Most physician practice owners we work tell us they believe it is very unlikely that any employee would steal from them. But when you consider that an MGMA study found that 83% of members had worked in a practice where embezzling had occurred, it seems quite probable that some of those physicians will eventually employ a thief (or would-be thief) — and that some don’t realize they are being stolen from right now.
Embezzling is easily missed by physicians and administrators for many reasons. One of the most common is that honest people, people who tend to respect protocols and rules, don’t always consider the possibility that others don’t share their boundaries. Physicians and practice managers who use a CPA to handle accounting and/or bookkeeping may assume those professionals can spot embezzlement, even though the tracks are almost certainly well-hidden in details that aren’t part of a CPA’s calculations (and usually aren’t even accessible to them). The modern medical practice embezzler can also be an extremely creative thinker. We’ve worked with practices where the owners believed that embezzling couldn’t happen in their practice because they don’t accept cash or because the payroll and accounts payable aren’t handled by any employee — but physicians and administrators would be astounded (as we are) by the number of schemes that can tap into any flow of money in or out of the practice. New schemes are also constantly being devised by clever, determined thieves.
Of course, for physician owners, another huge obstacle is the fact that most of their time is focused on patient care. This leaves less time and less energy for business details. Doctors need to trust people to manage most administrative matters for them. Unfortunately, embezzlers take advantage of that trust, often presenting themselves as the most loyal, hard-working employees in the practice, cultivating a “halo” that helps them get away with their crimes. Administrators and practice managers, the most trusted individuals in the practice, are generally among the employees with the most opportunity to steal, if they are so inclined. In some cases, physicians are even victimized and betrayed by their own partners.
There is no perfect vaccine to inoculate you and your practice against embezzlement. But there are steps you can take to reduce your risk and minimize the time it takes to spot theft in your practice, including:
- Set up internal controls*. Internal controls are operational policies that make it easier for you to track and verify financial transactions and, more important, make it harder for would-be criminals to steal. For example, today’s practice management systems can generate transaction receipts that automatically attach to patients’ financial records, yet some practices still use hand-written receipts, which are much easier to tamper with. Similarly, EFT can get your practice paid faster and reduce manual processing and potential loss or diversion of checks — yet we still often see practices with key insurers not paying electronically. A payment portal and email statements also allows patient payments to go directly to your bank account; you’ll get paid faster and make it harder for those monies to end up in the wrong hands.
- Stay involved. If you’re the owner of the practice, you may find it burdensome to engage with the business side of things. Find the time. It’s too important not to. Remember, this is your money and it’s also the life-blood of your practice. Staying involved doesn’t mean micromanaging; it means making your presence felt, making it clear that you intend to protect your business. If your practice is small, have credit card and bank statements sent to you personally. At least occasionally, check the path of money coming into your practice through to your bank. Make sure everyone in the practice understands you have not abdicated responsibility for the finances of the practice. If you’re an administrator or manager, be sure your behavior emphasizes that you respect internal controls and want to involve your practice owners in the finances of the practice. With respect to employees with access to a stream of practice payments, owners and managers should adopt a “trust but verify” attitude that helps deter thieves without demotivating honest employees.
- Keep your eyes open and listen to your gut. Even when their schemes are hard to detect, embezzlers often transmit clues that they’re up to something bad. For example, the practice manager or biller who is a “hero” who handles everything, controls the system entirely (e.g., resists upgrades or conversions to new systems), and never cross-trains anyone or takes vacation could be afraid of exposure or of losing their access point to funds. When an employee appears to be living beyond their means, that could be another clue. Increasing patient complaints about confusing statements or payments not being applied could be another. Make note of these hints, but keep in mind that while they’re suspicious, they’re not conclusive. They indicate you should investigate further, quietly and discreetly, since embezzlement is not the only explanation for these behaviors.
- Rely on data. If you suspect embezzlement is occurring, test your suspicion with data analysis. Enlist the help of a consultant or fraud examiner if you’re not sure how to start. (One good idea is to simply work backward from your bank statements to your practice management system — or analyze a cross-section of EOBs against postings in the system.) Make sure that you never give up total control of your data, and that you know how to use your systems so that you can investigate and validate transactions without the help of employees.
- Get insurance. If you haven’t reviewed your insurance coverage recently, now is a good time to do so. Make sure you have coverage both for theft of money from your practice by employees and data security breaches, including medical data theft.
*This article is not meant to be exhaustive, but it should provide a starting point for protecting yourself from embezzling. The internal controls mentioned are just a few of many easy-to-implement processes that can help make embezzling more difficult. Capko & Morgan can help your practice with a detailed review of internal controls and recommendations on how to implement or improve them. For more information about this service, contact us.
Interested in learning more about embezzling and internal controls? Take our 5-minute quiz.