It’s Official: There Are New Risk Management Program Rules

PSM/RMP for the Uninitiated: The Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) enforce similar requirements for facilities that have more than the threshold quantity of listed highly hazardous chemicals. OSHA established the requirements under the Process Safety Management (PSM) rule (29 CFR 1910.119), and EPA established the requirements under the Risk Management Program (RMP) rule (40 CFR 68). New RMP rules are now available under a finalized revision by the EPA, keep reading to learn how to stay compliant under the new guidance.

On February 27, 2024, the EPA finalized revisions to the new Risk Management Program (RMP) rules by signing the Safer Communities by Chemical Accident Prevention rule. The final rule was published in the Federal Register on March 11, and the effective date is May 10, 2024. For all of you who carefully monitor my blog posts, like the one I wrote last year, this may feel like déjà vu. Didn’t EPA update the RMP rules in 2017? Weren’t most of those updates rescinded in 2019? (The answer to both questions is yes.) Isn’t OSHA also putting out updated PSM rules? (They are working on it, but the timing is unclear). Is another update inevitable if there’s a new presidential administration? (I don’t know).

What I can do is tell you about the newest RMP rules and share a few words of wisdom.

What Are the New RMP Rules?

The EPA fact sheets and other materials explain that the new RMP rules relate to the prevention program, emergency response requirements, information availability, and more.

Prevention program requirements

• Natural hazards and power loss: Adding amplifying regulatory text that the process hazard analysis must address natural hazards (including those resulting from climate change) and loss of power. Requiring backup power for release monitoring equipment.
• Facility siting: Emphasizing facility siting considerations in the hazard review/process hazard analysis.
• Safer technologies and alternatives analysis: Requiring a safer technologies and alternatives analysis for petroleum refineries and chemical manufacturing processes (North American Industrial Classification System codes 324 and 325).
• Root cause analysis: Requiring a root cause analysis incident investigation when facilities have had an RMP-reportable accident.
• Third-party compliance audits: Requiring that the next scheduled compliance audit be conducted by a third party when the following occurs:
  • The facility experiences an RMP-reportable accident.
  • If the implementing agency requires it due to conditions at the facility that could lead to an accidental release.
  • When a previous third-party audit failed to meet the competency or independence criteria.
• Employee participation: Requiring employee participation when implementing recommendations from process hazard analyses, compliance audits, and incident investigations; outlining stop-work procedures in employee participation plans; developing and implementing a process for employees to anonymously report RMP-reportable accidents or other related RMP noncompliance issues.
• Justification for not adopting recommendations: Requiring justification in the RMP for not adopting recommendations related to natural hazards, facility siting considerations, safer technologies and alternatives analysis, and third-party compliance audits.

Emergency response requirements

• Community notification of RMP accidents: Requiring nonresponding facilities to develop procedures for informing the public about accidental releases. Requiring that release notification data be provided to local responders. Partnering with local responders to ensure a system is in place to notify the community in case of RMP-reportable accidents.
• Emergency response exercises: Requiring a ten-year frequency for field exercises unless local responders indicate that this frequency is infeasible.

Information availability requirements

• Enhanced information availability: New requirements to provide chemical hazard information when it is requested to people living, working, or spending significant time within 6 miles of the facility. The information must be written in at least two of the most common languages in the community.

Other minor regulatory edits in the new RMP rules

• Program 3 process safety information should be kept up to date.
• Program 2 and Program 3 requirements consistent for recognized and generally accepted good engineering practices (RAGAGEP).
• Hot work permits should be retained for three years.
• Fiscal or calendar prior year sales should be used to qualify for the retail facility exemption.
• RAGAGEP should be reviewed in process hazard analyses to determine gaps in safety.

When Do We Have to Do This Stuff?

May 10, 2027, is the deadline for these provisions: root cause analysis, third-party audits, employee participation, emergency response public notification, exercise evaluation reports, and information availability.

Responding facilities must complete the emergency response field exercise by March 15, 2027, or ten years after a field exercise conducted between March 15, 2017 and August 31, 2022.

Updated RMP submissions with the new elements must be provided by May 10, 2028.

Won’t These Changes Be Challenged in Court? Will We Really Have to Do This Stuff?

The short answer is that I don’t know. History has shown that different presidential administrations can significantly change the trajectory of these rules.

What Should We Do?

I suggest we familiarize ourselves with the new rules and work to implement the new requirements.

Here’s the good news: if you’re already focused on managing risk, you probably don’t have to do a lot. Your process hazard analyses might already include the required elements. You probably already perform a root cause analysis following an incident. If you have an emergency response team, I bet you drill more than once every ten years. Your compliance audits are probably conducted by a third party.

So here are my promised words of wisdom to reward anyone who has read this entire post: You will probably be in the best compliance position if you take off your regulatory hat and put on your practical hat. You might miss the forest for the trees if you prioritize rules and citation avoidance. Instead, I suggest you prioritize practical ways to reduce your risk of an accident and then double-check the rules to see if your approach is compliant. It’s a subtle but important difference that will make you much more likely to stay compliant as these rules continue to evolve.