NFPA 99 Heads Toward a 2027 Edition — What the New Cybersecurity Chapter Means for Anesthesia Gas Machines
NFPA 99, the Health Care Facilities Code, is revised on a roughly three-year cycle through NFPA's open, ANSI-accredited consensus process, and the 2024 edition marked a notable shift by introducing dedicated attention to the cybersecurity of building and medical systems alongside the long-standing electrical, gas, and life-safety requirements. As development work proceeds on the next edition and its provisions move through public-input and public-comment stages, networked clinical equipment — including modern anesthesia workstations that push data to the EHR and receive firmware updates — falls increasingly within the code's field of view.
Anesthesia gas machines are a useful test case because they blend the two worlds NFPA 99 governs: they depend on the medical-gas and vacuum systems behind the wall, and they are now full-fledged networked computers with monitors, agent analyzers, and electronic records. That convergence means a preventive-maintenance visit is no longer purely mechanical. Alongside vaporizer calibration and leak testing, teams should be inventorying network interfaces, confirming that only necessary services and ports are enabled, verifying that firmware is at a supported and patched level, and documenting the device's role in the facility's overall security and emergency-management program.
Our recommendation is to treat the coming edition as a prompt rather than a deadline. Building a defensible baseline now — accurate asset inventory, documented PM against manufacturer intervals, change-controlled firmware, and coordination with facilities on the medical-gas source-valve and auxiliary-connection requirements already in force — means that when the new provisions are adopted by your authority having jurisdiction, compliance is largely a matter of showing existing records rather than launching a scramble.
Sources: NFPA 99 Health Care Facilities Code; FDA Medical Device Cybersecurity; The Joint Commission Standards































