Two NFPA Codes, One Message — but UK Hospitals Answer to a Different Set of Rules
The codes are BS 5839-1, the NHS’s own estates guidance (HTM 06-01, formerly HTM 82), and the NHS Data Security and Protection Toolkit (DSPT).
This article covers what UK regulation actually requires for hospital fire alarm cybersecurity, then explains how the US codes compare and where they’re a useful benchmark.
BS 5839-1:2025: What’s New for Networked Fire Alarm Systems
BS 5839-1 is the British Standard code of practice for the design, installation, commissioning, and maintenance of fire detection and fire alarm systems in non-domestic buildings — including hospitals, where it’s applied alongside NHS-specific guidance in HTM 06-01 (which builds on the earlier HTM 82).
The 2025 revision of BS 5839-1 caught up with a reality that fire alarm systems in modern hospitals had already reached: many are now networked, connected to Building Management Systems (BMS), and in some cases remotely monitored over the cloud. The update introduces:
- Compatibility requirements with Building Management Systems (BMS), recognising that fire alarm systems increasingly sit within a wider connected building network rather than standing alone.
- Cybersecurity considerations for networked fire alarm systems, addressing a gap that previously didn’t exist in UK fire alarm standards.
- Data protection and privacy requirements for cloud-connected systems, relevant to any fire alarm platform offering remote monitoring or diagnostics.
- Standards for remote monitoring and maintenance, covering how vendors and facilities teams access these systems remotely.
This is a genuinely new area for UK fire alarm guidance. Previously, cybersecurity wasn’t something BS 5839-1 addressed at all — it was left to whatever separate IT or information governance framework a hospital happened to apply.
NHS DSPT: The Data Security Obligation Hospitals Can’t Ignore
Separately from fire alarm standards, any NHS organisation — and any supplier connected to NHS systems or patient data — must complete the NHS Data Security and Protection Toolkit (DSPT) annually. It’s a mandatory self-assessment aligned to the National Cyber Security Centre’s Cyber Assessment Framework, and it’s a requirement for holding NHS contracts, not an optional best practice.
DSPT covers areas directly relevant to a networked fire alarm system, including:
- Role-based access controls, reviewed regularly rather than granted once and forgotten.
- Identification of unsupported systems — legacy operating systems, software, or hardware that can’t be patched.
- Incident reporting, with specific timeframes for reporting data security incidents through the toolkit.
- Business continuity planning that accounts for data security disruptions, not just physical system failure.
A fire alarm system connected to a hospital’s network — with a vendor able to remotely monitor or update it — falls squarely within the scope of what DSPT expects a hospital and its suppliers to have under control.
Why This Convergence Matters
BS 5839-1’s 2025 cybersecurity update and the NHS DSPT’s ongoing requirements are converging on the same point from two different directions: a fire alarm system is no longer just a life-safety device, it’s a networked endpoint that needs to be managed as part of the hospital’s broader security posture.
For hospital facilities teams, that means fire alarm procurement and design decisions can no longer sit entirely separate from IT and information governance. Whoever specifies or maintains the fire alarm system needs to be able to answer DSPT-style questions about it: who has access, is it running supported software, what happens if it’s compromised.
What a UK Hospital’s Fire Alarm Cybersecurity Plan Needs to Cover
Combining what BS 5839-1:2025 and NHS DSPT expect, a practical starting checklist looks like:
- Access controls — clearly defined, regularly reviewed rules for who can access the fire alarm network, in line with DSPT’s role-based access expectations.
- Network segmentation — keeping the fire alarm system separated from the hospital’s wider IT network where possible, so a breach in one doesn’t compromise the other.
- Supported software and firmware — a documented plan for identifying and migrating away from unsupported systems, which DSPT specifically checks for.
- Incident response — a plan for what happens if the system is compromised, aligned with DSPT’s incident reporting timeframes.
- Remote monitoring safeguards — clear controls around how vendors and facilities teams access the system remotely, per BS 5839-1:2025’s new remote monitoring guidance
Fire and Gas Healthcare Contracts – Protex Systems
NFPA 72 & NFPA 99: An International Reference Point
Even though NFPA 72 and NFPA 99 don’t apply legally in the UK, they’re worth knowing about because the US has moved faster and gone into more technical depth on this specific issue.
NFPA 72’s 2025 edition introduced an enforceable Chapter 11 on cybersecurity, requiring any network-connected fire alarm or emergency communications system to have a documented plan covering access controls, firmware update procedures, network segmentation, and incident response — with the required security level scaling based on how the system connects to a network.
NFPA 99’s 2027 edition, covering US healthcare facilities specifically, is adding its own cybersecurity chapter alongside updates to electrical and medical gas systems, reflecting the same rise in attacks on building automation systems that’s driving BS 5839-1’s update.
For UK estates and IT teams, NFPA 72’s twelve-section cybersecurity chapter is a genuinely useful design reference where BS 5839-1:2025’s newer, less detailed guidance needs filling in — particularly on how to scale security requirements to different types of network connection.
Practical Next Steps for UK Hospital Facilities
- Check whether your fire alarm system falls under BS 5839-1:2025’s new cybersecurity provisions — any networked or BMS-integrated system likely does.
- Confirm your fire alarm vendor’s remote access practices are DSPT-compliant, including whether they can demonstrate supported software and documented access controls.
- Review network segmentation between the fire alarm system and the hospital’s broader IT and clinical networks.
- Build fire alarm cybersecurity into your next DSPT self-assessment rather than treating it as a separate estates issue.
- Use NFPA 72 as a design reference where BS 5839-1:2025’s guidance needs more technical detail, particularly for security-level scaling by connection type.
Frequently Asked Questions
Is NFPA 72 relevant to UK hospitals? Not legally — NFPA 72 has no standing in the UK, where BS 5839-1 and NHS HTM 06-01 apply instead. It’s used informally as a technical reference because its cybersecurity chapter is currently more detailed than UK-specific guidance.
Does BS 5839-1:2025 apply to existing fire alarm systems, or only new installations? BS 5839-1 is a code of practice rather than retrospective law, so existing systems aren’t automatically required to be upgraded. However, hospitals reviewing, extending, or replacing a fire alarm system would be expected to design to the current edition, and NHS DSPT’s ongoing data security expectations apply regardless of when the system was installed.
Do all NHS suppliers need to complete the DSPT, or just NHS trusts? Any organisation with access to NHS patient data or systems must complete the DSPT annually, including NHS suppliers, technology vendors, and contractors — not just NHS trusts themselves.
What’s the difference between HTM 82 and HTM 06-01? HTM 06-01 is the current NHS Estates guidance for fire safety in healthcare premises, building on and superseding the earlier HTM 82. Both are applied alongside BS 5839-1 rather than replacing it.
