Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Whenever possible, medication orders should be by:
Ordering by clear dose (with units, route, frequency, and indication when needed) reduces ambiguity and prevents common medication errors such as wrong concentration, wrong formulation, or misunderstood shorthand. Risk management objectives emphasize ''closed-loop'' medication communication: standardized ordering, read-back for limited verbal orders, and minimizing abbreviations that cause confusion (sound-alike drug names, numeric mishearing like 15 vs 50). Patient safety frameworks consistently identify unclear orders as a high-frequency contributor to adverse drug events; therefore, explicit dosing is a core reliability practice. When dose is specified precisely and entered via CPOE (preferred), organizations reduce transcription errors, improve pharmacy verification, and enable automated safety checks. Clear dosing also supports legal defensibility by documenting rational prescribing aligned with standards of care.
The Joint Commission requires that after a healthcare organization becomes aware of a sentinel event, it must complete a root cause analysis and action plan within how many days?
According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, The Joint Commission's sentinel event policy requires organizations to complete a thorough root cause analysis and develop an action plan within 45 days of becoming aware of the sentinel event.
The root cause analysis must identify underlying system failures and contributing factors rather than focusing solely on individual performance. The resulting action plan must outline specific corrective measures, assign responsibility, establish implementation timelines, and include mechanisms to monitor effectiveness. The emphasis is on sustainable system improvement to reduce the likelihood of recurrence.
Failure to complete the analysis and action plan within the required timeframe may result in additional review, accreditation consequences, or other follow-up actions by The Joint Commission. Timely completion demonstrates organizational accountability, leadership oversight, and commitment to patient safety.
Clinical and patient safety objectives emphasize structured investigation processes, documentation of corrective actions, and alignment with accreditation standards. Therefore, the required timeframe for completion of the root cause analysis and action plan following awareness of a sentinel event is 45 days.
Which of the following items should be part of a claim file?
peer review reports or data
correspondence with attorneys and investigators
literature search
verification of settlement authority
According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, claim files must be carefully structured to preserve confidentiality, protect privilege, and support effective defense strategy. A claim file typically includes correspondence with attorneys and investigators, as this documentation reflects legal strategy, communications, and case development. Literature searches relevant to standards of care may also be included to assist counsel in evaluating clinical issues and expert testimony preparation. Verification of settlement authority is essential documentation to confirm that appropriate approvals were obtained before resolving a claim.
Peer review reports or data, however, should not be included in the claim file. Peer review materials are generally protected under state peer review statutes and federal patient safety privilege provisions. Commingling peer review documents within the claims file may jeopardize privilege protections and increase the risk of discoverability in litigation. Maintaining separation between peer review files and claim files is a critical risk management practice.
Claims and litigation objectives emphasize preservation of privilege, organized documentation, and compliance with legal standards. Therefore, correspondence, literature searches, and settlement authority verification belong in the claim file, while peer review reports should be maintained separately.
An unstable patient in the emergency department needs transfer to another hospital. Which of the following statements is true regarding the refusal of an on-call physician to treat this patient?
Under Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, obligations under the Emergency Medical Treatment and Labor Act EMTALA govern on-call physician responsibilities. When a hospital maintains an on-call roster to provide specialty services for emergency department patients, physicians listed on call are required to respond and participate in the evaluation and stabilization of patients with emergency medical conditions.
An on-call physician may only be relieved of duty if legitimately unavailable due to circumstances beyond their control, such as actively caring for another patient or being otherwise unable to respond in accordance with hospital policy. Refusal to treat for convenience or non-clinical reasons may constitute an EMTALA violation and expose both the hospital and physician to regulatory penalties.
A blanket right to refuse care is inconsistent with EMTALA requirements. While financial discrimination is prohibited, refusal for other non-justifiable reasons may still violate federal law. Conversely, stating that a physician is never relieved of duty is inaccurate, as legitimate unavailability may excuse performance under specific circumstances.
Legal and regulatory objectives emphasize compliance with EMTALA, proper on-call coverage policies, and documentation of availability. Therefore, the correct statement is that relief occurs only when the physician is unavailable due to circumstances outside their control.
Information from the Data Bank (NPDB; includes former HIPDB content) can be requested by:
Access to NPDB information is restricted to authorized entities for credentialing, privileging, and oversight---not public browsing. HRSA's NPDB rules identify who can query and report; professional societies with formal peer review are listed among entities that may query under certain circumstances. This limited-access model supports patient safety objectives by enabling credentialing bodies to identify adverse licensure actions, certain negative clinical privilege actions, and other reportable events, while protecting due process and confidentiality. From a risk management perspective, proper querying supports defensible credentialing and reduces negligent credentialing exposure. Equally important: organizations must maintain secure handling of NPDB responses and follow permitted-use rules to avoid compliance violations.
The first layer of insurance that will respond to a specific type of loss or exposure is called
According to Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, insurance coverage for liability exposures is often structured in layers. The first layer of insurance that responds to a covered loss is known as the primary policy.
Primary insurance provides initial coverage once any applicable deductible or self-insured retention has been satisfied. It is responsible for defense and indemnity payments up to the policy's stated per-occurrence and aggregate limits. Only after the primary policy limits are exhausted do excess or umbrella policies respond.
Terms such as baseline, foundation, and frontline are not recognized technical classifications in layered insurance structures. In professional and general liability programs, organizations commonly maintain a primary layer followed by one or more excess layers to protect against catastrophic losses.
Risk financing objectives emphasize understanding policy structure, limits, attachment points, and coordination between layers to ensure adequate protection of organizational assets. Therefore, the correct term for the first layer of insurance that responds to a loss is the primary policy.
A hold-harmless agreement is an important component of which of the following aspects of a risk financing program?
Within Health Care Risk Management frameworks established by ASHRM and the American Hospital Association Certification Center, risk financing strategies include risk retention, risk transfer, and insurance mechanisms. A hold-harmless agreement is a contractual provision in which one party agrees to assume responsibility for certain liabilities and to protect another party from claims or losses arising from specified activities. This mechanism is a classic example of risk transfer.
Through hold-harmless or indemnification clauses, an organization shifts potential financial responsibility for loss to another party, often a contractor, vendor, or service provider. This contractual allocation of liability reduces the organization's exposure without necessarily purchasing insurance. It is therefore categorized under noninsurance risk transfer.
Risk retention, by contrast, involves assuming and financing losses internally, such as through self-insurance or deductibles. First-party liability insurance addresses losses sustained directly by the insured organization, while third-party liability insurance covers claims made by others against the organization. Although insurance is also a method of risk transfer, the specific instrument described in the question is a contractual transfer mechanism rather than an insurance product.
Accordingly, a hold-harmless agreement is most directly associated with risk transfer within a comprehensive risk financing program.
Exam domains verified against: Official ASHRM CPHRM exam guide, last checked October 2026.
Candidates assess patient safety awareness, collaborate on proactive safety initiatives using methods like FMEA and RCA, and design educational programs. They promote safety culture through policy development, coach providers on disclosure methods, participate in incident debriefing and corrective action planning, and provide guidance on informed consent, substitute decision-makers, and abuse allegations. Manage incident reporting systems and review documentation to mitigate risk.
Sample question from this domain above: Q6
Candidates manage comprehensive insurance programs including captive management, self-insured coverages, and claims coordination. They oversee investigation of accidents and circumstances leading to financial loss, analyze loss experience and trends, develop enterprise risk financing strategies for exposures like general liability and professional liability, and ensure timely incident reporting according to insurance policy requirements.
Sample question from this domain above: Q2
Candidates promote compliance with federal and state laws and regulations through policy development and education, including HIPAA, EMTALA, CMS requirements, and NPDB. They manage patient confidentiality policies, reporting requirements for vulnerable populations and workplace violence, patient complaint resolution procedures, and accreditation readiness. They participate in responses to regulatory inquiries and develop organizational compliance plans.
Sample question from this domain above: Q1
Candidates collaborate on workplace violence prevention, conduct risk assessments for new and existing services, establish reporting methods for harm and near-harm incidents, and supervise risk management staff. They develop departmental policies and procedures, coordinate risk activities, establish institutional goals, evaluate program effectiveness, provide education on patient rights, and collaborate on policies addressing high-risk topics like privacy, informed consent, and infection prevention.
Candidates maintain data collection systems for potential compensatory events, open and closed claims, and loss runs. They notify carriers and claims administrators of potential claims, participate in claims management including counsel assignment, loss reserves, and discovery responses. They evaluate claims for organizational exposure, inform administration of high-exposure cases, manage legal case information under attorney-client privilege, and support insured defendants through litigation phases.
Sample question from this domain above: Q7
Common questions about the exam itself
