ASHRM Certified Professional in Health Care Risk Management CPHRM Exam Questions

Answer : C

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, a 22-year-old patient is a legal adult and retains full rights to privacy and control over disclosure of protected health information under HIPAA and applicable state confidentiality laws. Psychiatric records are subject to heightened confidentiality protections in many jurisdictions.

Absent a court order or legal guardianship determination, a parent does not have automatic access to an adult child's medical records. Therefore, before releasing any information, the organization must verify that the patient has executed a valid, specific authorization for release of information that complies with HIPAA requirements. The authorization must clearly identify the recipient, the information to be disclosed, and be properly signed and dated.

Consulting legal counsel or a treating psychiatrist does not substitute for proper authorization. Similarly, requesting guardianship documentation would only be appropriate if the mother asserts legal guardianship status; however, in the absence of such documentation, release cannot occur.

Legal and regulatory objectives emphasize strict adherence to privacy laws, protection of psychiatric records, and proper authorization procedures. Therefore, verification of a signed release of information from the patient is required before disclosure.

Answer : D

Under Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, the insurance application is the primary document used by an underwriter to evaluate risk and generate a premium quote. The application provides detailed information about the organization's operations, services, patient volume, claims history, risk control measures, governance structure, and prior insurance coverage. This information enables the underwriter to assess exposure, determine eligibility, and calculate appropriate pricing and coverage terms.

A certificate of insurance is issued after a policy is in force to verify coverage to third parties and does not serve as a quoting document. The declaration page is part of an existing insurance policy and summarizes coverage limits, deductibles, and endorsements; it reflects finalized terms rather than information used to generate a quote. A certificate of need is a regulatory document related to state approval of healthcare facilities or services and is unrelated to underwriting.

Risk financing objectives emphasize accurate disclosure and thorough completion of insurance applications, as misrepresentation or omission may affect coverage validity. Therefore, the application is the document used by an underwriter to provide an insurance quote.

Answer : B

According to Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, organizations operating vehicle fleets must implement structured fleet risk management controls to reduce liability exposure. One of the most fundamental annual requirements is verification of each driver's driving record, typically obtained through a motor vehicle record MVR review.

An annual driving record review allows the organization to confirm that drivers maintain valid licensure, identify traffic violations, detect patterns of unsafe driving behavior, and assess risk exposure. This proactive screening supports loss prevention, reduces the likelihood of negligent entrustment claims, and ensures compliance with organizational driving policies.

Mileage logs are operational tools used for tracking usage and reimbursement but do not assess driver eligibility or risk. Driver training is important for safety programs but is not the minimum required documentation to confirm driver qualification status. Proof of insurance may be required when employees use personal vehicles for business purposes, but it does not replace the need to review the driver's official record.

Health Care Operations objectives emphasize credential verification, regulatory compliance, and proactive liability mitigation. Therefore, obtaining and reviewing each driver's driving record annually is the minimum required documentation.

Answer : B

Laboratory testing is best understood as a total testing process (from test ordering through specimen collection, analysis, and result reporting). Across this chain, error risk is heavily influenced by variability---especially in pre-analytical steps (patient identification, tube labeling, specimen handling, transport conditions) and post-analytical steps (timely reporting, critical value communication, interpretation). Risk management objectives emphasize controlling variation through standard work, barcoding, competency training, environmental controls, and quality indicators for each phase. Importantly, many lab failures arise outside the analyzer itself; focusing only on the analytical instrument misses major sources of harm. Reducing variability improves reliability, reduces redraws and diagnostic delay, and supports defensible performance in accreditation and event review. In short: the lab process chain is a high-volume, multi-step clinical production system---variation is inevitable, but unmanaged variation increases patient safety risk.

Answer : A

Within Health Care Risk Management frameworks identified by ASHRM and the American Hospital Association Certification Center, organizational culture refers to the collective values, shared norms, guiding beliefs, and behavioral expectations that shape how members of a healthcare organization function. It influences decision-making, communication patterns, leadership styles, and responses to risk and safety concerns. Culture is transmitted formally through policies and training, and informally through leadership behavior, peer interactions, and organizational traditions.

Organizational culture plays a critical role in patient safety, compliance, and ethical conduct. A strong culture of safety encourages reporting of adverse events, supports transparency, and promotes continuous improvement. Conversely, a punitive or hierarchical culture may suppress reporting and increase liability exposure.

Corporate vision describes the aspirational future state of the organization. A strategic mission outlines the organization's purpose and objectives. Managerial ethics refers to principles guiding leadership conduct. While these elements contribute to the broader organizational framework, they do not encompass the shared and socially transmitted system of norms and beliefs that define culture.

Therefore, the correct term describing shared and taught values and norms within a healthcare organization is organizational culture.

Answer : A

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, the governing board has ultimate responsibility for organizational oversight, quality of care, and patient safety. As part of its fiduciary and governance duties, the board approves high-level policies that establish the organization's philosophy, strategic direction, and commitment to safety and risk management.

A philosophy regarding medical error management reflects the organization's approach to disclosure, reporting, just culture principles, accountability, and system improvement. Because this philosophy sets the tone for organizational culture and impacts patient safety, legal exposure, and regulatory compliance, it requires board-level approval to ensure alignment with governance expectations and accreditation standards.

In contrast, the risk management department's annual budget is typically approved through financial governance processes rather than as a policy document. Risk analyses are operational tools conducted by management and do not require board approval. Departmental personnel job descriptions are administrative documents managed at the executive or human resources level.

Health Care Operations objectives emphasize board engagement in safety culture and oversight of enterprise risk management. Therefore, the philosophy regarding medical error management should be approved by the organization's board of directors.

Answer : A

Under Health Care Risk Management principles recognized by ASHRM and the American Hospital Association Certification Center, a properly executed advance directive carries legal authority when a patient lacks decision-making capacity. The physician has assessed that the patient is terminally ill and lacks capacity, triggering activation of the advance directive. If the directive clearly states refusal of life-prolonging treatment, including artificial nutrition and hydration, those wishes must be honored in accordance with state law and the Patient Self-Determination Act framework.

Patient autonomy is a foundational ethical and legal principle in health care. Once capacity is lost, previously expressed wishes through a valid advance directive govern care decisions. Family members do not have authority to override a valid directive unless legal defects or ambiguity exist. Their disagreement does not negate the patient's documented preferences.

Although ethics consultation can be helpful in managing conflict, the directive here is described as properly executed and clear. Additional determination of capacity is unnecessary because the physician has already made that assessment.

Risk management objectives emphasize compliance with advance directive statutes, respect for patient autonomy, and reduction of liability through adherence to documented patient wishes. Therefore, the appropriate advice is to support the physician in honoring the advance directive.