Improper or illegal conduct by office personnel can result in liability for your practice.  Such conduct can include theft of cash on hand, prescription pads or drugs, embezzlement and credit card theft.  To minimize the likelihood of this occurring, there are important steps that should be taken:
      (a) Conduct a careful background check on all applicants who will have access to office checks, credit cards, cash receipts and bank accounts should be completed prior to hire.  This is particularly important for positions that provide office access to a practice’s financial instruments and records;
      (b) Consider purchasing fidelity bonds for employees with access to any financial data so that the insurer will vet these individuals and indemnify the practice to the extent of the bond; and
      (c) Review an applicant’s resume for large gaps in work history, frequent relocation and contact prior to employers and references.
      Other possible red flags include: an arrest record; a history of drug addiction or financial insolvency; employees who do not take time off and who arrive early and stay late; employees who frequently ask for pay advances; employees who insist on personally speaking to all patients with billing issues; potentially dissatisfied employees, such as those who failed to receive a promotion or a raise; and employees who habitually take work home.
      Practices that take precautions in hiring may still not be completely protected.  For this reason, there are some additional practice safeguards that should also be put in place with the practice:
      (a) Install software on your computer system that will leave a trail of posted adjustments and payments and indicate the employee responsible for the posting;
      (b) Employ an accountant to periodically audit office finances;
      (c) Review all canceled checks and set an upper limit above which a partner must co-sign checks in addition to the office manager;
      (d) Have office accounts regularly reconciled by someone other than your usual financial office staff;
      (e) Monitor the petty cash drawer for unexplained discrepancies;
      (f) Divide the financial functions among several employees so that one employee can check another’s work;
      (g) Consider regular unplanned drug tests; and
      (h) Make sure all prescription pads are locked up and regularly accounted for and reconciled.
      Once theft is detected, it should be reported immediately to the appropriate law enforcement agency.  Problems involving inappropriate prescribing or theft of drugs or prescription pads should be reported to the state medical board and the DEA.  Local pharmacies should also be notified so that they can place an alert in their system.  All actions taken in response to any problems should be completely documented.
      Practices should also be aware that HIPAA mandates that medical practices maintain strict confidentiality of patient records.  This means that theft of patient information, including payment information (credit card data), social security numbers and addresses can violate HIPAA even if the employee is the one who engages in improper behavior.  A practice can protect itself by developing written policies to safeguard patient information and by controlling employee access on a need-to-know basis.  Practices should further consider investing in an electronic medical records (EMR) system, which will make it possible to control access and to comply with HIPAA audit guidelines.  While it is virtually impossible to prevent a rogue employee from committing identify theft or otherwise violating HIPAA, an office’s good faith effort to comply with HIPAA guidelines is its best defense against liability.