Wendy Johnson

	Lisa Sundquist still remembers the moment she decided to 

. A check for $8,000 had arrived in the mail from an insurance provider-a settlement for an old claim that had already been written off and was never entered into their new practice management system.

: Everything independent doctors need to know about private equity

	“I remember thinking, ‘This money is not going to be missed by anyone,’” recalls Sundquist, who was administrator of a six-physician surgical practice in Portland, Oregon. 

and soon learned just how easy it was to steal from the practice

. With responsibility over all receivables and payables in QuickBooks and a thick stack of signed, blank checks provided by the physician owners to pay bills, Sundquist had the unfettered ability to cook the books and line her pockets. 

	Every few days she’d write a check out to herself and enter a valid vendor into the system to mask the spend. A $500 check here and a $3,000 check there quickly added up. By the time she resigned 18 months later, Sundquist had embezzled $257,000.  

	Assisting her, unwittingly, was an accountant who had been with the practice for 36 years. 

	“He got complacent,” says Sundquist. “If everything matched up, he would just sign off on the monthly reports and bank statements.” Like many practices, there were no safeguards built into the administrative workflow, so no one was looking over Sundquist’s shoulder. 

	Theft and embezzlement is widespread, and it occurs more often in healthcare than in most other industries, amounting to $25 billion in annual losses for medical practices, according to the Association of Certified Fraud Examiners. 

Is your practice's location financially hurting you?

	A 2009 survey by the Medical Group Management Association found that an astounding 83% of practice administrators have been associated with a practice where there was employee theft or embezzlement. 

	“It’s happening every single day. People just aren’t catching it and aren’t taking the time to look for it,” says Reed Tinsley, CPA, a Houston-based accountant who specializes in working with physicians and medical practices.

	Embezzlement can remain undetected for years-or longer. A practice administrator arrested in August 2016 was accused of embezzling more than $890,000 over 11 years from a North Carolina-based OB/GYN practice. 

	Sundquist’s theft wasn’t detected until six months after she resigned, when an outside accountant noticed that checks listed on bank statements didn’t match up with the practice’s records.

	By then, all of the stolen money was gone. Sundquist pleaded guilty to 13 counts of aggravated first-degree theft in 2012 and was sentenced to 57 months in prison. She was released in 2015 and ordered to repay $250,000. But full restitution is unlikely. Sundquist now works odd jobs and doubts she’ll ever be able to pay back what she owes.

It's time a real investment is made in primary care

	Embezzlers tend to fit a certain profile, according to the “2013 Marquet Report on Embezzlement.” Often, they’re women with no criminal history who have worked their way up through the organization, perhaps starting as a receptionist and later moving into accounting or billing.

	Sometimes their crime is triggered by an unexpected financial hardship, such as a spouse’s job loss or a sickness in the family. Other times, it’s driven by an addiction to drugs, alcohol or gambling-or simply a desire to live a lavish lifestyle.

	This latter motivation was certainly the case for Sundquist. A 45-year-old mother and wife, Sundquist used the stolen money to spend lavishly on clothes, jewelry, tanning salons and fancy restaurants. She got breast enhancements and a tummy tuck, and treated friends and family to extravagant parties and vacations. Her family didn’t know she was financing this generosity with someone else’s money, she says.

	And while Sundquist began by stealing a sizeable amount, embezzlement often starts off small-perhaps with an employee “borrowing” a small sum of money from the cash drawer-and mushrooms from there. “If the money doesn’t get repaid and it goes undetected, the waters have been tested,” Tinsley says. 

	People who embezzle are often set free to steal again. Practice owners, fearing negative publicity and the perception that they run a shoddy business, can be reticent to press charges, says Karen Mosteller, CPA, a partner at Markham Norton Mosteller Wright & Company, in Naples, Florida.

	Instead, they may opt to settle the matter quietly through an attorney. She recalls a client who declined to prosecute a nurse that was stealing Botox from her employer, a pain management physician in solo practice.

	“The nurse begged the doctor not to prosecute because she’d lose her nursing license,” she says. “They settled it; she was never prosecuted. So this person can go on to do it to someone else.” 

 Top 10 workplaces for PCPs to earn higher salaries

	Now 50, Sundquist doesn’t expect to work for a medical practice again, although she does want to work with them. She’s establishing herself as a consultant and wants to help physicians recognize the warning signs of embezzlement. 

	“If I can protect just one person from being embezzled, it will be a good start” toward making amends, she says. “Doing some good will be the right thing to do.”

	Today, she focuses on living her life honestly, even at the most basic level. 

	“What I did was embarrassing. It’s shameful,” she says. “But I can’t live with that shame and remorse for the rest of my life. Now, if I even see a penny on the street, I just step over it.” 

Articles

Theft and embezzlement is widespread, and it occurs more often in healthcare than in most other industries

Warning signs to look for to avoid practice embezzlement

	When it comes to identifying a practice’s top 

 threat, look beyond the hackers and email scammers. Instead, physicians and practice administrators need only glance around the office.

Cybersecurity finally becoming healthcare priority

	Cyber criminals’ success depends on tricking busy, distracted workers into clicking on links or attachments that will enable them to download ransomware onto the user’s device, where it can infect the network and lock up all data until a ransom is paid. 

	“Cyber criminals think that if they can attack your system long enough to cause you to panic, they can get you to pay almost anything to get your system back,” says Cathy Bryant, manager of product development and consulting services at Austin-based Texas Medical Liability Trust (TMLT), which offers cyber liability coverage to physicians and is the state’s largest medical malpractice carrier.

	Healthcare organizations must develop and foster a culture of cybersecurity to protect against outside threats. This means making health data security a business priority. Here are some ways to create this culture among the staff:

Appoint an employee or outsourced firm to oversee information security.

 Conduct a comprehensive risk analysis. 

Identify every place where the practice stores protected health information, financial data and other sensitive information and determine how the data may be vulnerable to an attack or breach, says Daniel Klein, JD, a Dallas attorney who specializes in data security and HIPAA compliance at Kane Russell Coleman Logan PC.

How will health IT trends evolve in 2017?

 It should address how the practice will mitigate the risks that were uncovered during the risk analysis, Klein says. 

 Develop security policies and procedures.

 These should address how the practice will respond to incidents; who should, and shouldn’t, have access to protected health information; and how the practice will encrypt data-for starters. These documents should be updated whenever changes occur that involve sensitive data, such as switching from a server- to a cloud-based EHR, Bryant suggests. 

 Install software updates as soon as they’re available.

 Software companies release patch updates when they’ve identified software vulnerabilities, Bryant says. 

 Back up all data, but don’t store it on the network.

 Perform regular data backups and store this information separately from the organization’s network, Klein says. The more often the data is backed up, the less data that will be lost if a breach occurs. Be sure to test the backup data regularly to make sure it can actually be accessed when it’s needed, he adds. 

Why are doctors still waiting for interoperability?

 Provide employees with up-to-date security awareness training.


	Do employees know how to recognize spam emails?
	(Employees open roughly one in every three phishing emails, according to Verizon’s 2016 Data Breach Investigations Report.) Smaller practices may want to outsource  training or rely on web-based training from a reputable vendor, Bryant says. 

 Some medical malpractice insurance policies include coverage for a cyberattack, but it’s often inadequate for responding to an incident. Once the practice hires an attorney, notifies patients and pays for a forensics investigation, the costs can easily exceed six figures, Bryant says. 

When it comes to identifying a practice’s top cybersecurity threat, look beyond the hackers and email scammers. 

How to develop a culture of cybersecurity

	Practices that lack internal expertise with coding, billing, contracting or working denials can generally increase revenue by outsourcing to a reputable firm, says Jacqueline Coult, CHBC, owner of Salt Lake City-based Complete Healthcare Business Consulting. 

	Vendors typically base their fees on a combination of factors, including claims volume, specialty and the specific services they’re providing, so it’s important to understand what’s included, says Michelle Durner, CHBME, president of the Healthcare Business Management Association, which represents 500 revenue cycle management providers. For example, does the vendor employ certified coders? Is provider enrollment, contracting, credentialing and/or preauthorization included in the cost, or broken out separately?

	Staff can shift their focus from performing routine billing tasks to more pressing issues that require their attention.

	Amy Shoales, FACMPE, practice administrator of Physicians for Women & Children in Laramie, Wyoming, prefers the immediacy and control of maintaining an in-house team. Onsite access to providers enables her team to resolve coding and billing issues faster than an outsourced vendor, she says.

Developing and refining internal best practices

	Shoales has fine-tuned her internal processes to achieve a 4% denial rate-one point less than the industry average.

	She developed a team of five coders-four of them certified. She also cross-trains billers to perform a variety of functions on any given day, such as payment posting and insurance verification. In addition, she trains all clinic staff members to recognize the types of services that may require a pre-authorization, and to ask the billing team to obtain the needed approval. But Shoales doesn’t mind putting extra time and resources into training. “It’s always more cost effective to get the work done right and on the front end,” she says.

	A practice that lacks the resources to maintain up-to-the-minute knowledge of all state, federal and carrier requirements exposes itself to compliance deficits that could impact revenue and cash flow.

	The Merit-based Incentive Payment System (MIPS) is one example. It consolidates three existing quality reporting programs into a final score that will be used to determine physician payment adjustments. Many providers are confused about what they need to do to avoid future payment penalties, Durner says. State rules that govern patient credits and Medicare requirements regarding overpayments can also be confusing to untrained practice staff, she notes.

	Using some vendors may require use of a new practice management systems that could disrupt your practice, says consultant Elizabeth Woodcock, principal of Atlanta-based Woodcock & Associates.

Costs associated with recruiting, hiring and training staff

	The practice will spend time and resources to maintain a team of  certified coders, expert billers and knowledgeable back-end staff who maintain current knowledge of all payer requirements and state and federal regulations.“The overall revenue cycle management process has become so complicated,” Dumer says. 

Is it time to outsource? Here’s a closer look at the pros and cons of outsourcing vs keeping it in-house

Author | Wendy Johnson

Articles

Warning signs to look for to avoid practice embezzlement

How to develop a culture of cybersecurity

Revenue cycle management: Is it time to outsource?