Feature Embezzlement? That Could Never Happen in My Practice Yes, it could, as a growing number of PTs have found out. Here's how to protect yourself. By Keith Loria | May 2015 "This could never happen to me." A physical therapist (PT) who believes that his or her practice is immune to embezzlement, a data breach, or other similar threat isn't up to speed with the reality of the 21st century. The truth is, embezzlement and theft can happen in any practice and, in fact, often the perpetrators are longtime, trusted employees. Marcee Hopper, PT, in Corbin, Kentucky, found this out the hard way. Hopper began her career in 1991 after graduating from the University of Kentucky. In 2003, after her employer shut down his clinic, Hopper opened her own outpatient clinic. Since her former employer also let go of his office manager, who had managed his clinics for 18 years, Hopper thought the 2 of them together would make a good team. "I figured since I had very little business experience, she could handle all of the billing and financial end of the business, while I dove into building our patient load and developing the clinical side," Hopper says. "I had known her for years. She was very dedicated to her church and her family. Never did it cross my mind that she could rob me." But that's exactly what happened. Despite seeing consistently good patient numbers, Hopper couldn't understand why the clinic was still struggling 4 years after its opening. Hopper had become suspicious about 2 years in, but the embezzler was clever and had covered her tracks. "I had looked and looked at different things on the financial end, but she was smart enough to make the numbers she gave me match up with financial statements. Meanwhile, I was so busy on the clinical side, I did not have much time to keep an eye on what she was doing. And of course I 'trusted' her to do her job," Hopper explains. "I finally looked in the right place. The one thing I never saw were our cancelled checks, because they did not come with our bank statements. I knew immediately after I requested them from the bank that she was forging my signature and giving herself 2 extra paychecks per month, in addition to her regular pay." To make matters worse, the employee also had not paid payroll taxes for several months, and was shredding all of the IRS notices. "I would sign the payroll tax checks, thinking she was paying them. Then she would shred them," Hopper explains. "In total, she embezzled over $80,000, and I owed over $40,000 in late payroll tax payments. Later, after my former employer found out about her crimes, he investigated further. She also had been embezzling from him." The employee began embezzling just 2 months into the job. Reflecting back, Hopper admits there were "red flags." "She did not want to take vacation very often and always had a reason why she needed to handle the mail," Hopper says. "And looking back, she tried to get my other staff members 'in trouble' a lot. I think she wanted to make sure I would not believe anyone if they came to me." (See "The Warning Signs.") It took Hopper more than a year to recover financially, but she says that she's now a much better business person and the clinic is thriving. Anyone Can Be a Victim According to the Association of Certified Fraud Examiners (ACFE), the typical business loses 5% of its revenues each year to fraud. Small businesses tend to suffer disproportionately large losses. Historically, health care professionals have spent far more time on patient care than on their finances. In a 2008 "Liability Awareness" column in PT Magazine, the authors commented, "Health care practices would seem to be particularly vulnerable to this crime because of health care practitioners' typically benevolent nature and lack of fiduciary training."1 Protecting yourself is a topic that should be on the mind of every physical therapist, regardless of practice size, security experts advise. Martin Williams, a CPA/CFF with Fiske & Company in Plantation, Florida, says health care practitioners must focus on their finances with the same effort they dedicate to their patients. To protect against embezzlement, Williams advises segregating duties within the finance function. "For example, the individual responsible for collecting payments should not be involved in depositing payments. This way, a single individual would face difficulty performing embezzlement alone," he says. "You should also eliminate employee access to the company credit card. Any personal inconvenience will offset the decrease in liability for unauthorized credit card usage." Franklin J. Rooks Jr, PT, who left the world of physical therapy to practice law with the law firm of Jacobson & Rooks LLC, Marlton, NJ, once owned a chain of physical therapy clinics. He noticed cash was disappearing and unaccounted for. "More than 1 patient said that he or she paid his or her copay, and I discovered it was not credited in the system," he says. "We had a cash receipt policy in place at the time, but the patients were not issued receipts. We tracked the dates of service and cross-referenced the schedule book to see who was working the front desk at the time the patients claimed they made their copayments. We could not prove that the employee stole the money, because no one saw her do it." Rooks installed hidden cameras to monitor the front desk, adding them to the existing security system. The employee subsequently resigned. Portrait of a Typical Thief Although thieves come in all shapes and sizes—and sexes, ages, and backgrounds—there are some recurring patterns, according to Christopher Marquet of Marquet International, a boutique investigative, litigation support, and due-diligence firm based in Boston. The firm annually analyzes publicly reported cases of embezzlement—generally those resulting in more than $100,000 in losses. In 2013, the most recent year for which figures are available, it reviewed 554 embezzlement cases with a median loss of $325,000.2 The average age of the perpetrator was 47.9 years., with nearly a third (31.8%) between the ages of 40-49. Over a 6-year period, 61% were women. Marquet says, "These results demonstrate that women are predominantly the perpetrators of major embezzlements in our society at this time (with the caveat that there appear to be more women in bookkeeping and finance positions than men)." And most of the perpetrators—71%—held positions in finance and accounting. A nagging question among victims is, "Why did he or she do that to my business?" According to Marquet, the overwhelming motivation is for a more lavish lifestyle, which accounted for 60% of the reported embezzlements. Gambling debts were a distant second at 24%, followed by need at 4%. Only 5% had prior criminal records or a history of fraudulent activity. Checks and Balances The Association of Certified Fraud Examiners (ACFE) found that among the cases it analyzed, the median loss among 100 health care organizations in 2014 was $175,000—well below the loss leader, mining, at $900,000 but well ahead of the $50,000 median loss experience by the lowest-ranked industry, communications and publishing.3 On the other hand, ranking the number of cases investigated by ACFE, health care is near the top, exceeded only by banking and financial services, government and public administration, and manufacturing. Marquet found a similar pattern in his analysis, with health care ranking fifth out of 15 industry groupings. Jeff Holt, healthcare banking consultant and vice president of PNC Healthcare Business Banking, recently spoke on embezzlement in medical practices. He said that 2 out of 3 people in the industry are losing, have lost, or will lose funds through embezzlement. His advice to deter embezzlement: "Don't keep patients' financial information like credit card numbers written down. Instead, have the credit card information digitally stored and encrypted," he says. "Get a management security code for patient refunds at the merchant terminal, and put inventory controls, IT security, and cash controls in place." Most important, engage your banker, CPA, or attorney if you suspect embezzlement. Your professional partners will let you know what to do next, including if and when to contact the police. Hopper's big takeaway from her experience is that she no longer has one person handle the finances, and she takes an active role in the process. "I now have 4 people that include my administrator, my office assistance, myself, and my CPA who all have a role in my daily deposits and finances," she says. "Now there is a check and balance system where each person has a role. If something is wrong, 1 of us will catch it. I probably now spend at least 30%-40% of my time on the financial and business side of the clinic, and I handle all of the money coming in and out." Missing Cash Isn't Always Theft It is important to recognize that when money goes missing, it is not always due to theft. Is it missing because the billing department called a patient on a past-due balance, and the patient claimed that he or she already paid, but the amount is not credited to the patient's account? Or perhaps the books show one payment amount but your bank account shows something else. As Rooks explains, if you have more than 1 clinical location, and payments are accepted at those locations, those payments ultimately have to make it to the bank. They also have to be posted to the billing system to be credited to a patient's account, so a process must be in place by which payments are accepted at the clinical locations, credited to the patient's account, and deposited into the practice's operating account. "Missing cash can be missing because it has been stolen. It also can be 'missing' because it was misplaced or lost during a transport process from the clinical location to the practice's central business office," he says. "It can be 'missing' because it was misapplied in the posting process—posted to the wrong patient account or a portion of it applied instead of the full amount." That is why it is important to have proper safeguards in place to isolate and identify disappearances of cash. Rooks advises that practices take several steps. "Have a receipt system to acknowledge cash payments," he says. "Have a payment posting system that separates the functions, so that the same person is not performing more than 1 function. That is, do not have the same person post payments, make bank deposits, issue refunds, or post charges. These should be separate functions." (See "Steps to Help Prevent Embezzlement.") Other financial safeguards include using a reconciliation process, so that daily bank deposits are the same amount as what's being posted to the billing system. Also, minimize cash transactions, since checks and credit cards provide a better audit trail than does paper money, and there is less chance of misappropriating credit card or check payments. Sound Advice Segregation of duties is the most critical way to safeguard against embezzlement, according to Diane A. Matthews, PhD, CPA/CFF, director, master of science in fraud and forensics for Carlow University in Pittsburgh, Pennsylvania. "One person should not control the entire accounting process. For example, the employee who pays the bills (writes the checks) should not be the employee who reconciles the bank account," she says. "Segregating duties can be difficult in a small practice with few employees. For small practices, the head of the practice should be involved in the daily operations, approving all payments, having [unopened] bank statements sent directly to him or her, and keeping an eye on the books of record." Other tips include keeping unused checks in a locked box, allowing only the head of the practice to sign checks, reconciling accounts monthly so that irregularities can be found quickly, and reconciling petty cash daily. "Embezzlers often start by taking small amounts of money that are readily available," Matthews says. "Daily deposits should be made of any cash received, as cash sitting around can be very tempting." "You need to pay attention to any employee who has personal difficulties—for example, an individual who cannot pay medical expenses for a newly diagnosed medical condition, has gambling debt, or drug usage," Matthews says. "Also keep an eye on an employee who has a close relationship with a vendor." While it seems obvious, a PT should have a background check conducted on every employee, said those interviewed for this article. Pre-hire drug screening also is recommended. Remember, the experts say, most cases of embezzlement come from "loyal" employees with many years of service, so if a practice owner starts to notice money irregularities, the owner must be open to the possibility that anyone on staff can be involved. "Ask questions. If someone is unwilling or averse to answering them, you may have a problem," Williams says. "Remember, it's your business and your information, so don't take no for an answer." Rooks also stresses the importance of performing quality assurance and creating an accountability trail. "Make sure your billing system places a time stamp and user ID stamp on each transaction, so that you can identify who entered the charges, who posted the payments, and who wrote off balances," he says. "Place user restrictions on the billing system so that no single person can perform all functions. Do not allow any user to delete entries; allow them only to correct entries, which can be identified." He also advises separating the practice's accounts receivable into "due from insurance" and "due from patient" components to track payments made in each category on a monthly basis and to look for changes in payment trends and aged balances. "Invest in a billing system that accomplishes all of the above-referenced functions," Rooks says. "Don't underestimate the utility of quality assurance on front-end and back-end operations, in addition to the clinical operations." The Final Say Many types of assets misappropriations can take place in an organization, including skimming, billing schemes, check tampering, expense reimbursement fraud, and payroll fraud. One relatively easy way to help deter these schemes is to hire a reputable CPA or financial adviser to help put a system of checks and balances in place. Hiring an outside auditor to look at the books and billing also is recommended by the experts. Nevertheless, don't let your guard down when hiring an outside expert. Marquet describes the largest embezzlement case in his 2013 report, involving $133.4 million. The perpetrators were 2 men, both in their 60s (therefore not fitting the profile described above) who defrauded numerous small businesses through fraudulent professional employer organizations. Marquet says, "Over a period of more than 6 years … [they] fleeced the small business owners out of about $120 million in payroll taxes they had contributed to and believed were being paid to the authorities, along with an additional $13 million in insurance premiums the duo diverted to themselves." While they spent most of the money supporting a lavish lifestyle, one spent $1.2 million to pay off his restitution order from a 1990 criminal tax fraud case. Perhaps the most important lesson, then, is never to blindly trust someone or give someone total control over the business' finances. It's important to be educated on the basics of running a business and understand the finances that are involved. "As physical therapists, typically we are not educated in business or finance," Hopper says. "We are educated in patient care, and that is where our skills lie. Many of us spend most of our time on the clinical side or management of staff, and we tend to give the financial side over to someone who is an expert in that field. It is very important to educate ourselves on how to run a business, and have checks and balances in place." Matthews says that training employees about ethics so they know that the practice values honesty and integrity also can go a long way, and he suggests that all employees sign a Code of Ethics. Additionally, having an employee handbook that details what is expected of all employees is a smart idea. "When you find embezzlement, or any type of fraud, prosecute," she says. "Catching employees, and letting them go, isn't enough. It will not keep that employee or others from stealing." Keith Loria is a freelance writer. Watch for Warning SignsThere are hundreds of clues that embezzlement may be occurring in your practice. Some of them, considered separately, may be completely innocent. But, the experts say, be careful when multiple warning signs appear. Here are some to watch for.Does an employee consistently work extra hours when the office is closed or make frequent use of remote computer access?Does an employee limit taking vacation to when the office is closed or come to the office while on vacation?Do write-offs or credit adjustments seem unusually high when compared with historical patterns?Does the interval between when bank deposits are made seem unusually high?Are there an unusually high number of patient complaints or questions about billing and accounting?Does an employee appear to have an unusually close relationship with someone who sells goods or services to the practice?Does an employee make "conspicuous displays of honesty"?Does an employee have substance abuse issues, a gambling addiction, or other compulsive behaviors?Behind the Embezzlement SchemesEmployees have found many different ways to embezzle funds. Several are described in the article. According to Christopher Marquet of Marquet International, his firm's analysis determined that these were the most popular techniques in 2013.Payroll Schemes: 28% These include all forms of manipulation of the payroll systems to allow the perpetrator to draw additional income.Forged or Unauthorized Checks: 23% Company checks are forged or issued without authorization for the benefit of the perpetrator.Theft or Conversion of Cash: 13% These cases involve the taking of cash or checks meant for company receipts and pocketing or converting them for one's own benefit.Unauthorized Electronic Transfers: 12% Wire transfers and other similar transfers of funds are the primary mode of theft.Bogus Loan Scheme: 9% Fraudulent loans are created or authorized by the perpetrator from which funds are taken for his or her own benefit.Vendor Fraud Scheme: 8% Either a bogus vendor is created by the perpetrator to misappropriate monies or a real vendor colludes with the perpetrator to siphon funds from the company.Steps to Help Prevent EmbezzlementThere are many ways that physical therapist practices can make embezzlement more difficult. Among them are the following:Perform criminal background checks on all employees. Embezzlers often move on to new jobs, and are able to do so because many employers are reluctant to give out substantive information about former employees out of liability concerns. But go beyond simply calling prior employers. Check court records. Look for signs of current drug, alcohol, or gambling addictions. (Employees with past addictions may be entitled to protection under the Americans with Disabilities Act.)Delineate and separate employee duties. For example, designate one person to open the mail, a second person to record the bill or payment, and a third to pay the bill or deposit the check. No one person should have control over all accounts payable or accounts receivable.Regularly rotate responsibilities for accounting personnel.Require accounting and financial personnel to take time off and vacations.Require 2 signatories on outgoing checks above a certain nominal amount. One signatory should be from outside the finance and accounting functions.Develop internal control procedures. For example, collections and payments should be separate line items and all payments should have supporting documentation.Develop external control procedures. Some practices hire outside CPA firms to audit their records. Some practices have agreed to appropriately audit each other's business practices.Encourage anonymous tips. Sixty-five percent of frauds are discovered through tips, according to Richard Gordon, a forensic accountant and owner of California-based Gordon Forensics & Accounting. Subscribe to an abuse hotline service that allows employees to anonymously call, text, email, or fax any suspicions they may have.ReferencesDaulong M, Hildreth P, Swisher LL. An Attack from Within. PT Magazine. 2008;16(1):48-51.Marquet C. The 2013 Marquet report on embezzlement. Marquet International. www.marquetinternational.com.Forensic accountants dig up the dirt in embezzlement cases. Central Valley Business Journal. October 2, 2013. http://cvbj.biz/2013/10/02/forensic-accountants-dig-dirt-embezzlement-cases/.