The embezzler is almost never a stranger. It is the trusted employee with too much access and too little oversight. Controls, not character judgment, are what protect the practice.
Key Takeaways
- Long-standing MGMA survey data show a large majority of practices experience employee embezzlement at some point, usually by a trusted long-tenured employee.
- The single most important control is segregation of duties: no one person should receive payments, post them, and reconcile the bank account.
- Unopened bank statements delivered to the physician owner, surprise audits, and mandatory vacations close most of the remaining gaps.
- If you suspect theft, do not confront the employee first; preserve records and call counsel and a forensic accountant.
No physician believes their office manager is stealing. That is precisely the condition embezzlement requires. The person taking from the practice is almost always the person with the most trust and the most access, which is why medical practice embezzlement prevention cannot rest on judgment of character. It rests on controls — dull, mechanical, reliably enforced — that make theft difficult to commit and impossible to hide for long.
The prevalence data have been sobering for a long time. In a widely cited MGMA survey of 945 medical practices, 83% reported having been victims of employee embezzlement at some point. Just as telling: while 82% of the embezzlers were fired, only 29% were prosecuted. Practices quietly absorb the loss, avoid the embarrassment, and the embezzler moves on to the next unsuspecting practice, often with a neutral reference in hand.
The dollars are not trivial. Fierce Healthcare, summarizing employee-theft research, reports that U.S. healthcare ranked fourth among industries in annual median loss per organization at $437,016, and that practices are estimated to lose 5% to 10% of revenue to fraud each year. For a practice collecting $3 million, the midpoint of that range is a partner-level income walking out the door annually. Awareness has improved — in a 2018 MGMA Stat poll of 1,295 respondents reported by Healio, 81% said their organizations take preventive measures — but taking “measures” and running a control environment are different things.
Why are medical practices such reliable targets? Structure. The owners generate the revenue in exam rooms all day, which means the people who watch the money are never the people who earn it. Staffing is lean, so financial duties concentrate in one or two trusted hands. And the culture runs on trust — the same quality that makes a practice a good place to work makes it a soft place to steal. None of that changes by wishing. It changes by design.
How It Actually Happens
Medical practice embezzlement is rarely a dramatic wire transfer. It is small, repeated, and disguised as routine work:
- Cash skimming. Copays and cash payments received but never posted, with the appointment later marked as no-charge or the encounter deleted.
- Adjustment abuse. Payments posted, then offset with fabricated contractual adjustments or write-offs so the books balance while cash disappears.
- Refund fraud. Phony patient or payer refunds routed to an account the employee controls.
- Payroll and vendor schemes. Ghost employees, inflated hours, personal purchases on the practice card, or a shell “vendor” that invoices monthly.
Notice the common thread: every scheme depends on one person controlling both the money and the record of the money. Remove that condition and most schemes die at inception.
Medical Practice Embezzlement Prevention: The Core Controls
The control set recommended consistently by practice-finance experts, including guidance published by Healthcare Finance News, is short enough to implement in a quarter.
Segregate duties. This is the load-bearing wall. The person who opens the mail and receives payments must not be the person who posts them, and neither may reconcile the bank account. In a small office where one person wears several hats, the owner becomes the third leg: you reconcile, or an outside bookkeeper who reports only to you does.
Review the bank statements yourself. Have the unopened statement delivered to the physician owner monthly. Scan cleared checks, transfers, and payees for ten minutes. Employees who know the owner looks behave differently than employees who know the owner does not.
Run surprise audits. Periodic, unannounced reviews — a day of posted payments traced to deposits, a sample of adjustments traced to EOBs, refunds traced to their recipients. The deterrent value exceeds the detection value, and both are real. Announce that audits happen; never announce when.
Watch the adjustment and refund reports. Monthly, review write-offs by user, adjustment codes by volume, and all refunds. A spike in adjustments posted by one login is the classic early signal.
Require real vacations and cross-training. Schemes need daily tending. The employee who never takes a week off and never lets anyone touch “her” books is a risk pattern, whatever her intentions. Rotate duties so someone else runs each seat at least annually.
Set the tone formally. Background checks on hires who touch money, a written fidelity policy, employee-dishonesty (fidelity bond) coverage, and a stated commitment to prosecute. Recall that only 29% of practices in the MGMA survey prosecuted; a practice known to press charges is a less attractive target. The bond is not an insult to your team; it is the same logic as carrying malpractice coverage while practicing careful medicine.
Controls are not an accusation against your staff. They are the reason your best employees never fall under suspicion.
From the Field
During a financial-operations assessment for a two-physician internal medicine practice in Texas, we found one long-tenured employee opening mail, posting payments, issuing refunds, and reconciling the bank account, with no secondary review anywhere in the cycle. We segregated the duties, moved bank statements to the owners, and ran a look-back audit that surfaced roughly $38,000 in unsupported adjustments and unposted cash over two years. The practice recovered a portion through its fidelity coverage, and the new controls — ten minutes of owner review a month plus quarterly surprise audits — cost it almost nothing to run.
If You Suspect Something
Resist the urge to confront the employee immediately. Confrontation before evidence lets records disappear and can expose the practice to wrongful-termination claims. Quietly preserve documents and system access logs, restrict the employee’s access if you can do so without tipping your hand, and engage your attorney and a forensic accountant before taking personnel action. Report to your fidelity carrier promptly; late notice can jeopardize coverage. And when the case is proven, prosecute. This article is general information, not legal advice; consult your attorney on any suspected theft, termination, or prosecution decision.
Controls Are a Management Function, Not a Suspicion
Most owners know these controls exist. The reason they go unimplemented is not ignorance; it is that installing them feels like an accusation aimed at people you trust, and no one inside the practice wants to own that conversation. This is where outside financial leadership earns its keep. A fractional CFO installs segregation of duties as ordinary professional hygiene — the same way a hospital counts instruments — with no relationship baggage attached. The controls arrive as policy, the monthly review arrives as routine, and the staff who handle your money get the protection of a system that vouches for them. If no one has independently reconciled your deposits to your postings in the last year, that is worth a conversation before it becomes a discovery.
Sources
- MGMA, “Understanding and preventing embezzlement in your practice” — https://www.mgma.com/articles/understanding-and-preventing-embezzlement-in-your-practice
- Healio, reporting 2018 MGMA Stat polling on embezzlement prevention — https://www.healio.com/news/ophthalmology/20181113/medical-practices-take-steps-to-prevent-employee-embezzlement
- Fierce Healthcare, “3 reasons practice embezzlement persists” — https://www.fiercehealthcare.com/practices/3-reasons-practice-embezzlement-persists
- Healthcare Finance News, “Medical practices can make it harder for employees to embezzle money with these basic steps” — https://www.healthcarefinancenews.com/news/medical-practices-can-make-it-harder-employees-embezzle-money-these-basic-steps