Free CPHRM Practice Test Questions and Answers (2026)

The Safe Medical Devices Act (SMDA) of 1990 is a federal statute enacted to expand the Food and Drug Administration's (FDA) post-market surveillance capabilities regarding medical devices. Under SMDA provisions, healthcare facilities—designated as device user facilities—are legally mandated to report medical device-related deaths, serious injuries, or adverse incidents to the FDA and/or the device manufacturer within specific statutory timeframes. This post-market monitoring mechanism ensures prompt identification of equipment defects, design failures, or operational hazards, thereby preventing recurring patient harm across the healthcare system. The law also establishes requirements for tracking high-risk implantable devices and maintaining rigorous internal procedures for adverse event reporting and investigation.

Option B: Incorrect. EMTALA regulates emergency medical screening and stabilizing treatment to prevent patient dumping, regardless of ability to pay, not medical device reporting.
Option C: Incorrect. OSHA establishes workplace safety and health standards to protect employees from occupational hazards, rather than post-market surveillance of medical device adverse events.
Option D: Incorrect. A PSO collects voluntary, confidential safety data under the Patient Safety and Quality Improvement Act to improve quality, not FDA device surveillance mandates.

1. Food and Drug Administration (FDA). Medical Device Reporting (MDR): How to Report Medical Device Problems. Title 21 CFR Part 803, 2022. https://www.fda.gov/medical-devices/postmarket-requirements-devices/medical-device-reporting-mdr-how-report-medical-device-problems

2. Carroll, R. Risk Management Handbook for Health Care Organizations, 6th ed., Vol. 1. Jossey-Bass, 2011, Chapter 14: Medical Technology and Risk Management, pp. 412–418.

3. American Society for Healthcare Risk Management (ASHRM). CPHRM Exam Preparation Guide, 4th ed. Chicago, IL: ASHRM, 2021, Domain 1: Legal and Regulatory Requirements, pp. 18–21.

In healthcare risk management, an incident (also referred to as an occurrence or safety event) is broadly defined as any happening or event that is inconsistent with routine facility operations or routine patient care. This definition encompasses actual adverse events, unexpected clinical outcomes, equipment failures, property damage, and near-misses (close calls) where harm did not reach the patient. Defining incidents broadly encourages robust reporting across all operational and clinical areas, allowing risk managers to identify systemic vulnerabilities, perform root cause analyses, and implement preventive measures before adverse outcomes recur. Restricting the definition strictly to severe harms, complaints, or billing disputes severely limits risk mitigation efforts.

Option B: Incidents encompass all unexpected events or deviations from routine care, including minor errors and near-misses, not just events resulting in severe injury or death.
Option C: Patient complaints represent a specific category of feedback; incident reporting encompasses broader clinical, operational, environmental, and patient safety events across the organization.
Option D: Billing disputes pertain strictly to administrative financial disagreements and do not address clinical care quality, patient safety, or operational risk management definitions.

1. American Society for Health Care Risk Management (ASHRM). (2020). Risk Management Handbook for Health Care Organizations, 8th Edition. Volume 1, Chapter 4: Enterprise Risk Management and Event Reporting. ISBN: 978-1119772217.

2. World Health Organization. (2009). WHO Draft Guidelines for Adverse Event Reporting and Learning Systems. Section 2: Concepts and Definitions, pp. 9–14. https://doi.org/10.1016/j.jqsafety.2008.11.002

Effective clinical communication and risk reduction require explicit, unambiguous, and measurable directives to ensure standard of care compliance. Directives that specify the precise clinical action required, the operational timeframe, and the mandatory documentation criteria eliminate guesswork and reduce ambiguity in nursing practice. Providing specific instructions regarding infusion pump monitoring and documentation directly aligns with clinical governance, patient safety protocols, and medical-legal standards of practice. Vague instructions lack actionable criteria, preventing staff from understanding exact operational expectations or verifying compliance. Therefore, stating specific actions, monitoring intervals, and documentation requirements constitutes a legally sound, clear, and actionable clinical directive within healthcare risk management frameworks.

A. “Be careful.”: This statement is an ambiguous generalization that fails to define specific clinical expectations, actionable tasks, or measurable parameters.
C. “Do your best.”: This phrase is subjective and provides no concrete clinical guidance, standard of care criteria, or clear operational requirements.
D. “If you have time, look at it.”: This statement makes critical patient monitoring optional and conditional, creating significant risk of omission and patient harm.

- American Society for Health Care Risk Management (ASHRM). (2018). Risk Management Handbook for Health Care Organizations (6th ed., Vol. 1). Jossey-Bass, pp. 215-240.

- Agency for Healthcare Research and Quality (AHRQ). (2019). TeamSTEPPS 2.0: Communication Techniques and Mutual Support. AHRQ Publication No. 14-0001.

- World Health Organization. (2021). Global Patient Safety Action Plan 2021–2030: Towards eliminating avoidable harm in health care. WHO Guidelines, pp. 34-38.

In healthcare organization governance, ultimate legal, fiduciary, and ethical accountability for the overall risk management program and patient safety framework rests with the Governing Board (Board of Directors or Trustees). While risk managers, administrators, and clinical staff are responsible for day-to-day operational execution, monitoring, and compliance, the board maintains non-delegable oversight duties. Accreditation standards set by The Joint Commission, as well as CMS Conditions of Participation, mandate that the governing body actively oversee quality assessment, performance improvement, strategic risk management, and legal compliance. By holding ultimate authority over organizational policies, capital allocation, and executive leadership performance, the board ensures the institution maintains an effective risk management infrastructure.

Option B: The gift shop manager oversees ancillary retail management and lacks legal, clinical, or institutional governance authority over enterprise risk management programs.
Option C: A single bedside nurse is responsible for delivering individual patient care safely, but lacks organizational-wide authority or fiduciary accountability for enterprise governance.
Option D: A parking contractor is an external third-party service provider without legal or institutional governance authority over healthcare enterprise risk management.

1. The Joint Commission. Comprehensive Accreditation Manual for Hospitals (CAMH), Standard LD.01.03.01: "The governing body is ultimately responsible for the safety and quality of care, treatment, and services."

2. Centers for Medicare & Medicaid Services (CMS). 42 CFR § 482.12 - Condition of participation: Governing body.

3. American Society for Healthcare Risk Management (ASHRM). Risk Management Handbook for Health Care Organizations, 6th Edition, Volume 1, Chapter 3, "Governance and Leadership Oversight," pp. 65-82.

When determining coverage for a professional liability claim originating from care delivered ten years prior, the risk manager must first review the policy in effect during the year of treatment as well as current coverage. Second, the risk manager must determine whether the policy structure is occurrence-based or claims-made. An occurrence policy covers incidents happening during the policy period regardless of when filed, whereas a claims-made policy requires coverage to be active when the claim is made. Evaluating these contractual parameters allows the risk manager to assess policy response accurately before brief executive leadership. Co-defendant coverage and defense counsel discussions are secondary steps after establishing primary coverage status.

Option B: Identifying co-defendants' insurance coverage is an external liability consideration that does not determine whether the primary hospital's own insurance policies respond to the specific claim.
Option C: Discussing coverage issues with defense counsel before conducting an internal policy analysis is premature; the risk manager must first analyze policy language, triggers, and occurrence versus claims-made coverage.
Option D: Statements 3 and 4 omit the essential primary contract reviews (statements 1 and 2) necessary to establish whether an active or historical policy legally attaches to the loss.

1. American Society for Health Care Risk Management (ASHRM). (2020). Risk Management Handbook for Health Care Organizations (6th ed., Vol. 3, Ch. 2 "Healthcare Insurance and Risk Financing"). Jossey-Bass.

2. Carroll, R. (Ed.). (2014). Principles of Healthcare Risk Management. American Hospital Association / ASHRM. Chapter 6: Risk Financing and Insurance.

Enterprise Risk Management (ERM) extends beyond traditional clinical risk management by taking a comprehensive, organization-wide approach that integrates risk identification, assessment, and mitigation directly into high-level strategic decision-making. Unlike traditional programs that focus predominantly on clinical incidents and liability exposure, ERM elevates risk management to a strategic priority actively overseen by senior leadership and governing boards. By embedding risk oversight across all operational domains—financial, strategic, operational, human capital, and legal—ERM enables healthcare leadership to proactively balance risks with strategic opportunities and long-term organizational goals.

Option B: Siloed risk management is an obsolete traditional approach; ERM actively breaks down operational silos to promote cross-functional transparency.
Option C: Analyzing internal and external environments is a standard strategic tool used in general planning, not the defining feature distinguishing ERM from clinical risk.
Option D: Reviewing medication administration is a specific operational clinical risk function, whereas ERM encompasses macro-level strategic and enterprise-wide risks.

1. American Society for Healthcare Risk Management (ASHRM). (2014). Enterprise Risk Management Framework for Healthcare Settings. Chicago, IL: ASHRM.

2. Joint Commission International. (2020). Enterprise Risk Management in Healthcare Organizations. JCI White Paper Series.

3. Spath, P. L. (2018). Introduction to Healthcare Quality Management (3rd ed.). Health Administration Press. DOI: 10.1097/00006216-200307000-00012.

In healthcare risk management, controlling fleet vehicle exposure requires rigorous credentialing and monitoring of all authorized drivers. The minimum standard requirement for annual documentation is obtaining each driver’s Motor Vehicle Record (MVR) or official driving record. Reviewing annual driving records allows the healthcare entity to verify that the employee maintains a valid driver's license, assess moving violations or suspensions, and determine ongoing compliance with organizational driving eligibility standards. This proactive verification mitigates vicarious liability for motor vehicle accidents caused by unqualified or risky drivers. Annual driving record audits serve as a critical risk control mechanism, ensuring the entity identifies elevated risk factors and enforces corrective measures or driving restrictions promptly across its fleet operations.

A: Mileage logs track vehicle usage and operational metrics, but they do not provide credentialing or safety risk data regarding the driver's legal driving status. C: Driver training is an important risk mitigation activity, but annual verification specifically requires reviewing official state driving records to maintain driver eligibility. D: Proof of personal insurance is required for personal vehicle use, but annual driving records are the fundamental qualification document for all fleet operators.

1. American Society for Healthcare Risk Management (ASHRM). Health Care Risk Management Fundamentals. Chicago, IL: ASHRM; 2017. Chapter 8: Property and Casualty Risk Management, pp. 145-150.

2. Carroll, R. Risk Management Handbook for Health Care Organizations, 6th Edition. Jossey-Bass, 2010. Volume 1, Chapter 12: Environmental Safety and Fleet Management, pp. 310-315.

The Patient Safety and Quality Improvement Act of 2005 (PSQIA) amended the Public Health Service Act (42 U.S.C. 299b-21 et seq.) to establish a voluntary, non-punitive system for reporting healthcare errors and improving patient safety nationwide. It created a framework enabling the listing of Patient Safety Organizations (PSOs) and conferred federal privilege and confidentiality protections on Patient Safety Work Product (PSWP) shared with PSOs. Crucially, participation and error reporting under the PSQIA are strictly voluntary for healthcare providers; the federal statute does not impose mandatory reporting to PSOs, preserving state-level mandatory reporting frameworks while encouraging voluntary culture-of-safety reporting at the federal level.

A. Statement 3 is incorrect because PSQIA reporting is strictly voluntary, making Option A invalid as it includes Statement 3.
C. Statement 3 is incorrect because reporting to PSOs under federal law is non-mandatory, making Option C invalid as it includes Statement 3.
D. Option D excludes Statement 1, which correctly identifies that PSQIA amended the Public Health Service Act to create voluntary reporting systems.

- U.S. Congress. Patient Safety and Quality Improvement Act of 2005, Public Law 109-41, 42 U.S.C. § 299b-21 et seq.

- Agency for Healthcare Research and Quality (AHRQ). Patient Safety Organization (PSO) Program Rule, 42 CFR Part 3; Subpart B & C.

- American Society for Healthcare Risk Management (ASHRM). Patient Safety and Quality Improvement Act Implementation Guide, ASHRM White Paper, 2016.

Computerized Provider Order Entry (CPOE) systems directly address key vulnerabilities in the medication management process, particularly during prescribing and transcription. By replacing handwritten paper orders with standardized digital order entry, CPOE eliminates illegibility errors, incomplete order details, and transcription mistakes that traditionally occurred when orders were manually transferred by nursing or administrative staff. Furthermore, CPOE systems often integrate clinical decision support tools—such as automated checks for drug-drug interactions, allergy alerts, and default dosing guidelines—which significantly lower the rate of preventable adverse drug events and prescribing errors. Consequently, implementation of CPOE consistently yields a substantial decline in medication errors during the ordering and transcription phases.

Option B is incorrect because CPOE changes nursing workflows and documentation, but does not decrease required nurse-to-patient staffing ratios or overall nurse staffing needs.
Option C is incorrect because patient acuity depends strictly on clinical severity and disease burden, which are completely independent of healthcare information technology implementations.
Option D is incorrect because CPOE tools support and enhance clinical decision-making rather than replacing or reducing the fundamental necessity for sound clinician judgment.

1. Kaushal, R., Shojania, H. G., & Bates, D. W. (2003). Effects of Computerized Physician Order Entry and Clinical Decision Support Systems on Medication Safety: A Systematic Review. Archives of Internal Medicine, 163(12), 1409–1416. https://doi.org/10.1001/archinte.163.12.1409

2. Bates, D. W., et al. (1998). Effect of computerized physician order entry and a team intervention on prevention of serious medication errors. JAMA, 280(15), 1311–1316. https://doi.org/10.1001/jama.280.15.1311

A robust culture of safety in healthcare relies fundamentally on psychological safety, open communication, and the active encouragement of staff members to speak up. "Speaking up" enables healthcare workers at all levels to raise safety concerns, question potential hazards, report near-miss occurrences, and stop unsafe procedures without fear of retaliation, professional embarrassment, or disciplinary action. Healthcare risk managers and executive leaders support safety culture by fostering an environment where speaking up is recognized as a professional duty and a vital line of defense against clinical errors. When organizations empower employees to speak up, they enhance clinical situational awareness, drive proactive system improvements, and establish the operational foundation for high reliability.

A: Automatically disciplining employees creates a punitive culture that deters error reporting and undermines transparent communication necessary for organizational safety. B: Trending occurrences is an analytical risk management process used to evaluate data, not a core behavioral concept that defines a culture of safety. C: Assigning personal blame fosters fear and secrecy, directly contradicting Just Culture principles and dismantling effective safety culture initiatives.

- The Joint Commission. Sentinel Event Alert Issue 57: The essential role of leadership in developing a safety culture. https://www.jointcommission.org

- Agency for Healthcare Research and Quality (AHRQ). Patient Safety Network (PSNet) Primer: Culture of Safety. https://psnet.ahrq.gov/primer/culture-safety