8.4 Risk Assessments for New and Existing Services

Why Proactive Assessment Sits at the Center of Domain 4

Domain 4, Health Care Operations, contributes 20 scored items to the CPHRM, and task B states it plainly: conduct risk assessments to identify exposures related to new and existing services and enterprise-wide services. Most of the rest of the exam is retrospective — an event happened, a claim arrived, a survey found a deficiency. Risk assessment is the one discipline that runs before harm, and the exam rewards candidates who recognize when a stem is asking for prospective work rather than investigation.

The scope boundary is tested just as hard as the content. The risk manager does not decide whether a service opens. The risk manager convenes the review, identifies exposures, documents them, offers mitigation options, and escalates residual risk that exceeds tolerance to the people who own the decision. Answer choices in which the risk manager "denies privileges," "vetoes the program," or "approves the new laser" exceed the role. Answer choices that say "convene a multidisciplinary review before the first case," "notify the broker of the new exposure," or "document the residual risk and take it to the risk committee" are inside it.

The New Service and New Technology Review

A new service review (also called a new technology or new program assessment) is a structured, multidisciplinary evaluation completed before a service goes live. It is triggered by more than a brand-new service line: a new procedure a surgeon learned at a weekend course, a new device, a new patient population (pediatrics in an adult facility, bariatrics, high-risk obstetrics), a new site of care, a telehealth expansion into another state, an investigational protocol, or a co-management deal with an outside group.

The review should cover, at minimum:

1. Clinical need and evidence base. Is there demonstrated volume and a body of evidence, or is this a physician-driven request in search of a market? A service with no volume cannot sustain competence.
2. Credentialing and privileging criteria. Criteria specific to the new procedure — training, case logs, proctoring, and Focused Professional Practice Evaluation (FPPE) — must be written and approved before the first case is scheduled, not retrofitted afterward. (The credentialing process itself is covered in the policy and credentialing section.)
3. Staff competency and volume thresholds. Nursing, technologists, anesthesia, and perioperative staff need documented training and a competency check-off. Where the literature supports a volume-outcome relationship, set a minimum annual case threshold for both the practitioner and the program.
4. Equipment, space, and support services. Biomedical acceptance testing, reprocessing and sterilization capability, imaging and blood bank availability, ICU and rapid-response backup, and a written rescue plan for the predictable complication.
5. Informed consent content. A novel or investigational procedure requires consent language beyond the standard form: the procedure's newness at this facility, the practitioner's experience with it, alternatives including referral elsewhere, any investigational device or Institutional Review Board (IRB) status, and disclosure of financial relationships with the device manufacturer.
6. Insurance coverage confirmation. This is the step candidates forget. A new service line may fall outside the current professional and general liability program, may require a specific endorsement, or may trigger a policy provision requiring notice of a material change in operations. Notify the broker and carrier in writing and get the confirmation before the first case.
7. Regulatory and licensure approval. State facility licensure category, certificate of need (CON) where the state requires it, CMS provider-based and enrollment rules, FDA clearance or approval status of the device, IRB approval for research, and state-specific telehealth licensure.
8. Contract review. Vendor, co-management, and joint venture agreements need indemnification language, insurance requirements with certificates of insurance and additional-insured status, a Business Associate Agreement (BAA) if protected health information moves, and a compliance and counsel review of the financial arrangement.
9. Policies, protocols, and order sets. Written before go-live, including the escalation and transfer plan.
10. Post-launch monitoring with predetermined stop criteria. Define the monitoring period, the metrics, the review interval, and — critically — the thresholds that trigger suspension. If leadership cannot state in advance what result would make them stop the program, the assessment is incomplete.

New Service Review Checklist

Choosing the Right Assessment Method

Different exposures call for different tools, and the exam tests whether you can match the method to the question.

• Failure Mode and Effects Analysis (FMEA) — a proactive, step-by-step analysis of a defined process to find failure modes before they cause harm. Use it when the question is "how could this process fail?" (Mechanics are taught in the RCA and FMEA section.)
• Gap analysis — a structured comparison of current practice against an external requirement: a regulation, an accreditation standard, a clinical practice guideline, or a contract obligation. Use it when the question is "where do we fall short of the standard?"
• Hazard Vulnerability Analysis (HVA) — prioritizes natural, technological, human, and hazardous-materials threats by probability and impact for emergency planning. (Covered in depth in the emergency preparedness section.)
• Security risk assessment — two distinct meanings. The HIPAA Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to electronic protected health information, and it must be maintained and updated, not done once. Separately, a physical security and workplace violence assessment evaluates access control, high-risk departments such as the emergency department and behavioral health, and staffing patterns.
• Infection Control Risk Assessment (ICRA) — required before construction, renovation, and maintenance work by accreditation standards and the FGI design and construction guidelines. It pairs the type of activity with the risk level of the adjacent patient population to set containment requirements, and is completed with infection prevention and facilities as a pre-construction risk assessment (PCRA) covering air quality, infection control, utilities, noise, vibration, and emergency egress.

Scoring, Registers, and Risk Appetite

Assessment without scoring produces a list nobody can act on. Most programs score each identified exposure on a likelihood x consequence matrix, then record it in a risk register.

Two scores matter for every entry. Inherent risk is the score before controls — the raw exposure. Residual risk is the score after existing and planned controls are credited. Boards and executives make decisions on residual risk; inherent risk shows how much the controls are actually buying you, which is the argument for keeping them funded.

A complete risk register entry names the exposure, the owner, the inherent score, the current controls, the residual score, the treatment decision, the action items with due dates, and the review date. Treatment decisions fall into four choices:

Risk appetite is the amount and type of risk the organization is willing to pursue in order to meet its objectives; it is set by the board and is strategic. Risk tolerance is the acceptable variation around that appetite, expressed as concrete thresholds — for example, no residual score of 15 or higher may be accepted below the executive risk committee. Thresholds are what turn a scoring exercise into a decision rule, and they define the escalation path: residual risk above tolerance moves up, not sideways.

Reassessing Existing Services

Existing services are reassessed on a cycle and on trigger. The annual enterprise-wide assessment refreshes the register, but the exam is more interested in the event-driven triggers:

• A claim or loss trend in one service line, one shift, or one practitioner group
• A sentinel event or serious safety event that reveals a system vulnerability broader than the single case
• Staffing changes — high turnover, heavy locum or agency use, loss of a subspecialist, a new residency rotation
• New technology or an EHR change, including an upgrade that alters order sets, alerts, or documentation flow
• Volume shifts in either direction; volume that falls below the competence threshold is as dangerous as volume that overwhelms capacity
• Service-line acquisition, outsourcing, or a vendor contract termination
• Regulatory change, accreditation survey findings, or repeat deficiencies
• Patient complaint and grievance themes clustering around one unit or process

Mergers, Acquisitions, Outsourcing, and Joint Ventures

These transactions carry exposures that ordinary operations do not, and the risk manager belongs on the due-diligence team.

In an acquisition, examine open claims and their reserves, known events not yet reported, litigation and regulatory history, any corporate integrity agreement or open survey, credentialing and licensure files for practitioners who will come across, malpractice history, and the state of the target's policies and event reporting system. The dominant risk-financing question is prior acts: an acquiring organization's occurrence policy does not cover incidents that happened before the entity became an insured, and a claims-made program requires either tail (extended reporting) coverage or prior-acts (nose) coverage for those exposures. Confirm coverage in writing before closing, not after the first demand letter arrives.

Outsourced and joint-ventured services — hospitalists, emergency physicians, anesthesia, radiology reads, dialysis, laboratory, environmental services — raise a distinct question: whose liability is it? The contract should set indemnification, insurance minimums with certificates and notice of cancellation, who credentials and who monitors quality, whose policies apply, and how events are reported to the hospital. But the contract does not settle patient perception. Under apparent (ostensible) agency, a hospital can be held liable for a contractor's negligence when the patient reasonably believed the practitioner was a hospital employee — an exposure that badging, signage, and consent-form language can reduce but not eliminate.

Scenario

An orthopedic group wants to begin same-day outpatient total joint replacement in the hospital's attached ambulatory surgery center, with the first case in six weeks. The right move is not to approve or refuse. The risk manager convenes a new-service review, and within two meetings the team surfaces four exposures: the ASC has no overnight capability and no written transfer agreement for the patient who cannot be discharged; the anesthesia group's contract predates the ASC and does not name it as a covered site; patient selection criteria excluding higher-risk comorbidities have not been written; and the professional liability program was underwritten without outpatient arthroplasty in the exposure schedule. The risk manager documents each exposure with an inherent and residual score, obtains a carrier endorsement, drafts transfer and selection protocols with the medical director, and takes one residual item — the anesthesia contract gap — to the executive risk committee because it exceeds tolerance. The launch is delayed four weeks. That delay is the deliverable.

Exam Traps

• Confusing reactive with proactive. RCA follows harm. Risk assessment precedes it. A stem describing a service that has not yet launched is not asking for an RCA.
• Skipping the insurance step. New services and acquisitions can fall outside the current program. Notifying the broker and carrier is a tested step, and it is the one candidates omit.
• Exceeding scope. The risk manager identifies, documents, advises, and escalates. Approving, denying, and disciplining belong to medical staff leadership, executives, and the governing body.
• Treating a signed contract as risk elimination. Contractual transfer moves financial consequence; apparent agency and reputational exposure remain.
• Launching without stop criteria. A monitoring plan with no predefined threshold for suspension is not a monitoring plan.
• Assuming a certificate of insurance is continuing proof. It documents coverage on the day it is issued; require notice of cancellation and re-verify at renewal.