ASHRM Certified Professional in Health Care Risk Management CPHRM Exam Questions

Answer : C

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, the declarations page is the first section a risk manager should review when assessing limits of liability in a professional liability insurance policy. The declarations page summarizes key policy information, including named insureds, policy period, coverage types, limits of liability per occurrence and aggregate, deductibles or self-insured retentions, endorsements, and premium details.

Because the question focuses specifically on limits of liability, the declarations page provides the most direct and concise statement of coverage limits. It serves as the policy's summary and reference point for determining financial exposure and coverage structure.

The insuring agreement defines the scope of coverage and triggers for defense and indemnity obligations but does not list specific limit amounts. Exclusions outline what is not covered, and conditions specify policyholder responsibilities such as notice and cooperation requirements. While all sections are important for comprehensive review, the declarations page is the appropriate starting point when verifying coverage limits.

Risk financing objectives emphasize careful policy analysis to ensure alignment between coverage limits and organizational risk exposure. Therefore, the declarations page should be reviewed first when assessing limits of liability.

Answer : A

The IOM's quality framing highlights three categories of quality problems: underuse (failing to provide beneficial care), overuse (providing care where harms outweigh benefits), and misuse (errors/defects in delivering appropriate care). This triad matters to risk management because harm arises not only from mistakes (misuse) but also from omissions (underuse) and unnecessary interventions (overuse). For example, missing a diagnostic test can cause deterioration (underuse), while ordering a risky, non-indicated procedure can cause avoidable complications (overuse). Misuse connects strongly to patient safety incident analysis and reliability engineering. Together, these categories provide a comprehensive lens for prioritizing improvement: reduce preventable adverse events, close evidence-based gaps, and avoid low-value care that increases complications and cost. Using this IOM model supports a balanced quality/risk program that prevents harm across the full spectrum of clinical decision-making and care delivery.

Answer : B

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, The Joint Commission's sentinel event policy requires organizations to complete a thorough root cause analysis and develop an action plan within 45 days of becoming aware of the sentinel event.

The root cause analysis must identify underlying system failures and contributing factors rather than focusing solely on individual performance. The resulting action plan must outline specific corrective measures, assign responsibility, establish implementation timelines, and include mechanisms to monitor effectiveness. The emphasis is on sustainable system improvement to reduce the likelihood of recurrence.

Failure to complete the analysis and action plan within the required timeframe may result in additional review, accreditation consequences, or other follow-up actions by The Joint Commission. Timely completion demonstrates organizational accountability, leadership oversight, and commitment to patient safety.

Clinical and patient safety objectives emphasize structured investigation processes, documentation of corrective actions, and alignment with accreditation standards. Therefore, the required timeframe for completion of the root cause analysis and action plan following awareness of a sentinel event is 45 days.

Answer : A

Within Health Care Risk Management practice as outlined by ASHRM and the American Hospital Association Certification Center, understanding legal process documents is essential to effective claims management and litigation response. A subpoena duces tecum is a court-issued legal instrument requiring an individual or organization to produce specified documents, records, or tangible evidence relevant to a legal proceeding.

In many jurisdictions, a subpoena duces tecum may also require the recipient to appear at a deposition, hearing, or trial while producing the requested documents. The key distinguishing feature is the command to bring documents or evidence. Compliance is mandatory unless successfully challenged or quashed by the court.

Providing a list of all parties involved or disclosing expert witness identities are generally handled through formal discovery processes such as interrogatories, requests for production, or court-ordered disclosures, not specifically by a subpoena duces tecum.

Claims and litigation objectives emphasize prompt review of subpoenas, coordination with legal counsel, protection of privileged information, and timely compliance to avoid sanctions. Therefore, a subpoena duces tecum requires production of specified documents and may also compel appearance, making options 1 and 2 correct.

Answer : B

According to Health Care Risk Management principles endorsed by ASHRM and the American Hospital Association Certification Center, the effectiveness of an educational program is best measured by demonstrated changes in behavior rather than by subjective or indirect outcomes. Educational initiatives in healthcare risk management aim to improve compliance, enhance patient safety practices, and modify unsafe behaviors.

Analysis of written evaluations primarily reflects participant satisfaction and perceived value of the program, but does not confirm that learning objectives were achieved or that behaviors changed. Reductions in claim frequency or severity are important organizational outcomes; however, these are influenced by multiple variables beyond education alone, including patient volume, case complexity, legal climate, and system-level interventions. Therefore, claims data are indirect and delayed measures.

Observable changes in human behavior, such as improved adherence to safety protocols, increased incident reporting, or consistent compliance with documentation standards, provide direct evidence that learning has translated into practice. Risk management objectives emphasize measurable performance improvement, competency validation, and alignment with patient safety goals.

Thus, observable behavioral change is the most reliable and immediate indicator that an educational program has achieved its intended effect.

Answer : A

The HIPDB was established to help combat healthcare fraud and abuse, while the NPDB historically focused on practitioner competence and professional conduct (including items like malpractice payments and certain adverse actions). HRSA explains that HIPDB is no longer separate and that its information is now collected and disclosed through the NPDB following the 2013 merger. For risk managers, the objective is to ensure credentialing, contracting, and compliance teams understand the expanded scope and proper use: querying supports safer hiring/privileging decisions and reduces negligent credentialing risk, while reporting supports system integrity. Organizations must also ensure due process and correct categorization of reportable events to avoid wrongful reporting exposure.

Answer : B

According to Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, organizations operating vehicle fleets must implement structured fleet risk management controls to reduce liability exposure. One of the most fundamental annual requirements is verification of each driver's driving record, typically obtained through a motor vehicle record MVR review.

An annual driving record review allows the organization to confirm that drivers maintain valid licensure, identify traffic violations, detect patterns of unsafe driving behavior, and assess risk exposure. This proactive screening supports loss prevention, reduces the likelihood of negligent entrustment claims, and ensures compliance with organizational driving policies.

Mileage logs are operational tools used for tracking usage and reimbursement but do not assess driver eligibility or risk. Driver training is important for safety programs but is not the minimum required documentation to confirm driver qualification status. Proof of insurance may be required when employees use personal vehicles for business purposes, but it does not replace the need to review the driver's official record.

Health Care Operations objectives emphasize credential verification, regulatory compliance, and proactive liability mitigation. Therefore, obtaining and reviewing each driver's driving record annually is the minimum required documentation.