Protect Your Practice from Fraud, Part 2

Part 1 of this article highlighted today’s popular cyber fraud schemes. Here, in Part 2, common in-office fraud scenarios are covered. By knowing potential at-risk areas, you can put appropriate measures in place to deter fraud and protect your valuable assets.

Embezzlement

Embezzlement is the theft or misuse of funds or resources by an employee or someone in a trusted position within the business. The perpetrator often uses these gains for personal use. Assets susceptible to theft are discussed below.

Money

Case study: A medical practice with an adjoining ambulatory surgery center (ASC) divides financial duties between the practice’s front desk person and the surgery center’s receptionist. The practice receptionist is responsible for retrieving and opening the mail, logging all checks that come in the mail, and dispersing payments to the appropriate billing staff. Meanwhile, the surgery center receptionist collects surgery fees from patients and posts payments that come in the mail.

For the past two years, the practice’s front desk person has had some difficulty standing and walking. To help her, the surgery center receptionist has graciously been retrieving the mail and bringing it to her. The practice’s front desk person continues to log all the checks and gives the surgery center receptionist the payments she needs to process and post. However, the front desk person is unaware that the surgery center receptionist has been stealing one or two checks per month when retrieving the mail. The front desk person never sees those envelopes and never logs those checks.

The surgery center receptionist posts the payments to patient accounts and makes it look like the ASC received the monies. She then takes the checks home, endorses them to herself, and deposits them at the bank. She usually makes these deposits after hours at the drive-through ATM. Her bank questions her once about the checks since they are payments to the surgery center. The receptionist lies and tells the bank that the physicians prefer to pay her this way, and these are bonus checks for doing such a great job.

The surgery center receptionist is eventually caught because she fails to post a payment to a patient’s account. The patient complains when he receives a statement, and the practice starts to unravel payments that were posted but never deposited. The practice hires a forensic accountant and finds this receptionist has stolen more than $300,000 in the two years she has intercepted the mail for the front desk person. She serves nine years in prison and is still on parole. The practice also files an action against the bank for processing falsely endorsed checks without calling the practice to verify.

• About money fraud:
• Forging checks. An employee writes a check from the company and makes a payment to him or herself, and
• Cashing customer checks, as in the case study. An employee endorses and cashes customer checks and keeps the funds. Today, employees can also set up accounts with similar or “doing business as” (DBA) names and electronically transfer monies from the practice into their accounts.

• Risk factors:
• Only one person “owns” specific duties related to collecting money, such as checking the mail or posting payments.
• A “double-check” system with signatures either is not in place or is not strictly followed.
• A reconciliation process is not in place to check bank deposits against monies posted.

• Mitigation tips:
• Designate separate responsibilities. For instance, assign one worker to process checks and another to reconcile transactions or approve documentation.
• Use electronic funds transfer (EFT). Whenever possible, switch all payers/payments to direct deposit into your account. Investing in check readers to deposit checks directly is also beneficial.
• Establish a two-person audit system for all payments and cash handling, as well as require employees to initial amounts that are counted and verified.
• Know your benchmarks, such as your collections rate, deposit “norms,” and adjustments to catch when a payment or deposit is missing.
• Implement a two-signature signing system for all checks processed through your accounts payable.
• Watch for voided transactions at checkout to ensure employees are not voiding payments and then pocketing the cash.

Time

Case study: An employee is consistently late every morning, arriving 30–60 minutes after her shift starts. Her manager has counseled her and issued a final written warning. If the employee is late again, she will be terminated. The delinquent employee develops a plan with her co-worker to log into a workstation and punch her time clock. For several weeks, the manager is happy and convinced that the late employee has improved. One day, the manager is looking for the employee, knowing that she is there because she has punched in. However, the manager cannot find her. The late employee finally arrives, and the manager discovers that someone has been clocking her into the system even when she is not there. The practice terminates both employees.

• About time fraud:
• May include schemes where co-workers clock in and out for each other.
• Can involve someone in payroll falsifying punches for overtime that one did not work.

• Risk factors:
• Employees can clock in or out from any online system.
• Only one person verifies and submits payroll.
• Managers do not have viewing access to employee time clocks to ensure logged hours are accurate.

• Mitigation tips:
• Use a timeclock system that utilizes fingerprint technology.
• Ensure that two individuals verify payroll.
• Review any manual time punches closely.
• Counsel employees who constantly “miss punches.”
• Limit overtime and review overages carefully.
• Give managers viewing rights to their team’s attendance and request they monitor overtime.

Expenses

Case study: A manager is issued a company credit card for vendor dinners and periodic practice purchases. When she submits her expense report every month, she is missing a few receipts. The manager frequently has an excuse for the missing slips. After several months, she confides in another manager that the expenses without receipts are expensive dinners out with her husband.

• About expense fraud:
• May include “padding” an expense report with expensive meals or products purchased with a company credit card.
• Can also include “double-dipping,” when an employee purchases an item with the company credit card but then submits an expense report using the same receipt to receive payment for him/herself.

• Risk factors:
• Employee expense reports are accepted despite missing receipts.
• The practice fails to match itemized receipts.

• Mitigation tips:
• Set limits on company expenses with employees and credit services.
• Require itemized receipts for all meal expenses.
• Download an app such as Expensify or Paylocity for employees to take pictures of receipts and upload them from their phones.
• Create a policy that outlines what is and is not covered. Be sure to address whether alcohol is permitted during company meals.

Inventory Fraud

Inventory fraud involves the theft of physical goods and the likely altering or failure to update inventory records to cover up the missing products. Several types of goods are at risk for theft.

Controlled Drugs

Case study: A pharmacist calls a plastic surgery practice to confirm the prescription of a controlled substance. The prescription was sent electronically through the practice’s electronic health records (EHR). The order quantity drew the pharmacist’s attention, and she wanted to confirm that the dosage was accurate.

After researching the patient’s chart, the practice manager realized that the prescription was sent in error. When she looked into it further, she discovered that this patient had multiple and ongoing prescriptions for this drug. She talked to the doctor and realized he had never prescribed this medication, and he did not submit a request to the pharmacy. The practice realized, by performing an internal audit, that an employee had the doctor’s EHR username and password. The employee was illegally submitting and picking up a prescription for a controlled substance. The practice worked with local law enforcement, allowing the prescription to go through, and police arrested the employee when she went to pick up the drugs at the pharmacy.

• About:
• This is relevant to any practice (dermatology or plastic surgery) that might prescribe or dispense controlled substances.
• Controlled substances might be used in the operating room to anesthetize a patient or to relax a patient before a procedure.

• Risk factors:
• Unauthorized personnel are allowed access to controlled substances.
• Blank prescription pads are left unattended.
• Staff has access to physician e-prescribing logins and can submit e-prescriptions for controlled substances.

• Mitigation tips:
• Ensure proper licensure with the US Drug Enforcement Administration (DEA).
• Use physical controls to restrict drug access for patients and employees.
• Maintain accurate inventory to know the type and quantity of each stored controlled substance.
• Institute strict control over provider log-in information.

Retail goods

Case study: A patient purchases two bottles of the same product containing retinol. After she starts using the product on her face, she notes the skin around her lower eyes becomes irritated. The cosmetic counselor recommends switching out the product for a milder formula. The patient takes home the new product, but the employee places the unopened product in her purse. She later goes home and sells the returned item on eBay and keeps the money.

• About:
• Employees periodically taking products for personal use without paying for them.
• Staff stealing returned merchandise, such as a product that a patient did not like. The employee may use the product for personal use or sell the product online (like in the case study).

• Risk factors:
• The inventory system in place does not track products by Universal Product Code (UPC).
• Practice does not complete monthly scanned inventories and rarely conducts a hard count inventory to verify the amount of product on hand.
• Inventory systems or displays are haphazard, without an organized grouping of products. This allows merchandise to go missing without anyone noticing.

• Mitigation tips:
• Develop a schedule to audit product inventory. Use a handheld scanner to conduct monthly inventories and perform a hard count audit once per quarter.
• Use an inventory management system with bar code labels that stick to product packaging.
• Implement a control system to manage product and vendor returns.

Office supplies

Case study: It’s back to school time! Instead of purchasing school supplies for his daughter, an employee raids the office supply closet to complete his shopping list. He does not give it a second thought—the practice has plenty of these supplies!

• About:
• Employees often feel it is okay to take home office supplies.
• Everyday stolen items include stamps, Post-it notes, coffee, or notepads.

• Risk factors:
• Office supplies are readily available without any accountability for their use.
• The office orders its supplies without having controls set for the frequency of how often supplies are needed.

• Mitigation tips:
• Teach practice core values and set the tone for frugality, even when it comes to using office supplies.
• Lock office supplies in a closet and only replenish a common area sparingly.
• Install a security camera.

Protect Yourself

Fraud can be carried out in multiple ways. By knowing what to look out for and strengthening areas of potential weakness, you can make yourself less susceptible to fraud. If you suspect fraud in your practice, contact your business attorney and local law enforcement.