Failure mode and effects analysis of fuel and LPG shortage impacts on hospital operations: a framework for healthcare resilience in conflict-related supply disruptions

Abstract

Objectives

To conduct a proactive failure mode and effects analysis (FMEA) of patient safety risks arising from acute fuel and liquefied petroleum gas (LPG) shortage at a quaternary-care hospital in a modelled geopolitical conflict scenario and to produce a tiered preparedness framework.

Design

Proactive process FMEA using the Institute for Healthcare Improvement (IHI) Healthcare FMEA framework. Risk priority numbers (RPNs) were computed as severity (S)×occurrence (O)×detection (D), each scored 1–10.

Setting

A 455-bed quaternary-care hospital in South India.

Methods

A multidisciplinary team (infectious diseases, quality, engineering, dietetics, nursing, pharmacy) mapped 10 hospital departments across six structured sessions. The hazard scenario modelled a US–Iran war causing Strait of Hormuz closure and acute national fuel and LPG supply shock. Each failure mode was scored on S, O and D; RPN risk bands were defined as Critical (≥200), High (150–199), Medium (100–149) and Low (<100).

Results

62 failure modes were identified across 10 departments (RPN range 70–252; mean 143.3). 5 failure modes were Critical, 17 High, 34 Medium and 6 Low. The Generator/Power Backup department recorded the highest mean RPN (171.0), functioning as a systemic root-cause amplifier propagating risk across seven other departments. Laundry Services contained the highest-scoring individual failure mode (operating theatre/intensive care unit linen sterilisation failure, RPN 240); Kitchen Services—entirely LPG-dependent—recorded a mean RPN of 163.4. Critical clinical consequences, including ventilator failure, haemodialysis shutdown and emergency surgical cancellation, were traceable upstream to generator dependency.

Conclusions

Fuel and LPG shortage in a conflict scenario generates cascading, multisystem patient safety failures. Generator continuity is the paramount mitigation target. Kitchen and laundry services carry infection-control risks comparable in magnitude to clinical departments. A proactively constructed, RPN-stratified response framework is essential for hospital resilience in geopolitical emergencies.

WHAT IS ALREADY KNOWN ON THIS TOPIC

• Hospital operations are critically dependent on uninterrupted energy supply, and conflict-related disruptions to health infrastructure have caused preventable mortality in Gaza, Lebanon and Ukraine. Existing literature on hospital energy resilience focuses predominantly on natural disaster scenarios, with limited attention to the supply-chain dynamics of fuel or liquefied petroleum gas (LPG) shortage arising from geopolitical conflict.

WHAT THIS STUDY ADDS

• This is, to the authors’ knowledge, the first published failure mode and effects analysis specifically examining the patient safety impact of fuel and LPG shortage across the full spectrum of hospital departments—including kitchen, laundry, heating, ventilation and air conditioning, boiler and biomedical waste services—using a geopolitical conflict scenario. Generator dependency is identified as a systemic root-cause amplifier propagating risk across seven distinct departments, while kitchen and laundry services carry Critical or High infection-control risks equal to or exceeding those of many clinical departments, establishing these as non-negotiable infection-control infrastructure.

HOW THIS STUDY MIGHT AFFECT RESEARCH, PRACTICE OR POLICY

• Hospital disaster management plans should incorporate dedicated fuel and LPG contingency protocols, explicitly recognising kitchen and laundry as infection-control-critical infrastructure and national hospital preparedness standards—including the National Accreditation Board for Hospitals & Healthcare Providers in India and equivalent bodies internationally—should mandate minimum on-site fuel reserve requirements linked to geopolitical risk assessments.

Introduction

Hospitals are among the most energy-intensive buildings in the built environment, consuming approximately two and a half to three times more energy per unit floor area than comparable commercial buildings, and their dependence on uninterrupted fuel supply renders them acutely vulnerable to the supply-chain disruptions that accompany armed conflict.^{1 2} Modern quaternary-care hospitals rely on diesel for emergency generator sets, liquefied petroleum gas (LPG) for catering and sterilisation, and diesel again for transport and logistics.³ When fuel supply chains fracture—as they do in nearly every major armed conflict—the consequences propagate rapidly from infrastructure to patient care.

Real-world precedent is instructive. In Lebanon in 2021, the collapse of state electricity provision and acute diesel scarcity forced hospitals to operate entirely on private generators; the American University of Beirut Medical Center warned publicly that 40 adult patients and 15 children on mechanical ventilators would die within hours if diesel was not delivered.⁴ In Gaza, Al-Awda Hospital suspended most services in December 2025 because generator fuel fell below 800 L.⁵ In Ukraine, systematic attacks on energy infrastructure caused power outages in 92% of surveyed healthcare facilities, with direct effects on surgeries and life support.⁶

India’s energy profile makes this threat particularly salient. India imports approximately 88.6% of its crude oil requirement, with roughly 90% of LPG imports transiting the Strait of Hormuz.^{7 8} A US–Iran war causing Strait of Hormuz closure would simultaneously disrupt diesel supply chains and eliminate the dominant LPG import route, creating a compound energy emergency with no rapid domestic substitution pathway.

Despite this vulnerability, published literature on hospital preparedness in conflict scenarios focuses predominantly on mass-casualty surge capacity, trauma care and pharmaceutical supply chains. The specific intersection of fuel and LPG shortage with hospital infection control—encompassing linen sterilisation, food safety, autoclaving and heating, ventilation and air conditioning (HVAC) function—has received scant systematic attention. There are no published failure mode and effects analysis (FMEA) studies addressing the multidepartmental patient safety implications of fuel and LPG shortage from geopolitical conflict.

FMEA is a structured, proactive risk methodology quantifying failure risk through a composite risk priority number (RPN=S × O × D).⁹ Healthcare FMEA was formalised by the US Department of Veterans Affairs and is mandated annually by the Joint Commission on Accreditation of Healthcare Organizations.¹⁰ It has been applied across clinical processes but rarely to infrastructure supply-chain scenarios.^11–13

This study reports the findings of a prospective Healthcare FMEA at a 455-bed quaternary-care hospital in South India, examining patient safety risks from acute fuel and LPG shortage in a modelled US–Iran war scenario. The primary objective was to identify, score and stratify failure modes across all energy-dependent hospital departments; the secondary objective was to provide a priority-stratified preparedness framework.

Methods

Study design

This was a prospective process FMEA conducted as a structured preparedness exercise. The analysis examined energy-dependent systems across the entire hospital. No patients were involved.

Setting

The study was conducted at a 455-bed quaternary-care hospital in South India offering cardiac surgery, neurosurgery, solid organ transplantation, neonatal intensive care, haemodialysis and radiation oncology. It also operates a round-the-clock emergency department that serves as a major regional referral centre. The hospital operates multiple intensive care units (ICUs), eleven main operating theatres (OTs) with laminar airflow, a central sterile services department (CSSD) and a hospital kitchen serving approximately 900 meals per day. Primary energy sources are mains grid electricity backed by diesel standby generators and LPG piped to kitchen and sterilisation areas.

Hazard scenario

The modelled hazard was a US–Iran armed conflict causing closure or sustained disruption of the Strait of Hormuz, resulting in (a) acute national diesel and petrol shortage due to crude oil import disruption and (b) acute LPG shortage due to cessation of Gulf LPG imports, which ordinarily account for approximately 90% of India’s imported LPG.⁸ The scenario assumed sustained disruption of 21 days or more, during which domestic fuel reserves would be progressively depleted without reliable resupply.

FMEA team composition

A multidisciplinary FMEA team comprising a consultant in infectious diseases and infection control, quality and patient safety officer, senior biomedical/clinical engineer, chief dietitian, senior nurse manager (ICU and OT) and lead pharmacist met over six structured 2-hour sessions. Departmental heads were consulted during process mapping.

Scoring methodology

The IHI Healthcare FMEA framework was followed.¹¹ Each failure mode was scored on three dimensions (table 1).

Table 1. FMEA scoring scales used in this analysis: severity (S), occurrence (O) and detection (D) anchors.

Score	Severity (S)	Occurrence (O)	Detection (D)
10	Catastrophic: death or permanent major harm to multiple patients	Near-certain in defined scenario	No detection possible before patient harm
9	Severe: life-threatening harm, major organ failure, septicaemia	Near-certain	Remote detection chance
8	Very high: probable serious patient harm or major procedural failure	Very frequent	Very low detection probability
7	High: potential for significant patient harm; major service disruption	Frequent (failure within 48–72 hours of shortage onset)	Low detection probability
6	Significant: patient discomfort, increased length of stay, additional treatment	Moderately high (within 1 week)	Low to moderate detection
5	Moderate: significant service impact, delayed care	Moderate likelihood	Moderate detection
4	Low: temporary service degradation, compensable impact	Moderately rare	Moderate to high detection
3	Minor: non-critical service delay, minor patient inconvenience	Occasional occurrence	High detection probability
2	Very minor: patient inconvenience, no clinical consequence	Very rare	Very high detection probability
1	No patient harm or negligible effect	Extremely unlikely	Almost certain pre-harm detection

• Severity (S, 1–10): Magnitude of patient harm if the failure occurred; score 10=death or permanent major harm.

• Occurrence (O, 1–10): Likelihood of failure in the defined scenario; calibrated to the near-certainty of fuel deprivation, with scores 7–8 indicating failure within 48–72 hours of sustained shortage.

• Detection (D, 1–10): Likelihood that failure would not be detected before patient harm; generally moderate (2–5), reflecting the insidious onset of supply-chain failures.

RPN risk bands were defined a priori as Critical (RPN≥200, immediate action); High (150–199, action within 72 hours); Medium (100–149, action within 2 weeks) and Low (<100, quarterly review) (see table 2).

Table 2. RPN risk stratification bands, distribution of failure modes identified in this analysis and required action timeframes.

Risk band	RPN range	No. of FMs	% of total	Required action and timeframe
Critical	≥200	5	8.1	Immediate: escalate to hospital administrator and clinical governance within 24 hours; activate emergency operations protocol
High	150–199	17	27.4	Urgent: assign dedicated owner; convene Emergency Operations Committee within 72 hours
Medium	100–149	34	54.8	Action plan within 2 weeks; include in departmental risk register; monthly monitoring
Low	<100	6	9.7	Monitor; review quarterly; document in departmental meeting minutes

FM, failure mode; RPN, risk priority number.

Scope

10 hospital departments were analysed: Kitchen Services; Laundry Services; Generator/Power Backup; HVAC and Infection Control; Boiler and Steam Services; Clinical Services (ICU, OT, dialysis, respiratory support); Pharmacy and Cold Chain; Transport and Logistics; Biomedical Waste Management; and IT and Communication Infrastructure.

Risk mitigation and post-mitigation scoring

For each Critical and High failure mode, the multidisciplinary team defined one or more targeted mitigation actions directed at the specific driver of risk: reducing occurrence through fuel and consumable reserves, redundancy and pre-authorised resupply; improving detection through continuous monitoring, alarms and automated load management; and, where a process could be substituted, lowering severity by preserving critical functions on protected circuits. Each mitigated failure mode was then re-scored on the same S, O and D scales (table 1) to yield a projected post-mitigation RPN, following the standard FMEA action-and-reassessment cycle. Projected post-mitigation RPNs represent the anticipated residual risk once the recommended actions are fully implemented and are planning estimates rather than measured post-implementation values. Recommended actions and projected post-mitigation RPNs for all Critical and High failure modes are presented in table 3.

Table 3. Recommended mitigation actions and projected post-mitigation RPNs for all Critical and High failure modes.

Department	Failure mode	Recommended mitigation action	Base RPN	Projected post-mitigation RPN	Residual band
Generator/Power Backup	Diesel supply chain breakdown	Pre-authorised priority fuel resupply under state disaster protocol; ≥7–10-day on-site diesel reserve; dual-supplier contracts; telemetry fuel-level monitoring	252	108	Medium
Laundry Services	OT/ICU linen sterilisation failure	Reserve steam/LPG on a protected circuit for CSSD and laundry; validated thermo-chemical disinfection contingency; buffer stock of sterile disposable linen for OT/ICU	240	60	Low
Generator/Power Backup	Non-critical load mismanagement	Automated load-shedding hard-wired to prioritise ICU, OT and CSSD circuits; documented load-priority matrix; staff drills	240	48	Low
Kitchen Services	Inability to achieve cooking temperature≥74°C	Electric induction cooking on a protected circuit; validated core-temperature probes; retort/ready-to-eat therapeutic meals during shortage	216	54	Low
Laundry Services	Infectious linen not processed safely	Segregated handling; validated thermo-chemical disinfection; single-use linen for tuberculosis, MDRO and C. difficile cases when thermal disinfection is unavailable	200	60	Low
Kitchen Services	Utensil decontamination /water-boiling failure	Electric boilers and dishwashers on a protected circuit; single-use utensils for immunocompromised units	192	72	Low
HVAC & Infection Control	Isolation room cleaning failure	Prioritised cleaning roster; battery/uninterruptible power supply-backed cleaning equipment; audited terminal-cleaning checklist	192	64	Low
Laundry Services	Thermal disinfection failure (<60°C)	Continuous wash-temperature monitoring with alarms; priority steam allocation; chemical disinfection backup	189	72	Low
Pharmacy & Cold Chain	Critical drug stockouts	≥14-day buffer stock of essential and emergency drugs; dynamic reorder triggers; regional mutual-aid sharing	189	72	Low
Transport & Logistics	Supply delivery disruption	Pre-positioned consumable reserves; prioritised fuel for the logistics fleet; alternate supplier and route contracts	189	108	Medium
HVAC & Infection Control	OT loss of positive pressure	Dedicated uninterruptible power supply/generator circuit for OT HVAC; differential-pressure alarms; defer elective surgery while protecting one emergency theatre	180	60	Low
HVAC & Infection Control	Isolation room negative-pressure failure	Priority power to isolation-room exhaust; portable high-efficiency particulate air negative-pressure units; pressure alarms	180	60	Low
Clinical Services	Surgical services suspended	Tiered elective-deferral plan preserving emergency and life-saving surgery on protected circuits; CSSD reserve sterile sets	180	60	Low
Transport & Logistics	Blood supply chain breakdown	Increased on-site blood-bank reserve; prioritised cold-chain transport; regional blood-sharing agreement	180	60	Low
Kitchen Services	Complete LPG cessation	Electric induction backup; retort meal contingency; ≥14-day LPG reserve	168	72	Low
Laundry Services	Damp linen distribution	Electric drying on a protected circuit; buffer stock of dry/disposable linen; humidity check before distribution	168	64	Low
HVAC & Infection Control	Chiller plant shutdown	Priority power to critical-area chillers; portable cooling for OT, ICU and pharmacy; temperature alarms	162	54	Low
Boiler & Steam Services	CSSD reusable device stock depletion	Increased sterile instrument-set inventory; single-use device contingency for critical procedures; priority steam	162	54	Low
Kitchen Services	Therapeutic diet failure (chronic kidney disease/diabetes)	Pre-stocked renal and diabetic therapeutic meal packs; dietitian-led contingency menu not requiring LPG cooking	160	72	Low
Generator/Power Backup	Generator mechanical failure	N+1 generator redundancy; preventive maintenance with weekly load-bank testing; 24-hour service contract	150	60	Low

Post-mitigation RPNs are projected residual values assuming full implementation of the stated actions; they are planning estimates, not measured outcomes, and are re-scored on the same S, O and D scales as table 1.

CSSD, central sterile services department; HVAC, heating, ventilation and air conditioning; ICU, intensive care unit; LPG, liquefied petroleum gas; MDRO, multidrug-resistant organism; OT, operating theatre; RPN, risk priority number.

Results

Overall risk profile

62 failure modes were identified across the 10 departments. RPNs ranged from 70 to 252 (mean 143.3). Risk stratification yielded 5 Critical failure modes (RPN≥200; 8.1%), 17 High (150–199; 27.4%), 34 Medium (100–149; 54.8%) and 6 Low (<100; 9.7%). The Generator/Power Backup department recorded the highest mean RPN (171.0), followed by HVAC and Infection Control (166.8) and Kitchen Services (163.4). Summary statistics are provided in table 4, and selected high-priority failure modes are provided in table 5.

Table 4. Summary statistics by department.

Department	No. of FMs	Mean RPN	Max RPN	Critical FMs	High FMs
Generator/Power Backup	6	171.0	252	2	1
HVAC & Infection Control	5	166.8	192	—	4
Kitchen Services	8	163.4	216	1	4
Laundry Services	8	150.1	240	2	3
Transport & Logistics	5	143.4	189	—	3
Boiler & Steam Services	6	143.2	180	—	2
Pharmacy & Cold Chain	6	134.3	189	—	2
Clinical Services	6	130.0	180	—	2
Biomedical Waste Management	6	118.0	135	—	—
IT & Communication Infrastructure	6	108.2	140	—	—
Overall	62	143.3	252	5	17

Max RPN is colour-coded by risk band: Critical (red), High (orange), Medium (yellow) and Low (green).

FMs, failure modes; RPN, risk priority number.

Table 5. Selected high-priority failure modes from the FMEA risk register (n=34 of 62 total failure modes, showing all Critical and High risk failure modes plus selected Medium risk).

Department	Failure mode	S	O	D	RPN	Risk band
Generator/Power Backup	Diesel supply chain breakdown	9	7	4	252	Critical
Laundry Services	OT/ICU linen sterilisation failure	10	6	4	240	Critical
Generator/Power Backup	Non-critical load mismanagement	8	6	5	240	Critical
Kitchen Services	Inability to achieve cooking temperature ≥74°C	9	6	4	216	Critical
Laundry Services	Infectious linen not processed safely	10	5	4	200	Critical
Kitchen Services	Utensil decontamination/water boiling failure	8	6	4	192	High
HVAC & Infection Control	Isolation room cleaning failure	8	8	3	192	High
Laundry Services	Thermal disinfection failure (<60°C)	9	7	3	189	High
Pharmacy & Cold Chain	Critical drug stockouts	9	7	3	189	High
Transport & Logistics	Supply delivery disruption	9	7	3	189	High
HVAC & Infection Control	OT positive pressure loss	10	6	3	180	High
HVAC & Infection Control	Isolation room negative pressure failure	10	6	3	180	High
Clinical Services	Surgical services suspended	10	6	3	180	High
Transport & Logistics	Blood supply chain breakdown	10	6	3	180	High
Kitchen Services	Complete LPG cessation	8	7	3	168	High
Laundry Services	Damp linen distribution	8	7	3	168	High
Kitchen Services	Therapeutic diet failure (chronic kidney disease/diabetes)	8	5	4	160	High
Generator/Power Backup	Generator mechanical failure	10	5	3	150	High
Boiler & Steam Services	CSSD reusable device stock depletion	9	6	3	162	High
HVAC & Infection Control	Chiller plant shutdown	9	6	3	162	High
Boiler & Steam Services	Laundry boiler shutdown	8	6	3	144	Medium
Kitchen Services	Cold chain failure for perishables	7	7	3	147	Medium
Clinical Services	Mechanical ventilator shutdown	10	7	2	140	Medium
Generator/Power Backup	ICU power failure from fuel exhaustion	10	7	2	140	Medium
Transport & Logistics	Ambulance fleet immobilisation	10	7	2	140	Medium
IT & Communication	Electronic access control failure	7	5	4	140	Medium
Boiler & Steam Services	Steam autoclave failure	10	5	4	140	Medium
Clinical Services	Haemodialysis/continuous renal replacement therapy shutdown	10	6	2	120	Medium
Clinical Services	Oxygen generation failure	10	6	2	120	Medium
Pharmacy & Cold Chain	Pharmacy cold chain breach	9	7	2	126	Medium
Biomedical Waste Mgmt	Pathological waste accumulation	9	5	3	135	Medium
Biomedical Waste Mgmt	Incinerator shutdown	9	7	2	126	Medium
IT & Communication	Nurse call/internal comms failure	9	6	2	108	Medium
IT & Communication	Hospital information system/electronic health record shutdown	8	6	2	96	Low

Full register available from the corresponding author on request.

CSSD, central sterile services department; D, detection; FMEA, failure mode and effects analysis; HVAC, heating, ventilation and air conditioning; ICU, intensive care unit; IT, information technology; LPG, liquefied petroleum gas; O, occurrence; OT, operating theatre; RPN, risk priority number = S × O × D; S, severity.

A key structural finding was the cascading interdependency rooted in generator dependency: diesel supply chain breakdown (RPN 252, Critical) propagates upstream risk to seven of the nine remaining departments. Loss of generator power sequentially compromises OT/ICU HVAC, CSSD autoclaving, laundry boilers, pharmacy cold chain, IT infrastructure and all life-support clinical equipment.

Generator and Power Backup (n=6; mean RPN 171.0; maximum RPN 252)

The highest-scoring failure mode in the entire analysis was diesel supply chain breakdown (S=9, O=7, D=4; RPN 252), representing progressive fuel depletion without replenishment capability. A near-highest severity score (9 rather than 10) reflects the possibility of temporary selective load-shedding; however, this in turn introduces non-critical load mismanagement (S=8, O=6, D=5; RPN 240), in which incorrect load prioritisation causes premature power loss to ICU or OT circuits. Generator shutdown leading to ICU power failure (S=10, RPN 140) defines the lethal endpoint: ventilator failure, infusion pump shutdown and cardiac monitoring loss in the most clinically vulnerable patients.

Kitchen Services (n=8; mean RPN 163.4; maximum RPN 216)

All eight Kitchen Services failure modes were attributable to LPG deprivation. The highest was inability to achieve safe cooking temperatures (≥74°C) (S=9, O=6, D=4; RPN 216). In hospitals serving immunocompromised, post-transplant, and neonatal populations, failure to achieve minimum safe internal cooking temperatures creates substantial foodborne pathogen transmission risk.¹⁴ Utensil decontamination and water boiling failure (RPN 192) represents a direct enteric infection transmission pathway. Complete LPG cessation (RPN 168) eliminates all cooking capacity, with immediate malnutrition risk in long-stay patients. Therapeutic diet failure for chronic kidney disease and diabetic patients (RPN 160) adds metabolic risks—hyperkalaemia in renal patients and dysglycaemia in diabetic patients— independent of infection.

Laundry Services (n=8; mean RPN 150.1; maximum RPN 240)

The highest-scoring failure mode in the entire FMEA was OT/ICU linen sterilisation failure (S=10, O=6, D=4; RPN 240). Thermal disinfection at 65–71°C is the primary barrier against linen-mediated surgical site infection (SSI).¹⁵ Boiler shutdown eliminates this barrier, creating a direct SSI transmission pathway. Infectious linen not processed safely (S=10, O=5, D=4; RPN 200) poses cross-contamination risk from tuberculosis, COVID-19 and multidrug-resistant organism (MDRO)-positive patients. Evidence demonstrates that Clostridioides difficile spores survive standard National Health Service thermal disinfection processes,^{15 16} raising concern that partially disinfected linen may actively disseminate pathogens. Damp linen distribution (RPN 168) has been implicated in mucormycosis outbreaks in immunocompromised populations.¹⁷

HVAC and Infection Control (n=5; mean RPN 166.8; maximum RPN 192)

Two failure modes shared maximum severity scores (S=10): OT HVAC failure with loss of positive pressure (RPN 180) and negative pressure failure in isolation rooms (RPN 180). Laminar airflow disruption in OTs has been directly implicated in SSI outbreaks involving Aspergillus, Staphylococcus and Acinetobacter species.^{18 19} Isolation room negative pressure failure removes the environmental barrier to nosocomial spread of tuberculosis and other airborne pathogens. Isolation room cleaning failure (RPN 192) recorded the highest RPN in this department, reflecting high occurrence of cleaning protocol disruption during energy shortage.

Remaining departments

Boiler and Steam Services (mean RPN 143.2) identified CSSD reusable device stock depletion (RPN 162) and steam autoclave failure (RPN 140, S=10) as leading to surgical service suspension. Clinical Services (mean RPN 130.0) failure modes included surgical services suspended (RPN 180, S=10), mechanical ventilator shutdown (RPN 140, S=10), haemodialysis/continuous renal replacement therapy shutdown (RPN 120, S=10) and oxygen generation failure (RPN 120, S=10), all carrying maximum severity scores reflecting direct lethality. Transport and Logistics (mean RPN 143.4) identified blood supply chain breakdown (RPN 180) and ambulance fleet immobilisation (RPN 140) as High-risk. Pharmacy and Cold Chain (mean RPN 134.3) highlighted critical drug stockouts (RPN 189) and pharmacy cold chain breach (RPN 126). Biomedical Waste Management (mean RPN 118.0) and information technology (IT) and Communication Infrastructure (mean RPN 108.2) generated predominantly Medium-risk failure modes, though nurse call system failure (RPN 108) carries significant patient safety consequence.

Projected impact of mitigation

Application of the recommended actions (table 3) is projected to reduce the mean RPN of the 20 Critical and High-priority failure modes from 189.5 to 66.7, a reduction of approximately 65%. Under this projected post-mitigation model no failure mode remained in the Critical or High band: 18 fell to Low (<100) and 2—diesel supply chain breakdown and supply delivery disruption, both governed by external resupply that the hospital cannot fully control—remained in the Medium band. The largest absolute reductions were achieved for generator load management and for linen and kitchen thermal-disinfection failures, where automated load-shedding, protected circuits, continuous temperature monitoring and validated chemical or single-use contingencies simultaneously lowered occurrence and improved detection.

Discussion

Generator continuity as the systemic root cause

The overall mean RPN of 143.3, with 35% of failure modes classified as High or Critical, reflects the profound dependency of a modern quaternary-care hospital on uninterrupted fuel supply. The 5 Critical and 17 High failure modes are not independent events but cascading consequences of a single upstream failure: diesel supply chain disruption (RPN 252). The Generator/Power Backup department functions as a root-cause amplifier for seven other departments, mirroring real-world experience. In Ukraine, 92% of surveyed healthcare workers reported power outages following attacks on energy infrastructure, with direct effects on surgeries and life support.^{6 20} In Lebanon, fuel availability became synonymous with patient survival.⁴

The underestimated role of kitchen and laundry

The most clinically significant finding is the high RPN burden in kitchen and laundry services—departments traditionally classified as support or ancillary functions in hospital disaster planning. Kitchen Services recorded the third-highest mean RPN (163.4); Laundry Services contained the single highest-RPN failure mode in the dataset (RPN 240).

The infection-control significance of laundry processing failure is supported by a growing evidence base. Tarrant and colleagues demonstrated that C. difficile spores survive standard National Health Service thermal disinfection with reduction rates as low as 40%¹⁵; Hind et al¹⁶ confirmed spore persistence across chemo-thermal disinfection processes. MDROs are documented fomite colonisers of hospital linen²¹; when boiler failure drops wash temperatures below the thermal disinfection threshold, the laundry may become an active pathogen dissemination mechanism rather than a decontamination step.

In the kitchen, failure to achieve 74 °C internal temperatures removes the primary bactericidal step for Salmonella and Campylobacter in populations where these can cause fatal septicaemia.¹⁴ This study delineates what may be termed the ‘LPG-dependent infection-control chain’: cooking to safe temperatures, utensil boiling, linen thermal disinfection and steam autoclave sterilisation—a sequence of hospital functions collectively dependent on LPG or LPG-fired steam, whose simultaneous failure constitutes a compound infection-control emergency without published precedent in the disaster preparedness literature.

HVAC and the nosocomial outbreak nexus

The HVAC department’s high mean RPN (166.8) and two maximum-severity failure modes reflect the dual nosocomial outbreak risk from power failure. Laminar airflow disruption has been directly implicated in SSI outbreaks involving Aspergillus, Staphylococcus and Acinetobacter species.^{18 19} Isolation room negative pressure failure simultaneously removes the barrier to spread of airborne pathogens including tuberculosis, creating conditions for a hospital-wide respiratory outbreak.

Comparison with published literature

Published healthcare FMEA studies report failure mode counts of 25–109 and mean RPNs of 100–270.^{12 13} This study’s 62 failure modes and mean RPN of 143.3 are within the published range, providing external calibration validation. The identification of generator dependency as a systemic root cause parallels CUNY research on healthcare resilience during natural disasters²² and NGA energy resilience guidance²³; this study extends those findings to the specific mechanism of geopolitical fuel shortage, providing a quantified, reproducible RPN framework for conflict-preparedness planning.

Strengths and limitations

Strengths include multidisciplinary team composition, comprehensive scope (62 failure modes, 10 departments), use of a standardised internationally recognised framework and the novel identification of support-service infection-control risks at Critical level in a geopolitically motivated hazard scenario.

Limitations include single-site design, expert-consensus scoring (standard for prospective FMEA but potentially subjective), the single modelled hazard scenario and the fact that the scenario predates any actual US–Iran armed conflict, so that the projected post-mitigation RPNs (table 3) await prospective validation against real-world implementation data. The Lebanon and Gaza precedents provide supporting face validity for the high occurrence scores.

Implications for practice and policy

Hospitals in fuel-import-dependent countries should develop geopolitical energy contingency plans incorporating: tiered diesel rationing with pre-defined load priorities; LPG reserve stockpiling (minimum 14-day reserve); alternative cooking methodologies (electric induction on priority circuits) to maintain food safety when LPG is unavailable and cold-wash chemical disinfection protocols for laundry as contingency for boiler failure, acknowledging documented limitations for C. difficile and MDRO decontamination.^{15 16}

Kitchen and laundry services must be incorporated into hospital emergency operations plans as infection-control-critical infrastructure. National accreditation standards—including the National Accreditation Board for Hospitals & Healthcare Providers in India and Joint Commission International internationally—should mandate minimum on-site fuel reserve requirements. Given India’s acute LPG import dependency on the Strait of Hormuz, coordination between the Ministries of Health and Petroleum and Natural Gas to establish hospital-specific strategic LPG reserves would constitute an evidence-based preparedness measure.

Conclusions

This FMEA of a 455-bed quaternary-care hospital in South India demonstrates that acute fuel and LPG shortage in a geopolitical conflict scenario generates cascading, multisystem patient safety failures penetrating clinical and support operations simultaneously. 62 failure modes were identified across 10 departments, with five Critical and 17 High failure modes constituting immediate preparedness priorities.

Generator continuity is the single most critical mitigation target, functioning as a systemic root-cause amplifier for seven of the nine remaining departments. Kitchen and laundry services carry Critical-level infection-control risks equal to or exceeding those of many clinical departments—primarily through foodborne pathogen transmission to immunocompromised patients and MDRO/SSI risk from thermally inadequate linen processing.

A tiered, RPN-stratified response framework provides hospital administrators, quality teams and emergency planners with a structured, proportionate preparedness roadmap. As geopolitical instability continues to threaten energy supply chains globally, the systematic integration of fuel and LPG contingency planning into hospital emergency operations plans is a patient safety imperative that can no longer be deferred.

Data availability statement

Data are available upon reasonable request.