What Billing Controls Catch Embezzlement in a Small Practice Where One Person Touches Every Dollar?
In a small practice, one person often runs the whole money side. They post the payments, make the deposits, set up the write-offs, reconcile the bank, and answer any question anyone thinks to ask.
How to Build Separation of Duties When You Only Have a Few Staff
The goal is simple: make sure no single person can both divert a dollar and hide it, even in a practice too small to have a whole finance department. Here is what does that, move by move.
1. Separate Posting, Adjusting, and Reconciling
The core control, per MGMA's internal-controls guidance, is that the person who collects and posts payments should not also post adjustments and reconcile the bank account. When those three sit with one person, there is no way to detect a problem until something external forces it out. In a small practice you may not have three people, but you can split the sensitive pieces: let one person post, have a second review and approve adjustments, and put reconciliation with someone outside the daily billing entirely, even an outsourced specialist. Separation is not about headcount; it is about making two people verify each other's work as a byproduct of the process itself.
2. Require an Approval Trail on Every Write-Off
A write-off is the easiest place to bury a diverted payment, because it makes a balance disappear without moving cash. So make write-offs and adjustments impossible to do silently: each one needs a reason code and a named approver who is not the person posting it. MGMA guidance is explicit that writing off receivables should be approved only by appropriate staff, and often the physician on an overdue account should be involved before it is written off. When every adjustment carries a reason and a second name, hiding a diverted check as an adjustment stops being invisible.
3. Reconcile the Bank Independently, Every Month
Reconciliation is the control that catches what posting hides. Someone other than the person who posts payments should tie the bank deposits to the payments log every single month, and open the mail and log incoming checks before they reach the poster. When the poster also reconciles, they are checking their own work, which is no check at all. An independent monthly reconciliation, even one run by an outside specialist, is often the single control that surfaces a diverted dollar while it is still small.
4. Audit a Sample of Accounts Against the EMR
Controls on paper still need testing. Pull a monthly sample of accounts and trace each one against the EMR: was the payment posted in full, does the adjustment have a reason and an approver, does the write-off make sense. This is the spot-check that turns a policy into a deterrent, because staff know the sample is real and random. Most small-practice embezzlement runs for years precisely because no one ever traced the accounts, so a modest monthly audit changes the math for anyone tempted.
5. Put an Independent Set of Eyes on the Money
Practices that close the blind spot do it by putting a dedicated, independent team on exactly the pieces one person should not own alone: adjustment and write-off review, monthly reconciliation, and account auditing, live in 1 to 2 weeks. The trusted staffer keeps doing their job, but now a separate set of eyes reviews the sensitive steps, a trained backup covers every gap, and no single person is both the doer and the checker. Below is what it sounds like when nobody owns this yet, in practice teams' own words.
Key Pain Points and Discussions by Providers
representative composite examples based on common workflow discussions
“Our office manager has done our billing for years and I would have trusted her with anything. That is exactly the problem. She posts, she adjusts, she reconciles, and nobody checks any of it, because who checks the person you trust? I did not even realize that was a risk until an accountant asked me who reviews the write-offs.” composite example: physician, solo practice
“It only came out because she went on vacation and someone else had to cover the posting. Suddenly there were adjustments nobody could explain and deposits that did not match. When one person owns all of it, you do not find a problem, you stumble into it.” composite example: practice administrator, small group
“I asked to see the write-off log and there was no reason on half of them and no approver on any. That is not fraud by itself, but there was no way to tell fraud from a mistake, because nothing required a second person to sign off. The control just did not exist.” composite example: office manager, OB/GYN practice
“We are small. I always thought separation of duties was a hospital thing, something you do when you have a real finance department. Then I read that most of these cases happen precisely at practices our size, because one person can touch everything, and it stopped feeling optional.” composite example: practice manager, small specialty group
“The scary part is how normal it looks. A diverted check just shows up as an adjustment, and an adjustment is the most boring line in the system. Nobody reads the adjustment log, so nobody sees it. You need someone whose actual job is to read exactly that.” composite example: billing lead, multi-provider practice
Our Answer
Here is what we actually do. A dedicated remote specialist takes over the pieces one person should never own alone: they review every adjustment and write-off against a reason code and a named approver, run an independent monthly reconciliation that ties bank deposits to the payments log, and audit a random sample of accounts against your EMR each month. Your trusted staffer keeps posting and running the day-to-day, but now a separate, independent set of eyes verifies the sensitive steps, so a diverted dollar cannot hide as an unreviewed adjustment. Our teams include trained healthcare operations professionals with backgrounds that may include medicine, nursing, and pharmacy, working inside the practice-management and EMR systems you already use, with approved AI tools assisting with first-pass reconciliation and exception reports and a human verifying every finding. This is our revenue cycle management support paired with an AI-first workflow, in one paragraph.
Why This Keeps Happening
If separation of duties is the known control, why do small practices keep skipping it? Because there is a complete absence of separation of duties by default: the same person who posts payments can also write off balances, so a diverted check is hidden as an adjustment no one reviews. It is not negligence so much as scale. A small practice hires one capable person to run billing, trusts them, and never imagines the arrangement itself is the risk. MGMA's internal-controls guidance is blunt about the pattern: when access, recording, and review all sit with one person, the practice has no way to detect a problem until a vacation, a software change, an audit, or a tip forces it into the open.
The size of what can hide there is the second half of the problem. An embezzlement inside a one-person setup does not look dramatic; it looks like ordinary adjustments. A North Carolina OB/GYN practice administrator was accused of embezzling more than $890,000 over roughly 11 years, which is only possible when no one else ever reads the adjustment log. Small sums, posted as routine write-offs, across years no one audited. This is exactly the exposure an independent payment posting and review workflow is built to close, because the point of a second set of eyes is that the first set can no longer act alone.
And the cost is not only the stolen money. It is the years of trust that turn out to have been unverified, the scramble to reconstruct what happened, and the realization that the practice had no system that would ever have caught it. MGMA guidance frames the goal plainly: each process should involve two different people in a way that causes them to verify each other's work as a byproduct of the process itself. When that is missing, the loss is real and the discovery is almost always an accident, not a control doing its job.
Most groups have already tried the obvious fixes before they talk to anyone. Each one fails the same way: the work lands back on the practice. The pattern, in one table:
| What you tried | What actually happened | Who ended up doing the work |
|---|---|---|
| Trusted one capable person with all of it | No second set of eyes on posting, adjustments, or reconciliation; a diverted dollar could hide as an adjustment | One person, checked by no one |
| Assumed separation of duties was only for big practices | Left the exact structure most small-practice embezzlement exploits fully in place | Nobody; the control never existed |
| Glanced at the monthly summary | Summaries looked normal because a diverted check shows up as a routine adjustment, not a red flag | A report that could not reveal the problem |
| Put an independent specialist on adjustments and reconciliation | Every write-off reviewed against an approver, bank reconciled independently, accounts audited monthly | Someone whose whole job it is |
The Solution
So what does "an independent set of eyes" actually look like in a practice too small for a finance department? The specialist takes the three duties that should never sit together and separates one of them out entirely. Your trusted staffer keeps posting payments and running the day-to-day. The specialist independently reviews every adjustment and write-off against a reason code and a named approver, so nothing can be written off silently. That single split, posting on one side, adjustment review on the other, is the core of what MGMA calls separation of duties, and it is the heart of dedicated revenue cycle management support built for small practices.
Then comes reconciliation, the control that catches what posting hides. Every month the specialist ties bank deposits to the payments log independently, so no one is ever checking their own work, and audits a random sample of accounts against your EMR. When an adjustment has no reason, a deposit does not match, or a write-off does not make sense, it gets flagged and chased. The point is not to distrust your staff; it is to make sure that if something is wrong, a second person finds it while it is still small, instead of stumbling onto it during a vacation years later.
Behind all of it, AI drafts the first-pass reconciliation and exception reports and a trained human reviewer verifies. The workflow ties the numbers, surfaces the adjustments without approvals, and flags the mismatches; a person confirms each finding and reviews it with you. Because this work moves your payment and chart data through a review pipeline, every security control that protects it is documented and auditable, and the whole approach is described on our HIPAA and security page, since handling a practice's money and records is only safe when the controls are real.
Who Actually Does This Work
Fair question: why would an outsourced team be a better check on your money than someone you see every day and trust? Precisely because they are independent and it is their whole job. Reading adjustment logs, reconciling deposits, and auditing accounts against an EMR is what they do all day, not a task the same busy person does to themselves. The people doing this work include trained healthcare operations professionals with backgrounds that may include medicine, nursing, and pharmacy, all trained in US revenue cycle and internal-controls workflows. They have no incentive tied to hiding an adjustment, and separation of duties only works when the second set of eyes belongs to a different person entirely.
We are not a call center. We are a clinical operations partner, a healthcare BPO built on dedicated virtual staff: 500+ team members, 24/7 coverage, and the AI-assisted plus human-verified workflow you just read about behind every one of them. A typical practice is live in 1 to 2 weeks, at approximately 68% below equivalent in-house staffing costs. Trained backup coverage is included in the managed-service model.
And the security piece your compliance officer will ask about: Staffingly maintains active ISO/IEC 27001:2022 certification and operates under HIPAA-compliant controls and signed BAAs. SOC 2 Type II reporting and security controls apply according to the relevant entity, client environment, facility, device, and workflow. Venn Blue Border and related workstation restrictions are used where applicable. Staffingly maintains $5M in professional liability (E&O) and cyber insurance as part of its enterprise risk-management program; the full detail lives in our HIPAA and security posture.
Put the routine and the people together, and a specific list of things simply stops happening.
Ready to Close the One-Person Blind Spot?
Comparing the best RCM and denial-management outsourcing companies? See how a dedicated remote team compares, then browse every pain point we solve.
How We Build a More Durable Process
A person alone is not the fix, and neither is a bot alone. The fix is a documented internal-controls standard: exactly which duties are separated, who approves write-offs, who reconciles independently, and which accounts get audited on what schedule, all written down and worked the same way every month. Before we take a single reconciliation for a new practice, we chart where one person currently owns posting, adjustment, and review together, so we can see exactly where the blind spot is, and we build the controls against that, not against a generic template.
From there the controls become a living discipline rather than a policy in a binder no one follows. It records who may post, who must approve each adjustment, how the monthly reconciliation is run, and the escalation path when a number does not tie out or a write-off has no reason. It is written down, kept current, and owned by the team. When your specialist is out, a trained backup runs the same controls the same way, so the second set of eyes never disappears because one person went on leave.
That is the difference between hoping the person you trust is trustworthy and building a system where trust is verified, and it is what a dedicated revenue cycle management partner actually buys you. A key staffer used to be a single point of failure with no check on their work. Under this model the controls keep running, the reconciliation stays independent, the backup steps in, and the one-person blind spot stops being the thing that could quietly cost you for years.
The Whole Thing in Four Sentences
Embezzlement hides in a small practice because there is a complete absence of separation of duties: the same person posts payments and writes off balances, so a diverted check can be buried as an adjustment no one reviews. Trusting one capable person, assuming controls are only for big practices, or glancing at normal-looking summaries all fail the same way. The fix is to separate posting from adjustment from reconciliation, require a named approver on every write-off, reconcile the bank independently every month, and audit a sample of accounts against the EMR. A small group practice runs exactly this independent-review model with us today, names withheld, no patient data shown.
If you want to check us out before talking to anyone: our security posture is independently auditable, we are an MGMA 2026 Corporate Member, and 800+ providers run back office work with us.
Ready to close the one-person blind spot? Start with a Two-Week Free Trial: your real adjustment and reconciliation workflow, dedicated specialists running the independent review, and if it does not earn the handoff, you walk away. From here down is the sales part, and it is short: here is exactly what it costs.
One Flat Weekly Rate. 45 Hours of Coverage.
No hourly meters, no setup fees, no security deposits, no long-term contracts. Two-Week Free Trial. Your dedicated team member covers your desk 45 hours every week, and a trained backup steps in at no charge whenever they are out.
One dedicated remote specialist running independent adjustment and write-off review and payment reconciliation, solo physician practice
5+ remote specialists covering separation-of-duties review across a multi-provider group or several sites
10+ remote specialists, multi-location group, MSO, or PE-backed platform standardizing internal-controls review across many practices
45 hours of coverage at one flat weekly rate.
For a simple annual comparison, 40 hrs x 52 weeks = 2,080 hours. A Staffingly plan: 45 hrs x 52 weeks = 2,340 hours a year, that is 260 additional hours included in your flat rate. $399/week x 52 = $20,748 a year / 2,340 hours = $8.87 per hour.
Get a Second Set of Eyes on Your Money This Month
You have seen the whole method. The trial lets you test it on your own adjustment log and reconciliation, with independent review your practice can trust.
Start My Two-Week Free TrialWant Us to Close the One-Person Blind Spot?
Tell us your situation and we will map where one person owns every step of your money and where a second set of eyes belongs. A team member will follow up with next steps.
Frequently Asked Questions
Where the Claims on This Page Come From
Sources & References
- MGMA, Internal Controls to Catch Embezzlement in Physician Practices. Practice-management guidance on separation of duties, adjustment and write-off review, and independent reconciliation. mgma.com
- MGMA Understanding and Preventing Embezzlement in Your Practice. Additional MGMA guidance on fraud prevention, controls, and the risk of centralized financial control in small practices. mgma.com
- Medical Economics, Theft in a Medical Practice. Practice-management reporting on why embezzlement happens in physician practices and how internal controls stop it. medicaleconomics.com
- AMA Practice Management and Financial Operations Resources. Physician-practice guidance on billing controls, financial oversight, and administrative operations. ama-assn.org