Share this article…







It is important to disable logins for any employee that leaves your practice. If this is not done, an employee could potentially still connect in remotely to your system. This opens your practice up to a serious cyber security threat. This risk is so great that the FBI and Department of Homeland Security (DHS) recently issued a public service announcement, saying the “increase in insider threat cases … from disgruntled and/or former employees poses a significant cyber threat to U.S. businesses due to their authorized access to sensitive information and the networks businesses rely on.”


How can you comply with regulatory obligations to protect sensitive data or PHI if ex-employees can still enter your systems and delete or modify data? Fines and legal costs can be substantial.


Being proactive is key to protecting your data and your business. To help you do that, we recommend you:
• Conduct regular reviews of employee access, and terminate any account that individuals don’t need to perform their daily job responsibilities.
• Terminate all accounts associated with an employee or contractor immediately upon their dismissal.
• Change administrative passwords to servers and networks when you terminate IT personnel.
• Avoid using shared usernames and passwords.
• Avoid using the same login and password for multiple platforms, servers or networks.
• Notify third-party service companies that provide email or customer support when an employee has been terminated.
• Restrict Internet access on corporate computers to cloud storage websites.
• Restrict employees from downloading unauthorized remote login applications on corporate computers.
• Maintain daily backups.


To protect your business, it’s important that you pay close attention to who has access to what data. Most offices don’t think about this until something happens but you should focus on this [immediately], then you won’t have to worry going forward.

Share this article…







Relevant and meaningful information regarding the management of your Revenue Cycle (billing and Accounts Receivable) is vital to your practice.

By Rob Feldman

Let’s start with our first, and in my opinion, most important topic….measurement.

If “The Promised Land” is optimal cash flow, there are several KPI’s (Key Performance Indicators) that are commonly utilized as a road-map to measure if your practice is indeed falling within benchmarked “best practices”. After all, don’t we need a road map to know where it is we want to arrive?

Virtual Revenue Solutions (VRS) utilizes several simple but powerful benchmarks, all geared and linked to providing the answer to that bigger question, am I maximizing cash flow? These tools, indicated below, are the undercurrents to arriving at the ultimate cash flow conclusion:

1. Gross and Net Collection Ratio

a. Gross collection ratio is a simple calculation that compares monthly gross collections divided by total charges. It is a calculation that does not take into account your fee schedules.

b. Net collection ratio does take your contractual adjustments into account by dividing your payments by your net charges (charges less adjustments).

2. Aging Analysis

a. Aging of A/R can be measured in so many ways. Two measurements stand true:
i. No more than 5-7% should be greater than 120 days
ii. At least 65% of the A/R should be less than 30 days

b. Aging can also be measured by payer, financial class, and trended over time to make some very interesting and eye popping (somewhat unexpected) results.

3. Cash Lag Analysis

a. This is one of the more complicated benchmarks to measure. Its primary essence is to evaluate “when your money comes in relation to when it is billed”.

b. It usually requires a savvy spreadsheet.

c. It is great to know when the lion-share of your money comes in relation to the date you bill it.

4. Accounts Receivable Days Outstanding

a. This is the most critical and telling of all the measurements as it ties the other three KPI’s together.

b. This measures the average number of days charges that still remain in your Accounts Receivable.

c. The calculation is not very difficult and we are happy to provide that to you, just click on the email link below and we will forward the worksheet.

5. Denial Management

a. The billing team must be able to track many aspects of denials:
i. Denial types and dollar types associated with those denials
ii. Working of and refiling of all denials on a timely basis to facilitate collection and reduce the risk of timely filing deadlines
iii. Trending all denial types monthly; see below common denial types:
-Intake and Registration

b. Denials should be reported to senior management as many denials are not always (or usually for that matter) the fault of the billing team and can reveal a more deeply rooted problem.

c. No more than 5% of your charges should be denied for any reason.

While there are many other measurement tools, these are the top 5 to really get a sense as to the efficacy of your Revenue Cycle Management (RCM) and ultimately your cash flow.

VRS offers substantive RCM analysis. If your practice has any concerns or may feel as though you are coming up short on these measurements, do not hesitate to get the help you need to increase your cash flow. Short or long term deliverables are just a phone call or email away.

Interested in a free assessment? Contact Virtual Revenue Solutions at or 412.424.2265.

Share this article…







To ensure your practice does not leave money on the table, proper credentialing is a must.

By Shelly K. Schwartz

Physician credentialing is, by anyone’s measure, a tedious task. Practices that wish to contract with third-party payers must attest to the competency and qualifications of their doctors through a process that involves data collection, source verification, and committee review. For starters, they must verify their license, experience, certification, education, training, malpractice coverage, clinical judgment, and character. They also must obtain hospital privileges, successfully enroll their doctors in health plans as participating providers, and research any malpractice or adverse clinical occurrences.
Such legwork helps ensure patient safety, but it also creates an administrative burden for office managers. “It is a time-consuming process, but an absolutely critical one,” says Ken Hertz, a consultant with Medical Group Management Association Health Care Consulting Group. “It always takes longer than the practice thinks it will, and if you don’t do it right you run the risk of not getting paid.”
Indeed, physicians who are not properly credentialed by an insurance company may not be reimbursed, or paid on time, for treating patients covered by that plan — a direct hit to revenue. The patients the physician does see may also be charged a higher out-of-network copay and deductible, which are harder to collect. “Some practices just absorb that as a loss, and some try to collect the higher deductible from the patient, but a great deal wind up in collections,” says Gerry Malloy, a partner with medical practice consulting firm Global Health Management Services, noting inefficiency can also contribute to higher administrative costs. “That’s how it impacts your bottom line. Many practices underestimate the importance of proper credentialing, but it can have a major impact on your revenue cycle.”
Here’s how the experts say your practice can perfect the credentialing process.


The initial submission of credentialing applications for a new physician is a labor-intensive process that can take between 90 days and 180 days to complete. But that’s merely step one. Most payers, hospitals, and surgical facilities also require periodic recredentialing of specific documents. “Recredentialing tends to be staggered, so the smart practice will literally use an Excel spreadsheet to develop a database of every provider in their practice, with information on their licensure, their Drug Enforcement Administration numbers, their Medicaid and Medicare numbers, anything that will need to be resubmitted, and when the renewal dates are,” says Hertz.
Larger groups and those with deeper pockets often invest in credentialing software or Web-based solutions, which help to automate work flow and integrate practitioner quality data. Others outsource the credentialing process entirely.
But smaller practices typically handle such submissions manually, making it all the more important to designate a point person to manage and maintain the provider database on an ongoing basis. Your “credentialing czar” should be detail-oriented, says Hertz, and able to submit on-time and accurate forms as minor mistakes can delay the process or cause applications to be rejected. He should also be skilled at cultivating a professional relationship with the points of contact at payers, hospitals, and healthcare agencies. “Make friends with these people because these are the people you are going to need,” says Hertz. “We all know very well from everyday living that if you’ve got a good relationship with somebody it’s remarkable how things get done that were otherwise impossible.”
The best internal systems use an electronic tickler file, giving your practice a heads-up when renewal deadlines draw near. Don’t wait for the payers to notify you. “You might get a calendar pop-up 90 days before the deadline that tells you Dr. Smith’s Medicare number or state licensure needs to be renewed,” says Hertz. “You can’t leave it to chance. It’s your duty as the administrator to make sure that that happens properly or to hold the person whose job it is accountable.”


Physician credentialing is a lesser undertaking for small practices, notes Hertz, as there are fewer providers to manage. “Larger practices sometimes get into the position of hiring a physician and the only way the billing department finds out there’s a new doctor is they start getting charges from them, but they haven’t been credentialed,” says Hertz. Thus, larger medical practices need to emphasize coordination and communication between human resources, upper management, and the practice manager. “All of these pieces are connected,” he says.
Where new recruits are concerned, practices should begin the credentialing process right away to allow for processing time and ensure they can begin billing for the physician’s services on day one, says Patrick Boyle, vice president and director of managed care for Catalyst Consulting. Don’t wait for their start date. “You want to make sure you get a head start as soon as possible,” he says. To encourage the swift submission of key signatures and copies of diplomas by the physician, practices might also consider tying the receipt of those documents to the physician’s start date.
Boyle notes that Medicare does not allow practices to submit a credentialing application any earlier than 60-days prior to a new physician’s start date, but it is also one of the few payers that will credential physicians retroactively, meaning your practice can retro-bill for Medicare patients seen before the doctor was officially credentialed. Many of the commercial payers will not. As you bring new physicians into your fold, then, it may make sense to allow them to phase in their schedule as payer credentialing comes through.
To ensure your practice does not leave money on the table, proper credentialing is a must. The most effective managers put timelines in place, create physician databases, and assign a point person to keep well ahead of the deadlines. “It’s not brain surgery, but it does need to be thoughtfully addressed in an organization and standardized in a concrete fashion,” says Hertz.

Copyright© 2015 by UBM Medica, All rights reserved. Republication or redistribution of Physicians Practice content, including by framing, is prohibited without prior written consent. Physicians Practice shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Share this article…







Don’t let your EHR drag your medical practice down. Here’s how physicians and staff members can learn to use the technology in smarter ways.

By Aubrey Westgate

EHRs are no small investment, so it’s important to get your practice back up to speed as quickly as possible post-implementation. But that’s proving to be very difficult for many of you.
Only about 47 percent of the more than 1,400 respondents to Physicians Practice’s 2014 Technology Survey, Sponsored by Kareo, said their EHR made their practice’s work flow more efficient; 21 percent said it has remained about the same, and 33 percent said it has decreased.
While it’s very rare that practices will see a boost in the number of patients they can accommodate per day due to an EHR implementation, Jeffery Daigrepont, senior vice president of the Coker Group, a healthcare consulting firm, says those that have seen a decrease may not be using the system as efficiently as they could. In general, he says, if a practice has gone through a smart selection and training process, it should be back to normal levels of productivity within four weeks to six weeks after implementation.
If your practice has failed to meet that mark, don’t be discouraged. According to Daigrepont and other technology experts, making a few small tweaks to how you use the technology could make a big difference. Here are 10 ways your practice and physicians can pick up the pace.

1. Use shortcuts when appropriate
Think about some of the more repetitive tasks your physicians perform in the EHR, and then consider how they might be able to complete those tasks more quickly, says Daigrepont. “Most doctors have very rigid standardized treatment plans, so if they can pick their top five or 10 things that they see and treat the most, and build very efficient templates that can be consistent with what they’re going to be working on most commonly, then that will improve efficiency.”
Similarly, create “triggers” within your EHR to help physicians document more quickly, says Daigrepont. “When a physician says, for example, ‘review of systems normal,’ that one statement alone or that one click alone could trigger a default or a standardized set of text or statements or language that could explode automatically into the note on their behalf.” While these shortcuts can be great timesavers, make sure your physicians are not overusing them, cautions Daigrepont. HHS Office of Inspector General, Medicare, and other payers are on the lookout for documentation missteps, such as “cloned” notes.

2. Consult your vendor
If you’re not sure how to get started when it comes to templates, shortcuts, and triggers, ask your EHR vendor to spend the day in your practice watching how physicians and staff use the system, says Rosemarie Nelson, of the Medical Group Management Association Health Care Consulting Group. “Let them observe you, let them follow you around for those 20 patients and see what it is you do over and over, and then have them help you create that shortcut abbreviation,” she says. Though this in-office vendor observation might come at a cost, Nelson says it is much more effective than any vendor assistance you would receive over the phone, as the vendor will better understand “the nuances” of how you are using the system. “Remember the old adage, ‘You get what you pay for,'” says Nelson. “… If you want to gain efficiencies, pay for the help to do so.”

3. Pick up a portal
A portal can help your physicians satisfy the patient engagement requirements in Medicare’s EHR Incentive Program, and it can also cut down the time physicians and staff spend documenting patient information, says Nelson. For instance, if the portal is integrated with your EHR and your patients use it to enter information such as their health histories and current medications, that information can be seamlessly pulled into the system. Similarly, consider implementing a patient kiosk in your reception area so that patients can input health information while waiting for appointments, says Marsha Hopper, senior clinical team lead at Regent Medical Solutions, a medical practice consulting firm.

4. Consider add-ons
The portal is not the only piece of technology that can streamline EHR documentation. Physicians can use “smart” pens, for instance, to write text on a computer or tablet, which can then be converted to text within the EHR. Or, they can use speech recognition software that fills in areas of the record as they are speaking, says Daigrepont. “It used to be that you would just dictate kind of a paragraph of text, now you can use your voice to put text in certain fields.”
If physicians are really struggling with documentation, consider merging traditional transcription services with EHR data entry, says Daigrepont. For instance, a physician might use the EHR to document patient data, but he might have the visit note transcribed and then merged into the system. “Maybe they’re only using it for the consult letter or the treatment plan but it’s OK to [merge] your transcription with your [EHR] if you’re struggling or if you’re losing patient volume,” says Daigrepont. “You might want to look at that as a short-term fix until you can get yourself back to normal levels.”

5. Find other features
Consider additional elements of the EHR you may not be using that could help improve efficiency. Hopper says many practices overlook tools built into their systems, such as messaging features that help physicians and staff communicate in real time, reminder or calendar options that help physicians stay on time and/or focused on high priority tasks, and referral tools that streamline the referral process. “… There are so many [often underused features], whether it’s action items for yourself as your personal to-do list, messaging between staff and providers, setting up your letter templates for reminders, or any other type of letters, like letters of medical necessity,” says Hopper.

6. Get staff to step up
Physician time is precious, so consider what tasks they are completing in the EHR that could be delegated to staff. In advance of appointments and prior to physicians entering exam rooms, for instance, nurses and/or front-desk staff could capture the patient’s history of present illness, health history, and so on, says Nelson.
To ensure staff knows exactly what to capture (and so physicians aren’t spending their time correcting errors and filling in missing information due to poor staff documentation) have physicians spend a few hours training them on the appropriate methods, says Nelson.

7. Train, train, and train again
Fully utilize all vendor training resources available to your practice, such as any webinars, whitepapers, or training modules. Otherwise, you might be overlooking key details that could help you better utilize the system, says Hopper. “I think a lot of practices are under the belief that when they go through implementation they’re going to know everything they need to know about that software, which is never the case,” she says. In fact, she says, “… It’s almost impossible for that practice to learn that in a week’s worth of training …”

8. Stay up to date
Ensure that your practice is always aware of changes and improvements the vendor makes to the system. That way, you are always using it in the best ways, says Hopper. She recommends asking a “super user” to regularly review new information and guidance released by the vendor, such as information released through the user portal.

9. Be resourceful
Take advantage of your vendor’s user groups. “People love to help each other so they are always posting how they do things,” says Nelson. “Why reinvent the wheel if someone else spent a lot of time doing that? Maybe they even built a template that they’ll share with you.” Also, observe a similar medical practice using the same EHR, says Daigrepont, noting that other practices have likely faced similar challenges. “I actually think the knowledge sharing of visiting other sites that are using the same software would be more beneficial than having a vendor come in, because the vendor is going to be a little bit more protective of what they think is the best way [to use the system],” he says. “Another physician practice that’s similar, they will relate to each other, and they will have, I think, a better opportunity to see how [the EHR is] actually performing in another office versus how a vendor thinks it should be performing.”

10. Ask your team
Increase EHR-specific communication within your practice, as that might reveal areas of improvement you are missing. Nelson recommends setting aside some time for physicians and staff to meet to discuss challenges, frustrations, and opportunities. “The one thing that the doctors don’t think about is approaching the work flow from a team perspective,” she says. “They know that their nurse is involved but they don’t consciously think about it, so I would actually encourage them to just take half an hour every week and talk to their nurse about, ‘How could we do this better?'”

Copyright© 2015 by UBM Medica, All rights reserved. Republication or redistribution of Physicians Practice content, including by framing, is prohibited without prior written consent. Physicians Practice shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Share this article…







Having a patient portal and using it efficiently are two different things. Here’s how to get your patients on-board in four simple steps.

By Audrey “christie” Mclaughlin, RN”

I had the pleasure of speaking at the semi-annual Practice Management Institute Conference this May.
Can you guess the biggest hurdle practices in attendance were facing? Patient portal engagement. So we talked, brainstormed, and shared insight on the topic. And here are some of the top ideas that came up with to increase portal engagement:

1. Direct patients to access return to work or school slips on the portal.

This tip even works for say general or orthopedic surgeons that see many patients one time — maybe — for follow up.

2. Get tablets and train on-site.

Have a staff member walk patients through signing into the portal and sending a message to the nursing staff, letting them know why they are in the clinic today. This is a great teaching moment for patients and can be done in the waiting area or exam rooms while patients are waiting to see the provider.

3. Promote it.

Most patients would find a portal quite useful, if they knew it was there, what it was, and how it benefits them. Make sure when marketing your portal that you are letting patients know they can send and receive messages from the staff, check lab results, and request refills without waiting for call backs.

4. Get the doctors in on it.

This works in two ways. First, have doctors talk with patients about it, even if it’s simply letting them know when their prescription runs out they can request a refill via the portal or to check for their lab results. You can also have the physician ask patients to check for a message from the clinic to see how they are doing after the visit.

Second, according to an article in Medical Practice Insider it is noted that patients are about 90 percent more apt to open an e-mail from the actual doctor than from the practice. Now having spent many years in practices, I know that is not likely that the physician would send every e-mail to patients. But, it is as simple as having the e-mail address reflect the name of the doctor rather than the practice.

Copyright© 2015 by UBM Medica, All rights reserved. Republication or redistribution of Physicians Practice content, including by framing, is prohibited without prior written consent. Physicians Practice shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Share this article…







Establish appropriate staff training for ICD-10 with a keen eye on your revenue cycle management.

By Crystal Clack, RHIA

As the U.S. healthcare system moves closer to the Oct. 1, 2015, ICD-10 implementation deadline, clinicians and coders continue preparing for this immense change in healthcare reimbursement and clinical documentation practices. While medical office operations and management continue to focus on ICD-10 education, it’s important to determine the appropriate education levels of non-coding, nonclinical staff needed for ICD-10 education. Determining the details in ICD-10 education is an important consideration that an astute leader will want to eagerly identify according to their practice needs.

A practice leader’s focus on educating the nonclinical, non-coding staff might include reviewing the following positions: scheduling, registration, accounts payable and accounts receivable, laboratory, revenue cycle specialists, and file clerks. For the ICD-10 transition to flow as smoothly as possible, it is imperative that all staff have knowledge of the new coding system and understand how it will impact their current positions.

In order to determine the correct level of education, analyzing current job positions should commence. This includes the review of policies and procedures, specific job aides and toolkits, work flow, and finally, transparent communication with the team. Furthermore, the revenue cycle process should be reviewed to ensure all staff with revenue cycle interactions are appropriately educated in ICD-10.

Here are some suggested processes a practice leader may follow in order to establish appropriate training in ICD-10 according to job position, including giving a brief refresher on the revenue cycle processes, and common positions that normally interact with the cycle and its specific stage. While every effort is made to cover all non-coding, nonclinical staff, it is up to the practice leader to review all positions and determine the best way to proceed with ICD-10 education for their team.

Revenue Cycle

A healthy revenue cycle is a key to a successful physician practice. A practice leader should review his current revenue cycle processes and take into consideration where the individual practice’s revenue cycle starts and stops, as well as determine each staff position’s interaction with the cycle.

Before education can be delivered, and staff positions are analyzed, it is crucial to remember the flow of the revenue cycle from the initial intake of patient information to zeroing out the balance in the patient’s account. This will ensure a successful ICD-10 training for practice staff.

The process of a medical office revenue cycle usually resembles the following:

1. The patient calls to schedule an appointment.

2. Registration obtains prior authorization from insurance for the patient visit, if appropriate.

3. The patient presents for her scheduled appointment and signs required paperwork.

4. The physician examines the patient and documents the visit on the patient’s chart.

5. The coder receives the chart and assigns the codes according to the physician’s documentation.

6. The claim is sent to the payer.

7. Reimbursement is issued for the visit, if appropriate, according to the patient plan and contract.

8. Accounts receivable processes the payment and a statement is sent to the patient if monies are owed.

9. The patient pays the balance on her account.

10. The patient’s account for that date of service is at zero balance. The revenue cycle process is complete for that patient encounter.

In order to understand how a staff member interacts in the revenue cycle at each level, analyzing positions is a must. Below is a sample of how this process might look and which staff member might interact at each level:

1. The patient calls to schedule an appointment and speaks with a scheduler. The scheduler will need to do a quick intake on the patient’s insurance, reason for visit, if the patient is new or established, or if he has a referral. Appropriate steps must be addressed to obtain authorization for the visit. In order for this to occur, the scheduler will need to give the patient’s insurance payer an appropriate ICD code.

2. The patient arrives for the visit and checks in at the front desk. The registration specialist will confirm the patient’s information and insurance, as well as collect any copays due at that time. He may also take the original requisition slip if referred by another physician. Depending on work flow and practice size, the scheduler may have to select an ICD code (the reason for the visit) for pre-authorization purposes and/or to place on the patient’s superbill.

3. The patient is seen by the physician. The physician documents the patient complaint and proposed treatment, if any, in the medical record. Diagnoses and any procedures are added to the superbill. The patient checks out, the chart is completed by physician, and routed to the coder.

4. The coder reviews the chart and assigns ICD codes according to the physician documentation. The encounter is sent electronically at midnight and routes to the insurance payer.

5. The payer issues payment to the physician. Your accounts receivable or billing department processes the payment. Any monies owed are sent by the patient to the billing department. Once the patient account is zero, the claim is closed.

The ICD-10 planning phase begins with determining each staff’s interaction with the revenue cycle. This can occur by reviewing processes and work flow as well as policies and procedures. Scheduling, registration, filing, billing, accounts payable and receivable, release of information, revenue cycle specialists, and privacy and security staff should be asked for the tools they use every day with current ICD-9 codes, so they can be updated to ICD-10 codes.

Structuring Training

Once the quantity of existing ICD-10 knowledge is determined, training can be disseminated to staff through a variety of delivery methods. Face-to-face, written, electronic, or a combination of two or more can be used. Four hours to eight hours of training could be sufficient, but will be determined according to the needs of each staff member. This training should be completed at least one month prior to Oct. 1, 2015.

A detailed four-hour ICD-10 training agenda may look similar to the following, starting with the morning session:

• An overview of the healthcare system and why it is expanding from ICD-9 to ICD-10.

• The differences between the two classification systems.

• The impact on various physicians and healthcare positions.

• How the medical practice is preparing for ICD-10, to include timelines, parallel testing, upgrades, and go-live date.

• A question-and-answer session.

The afternoon agenda can be customized according to position, need, size of practice, etc. For a registration specialist, the training may look similar to the following:

• An overview of current work flow practices and where ICD-9 codes appear.

• An overview of any current daily job tools, such as coding, billing, or insurance software or interfaces.

• Updated policies and procedures to include the communication protocol with physicians regarding specific coding questions.

• Process flow changes, if any.

• ICD-9 to ICD-10 crosswalks, if available, pertaining to the practice and job title.

• Updated fee tickets with ICD-10 codes.

• Available resources: coding books, anatomy toolkits based on staff position, designated coder-of-the-day team member who can be contacted should a question arise, etc.

Additional spot training can occur after the initial training as a refresher for staff members who encounter ICD codes in their positions, followed by regular education meetings following the implementation date. The practice leader may also wish to monitor claim denials, and map back to specific steps in the process in order to further fine tune ICD-10 training with all staff (clinical and nonclinical). Lastly, updating policies and procedures, process flow charts, coding tools, and reference cards will help ensure a smooth transition for a practice.

When implementing ICD-10 in a medical practice, it’s critical for a practice leader to review all nonclinical and non-coder positions, and to assess the ideal amount of training for each position. Understanding the revenue cycle and what each department contributes to the cycle will be useful in determining appropriate training methodologies for ICD-10.

© 2015 American Health Information Management Association (AHIMA). Reprinted by permission. This article originally appeared in the July/August 2015 issue of Copyright© 2015 by UBM Medica, All rights reserved. Republication or redistribution of Physicians Practice content, including by framing, is prohibited without prior written consent. Physicians Practice shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Share this article…







Learn from victimized practices and protect your own office from theft with these simple strategies.

By Janet Kidd Stewart

Over the course of seven years, a Buffalo-area bookkeeper stole approximately $723,000 in cash from the dermatology practice where she worked.

In another practice, a wife working in the office was found to be stealing to set up a cash cushion before filing for divorce from her physician husband.

Despite sophisticated cash management and billing software, embezzlement still happens with alarming regularity in physicians’ offices, experts say.

“It happens all the time,” says Vicki Rackner, a former general surgeon who founded Medical Bridges, a consulting firm. Rackner recalled a friend, a fellow surgeon, who was so distraught by an act of embezzlement that she had to take a mental health leave from her practice.

“Some of us are so bad as business people that we don’t take a look at the numbers to make sure they make sense.”

Staying vigilant about protecting your practice from all forms of embezzlement is a must, Rackner and other experts say.
“Every doctor right now is looking at how to generate more revenue, but the first thing they should be thinking about is not losing money” to fraudsters and inaccurate claim denials, Rackner says.

A majority of embezzlement cases in medical practices involve a trusted employee who has been with a practice for a number of years, says Carl Frost, founder of Frost & Co., a healthcare consulting and accounting firm.

“There will be others, but doctors in particular will say, ‘She’s been with me for years and I trust her implicitly,’ and there’s the problem,” says Frost. “It was President Reagan who said it: ‘Trust but verify.'”

Count the ways

So, how are thieves plying their trade at your practice?

Stealing from the petty cash drawer is one of the most common offenses, said George Indest, a Florida attorney and president of The Health Law Firm. That may be changing, however, as consumers’ use of credit and debit cards grows, he says.

“If you can minimize cash handling in the office, that’s good because it’s just an invitation to steal. Employees, [contract] janitors, night staff — they all find out where the cash is kept,” he says.

Another fairly common method involves staffers who prepare checks for invoices but never submit them and then use the money for their own expenses.

“A bill will come in, say for a $3,000 medical malpractice insurance premium. The person in the office prepares the check and the doctor signs it,” he says. “Then the office person destroys the check, [and] starts writing other checks for personal expenses that add up to $3,000. The doctor doesn’t realize the money hasn’t gone to pay the premium and the office person is throwing away the past-due notices.”

Using practice credit cards for personal purchases, creating false invoices and diverting the payments, and applying for company credit cards for themselves are a few other ways employees may be stealing from the practice, Indest says.

“I once had a client who had a staff person who was stealing in five different ways,” says Frost. “If these people spent as much time and energy on work they would be phenomenal employees.”

And it may not just be employees you need to watch, Rackner says. “The truth is there are just a lot of ways doctors can be taken advantage of,” she says, noting a time she gave some money to someone who approached her in the parking lot of her hospital saying his son was in the hospital and someone had stolen his wallet. The next day when she mentioned it to colleagues, they told her the same person frequents the lot with the same story.

She says she felt foolish because it’s such an old scam, but her story illustrates a point that physicians should keep in mind: Patients — and even partners — can present real threats.

A partner who mentions a questionably aggressive tax-deduction strategy, or in some other way demonstrates a comfort level with stretching the rules could put other partners in jeopardy, she says.

Frost agreed.

“I’ve seen situations where a physician partner was stealing from the practice retirement plan,” he says. Also not uncommon: Partners who run their own home utility bills through the practice or overuse a company credit card.

Ounce of prevention

So what can physicians do to protect themselves?

Measures to diligently protect a practice from embezzlement can be costly and take away precious billable time, but they’re worth it, experts say.

“Open all of your own mail and don’t give away check-writing privileges,” Rackner says.

Delegating such routine tasks is tempting, but a low-level staff member probably won’t know enough about the practice to recognize when something coming through the mail is amiss, such as overdue notices if a bookkeeper is diverting funds.

“Also, take a critical look at your profit and loss statement and make sure the numbers make sense to you,” says Rackner.

Third-party billing is an option to consider, she says, and could have positive side benefits, such as practice efficiencies.

If you have an in-house financial staffer, consider having him bonded, says Frost. The process will insure the practice against losses due to theft. First, a thorough background check will be conducted on the staff member, Indest says. The process isn’t cheap, he says, but is worth it.

At the very least, be sure to do background checks separately if you don’t go the bonding route, experts say.

“You can have background screening done on all employees through online services,” Indest says. Just remember to disclose this on your employment application. And if current employees never went through these checks, consider doing them retroactively. It is an expense, but a necessary one, he says.

On the employment applications, be sure to ask about prior convictions and any other names or versions of names that applicants may go by, Indest says.
“Often physicians don’t care about all the paperwork and don’t look at financial statements because they just want to treat patients,” he says. “It’s admirable, but at some point you have to be careful and be aware of every penny.”

Embezzlement prevention tips

1. Move it or …

Remove temptation by depositing petty cash into a bank on a nightly basis, suggests George Indest, a Florida attorney and president of The Health Law Firm.

2. Separate tasks.

Don’t make the same person responsible for both opening the mail and paying bills, Indest says. This makes it too easy to hide evidence of embezzlement.

3. Don’t be shy about these measures.

“There’s an old saying that a friend does not put a friend in a position to do wrong. You shouldn’t put employees in a position where they could be tempted to do wrong,” says Carl Frost, founder of Frost & Co., a healthcare consulting and accounting firm. That means establishing a strong and watchful stance on all handling of money in a practice.

Copyright© 2015 by UBM Medica, All rights reserved. Republication or redistribution of Physicians Practice content, including by framing, is prohibited without prior written consent. Physicians Practice shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

Share this article…







By: Joseph Goedert

The HHS Office for Civil Rights in 2013 issued extensive guidance on handling business associate contracts under the HIPAA privacy and security rules. LockPath, vendor of a software platform to manage corporate governance, risk management and regulatory compliance, has distilled the guidance down to 10 bullet points and four additional tips:

1. Determine when and how the BA is allowed to use or disclose PHI.

2. Require that the BA will not use or disclose PHI other than what has been permitted by the contract or required by law.

3. Establish what safeguards will be put in place to prevent unauthorized PHI disclosure. This includes implementing HIPAA requirements surrounding electronic PHI.

4. Require the BA to report any use or disclosure of PHI not covered by the contract to the covered entity, including incidents or breaches of unsecured PHI.

5. Ensure the BA will disclose PHI as specified in the contract to satisfy a covered entity’s obligation with respect to individuals’ requests for copies of their PHI. PHI should be available for amendments as well.

6. To the extent the BA is to carry out a covered entity’s obligation under HIPAA, require the BA to comply with the requirement relevant to the obligation.

7. Ensure internal practices, books and records relating to the use and disclosure of PHI by the BA will be made available to HHS to determine the covered entity’s HIPAA compliance.

8. Require the BA to return or destroy all PHI received from, or created or received by the BA on the covered entity’s behalf, upon termination of the contract..

9. Require BAs to enter agreements with their subcontractors that may have access to PHI..

10. Allow the covered entity to terminate the contract if the BA violates a material term of the contract..

Other tips include: Keep all agreements in a centralized location that can be accessed anytime, know when agreements expire, continually monitor BA compliance by issue assessments and include BAs in your risk analyses..

The complete HHS/OCR guidance is available here. More information on LockPath is here.

This article was reposted from HealthData Management and can be viewed here.

Subscribe to our newsletter!