Healthcare construction risk is defined by interdependency: a single regulatory event can cascade into design rework, a schedule slip, budget pressure, and a compressed activation window. An integrated framework makes those chains visible and assigns ownership to the chain, not just each isolated link.

Why one framework, not six registers

A hospital risk program fails the moment it runs as six parallel registers owned by disconnected teams. The highest-consequence acute-care risks live at the seams between disciplines — a late FGI-driven clearance change on sterile processing becomes a design rework, a buyout slip on stainless casework, then a licensure-window compression.

Structure the framework around six risk domains, each with a named lead feeding a unified register:

• Design — incomplete program-of-requirements, unresolved code interpretations, MEP/medical-systems coordination clashes (medical gas, nurse call, RTLS). Peaks when clinical input lags the design schedule.
• Construction — geotechnical surprises, long-lead equipment (AHUs, generators, chillers, switchgear, imaging shielding), trade-stacking, and — on renovations — building adjacent to a live, accredited hospital.
• Clinical/operational — the gap between what is built and what staff can safely use: workflow validation, equipment-to-room fit, throughput, and EHR/ADT, biomedical/CMMS, and pharmacy readiness.
• Regulatory/compliance — FGI Guidelines (state-adopted edition), NFPA 101 Life Safety Code, NFPA 99 Health Care Facilities Code, ASHRAE 170 ventilation, ADA/ABA, state DOH plan review (or an HCAI/OSHPD-style review), Certificate of Need where applicable, and CMS Conditions of Participation verified via Joint Commission, DNV, or state survey.
• Schedule — critical-path exposure, with attention to milestones that are not contractor-controlled: plan-review turnaround, AHJ inspection availability, fire-marshal and DOH life-safety sign-offs.
• Budget/financial — escalation, GMP buyout gaps, owner-direct equipment and FF&E volatility, and the frequently underfunded activation budget.

The integrating mechanism is a single taxonomy and one register of record. Each entry is tagged with its primary domain and any secondary domains it propagates into, so the team can query "every risk that touches the licensure milestone." The framework must be co-owned by the clinical activation lead and regulatory/AHJ liaison — not the scheduler alone.

The risk register and scoring

The register is a living, version-controlled instrument — not a slide refreshed quarterly. Each entry carries, at minimum:

• A unique ID and a risk statement in cause-condition-consequence form ("Because the state adopted a newer FGI edition mid-design, imaging-room clearances are non-compliant, which will require shielding redesign and re-review").
• Domain tag(s); category (threat or opportunity); probability; impact; inherent and residual scores; a named single-threaded owner; mitigation strategy; trigger indicators; and status.

Score on a calibrated probability-and-impact matrix (commonly 5×5), but extend the standard cost/schedule/quality axes with a patient-safety / regulatory severity perspective. A risk with modest dollar impact that could delay licensure or trigger a Life Safety Code deficiency at survey must rank as critical regardless of its financial footprint. Avoid two endemic failures: score inflation (everything becomes "high" — counter with calibration) and static scoring (re-score at every review and whenever a trigger fires).

Mitigation ownership and response strategies

Ownership separates a register that works from one that merely exists. Every active risk has exactly one accountable owner — not a committee. The owner selects a response:

• Avoid — change the design or sequence to eliminate the cause.
• Mitigate/reduce — lower probability or impact (e.g., pre-purchase long-lead switchgear to take delivery risk off the critical path).