In health care, the word “fraud” often refers to the submission of improper claims on the part of a medical practice. However, there is another type of fraud – financial fraud, or embezzlement – that gets little attention in the industry but should be of great concern. A recent study of community health clinics found that more than 40 percent had experienced some type of financial crime during the previous five years.¹ As bad as this sounds, the actual situation is probably even worse. It's estimated that up to 75 percent of embezzlement, fraud and related financial crimes go unreported.² Additionally, several investigators, including accounting firm KPMG International, have found evidence that the incidence of financial crime is growing.³

Preventing financial misconduct within your practice does not need to be an expensive or painful process, but it does require implementation of internal controls. This article describes six safeguards to employ, with advice for both small and large practices.

Check candidates' references and job histories

The process of safeguarding your practice begins before you hire an employee. Checking job candidates' references, job histories and other information on their resumes can identify those who have committed fraud at previous jobs. Often, employees who commit fraud are repeat offenders, so it is important to be thorough when you question their former employers.

Small practices. Make sure your employment applications require all necessary information, such as previous relevant job experiences and the names and contact numbers of former employers. Try to find the reason for any gaps in a candidate's employment history. These could be areas the candidate wishes to keep hidden. At a minimum, you should call to confirm that the previous employment was legitimate and that all professional licenses are valid.

Occasionally you can elicit further details when speaking with a former employer. For instance, let former employers know that the prospective employee will be in a position of trust, and ask them to comment on the past performance of the employee. Although many employers will be reluctant to make damaging remarks over the phone, they may be compelled to speak up knowing that they will be liable should the employee commit fraud again. You should inform your prospective employee that you'll be checking references; applicants with a history of financial misconduct are likely to withdraw.

Large practices. Because managing physicians are more removed from employees in larger practices than in smaller practices, large practices need to conduct more careful checks on their potential employees. It is particularly important to complete a thorough check on candidates applying for critical management positions or positions requiring high levels of trust, such as accountants. If your practice is large enough to have a human resources (HR) staff, they can conduct the employee checks. In practices without an HR staff, employee background checks can be outsourced to private companies that specialize in this service. Even though you would not be conducting the employee checks yourself in this case, make sure the company follows your guidelines.

Review individual expenses

Regularly reviewing expenditures and individual accounts can uncover unusual transactions. If you pay attention to account balances and review documentation before signing checks, you may discover financial misconduct earlier. These reviews will serve as a deterrent to those who might attempt fraud.

Small practices. Reviewing expenses doesn't necessarily mean signing off on every expense yourself, but you do need a process to make sure that every check signed is for a legitimate expense. In general, when a payment is made, two things must be documented: appropriate authorization for the purchase and verification that the goods actually arrived. Ideally, these tasks would be handled by separate individuals. For example, one staff member may be authorized to order supplies and sign the purchase order, but a different person should verify that the goods were received and sign the invoice. A third person can then sign the check, after reviewing all supporting documentation. If you do not have enough staff to separate these tasks, at least have a separate person sign the check and review all documentation.

Small practices should also review office accounts monthly. While this doesn't prevent all fraud, it can alert you to potential problems when expense or revenue accounts are larger or smaller than expected. This process is easier if you compare last year's revenues and expenses with the current year's, or if you compare budgeted revenues and expenses with actual results. Significant differences will highlight areas that you should investigate. Pay particular attention to large expenditures for services because services are more difficult to verify than supplies. Accounting software that is suitable for small practices can be configured to produce these reports each month.

Large practices. As with smaller practices, you should conduct independent, internal checks to ensure that money is being spent on legitimate, properly authorized expenses and that all revenue is accounted. Larger practices also should separate responsibilities for authorizing purchases, verifying receipt of goods and authorizing payment of invoices. Individuals with these responsibilities should not have any access to cash or checks.

When there are a large number of purchases, conserve time by delegating authorization of payments under a set dollar amount. For payments over that dollar amount, add your review and signature to the routine review process. You can notify the bank of this policy by having your checks pre-printed with the message “All checks over [set dollar amount] must have two signatures.”

You may want to add an exception report to your routine review. Exception reports notify you when an account's activity exceeds a particular level or when the balance rises or falls above particular levels. Exception reports are needed only when unusual transactions occur. Most accounting systems can be configured to produce such reports. Use your judgment to set the limits. Limits that are set too low will result in many exception reports. Frequent exception reports lose their effectiveness.

These reports are only effective if you or your practice manager actually read them. Exception reports will not deter financial misconduct if employees know that you never look at them. It is a good practice to sign the reports as they are reviewed, particularly if you delegate some of the review responsibilities to your practice manager. This provides evidence of strong management oversight.

Prohibit pre-signed checks and signature stamps

Neither large nor small practices should pre-sign checks or use signature stamps. This violates the policy of reviewing documentation before signing checks. While this may seem like an elementary precaution, you can never be too careful. Payments should be made only by properly authorized people and only when there is adequate documentation. You and your designated employees need to set aside a regular time to review expenses and sign checks. Once this practice becomes routine, you will encounter fewer situations where someone asks you to pre-sign a check.

Enforce job rotation and vacation policies

It is smart office policy to require your employees to take at least five consecutive days of vacation annually and assign someone else to do their job while they are gone. Rotating responsibilities on occasion can also benefit your practice. This not only ensures that you have someone who can step into a job in the event of an emergency, but it also deters fraud when potential perpetrators know that someone else will do their job for a period of time. If fraud is occurring, another person reviewing the work is likely to expose that fraud. Most fraud requires a great deal of attention and rarely stands up to scrutiny by outsiders, particularly during a week or more of vacation. Even in medical practices where there is no fraud, this policy helps detect ongoing errors and inefficiencies.

Small practices. At first, this policy may seem difficult to implement in smaller practices. There may be only one person in the administrative area, so you may not be able to rotate all tasks. Concentrate on tasks that relate to cash because cash is the asset most susceptible to financial misconduct. The easiest tasks to rotate are opening the mail and making bank deposits. They require very little training, so you can ask a receptionist or assistant to complete these tasks temporarily. You will be protecting checks that come through the mail and assuring that all cash receipts are deposited.

Another job rotation involves you. Occasionally, do your own bank reconciliation. This will assure you that only the checks that you reviewed and signed are presented to the bank for payment.

Large practices. Job rotation and enforced vacations are less important in a setting with enough employees to segregate accounting functions. However, they are inexpensive and will reveal any hidden weaknesses in your internal control. If you choose not to implement this policy, be sure that your staff is organized to provide sufficient independent checks on a daily basis.

Bonding employees

Employee bonds are insurance policies that reimburse you for your loss if the employee commits fraud or embezzlement. Bonding also serves as a deterrent to financial crime because bonding companies prosecute perpetrators.

Small practices. Small practices may want to provide bonding for all employees. This reflects the actual risk in a small practice where many employees share duties. The cost for all of the employees in a small practice is likely to be similar to that of an individual bond, since the main cost of bonding is the initial policy. In some cases, employee bonding may be available as part of the umbrella liability policy for your office.

Larger practices. In practices with large numbers of staff, it may become too costly to provide bonding for all employees. Assess individual positions to determine the potential risk of financial loss through financial misconduct. Because positions with financial responsibilities pose the greatest risk, it may be more cost-effective to bond only these employees.

Issue receipts for cash collected

Nothing is easier to steal, or harder to prove ownership of, than cash. Not long ago, it was rare to issue receipts for cash collected in a medical office. However, with more co-payments now required at the time of service, practices of all sizes collect substantial amounts of cash during the course of a day. Issuing receipts for cash collected reduces the likelihood that an unscrupulous employee will take the cash. A receipt records the amount of cash collected, when it was collected and the patient account to which it is applied. Many integrated accounting systems have a cash receipt function that can be used to record payments and issue receipts. If your system does not have this feature, you can use a cash receipts book that makes a carbon copy of the receipt as it is prepared. Additionally, if your practice collects a significant amount of cash each day, consider taking the time to account for all cash and receipts daily.

“Preventive medicine” for your practice

Whether your practice is large or small, the internal controls described in this article require involvement and diligence on the part of the practice owners. Internal controls can't help your practice if you don't take the time to make them work. We recently examined the differences in internal controls between medical practices that had experienced fraud and embezzlement and those that had not. We found that all medical practices in the study followed basic internal control processes, but those medical practices that had not experienced fraud completed the internal control processes more regularly.

It isn't enough for your practice to simply make money; the money must be protected once it enters the practice. All practices underwrite losses, either by investing some time and money in financial controls, or by paying the full cost of missing funds out of the practice's daily revenue. Just as you encourage patients to make smart lifestyle choices to stay healthy and avoid illness, you should takes steps daily to prevent and detect financial fraud. In the long run, it will be the cheaper and less painful way to keep your practice's bottom line healthy.