Medical gas safety: the new chapter

After 20 years, HTM 02-01 has changed. The 2026 revision is much more than an update of technical references or a replacement for an ageing document. Parts A and B together establish a stronger lifecycle approach to Medical Gas Pipeline Systems (MGPS), linking the way systems are conceived and designed with the way they are validated, handed over, operated, maintained, modified, and governed.

The underlying engineering principles remain familiar: the supply must be adequate, correctly identified, continuous, and of the required medicinal quality. What has changed is the context in which those principles are applied. Clinical practice has evolved, oxygen demand has changed, healthcare estates have become more complex, sustainability is a strategic requirement, and the COVID-19 pandemic demonstrated that installed capacity does not always translate into usable resilience at the patient. At the same time, experience has shown the limitations of treating medical gases primarily as an Estates engineering service rather than as a safety-critical clinical, pharmaceutical, and engineering system.

The new HTM therefore asks organisations to make decisions using better evidence and stronger governance. Design should start with clinical need and risk. Resilience should consider the complete route from source to patient. Validation and verification should demonstrate that the installed system actually delivers the design intent. Operational management should make risks visible to the organisation, while competence, pharmacy input, and clinical engagement should be built into the assurance process rather than added at the end.

In this article, Rob McCrea considers the principal changes in Part A – Design, installation, validation and verification – and what they mean for designers, Estates teams, and existing hospitals. Richard Maycock then examines Part B – Operational management – with particular emphasis on governance, pharmacy, competence, risk management, and the strengthened Permit-to-Work process.</Text><Text>The first major revision of HTM 02-01 Part A in 20 years asks a different question of medical gas designers: not simply “What did we install before?” but “What does this healthcare service actually need?”

That question captures an important change in philosophy. The 2006 edition provided the industry with a strong and dependable framework, but two decades of projects, refurbishment schemes, operational experience, and changes in clinical practice inevitably exposed areas where interpretation could vary. Some requirements became treated as fixed solutions even where the original clinical rationale was no longer clear. Historic room data, familiar plant arrangements, or long-standing rules of thumb could be carried from one project to another without always challenging whether they remained appropriate for the service being provided.

This could create several problems. One was the risk of unnecessary oversizing. Larger plant, additional pipework, and greater installed capacity may appear inherently safer, but oversizing can bring higher capital cost, increased energy use, additional maintenance, and more equipment to manage. It can also obscure the more important question of whether the complete system is resilient. A large oxygen vessel, for example, is of limited benefit if the evaporators, pressure-control equipment, or downstream pipework cannot deliver the required flow to the patients who need it.

At the other end of the scale, ambiguity can also lead to under-appreciated risk. A system that has operated for many years may be assumed to be satisfactory simply because it has not yet failed. That assumption becomes increasingly fragile when a ward changes use, high-flow therapies are introduced, bed numbers increase, or the concentration of dependent patients changes. Patient safety requires a design basis that reflects the clinical service of today and the reasonably foreseeable demands of tomorrow.

Sustainability is another reason for change. Healthcare organisations cannot ignore energy, carbon, lifecycle cost, and the environmental impact of medical gases, but sustainability cannot be pursued by reducing resilience or transferring risk to clinical teams. The revised approach is therefore not ‘use less at any cost’; it is to select the lowest-impact solution that still demonstrably meets clinical need and preserves patient safety. That makes good option appraisal, rather than automatic repetition of historic solutions, increasingly important.

The Informed Design Process: evidence before equipment

At the centre of Part A is the Informed Design Process (IDP). The significance of the IDP is not that engineering calculations disappear; it is that calculations sit within a broader, documented decision process. Clinical activity, patient dependency, anticipated procedures, future changes, resilience, emergency scenarios, operational constraints, sustainability, and lifecycle implications all need to inform the selected solution.

This creates a better conversation at project level. Instead of a designer receiving a room schedule and immediately converting terminal-unit numbers into plant and pipe sizes, the multidisciplinary team can first challenge the requirement. What equipment will clinicians actually use? What are the likely simultaneous flows? Could the department change function? Which patients cannot tolerate interruption? What happens during a single fault, electrical failure or abnormal demand event? What existing infrastructure can be retained safely? These questions give the design calculation a defensible clinical and operational basis.

Governance is part of this design process. Important MGPS decisions should not sit in isolation within a consultant’s calculation file. Estates, the Authorising Engineer (MGPS), Authorised Person (MGPS), clinical representatives, pharmacy/QC, and the Medical Gas Safety Group should be able to understand the assumptions, risks, and consequences of major options. For complex projects, the project governance arrangements need to connect with the organisation that will ultimately inherit and operate the system.

Flow loops: an opportunity for older hospitals

One practical example of this more informed approach is the use of flow loops. Many hospitals still operate oxygen distribution systems installed when typical ward demand was much lower. Modern respiratory therapies and the concentration of high-dependency patients can expose pressure and flow limitations that were not apparent when those systems were first designed.

The traditional response to a constrained branch or distribution main may be to replace it with larger pipework. On a new-build project that may be straightforward. On a live hospital site it can be very different: ceilings have to be opened, risers accessed, fire compartments disturbed, occupied clinical departments worked through, and repeated isolations coordinated. The engineering solution may be technically simple but operationally disruptive and expensive.

A flow loop can provide another option where the calculations demonstrate that it is suitable. By creating a simplified ring arrangement, gas can approach a high-demand area from more than one direction. That can reduce the pressure loss associated with forcing the entire diversified flow through one route and may improve the usable performance of existing infrastructure.

The important word is ‘may’. A flow loop is not a shortcut that turns inadequate pipework into compliant pipework. The existing network has to be surveyed accurately, the proposed arrangement calculated, the effect on upstream sections understood, and the completed installation validated under appropriate conditions. Isolation, valve arrangements, future maintenance, and emergency operation also need consideration.

Where those checks are satisfied, however, the benefit for an older estate can be significant. Instead of wholesale replacement, the organisation may be able to make better use of sound existing assets, reduce invasive construction, avoid unnecessary clinical disruption, and direct capital investment to the parts of the system that genuinely constrain performance. That is a good illustration of what informed design should achieve: not necessarily a bigger system, but a better understood one.

Vacuum: whole-life value rather than purchase price

The same thinking applies to medical vacuum. Portable suction has an important role in healthcare, including contingency and local applications, but a decision to replace a central piped service with portable devices should not be based simply on the purchase price of one unit compared with the capital cost of plant and pipework.

A ward or department requiring suction at numerous bed spaces may need a substantial fleet of portable units. Each device becomes an asset to procure, locate, clean, test, service, repair, and eventually replace. Batteries deteriorate and require replacement; chargers need sockets and management; units must be available where and when they are needed. A strategy involving large numbers of rechargeable devices also requires the organisation to consider the electrical and fire risks associated with charging and storing lithium-battery equipment.

By comparison, a correctly designed central vacuum system provides suction at the terminal unit as part of the fixed clinical infrastructure. It still has lifecycle costs: pumps require maintenance, filters, and exhaust arrangements require attention, and the plant needs electrical resilience. The point is that the option appraisal should compare the complete service models rather than one capital line against another.

Clinical preference matters as well. If staff find piped suction more dependable, immediately available, and easier to use than a fleet of portable units, that operational evidence belongs within the IDP. A solution that appears cheaper for Estates may be poor value if it transfers equipment management, charging, cleaning, and availability problems into clinical areas. The correct question is therefore: what is the whole-life cost, risk, and clinical impact of providing reliable suction by each option?

Primary, secondary, and tertiary: resilience beyond standby plant

Part A also strengthens how resilience is addressed through primary, secondary, and tertiary supplies. This terminology moves the discussion beyond the assumption that resilience is achieved simply by installing duty and standby plant. The more important question is what supply remains available if the normal source, or the route from that source, is compromised.

The primary supply supports normal operation. The secondary arrangement provides continuity following the relevant failure scenario. Tertiary provision adds a further layer, determined through the IDP and the clinical risk. Depending on the system and application, that could involve a further fixed pipeline source, a portable manifold, or individual cylinders. The exact arrangement is less important than the principle: the organisation should know how essential patients will continue to receive gas if the first layers of resilience are unavailable.

Tertiary supply therefore connects engineering design directly with emergency and clinical contingency planning. It needs sufficient capacity for the intended scenario, a practical method of deployment or changeover, trained staff, appropriate connections, and a clear understanding of which clinical services are prioritised. A tertiary source that exists on a drawing but cannot be deployed safely or quickly is not meaningful resilience.

This is particularly relevant to oxygen. COVID-19 showed that a hospital can have adequate bulk storage while still encountering delivery constraints. Resilience must be considered along the entire chain: storage, evaporators, pressure regulation, distribution mains, risers, branches, area valves, terminal units, and the patient interface. Primary, secondary, and tertiary supplies add protection, but the distribution network must still be capable of carrying the required flow.

Validation and verification: prove the system before it is released for use

One of the most important improvements in Part A is the greater prominence given to validation and verification. This matters because an MGPS can appear complete while still containing defects concealed above ceilings, within risers, or inside a complex sequence of valves and connections. Once the system is placed into clinical service, those defects may only become visible when a patient depends on the supply.

The strengthened approach clarifies the assurance sequence. Design defines what the system must achieve. Installation creates a physical system. Engineering validation and verification then confirm that the installation aligns with the design intent and performs correctly. Separate pharmaceutical quality-control testing confirms that the medicinal gas delivered through the system meets the required quality before the relevant sections are released for use.

That distinction between engineering verification and pharmaceutical quality matters. The engineer can demonstrate pressure, flow, identity, alarm operation, valve function, and other engineering requirements, but medical gases are medicines. The final assurance chain therefore needs appropriate pharmacy and QC input alongside engineering evidence. Neither discipline is replaced by the other.

The more robust process also improves handover. Test results, material information, drawings, design assumptions, and commissioning evidence should not be treated as temporary project paperwork. They form part of the technical file and the wider golden thread of information that future APs, designers, maintainers, and governance teams may need when the system is modified or investigated years later.

This is ultimately a patient-safety issue. If an organisation cannot demonstrate what was installed, what was tested, what performance was achieved, and what limitations were accepted, it inherits uncertainty. Part A’s stronger validation, verification, and information requirements are intended to reduce that uncertainty before the system becomes operational.

If Part A changes the way we design and prove an MGPS, Part B changes the way healthcare organisations govern it throughout operation. The familiar engineering controls remain essential, but the 2026 document places them inside a wider organisational framework. Medical gas safety is not solely an Estates responsibility; it is a patient-safety, medicines-management, operational-resilience, and corporate-governance issue.

The Medical Gas Safety Group: bringing the whole risk together

The Medical Gas Safety Group (MGSG) is central to that shift. Its value is not in creating another meeting. Its value is in bringing together information and authority that can otherwise remain fragmented across Estates, pharmacy, clinical services, capital projects, health and safety, and operational management.

Consider a common scenario. Estates may know that an oxygen branch is operating close to its calculated capacity. A clinical team may be planning to introduce high-flow equipment. Capital Projects may be refurbishing an adjacent ward. Pharmacy may be reviewing gas usage and contingency arrangements. Individually, each department sees only part of the picture. The MGSG provides a route for the organisation to recognise that these separate activities may create one combined MGPS risk.

This also improves accountability. Significant defects, resilience concerns, overdue actions, competence gaps, incidents, major projects, and changes in clinical demand should be visible through an appropriate governance route rather than remaining within local engineering correspondence. Board and senior-management assurance depends on having a clear route by which material MGPS risks are escalated, owned, and monitored.

The same principle applies to projects. A new installation can be technically compliant at handover yet still create operational problems if the receiving team was not involved in design assumptions, emergency arrangements, isolation philosophy, or documentation requirements. Linking project decisions to MGSG oversight helps connect Part A design with Part B operation before handover rather than after problems emerge.

Pharmacy: medical gases are medicines

The increased visibility of pharmacy is one of the most important aspects of the 2026 governance model. Medical gases occupy an unusual position: they are medicinal products delivered through permanent engineering infrastructure and used directly in patient care. That combination means engineering, pharmacy, and clinical governance cannot sensibly operate in isolation.

The Chief Pharmacist brings medicines-governance oversight to decisions that may otherwise appear predominantly technical. Pharmacy and QC involvement is particularly important around gas quality, commissioning and return to service, changes in medicinal gas use, cylinder management, contingency supplies, incidents, and the transition away from piped nitrous oxide where clinically appropriate.

This does not mean pharmacy is expected to design pipework or manage engineering permits. Equally, Estates should not be expected to provide pharmaceutical assurance. The strength of the revised structure is that responsibilities remain distinct while the governance interfaces become clearer. Engineering verification can demonstrate that the pipeline performs correctly; QC can provide the required pharmaceutical-quality assurance; clinical representatives can confirm that the service is suitable for patient use.

A strong MGSG should therefore be genuinely multidisciplinary, not an Estates meeting to which pharmacy and clinicians are occasionally invited. Pharmacy should be able to challenge proposals, understand outstanding risks, and influence decisions where medicines governance is affected. That is particularly relevant when a technical change alters how a medicinal gas is stored, produced, distributed, or presented to clinical users.

CARA: from a list of defects to active risk management

Part B’s Compliance Audit and Risk Assessment (CARA) gives organisations a clearer mechanism for understanding the condition of existing systems and translating deficiencies into managed risk. This is important because much of the NHS estate is old, complex, and continually modified. Complete immediate compliance may not always be technically or financially achievable, but unmanaged non-compliance is not an acceptable alternative.

The CARA process creates a logical chain: identify the deficiency, understand the consequence, assess the risk, prioritise the action, assign ownership, implement controls, and review progress through governance. Where a permanent solution cannot be delivered immediately, interim controls and residual risk should remain visible rather than disappearing into an old audit report.

This also gives the Operational Policy a stronger purpose. It should reflect the actual system, the known risks, and the arrangements the organisation uses to control them. If a site has a capacity limitation, unusual isolation arrangement, temporary resilience measure, or outstanding remedial action, the management system should acknowledge it and ensure the relevant people understand what it means in practice.

Competence: a certificate is not the end of the process

The revised Part B also places greater emphasis on competence. Training remains fundamental, but attendance on a course is only one part of the evidence. Skills, knowledge, experience, and behaviours need to be considered alongside formal assessment, appointment, site familiarisation, and clearly defined limits of authority.

This matters particularly for AP(MGPS)s and CP(MGPS)s. A person may be experienced on one type of plant or one healthcare site but unfamiliar with another organisation’s complex distribution network, emergency arrangements, or local procedures. Site-specific knowledge is therefore an important component of safe authorisation. The same principle applies to contractors: commercial appointment does not automatically demonstrate competence for every MGPS task.

Governance should make competence visible. Training dates, refresher and reassessment status, appointments, scope limitations, deputies, and gaps in cover should be capable of review. If the organisation does not have sufficient competent AP resources to support safe permits, projects, and emergencies, that is a governance and resilience risk rather than simply an Estates staffing inconvenience.

A more robust Permit-to-Work system

For APs, one of the most practically significant changes is the strengthened Permit-to-Work (PTW) process. The permit is not simply permission for a contractor to start work. It is the structured control that links the engineering intervention to isolation, contingency, clinical communication, testing, pharmaceutical assurance where required, and safe return to service.

The 2026 process makes the AP’s engineering-control role clearer. The AP determines which engineering tests are required before testing takes place, records those requirements, examines the installation, and witnesses the CP carrying out the specified tests. The results are recorded and the AP controls progression through the subsequent stages.

This separation is deliberate. The person who installs or modifies the system should not simply decide what testing is sufficient and then provide their own assurance that the work is acceptable. The CP carries out the work and performs the required engineering tests; the AP provides independent engineering control and acceptance. Where pharmaceutical QC is required, that remains a distinct assurance stage before clinical return to service.

The strengthened permit arrangements also improve traceability. Clear work descriptions, current drawing references, isolation information, sketches or mark-ups, hazard classification, contingency arrangements, and defined test requirements reduce the opportunity for assumptions. In a complex hospital, knowing exactly which valve was isolated and which part of the system was affected can be as important as the physical work itself.

Why make this more robust? Because MGPS work frequently takes place on live healthcare infrastructure. A small modification can have consequences beyond the immediate work area if the isolation boundary is misunderstood, a valve is incorrectly identified or testing is incomplete. The PTW is therefore a patient-safety control, not a contractor administration form.

Operational resilience: making the engineering usable in an emergency

Part B also reinforces that installed resilience must be operationally usable. A tertiary oxygen arrangement, emergency manifold, or cylinder stock provides limited protection if staff do not know when to deploy it, the connections are inaccessible, the required equipment cannot be located, or clinical teams have not considered how patients will be prioritised during a prolonged interruption.

Emergency planning therefore needs engineering, clinical, pharmacy, and operational input. 

Scenarios should consider not only complete source failure but abnormal demand, distribution restrictions, electrical failure, loss of a pressure-control component, plant maintenance, and the practical deployment of temporary supplies. Business continuity arrangements should recognise that medical gases can be a limiting factor in maintaining clinical services.

This is another area where pharmacy contributes more than gas-quality testing. Cylinder stocks, medicinal gas availability, contingency supply routes, and changes in consumption all have medicines-management implications. Clinical teams, meanwhile, need to understand what equipment can be supported and what actions may be required if supply becomes constrained. Resilience is strongest when these plans are agreed before an incident, not improvised during one.

The golden thread: information as a safety control

Good governance depends on good information. An AP cannot plan a safe isolation if the drawings are wrong. A designer cannot assess an extension properly if previous modifications are undocumented. An MGSG cannot make an informed capacity decision if the organisation does not know the validated design basis of the system.

The technical file and golden-thread philosophy in Part A therefore have a direct Part B consequence. Design assumptions, calculations, material records, commissioning results, drawings, and subsequent modifications need to remain usable throughout the life of the system. Permits, maintenance records, risk assessments, and operational changes add to that evidence base.

The objective is continuity of knowledge. Healthcare staff change, contractors change and buildings are repeatedly altered, but the safety-critical information should remain. In that sense, good documentation is not an administrative by-product of the MGPS; it is part of the system’s resilience.

Taken together, Parts A and B create a much stronger life cycle approach.

Rob’s Part A perspective asks: What does the patient and clinical service require, what can the infrastructure genuinely deliver, and what is the most appropriate engineering solution?

Richard’s Part B perspective asks: Who owns the risk, who is competent to make the decisions, how is the system controlled, and how does the healthcare organisation know it remains safe?

The two cannot be separated.

An informed design needs effective operational management. Equally, excellent operational management cannot compensate indefinitely for an MGPS that no longer meets clinical demand.

That is perhaps the biggest change in HTM 02-01:2026. It moves the conversation beyond individual pieces of plant, pipework, and permits, towards whole-system, whole-life medical gas safety.

For healthcare Estates teams, APs, AEs, designers, pharmacy, and clinical colleagues, the challenge now is not simply to read the new HTM. It is to understand what has changed, identify what those changes mean for the systems we already operate, and ensure that engineering, pharmaceutical, clinical, and governance arrangements work together.

For capital projects, that means challenging inherited assumptions and documenting the evidence behind the selected design. For operational teams, it means knowing the system’s limitations and maintaining competent control. For pharmacy and clinical colleagues, it means being active participants in decisions that affect medicinal gas quality, availability, and patient care. For Boards and senior leaders, it means recognising MGPS as a safety-critical organisational risk that requires visible assurance.

Ultimately, the measure of a successful MGPS is not how large the plant is, how new the pipework is, or how many compliance boxes have been ticked. It is whether the right medical gas, at the right quality, pressure, and flow, remains safely available to the patient when it is needed most.