ASHRM CPHRM - Certified Professional in Health Care Risk Management (CPHRM)

Access to NPDB information is restricted to authorized entities for credentialing, privileging, and oversight—not public browsing. HRSA’s NPDB rules identify who can query and report;professional societies with formal peer revieware listed among entities that may query under certain circumstances. This limited-access model supports patient safety objectives by enabling credentialing bodies to identify adverse licensure actions, certain negative clinical privilege actions, and other reportable events, while protecting due process and confidentiality. From a risk management perspective, proper querying supports defensible credentialing and reduces negligent credentialing exposure. Equally important: organizations must maintain secure handling of NPDB responses and follow permitted-use rules to avoid compliance violations.

According to Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, organizations operating vehicle fleets must implement structured fleet risk management controls to reduce liability exposure. One of the most fundamental annual requirements is verification of each driver’s driving record, typically obtained through a motor vehicle record MVR review.

An annual driving record review allows the organization to confirm that drivers maintain valid licensure, identify traffic violations, detect patterns of unsafe driving behavior, and assess risk exposure. This proactive screening supports loss prevention, reduces the likelihood of negligent entrustment claims, and ensures compliance with organizational driving policies.

Mileage logs are operational tools used for tracking usage and reimbursement but do not assess driver eligibility or risk. Driver training is important for safety programs but is not the minimum required documentation to confirm driver qualification status. Proof of insurance may be required when employees use personal vehicles for business purposes, but it does not replace the need to review the driver’s official record.

Health Care Operations objectives emphasize credential verification, regulatory compliance, and proactive liability mitigation. Therefore, obtaining and reviewing each driver’s driving record annually is the minimum required documentation.

According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, occurrence coverage provides protection for incidents that occur during the policy period, regardless of when the claim is reported. The triggering event is the date of the occurrence. As long as the alleged act or omission took place while the policy was in force, coverage applies even if the claim is filed years later.

Option A is incorrect because occurrence coverage does not extend to incidents that occur prior to the policy’s effective date. Coverage is strictly tied to the policy period.

Option C is incorrect because in claims-made coverage, the retroactive date is critical. Coverage applies only to claims made during the policy period for incidents that occurred on or after the retroactive date.

Option D is incorrect because the “nose” period, also known as prior acts coverage, is highly significant in claims-made policies. It determines whether earlier acts are covered when switching carriers.

Risk financing objectives emphasize understanding policy triggers, retroactive dates, and reporting requirements. Therefore, occurrence coverage applies to incidents that occur while the policy is in effect.

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, a risk management policy and procedure manual should clearly define the structure, authority, and operational framework of the risk management program. An organizational chart is an essential component because it identifies reporting relationships, lines of authority, and accountability within the department and in relation to executive leadership and governing bodies.

A clearly documented organizational structure supports regulatory compliance, facilitates communication, and ensures that responsibilities for event reporting, claims management, patient safety initiatives, and regulatory oversight are properly assigned. It also demonstrates governance alignment and helps accrediting bodies evaluate program effectiveness.

Medical staff bylaws are separate governance documents that outline credentialing, peer review, and clinical governance standards. Actuarial reports are financial analyses used in risk financing decisions but are not part of a policy and procedure manual. Loss run reports summarize historical claims activity and support financial review but do not define program structure.

Health Care Operations objectives emphasize formal documentation of authority, processes, and accountability within the risk management framework. Therefore, inclusion of the department organizational chart is an essential element of a comprehensive risk management policy and procedure manual.

RCA and systems safety models (e.g., Swiss Cheese) emphasize that adverse events typically requiremultiple contributing factors—small process breakdowns, latent conditions, and active failures—to align. This is why focusing only on the last person who touched the patient (“sharp end blame”) rarely prevents recurrence. Risk management objectives are to identify and strengthen defenses: policies, training, equipment design, staffing models, communication standards, and redundancy where needed. A series-of-events understanding enables targeted corrective actions (forcing functions, standardization, automation with safeguards, independent double checks for high-alert processes). It also supports just culture: accountability is preserved for reckless behavior, but most improvement comes from redesigning systems that make errors more likely. This approach improves reliability, reduces repeat harm, and provides defensible evidence of organizational learning and corrective action.

The “sharp end” refers to the point in a system where clinicians directly interact with patients and deliver care—nurses administering medications, physicians performing procedures, therapists mobilizing patients, and so on. Errors at the sharp end are typicallyactive failuresthat are immediately visible, but they are often shaped by “blunt end” factors—staffing levels, training, equipment design, policies, and workflow constraints. Risk management objectives discourage blaming the sharp end alone; instead, they use incident analysis (RCA) to identify latent system conditions that make frontline errors more likely. Improving sharp-end safety includes standardization, teamwork tools (SBAR/TeamSTEPPS), human factors engineering, and reducing hazardous variability in processes. This systems approach helps prevent repeat events and supports a just culture where learning is prioritized while accountability is preserved for reckless conduct.

According to Health Care Risk Management principles established by ASHRM and the American Hospital Association Certification Center, indemnity reserves represent the estimated amount the organization expects to pay in settlement or judgment to a claimant. Indemnity refers specifically to damages paid to compensate the injured party, not defense or administrative expenses.

Incurred medical expenses are a core component of economic damages and must be included in indemnity reserve calculations. Emotional pain and suffering fall under non-economic damages and are also considered when estimating potential settlement or verdict value. Future cost of medical care is another essential factor, particularly in cases involving long-term injury or disability, as it represents projected economic damages that may substantially increase exposure.

Medical expert witness costs, however, are categorized as defense expenses and are typically included in allocated loss adjustment expenses rather than indemnity reserves. These costs relate to the defense of the claim rather than compensation to the plaintiff.

Risk management objectives emphasize accurate differentiation between indemnity and expense reserves to ensure proper financial reporting and regulatory compliance. Therefore, incurred medical expenses, pain and suffering, and future medical costs should be considered when setting indemnity reserves, while expert witness costs should not.

Under Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, cases involving sterilization of minors, particularly those who are developmentally disabled, raise significant legal and regulatory concerns. The risk manager’s primary responsibility is to ensure compliance with applicable consent laws and protect patient rights while minimizing organizational liability.

First, determining who has legal consent authority is essential. When parents disagree, state law typically governs whether both parents must consent, whether one parent’s consent is sufficient, or whether court involvement is required. Second, evaluating the competency level of the patient is critical because decision-making capacity influences whether the patient can participate in consent or assent processes. Capacity assessments may require clinical and legal evaluation.

Third, state statutes and laws are highly relevant, as many jurisdictions impose strict legal requirements or court approval for sterilization of minors or individuals with developmental disabilities. These laws are designed to protect vulnerable populations.

The patient’s diagnosis alone is not the determining legal factor; rather, decision-making capacity and statutory requirements are central. Therefore, the risk manager must evaluate consent authority, competency, and applicable state laws to ensure regulatory compliance and ethical integrity.

Under Health Care Risk Management standards recognized by ASHRM and the American Hospital Association Certification Center, the Safe Medical Devices Act SMDA is part of the FDA’s post market surveillance system for medical devices. The SMDA requires healthcare facilities to report to the FDA and, in some cases, to the manufacturer when a medical device has or may have caused or contributed to a patient death or serious injury. This mandatory reporting system enhances device safety monitoring and supports regulatory oversight after products enter the market.

EMTALA governs emergency medical screening and stabilization obligations, not device reporting. The Occupational Safety and Health Act focuses on workplace safety for employees rather than patient device-related injuries. Patient Safety Organizations operate under the Patient Safety and Quality Improvement Act and facilitate voluntary reporting of patient safety events, but they do not replace FDA-mandated device reporting requirements.

Legal and regulatory objectives in healthcare risk management emphasize compliance with federal reporting statutes, timely submission of required reports, and maintenance of documentation to mitigate regulatory exposure. Therefore, the Safe Medical Devices Act is the correct answer regarding mandatory FDA post market surveillance reporting for device-related deaths or injuries.

According to Health Care Risk Management standards established by ASHRM and the American Hospital Association Certification Center, deaths resulting from criminal acts fall under medico-legal jurisdiction and are typically subject to coroner or medical examiner review. Even when a patient is a documented organ donor, as indicated on a driver's license under the Uniform Anatomical Gift Act framework, the circumstances of death may require legal investigation.

When a death is associated with trauma from a criminal act, it is generally considered a reportable death. The medical examiner or coroner has statutory authority to determine whether an autopsy is required and to ensure preservation of forensic evidence. Organ procurement activities must not interfere with legal investigation obligations. Therefore, prior to organ retrieval or withdrawal of life support, the appropriate legal authorities must be notified.

While honoring the patient’s documented donation wishes is important, compliance with state statutes governing reportable deaths and forensic investigations takes precedence. The family’s wishes do not override a valid donor designation, but coordination must occur within the legal framework.

Thus, the most appropriate action for the risk manager is to ensure that authorities are notified to determine autopsy requirements before proceeding.