Preventing Embezzlement at Your Medical Practice

When Robin Good joined Plastic Surgery Center in South Bend, Ind., four years ago, there were no internal controls in place to prevent employee theft. No audits. No division of responsibilities. No review of collections and deposits. "I immediately put in processes to cross check everything," says Good, an office administrator who previously worked for a large hospital system and is well aware of how vulnerable medical practices are to embezzlement. "I installed a new accounting system, revamped posting procedures, created spreadsheets for each procedure so we now know down to the penny how much everything costs. It was like starting over."

It's not paranoia. It's prudence. Employee theft is rampant among medical practices, primarily because most physicians assign bookkeeping responsibilities to their staff while they remain focused on patient care. At smaller groups, the person who collects copays and deductibles is often the same person who posts charges and makes bank deposits. Temptation abounds, especially when work goes unchecked.  A 2009 study by the Medical Group Management Association (MGMA) found that 83 percent of the 945 practices that responded had at some point been the victim of embezzlement.

Very few practices ever recover what was taken, says Denise McClure, a certified public accountant with Averti Fraud Solutions in Boise, Idaho, and a former medical practice administrator. "Typically, the people who embezzle spend the money," she says. "They don't put it in a savings account. They buy gifts for family or friends. They gamble it away. They tell themselves that they're just borrowing the money and that they'll pay it back, but that's an absurd rationalization."

Given the prevalence of such crimes in the healthcare setting, says Jim Arend, chief financial officer of TransforMed, a practice consulting firm in Leewood, Kan., practices should remain alert for signs that something may be amiss. That includes watching staff members - especial those handling collections, bookkeeping, and/or bank deposits - who refuse to take vacation (fearing they will be discovered by their replacement). Some even refuse promotions. It is also suspect if an employee gets defensive when you suggest that their work be independently reviewed. "That may mean they are afraid of someone looking over their shoulder," says Arend. A cluttered paper trail is another sign, he says. "If your petty cash fund is always unreconciled, there are no receipts, and the physician is having to put $100 in there every other month, that's a red flag," he says.

Where to look

There are countless opportunities for unscrupulous employees to misappropriate funds. Nearly half of the MGMA survey respondents indicated that theft occurred from cash payments - employees pocketed copays or deductibles either before or after they were recorded on the practice's books. A receptionist who takes a $30 copay from a patient, for example, can easily pocket the money and write it off as bad debt, says McClure. Such write-offs are often buried in accounts receivable among the contractual allowances from third-party payers. Employees may also write off the balances from office visits for friends or family - a less overt form of theft, but plenty costly to your practice.

Petty cash is another common target and often where stealing begins. According to Arend, embezzlers typically start small, taking $20 here and $10 there. When no one notices, they become more brazen. "Many smaller practices have drawers of money that staff members can use to buy stamps or other office supplies, and if you have more than one person who can get into petty cash, you don't know who's been in there and who took the $20," he says.

Practice owners and managers should also monitor payroll. When a physician doesn't know how much he's paying his staff, or doesn't bother to review paychecks before they are distributed, the staff person managing payroll can easily inflate her own hours, or create a paycheck for someone who doesn't work in your office - like their spouse, says Arend.

Internal controls

The most effective way to reduce the threat of embezzlement is to divide responsibilities, says Arend. The person who writes checks in your office should be different from the person who makes bank deposits, just as the person who collects cash payments at the front desk should be different from the person who reconciles accounts. Smaller practices, in which one or two employees must wear many hats, can help keep theft at bay by using an outside accounting firm to monitor their books, and by ensuring a physician owner reviews all accounts either weekly or monthly.

It's also wise to restrict the number of people who collect copays and deductibles from patients at the front desk, and ensure each staff member keeps a written record of his collections, says Arend. Assign a staff member who is not involved in collections the task of verifying that a payment and claim was processed for each patient at the end of the day.

Likewise, he says, ensure accountability by limiting the number of staff members who are authorized to access your accounting database, cut checks, and use the company credit card, so any discrepancies can be quickly traced. Insist on receipts for all withdrawals from petty cash, adds Arend, and consider having bank and credit card statements sent directly to a physician's home, where they can be verified for accuracy. According to Arend, write-offs should also be reviewed regularly by a manager and physician shareholder. "If you spot write-offs that are not approved, or deposits that don't match up with collections, that's one way to identify theft," he says.

Oh, and put the kibosh on signature stamps. They may be a time saver, but they also give morally challenged employees the wherewithal to write checks to themselves. "After they cut the check to themselves, they go in and change it in the accounting system to indicate that it went to another payee for office supplies or some other expense," says McClure, noting one of her clients, a practice with fewer than five physicians, suffered a loss of more than $1 million over five years in such a scheme. "If no one is looking at canceled checks you'll never find that." An authorized physician owner should sign each check for deposit and verify that each has an approved invoice from a legitimate vendor, she says.

When it comes to preventing employee theft, your best defense is to "trust but verify." By implementing internal controls, you'll not only help take temptation off the table, but catch any embezzlement that does occur before you lose your shirt. "We now know what copays are due every day and reports are run regularly," says Good. "Balances are reviewed. I made up all new adjustment codes. Everything is tracked with a paper trail. Physicians always think their employee would never do that to them, but that's a big mistake. I think anybody will do anything when it involves money."

Shelly K. Schwartz, a freelance writer in Maplewood, N.J., has covered personal finance, technology, and healthcare for more than 18 years. Her work has appeared on CNBC.com, CNNMoney.com, and Bankrate.com. She can be reached via editor@physicianspractice.com.

This article originally appeared in the March 2013 issue of Physicians Practice.