparedness scores; Chapter 12 elements triggered	Priority score
Sign-off	Team, edition applied, approver, next review, interim-review triggers	The record a surveyor asks for

Why Surveyors Ask for the Assessment Before Anything Else

The NFPA 99 risk assessment is a federal requirement for any facility that bills Medicare or Medicaid. CMS adopted the 2012 editions of NFPA 99 and NFPA 101 by final rule on May 4, 2016, effective July 5, 2016, and Survey and Certification letter 16-29 told state agencies to survey against them. Chapters 7, 8, 12, and 13 were excluded. Figure 1. The Environment of Care standards cited most often in Joint Commission hospital surveys, FY 2025. The Joint Commission surveys the same NFPA 99 risk assessment requirement as standard EC.02.05.01, the hospital manages risks associated with its utility systems. Bay Area Compliance’s summary of FY 2025 data puts that standard in about 58 percent of hospital surveys, with missing risk assessments and incomplete inventories among the findings, behind only EC.02.06.01 at about 65 percent. CMS scores the same gaps as K-tags. Health Facilities Management explains that K-tags in the 900 series cover NFPA 99, and K901 is the risk assessment itself: no documented Chapter 4 categories means a deficiency before a surveyor looks at a single outlet. The healthcare risk management framework shows where this sits among a hospital’s other registers.

Enforcer	Instrument	What it checks in the assessment
CMS and state survey agencies	Form 2786 Life Safety Code survey; K-tags K901 and up for NFPA 99	A documented risk assessment exists; categories drive inspection, testing, and maintenance; 2012 edition applied
The Joint Commission	EC.02.05.01 EP 15 and related EPs; LS chapter	Utility systems inventory with risk categories; written maintenance strategy; test results
State fire marshal or AHJ	NFPA 101 occupancy chapters; local amendments	Life safety features; often adopts a later NFPA 99 edition than CMS
Internal audit and insurer	Property survey; HVA review	Category 1 redundancy; oxygen storage and handling; generator testing under NFPA 110

Figure 2. Where the roughly 5,800 US medical facility fires a year occur, from the US Fire Administration’s NFIRS snapshot for 2014 to 2016. The fire record is the second reason an NFPA 99 risk assessment matters. The US Fire Administration counts about 5,800 medical facility fires a year, causing 5 deaths, 150 injuries, and 56 million dollars in property loss annually in its latest snapshot, with nursing homes accounting for 48.6 percent. Cooking causes 71.3 percent, which is why the Systems tab lists kitchens as rooms.

How to Complete the Systems, Equipment, and Emergency Management Sheets

The order of work in an NFPA 99 risk assessment matters, and it starts with the rooms. NFPA 99 Annex A.4.2 points to ISO/IEC 31010 techniques for the assessment itself, and Consulting-Specifying Engineer notes that CMS does not require the assessment to be submitted, only to exist and be defensible. The six steps below produce that NFPA 99 risk assessment record.

Step	What you do	Sheet	Who is in the room
1. List the spaces	Every patient-care room, procedure room, and support space that a system serves; group by unit	Systems	Facilities, nursing manager
2. Map the systems	For each room, which medical gas, vacuum, electrical branch, HVAC zone, water, IT, and nurse call circuit serves it	Systems	Facilities, biomedical, IT
3. Ask the failure question	If this system failed in this room during normal use, what is the worst likely outcome for the patient? Enter 1 to 4	Systems	Clinical lead decides; facilities records
4. Inventory equipment	Each asset with location, system, and outcome code; the sheet assigns category and next inspection	Equipment	Biomedical engineering
5. Score the hazards	Transfer the hazard vulnerability analysis; score probability, impact, preparedness; list Chapter 12 elements	Emergency Management	Safety officer, emergency manager
6. Sign and schedule	Team, edition, approver, next review, interim triggers	Sign-off	Facilities director, safety committee

Step three of the NFPA 99 risk assessment is the one clinicians must answer, because only they know what a lost oxygen supply does to a ventilated patient in bed 12. Jensen Hughes describes the multidisciplinary team NFPA 99 expects: people who know space use, patient care services, and clinical practice. The hazard identification guide covers how to run that conversation. Figure 3. The four categories in NFPA 99 section 4.1, with the examples used in the workbook’s Category Key tab. The Systems sheet takes the lowest code in the row as the room’s category, because a room is only as safe as its most critical dependency. An ICU bed with Category 1 medical gas and Category 3 HVAC is Category 1. The risk matrix template explains why a single worst-case axis is the right scale here. The Equipment sheet adds the inspection interval from the Category Key and calculates the next due date. The defaults are quarterly for Category 1 and semi-annual for Category 2; change them to match your alternative equipment maintenance program, which CMS allows under the Conditions of Participation. The control measure guide covers how inspection frequency functions as a control. The NFPA 99 risk assessment tool fills in a day when the documents below are gathered before the first working session. Each one fills a column the surveyor will open, and the sixth is the one that was missing at Gabriel House:

• Medical gas source, zone valve, and outlet drawings, with the master and area alarm schedule
• Essential electrical system one-line diagram showing life safety, critical, and equipment branches
• Medical and building equipment inventory from the CMMS, with last inspection dates
• The current hazard vulnerability analysis and the last two exercise after-action reports
• Previous survey findings, K-tags, and plans of correction
• Any oxygen concentrator, portable cylinder, or bulk oxygen procedures, including smoking policy enforcement

A Worked Example: One ICU Bed and One Resident Room

Row 2 of each NFPA 99 risk assessment worksheet is filled in so the logic is visible. The Systems row is an ICU bed with ventilated patients; the Equipment row is a portable oxygen concentrator in a resident room, the device the Massachusetts findings named. The register elements guide explains the columns that carry over to a facility-wide register.

Room and system	Medical gas	Electrical	HVAC	Nurse call	Room category and mitigation
ICU Bed 12, ventilated patients	1	1	2	2	Category 1. Bulk oxygen with reserve; critical branch; auxiliary source connection added under the 2024 edition
Resident room 214, oxygen concentrator user	1 (portable)	2	3	2	Category 1 for the concentrator. Smoking prohibited and enforced; concentrator on a tested circuit; filters and tubing inspected; staff drilled on oxygen shut-off
Outpatient exam room 3	2	2	3	3	Category 2. Standard maintenance; outlet inspection semi-annual
Administrative office 110	4	4	3	4	Category 3 from HVAC only; building maintenance schedule

The resident room is the NFPA 99 risk assessment row that matters after Fall River. A concentrator delivering continuous oxygen to a resident who cannot self-evacuate is a Category 1 failure whatever the device costs, and the mitigation column records the smoking policy, the circuit test, and the evacuation drill. The fire risk assessment guide covers the building side of the same room. Figure 4. What the Massachusetts fire marshal and the Fall River after-action report recorded about the July 13, 2025 fire. Figure 4 shows why the NFPA 99 risk assessment Emergency Management sheet exists: the after-action report counted 33 firefighters on scene in 15 minutes against a standard of 42 in 10, and the incident record notes recalled sprinkler heads left in place. A facility that scores evacuation honestly drills differently. The business continuity program guide links that score to a recovery plan.

Where the 2024 Edition and the Related Codes Change the Sheets

CMS still enforces the 2012 NFPA 99 risk assessment rules, but the 2024 edition is what many state fire marshals and designers now use, and the Sign-off tab records which edition you applied. Health Facilities Management, in a preview by Val Ziavras and Brian O’Connor of NFPA, lists the changes that touch the worksheets.

2024 change	What it requires	Where it lands in the tool
Auxiliary source connection	All medical gas and vacuum systems get an auxiliary connection on the patient side of the source valve, so a temporary supply can be connected in an emergency	Systems tab mitigation column; Emergency Management hazard for loss of bulk oxygen
Medical gas pipe sizing	Pressure-loss calculations not to exceed 10 percent, retained as permanent records	Sign-off tab document list
Cryogenic liquid section	New requirements for withdrawal, piping, containers, ventilation, and relief valves	Systems tab for any cryogenic supply room
ASSE 6060 reference	Medical gas system designers qualified to the ASSE/IAPMO/ANSI 6060 standard	Team column on the Sign-off tab
Electrical terminology	“On-site power” replaces “emergency power supply”; NFPA 110 extracts removed to allow non-generator sources	Electrical column definitions; NFPA 110 testing still applies to generators
Hyperbaric fire suppression	Performance-based options replace prescriptive deluge and handline rules	Equipment tab for hyperbaric chambers

Three other codes feed the same NFPA 99 risk assessment rows. NFPA 101 governs the building and egress features that the Fall River report found missing, NFPA 110 sets the generator testing behind the electrical column, and NFPA 70 Article 517 covers the wiring of the essential electrical system. NFPA’s CMS resources page maps each to the federal rule. For emergency management, the CMS emergency preparedness rule requires the all-hazards risk assessment that the third worksheet records, and the 2024 edition adds definitions such as debrief for use after exercises. CASRAI’s guide summarises which edition each authority applies, and the disaster recovery plan template holds the recovery side.

Where NFPA 99 Risk Assessment Tools Go Wrong

The NFPA 99 risk assessment findings surveyors write up repeat across facilities, and most are worksheet errors rather than engineering ones. The table lists the ones we see most, the case that shows the cost, and the fix in the workbook. The types of risk assessment guide places the NFPA 99 assessment beside the fire, HIPAA, and safety assessments a hospital also runs.

Failure	Where it shows up	Fix in the tool
Categorising by equipment type	Every oxygen outlet marked Category 1, so the schedule is unaffordable and ignored	Score the failure outcome per room; the same outlet can be 1 in ICU and 2 in an exam room
Assessment done by facilities alone	Clinical consequence guessed; surveyor asks who decided	Clinical lead named on the Sign-off tab for every Category 1 decision
Inventory copied from the CMMS without location	Equipment categorised but no room context	Location and system columns mandatory on the Equipment tab
No re-assessment trigger	Assessment dated 2019; renovation in 2023; K901 finding in 2025	Triggers listed on the Sign-off tab: renovation, change of use, new Category 1 equipment, outage, survey finding, new edition
Emergency Management sheet left blank	HVA exists in another binder; no link to utilities	Transfer the HVA and score preparedness; list the Chapter 12 elements per hazard
Assisted living treated as out of scope	Gabriel House: medical oxygen throughout, no fire doors, no NFPA 99 obligation	Assess resident rooms with concentrators as Category 1 regardless of licence type
Wrong edition cited	Design to 2024 while CMS surveys to 2012, or the reverse	Edition recorded on the Sign-off tab; differences noted per row

The assisted living row deserves emphasis. OSHA’s healthcare page and the ambulatory design guidance both treat oxygen-using occupants as the hazard that decides design, whatever the licence says. We would run the Equipment sheet on any building where residents use concentrators, and the health and safety assessment guide covers the staff side. Frequency is the other recurring NFPA 99 risk assessment gap. NFPA 99 sets no calendar interval for the Chapter 4 assessment; it expects a review when anything it depends on changes. Our guide on how often to run risk assessments sets an annual floor, and the risk appetite guide explains how to document the Category 3 and 4 decisions a board accepts.

Common NFPA 99 Risk Assessment Tool Questions Practitioners Ask

What is the NFPA 99 risk assessment tool?

It is the worksheet set, originally from ASHE, that records each room, system, and equipment item in a health care facility and assigns the Chapter 4 category a failure would earn: 1 major injury or death, 2 minor injury, 3 discomfort, 4 no impact. The free workbook on this page follows the same three-sheet layout and calculates the categories.

Is the NFPA 99 risk assessment required by CMS?

Yes for hospitals, long-term care facilities, critical access hospitals, ambulatory surgical centers, hospices, PACE programs, and ICF-IID facilities. CMS adopted the 2012 edition by final rule on May 4, 2016, effective July 5, 2016, and surveys it under K-tags in the 900 series. The assessment must exist and be defensible; it does not have to be submitted.

What are the four NFPA 99 risk categories in the tool?

Category 1 covers systems or equipment whose failure is likely to cause major injury or death, Category 2 minor injury, Category 3 discomfort without injury, and Category 4 no impact on patient care. The category is assigned to the failure outcome in a specific room, which is why the tool asks the question per room and per system.

Who should fill in the NFPA 99 risk assessment tool?

An NFPA 99 risk assessment team: facilities for the systems, biomedical engineering for the equipment, a clinical lead to decide what a failure does to a patient, and the safety officer or emergency manager for the hazards sheet. The Sign-off tab names each of them, because the surveyor’s first question about a Category 1 decision is who made it.

How often should the NFPA 99 risk assessment tool be updated?

Update the NFPA 99 risk assessment tool on any trigger and at least annually. Triggers are renovation or change of use, new Category 1 equipment, a utility outage or near miss, a survey finding, and adoption of a new code edition by your authority having jurisdiction. The fire risk assessment validity guide applies the same logic to the building assessment.

Does the NFPA 99 risk assessment tool cover emergency management?

Yes. The third NFPA 99 risk assessment worksheet records the hazards from the hazard vulnerability analysis with probability, impact, and preparedness scores and the NFPA 99 Chapter 12 elements each triggers. CMS excludes Chapter 12 from its adoption but requires an all-hazards assessment under its emergency preparedness rule, so the sheet serves both.

Which NFPA 99 edition should the tool use?

Record the edition your enforcer applies. CMS and The Joint Commission survey to 2012; many state fire marshals and design teams use 2021 or 2024. The workbook’s Sign-off tab records the edition, and the 2024 change table above shows where the newer requirements, such as the auxiliary source connection, land in the sheets.

What Changes for Facility Teams Before the Next Survey

Two developments will shape the next NFPA 99 risk assessment cycle. The first is state action on assisted living after Fall River: Chief Bacon asked the Massachusetts legislature to hold assisted living to nursing-home building rules, Governor Maura Healey committed 5.7 million dollars, and new state fire safety regulations for assisted living took effect July 31, 2026. The second is edition drift. Every year CMS stays on 2012 while designers build to 2024, the gap between what is installed and what is surveyed widens, and the NFPA tentative interim amendment to the 2024 edition shows the code still moving. The US Fire Administration’s hospital snapshot is the baseline to measure your own incident log against. Run the NFPA 99 risk assessment Systems sheet for every unit this quarter and put the clinical lead’s name against each Category 1 row. That single column answers K901, EC.02.05.01, and the first question any investigator asks after a fire. The scenario-based assessment guide shows how to test the Category 1 rows against a loss-of-oxygen exercise. For facilities with an equipment inventory but no Chapter 4 categories behind it, we complete the NFPA 99 risk assessment workbook with your facilities and clinical leads in two sessions and return it survey-ready. Engagement formats are listed on the services page, and the contact page reaches us. The workbook is free above; start with the rooms where a concentrator runs all night. NFPA-99-risk-assessment-tool