CPHRM Certification Overview - [Aug 28, 2026] Latest CPHRM PDF Dumps
The Best ASHRM CPHRM Study Guides and Dumps of 2026
NEW QUESTION # 69
A 78-year-old patient in the ICU is unable to speak or swallow. The physician states that she is terminally ill and believes she lacks decision-making capacity. As such, he has deferred to her properly executed advance directive that clearly outlines her wishes for no life-prolonging treatment. The patient's three sons know of the directive, but insist that a PEG tube be placed to assist with feeding. The physician is opposed to placing the tube. The nurse calls the risk manager for advice. Which of the following should the risk manager advise?
- A. More facts are needed; decision making capacity must be determined before moving forward.
- B. More facts are needed; request an ethics consultation.
- C. The family will outlive the patient, and they have the right to sue; support the family.
- D. The patient has the right to autonomy, and the advance directive is proper; support the physician.
Answer: D
Explanation:
Under Health Care Risk Management principles recognized by ASHRM and the American Hospital Association Certification Center, a properly executed advance directive carries legal authority when a patient lacks decision-making capacity. The physician has assessed that the patient is terminally ill and lacks capacity, triggering activation of the advance directive. If the directive clearly states refusal of life-prolonging treatment, including artificial nutrition and hydration, those wishes must be honored in accordance with state law and the Patient Self-Determination Act framework.
Patient autonomy is a foundational ethical and legal principle in health care. Once capacity is lost, previously expressed wishes through a valid advance directive govern care decisions. Family members do not have authority to override a valid directive unless legal defects or ambiguity exist. Their disagreement does not negate the patient's documented preferences.
Although ethics consultation can be helpful in managing conflict, the directive here is described as properly executed and clear. Additional determination of capacity is unnecessary because the physician has already made that assessment.
Risk management objectives emphasize compliance with advance directive statutes, respect for patient autonomy, and reduction of liability through adherence to documented patient wishes. Therefore, the appropriate advice is to support the physician in honoring the advance directive.
NEW QUESTION # 70
Aside from clinical risk exposures, which of the following should be evaluated as part of a risk assessment concerning telemedicine?
- A. behavioral
- B. financial
- C. public awareness
- D. operational
Answer: D
Explanation:
According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, telemedicine risk assessment must extend beyond clinical quality of care to include operational risks. Operational considerations encompass technology infrastructure reliability, cybersecurity protections, credentialing and privileging of providers across state lines, licensing compliance, documentation workflows, data storage, and continuity planning for system outages.
Telemedicine platforms rely heavily on secure networks, interoperability with electronic health records, and protection of protected health information. Operational failures such as system downtime, inadequate bandwidth, or insufficient training can disrupt care delivery and increase liability exposure. Additionally, compliance with regulatory requirements regarding interstate practice and reimbursement policies falls within operational risk management.
Behavioral and public awareness considerations may influence patient engagement but are not primary risk assessment categories. Financial risks are relevant in enterprise risk management; however, the question specifically contrasts clinical risk exposures with other telemedicine-related risks, making operational risk the most directly applicable.
Health Care Operations objectives emphasize comprehensive evaluation of technological, regulatory, and workflow factors in emerging service models. Therefore, operational risks should be evaluated alongside clinical exposures when assessing telemedicine programs.
NEW QUESTION # 71
Which of the following risk management documents in a policy and procedure manual should be approved by an organization's board of directors?
- A. philosophy regarding medical error management
- B. risk management department's annual budget
- C. risk analysis
- D. departmental personnel job descriptions
Answer: A
Explanation:
According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, the governing board has ultimate responsibility for organizational oversight, quality of care, and patient safety. As part of its fiduciary and governance duties, the board approves high- level policies that establish the organization's philosophy, strategic direction, and commitment to safety and risk management.
A philosophy regarding medical error management reflects the organization's approach to disclosure, reporting, just culture principles, accountability, and system improvement. Because this philosophy sets the tone for organizational culture and impacts patient safety, legal exposure, and regulatory compliance, it requires board-level approval to ensure alignment with governance expectations and accreditation standards.
In contrast, the risk management department's annual budget is typically approved through financial governance processes rather than as a policy document. Risk analyses are operational tools conducted by management and do not require board approval. Departmental personnel job descriptions are administrative documents managed at the executive or human resources level.
Health Care Operations objectives emphasize board engagement in safety culture and oversight of enterprise risk management. Therefore, the philosophy regarding medical error management should be approved by the organization's board of directors.
NEW QUESTION # 72
An emergency department physician has evaluated and stabilized a patient who needs a sign language interpreter. The on-call physician is consulted for admission. Which of the following regulatory laws are most relevant?
- A. ADA and EMTALA/COBRA
- B. HCQIA and ADA
- C. HIPAA and HCQIA
- D. EMTALA/COBRA and HIPAA
Answer: A
Explanation:
Under Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, two federal laws are most directly implicated in this scenario: the Americans with Disabilities Act ADA and the Emergency Medical Treatment and Labor Act EMTALA, formerly enacted under COBRA.
EMTALA requires hospitals with emergency departments to provide an appropriate medical screening examination, stabilization of emergency medical conditions, and appropriate transfer or admission regardless of ability to pay. Since the emergency physician has evaluated and stabilized the patient and the on-call physician is being consulted for admission, EMTALA obligations remain central to ensuring compliant continuation of care.
The ADA is also directly relevant because it mandates that health care organizations provide reasonable accommodations to individuals with disabilities, including effective communication. For a patient requiring a sign language interpreter, the hospital must provide appropriate auxiliary aids and services to ensure meaningful access to care.
HIPAA relates primarily to privacy and protected health information, while HCQIA addresses peer review immunity and credentialing matters. Therefore, ADA and EMTALA are the most relevant regulatory frameworks in this case.
NEW QUESTION # 73
What in particular is the process chain in a laboratory subject to?
- A. Standardization only
- B. Variability across pre-analytical, analytical, and post-analytical phases
- C. Zero human factors influence
- D. Exclusively equipment failure
Answer: B
Explanation:
Laboratory testing is best understood as atotal testing process(from test ordering through specimen collection, analysis, and result reporting). Across this chain, error risk is heavily influenced byvariability- especially inpre-analytical steps(patient identification, tube labeling, specimen handling, transport conditions) andpost-analytical steps(timely reporting, critical value communication, interpretation). Risk management objectives emphasize controlling variation through standard work, barcoding, competency training, environmental controls, and quality indicators for each phase. Importantly, many lab failures arise outside the analyzer itself; focusing only on the analytical instrument misses major sources of harm. Reducing variability improves reliability, reduces redraws and diagnostic delay, and supports defensible performance in accreditation and event review. In short: the lab process chain is a high-volume, multi-step clinical production system-variation is inevitable, but unmanaged variation increases patient safety risk.
NEW QUESTION # 74
Which of the following can be considered evidence in a malpractice claim?
* photographs of injuries
* thank you note from the patient to the physician
* patient journal of the hospital stay
* gift from the patient to a volunteer
- A. 1, 2, and 4 only
- B. 1, 2, and 3 only
- C. 1, 3, and 4 only
- D. 2, 3, and 4 only
Answer: B
Explanation:
According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, evidence in a malpractice claim includes any relevant material that may help establish facts related to duty, breach, causation, or damages. Photographs of injuries are routinely admissible as demonstrative or documentary evidence to illustrate the nature and extent of harm. A thank you note from a patient to a physician may be introduced to reflect the patient's contemporaneous perception of care, credibility, or satisfaction at a particular time, depending on context. A patient's personal journal documenting experiences during hospitalization may also be considered evidence, particularly if it describes symptoms, interactions, or emotional distress relevant to damages.
A gift from a patient to a volunteer, however, is generally not probative of negligence or injury unless directly tied to issues of undue influence or misconduct. In typical malpractice litigation, such a gift does not establish standard of care, breach, or damages and would not ordinarily be considered relevant evidence.
Claims and litigation objectives emphasize careful documentation, preservation of relevant materials, and coordination with counsel regarding evidentiary matters. Therefore, photographs, written communications, and patient journals may be considered evidence in a malpractice claim.
NEW QUESTION # 75
Documentation that assists with defense of a malpractice claim
- A. contains subjective comments about the patient.
- B. is not important if the claim happened in prior years.
- C. does not need to be complete or timely.
- D. describes the provider's clinical decision-making process.
Answer: D
Explanation:
According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, high-quality clinical documentation is critical in defending malpractice claims. The medical record serves as the primary evidence of care provided and reflects whether the standard of care was met.
Documentation that clearly describes the provider's clinical decision-making process is particularly valuable in litigation. It demonstrates assessment findings, differential diagnoses, rationale for chosen interventions, informed consent discussions, and follow-up plans. Thorough documentation provides objective support for clinical judgments and establishes a defensible narrative of care.
Subjective or disparaging comments about the patient can undermine credibility and may be harmful in court.
Complete and timely documentation is essential; delayed or incomplete entries may suggest negligence or alteration. Additionally, documentation remains important regardless of when a claim arises, as statutes of limitation may allow claims to be filed years after the event, especially in cases involving minors or discovery rules.
Claims and litigation objectives emphasize accurate, objective, and contemporaneous recordkeeping to reduce liability exposure. Therefore, documentation that clearly outlines the provider's clinical reasoning best assists in defending a malpractice claim.
NEW QUESTION # 76
A hospital has opted to open an anticoagulation clinic. As this is a high-risk medication, a risk manager wants to conduct a risk assessment before opening the clinic. The BEST tool to use would be a
- A. scatter diagram.
- B. failure mode and effects analysis FMEA.
- C. cause and effect diagram.
- D. root cause analysis RCA.
Answer: B
Explanation:
Failure Mode and Effects Analysis FMEA is the most appropriate tool in this scenario because it is a proactive risk assessment methodology designed to identify and mitigate potential failures before harm occurs. According to Health Care Risk Management principles outlined by ASHRM and the American Hospital Association Certification Center, FMEA is specifically used when introducing new processes, services, or high-risk clinical operations, such as an anticoagulation clinic involving medications with narrow therapeutic indices and significant bleeding risks.
FMEA systematically evaluates each step in a proposed process, identifies possible failure modes, analyzes their causes and effects, and prioritizes risks using severity, occurrence, and detectability scoring. This structured approach aligns with patient safety objectives by reducing preventable adverse events before implementation.
In contrast, Root Cause Analysis RCA is a retrospective tool used after an adverse event has occurred. A cause and effect diagram is a component often used within RCA or FMEA but is not a comprehensive risk assessment tool on its own. A scatter diagram is primarily used for statistical correlation analysis and does not evaluate process failures.
Therefore, for proactive risk identification and mitigation prior to clinic opening, FMEA is the best and most appropriate tool.
NEW QUESTION # 77
What group reports information (historically HIPDB content; now within NPDB) related to fraud/abuse oversight?
- A. Peer review organizations (for certain state/federal reporting categories)
- B. School boards
- C. Any patient advocacy blog
- D. Restaurant inspectors
Answer: A
Explanation:
The Healthcare Integrity and Protection Data Bank (HIPDB) was created to combat healthcare fraud and abuse; it isno longer operational as a separate bank, and its content was merged into the NPDB. Reporting and querying are governed by HRSA rules defining authorized entities, including certain peer review and oversight organizations in specific reporting frameworks. Risk management objectives include ensuring organizations understand which actions must be reported, ensure due process, and comply with data handling rules. Proper reporting supports system integrity by preventing practitioners or entities with serious adverse actions from moving undetected across organizations. For hospitals and health plans, this strengthens credentialing and contracting decisions, reducing organizational exposure to negligent credentialing and improper network participation risks.
NEW QUESTION # 78
In general, how many steps should an FMEA proceed in each direction (upstream/downstream) when mapping a process for failure analysis?
- A. Only the current step; context is irrelevant
- B. Two steps in each direction (a common practical rule-of-thumb)
- C. Steps are not mapped in FMEA
- D. Ten steps minimum regardless of complexity
Answer: B
Explanation:
A practical FMEA requires enough process context to capture upstream causes and downstream consequences without becoming unmanageably large. A common operational rule-of-thumb is to examine roughlytwo steps upstream and two steps downstreamfrom a target step to uncover handoffs, dependencies, and failure propagation. Risk management objectives focus on identifying failure modes that originate earlier (e.g., incorrect patient ID at registration leading to lab/specimen mismatch) and harms that emerge later (e.g., delayed result communication causing deterioration). The exact boundary depends on complexity and risk; high-hazard workflows (blood products, surgery, chemo) may require deeper mapping. The goal is usable granularity: map, identify failure modes, score (S-O-D), prioritize, implement controls, and reassess residual risk.
NEW QUESTION # 79
Supervisors who conduct job interviews may ask which of the following questions?
- A. Are you currently taking a prescription medication?
- B. Are you a citizen of the United States?
- C. Do you plan to have children?
- D. Can you meet the organization's attendance requirement?
Answer: D
Explanation:
Under Health Care Risk Management standards aligned with ASHRM and the American Hospital Association Certification Center, employment interview questions must comply with federal and state anti-discrimination laws, including the Americans with Disabilities Act ADA, Title VII of the Civil Rights Act, the Pregnancy Discrimination Act, and the Immigration Reform and Control Act.
Questions about prescription medications may violate ADA provisions by eliciting information about potential disabilities prior to a conditional offer of employment. Asking whether a candidate plans to have children may constitute unlawful discrimination based on sex or family status. Inquiring directly about citizenship may violate federal employment eligibility standards; employers may instead ask whether the applicant is legally authorized to work in the United States.
In contrast, asking whether a candidate can meet the organization's attendance requirements is permissible because it relates directly to essential job functions and business necessity. Employers may inquire about the ability to perform job-related duties, provided questions are applied consistently to all applicants and are not designed to screen out protected classes.
Legal and regulatory objectives emphasize nondiscriminatory hiring practices and adherence to equal employment laws. Therefore, questions regarding attendance requirements are appropriate in a job interview setting.
NEW QUESTION # 80
What factors are included in a calculation of Risk Priority Number (RPN) in FMEA?
- A. Insurance premiums, deductibles, coinsurance
- B. Cost, staff satisfaction, marketing risk
- C. Legal privilege, media attention, reputation
- D. Severity, occurrence (probability), detection
Answer: D
Explanation:
In Failure Modes and Effects Analysis (FMEA), the Risk Priority Number (RPN) is commonly calculated as the product of three ratings:Severity (S)of impact,Occurrence (O)likelihood/probability, andDetection (D) ability to detect the failure before it causes harm (lower detectability increases risk). This structured scoring helps teams prioritize which failure modes deserve immediate mitigation. Risk management objectives include proactively identifying high-risk process steps (medication administration, specimen labeling, surgery scheduling), designing controls (standard work, forcing functions, redundancy), and tracking residual risk after changes. While cost and feasibility may influence selection of mitigations, they are not the core RPN elements. Using S-O-D improves transparency in prioritization, supports interdisciplinary alignment, and provides a defensible rationale for resource allocation toward patient safety improvements.
NEW QUESTION # 81
Which of the following concerns meets the CMS Hospital Conditions of Participation 42 CFR §482.12 classification as a grievance?
- A. post-hospital verbal communication regarding a care issue that could have been handled by the staff during visit but was not reported
- B. information obtained with a patient satisfaction survey
- C. a patient calling regarding a billing issue requesting for adjustment to the charges
- D. a verbal complaint that cannot be solved by current staff, and the resolution of which is postponed for later
Answer: D
Explanation:
According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, the CMS Hospital Conditions of Participation define a grievance as a formal or informal written or verbal complaint made by a patient or representative regarding care, abuse, neglect, compliance with regulations, or patient rights that is not resolved at the time of the complaint by staff present.
A verbal complaint that cannot be resolved immediately by current staff and whose resolution is postponed qualifies as a grievance under 42 CFR §482.12. Such grievances require formal investigation, documentation, and written response within established timeframes.
Billing issues generally fall outside the grievance definition unless they involve quality of care or patient rights concerns. Information from patient satisfaction surveys is not automatically classified as a grievance unless the patient specifically requests investigation or follow-up. Post-discharge verbal concerns may constitute grievances depending on context, but the key CMS criterion is whether the complaint could not be resolved at the time it was expressed.
Legal and regulatory objectives emphasize proper classification, timely response, documentation, and board oversight of grievance processes. Therefore, a verbal complaint that cannot be resolved immediately and is deferred meets CMS grievance criteria.
NEW QUESTION # 82
Which of the following should be included in a risk management plan?
* purpose of the program
* budget for the department
* process of risk management activities
* structure of the program
- A. 1, 3, and 4 only
- B. 1, 2, and 4 only
- C. 1, 2, and 3 only
- D. 2, 3, and 4 only
Answer: A
Explanation:
According to Health Care Risk Management standards defined by ASHRM and the American Hospital Association Certification Center, a formal risk management plan is a governance document that outlines the framework, scope, and operational processes of the program. It is intended to define how risk management activities support organizational objectives and regulatory compliance.
The plan should clearly state the purpose of the program, establishing its mission, goals, and alignment with patient safety and enterprise risk management strategies. It must also describe the structure of the program, including reporting relationships, committee oversight, leadership roles, and accountability mechanisms.
Additionally, the process of risk management activities should be detailed, including event reporting, investigation procedures, claims management, education initiatives, and performance evaluation methods.
While financial planning is important for departmental operations, the budget for the department is typically addressed in administrative or financial planning documents rather than the risk management plan itself. The plan focuses on governance, structure, and operational processes rather than line-item budgeting.
Therefore, inclusion of the program's purpose, structural framework, and operational processes appropriately defines a comprehensive risk management plan.
NEW QUESTION # 83
What significantly impacts whether incident reports are discoverable?
- A. The patient's insurance plan
- B. Staff seniority
- C. The color of the incident form
- D. State statutes, federal statutes, and case law
Answer: D
Explanation:
Discoverability of incident reports varies substantially by jurisdiction and depends on how state and federal laws define peer review privilege, quality improvement protections, and confidentiality-plus how courts interpret those protections. Risk management objectives include structuring reporting and investigation workflows to maximize protected quality review where legally available: routing analyses through designated committees, labeling and handling documents per policy, limiting distribution, and avoiding mixing risk/peer review materials with ordinary business records. However, privilege is not automatic; mishandling (broad email distribution, using reports for disciplinary actions outside protected structures, inconsistent committee practices) can weaken protections. A defensible program uses legal counsel guidance, staff training, and clear documentation rules so the organization learns from events while reducing unnecessary legal exposure.
NEW QUESTION # 84
When a hospital notes that most errors are occurring at the "sharp end," what does that mean?
- A. Errors are occurring in billing and contracting
- B. Errors occur only in device manufacturing
- C. Errors are exclusively leadership decisions
- D. Errors occur during direct caregiver-patient interaction (frontline care)
Answer: D
Explanation:
The "sharp end" refers to the point in a system where clinicians directly interact with patients and deliver care-nurses administering medications, physicians performing procedures, therapists mobilizing patients, and so on. Errors at the sharp end are typicallyactive failuresthat are immediately visible, but they are often shaped by "blunt end" factors-staffing levels, training, equipment design, policies, and workflow constraints. Risk management objectives discourage blaming the sharp end alone; instead, they use incident analysis (RCA) to identify latent system conditions that make frontline errors more likely. Improving sharp- end safety includes standardization, teamwork tools (SBAR/TeamSTEPPS), human factors engineering, and reducing hazardous variability in processes. This systems approach helps prevent repeat events and supports a just culture where learning is prioritized while accountability is preserved for reckless conduct.
NEW QUESTION # 85
Which of the following documents will an insurance underwriter use to provide an insurance quote?
- A. certificate of insurance
- B. certificate of need
- C. application
- D. declaration page
Answer: C
Explanation:
Under Health Care Risk Management principles supported by ASHRM and the American Hospital Association Certification Center, the insurance application is the primary document used by an underwriter to evaluate risk and generate a premium quote. The application provides detailed information about the organization's operations, services, patient volume, claims history, risk control measures, governance structure, and prior insurance coverage. This information enables the underwriter to assess exposure, determine eligibility, and calculate appropriate pricing and coverage terms.
A certificate of insurance is issued after a policy is in force to verify coverage to third parties and does not serve as a quoting document. The declaration page is part of an existing insurance policy and summarizes coverage limits, deductibles, and endorsements; it reflects finalized terms rather than information used to generate a quote. A certificate of need is a regulatory document related to state approval of healthcare facilities or services and is unrelated to underwriting.
Risk financing objectives emphasize accurate disclosure and thorough completion of insurance applications, as misrepresentation or omission may affect coverage validity. Therefore, the application is the document used by an underwriter to provide an insurance quote.
NEW QUESTION # 86
All of the following are valid reasons for performing risk management review of policies and procedures EXCEPT
- A. ensuring consistency between practice and policy.
- B. maintaining staff competency.
- C. monitoring compliance with standards.
- D. identifying potential risk exposures.
Answer: B
Explanation:
According to Health Care Risk Management standards supported by ASHRM and the American Hospital Association Certification Center, periodic review of policies and procedures is essential to ensure alignment with current laws, regulatory standards, accreditation requirements, and best practices. Reviewing policies helps ensure consistency between written procedures and actual clinical practice, thereby reducing liability exposure.
Policy review also supports identification of potential risk exposures by detecting outdated language, conflicting guidance, or gaps in processes that could lead to adverse events. Additionally, monitoring compliance with standards-such as federal regulations, state statutes, and accreditation requirements-is a central purpose of policy review, ensuring that organizational practices meet required benchmarks.
Maintaining staff competency, however, is primarily addressed through education, training programs, credentialing, and performance evaluation processes. While policies provide guidance for staff conduct, competency assessment is not the primary objective of policy review itself.
Health Care Operations objectives emphasize governance oversight, regulatory compliance, and risk mitigation through clear, current policies. Therefore, maintaining staff competency is not a direct reason for performing risk management review of policies and procedures, making it the correct exception.
NEW QUESTION # 87
......
Valid CPHRM Exam Updates - 2026 Study Guide: https://simplilearn.lead1pass.com/ASHRM/CPHRM-practice-exam-dumps.html