Two editions, one door, and the release conditions that are not negotiable
CMS incorporates NFPA 101, 2012 edition, by reference at 42 CFR §482.41(b)(1)(i) — and §485.623 for critical access hospitals — together with TIA 12-1 through 12-4. This came from the Medicare fire-safety final rule (81 FR 26899, effective July 5, 2016; surveys to the 2012 edition began November 1, 2016 under CMS S&C 16-29), and in that rule CMS made a promise in its own words: if it adopts a later edition, it will publish a document in the Federal Register to announce the change. It has not. The 2015, 2018, 2021, and 2024 editions all exist; for Medicare and Medicaid purposes CMS still enforces the 2012. Your state fire marshal, meanwhile, may have adopted a newer edition under state law — so on the very same door you can answer to two editions at once, and the honest posture is to build to the stricter and document the reconciliation.
The sections that govern the doors an integrator actually installs are the special locking arrangements: delayed egress (§7.2.1.6.1 — 15-second release, 30 where the AHJ approves), sensor-release of electrical locking systems (§7.2.1.6.2), the electrically controlled egress door assemblies new to the 2012 edition (§7.2.1.5.6), and the clinical-needs / security-threat and patient-special-needs provisions (§18/19.2.2.2.5.1 and §18/19.2.2.2.5.2). Annex A names pediatric units, maternity units, and emergency departments explicitly — which is why §18.2.2.2.5.2 is the citation behind the infant-abduction door every vendor sells a tag system for. In each case the lock must release on sprinkler activation, smoke detection, and loss of power, and staff must be able to unlock it at all times. One qualifier keeps the claim honest: under §482.41(b)(3), where CMS has found a state fire and safety code to protect patients adequately, that state code applies instead of NFPA 101.
This is the one place in healthcare where a regulation tells you how the hardware must behave — not merely that you must manage a risk. And it still resolves to the record: where a security recommendation and the Life Safety Code appear to conflict, life safety governs and the AHJ decides, and the surveyor’s question is whether you can prove the lock released when it had to. We build to the code, defer to the AHJ, and produce the test documentation. We do not overrule a fire marshal, and we never let a security feature defeat an egress path.
The four-question read a facilities director can answer without leaving his office
Trigger: CMS enforces the 2012 edition; your state may enforce the 2024; you comply with both. This is the read that tells you whether you can — and you hold every answer, in your building, right now. It is transcribed from the code, not invented.
- Do your controlled-egress and delayed-egress doors release on all three — sprinkler activation, smoke detection, and loss of power?
- Is the locking hardware UL 294 listed?
- Do clinical staff carry the unlocking means at all times?
- Can you produce the test documentation?
The first three are the code. The fourth is the one that protects you — can you prove it worked? That’s the question a surveyor actually asks, and the one most integrators never help you answer.
“No security integrator had ever called me about egress hardware. The one who opens with “CMS is still on the 2012 edition, and your state isn’t” is a different conversation entirely.”
Sources: 42 CFR §482.41(b)(1)(i) and (b)(3); §485.623 (CAH); Medicare fire-safety final rule 81 FR 26899 (eff. July 5, 2016); CMS S&C 16-29; NFPA 101 (2012 ed.) §§7.2.1.6.1, 7.2.1.6.2, 7.2.1.5.6, 18/19.2.2.2.5.1, 18/19.2.2.2.5.2 and Annex A; UL 294 for access-control listing. The line “security does not take precedence over life safety” is standards-body commentary, not NFPA 101 text, and is not attributed to the code here.
What would change this: Any CMS Federal Register notice adopting a later NFPA 101 edition; a state fire-code edition change affecting your AHJ; the next SOM Appendix A transmittal.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).