Occupational Fraud in Medical Practices: 3 Common Patterns

Occupational fraud rarely announces itself. When a medical practice loses money to internal fraud, the losses accumulate quietly, often for years, before an inconsistency shows up during a staff transition, an audit, or a tax notice. The average practice loss when fraud is finally discovered is materially higher than most owners expect, and the delayed discovery is what makes it so.

Three patterns account for most of the fraud that hits small and mid-sized medical practices: cash-pay and refund manipulation, payroll and ghost-employee schemes, and vendor kickbacks or inflated purchase orders. This piece walks through how each one works, the red flags a physician-owner in Idaho or Utah should learn to spot, and the five internal controls that prevent most of it.

Cash-Pay and Refund Schemes

Cash-pay medicine (fees collected at time of service outside insurance billing) is a real target for asset misappropriation. Staff who handle cash have access to it, and if the practice’s controls do not require reconciliation between service, invoice, and deposit, cash can leave without a trace.

The common patterns:

• Skimming: a portion of a cash payment is pocketed and the encounter is either not recorded or recorded at a lower amount
• Refund manipulation: a refund is issued to a patient who did not request one, and the “refund” is intercepted by the staff member
• Voided transaction schemes: an encounter is entered, the cash collected, then the transaction is voided in the system with no matching cash return

Practices with a growing cosmetic, aesthetic, or membership-medicine cash line face the highest exposure. A cash-line practice with weak controls is one of the easier fraud targets in health care.

Payroll and Ghost-Employee Schemes

Payroll fraud typically works through three variations:

Ghost employees. A fictitious employee is added to the payroll and the paychecks are diverted to an account the perpetrator controls. Works most easily when the person running payroll also has access to add new employees to the system.

Rate or hours manipulation. A real employee’s hours are inflated by the person entering them, or a rate change is entered without proper authorization. Small overpayments compound over months and years.

Unauthorized bonus or reimbursement claims. Expense reimbursements or bonus payments are processed for the perpetrator or a co-conspirator, disguised as ordinary payroll.

The single control that stops most of this is separation of duties: the person who enters payroll should not be the same person who approves the payroll register or reconciles the bank statement.

Vendor Kickbacks and Inflated Purchase Orders

Vendor-side fraud usually involves a staff member with purchasing authority and a vendor willing to participate:

• Kickback arrangements: a vendor pays a portion of each invoice back to the buyer, in cash or gifts
• Shell vendors: a fake vendor is created that bills the practice for services never delivered
• Overbilling: a legitimate vendor bills more than the agreed rate and the buyer approves the inflated invoice
• Inflated purchase orders: quantities or specifications are inflated, and the excess is diverted or resold

Medical supply vendors are the most common vector because most practices have several of them, monthly invoices are common, and no single physician-owner is reviewing every line item.

Red Flags Every Owner Should Watch For

Five patterns show up in most fraud cases well before discovery:

• An employee who refuses to take vacation or refuses cross-training on their tasks
• Vendor payments that consistently round to convenient numbers or come slightly under approval thresholds
• Unusual write-offs, adjustments, or refunds concentrated with one staff member
• Bank reconciliations that consistently require corrections in the same categories
• A rising A/R aging on cash-pay balances while insurance A/R stays clean

Any one of these deserves a conversation. Two or three together deserve a look.

The Five Controls That Prevent Most of It

Internal controls do not need to be elaborate. Five controls, consistently applied, stop the majority of medical-practice fraud:

Separation of duties. No single staff member should have access to cash, the ability to enter or void transactions, and the ability to reconcile the bank statement. Any two of the three is manageable; all three is a control failure.

Daily reconciliation. Cash collected each day should reconcile to encounters recorded that day, before the deposit hits the bank. Reconciling only monthly gives fraud room to hide.

Mandatory vacation coverage. Any staff member handling money should be required to take at least one continuous week off each year, with their duties fully covered by someone else. Most embezzlement schemes require constant attention and cannot survive a week of another person’s eyes on the same records.

Vendor list review. Quarterly review of the active vendor list, with an eye for vendors the owner does not recognize or has not authorized. A fraud vendor rarely survives this review if it happens routinely.

Owner review of monthly bank statements. Not a summary from the bookkeeper. The actual bank statement, checked against the general ledger, with unusual items questioned.

Cooper Norman’s healthcare accounting team reviews internal controls and runs fraud risk assessments for medical practices across Idaho and Utah. To review your current controls before you need to, talk with a Cooper Norman advisor.