Iberian Peninsula blackout
A grid collapse cut power to continental Spain and Portugal for about ten hours. Hospitals largely held on generators; care outside them did not.[21,22,17,18,23]
how automated healthcare fails, how you'd know, and what to do at each tier — every claim sourced, reviewed continuously
Electricity, fuel, water, heat and cooling, including the physical data centres everything clinical now runs on; when they fail, the decision support goes too.
This layer is the physical base of the hospital: utility feeds, generators and automatic transfer switches, uninterruptible power supplies (UPS), fuel, water and heat, HVAC and data-centre cooling, and the physical plant of the off-site data centres that host the EHR and its connected services. Software and control-plane failures inside a cloud provider belong to Connectivity & data. In US hospitals it is regulated mainly through CMS's emergency preparedness rule (42 CFR 482.15) and the NFPA 99 and NFPA 110 codes that CMS enforces.
Everything else on this site stands on it. Monitors, infusion pumps and ventilators need electricity; the EHR, order entry, lab analyzers, PACS, paging and any AI model need electricity, cooling and a working data centre. The documented failures are rarely 'the generator did not exist'. They are a fuel pump in a flooded basement, a cooling unit that trips in record heat, two 'redundant' sites that share the same weather, or a DNS fault in a cloud region hundreds of miles away.
A paper-era hospital that lost power lost light, lifts and life-support devices. A 2026 hospital also loses its records, its order sets, its alerts and its models, IT loads frequently sit on UPS and generator branches that were sized and tested for life-safety loads, not for whole data centres, and a cloud region can fail while the building's lights stay on.
FailSystems viewAutomation moves cognitive work onto the power layer. When the lights go out in 2026 you lose the decision support, the medication checks and the patient's history, not just the monitors, and you lose them at the moment clinicians are also running an evacuation or a surge. Power failures are also where 'redundancy' is most often an illusion: backup systems share a basement, a heatwave, a fuel supplier or a cloud region with the thing they back up. We judge this layer's defining risk to be correlated failure, not single-component failure.
Generators are raised, but fuel tanks, fuel pumps, transfer switches or switchgear stay at or below grade. Water reaches the lowest component and the whole chain stops. CMS requires flood-free generator placement only for new construction, renovation or new generators, so older sites can remain exposed.[1,2,3,4]
Warning signs
Seen inSuperstorm Sandy: NYU Langone and Bellevue lose backup power and evacuate, Hurricane Katrina: Memorial Medical Center loses all power
On-site fuel covers the design duration, but regional events close roads, knock out fuel pumps at stations and create competition for deliveries. Generators then run in 'constant fear' of stopping. The same fuel shortage keeps staff from getting to work.[1,5,6,7]
Warning signs
Seen inSuperstorm Sandy: NYU Langone and Bellevue lose backup power and evacuate, Texas winter storm: record load shed, hospitals lose water and heat
Generators are tested monthly, but a real outage asks for hours or days at full building load. In 2003 multiple New York City hospital generators failed during the blackout, and in 2012 OIG found backup generators unreliable at 28 of the 69 Sandy-area hospitals that lost utility power. NFPA 110 and The Joint Commission set monthly and 36-month load tests to catch this. IT has a further gap: servers and network gear drop in the seconds before generators pick up unless a UPS carries them, and ONC's SAFER guide asks for at least 10 minutes of UPS for the EHR, tested monthly.[8,1,9,10,2,5]
Warning signs
Seen inNortheast blackout: New York City hospital generators fail, Superstorm Sandy: NYU Langone and Bellevue lose backup power and evacuate
Chillers, condensers and air handlers fail in extreme heat or lose their own supply, while the rest of the building still has power. Data-centre equipment overheats and fails within hours; frail patients overheat over days. Both are often seen as facilities problems rather than clinical ones until harm occurs.[11,12,13,14,6]
Warning signs
Seen inGuy's and St Thomas': heatwave cooling failure takes down both data centres, Hurricane Irma: nursing home loses air conditioning while power stays on
A wide-area grid failure takes out water pressure, heating, fuel supply, telecoms and EMS at once. Hospitals on generators can still lose heat (boilers fed by city water), labs, imaging and records, and receive patients whose home medical devices have stopped.[7,15,16,17,18,19]
Warning signs
Seen inTexas winter storm: record load shed, hospitals lose water and heat, Iberian Peninsula blackout, Northeast blackout: New York City hospital generators fail
A grid collapse cut power to continental Spain and Portugal for about ten hours. Hospitals largely held on generators; care outside them did not.[21,22,17,18,23]
Air conditioning tripped at both trust data centres on the UK's record-heat day. Clinical IT went down and the trust ran on paper for weeks.[11,12]
Freezing weather knocked out generation and forced the largest controlled load shed in US history. Power loss spread to water systems and hospitals, and to patients at home on powered medical equipment.[7,15,16,24,25,26]
PathPower → Devices → Human handoff
Irma knocked out the transformer feeding a nursing home's air conditioning. 14 residents died; 12 deaths were ruled homicides.[13,14]
Storm surge flooded basements holding fuel tanks and pumps at two Manhattan hospitals whose generators sat on upper floors. Both hospitals evacuated.[2,27,1]
After city power failed, Memorial ran on generators that failed as floodwater rose. 45 bodies were later recovered from the hospital.[4,28,29]
During the 2003 blackout multiple NYC hospital emergency generators failed. The outage was associated with about 90 excess deaths citywide.[8,30]
What should already be in place at each degradation tier for this layer. Tier 0 is normal automated running; tier 3 is paper, batteries and judgement.
These are practices reported or recommended in the cited sources, gathered for reference. They are not a prescription for your organisation; judge what fits your setting, and check the current official text of any standard.
| Instrument | What it requires |
|---|---|
| 42 CFR 482.15 — CMS Emergency Preparedness Condition of Participation (2016 rule) | Hospitals must provide alternate energy for safe temperatures, emergency lighting, fire alarm and sewage; site generators per NFPA 99/101; follow NFPA 99/110/101 emergency power testing and maintenance; have a fuel plan; exercise twice a year and review the plan at least every two years.[6] |
| NFPA 110, Standard for Emergency and Standby Power Systems (CMS enforces 2010 ed.; 2025 is current) | Sets performance, installation, maintenance and testing of emergency power systems, including monthly load exercise at 30% of nameplate or minimum exhaust temperature and a 4-hour test every 36 months.[34] |
| NFPA 99, Health Care Facilities Code (CMS enforces 2012 ed.) | Applies electrical and other building-system requirements by risk category; Category 1 covers systems whose failure is likely to cause major injury or death.[10] |
| The Joint Commission EC.02.05.07 (emergency power testing) | Accreditation standard requiring monthly generator load tests and the 36-month 4-hour test, aligned with NFPA 110.[9] |
| ONC/ASTP SAFER Guide: Contingency Planning (2025) | Recommended practices: EHR on UPS for at least 10 minutes, generator support for critical EHR functions, 2 days of fuel, flood-safe siting, a remote warm site, and a tested read-only backup EHR.[5] |
In England, Health Technical Memorandum 06-01 (NHS England; last updated April 2017) sets the legal, design, operation and maintenance expectations for hospital electrical infrastructure, including existing sites. The Guy's and St Thomas' review shows those rules did not reach data-centre cooling in practice. In the EU, the Critical Entities Resilience Directive (2022/2557) brings both health and energy into scope and requires designated critical entities to assess all relevant risks at least every four years and keep a resilience plan. The April 2025 Iberian blackout, analysed by the ENTSO-E expert panel, is the reference event for grid-wide failure in Europe.[35,36,11,21]
FailSystems judgementOur judgement: whole-facility power loss is uncommon for any one hospital, but weather and heat events recur often enough across the sector to score 3. When it happens it removes every other layer at once, so blast radius is 5. A blackout itself is obvious, but the causes (a flooded fuel pump, an ageing condenser, a shared failure domain) stay hidden until the event, so detectability scores 3.
Each factor is scored 1–5 and multiplied, as in a classic FMEA risk priority number. This is our first-draft judgement, not a measurement; see how scoring works and how it will be revised.
These gaps drive what the nightly research pass looks for. If you have evidence, send it.
Cite this pageFailSystems. “Power & infrastructure.” https://failsystems.health201.com/layers/power/ (reviewed 2026-09-26). Health 201 / AstroNexus LLC. CC BY 4.0.
Information only, not advice. FailSystems is an aggregation and synthesis of published sources. It is not consulting, engineering, legal, regulatory or medical advice, and using it creates no professional relationship. Health systems are complex and no approach fits every organisation: anything you adopt is your own decision, at your own risk, and should be checked against the current official sources and by qualified people who know your setting. Full disclaimer.