Loss of continuity of oxygen supply — supply sources, reserves and risk analysis according to Annex F
Within a single year, three Polish hospitals lost continuity of oxygen supply for three different reasons: an empty tank, a cracked manifold and overloaded vaporisers. All three scenarios are described explicitly in the risk analysis table of Annex F to PN-EN ISO 7396-1:2016 — together with an indication of who is responsible for them.
The year 2021: three failures, three different causes, one outcome
Temporary hospital at the MTP grounds in Poznań, 30 March 2021 There were interruptions in oxygen therapy and some intubated patients were evacuated to other facilities. The prosecutor's office established that the cause was an insufficient quantity of oxygen in the main tank and in the reserve tank, and the absence of the required number of cylinders as an emergency source. The case ended with an indictment against the then head of the energy section of the technical department — the presumption of innocence applies until a final judgment. From a technical point of view, however, what matters is something other than the liability of a particular individual: all three levels of supply, which are supposed to back one another up, failed simultaneously.
District hospital in Włoszczowa, spring 2021 A fractured elbow in the main distribution manifold caused a sudden pressure drop with 80 hospitalised COVID-19 patients. The situation was brought under control solely because the facility had cylinders left from an earlier upgrade of the installation that could be quickly connected into the system. The reserve worked because it was physically on site and it fitted.
Szpital Południowy in Warsaw, October 2021 Insufficient capacity of the vaporisers under a load many times exceeding the installation's original design assumptions. Crisis intervention by the voivode, delivery of a tank from strategic reserves and construction of an additional oxygen line were required. The installation did not fail in the ordinary sense — it operated exactly as designed, but the design had ceased to match reality.
Annex F: the standard describes these scenarios explicitly
Annex F to PN-EN ISO 7396-1:2016 is not a collection of good practices or a wish list. It is a risk analysis table which lists, among others:
- failure of a critical component,
- failure of the maintenance system,
- incorrect specification of the supply sources,
- changes in oxygen demand arising over time.
Each of the three incidents from 2021 fits into this catalogue without any stretching. These were not unforeseeable situations — they were situations anticipated by the standard and never worked through at the facility.
| Hazard from the Annex F table | What it looks like in practice | Risk control measure |
|---|---|---|
| Incorrect specification of the supply sources | Main tank, back-up tank and emergency cylinders sized for assumptions that no longer apply | Routine inspections of supply sources and alarm systems |
| Changes in oxygen demand arising over time | New workstations and new equipment connected to the installation, occupancy beyond the design assumptions | Testing of the alarm systems for detectability of failures of critical components |
| Failure of a critical component | A cracked elbow in the manifold, insufficient capacity of the vaporisers | Maintaining a stock of critical spare parts |
| Failure of the maintenance system | No schedule, no documented alarm tests | Operational Management Documentation relating to periodic inspection of the installation |
The two things that in practice decide the matter most often are placed by the standard outside the table of Annex F. Verification actual the capacity of the primary tank, the back-up tank and the cylinder supply source — against current rather than design demand — is a control question. Consulting the Authorised Person (AP) on every purchase of equipment to be connected to the installation is, in turn, recommended by Annex G.
Who is responsible for the control measures
This is the most frequently overlooked part of Annex F. Responsibility for most of the measures indicated — routine inspections of supply sources and alarm systems, checking alarm systems for their ability to detect failures of critical components, maintaining a stock of critical spare parts and keeping the Operational Management Documentation — is assigned by the standard to the healthcare organisation (H), not to the manufacturer. Acceptance of the installation, the commissioning report and the contractor's warranty do not transfer this obligation to anyone else. From the day the system is handed over for operation, the hospital manages the risk.
Actual demand versus design demand
Oxygen demand is a variable quantity, whereas the specification of supply sources is a quantity recorded once, in the design. The divergence between them grows quietly: through increased occupancy, through a change in a ward's profile, through every further device connected to the installation. The case of Szpital Południowy shows the limit of that divergence: a load many times exceeding the original design assumptions was enough for the installation to stop being sufficient.
The standard answers this with two mechanisms. The first is the entry in the Annex F table on demand changes arising over time — that is, an obligation to recalculate periodically rather than to size once. The second is the recommendation in Annex G that every purchase of a medical device to be connected to the installation should be consulted with the Authorised Person (AP) — so that the system's design specification continues to be met. In this view, purchasing equipment is a decision about supply sources, not merely a procurement decision. More on the role and powers of the AP: Who in the hospital is responsible for the medical gas installation.
The reserve that works and the reserve that exists on the drawing
Comparing Poznań and Włoszczowa gives the sharpest lesson of the whole of 2021. In both cases the emergency supply source existed in the documentation. In one it was physically available and could be quickly connected. In the other — the required number of cylinders was missing. The difference between these two states is not visible from the installation diagram or from the supply contract. It is visible only in the inspection of supply sources and in the current records.
Check questions that must be answerable from a document, not from memory:
- What is actual the capacity of the main tank, the reserve tank and the emergency cylinder source — against current demand, not the design demand?
- Are the alarm and signalling systems tested at regular intervals and the results documented?
- Have the alarms been checked for their ability to detect failures of critical components, and not merely for whether the signalling device sounds at all?
- Is a stock of critical spare parts kept, or are they ordered only after a failure?
Record in the documentation
Checking the operating parameters and alarms of supply sources falls within the typical scope of a periodic inspection of a medical gas installation. Its result goes into the documentation required by art. 63 ust. 3 of the Act on Medical Devices, and the date of the next activity — into the documentation under art. 63 ust. 4. All of it is retained for not less than 5 years from the date the device ceases to be used (art. 63 ust. 5). This is not archiving: it is the only material with which a hospital can demonstrate that it actually managed the risk control measures from Annex F. We discuss the legal basis of this obligation separately: Periodic inspections of medical gas installations are a statutory obligation.
The same set of documents works towards accreditation. Standard JZ12 deals directly with emergency backup of power, water and medical gases, CO2 — with conduct in exceptional situations, and group BP1 — with adverse events, which include a gas failure, lack of oxygen and a faulty alarm. Here the register of supply sources, the inspection schedule and the emergency procedure are evidence, not a formality.
Frequently asked questions
We have a main tank, a reserve tank and cylinders entered in the documentation — how do we check whether that reserve will really work?
The actual capacity of the main tank, the reserve tank and the cylinder-based emergency source must be verified, as well as whether the cylinders can physically and quickly be connected into the installation. In Poznań, in March 2021, oxygen ran out simultaneously in the main tank, in the reserve tank and in the required number of cylinders, which ended in interruptions to therapy and the evacuation of patients. In Włoszczowa, a rupture of the main manifold with 80 COVID-19 patients was brought under control because the facility had cylinders left from an earlier upgrade of the installation that could be quickly connected into the system. In both cases the emergency source existed in the documentation — the difference lay in whether it was physically available.
We are expanding a ward and adding more equipment — does the oxygen demand then have to be recalculated?
Yes — the standard requires demand to be recalculated periodically, and every purchase of a medical device to be connected to the installation should be consulted with the Authorised Person (AP). Oxygen demand is a variable quantity, whereas the specification of supply sources is a quantity recorded once, in the design; the divergence between them grows quietly through increased occupancy, a change in a ward's profile and every further connected device. In Warsaw, in October 2021, the vaporisers proved inadequate under a load many times exceeding the original design assumptions.
How long must a hospital retain the inspection documentation of the medical gas installation and what does it actually deliver?
Inspection documentation is kept in accordance with art. 63 of the Act on Medical Devices and retained for not less than 5 years from the date the device ceases to be used. Checking the operating parameters and alarms of supply sources falls within the typical scope of a periodic inspection of a medical gas installation, so its results should be visible in those records. This is the only material with which a hospital can demonstrate that it actually managed its risk control measures, and at the same time material used during accreditation.
Basis
- Act of 7 April 2022 on medical devices — art. 63, paras. 3, 4 and 5.
- PN-EN ISO 7396-1:2016-07 — Annex F (risk analysis table, risk control measures, responsibility of the healthcare facility H); Annex G (the role of the Authorised Person AP, consultation on purchases of equipment connected to the installation).
- Accreditation standards: JZ12 (emergency supply of power, water and medical gases), CO2 (procedure in special situations), BP1 (adverse events).
- Gazy Medyczne w Praktyce, Zeszyt 1, 2026 ed., INMED S.A. — Operational Management Documentation, types of service activities, link with accreditation requirements.
- Press and trade materials: Głos Wielkopolski, 2026 (indictment, temporary hospital at MTP Poznań); Medycyna Praktyczna, 2021 (Włoszczowa).
The topic is developed in the guide „Medical gases in practice. Volume 1" (GMWP) developed by INMED S.A. — the legal qualification of the installation, staff competences, types of service activities, tests and acceptances, and the Operational Management Documentation together with template procedures and forms. Order the GMWP guide.