Free Practice Questions for ASHRM CPHRM Exam

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, the risk management department should establish formal policies addressing core operational responsibilities. Coordination of responses to subpoenas is a critical function involving legal compliance, protection of privileged information, and collaboration with counsel. Departmental accountability for occurrence reporting is essential to ensure proper event identification, investigation, and trending. Additionally, defining the risk management reporting process to the governing body supports board oversight and enterprise risk management responsibilities.

Responses to freedom of information requests, however, are generally governed by legal, compliance, or public information offices, particularly in public institutions subject to open records laws. While risk management may provide input if records involve claims or adverse events, primary responsibility for handling such requests typically resides outside the risk management department.

Health Care Operations objectives emphasize clearly defined departmental scope, structured reporting relationships, and alignment with governance responsibilities. Therefore, while subpoena coordination, occurrence reporting, and board reporting are appropriate policy areas for risk management, responses to freedom of information requests fall outside its primary policy development scope.

According to Health Care Risk Management standards supported by ASHRM and The Joint Commission National Patient Safety Goals, the read-back process is designed to ensure accurate communication of verbal or telephone orders. The correct process requires the person receiving the order to first write down the complete order and then read it back to the prescribing practitioner for verification.

Writing the order down before reading it back reduces reliance on memory and decreases the risk of omission or transcription errors. The practitioner who gave the order must then confirm that the read-back is accurate. This closed-loop communication process enhances patient safety and reduces medication and treatment errors associated with miscommunication.

Immediately repeating the information without documenting it does not meet the full verification requirement, as the written record must be confirmed. A witness is not required under the standard. Documenting the date and time is necessary for proper charting but does not constitute completion of the read-back verification itself.

Clinical and patient safety objectives emphasize clear, structured communication processes. Therefore, writing the information down before reading it back is the appropriate method to complete the verification process.

According to Health Care Risk Management standards supported by ASHRM and patient safety principles endorsed by The Joint Commission, the most likely root cause of medication errors is system or process failure. Modern patient safety frameworks emphasize that errors rarely result from isolated individual mistakes. Instead, they typically arise from weaknesses in processes, workflow design, communication systems, technology integration, or inadequate safeguards.

Illegible handwriting, manual systems, and look-alike or sound-alike drugs are recognized contributing factors. However, these elements represent components within a broader system. For example, illegible handwriting becomes problematic when standardized order entry systems are lacking. Look-alike medications pose risks when storage, labeling, or verification processes are insufficient. Manual medication delivery systems increase risk when redundancy and double-check mechanisms are absent.

Root cause analysis methodologies consistently demonstrate that unsafe system design, poor communication processes, lack of standardized procedures, and inadequate training contribute to medication errors. A systems-based approach aligns with just culture principles and focuses on improving processes rather than assigning individual blame.

Clinical and patient safety objectives emphasize system redesign, standardization, and continuous quality improvement. Therefore, system or process failure is the most likely root cause of medication errors.

The HIPDB was established to help combathealthcare fraud and abuse, while the NPDB historically focused on practitioner competence and professional conduct (including items like malpractice payments and certain adverse actions). HRSA explains that HIPDB is no longer separate and that its information is now collected and disclosed through the NPDB following the 2013 merger. For risk managers, the objective is to ensure credentialing, contracting, and compliance teams understand the expanded scope and proper use: querying supports safer hiring/privileging decisions and reduces negligent credentialing risk, while reporting supports system integrity. Organizations must also ensure due process and correct categorization of reportable events to avoid wrongful reporting exposure.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, the declarations page is the first section a risk manager should review when assessing limits of liability in a professional liability insurance policy. The declarations page summarizes key policy information, including named insureds, policy period, coverage types, limits of liability per occurrence and aggregate, deductibles or self-insured retentions, endorsements, and premium details.

Because the question focuses specifically on limits of liability, the declarations page provides the most direct and concise statement of coverage limits. It serves as the policy’s summary and reference point for determining financial exposure and coverage structure.

The insuring agreement defines the scope of coverage and triggers for defense and indemnity obligations but does not list specific limit amounts. Exclusions outline what is not covered, and conditions specify policyholder responsibilities such as notice and cooperation requirements. While all sections are important for comprehensive review, the declarations page is the appropriate starting point when verifying coverage limits.

Risk financing objectives emphasize careful policy analysis to ensure alignment between coverage limits and organizational risk exposure. Therefore, the declarations page should be reviewed first when assessing limits of liability.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, deaths resulting from violent, traumatic, or suspicious circumstances are legally reportable to the appropriate medico-legal authority, typically the Office of the Medical Examiner or Coroner. A gunshot wound constitutes a violent and potentially criminal cause of death, triggering statutory reporting requirements.

When a patient is pronounced dead on arrival due to trauma, particularly with a history suggestive of domestic violence, the death falls within the jurisdiction of the medical examiner. The medical examiner has authority to determine cause and manner of death, order autopsy if indicated, and coordinate with law enforcement to preserve forensic evidence. Hospitals are required by state law to notify this office promptly.

The state Board of Medicine oversees professional licensure and discipline, not death investigation. The Department of Health and Family Services may have reporting roles for public health matters, but traumatic deaths are typically handled by the medical examiner. The public relations department may manage communications but is not a regulatory notification requirement.

Legal and regulatory objectives emphasize compliance with mandatory reporting statutes and preservation of evidence. Therefore, the appropriate entity to notify is the Office of the Medical Examiner.

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, proactive workplace violence prevention focuses on measures implemented before an incident occurs. These strategies aim to identify risks, strengthen preparedness, and reduce the likelihood or severity of violent events.

Pre-employment background screening helps identify applicants with histories that may pose safety concerns, consistent with legal hiring standards. Ongoing staff training enhances awareness of warning signs, communication skills, and reporting procedures. Leadership rounding increases visibility, supports early identification of environmental or behavioral risks, and reinforces safety culture. Active shooter drills and emergency preparedness exercises ensure that staff understand response protocols and can act effectively under stress.

Options B, C, and D primarily describe reactive or post-incident measures. Law enforcement notification, restraining orders, crisis intervention, DEA notification, documentation, and emergency command activation occur after an event has taken place or when an immediate threat is present.

Health Care Operations objectives emphasize prevention, preparedness, environmental assessment, and workforce education as foundational elements of a workplace violence program. Therefore, pre-employment screening, training, rounding, and drills represent proactive components of an effective prevention strategy.

According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, both deductibles and self-insured retentions are mechanisms used in risk financing to allocate a portion of loss to the insured organization. However, they function differently in relation to the insurer’s obligation.

A deductible is typically subtracted from the amount paid by the commercial carrier. In many policies, the insurer may pay the full claim amount and then seek reimbursement of the deductible from the insured, or the insured may pay the deductible portion while the insurer handles defense and indemnity payments above that amount. The key distinction is that coverage attaches immediately, but the insured ultimately bears the deductible portion.

A self-insured retention differs in that the insured must satisfy the retention amount before the insurer’s coverage is triggered. Until the retention is exhausted, the insured is responsible for payment and often for defense management.

Option B incorrectly describes a deductible as operating like a self-insured retention. Option C does not distinguish between the two mechanisms. Option D is incorrect because self-insured retention applies before, not after, carrier limits.

Therefore, the correct distinction is that a deductible is subtracted from amounts paid by the commercial carrier.

According to Health Care Risk Management standards defined by ASHRM and the American Hospital Association Certification Center, a formal risk management plan is a governance document that outlines the framework, scope, and operational processes of the program. It is intended to define how risk management activities support organizational objectives and regulatory compliance.

The plan should clearly state the purpose of the program, establishing its mission, goals, and alignment with patient safety and enterprise risk management strategies. It must also describe the structure of the program, including reporting relationships, committee oversight, leadership roles, and accountability mechanisms. Additionally, the process of risk management activities should be detailed, including event reporting, investigation procedures, claims management, education initiatives, and performance evaluation methods.

While financial planning is important for departmental operations, the budget for the department is typically addressed in administrative or financial planning documents rather than the risk management plan itself. The plan focuses on governance, structure, and operational processes rather than line-item budgeting.

Therefore, inclusion of the program’s purpose, structural framework, and operational processes appropriately defines a comprehensive risk management plan.