CPHRM common mistakes
CPHRM · Understand the traps and how to avoid them.
Opening every claim analysis with the clinical care question ('was the care negligent?') and never converting it into the risk question: what are the provable damages, what should the reserve be, and who must be notified by when.
Many candidates come from clinical, compliance or QA backgrounds and read claim scenarios through a quality-of-care lens because that frame is familiar; the exam tests claim handling as a financial and contractual process.
What to do instead
Before reading the options, write a three-column skeleton on the scratch pad: liability facts, damages band (low/expected/high), notice obligations. Eliminate any option that does not map to one of those three columns.
Treating 'claims-made' and 'occurrence' as labels to memorize, then mis-dating coverage when an incident and its claim straddle a policy renewal or a retroactive date.
Textbook definitions are learned in isolation, but scenario items bury the trigger question inside a timeline involving a retro date, an extended reporting period and a renewal.
What to do instead
Draw the timeline with three markers (incident date, policy period(s), claim/notice date) and apply one test: which policy was in force at the trigger date, and does a retroactive date bar it?
Judging a provider's decision by how the patient turned out and selecting the option stating the clinician 'should have' anticipated the complication.
Outcome and hindsight bias make a bad result feel like proof of a bad decision, and items deliberately present good-outcome and bad-outcome versions of the same decision to detect this.
What to do instead
Re-read the stem and ask only whether the decision was reasonable given the information available at the time. If it was, the correct option will not assign fault regardless of the outcome.
Choosing 're-educate the staff' or 'revise the policy' as the corrective action for a recurring clinical event.
Education and policy revision are the most familiar and least threatening interventions, so they read as plausible on nearly every item; they are usually distractors because they leave the conditions that produced the error intact.
What to do instead
Apply the substitution test: could a competent, well-rested person in that same workflow still make the error? If yes, the answer must be a forcing function, checklist or physical/design change, not training.
Using 'risk management' and 'quality/performance improvement' interchangeably and selecting the performance-improvement option on an item that asks for risk reduction (or the reverse).
The two functions overlap heavily in real organizations and both appear in the answer set; the discriminator is scope, trigger and who owns follow-through, not vocabulary.
What to do instead
Classify by trigger and output: risk management responds to an identified exposure and produces mitigation or transfer decisions; QI/PI works from measured variation toward improved outcomes. Match the option to the trigger named in the stem.
Assigning overall ownership of the risk management program, and of enterprise risk appetite, to the risk manager rather than to the governing body.
Candidates identify with the day-to-day program and pick the role that visibly does the work; governance accountability is a distribution-of-authority question, not a workflow question.
What to do instead
Memorize the split as a one-liner: the board sets risk appetite and is ultimately accountable; the risk manager designs, coordinates and reports; department leaders own execution in their areas.
Treating HIPAA as the ceiling on privacy obligations and choosing the HIPAA-permissive answer when a stricter state statute or a specialized federal rule governs the record.
HIPAA is the most rehearsed privacy framework and is easy to recall as 'the answer', so candidates forget it sets a national floor and that other law can be more protective.
What to do instead
Run a two-step check on every privacy item: (1) does a more stringent state law apply? (2) is this a specially protected category (substance use disorder records under 42 CFR Part 2, HIV, mental health, genetic information) that needs separate authorization?
Assuming patient safety work product is automatically privileged because the document was created during a safety investigation.
Candidates conflate peer review protection, attorney-client privilege and PSWP, and assume all three attach the moment a review begins.
What to do instead
Test the document against PSWP requirements: it must be assembled for reporting to a listed patient safety organization and must not be part of the medical record or held for another purpose. If either condition fails, treat it as discoverable.
Comparing a self-insured retention against a commercial premium on premium dollars alone, ignoring allocated loss adjustment expense, aggregate limits and the cost of capital held against the retention.
The premium 'savings' figure is the most legible number in the scenario and candidates stop computing once they find it.
What to do instead
Write the full cost line for each option before choosing: retained losses at expected value, plus ALAE, plus administrative cost, plus stop-loss/aggregate protection, plus capital cost. Compare totals, and treat any option missing a needed input as a distractor.
Recommending additional insurance purchase for an exposure the organization has deliberately chosen to retain, or misreading a deductible as transferring the whole loss rather than only the portion above the attachment point.
Buying insurance feels like the risk-averse answer, and 'retention' sounds passive rather than a defined financing structure with a specific layer and attachment point.
What to do instead
For every financing item, state first which layer is funded and which is transferred and where the attachment point sits, then select the option that matches that structure (retention buy-down, stop-loss, captive) instead of the generic 'more coverage' option.