Certified Healthcare Protection Administrator Exam — Questions and Answers

Question 1: A hospital is designing a new pediatric wing and wants to incorporate Crime Prevention Through Environmental Design (CPTED) principles. Which of the following best represents the application of 'Natural Surveillance' in this context?

Requiring all visitors to wear a color-coded badge.
Installing high-security locks on all nursery doors.
Positioning the nurses' station in the center of the unit with clear sightlines to all room entrances and play areas. (Correct answer)
Placing large, decorative boulders to block vehicle access to the main entrance.

Correct answer: Positioning the nurses' station in the center of the unit with clear sightlines to all room entrances and play areas.

Natural surveillance, a core principle of CPTED, focuses on designing spaces to maximize visibility. Placing the nurses' station centrally with unobstructed views allows staff to passively monitor the area, deterring potential threats by increasing the perception of being watched.

Question 2: Which of the following BEST describes 'lateral violence' in the healthcare workplace?

Physical altercations that happen in hospital hallways
Violence committed by patients against nurses on the same floor
Violence that occurs in adjacent or neighboring facilities
Hostile or aggressive behavior between peers at the same organizational level, such as nurse-to-nurse bullying (Correct answer)

Correct answer: Hostile or aggressive behavior between peers at the same organizational level, such as nurse-to-nurse bullying

Lateral violence refers to hostile or aggressive behavior between peers at the same organizational level, such as bullying or harassment among nurses, and is recognized as a significant workplace violence concern.

Question 3: A security supervisor is reviewing incident reports and notices a recurring pattern of aggressive behavior in the emergency department waiting area during peak hours. From a risk management perspective, what is the most appropriate NEXT step?

Post new signs warning that aggressive behavior is prohibited.
Recommend that all aggressive patients be immediately removed by police.
Request a budget increase for more security officers.
Initiate a risk assessment to identify the contributing factors and potential mitigation strategies. (Correct answer)

Correct answer: Initiate a risk assessment to identify the contributing factors and potential mitigation strategies.

Identifying a trend is the first step. The next logical step in a risk management process is to conduct a formal risk assessment. This involves analyzing the situation to understand the root causes (e.g., long wait times, lack of communication, environmental factors) and then developing appropriate strategies to mitigate the risk, which might include changes in staffing, processes, or the physical environment.

Question 4: A large, non-violent protest is taking place on the public sidewalk directly in front of the hospital's main entrance. What is the security department's primary objective in managing this situation?

Ensure unimpeded access for patients, staff, and emergency vehicles. (Correct answer)
Disperse the protestors to clear the area in front of the hospital.
Monitor protestors for any violations of the law to make arrests.
Engage with protest leaders to debate the topic of their protest.

Correct answer: Ensure unimpeded access for patients, staff, and emergency vehicles.

While monitoring the protest for safety is important, the absolute priority for healthcare security is to maintain the hospital's core mission and operations. This means ensuring that patient access to care, staff ability to report to work, and the flow of emergency vehicles are not obstructed by the demonstration.

Question 5: Which of the following is NOT a true statement about customers' perceptions of their experience?

Interaction can only be perceived by words stated. (Correct answer)
Interaction is affected by body language
Interaction is affected by all of your actions
Interaction is subject to personal interpretation

Correct answer: Interaction can only be perceived by words stated.

Customers' perceptions of their experience are complex and influenced by many factors, not just spoken words. Interaction is highly subjective, affected by body language, tone of voice, and all actions taken by the service provider. Therefore, stating that interaction can *only* be perceived by words is false, as non-verbal cues and overall behavior play a significant role.

Question 6: Which of the following is NOT one of the classifications of healthcare organizations in Chapter one?

Government-supported.
Individual healthcare. (Correct answer)
Propriety or for-profit.
Not-for-profit

Correct answer: Individual healthcare.

Healthcare organizations are typically classified based on their ownership and operational model, such as proprietary (for-profit), not-for-profit, or government-supported facilities. 'Individual healthcare' is not a standard classification for the organizational structure of healthcare facilities themselves, but rather refers to the care provided to an individual patient.

Question 7: Which federal agency publishes guidelines specifically addressing workplace violence prevention in healthcare and social service settings?

FEMA
OSHA (Correct answer)
DEA
CMS

Correct answer: OSHA

OSHA (Occupational Safety and Health Administration) publishes guidelines for preventing workplace violence for healthcare and social service workers.

Question 8: A patient arrives at the Emergency Department after a chemical spill nearby, complaining of skin irritation and difficulty breathing. Their clothes are visibly damp. What is the most critical immediate action for hospital staff to take?

Obtain a detailed medical history and list of allergies from the patient.
Contact the hospital's public relations department for a media statement.
Immediately triage the patient and move them to a standard treatment room.
Isolate the patient and begin the decontamination process in a designated area. (Correct answer)

Correct answer: Isolate the patient and begin the decontamination process in a designated area.

The primary goal when a chemically contaminated patient arrives is to prevent the spread of contamination to staff, other patients, and the facility itself. Isolating the patient and initiating the decontamination process is crucial to remove the hazardous substance, thus protecting healthcare providers and ensuring the hospital can remain operational.

Question 9: Which of the following is NOT a risk issue for healthcare?

Mostly female staff
High percentage of technical and professional staff. (Correct answer)
Drug are used and stored in the facility.
Publicly accessible and many doors must remain open.

Correct answer: High percentage of technical and professional staff.

While a high percentage of technical and professional staff is characteristic of healthcare, it is generally considered an asset, not a direct security risk issue. Factors like the presence of drugs, a predominantly female staff (potentially vulnerable), and public accessibility with many open doors are recognized security vulnerabilities that require specific mitigation strategies.

Question 10: Under the IAHSS Healthcare Security Industry Guidelines, a 'Behavioral Emergency Response Team' (BERT) is primarily responsible for:

Coordinating disaster evacuations during natural disasters
Responding to and de-escalating behavioral health crises to prevent violence (Correct answer)
Managing cybersecurity threats to patient data
Providing financial counseling to patients in distress

Correct answer: Responding to and de-escalating behavioral health crises to prevent violence

A Behavioral Emergency Response Team (BERT) is trained specifically to respond to and de-escalate behavioral health crises, reducing reliance on physical restraint and preventing violence.

Question 11: A security officer is posted at a busy emergency department entrance when a news reporter asks for the condition of a patient reportedly transported from a high-profile car accident. What is the officer's most appropriate response according to HIPAA regulations?

Confirm the patient's presence but decline to provide their condition.
Check the patient directory and, if the patient has not opted out, provide their one-word condition.
Request that the reporter have a seat and ask the charge nurse to provide an update.
State "I cannot confirm or deny that any specific patient is in our care" and refer the reporter to the hospital's Public Information Officer. (Correct answer)

Correct answer: State "I cannot confirm or deny that any specific patient is in our care" and refer the reporter to the hospital's Public Information Officer.

According to HIPAA, confirming or denying a patient's presence without their prior authorization is a violation of their privacy, especially to the media. The correct protocol is to neither confirm nor deny the patient's presence and to direct all media inquiries to the designated hospital spokesperson, typically the Public Information Officer or Media Relations department.

Question 12: Which environmental design strategy is MOST effective at reducing workplace violence risk in emergency departments?

Implementing controlled access and security checkpoints at entry points (Correct answer)
Reducing lighting in patient hallways
Installing vending machines near waiting areas
Allowing unrestricted visitor access to all areas

Correct answer: Implementing controlled access and security checkpoints at entry points

Controlled access and security checkpoints at entry points limit unauthorized individuals from entering clinical areas, significantly reducing the potential for violent incidents.

Question 13: How should friendships and inter-personal relationships between security officers and staff members from other department be treated?

Encouraged, but security staff educated about ethics and avoiding favoritism (Correct answer)
Discouraged
Encouraged
Encouraged but monitored

Correct answer: Encouraged, but security staff educated about ethics and avoiding favoritism

Positive inter-personal relationships among staff can foster a collaborative and supportive work environment, which is beneficial for overall facility operations and security. However, it's crucial for security personnel to be educated on ethics and the importance of avoiding favoritism to ensure impartiality and maintain professional integrity in their duties.

Question 14: When planning video surveillance for a hospital pharmacy to prevent drug diversion, which of the following is the MOST critical view to capture?

A wide shot of the public prescription drop-off and pickup counter.
A camera focused on the main entrance and exit of the pharmacy.
A view of the cash register and any co-pay transaction areas.
A clear view of all areas where controlled substances are stored, prepared, dispensed, and wasted. (Correct answer)

Correct answer: A clear view of all areas where controlled substances are stored, prepared, dispensed, and wasted.

To comply with DEA regulations and best practices for preventing internal drug diversion, it is most critical to have comprehensive video coverage of the entire chain of custody for controlled substances. This includes storage (safes), preparation/compounding areas, and dispensing/wasting stations, as these are the points of highest risk for theft by insiders.

Question 15: Which of the following may union members NOT do during picketing?

Carry signs
Block entrances to the building (Correct answer)
Congregate outside the facility.
Protest management decisions

Correct answer: Block entrances to the building

During picketing, union members have the right to carry signs, protest management decisions, and congregate outside a facility to express their views. However, they are legally prohibited from blocking entrances to the building. This restriction ensures that business operations are not unduly obstructed and that individuals can access the premises safely.

Question 16: Which of the following is a primary objective of the 'Mitigation' phase in the four phases of emergency management for a healthcare facility?

Installing hurricane-resistant windows on a coastal hospital to reduce potential storm damage. (Correct answer)
Conducting drills and training staff on emergency procedures.
Restoring essential services and resuming normal operations after a disaster.
Activating the emergency operations plan and mobilizing first responders.

Correct answer: Installing hurricane-resistant windows on a coastal hospital to reduce potential storm damage.

Mitigation involves actions taken to prevent or reduce the cause, impact, and consequences of disasters. Installing hurricane-resistant windows is a structural change designed to lessen the potential damage from a future event, which is a core concept of mitigation. The other options correspond to Preparedness (training), Recovery (restoring services), and Response (activating the plan).

Question 17: Which of the following is a key component of a healthcare facility's Emergency Management plan?

The hospital's marketing and public relations strategy.
A list of preferred vendors for cafeteria supplies.
The schedule for routine maintenance of non-critical equipment.
Procedures for interacting with local law enforcement and other first responders during a crisis. (Correct answer)

Correct answer: Procedures for interacting with local law enforcement and other first responders during a crisis.

An effective Emergency Management plan must include clear protocols for collaboration and communication with external agencies, such as police, fire, and emergency medical services (EMS). This ensures a coordinated and efficient response to a large-scale emergency or disaster. While other options are part of hospital operations, they are not foundational components of the emergency response plan itself.

Question 18: Which of the following is NOT one of the three powerful, personal reasons to provide great customer service?

More job satisfaction
Trying to impress your supervisor (Correct answer)
Less stress and hassle
More job success

Correct answer: Trying to impress your supervisor

Providing great customer service offers several personal benefits, such as increased job satisfaction, reduced stress and hassle, and greater job success. While impressing a supervisor might be a secondary outcome, it is not considered one of the primary, intrinsic personal reasons for delivering excellent service. The core motivations are typically centered on personal well-being and professional achievement.

Question 19: A hospital is located in an area with a high risk of prolonged power outages due to winter storms. According to The Joint Commission and NFPA standards, the hospital's emergency management plan must address its ability to be self-sufficient for a specific duration. This planning framework requires the hospital to be able to sustain itself for at least:

72 hours
96 hours (Correct answer)
24 hours
48 hours

Correct answer: 96 hours

The Joint Commission standards require hospitals to have plans in place for managing resources and assets to remain self-sufficient during an emergency. The 96-hour timeframe is the established benchmark used to evaluate a hospital's capability to operate without external support, ensuring they can sustain operations and care for patients for this period.

Question 20: A security officer responds to a fire alarm in a patient care area. Upon arrival, the officer sees smoke but no visible flames. Following the 'RACE' protocol, what is the officer's immediate priority?

Rescue anyone in immediate danger. (Correct answer)
Attempt to extinguish the fire using the nearest fire extinguisher.
Activate the nearest manual fire alarm pull station.
Close all doors to the area to confine the smoke.

Correct answer: Rescue anyone in immediate danger.

The 'RACE' acronym stands for Rescue, Alarm, Confine, Extinguish/Evacuate. The absolute first priority in any fire situation is to rescue anyone who is in immediate danger from the fire or smoke. After ensuring human life is safe, the subsequent steps of activating the alarm (if not already done), confining the fire by closing doors, and then attempting to extinguish (if safe and trained to do so) can be taken.

Question 21: Which of the following is an example of an 'administrative control' to prevent workplace violence in a hospital?

Adding security cameras to patient rooms
Implementing a buddy system policy for staff working in high-risk areas after hours (Correct answer)
Building a secure vestibule at the main entrance
Installing panic buttons at nursing stations

Correct answer: Implementing a buddy system policy for staff working in high-risk areas after hours

Implementing a buddy system policy is an administrative control — a policy or procedural change designed to reduce risk — as opposed to physical or engineering controls.

Question 22: An employee reports receiving repeated threatening text messages from a former coworker. This situation BEST represents which type of workplace violence?

Type IV - Personal Relationship
Type II - Customer/Client
Type III - Worker-on-Worker (Correct answer)
Type I - Criminal Intent

Correct answer: Type III - Worker-on-Worker

Type III workplace violence is worker-on-worker violence, which includes threats or acts of violence between current or former employees.

Question 23: A healthcare facility is training its staff on active assailant response using the "Avoid, Deny, Defend" model. In the context of the "Deny" phase, which of the following actions is most appropriate?

Confronting the assailant as a group to overwhelm them.
Evacuating the building through the nearest safe exit.
Locking and barricading a door to prevent the assailant's entry. (Correct answer)
Calling 911 to provide real-time information to law enforcement.

Correct answer: Locking and barricading a door to prevent the assailant's entry.

The "Deny" phase (analogous to "Hide" in other models) focuses on making it as difficult as possible for an assailant to access potential victims. This involves creating physical barriers by locking and barricading doors, which denies the attacker access to your location.

Question 24: According to The Joint Commission (TJC) standards for the Environment of Care (EC), a hospital's security management plan must be evaluated at least:

Annually (Correct answer)
Biennially (every two years)
Quarterly
Every three years

Correct answer: Annually

The Joint Commission requires that the written security management plan be evaluated at least annually. This evaluation helps ensure the plan remains current, relevant, and effective in addressing the organization's security risks.

Question 25: During a security patrol of a newly renovated behavioral health unit, an officer notices that the patient room doors are equipped with standard lever-style handles. From a patient safety and compliance perspective, why is this a significant concern?

They are more difficult to clean and sanitize than traditional doorknobs.
The handles can be easily broken, creating a security breach.
Lever handles are not compliant with the Americans with Disabilities Act (ADA).
They present a significant ligature risk for patients who are at risk of self-harm. (Correct answer)

Correct answer: They present a significant ligature risk for patients who are at risk of self-harm.

Regulatory and accrediting bodies like CMS and The Joint Commission place a high emphasis on creating a "ligature-resistant" environment in behavioral health settings to prevent patient self-harm. Standard lever-style door handles are considered a significant ligature point. While other options might be minor concerns, the immediate life-safety risk of ligature is the primary compliance issue.

Question 26: What role does 'psychological first aid' play in a post-incident workplace violence response?

It replaces the need for formal law enforcement reports
It refers to training staff in self-defense techniques
It is used to determine criminal liability of the perpetrator
It provides immediate emotional and psychological support to those affected (Correct answer)

Correct answer: It provides immediate emotional and psychological support to those affected

Psychological first aid provides immediate emotional and psychological support to staff, patients, and witnesses affected by a violent incident to promote recovery.

Question 27: Which of the following scenarios best describes an effective integration between a hospital's Access Control System (ACS) and its Video Surveillance (CCTV) system?

Requiring security staff to review video footage each time a new access card is created.
Placing a surveillance camera in the IT room where the ACS server is located.
Running the wiring for both the ACS and CCTV systems in the same conduit to save installation costs.
When a "door forced open" alarm is triggered in the ACS, the system automatically displays the live video feed from the nearest camera on the security operator's screen. (Correct answer)

Correct answer: When a "door forced open" alarm is triggered in the ACS, the system automatically displays the live video feed from the nearest camera on the security operator's screen.

Effective integration allows one system to trigger an automated, intelligent action in another. Linking an ACS alarm event to automatically call up the relevant camera provides immediate visual verification of the event, dramatically improving the security operator's situational awareness and ability to respond appropriately.

Question 28: During a facility-wide evacuation due to a bomb threat, the Security Officer's primary responsibility at a designated evacuation assembly point is to:

Direct media personnel to the Public Information Officer.
Assist with medical triage for individuals with minor injuries.
Secure the perimeter to prevent unauthorized re-entry. (Correct answer)
Help account for all evacuated staff, patients, and visitors.

Correct answer: Secure the perimeter to prevent unauthorized re-entry.

While all other tasks may be necessary parts of the overall response, the primary role for security at an assembly point is to establish and maintain a secure perimeter. This prevents individuals from prematurely or unsafely re-entering the building before it has been cleared and ensures the accountability process can occur in a controlled environment.

Question 29: Which legislation requires certain healthcare employers in California to establish and maintain a workplace violence prevention plan?

The Joint Commission Standard EC.02.01.01
SB 1299 (Correct answer)
EMTALA
HIPAA Security Rule

Correct answer: SB 1299

California SB 1299 (effective 2019) requires certain healthcare employers to establish and maintain workplace violence prevention plans specific to their settings.

Question 30: A security manager is tasked with chairing a new, multidisciplinary workplace violence prevention committee. According to IAHSS guidelines, which of the following is a critical first step for this committee?

Conducting a comprehensive worksite analysis to identify hazards. (Correct answer)
Drafting a zero-tolerance policy statement for the employee handbook.
Scheduling de-escalation training for all hospital employees.
Purchasing new panic alarm hardware for high-risk areas.

Correct answer: Conducting a comprehensive worksite analysis to identify hazards.

IAHSS guidelines emphasize a structured approach to workplace violence prevention, which starts with worksite analysis. This involves systematically identifying and assessing potential hazards and risks for violence before implementing specific controls like training, policies, or hardware. This analysis forms the basis for all other prevention efforts.

Question 31: What is the significance of a 'zero tolerance' policy for workplace violence in healthcare settings?

It means patients can be immediately discharged for any aggressive behavior
It requires all staff to physically intervene in any violent situation
It establishes that no level of violence or threatening behavior is acceptable and will result in consistent consequences (Correct answer)
It prohibits all visitors from entering the facility

Correct answer: It establishes that no level of violence or threatening behavior is acceptable and will result in consistent consequences

A zero tolerance policy establishes that no level of violence or threatening behavior is acceptable and that consistent consequences will be applied, which sets clear expectations and supports a culture of safety.

Question 32: A healthcare facility experiences an unexpected patient death unrelated to the natural course of the patient's illness. According to The Joint Commission, how is this event classified?

A sentinel event (Correct answer)
An operational failure
A critical incident
A standard medical error

Correct answer: A sentinel event

The Joint Commission defines a sentinel event as an unexpected occurrence involving death or serious physical or psychological injury, or the risk thereof. Such events are called 'sentinel' because they signal the need for immediate investigation and response. An unanticipated death not related to the patient's underlying condition fits this definition precisely.

Question 33: A hospital's emergency management team gathers in a conference room to discuss their response to a simulated earthquake scenario. They review the emergency plan and talk through their roles and responsibilities without deploying any actual resources or personnel. According to the Homeland Security Exercise and Evaluation Program (HSEEP), what type of exercise is being conducted?

Drill
Functional Exercise
Full-Scale Exercise
Tabletop Exercise (Correct answer)

Correct answer: Tabletop Exercise

A Tabletop Exercise (TTX) involves key personnel discussing simulated scenarios in an informal setting. It is a discussion-based exercise designed to assess plans, policies, and procedures without the deployment of resources, which perfectly describes the scenario.

Question 34: Which of the following is the definition of a customer?

Anyone with whom you interact (Correct answer)
Non-paying external customer
Internal customer
External paying customer

Correct answer: Anyone with whom you interact

In a comprehensive service context, a 'customer' is broadly defined as anyone with whom you interact, whether they are external paying clients, non-paying visitors, or internal colleagues. This inclusive definition emphasizes that everyone deserves a high level of service and respect. It recognizes that all interactions contribute to the overall organizational environment and success.

Question 35: A hospital security director is implementing a proactive risk management strategy. Which of the following activities is the BEST example of a proactive approach?

Interviewing staff after a patient assault to determine the cause.
Conducting a Failure Mode and Effects Analysis (FMEA) on the infant abduction prevention system. (Correct answer)
Disciplining a security officer who failed to follow a post order.
Updating the incident report form to capture more data.

Correct answer: Conducting a Failure Mode and Effects Analysis (FMEA) on the infant abduction prevention system.

Failure Mode and Effects Analysis (FMEA) is a proactive risk assessment tool used to identify potential failures in a process before they occur. Interviewing staff after an event, updating forms, and disciplinary actions are all reactive measures taken in response to an incident that has already happened.

Question 36: During a mass casualty incident, a hospital activates its Hospital Incident Command System (HICS). The individual responsible for overall incident management, setting objectives, and approving the Incident Action Plan (IAP) is the:

Liaison Officer
Incident Commander (Correct answer)
Public Information Officer
Operations Section Chief

Correct answer: Incident Commander

Within the HICS structure, the Incident Commander has the ultimate responsibility for all activities related to the incident. This includes setting the overall strategy and objectives, managing the command staff, and approving the Incident Action Plan that guides the response for each operational period.

Question 37: When documenting a workplace violence incident, which piece of information is MOST critical to include in the initial report?

A detailed account of the sequence of events, actions taken, and parties involved (Correct answer)
The personal medical history of the perpetrator
The financial cost of any property damage only
The name of the supervisor on duty during normal business hours

Correct answer: A detailed account of the sequence of events, actions taken, and parties involved

A detailed account of the sequence of events, actions taken, and parties involved is the most critical information, as it forms the foundation for investigation, trend analysis, and legal proceedings.

Question 38: A security director is developing the annual operating budget for the healthcare security department. Which of the following is considered a capital expense rather than an operational expense?

Annual maintenance contract for the access control system.
Replacement of officer uniform patches and insignia.
Overtime pay for security officers covering special events.
The purchase and installation of a new, facility-wide infant protection system. (Correct answer)

Correct answer: The purchase and installation of a new, facility-wide infant protection system.

Capital expenses are major purchases of physical assets that will be used for more than one year. A new infant protection system is a significant, long-term asset. Operational expenses, such as overtime, maintenance contracts, and uniform supplies, are the day-to-day costs of running the department.

Question 39: An officer is the first to respond to a clinical area where a disgruntled individual has taken a nurse hostage, is displaying a weapon, and is shouting demands. What is the security officer's most critical immediate priority in this situation?

Isolate and contain the incident area, and notify law enforcement. (Correct answer)
Enter the room and attempt to disarm the individual.
Attempt to negotiate with the hostage-taker to de-escalate the situation.
Activate the fire alarm to trigger a hospital-wide evacuation.

Correct answer: Isolate and contain the incident area, and notify law enforcement.

The primary role of the first responding healthcare security officer in a hostage situation is not to engage or negotiate, but to contain the threat to prevent it from spreading, protect others by limiting access to the area, and provide critical information to responding law enforcement who are trained for tactical resolution.

Question 40: Which of the following is a key component of an effective healthcare threat management program, according to IAHSS guidelines?

A policy that relies exclusively on law enforcement response.
A zero-tolerance policy that mandates immediate patient discharge for any verbal threat.
Limiting threat awareness training to only security and clinical leadership.
The formation of a multidisciplinary Threat Assessment and Management (TAM) team. (Correct answer)

Correct answer: The formation of a multidisciplinary Threat Assessment and Management (TAM) team.

IAHSS guidelines emphasize the importance of creating a multidisciplinary Threat Assessment and Management (TAM) Team. This team, composed of experts from departments like security, legal, human resources, and clinical services, is responsible for managing threats systematically.

Question 41: According to IAHSS guidelines, which Type of workplace violence involves violence directed at employees by patients or their families?

Type I - Criminal Intent
Type III - Worker-on-Worker
Type II - Customer/Client (Correct answer)
Type IV - Personal Relationship

Correct answer: Type II - Customer/Client

Type II workplace violence involves violence directed at employees by patients, clients, customers, or their families, which is the most common type in healthcare settings.

Question 42: As a security manager, you become aware that a security officer, who was hired a year ago after a clear background check, has recently been charged with assault during an off-duty incident. The officer has not yet been convicted. From a risk management perspective, which legal doctrine is most critical for the manager to consider when deciding on the officer's continued employment status?

Negligent hiring
Respondeat superior
Vicarious liability
Negligent retention (Correct answer)

Correct answer: Negligent retention

Negligent retention occurs when an employer becomes aware that an employee may be unfit for duty, creating a risk to others, but fails to take appropriate action. Since the manager now has new information about the officer's potential for violence, keeping the officer in their current role without any action could expose the facility to liability if a future on-duty incident occurs. Negligent hiring applies to the initial hiring process, which was properly conducted in this scenario.

Question 43: Which of the following is NOT a common technique to use while providing good customer service?

Acknowledge the customer's needs
Provide alternatives
Use inappropriate body language (Correct answer)
Say thank you

Correct answer: Use inappropriate body language

Common techniques for providing good customer service include acknowledging needs, offering alternatives, and expressing gratitude. Using inappropriate body language, such as slouching, crossing arms defensively, or avoiding eye contact, is detrimental to customer service. Positive body language is crucial for conveying attentiveness, respect, and a willingness to help.

Question 44: In the patient- and family-centered care philosophy, who determines which individuals are part of patient's family?

Patient's parents or legal guardians.
Attending physician
Nursing staff
The patient, provided he or she is development ally mature and competent to do so. (Correct answer)

Correct answer: The patient, provided he or she is development ally mature and competent to do so.

In a patient- and family-centered care philosophy, the patient's autonomy and preferences are prioritized. Therefore, a competent and mature patient has the right to define who constitutes their 'family' and who they wish to involve in their care and decision-making process, respecting their personal relationships and support system.

Question 45: What does the acronym 'STAMP' stand for in the context of healthcare workplace violence risk assessment?

Staring, Tone, Agitation, Movement, Pace of speech
Suspicious, Threatening, Agitated, Moving, Pointing
Staring, Tone, Anxiety, Mumbling, Pacing (Correct answer)
Stabbing, Threatening, Alarming, Menacing, Pushing

Correct answer: Staring, Tone, Anxiety, Mumbling, Pacing

STAMP stands for Staring, Tone, Anxiety, Mumbling, and Pacing — behavioral cues that may indicate an escalating patient or visitor who could become violent.

Question 46: Which of the following does NOT help the security uniform communicate an appropriate message to the public?

Clean uniform
Wearing the uniform shirt outside of the trousers (Correct answer)
Well cared for uniform
Shined footwear

Correct answer: Wearing the uniform shirt outside of the trousers

A security uniform is designed to convey professionalism, authority, and trustworthiness. Wearing the uniform shirt outside of the trousers typically presents a disheveled or unprofessional appearance, undermining the intended message of competence and order. A clean, well-cared-for, and properly worn uniform, including shined footwear, contributes to a positive and authoritative image.

Question 47: A 'Code Green' is announced for an elderly patient with dementia, who is a known elopement risk, missing from a third-floor unit. What should be the security officer's immediate priority upon receiving this information?

Initiate a rapid, systematic search of the patient's unit and adjacent areas, including unoccupied rooms and stairwells. (Correct answer)
Immediately begin reviewing CCTV footage from the past hour to trace the patient's movements.
Interview the patient's roommate and family members to determine potential destinations.
Secure all exterior exit doors and monitor the main hospital egress points.

Correct answer: Initiate a rapid, systematic search of the patient's unit and adjacent areas, including unoccupied rooms and stairwells.

In an elopement event, time is critical, and the highest probability is that the patient is still on or near their unit. The immediate priority is a rapid and systematic search of the immediate vicinity (the unit, adjacent stairwells, lounges, etc.) in coordination with clinical staff. Securing exits and reviewing video are crucial secondary steps, but an immediate physical search of the most probable area is the first action to take.

Question 48: What should the most primary overriding concern of any security department be?

Its image
The goals and mission of the entity
The safety and well-being of anyone in the facility (Correct answer)
Cost-effectiveness.

Correct answer: The safety and well-being of anyone in the facility

The paramount concern for any healthcare security department is the protection of life and safety. This includes patients, visitors, staff, and anyone else within the facility. All security measures, policies, and operations should prioritize ensuring a safe and secure environment for everyone present.

Question 49: According to the International Association for Healthcare Security and Safety (IAHSS), a layered security approach is a fundamental concept. Which layer of protection focuses on segregating authorized visitors from unauthorized individuals once they are inside the building?

Property Perimeter
Staff-Only Area Restriction
Building Perimeter
Department/Unit Access Control (Correct answer)

Correct answer: Department/Unit Access Control

The IAHSS defines five layers of protection. The third layer specifically addresses the management of people inside the facility by separating authorized and unauthorized visitors. This is often accomplished through visitor management systems, designated waiting areas, and escort policies, which fall under the broader category of department or unit access control.

Question 50: In healthcare risk management, risks are often categorized to ensure a comprehensive assessment. Which category would the risk of a cyberattack on the hospital's patient record system fall under?

Clinical Risk
Operational Risk (Correct answer)
Reputational Risk
Financial Risk

Correct answer: Operational Risk

Operational risks are vulnerabilities that could disrupt core systems, potentially causing downtime or delays in patient care. A cyberattack on the electronic health record system directly impacts the hospital's ability to function and deliver care, making it a primary operational risk. While it also has financial and reputational implications, its fundamental nature is operational.

Question 51: A hospital is experiencing a series of thefts from vehicles in its multi-level parking garage at night. From a Crime Prevention Through Environmental Design (CPTED) perspective, which of the following actions would be the MOST effective long-term strategy?

Installing a gate that requires an employee badge for entry after business hours.
Increasing the frequency of random security vehicle patrols.
Posting additional signs disclaiming liability for stolen items.
Upgrading lighting to eliminate dark areas and improving the quality of video surveillance coverage. (Correct answer)

Correct answer: Upgrading lighting to eliminate dark areas and improving the quality of video surveillance coverage.

The correct answer aligns with the core CPTED principle of 'Natural Surveillance,' which focuses on designing environments where people and activities can be easily observed. Upgrading lighting and improving video surveillance increases the potential for observation, making criminals feel more visible and thus deterring criminal activity more effectively and consistently than intermittent patrols or access restrictions that don't apply to all users.

Question 52: According to IAHSS guidelines and industry data, which area of a hospital is typically at the highest risk for workplace violence?

The surgical operating suites.
The cafeteria during peak hours.
The administrative offices.
The emergency department. (Correct answer)

Correct answer: The emergency department.

Numerous studies and reports, including data referenced by IAHSS, consistently identify the emergency department (ED) as the location with the highest frequency of workplace violence incidents in healthcare. This is due to a combination of factors including high-stress situations, long wait times, and the presence of individuals under the influence or experiencing behavioral health crises.

Question 53: A healthcare facility is experiencing thefts of personal items from a staff locker room. The current access method is a simple keyed lock on the main door. Which of the following access control upgrades would provide the best improvement in security and accountability?

Upgrading to a high-security, pick-resistant mechanical lock.
Implementing an electronic access control system with card readers and audit trails. (Correct answer)
Posting a security guard outside the locker room 24/7.
Installing a louder alarm on the door.

Correct answer: Implementing an electronic access control system with card readers and audit trails.

An electronic access control system with card readers provides a significant upgrade. It not only restricts access to authorized individuals but also creates an audit trail, logging every entry attempt. This data is invaluable for investigating incidents and serves as a strong deterrent.

Question 54: A healthcare security officer notices a visitor becoming increasingly agitated and using threatening language. What is the BEST initial de-escalation technique?

Physically restrain the individual as a precaution
Immediately call law enforcement
Use a calm voice and active listening to acknowledge concerns (Correct answer)
Ignore the behavior and continue normal duties

Correct answer: Use a calm voice and active listening to acknowledge concerns

Using a calm voice and active listening to acknowledge concerns is the best initial de-escalation technique, as it can reduce tension before the situation escalates further.

Question 55: Which of the following is a key security procedure when managing a patient who is in the custody of law enforcement (a forensic patient)?

Using the patient's full name and custody status on signage outside the room for clear identification.
Insisting that clinical staff make all decisions regarding the use of mechanical restraints.
Conducting a security search of the patient's room for potential weapons or contraband upon arrival. (Correct answer)
Allowing the law enforcement officer to store their firearm in the patient's bedside table for safety.

Correct answer: Conducting a security search of the patient's room for potential weapons or contraband upon arrival.

Before a forensic patient occupies a room, a thorough search by security is essential to ensure no weapons or contraband have been hidden that could be used to harm staff, aid in an escape, or cause self-harm. This is a critical proactive security measure in a high-risk situation.

Question 56: Following a major flood that causes a prolonged power outage, a hospital activates its Continuity of Operations Plan (COOP). What is the primary goal of the COOP?

To coordinate the volunteer response from the local community.
To provide a detailed report of the incident to The Joint Commission.
To immediately begin construction and repair of damaged facilities.
To ensure the performance of essential business and clinical functions can be continued with minimal disruption. (Correct answer)

Correct answer: To ensure the performance of essential business and clinical functions can be continued with minimal disruption.

A Continuity of Operations Plan (COOP) is specifically designed to ensure that a healthcare organization can continue to perform its essential functions during and after a wide range of emergencies. It outlines the procedures and resources needed to maintain critical services, such as patient care and vital support operations.

Question 57: Security uses senior management to build what kind of program?

Strong and simple
A program that works in a small part of the facility
Generally effective
Strong and effective (Correct answer)

Correct answer: Strong and effective

Security departments rely on senior management support to establish a robust and efficient security program. Senior management's backing provides the necessary resources, authority, and organizational commitment to implement comprehensive security policies, technologies, and training, ensuring the program is both strong in its measures and effective in its outcomes.

Question 58: Which of the following allows a department asses its cost-effectiveness within an organization?

Evaluation surveys
Risk assessments
Bench-marketing (Correct answer)
Crime analysis

Correct answer: Bench-marketing

Benchmarking involves comparing a department's performance metrics, costs, and processes against those of similar departments in other organizations or industry best practices. This comparison allows the security department to assess its efficiency, identify areas for improvement, and determine its cost-effectiveness relative to established standards.

Question 59: Which of the following are skills a security professional should have and use at all times?

All of the above (Correct answer)
Good observation skills
Good communication skills
Tolerance

Correct answer: All of the above

A security professional requires a combination of skills to be effective. Good observation skills are vital for identifying potential threats, communication skills are essential for interacting with diverse individuals and de-escalating situations, and tolerance is necessary for maintaining professionalism and impartiality in a varied environment. Therefore, all these skills are crucial.

Question 60: The 'Triad of Violence' in healthcare settings refers to which three contributing factors?

Lighting, staffing levels, and access control failures
Patient, visitor, and staff interactions
Mental illness, substance abuse, and criminal history
Physical environment, organizational culture, and individual risk factors (Correct answer)

Correct answer: Physical environment, organizational culture, and individual risk factors

The Triad of Violence refers to the physical environment, organizational culture, and individual risk factors as the three primary contributing factors to workplace violence in healthcare.

Question 61: A comprehensive security risk assessment for a healthcare facility analyzes three primary components to determine the level of risk for a specific asset or area. Which of the following correctly identifies these three components?

Access Control, Video Surveillance, and Alarms
Incidents, Accidents, and Audits
Threat, Vulnerability, and Impact (Correct answer)
Policies, Procedures, and Staffing

Correct answer: Threat, Vulnerability, and Impact

The standard formula for a security risk assessment involves evaluating the relationship between Threat (a potential event or aggressor), Vulnerability (a weakness that can be exploited), and Impact (the severity of loss or damage if the threat is realized). The other options list controls, data sources, or security systems, not the core components of the risk calculation itself.

Question 62: What is the relationship between employees and management sometimes called?

Family interaction
Tense conversation
Confidentiality
Employee relations (Correct answer)

Correct answer: Employee relations

The relationship between employees and management is commonly referred to as employee relations. This term encompasses the various interactions, policies, and practices that define how an organization manages its workforce. Effective employee relations are vital for fostering a positive work environment and ensuring smooth operations.

Question 63: Which of the following behaviors is considered a 'proximal warning sign' of imminent workplace violence?

A visitor asking multiple questions about hospital procedures
A patient clenching fists and invading the personal space of staff (Correct answer)
A family member expressing frustration about wait times in writing
An employee consistently arriving late to work

Correct answer: A patient clenching fists and invading the personal space of staff

Clenching fists and invading personal space are proximal warning signs of imminent violence, indicating immediate threat potential that requires immediate intervention.

Question 64: When handling a telephoned bomb threat, which of the following is the most crucial action for the person receiving the call to take?

Immediately hang up and call 911.
Announce a "Code Red" over the public address system.
Keep the caller on the line as long as possible and gather information using a checklist. (Correct answer)
Transfer the call directly to the security director's office.

Correct answer: Keep the caller on the line as long as possible and gather information using a checklist.

Standard bomb threat protocols emphasize keeping the caller on the line to gather as much intelligence as possible. Using a pre-established bomb threat checklist helps the recipient ask for key details (location, time, type of bomb) and note background noises or voice characteristics, which is vital for assessing the threat's credibility.

Question 65: A security manager needs to enhance key control for highly sensitive areas such as the pharmacy vault and research laboratories to prevent unauthorized duplication. Which type of mechanical keying system offers the highest level of protection against this specific risk?

A patented and restricted key system. (Correct answer)
An interchangeable core system that allows for rapid re-keying.
A master key system that allows for tiered levels of access.
A system using standard keys with "Do Not Duplicate" stamped on them.

Correct answer: A patented and restricted key system.

Patented and restricted key systems provide the highest level of mechanical key control because the key blanks are legally protected from unauthorized manufacturing and distribution. Duplicates can only be made by an authorized dealer with explicit permission from the system owner, effectively preventing employees from making copies at a local hardware store.

Question 66: A hospital security director wants to measure the effectiveness of the workplace violence prevention program. Which metric is MOST useful?

Total number of visitors per month
Number of security staff trained in CPR annually
Incident rate of violent events per 100 full-time equivalent employees (Correct answer)
Average patient satisfaction score

Correct answer: Incident rate of violent events per 100 full-time equivalent employees

The incident rate of violent events per 100 FTE employees is the most useful metric, as it allows standardized comparison over time and across departments.

Question 67: Which of the following is usually at the top of the organizational chart?

Board of Directors (Correct answer)
Department leaders
Assistant administrators
Vice presidents.

Correct answer: Board of Directors

In most organizational structures, especially for corporations and non-profits like healthcare facilities, the Board of Directors holds the highest authority. They are responsible for overall governance, strategic direction, and oversight of the organization, sitting above the executive leadership and various departments.

Question 68: Which of the following is considered a primary strategy for preventing infant abductions in a healthcare setting?

Relying solely on an electronic infant security tag system to alert staff of a potential abduction.
Using a combination of controlled access, staff training, and a patient/infant identification system. (Correct answer)
Stationing a security officer at the main entrance of the hospital 24/7.
Limiting the number of visitors each patient can have in the maternity unit.

Correct answer: Using a combination of controlled access, staff training, and a patient/infant identification system.

A comprehensive infant abduction prevention program relies on a multi-layered approach. This includes controlling access to maternity and neonatal units, providing thorough training for all staff to recognize suspicious behavior, and implementing a robust identification system (e.g., matching bracelets for infant and parents). Relying on a single measure, such as only an electronic tag or a single security post, creates vulnerabilities that can be exploited.

Question 69: According to IAHSS, which healthcare unit consistently reports the HIGHEST rates of workplace violence against staff?

Administrative offices
Hospital cafeterias
Medical records departments
Emergency departments and psychiatric units (Correct answer)

Correct answer: Emergency departments and psychiatric units

Emergency departments and psychiatric units consistently report the highest rates of workplace violence due to high-stress situations, patients in crisis, and unpredictable behaviors.

Question 70: What is the primary function of an 'anti-passback' feature in a modern electronic access control system?

It prevents a single credential from being used for entry twice in a row without first being used for an official exit. (Correct answer)
It requires two different users to present their credentials simultaneously to unlock a high-security door.
It automatically deactivates a credential after it has been used a pre-set number of times in one day.
It prevents a door from being propped open by sounding an immediate local alarm.

Correct answer: It prevents a single credential from being used for entry twice in a row without first being used for an official exit.

Anti-passback is a security feature that creates a required sequence of use for a credential (IN then OUT). Its main purpose is to prevent an authorized person from badging in and then passing their credential back to an unauthorized person to use for a second, fraudulent entry.

Question 71: When developing a security plan for a high-profile person (VIP) receiving care at the hospital, what is a critical initial step for the security leader?

Issue a press release detailing the VIP's condition and location.
Assign a single unarmed officer to stand outside the VIP's room.
Relocate all other patients from the hospital wing where the VIP is located.
Conduct a threat assessment and liaise with the VIP's protective detail and external law enforcement. (Correct answer)

Correct answer: Conduct a threat assessment and liaise with the VIP's protective detail and external law enforcement.

A comprehensive VIP protection plan begins with understanding the specific threats against the individual. This requires a thorough threat assessment and close collaboration with the VIP's own security team (if any) and local/federal law enforcement agencies to share intelligence and coordinate a layered security response.

Question 72: Which of the following is NOT an example of undesirable behavior and demeanor in a security officer?

Impoliteness
Bad attitude
Dishonesty
Confidence (Correct answer)

Correct answer: Confidence

Undesirable behaviors for a security officer include bad attitude, dishonesty, and impoliteness, as these undermine trust and professionalism. Confidence, however, is a desirable trait, indicating competence and self-assurance. A confident officer can better handle challenging situations and project authority, which are crucial for effective security work.

Question 73: A healthcare security leader wants to demonstrate the effectiveness and efficiency of their department to the hospital's executive team. Which of the following is the most effective Key Performance Indicator (KPI) to measure the security team's immediate responsiveness?

Cost of security operations per square foot.
Number of security incidents reported per month.
Percentage of staff completing annual security training.
Average time to respond to duress alarm activations. (Correct answer)

Correct answer: Average time to respond to duress alarm activations.

Average response time to alarms is a direct measure of the security team's efficiency and ability to react swiftly to potential emergencies. While the other options are valuable metrics for overall program management, they do not specifically measure the immediate, tactical responsiveness of the security force.

Question 74: A nurse in the behavioral health unit discreetly presses a button on their ID badge, which sends a silent alarm to the security operations center with their precise location. What type of electronic security device is this?

A glass break detector.
A motion detection sensor.
A personal duress alarm. (Correct answer)
A door prop alarm sensor.

Correct answer: A personal duress alarm.

A personal duress alarm is a device, often wearable, that allows an individual to discreetly summon immediate assistance when facing a personal safety threat, without escalating the situation. This is distinct from alarms that monitor physical spaces or infrastructure.

Question 75: Why are vendors potentially a high security risk to a healthcare facility?

Vendors often have access to sensitive areas yet staff of the healthcare organization may know very little about vendor's background. (Correct answer)
Vendors may be bringing in high-demand products that could be targeted for theft.
Competing vendors may clash at a facility
Vendors typically drive large vehicles that can conceal large amounts of stolen property or contraband.

Correct answer: Vendors often have access to sensitive areas yet staff of the healthcare organization may know very little about vendor's background.

Vendors frequently require access to various parts of a healthcare facility, including sensitive areas like operating rooms, pharmacies, or data centers, to perform their services. The risk arises because the facility may not have thoroughly vetted these individuals, making them potential vectors for theft, security breaches, or other illicit activities due to their unsupervised access.

Question 76: When a security leader collaborates with architects and facilities planners on the design of a new emergency department, they are primarily engaging in which security strategy?

Key performance indicator (KPI) development
Crime Prevention Through Environmental Design (CPTED) (Correct answer)
Contingency planning and business continuity
Incident Command System (ICS) implementation

Correct answer: Crime Prevention Through Environmental Design (CPTED)

Crime Prevention Through Environmental Design (CPTED) is a multi-disciplinary approach to deterring criminal behavior through physical design. By working with designers, the security leader can influence factors like natural surveillance (lines of sight), access control, and territorial reinforcement to build security into the environment from the start.

Question 77: Which of the following is a key responsibility of a healthcare facility under the OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)?

Annually testing all security officers for bloodborne pathogens regardless of exposure incidents.
Administering mandatory Hepatitis B vaccinations to all security officers upon hiring.
Maintaining the official OSHA 300 Log exclusively for security-related injuries.
Providing and ensuring the use of personal protective equipment (PPE) for officers who may be exposed to body fluids. (Correct answer)

Correct answer: Providing and ensuring the use of personal protective equipment (PPE) for officers who may be exposed to body fluids.

The OSHA Bloodborne Pathogens Standard requires employers to protect workers with occupational exposure by providing, at no cost, appropriate personal protective equipment (PPE) such as gloves, gowns, and masks. While Hepatitis B vaccination must be offered, it is not mandatory for the employee to accept. Testing is done post-exposure, not annually for all, and the OSHA 300 log is typically a facility-wide responsibility.

Question 78: A security officer discovers a significant chemical spill in the hospital's main laboratory. After ensuring the immediate area is clear and notifying their supervisor, what standardized emergency code would most likely be announced overhead?

Code Orange (Correct answer)
Code Red
Code Gray
Code Black

Correct answer: Code Orange

While emergency codes can vary, 'Code Orange' is widely used to indicate a hazardous material spill or release. This code mobilizes a specialized response team to contain and decontaminate the area safely. Code Red typically means fire, Code Gray a combative person, and Code Black a bomb threat.

Question 79: A security officer at a hospital's emergency department entrance is tasked with preventing unauthorized access after visiting hours. The main sliding glass doors must remain closed but allow for emergency egress and authorized entry. Which type of lock is best suited for this high-traffic, controlled environment?

An electromagnetic lock integrated with an access control system. (Correct answer)
A standard deadbolt lock.
A delayed egress magnetic lock.
A chain and padlock.

Correct answer: An electromagnetic lock integrated with an access control system.

An electromagnetic lock (maglock) integrated with an access control system is ideal. It can keep the doors securely locked while allowing authorized staff to enter using a card reader or keypad. It can also be integrated with the fire alarm system for safe egress during an emergency and can be released by security personnel for specific entries.

Question 80: According to IAHSS guidelines, which element is ESSENTIAL for a successful workplace violence training program for healthcare staff?

Online-only training modules with no hands-on component
Scenario-based training that includes recognition, reporting, and de-escalation skills (Correct answer)
Training focused exclusively on physical restraint techniques
Annual mandatory training limited to new employees only

Correct answer: Scenario-based training that includes recognition, reporting, and de-escalation skills

Scenario-based training that incorporates recognition, reporting, and de-escalation skills ensures staff are prepared for real-world situations, making it the most effective approach per IAHSS guidelines.

Question 81: A healthcare facility's emergency operations plan (EOP) is required by The Joint Commission to be based on an 'all-hazards' approach. Which of the following best describes this approach?

Focusing solely on the most likely disaster scenario identified in the Hazard Vulnerability Analysis (HVA).
Prioritizing response plans for external disasters over internal facility emergencies.
Creating a single, scalable, and flexible plan to manage various types of emergencies and disasters. (Correct answer)
Developing specific plans for every conceivable natural and man-made disaster.

Correct answer: Creating a single, scalable, and flexible plan to manage various types of emergencies and disasters.

The 'all-hazards' approach focuses on building a comprehensive emergency management program that can address a wide range of potential hazards, both natural and man-made. Instead of creating a separate plan for every possible scenario, it establishes a flexible and scalable framework with common functions (like communication, resource management, and safety) that can be adapted to any emergency.

Question 82: What is the primary purpose of a Threat Assessment Team (TAT) in a healthcare organization?

To conduct criminal investigations on behalf of law enforcement
To discipline employees who report incidents
To train security staff in firearm use
To evaluate and manage credible threats of violence before they escalate (Correct answer)

Correct answer: To evaluate and manage credible threats of violence before they escalate

A Threat Assessment Team evaluates and manages credible threats of violence before they escalate, using a multidisciplinary approach to mitigate risks proactively.

Question 83: The National Incident Management System (NIMS) provides a consistent, nationwide framework for incident management. Why is NIMS adoption important for healthcare organizations?

It is primarily for federal agencies and has little impact on individual hospitals.
It replaces the need for a hospital-specific Emergency Operations Plan.
It enables seamless integration and interoperability with external response agencies like police, fire, and EMS. (Correct answer)
It mandates the specific type of security uniforms to be worn during a crisis.

Correct answer: It enables seamless integration and interoperability with external response agencies like police, fire, and EMS.

NIMS was developed to provide a common framework for all levels of government, the private sector, and non-governmental organizations to work together during domestic incidents. For hospitals, adopting NIMS ensures they use the same terminology, command structures (like ICS), and procedures as their community partners, leading to a more effective and coordinated response.

Question 84: A healthcare security manager is conducting a post-incident review after a violent event in the ED. What is the PRIMARY goal of this review?

To satisfy media inquiries about the incident
To assign blame to the staff members who were present
To determine whether the security officer's response was fast enough
To identify contributing factors and implement corrective actions to prevent recurrence (Correct answer)

Correct answer: To identify contributing factors and implement corrective actions to prevent recurrence

The primary goal of a post-incident review is to identify contributing factors and implement corrective actions to prevent recurrence, focusing on system improvement rather than individual blame.

Question 85: Which of the following statements best describes employees?

Contracted persons
Medical staff contracted by the facility.
Volunteers who donate their time
All staff directly employed by the facility (Correct answer)

Correct answer: All staff directly employed by the facility

Employees are individuals who are directly hired and paid by the healthcare facility, working under its direct supervision and control. This distinguishes them from contracted staff, volunteers, or medical staff who may have different employment or affiliation arrangements.

Question 86: When security is requested to assist clinical staff with a patient who requires physical restraints, what is the security officer's primary role?

To document the incident in the patient's medical record.
To determine the type of restraint that should be used.
To make the final decision on when the restraints can be removed.
To provide support and control under the direction and supervision of qualified clinical staff. (Correct answer)

Correct answer: To provide support and control under the direction and supervision of qualified clinical staff.

The security officer's role in patient restraint is to support the clinical team. The decision to restrain, the type of restraint used, and the duration are all clinical decisions. Security's function is to assist in safely controlling the patient, acting under the direct supervision of the clinical staff who are responsible for the patient's care and safety.

Question 87: Which of the following is not an example of an external costumer?

Patients
Employees (Correct answer)
Regulatory Agencies
Vendors

Correct answer: Employees

External customers are individuals or entities outside the immediate organization who receive its services or products. Patients, vendors, and regulatory agencies fit this description. Employees, however, are considered internal customers because they are part of the organization and rely on other departments or colleagues for resources and support to perform their jobs.

Question 88: Which of the following describes the main objective of good customer service?

To make the customer think no one cares about the concern raised by the customer
To help the customer see that someone tried, even though the customer's wants were not met.
To help the customer walk away with a neutral feeling
To make the customer walk away with a positive feeling (Correct answer)

Correct answer: To make the customer walk away with a positive feeling

The main objective of good customer service is to ensure the customer leaves with a positive feeling about their experience. This goes beyond simply addressing their immediate need; it aims to create satisfaction, build loyalty, and foster a favorable impression of the organization. A positive feeling encourages repeat business and positive word-of-mouth.

Question 89: A hospital is activating its Hospital Incident Command System (HICS) in response to a mass casualty event. Which of the following represents the five core management functions established under HICS?

Assessment, Triage, Treatment, Transport, and Communication
Mitigation, Preparedness, Response, and Recovery
Security, Media Relations, Patient Care, Facilities, and Staffing
Command, Operations, Planning, Logistics, and Finance/Administration (Correct answer)

Correct answer: Command, Operations, Planning, Logistics, and Finance/Administration

The Hospital Incident Command System (HICS) is built around five major management functions: Command (sets objectives and priorities), Operations (conducts the tactical response), Planning (collects and evaluates information), Logistics (provides resources and services), and Finance/Administration (monitors costs and provides accounting support).

Question 90: Following a serious security breach in the pharmacy, the hospital's risk management team initiates a Root Cause Analysis (RCA). What is the primary focus of this analysis?

Determining the financial impact of the breach.
Assigning blame to the individuals responsible for the error.
Identifying and correcting underlying system-level vulnerabilities. (Correct answer)
Immediately reporting the event to law enforcement.

Correct answer: Identifying and correcting underlying system-level vulnerabilities.

The primary goal of a Root Cause Analysis (RCA) is to move beyond individual errors and identify the underlying systemic problems that allowed an adverse event to occur. The focus is on prevention by fixing the system, not on blaming individuals.

Question 91: When a forensic patient (an individual in law enforcement custody) is receiving treatment in the hospital, who holds the primary responsibility for preventing the patient's escape?

The hospital security department, which assumes custody upon the patient's admission.
The law enforcement agency that has the patient in custody. (Correct answer)
The attending clinical staff, who have direct control over the patient's care.
A joint responsibility shared equally between hospital security and the law enforcement agency.

Correct answer: The law enforcement agency that has the patient in custody.

The legal custody of a forensic patient remains with the escorting law enforcement agency. While hospital security has a critical role in collaboration and overall site safety, the primary responsibility for custody and prevention of escape rests with the law enforcement officers. Hospital security assists but does not assume legal custody.

Question 92: A healthcare security officer is conducting a routine patrol in the emergency department and observes a visitor who is becoming increasingly agitated, pacing, and speaking loudly to a nurse. What is the most appropriate initial action for the officer to take?

Approach the individual using a calm, non-threatening posture and attempt verbal de-escalation. (Correct answer)
Alert the nursing staff and ask them to handle the situation as it is a clinical issue.
Immediately attempt to physically restrain the visitor to prevent escalation.
Contact local law enforcement for immediate backup before taking any other action.

Correct answer: Approach the individual using a calm, non-threatening posture and attempt verbal de-escalation.

The most appropriate initial action is to use verbal de-escalation techniques. This approach is the least confrontational and often the most effective way to resolve a situation before it becomes violent, ensuring the safety of staff, patients, and the individual. Physical restraint should only be a last resort when a clear and present danger exists. While involving clinical staff is important, security has a primary role in managing escalating behavior. Calling law enforcement is premature unless de-escalation fails or a direct threat is made.

Question 93: Which of the following is a primary goal of a comprehensive Visitor Management System (VMS) in a healthcare setting, according to IAHSS principles?

To increase the speed of visitor check-in above all other considerations.
To replace the need for security officers at public entrances. (Correct answer)
To identify, badge, and track every individual entering the facility to enhance the safety of patients, staff, and visitors.
To generate revenue by charging for visitor badges.

Correct answer: To replace the need for security officers at public entrances.

A comprehensive VMS is a critical component of access control. Its main purpose is to ensure that every visitor is identified, issued a temporary badge, and tracked while in the facility. This helps prevent unauthorized access to sensitive areas and provides a record of who is in the building at any given time, significantly enhancing overall safety.

Question 94: A hospital's Emergency Operations Plan (EOP) should be based on an "all-hazards" approach. What is the main principle of this approach?

The plan is developed solely by federal emergency management agencies to ensure national standardization.
The plan focuses exclusively on the most likely disaster, such as a hurricane in a coastal area.
The plan prioritizes response to external disasters over internal incidents.
The plan addresses general operational functions that are common to most types of emergencies, rather than creating separate plans for every possible scenario. (Correct answer)

Correct answer: The plan addresses general operational functions that are common to most types of emergencies, rather than creating separate plans for every possible scenario.

The 'all-hazards' approach is a cornerstone of modern emergency management. It involves planning for the functions and capabilities that are critical in any emergency, regardless of the cause (e.g., communication, resource management, evacuation). This creates a flexible and scalable plan that can be adapted to various incidents, from natural disasters to human-caused events.

Question 95: Under IAHSS standards, what is a key component of a Workplace Violence Prevention Program (WVPP)?

Prohibition of any security cameras in patient areas
Regular risk assessments to identify hazards and vulnerabilities (Correct answer)
Restricting incident reporting to senior administration only
Mandatory weapons training for all clinical staff

Correct answer: Regular risk assessments to identify hazards and vulnerabilities

Regular risk assessments to identify hazards and vulnerabilities are a key component of a WVPP, enabling organizations to proactively address potential threats.

Question 96: During a security vulnerability assessment for a new hospital wing, the IAHSS security design guidelines are consulted. The pharmacy is identified as a highly sensitive area requiring stringent access control. Which security measure would be most appropriate for the primary entrance to the pharmacy?

A dual-authentication access control system requiring a card swipe and a PIN or biometric scan. (Correct answer)
A motion-activated camera without any door lock.
A simple privacy lock that can be opened from the inside without a key.
An open-door policy during business hours to improve workflow.

Correct answer: A dual-authentication access control system requiring a card swipe and a PIN or biometric scan.

Pharmacies are considered highly sensitive areas due to the presence of controlled substances. IAHSS guidelines recommend robust access control for such locations. Dual-authentication (requiring two different forms of verification) provides a higher level of security than a single card swipe, ensuring that only specifically authorized individuals can gain access.

Certified Healthcare Protection Administrator Exam

The CHPA exam is IAHSS' highest-level certification for healthcare security professionals with management responsibilities. It covers security leadership, physical and electronic security, emergency preparedness, workplace violence prevention, and investigation management in healthcare facilities.

220

Questions

180 min

Time Limit

76%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds