Free ASHRM CPHRM Practice Exam with Questions & Answers | Set: 2

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, telemedicine risk assessment must extend beyond clinical quality of care to include operational risks. Operational considerations encompass technology infrastructure reliability, cybersecurity protections, credentialing and privileging of providers across state lines, licensing compliance, documentation workflows, data storage, and continuity planning for system outages.

Telemedicine platforms rely heavily on secure networks, interoperability with electronic health records, and protection of protected health information. Operational failures such as system downtime, inadequate bandwidth, or insufficient training can disrupt care delivery and increase liability exposure. Additionally, compliance with regulatory requirements regarding interstate practice and reimbursement policies falls within operational risk management.

Behavioral and public awareness considerations may influence patient engagement but are not primary risk assessment categories. Financial risks are relevant in enterprise risk management; however, the question specifically contrasts clinical risk exposures with other telemedicine-related risks, making operational risk the most directly applicable.

Health Care Operations objectives emphasize comprehensive evaluation of technological, regulatory, and workflow factors in emerging service models. Therefore, operational risks should be evaluated alongside clinical exposures when assessing telemedicine programs.

Marketing claims can create liability exposure when they reasonably induce reliance and the patient suffers harm. Depending on jurisdiction and facts, plaintiffs may allegeapparent agency(belief that physicians acted as the HMO’s agents),vicarious liability, negligent credentialing, or negligent misrepresentation/consumer protection claims if statements are misleading. Risk management objectives include reviewing public claims for accuracy, ensuring marketing does not overpromise clinical capability, and aligning network adequacy and credentialing with representations. Clear disclosures about independent contractors may help but do not always defeat apparent agency claims. Controls include legal review of advertising, credentialing rigor, quality oversight, and complaint surveillance to detect mismatches between marketing and actual service capability.

Under Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, patient autonomy is upheld by honoring valid advance directives and durable powers of attorney for healthcare. When multiple documents are presented that designate different decision makers, the most recent properly executed document typically supersedes earlier versions, unless state law provides otherwise.

Durable powers of attorney for healthcare may be revoked or replaced by executing a newer document. Therefore, determining the effective document requires reviewing execution dates and ensuring validity under applicable state statutes, including witnessing and notarization requirements. The document with the more recent date generally reflects the patient’s latest expressed wishes and controls decision-making authority.

Referring immediately to an ethics committee may be appropriate in unresolved value conflicts, but first establishing legal authority is essential. Asking the family to resolve the dispute independently delays necessary medical decisions and does not clarify legal standing. Selecting the older document would contradict the principle that later directives replace earlier ones.

Legal and regulatory objectives emphasize verification of surrogate authority, compliance with state advance directive laws, and protection of patient autonomy. Therefore, the risk manager should confirm which document is most recent and legally valid.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, when a pharmacy staff member is arrested for illegal distribution of controlled substances, the organization must focus on immediate operational and patient safety concerns. Verifying the pre-employment background check ensures compliance with hiring policies and identifies whether due diligence was properly conducted.

An immediate inventory of controlled drug stock is essential to detect diversion, identify discrepancies, and comply with DEA requirements for controlled substance accountability. Prompt reconciliation of medication records protects patient safety and mitigates regulatory exposure.

Interviewing other pharmacy staff supports investigation of potential diversion patterns, internal control weaknesses, and workflow vulnerabilities. This step aligns with system-based risk management and prevention of further loss.

Notification to the National Practitioner Data Bank is not automatically required based solely on an arrest. NPDB reporting typically involves certain professional review actions, licensure restrictions, or clinical privilege actions, not merely criminal charges unless formal disciplinary action occurs.

Health Care Operations objectives emphasize safeguarding controlled substances, regulatory compliance, and internal investigation. Therefore, verifying background checks, inventorying stock, and interviewing staff are appropriate recommendations.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, periodic review of policies and procedures is essential to ensure alignment with current laws, regulatory standards, accreditation requirements, and best practices. Reviewing policies helps ensure consistency between written procedures and actual clinical practice, thereby reducing liability exposure.

Policy review also supports identification of potential risk exposures by detecting outdated language, conflicting guidance, or gaps in processes that could lead to adverse events. Additionally, monitoring compliance with standards—such as federal regulations, state statutes, and accreditation requirements—is a central purpose of policy review, ensuring that organizational practices meet required benchmarks.

Maintaining staff competency, however, is primarily addressed through education, training programs, credentialing, and performance evaluation processes. While policies provide guidance for staff conduct, competency assessment is not the primary objective of policy review itself.

Health Care Operations objectives emphasize governance oversight, regulatory compliance, and risk mitigation through clear, current policies. Therefore, maintaining staff competency is not a direct reason for performing risk management review of policies and procedures, making it the correct exception.

Boards are ultimately accountable for oversight of organizational risk, including patient safety, quality, compliance, and financial sustainability. While executives and risk leaders manage day-to-day operations, board governance sets expectations, ensures resources, monitors performance, and holds leadership accountable for corrective action. Risk management objectives at the governance level include approving risk appetite, reviewing top enterprise risks, ensuring systems exist for event reporting and learning, and verifying that mitigation plans are implemented and effective. In litigation and regulatory scrutiny, board oversight can be a critical factor: a board that demands transparency, tracks harm signals, and supports safety investment strengthens the organization’s defensibility and reduces preventable harm.

According to Health Care Risk Management standards established by ASHRM and the American Hospital Association Certification Center, the Patient Safety and Quality Improvement Act of 2005 amended the Public Health Service Act to promote voluntary reporting of patient safety events. The Act established a federal framework to encourage confidential reporting and analysis of medical errors in order to improve patient safety.

The law enabled the creation and certification of Patient Safety Organizations PSOs, which collect and analyze patient safety data submitted by healthcare providers. Importantly, the Act designates patient safety work product submitted to PSOs as privileged and confidential, providing federal legal protections against disclosure in most civil, criminal, or administrative proceedings. This privilege encourages candid reporting and system-wide learning.

However, reporting to PSOs is voluntary, not mandatory. The Act was specifically designed to foster participation by offering confidentiality protections rather than imposing compulsory reporting requirements.

Legal and regulatory objectives in healthcare risk management emphasize understanding the scope of federal protections and ensuring proper designation and handling of patient safety work product. Therefore, provisions 1, 2, and 4 are correct, while mandatory reporting to PSOs is not required under the Act.

The IOM’s quality framing highlights three categories of quality problems:underuse(failing to provide beneficial care),overuse(providing care where harms outweigh benefits), andmisuse(errors/defects in delivering appropriate care). This triad matters to risk management because harm arises not only from mistakes (misuse) but also fromomissions(underuse) andunnecessary interventions(overuse). For example, missing a diagnostic test can cause deterioration (underuse), while ordering a risky, non-indicated procedure can cause avoidable complications (overuse). Misuse connects strongly to patient safety incident analysis and reliability engineering. Together, these categories provide a comprehensive lens for prioritizing improvement: reduce preventable adverse events, close evidence-based gaps, and avoid low-value care that increases complications and cost. Using this IOM model supports a balanced quality/risk program that prevents harm across the full spectrum of clinical decision-making and care delivery.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, a 22-year-old patient is a legal adult and retains full rights to privacy and control over disclosure of protected health information under HIPAA and applicable state confidentiality laws. Psychiatric records are subject to heightened confidentiality protections in many jurisdictions.

Absent a court order or legal guardianship determination, a parent does not have automatic access to an adult child’s medical records. Therefore, before releasing any information, the organization must verify that the patient has executed a valid, specific authorization for release of information that complies with HIPAA requirements. The authorization must clearly identify the recipient, the information to be disclosed, and be properly signed and dated.

Consulting legal counsel or a treating psychiatrist does not substitute for proper authorization. Similarly, requesting guardianship documentation would only be appropriate if the mother asserts legal guardianship status; however, in the absence of such documentation, release cannot occur.

Legal and regulatory objectives emphasize strict adherence to privacy laws, protection of psychiatric records, and proper authorization procedures. Therefore, verification of a signed release of information from the patient is required before disclosure.

Inpatient suicide prevention is a high-stakes patient safety domain where RCAs frequently identifyenvironmental hazards—particularly ligature risks, blind spots, and unit design that limits observation. Joint Commission–style reviews and published analyses note that thephysical environmentis commonly “incriminated” in inpatient suicides, emphasizing design/engineering controls alongside clinical monitoring. Risk management objectives prioritize layered defenses: ligature-resistant fixtures, environmental rounding, safe room standards, removal control for risky items, and observation policies matched to patient risk. Environmental mitigation is especially powerful because it reduces reliance on perfect human vigilance (which is not realistic). By treating suicide prevention as a systems problem—not an individual failure—organizations improve reliability and reduce recurrence. Environmental corrections also strengthen regulatory readiness and demonstrate that the facility addressed known hazards with sustainable controls.