How common is embezzlement in medical practices, and how do we prevent it?

Embezzlement is far more common in medical practices than most owners want to believe. In a 2009 MGMA survey, 83% of responding practices said they had been victims at some point. Practices that had been hit may have been more likely to answer, but even a fraction of that number should get your attention. These thefts also tend to run for a long time. Most are found 8 to 24 months after they start, often by accident when someone new takes over a task or a patient calls about a payment that never showed up on their account.

Practices are vulnerable for predictable reasons. The owner is with patients all day and has little time to look at the money. A small staff means one trusted employee often handles collections, posting, deposits, and the bank statement. That person is frequently a long-tenured office manager the owner would never suspect. Trust matters in a practice, but it doesn’t protect your money.

The weak points are the same in most offices. Cash copays at the front desk are easy to pocket if no receipt is issued or the payment is never posted. Refunds can be sent to the wrong person, including the employee. Write-offs and adjustments can hide a payment that was collected but never deposited. Payroll changes, like extra hours, a raise nobody approved, or a direct deposit account that quietly changed, can go unnoticed for years.

The most effective control is separating duties. The person who collects payments should not be the person who posts them in the billing system, and neither should be the person who reconciles the bank account. A small office may not have enough people to split everything, but you can usually split enough to make theft hard to hide.

For cash, have two people count the drawer at the end of each day and both sign the count. Then reconcile the daily cash log to the actual bank deposit. Require the owner or a manager to approve every refund and any write-off over a set amount, and review an adjustments report every month.

Review bank and credit card statements yourself, not a summary someone else prepared. Log in directly or have statements sent to you, and scan them every month. Look at payroll reports the same way. Watch for names you don’t recognize, pay rate changes, and new bank accounts, and set up alerts in your payroll system so you hear about those changes as they happen.

Finally, have an outside bookkeeper reconcile every account each month. Someone with no access to the cash drawer and no role in the front office is the hardest person to fool. Our monthly bookkeeping includes checking that what your billing system says was collected actually reached the bank. That gap between reported collections and deposits is where a lot of front-desk theft leaves its first trail.

It’s also worth asking your insurance agent about employee dishonesty or crime coverage. Many practices assume their general policy covers theft by staff, and it often doesn’t.

If you suspect something is already happening, don’t confront the employee first. Secure the records, quietly limit their access, and talk to your attorney before you act. Setting up these controls is a routine part of our healthcare bookkeeping services, and most owners find that clear rules protect honest staff as much as they protect the practice.