ASHRM CPHRM Exam Questions

In Failure Modes and Effects Analysis (FMEA), the Risk Priority Number (RPN) is commonly calculated as the product of three ratings: Severity (S) of impact, Occurrence (O) likelihood/probability, and Detection (D) ability to detect the failure before it causes harm (lower detectability increases risk). This structured scoring helps teams prioritize which failure modes deserve immediate mitigation. Risk management objectives include proactively identifying high-risk process steps (medication administration, specimen labeling, surgery scheduling), designing controls (standard work, forcing functions, redundancy), and tracking residual risk after changes. While cost and feasibility may influence selection of mitigations, they are not the core RPN elements. Using S--O--D improves transparency in prioritization, supports interdisciplinary alignment, and provides a defensible rationale for resource allocation toward patient safety improvements.

According to Health Care Risk Management standards outlined by ASHRM and the American Hospital Association Certification Center, proactive workplace violence prevention focuses on measures implemented before an incident occurs. These strategies aim to identify risks, strengthen preparedness, and reduce the likelihood or severity of violent events.

Pre-employment background screening helps identify applicants with histories that may pose safety concerns, consistent with legal hiring standards. Ongoing staff training enhances awareness of warning signs, communication skills, and reporting procedures. Leadership rounding increases visibility, supports early identification of environmental or behavioral risks, and reinforces safety culture. Active shooter drills and emergency preparedness exercises ensure that staff understand response protocols and can act effectively under stress.

Options B, C, and D primarily describe reactive or post-incident measures. Law enforcement notification, restraining orders, crisis intervention, DEA notification, documentation, and emergency command activation occur after an event has taken place or when an immediate threat is present.

Health Care Operations objectives emphasize prevention, preparedness, environmental assessment, and workforce education as foundational elements of a workplace violence program. Therefore, pre-employment screening, training, rounding, and drills represent proactive components of an effective prevention strategy.

Under Health Care Risk Management standards recognized by ASHRM and the American Hospital Association Certification Center, the Safe Medical Devices Act SMDA is part of the FDA's post market surveillance system for medical devices. The SMDA requires healthcare facilities to report to the FDA and, in some cases, to the manufacturer when a medical device has or may have caused or contributed to a patient death or serious injury. This mandatory reporting system enhances device safety monitoring and supports regulatory oversight after products enter the market.

EMTALA governs emergency medical screening and stabilization obligations, not device reporting. The Occupational Safety and Health Act focuses on workplace safety for employees rather than patient device-related injuries. Patient Safety Organizations operate under the Patient Safety and Quality Improvement Act and facilitate voluntary reporting of patient safety events, but they do not replace FDA-mandated device reporting requirements.

Legal and regulatory objectives in healthcare risk management emphasize compliance with federal reporting statutes, timely submission of required reports, and maintenance of documentation to mitigate regulatory exposure. Therefore, the Safe Medical Devices Act is the correct answer regarding mandatory FDA post market surveillance reporting for device-related deaths or injuries.

EMTALA creates federal obligations for emergency screening and stabilization/appropriate transfer when an individual presents for emergency care. CMS interpretive guidance states a hospital's EMTALA obligation ends when the individual is admitted in good faith for inpatient services (even if not stabilized), shifting responsibility to inpatient Conditions of Participation and standard malpractice frameworks. EMTALA obligations also end following stabilization or an appropriate transfer (with required documentation/acceptance). Risk management objectives include tight ED documentation, clear decision points (screening complete, EMC identified, stabilization initiated, transfer accepted), and policy training to prevent EMTALA violations (which can carry major regulatory and financial consequences). The incorrect notion that EMTALA ends when contact information is provided is not supported; discharge planning is important, but it does not terminate EMTALA duties.

RCA and systems safety models (e.g., Swiss Cheese) emphasize that adverse events typically require multiple contributing factors---small process breakdowns, latent conditions, and active failures---to align. This is why focusing only on the last person who touched the patient (''sharp end blame'') rarely prevents recurrence. Risk management objectives are to identify and strengthen defenses: policies, training, equipment design, staffing models, communication standards, and redundancy where needed. A series-of-events understanding enables targeted corrective actions (forcing functions, standardization, automation with safeguards, independent double checks for high-alert processes). It also supports just culture: accountability is preserved for reckless behavior, but most improvement comes from redesigning systems that make errors more likely. This approach improves reliability, reduces repeat harm, and provides defensible evidence of organizational learning and corrective action.