According to the U.S. Department of Justice, internal business theft in this country totals $60 billion annually. No businesses are safe from embezzlement—not even small ones, such as the majority of medical practices.

In fact, a study conducted by the Association of Certified Fraud Examiners found that organizations with fewer than 100 employees are most likely to suffer internal fraud. Small companies tend not to have adequate control systems to prevent theft, and individuals are put into responsible positions with relatively little oversight.

One reason medical practices can be vulnerable to embezzlement is that they often have numerous cash transactions for out-of-pocket payments, copayments and deductibles. Many medical practices turn over complete control of their cash and checks to office staff, increasing the potential for internal theft.

But a medical practice can lose thousands of dollars because of just one dishonest employee. If your practice is not careful, your profitability could be jeopardized by a staff member’s falsifying records, creating fake patient accounts or conspiring with vendors.

Possibilities for embezzlement are limited only by the creativity of employees. The following are real-life examples:

• By skimming cash from patients, altering receipts and falsifying balances, a bookkeeper in a practice of six physicians siphoned off $28,000 before her employers noticed.
• A practice’s administrative assistant stole $1 million over a three-year period by creating a pool of fictitious vendors, inventing invoices for services rendered, and issuing and cashing checks.
• A staff member pocketed copayments and then discarded the encounter forms; as a result, the visits were never processed for insurance claims. Not only did the practice lose $5,000 in copays, it lost $50,000 in claims that were never submitted.

Why do employees embezzle? In most cases, they have pressing financial needs, often related to drug or gambling addiction, adultery or medical problems. Once embezzlers discover a covert way to steal money, they tend to rationalize being entitled to the funds. (Example: “I deserve a pay raise, so I’m giving myself one.”)

Frequently, no one notices that revenue is missing because the embezzler is the individual responsible for recording payments and keeping the books. Unless medical practices put a system of checks and balances in place, physicians probably won’t realize money is missing.

Procedures to Reduce the Risk
Clearly, the most important thing a physician can do to prevent theft is to be attentive. That doesn’t mean micromanaging, but it does require vigilance, awareness of office practices and the implementation of internal controls.

If you start with the premise that a good security system protects the practice itself and its employees, you’re likely to make the right changes without causing employees to feel as if Big Brother is looking over their shoulders.

When creating a security system, don’t overlook the need to prevent the least dramatic, day-to-day theft of funds. It is very unusual for someone to plan to steal, say, $100,000 from a medical office. More likely is what would seem to be a less sinister pattern of behavior: a couple of lunches paid for with petty cash, one or two copays missing, a few unauthorized uses of credit cards.

Such patterns tend to start almost inadvertently and develop imperceptibly over a period of time. Once a medical practice establishes a strong, formalized system of controls to monitor money, employees will understand that honesty is both valued and expected.

One of the most effective control measures is to make sure there is a separation of duties, so that different individuals handle and record cash. If a practice has more than one cashier, each should have a separate and lockable cash drawer to avoid the commingling of their incoming funds and the receipts they give out.

Many practices assign specific employees to open mail, prepare deposits and post receipts to the practice management system. Again, this creates valuable checks and balances in the handling of money, in that no one employee has control over revenue, expenses and inventory. Also, consider having your employees review each other’s work on occasion, or ask them to switch tasks. This ensures that no individual is the sole party responsible for handling certain types of transactions.

Since cash, incoming checks and payroll are the areas most vulnerable to theft, consider putting the following procedures in place:

• Record all transactions, including accounts payable, accounts receivable, refunds, adjustments, copayments and even write-offs.
• Reconcile receivables and charges every day.
• Issue a receipt for each transaction.
• Balance receipts every day, and have a second person verify the balance.
• Immediately stamp incoming checks “FOR DEPOSIT ONLY.”
• Retain charge sheets and explanation-of-benefit statements (EOBs) to support daily transactions.
• Periodically conduct outside audits.
• Routinely verify petty cash balances.
• Periodically review all accounting entries, rather than just totals.
• Monitor the controls you have set up.

Be cautious about giving employees signature rights. Money can be easily diverted through unauthorized expenditures, and banks usually do not question an office representative who is given check-signing authority. Also, it may not be a good idea to allow your signature to be applied to checks with the use of a rubber stamp.

Don’t Contribute to the Problem
Sometimes the office culture in a medical practice can promote internal theft. If doctors play fast and loose with the cash drawer by “borrowing” a few dollars now and then, they may unintentionally be giving others license to do the same thing. Even if the physicians later replace the cash with a personal check, and the deposit slip remains unchanged, it still sets a bad example.

Physicians often overlook the most essential protective measure for sorting out bad apples before they join the payroll: a thorough resumé check during the hiring process. Experts recommend doing a criminal background check—obtainable through state crime bureaus or private investigators—on any potential employee who will handle money or do the books.

Additionally, doctors should require employees to take a vacation every year as a matter of practice policy. If an employee resists taking vacations, that may be a warning flag in itself. Anyone who doesn’t want to take time away from the office may have a good reason—it’s difficult to maintain fraud when you’re removed from the source of income. If your practice’s financial picture changes dramatically during an employee’s absence, fraudulent activity could be the reason.

Other possible warning signs:

• employees who never ask for help to complete tasks, or who always refuse help when it is offered
• unusual relationships between employees and vendors
• employees who suddenly show signs of living beyond their means
• increased patient complaints about billing errors.

Medical practices are businesses. While there is no foolproof way to fight embezzlement, you can create an environment that discourages internal theft.