Free ASHRM CPHRM Practice Exam with Questions & Answers

A frequent HIPAA Privacy Rule violation isimpermissible access or disclosureof protected health information—commonly including employee “snooping” (accessing records of family, friends, coworkers, or celebrities without a work-related need) and other unauthorized disclosures. Risk management objectives focus on preventing these events through role-based access, audit logs with active monitoring, sanctions policies consistently enforced, workforce training, and a culture that treats privacy as patient safety. Even when disclosures are not malicious, “minimum necessary” failures, misdirected faxes/emails, and unsecured devices can create reportable breaches. Effective prevention is layered: technical controls (access restrictions), administrative controls (policies, training), and detection/response (auditing, rapid mitigation). Privacy violations are high-risk because they harm patients, trigger regulatory action, and damage trust and reputation.

According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, both deductibles and self-insured retentions are mechanisms used in risk financing to allocate a portion of loss to the insured organization. However, they function differently in relation to the insurer’s obligation.

A deductible is typically subtracted from the amount paid by the commercial carrier. In many policies, the insurer may pay the full claim amount and then seek reimbursement of the deductible from the insured, or the insured may pay the deductible portion while the insurer handles defense and indemnity payments above that amount. The key distinction is that coverage attaches immediately, but the insured ultimately bears the deductible portion.

A self-insured retention differs in that the insured must satisfy the retention amount before the insurer’s coverage is triggered. Until the retention is exhausted, the insured is responsible for payment and often for defense management.

Option B incorrectly describes a deductible as operating like a self-insured retention. Option C does not distinguish between the two mechanisms. Option D is incorrect because self-insured retention applies before, not after, carrier limits.

Therefore, the correct distinction is that a deductible is subtracted from amounts paid by the commercial carrier.

Sentinel event “most common” can change by reporting year and classification approach. Recent summaries of 2023 sentinel event reporting indicatefallswere the most frequently reported category in that dataset, with wrong surgery and unintended retention also high-ranking. Risk management objectives treat this as a dynamic signal: the organization should use current event data, internal trends, and unit-specific hazards to prioritize controls. Falls prevention requires layered interventions—risk stratification, mobility support, medication review, environmental controls, and post-fall huddles to learn and redesign. Leaders should avoid over-fixating on one historical “most common” event type and instead use current surveillance to target the biggest preventable harm burdens.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, projecting contributions to a self-insured retention fund requires actuarially sound financial forecasting. Actuarial reports use historical claims data, trend analyses, loss development factors, and exposure projections to estimate future liabilities and required funding levels. Loss run reports provide detailed historical claims information, including paid losses, reserves, and claim status, which serve as foundational data for actuarial modeling.

Professional and general liability premiums are relevant to insured layers above the retention but do not determine funding requirements for the retained portion. Frequency and severity analyses of pending claims are important components of actuarial evaluation but, standing alone, may not capture long-tail development or incurred but not reported claims. Total incurred losses for the current year provide limited insight without considering historical patterns and future projections.

Risk financing objectives emphasize accurate funding of retained risk to ensure financial stability, regulatory compliance, and protection of organizational assets. Therefore, actuarial reports, supported by comprehensive loss run data, provide the most reliable basis for determining projected contributions to a self-insured retention fund.

The Healthcare Integrity and Protection Data Bank (HIPDB) was created to combat healthcare fraud and abuse; it isno longer operational as a separate bank, and its content was merged into the NPDB. Reporting and querying are governed by HRSA rules defining authorized entities, including certain peer review and oversight organizations in specific reporting frameworks. Risk management objectives include ensuring organizations understand which actions must be reported, ensure due process, and comply with data handling rules. Proper reporting supports system integrity by preventing practitioners or entities with serious adverse actions from moving undetected across organizations. For hospitals and health plans, this strengthens credentialing and contracting decisions, reducing organizational exposure to negligent credentialing and improper network participation risks.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, the declarations page is the first section a risk manager should review when assessing limits of liability in a professional liability insurance policy. The declarations page summarizes key policy information, including named insureds, policy period, coverage types, limits of liability per occurrence and aggregate, deductibles or self-insured retentions, endorsements, and premium details.

Because the question focuses specifically on limits of liability, the declarations page provides the most direct and concise statement of coverage limits. It serves as the policy’s summary and reference point for determining financial exposure and coverage structure.

The insuring agreement defines the scope of coverage and triggers for defense and indemnity obligations but does not list specific limit amounts. Exclusions outline what is not covered, and conditions specify policyholder responsibilities such as notice and cooperation requirements. While all sections are important for comprehensive review, the declarations page is the appropriate starting point when verifying coverage limits.

Risk financing objectives emphasize careful policy analysis to ensure alignment between coverage limits and organizational risk exposure. Therefore, the declarations page should be reviewed first when assessing limits of liability.

Team-based care reduces errors by improving communication, cross-monitoring, workload distribution, and escalation when risk increases. TeamSTEPPS and related patient safety evidence show teamwork training can improve safety culture and reduce clinical error rates by creating predictable behaviors—briefs, huddles, check-backs, and mutual support. From a risk management standpoint, teamwork is a high-leverage control because many serious adverse events involve coordination failures (handoffs, unclear ownership, missed deterioration). Effective teams also reduce “single-point-of-failure” risk; when one clinician misses something, another can catch it. Organizations operationalize this through standardized communication (SBAR), structured handoffs, simulation, and leadership support for psychological safety so staff speak up. Team functioning is therefore not “soft skill”—it is a measurable safety barrier that reduces preventable harm and strengthens reliability in complex, high-acuity environments.

According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, evaluation of a claims management program focuses on efficiency, financial accuracy, and proactive identification of risk exposures.

Indemnity-to-expense ratios are important performance indicators that measure the proportion of funds spent on compensation versus defense costs. A balanced ratio reflects efficient claim handling and appropriate litigation management. The percentage of cases resolved within reserves evaluates the accuracy of initial reserve setting and ongoing claims assessment, demonstrating financial forecasting effectiveness. Additionally, the percentage of cases identified prior to formal claim filing reflects proactive risk identification and early intervention practices, which may reduce litigation costs and improve resolution outcomes.

In contrast, the total number of cases reported alone does not measure program effectiveness, as volume may be influenced by patient population, service lines, or reporting culture rather than management quality.

Claims and litigation objectives emphasize accurate reserving, early case identification, and cost-effective resolution strategies. Therefore, indemnity-to-expense ratios, resolution within reserves, and early case identification are appropriate metrics for evaluating the effectiveness of a claims management program.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, coverage determination depends on both the policy trigger and relevant dates. The alleged negligence occurred on September 5, 2003. Under an occurrence policy in effect from 1/1/03 to 1/1/04, coverage applies because the event occurred during that policy period, regardless of when the claim was filed. Therefore, option 2 applies.

For a claims-made policy covering 1/1/03 to 1/1/04, coverage would require that the claim be made and reported during the policy period unless tail coverage is in place. Because the claim was received on July 3, 2004, after expiration of the 1/1/03 to 1/1/04 claims-made policy, coverage would apply only if a 1-year tail was purchased. Thus, option 3 applies.

Option 1 would not apply because the claim was made after the claims-made policy period ended, and no tail is specified. Option 4 would not apply because occurrence coverage from 1/1/04 to 1/1/05 would not cover an event that occurred in 2003.

Risk financing objectives emphasize understanding policy triggers, reporting requirements, and tail coverage. Therefore, the applicable coverage scenarios are the occurrence policy for 2003 and the claims-made policy with tail coverage.

Wrong-site surgery is a high-severity, preventable event. Joint Commission analyses repeatedly identifycommunication failuresas a leading root cause—breakdowns in scheduling, consent/site verification, handoffs, and intraoperative confirmation. Risk management objectives therefore emphasize standardized verification systems: correct patient/procedure/site documentation, pre-op verification, surgical site marking, and a robust time-out performed with full team engagement. Communication failures can include ambiguous documentation, incorrect or incomplete handoff information, and hierarchy barriers that prevent speaking up. Improving communication reduces reliance on memory and individual vigilance and increases system reliability. In addition, organizations must audit compliance, address workarounds, and strengthen team empowerment so any member can stop the line if a mismatch is detected.