Process Hazard Analysis: Types, Methods, and OSHA Requirements

A process hazard analysis (PHA) is a structured review of a chemical process to identify hazards and evaluate safeguards. For facilities handling regulated quantities of hazardous chemicals, that review isn't optional. It's a compliance requirement under OSHA's Process Safety Management (PSM) standard [a mandatory federal program for facilities that handle highly hazardous chemicals above set quantities]. A missing or outdated PHA is a direct route to OSHA enforcement.

A process hazard analysis is a systematic, documented examination of a covered chemical process that identifies and evaluates hazards capable of causing a major release. OSHA calls it the key provision of 29 CFR 1910.119, the federal PSM rule.

This guide covers who must conduct a PHA, what it must include, and how OSHA's revalidation and recordkeeping requirements work.

TL;DR: Under 29 CFR 1910.119, a process hazard analysis is mandatory for any facility with highly hazardous chemicals above threshold quantities. It must address seven required content items, use an OSHA-accepted methodology, and revalidate every five years. All records must be retained for the life of the covered process.

Key Takeaways

• OSHA's PSM standard requires a formal PHA for every covered process with highly hazardous chemicals at or above applicable threshold quantities.
• Every PHA must address all required content items in 29 CFR 1910.119(e)(3). Facility siting, human factors, and safeguard failure analysis are among them.
• OSHA accepts six PHA methodologies (HAZOP, FMEA, Fault Tree Analysis, and more); the choice must match process complexity.
• PHAs must be updated and revalidated at least every five years, but a complete redo isn't always required.
• All PHA records and documented recommendation resolutions must be kept for the life of the covered process.

What Is a Process Hazard Analysis?

A process hazard analysis is a documented, systematic review of a chemical process. Its goal is to identify hazards, evaluate the adequacy of safeguards, and flag gaps before a release occurs.

OSHA calls PHA the "key provision" of the PSM program, which has 14 required elements in total. It's where hazards are formally identified and evaluated. OSHA enacted the PSM standard in 1992, largely in response to the 1984 Bhopal disaster, and the PHA requirement has applied to every covered process ever since. Operating procedures, mechanical integrity inspections, and emergency response planning all depend on what the PHA surfaces.

The types of chemical hazards in a process determine both complexity and method. Reactive, flammable, and toxic materials create different analytical demands.

Which Facilities Are Required to Conduct a PHA?

PSM coverage applies under two separate triggers.

First: any process involving a chemical listed in PSM Appendix A at or above its threshold quantity. The appendix covers 137 HHCs [highly hazardous chemicals with toxic, reactive, flammable, or explosive properties]. Thresholds range from 100 lbs for the most acutely toxic substances to 10,000 lbs for chemicals like ammonia.

Second: any process using a Category 1 flammable gas at 10,000 lbs or more in one location. The same 10,000-lb threshold applies to flammable liquids with a flashpoint below 100°F [37.8°C].

Three categories are explicitly excluded: retail facilities, oil or gas well drilling and servicing operations, and normally unoccupied remote facilities.

The table below shows common covered sectors and their threshold quantities (TQs) [the minimum on-site amount that triggers PSM applicability].

Covered Sectors and Example Threshold Quantities

Source: 29 CFR 1910.119(a) and Appendix A

What Must a PHA Cover? The Required Content Items

The standard at 29 CFR 1910.119(e)(3) defines what every PHA must address. These aren't guidelines. Each item must appear in the written analysis.

1. The hazards of the process: chemical, physical, and operational risks specific to that process unit.
2. Prior incidents: any previous incident at the facility with a reasonable potential for catastrophic consequences.
3. Engineering and administrative controls: what controls exist, how they interact, and where they depend on each other.
4. Consequences of control failure: what happens if engineering or administrative controls break down.
5. Facility siting: whether the physical layout creates exposure risks if a release occurs.
6. Human factors: how operator workload, interface design, and behavior could contribute to or prevent an incident.
7. Qualitative evaluation of safeguard failures: a judgment-based assessment of health and safety effects on employees if the safeguards failed.

On facility siting [the physical placement of process equipment relative to occupied buildings, control rooms, and neighboring units]: this is one of the most overlooked items on the list and a recurring citation source during OSHA PSM inspections.

These seven items are listed in 29 CFR 1910.119(e)(3). They're sometimes called "six elements" in industry guidance, but the standard formally enumerates all seven. Each one must appear in the written PHA.

What PHA Methods Does OSHA Accept?

OSHA doesn't require a specific method. The standard calls for one that's "appropriate to the complexity of the process." Six methods are listed in 29 CFR 1910.119(e)(2). An equivalent methodology is also permitted where the process warrants it.

The table below covers all six accepted methods and their best-fit scenarios.

OSHA-Accepted PHA Methodologies

For OSHA-covered processes, HAZOP is the most widely used method for complex continuous operations. What-If/Checklist fits well for batch or moderate-complexity operations.

What Does a Process Hazard Analysis Look Like in Practice?

Consider an ammonia refrigeration system at a food processing facility. Ammonia at or above 10,000 lbs triggers PSM coverage. The facility selects HAZOP because the system involves interconnected vessels, piping, and multiple potential failure paths.

The team divides the system into nodes [defined segments of the piping and instrumentation diagram]. For each node, they apply guide words [structured deviation prompts such as "more flow," "less pressure," or "no flow"] to identify what happens when parameters shift from design intent.

One node review might surface:

• A pressure relief valve that fails to open under overpressure
• A release path directed toward an occupied adjacent building
• A missing interlock that should automatically isolate the affected section

In a HAZOP study, the team works through the process node by node, applying guide words to identify what deviations could occur and what the consequences would be. Every deviation that could cause a release is logged as a hazard scenario. Each corrective action is assigned to a responsible party with a documented due date.

Who Must Be on the PHA Team?

29 CFR 1910.119(e)(4) sets three composition requirements. No formal certification is needed. OSHA confirmed this in its November 2001 interpretation on PHA facilitator qualifications. The standard calls for expertise and working knowledge, not formal credentials.

The team as a whole must have engineering and process operations expertise distributed across its members. At least one person must have hands-on knowledge of the specific process being evaluated. One member must also be knowledgeable in the PHA methodology the team is using.

Many facilities add a maintenance technician, a controls engineer, and a safety professional to round out the team. For complex processes, some bring in an external facilitator while keeping internal process experts involved.

How Often Must a Process Hazard Analysis Be Updated?

The minimum requirement under 29 CFR 1910.119 is a revalidation at least every five years after the initial PHA. That said, "updated and revalidated" doesn't mean a full redo every cycle.

OSHA's 1998 interpretation letter on PHA revalidation is direct on this point. Employers must evaluate the existing PHA against the 29 CFR 1910.119(e)(3) criteria. If the analysis is current and meets all requirements, they can revalidate it without starting fresh. A full redo is only needed when the existing analysis no longer meets those criteria.

Several events should trigger an update outside the five-year window:

• A management of change (MOC) [a formal review and approval process required before modifying process chemicals, equipment, or procedures] event affecting a covered process
• An incident that resulted in, or could reasonably have resulted in, a catastrophic release
• New hazard information about a process chemical
• Process modifications not reflected in the current PHA

How Are PHA Recommendations Resolved and Documented?

The analysis doesn't end when the team closes the review sessions. Under 29 CFR 1910.119(e)(5) and (e)(6), everything that follows carries the same compliance weight as the analysis itself.

• The employer must address all PHA findings and recommendations promptly.
• Each resolution must be documented: the action taken, or a clear explanation of why no action was taken.
• Employees and their representatives must have access to the completed PHA and all documented resolutions.
• Records (including the original PHA, all revalidations, and every documented resolution) must be retained for the life of the process.

"For the life of the process" is a longer window than most EHS recordkeeping requirements. It doesn't end when a chemical leaves the inventory. It ends when the covered process itself is decommissioned.

Organizing PHA records alongside a broader chemical safety program makes this retention requirement more manageable. SDS files, exposure records, and PHA documentation belong in the same system, especially for facilities managing multiple covered processes.

How Does the EPA's RMP Rule Relate to OSHA PSM?

Many PSM-covered facilities also fall under the EPA's Risk Management Program (RMP), a parallel federal rule under 40 CFR Part 68 that focuses on protecting the public and environment from off-site chemical releases. Both programs require a hazard analysis, but they differ in scope, enforcement, and disclosure.

Note: The EPA finalized significant updates to the RMP rule in March 2024. Verify current requirements against 40 CFR Part 68 before publishing.

The table below outlines the key differences between the two programs.

OSHA PSM vs. EPA RMP: Key Differences

Running an integrated PSM/RMP program is common practice. A PHA for PSM can satisfy the hazard review component under RMP. The RMP-specific off-site consequence analysis must still be completed separately.

Conclusion

A completed PHA isn't a finished deliverable. The five-year revalidation clock, MOC-triggered updates, recommendation tracking, and lifetime record retention all require sustained management.

Treating a PHA as a project with a finish line tends to create documentation gaps at OSHA inspections. It's usually an outdated analysis, an unresolved recommendation, or records that can't be produced for a process that's been running for years.

Process safety information must stay current throughout the process lifecycle. SDS records for each covered chemical are part of that foundation. An SDS management platform that keeps chemical data organized and audit-ready reduces the burden across the full PHA compliance cycle.

Frequently Asked Questions

What is a process hazard analysis?

A process hazard analysis (PHA) is a systematic, documented review of a covered chemical process. It identifies and evaluates hazards that could cause a major chemical release under OSHA's PSM standard at 29 CFR 1910.119.

Who must conduct a process hazard analysis under OSHA?

Any facility with an Appendix A chemical at or above its threshold quantity, or a flammable liquid or gas at 10,000 lbs or more in one location, must conduct a PHA under 29 CFR 1910.119.

How often must a process hazard analysis be updated?

PHAs must be updated and revalidated at least every five years. A complete redo isn't required if the existing analysis still meets all criteria under 29 CFR 1910.119(e)(3).

What are the accepted process hazard analysis methods?

OSHA accepts What-If, Checklist, What-If/Checklist, HAZOP, FMEA, and Fault Tree Analysis. An equivalent methodology is also permitted if appropriate to the process's complexity.

What must a PHA team include?

At minimum: members with engineering and process operations expertise, at least one person with direct knowledge of the process, and at least one person knowledgeable in the methodology being used. No formal certification is required.

What records must be kept from a PHA?

The original PHA, all updates and revalidations, and documented resolutions for every recommendation must be kept for the life of the covered process.