Health Care Risk Management

Course Description

HSA4502 – Health Care Risk Management is a 3-credit upper-division course on identifying, evaluating, and reducing the risks a health care organization faces — clinical, financial, legal, and reputational. Daytona State College titles it Healthcare Risk Management.

In most states this would be a useful elective. In Florida it maps onto a licensed occupation. Florida law requires every licensed hospital and certain other facilities to operate an internal risk management program and to employ a licensed health care risk manager — a credential issued by the state, with its own qualification requirements. That makes this course an unusually direct line from classroom to a specific Florida career. See Special Information.

Content covers risk management principles — identification, analysis, control, financing, and monitoring; the legal environment — negligence, standard of care, vicarious liability, informed consent, and medical malpractice; adverse events — identification, reporting, investigation, and root cause analysis; the relationship between risk management and quality, which are separate functions with overlapping tools; patient safety and systems thinking; claims management and the litigation process; insurance — professional liability, commercial coverage, self-insurance, and captives; credentialing and peer review; documentation and the medical record as a legal document; informed consent and disclosure of adverse outcomes; regulatory compliance — licensure, accreditation, HIPAA, and EMTALA; emergency preparedness; workplace and environmental safety; and enterprise risk management across the organization.

Offered at approximately 11 Florida institutions with bachelor's-level health services administration programs.

Learning Outcomes

Required Outcomes

• Describe the risk management process and apply it to a health care setting.
• Identify and classify the categories of risk facing a health care organization.
• Explain negligence, standard of care, and the elements of a malpractice claim.
• Describe vicarious liability and the organization's exposure for practitioner conduct.
• Describe adverse incident identification, reporting requirements, and investigation.
• Conduct a root cause analysis and develop corrective actions.
• Distinguish risk management from quality improvement and describe how they interact.
• Describe the claims process from incident through resolution.
• Describe professional liability insurance, self-insurance, and alternative risk financing.
• Describe credentialing and peer review and their role in reducing risk.
• Evaluate documentation practices and explain the medical record's evidentiary role.
• Describe informed consent requirements and the disclosure of adverse outcomes.
• Describe regulatory and accreditation requirements bearing on risk.
• Describe HIPAA and EMTALA obligations and the consequences of violation.
• Describe emergency preparedness and business continuity planning.
• Describe workplace safety and employee-related exposures.
• Develop a risk management plan component for a health care organization.
• Describe enterprise risk management and its application to health care.

Optional Outcomes

• Describe Florida health care risk manager licensure requirements.
• Describe disclosure and apology programs and their evidence base.
• Describe cybersecurity risk and health information breach response.
• Describe risk in ambulatory, long-term care, and behavioral health settings.
• Describe telehealth risk considerations.
• Describe the economics of malpractice and tort reform debates.

Major Topics

Required Topics

• Risk management fundamentals — the process, terminology, and the risk manager's role.
• Risk identification — incident reports, occurrence screening, claims data, and rounds.
• Risk analysis — frequency, severity, and prioritization.
• Legal foundations — negligence, duty, breach, causation, and damages.
• Malpractice — the claim, defenses, expert testimony, and standard of care.
• Vicarious and corporate liability — employees, contractors, and apparent agency.
• Adverse incidents — definition, internal reporting, and state reporting duties.
• Sentinel events and root cause analysis — process and corrective action.
• Failure mode and effects analysis — proactive risk reduction.
• Risk and quality — distinct functions, shared tools, and organizational placement.
• Claims and litigation — notice, discovery, settlement, and trial.
• Insurance and risk financing — occurrence versus claims-made, retention, and captives.
• Credentialing and peer review — process and confidentiality protections.
• Documentation — charting standards, alterations, and the record in litigation.
• Informed consent and disclosure — requirements, capacity, and adverse outcome communication.
• Regulatory compliance — licensure, accreditation, HIPAA, EMTALA, and fraud and abuse.
• Emergency preparedness — planning, drills, and continuity.
• Employee and environmental safety — OSHA, workplace violence, and security.
• Enterprise risk management — strategic, operational, financial, and reputational risk.

Optional Topics

• Florida risk manager licensure and continuing education.
• Disclosure and apology programs.
• Cybersecurity and breach response.
• Risk in non-hospital settings.
• Telehealth risk.
• Malpractice economics and tort reform.

Resources & Tools

• Risk Management Handbook for Health Care Organizations (ASHRM), Wiley — the field's standard reference.
• Health Care Risk Management or Legal Aspects of Health Care Administration (Pozgar), Jones & Bartlett — common adoptions.
• ASHRM — the American Society for Health Care Risk Management; the professional body, with the CPHRM certification and student resources.
• Florida Agency for Health Care Administration (AHCA) — licenses health care risk managers and receives adverse incident reports; the operative state agency.
• Chapter 395, Florida Statutes — particularly § 395.0197 (internal risk management program) and § 395.10974 (risk manager licensure); free on Online Sunshine.
• AHRQ Patient Safety Network — free case studies and analysis.
• The Joint Commission — sentinel event policy and National Patient Safety Goals.
• CMS — EMTALA and Conditions of Participation guidance.

Career Pathways

• Health Care Risk Manager — a licensed occupation in Florida; see below.
• Patient Safety Officer — frequently combined with risk management in smaller facilities.
• Claims Analyst or Adjuster — professional liability insurers and self-insured systems.
• Compliance Officer (SOC 13-1041) — regulatory and fraud-and-abuse compliance.
• Medical and Health Services Manager (SOC 11-9111).
• Quality Improvement Coordinator — the adjacent function; see HSA4383.
• Accreditation and Regulatory Readiness Coordinator.
• Insurance underwriter or loss control consultant — health care lines.

Special Information

⚠ Florida licenses health care risk managers — this course points at a real credential

This is the most consequential thing on this page, and it distinguishes Florida from most states. Two statutes work together:

• § 395.0197, F.S. requires every licensed facility to establish an internal risk management program as an administrative function, and provides that each licensed facility shall hire a risk manager, licensed under s. 395.10974, responsible for implementing and overseeing it. The program is the responsibility of the facility's governing board.
• § 395.10974, F.S. provides that a license issued by the agency is required in order to perform as a health care risk manager in this state, and sets the qualification requirements — an applicant must demonstrate competence by education or experience in specified areas.

The licensing agency is the Agency for Health Care Administration (AHCA). Practically: Florida hospitals must employ someone holding this license, the license is obtainable through a defined education-or-experience pathway rather than a graduate degree, and the demand is created by statute rather than by market preference. For a health services administration student, that is an unusually concrete and attainable target. Students interested should look up the current qualification and application requirements directly with AHCA, since specifics are set by rule and change.

Adverse incident reporting is a Florida statutory duty with deadlines

Florida requires licensed facilities to report defined adverse incidents to AHCA on statutory timelines, in addition to any accreditation obligations. The categories and deadlines are specific, and failure to report is itself a violation. This sits on top of the federal and Joint Commission requirements a national textbook will describe, and it is the kind of detail a Florida risk manager is expected to know precisely.

Risk management and quality improvement are different jobs

They share tools — root cause analysis, FMEA, incident data — and are sometimes combined in one office, but their orientations differ. Quality improvement asks how to make care better for future patients. Risk management asks how to reduce the organization's exposure to loss, which includes patient harm but also litigation, regulatory action, property loss, and reputation. The two can point in different directions, most visibly around disclosure: the quality answer to an adverse event is transparency and learning, while the historical legal instinct was to say nothing. Modern practice has largely resolved this in favor of disclosure — the evidence indicates that honest communication with patients after harm reduces rather than increases litigation — but understanding the tension is part of understanding the field. This course pairs with HSA4383 Quality Improvement in Healthcare, which approaches the same events from the other side.

Documentation is evidence

The medical record is the primary evidence in a malpractice claim, and it is generally the deciding factor. Contemporaneous, factual, complete records defend good care; sparse or inconsistent records make defensible care look indefensible. Altering a record after an adverse event is catastrophic — it converts a defensible case into an indefensible one and can constitute a separate offense. Students should understand this concretely, because they will supervise people who document.

Certification beyond licensure

The Certified Professional in Healthcare Risk Management (CPHRM), offered through the American Hospital Association's certification center and supported by ASHRM, is the national credential. It requires qualifying experience or education and an examination. In Florida it complements rather than replaces the state license — the license is what the statute requires.

Upper-division standing

The 4000-level number means junior or senior standing and, at most institutions, admission to the bachelor's program. Prerequisites commonly include an introduction to health services administration or the U.S. health care system, and often health law or a legal aspects course. Verify locally.