What Billing Controls Catch Embezzlement in a Small Practice Where One Person Touches Every Dollar?

How to Build Separation of Duties When You Only Have a Few Staff

The goal is simple: make sure no single person can both divert a dollar and hide it, even in a practice too small to have a whole finance department. Here is what does that, move by move.

1. Separate Posting, Adjusting, and Reconciling

The core control, per MGMA’s internal-controls guidance, is that the person who collects and posts payments should not also post adjustments and reconcile the bank account. When those three sit with one person, there is no way to detect a problem until something external forces it out. In a small practice you may not have three people, but you can split the sensitive pieces: let one person post, have a second review and approve adjustments, and put reconciliation with someone outside the daily billing entirely, even an outsourced specialist. Separation is not about headcount; it is about making two people verify each other’s work as a byproduct of the process itself.

2. Require an Approval Trail on Every Write-Off

A write-off is the easiest place to bury a diverted payment, because it makes a balance disappear without moving cash. So make write-offs and adjustments impossible to do silently: each one needs a reason code and a named approver who is not the person posting it. MGMA guidance is explicit that writing off receivables should be approved only by appropriate staff, and often the physician on an overdue account should be involved before it is written off. When every adjustment carries a reason and a second name, hiding a diverted check as an adjustment stops being invisible.

3. Reconcile the Bank Independently, Every Month

Reconciliation is the control that catches what posting hides. Someone other than the person who posts payments should tie the bank deposits to the payments log every single month, and open the mail and log incoming checks before they reach the poster. When the poster also reconciles, they are checking their own work, which is no check at all. An independent monthly reconciliation, even one run by an outside specialist, is often the single control that surfaces a diverted dollar while it is still small.

4. Audit a Sample of Accounts Against the EMR

Controls on paper still need testing. Pull a monthly sample of accounts and trace each one against the EMR: was the payment posted in full, does the adjustment have a reason and an approver, does the write-off make sense. This is the spot-check that turns a policy into a deterrent, because staff know the sample is real and random. Most small-practice embezzlement runs for years precisely because no one ever traced the accounts, so a modest monthly audit changes the math for anyone tempted.

5. Put an Independent Set of Eyes on the Money

Practices that close the blind spot do it by putting a dedicated, independent team on exactly the pieces one person should not own alone: adjustment and write-off review, monthly reconciliation, and account auditing, live in 1 to 2 weeks. The trusted staffer keeps doing their job, but now a separate set of eyes reviews the sensitive steps, a trained backup covers every gap, and no single person is both the doer and the checker. Below is what it sounds like when nobody owns this yet, in practice teams’ own words.

Why This Keeps Happening

If separation of duties is the known control, why do small practices keep skipping it? Because there is a complete absence of separation of duties by default: the same person who posts payments can also write off balances, so a diverted check is hidden as an adjustment no one reviews. It is not negligence so much as scale. A small practice hires one capable person to run billing, trusts them, and never imagines the arrangement itself is the risk. MGMA’s internal-controls guidance is blunt about the pattern: when access, recording, and review all sit with one person, the practice has no way to detect a problem until a vacation, a software change, an audit, or a tip forces it into the open.

The size of what can hide there is the second half of the problem. An embezzlement inside a one-person setup does not look dramatic; it looks like ordinary adjustments. A North Carolina OB/GYN practice administrator was accused of embezzling more than $890,000 over roughly 11 years, which is only possible when no one else ever reads the adjustment log. Small sums, posted as routine write-offs, across years no one audited. This is exactly the exposure an independent payment posting and review workflow is built to close, because the point of a second set of eyes is that the first set can no longer act alone.

And the cost is not only the stolen money. It is the years of trust that turn out to have been unverified, the scramble to reconstruct what happened, and the realization that the practice had no system that would ever have caught it. MGMA guidance frames the goal plainly: each process should involve two different people in a way that causes them to verify each other’s work as a byproduct of the process itself. When that is missing, the loss is real and the strategy is almost always an accident, not a control doing its job.

Most groups have already tried the obvious fixes before they talk to anyone. Each one fails the same way: the work lands back on the practice. The pattern, in one table:

The Solution

So what does “an independent set of eyes” actually look like in a practice too small for a finance department? The specialist takes the three duties that should never sit together and separates one of them out entirely. Your trusted staffer keeps posting payments and running the day-to-day. The specialist independently reviews every adjustment and write-off against a reason code and a named approver, so nothing can be written off silently. That single split, posting on one side, adjustment review on the other, is the core of what MGMA calls separation of duties, and it is the heart of dedicated revenue cycle management support built for small practices.

Then comes reconciliation, the control that catches what posting hides. Every month the specialist ties bank deposits to the payments log independently, so no one is ever checking their own work, and audits a random sample of accounts against your EMR. When an adjustment has no reason, a deposit does not match, or a write-off does not make sense, it gets flagged and chased. The point is not to distrust your staff; it is to make sure that if something is wrong, a second person finds it while it is still small, instead of stumbling onto it during a vacation years later.

Behind all of it, AI drafts the first-pass reconciliation and exception reports and a credentialed human verifies. The workflow ties the numbers, surfaces the adjustments without approvals, and flags the mismatches; a person confirms each finding and reviews it with you. Because this work moves your payment and chart data through a review pipeline, every security control that protects it is documented and auditable, and the whole approach is described on our HIPAA and security page, since handling a practice’s money and records is only safe when the controls are real.

Who Actually Does This Work

Fair question: why would an outsourced team be a better check on your money than someone you see every day and trust? Precisely because they are independent and it is their whole job. Reading adjustment logs, reconciling deposits, and auditing accounts against an EMR is what they do all day, not a task the same busy person does to themselves. The people doing this work are credentialed medical professionals: overseas-trained physicians, US-licensed nurses and pharmacists, and PharmDs, all trained in US revenue cycle and internal-controls workflows. They have no incentive tied to hiding an adjustment, and separation of duties only works when the second set of eyes belongs to a different person entirely.

We are not a call center. We are a clinical operations partner, a healthcare BPO built on dedicated virtual staff: 500+ credentialed professionals, 24/7 coverage, and the AI-first-pass plus human-verify workflow you just read about behind every one of them. A typical practice is live in 1 to 2 weeks, at up to 70% below the cost of hiring locally, and no one on our side goes out without a trained backup already inside your workflow, so your reconciliation and adjustment review never go dark because one person stepped away.

And the security piece your compliance officer will ask about: we are audited to SOC 2 Type II with zero exceptions and certified for ISO/IEC 27001:2022, HIPAA, and GDPR, with zero breaches in eight years. Every workstation runs inside a secure enclave on US-based servers, with screen captures and downloads blocked by policy, so PHI never sits on someone’s home laptop. Every client account carries a $5M E&O and cyber liability policy and a BAA signed before any work starts; the full detail lives in our HIPAA and security posture.

Put the routine and the people together, and a specific list of things simply stops happening.

How We Permanently Fix the Process

A person alone is not the fix, and neither is a bot alone. The fix is a documented internal-controls standard: exactly which duties are separated, who approves write-offs, who reconciles independently, and which accounts get audited on what schedule, all written down and worked the same way every month. Before we take a single reconciliation for a new practice, we chart where one person currently owns posting, adjustment, and review together, so we can see exactly where the blind spot is, and we build the controls against that, not against a generic template.

From there the controls become a living discipline rather than a policy in a binder no one follows. It records who may post, who must approve each adjustment, how the monthly reconciliation is run, and the escalation path when a number does not tie out or a write-off has no reason. It is written down, kept current, and owned by the team. When your specialist is out, a trained backup runs the same controls the same way, so the second set of eyes never disappears because one person went on leave.

That is the difference between hoping the person you trust is trustworthy and building a system where trust is verified, and it is what a dedicated revenue cycle management partner actually buys you. A key staffer used to be a single point of failure with no check on their work. Under this model the controls keep running, the reconciliation stays independent, the backup steps in, and the one-person blind spot stops being the thing that could quietly cost you for years.

The Whole Thing in Four Sentences

Embezzlement hides in a small practice because there is a complete absence of separation of duties: the same person posts payments and writes off balances, so a diverted check can be buried as an adjustment no one reviews. Trusting one capable person, assuming controls are only for big practices, or glancing at normal-looking summaries all fail the same way. The fix is to separate posting from adjustment from reconciliation, require a named approver on every write-off, reconcile the bank independently every month, and audit a sample of accounts against the EMR. A small group practice runs exactly this independent-review model with us today, names withheld, no patient data shown.

If you want to check us out before talking to anyone: our security posture is independently auditable, we are an MGMA 2026 Corporate Member, and 800+ providers run back office work with us.

Ready to close the one-person blind spot? Try us risk free: two weeks, your real adjustment and reconciliation workflow, dedicated specialists running the independent review, and if it does not earn the handoff, you walk away. From here down is the sales part, and it is short: here is exactly what it costs.

Written By

Dan Nandan

Founder and CEO, Staffingly, Inc. · Piscataway, NJ

Dan Nandan has spent 25+ years in IT consulting and healthcare BPO, was among the first in the US to build an RPO/BPO delivery network in India, and has been featured in Computerworld. He runs the operations and the dedicated virtual teams behind the workflows on this page; the team-voice answers above come from the remote specialists who work them every day.

Connect on LinkedIn

Where the Claims on This Page Come From