How Do I Protect My Dental Practice From Embezzlement?

Four reports to read every week, and what each one catches

Four reports, read on the same day each week by the owner or by someone who does not post payments, cover the places above. The names are Open Dental’s and Dentrix’s; other systems carry equivalents, and their support lines can point to them.

• Adjustments by type. Open Dental’s Daily Adjustments report runs for a date range, filters by adjustment type, and shows each adjustment’s date, patient, type, note and amount. Read every courtesy, small-balance or “other” adjustment above a dollar line the owner sets, and every one with no note. It catches balances made smaller without a stated reason.
• Payments against deposits. The Daily Payments report groups patient and insurance payments by payment type, with subtotals for each. Set each day’s cash and check total beside that day’s deposit slip and the bank’s deposit. It catches money received and not deposited.
• Refunds. Open Dental’s manual recommends a payment type of its own for patient refunds, which also makes them easy to list. For each refund of the week: who received it, by what method, against which original payment, and who approved it. It catches credits moved out of the practice.
• The audit trail, filtered. Open Dental’s Audit Trail logs each tracked action with the date and time, patient, user, permission, workstation and a description, and filters by permission and by user. Filter for PaymentEdit and InsPayEdit (patient and insurance payments edited), AdjustmentEdit, ProcCompleteStatusEdit (a completed procedure deleted or its status changed), DepositSlips and SecurityAdmin. It catches changes made after the fact, and shows who made them.

Open Dental says its audit trail entries are never changed inside the program and shows in red any entry that fails its integrity check. Dentrix’s Audit Trail Report lists changes to financial data, including payments and adjustments, with the original and the new data; its help page suggests running it monthly and as needed, and says each run is numbered in sequence, which can alert the doctor to check whether a report was discarded or withheld. Once a month, add the aging run for credit balances only.

How to split duties in a small dental office

The U.S. Government Accountability Office’s Green Book, written for federal agencies, states the principle: separate “the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets so that no one individual controls all key aspects of a transaction or event.” In a dental office, those are approving a reduction, posting a payment, reading the reports, and handling the cash and checks.

The same standard is realistic about small staffs. Where segregation “is not practical within a business process because of limited personnel or other factors,” management designs alternative controls instead, and it notes that segregation cannot rule out two or more employees acting together. One way to divide the work in a front office of three or four:

• Front desk: takes payments, enters each one under their own login the same day, and prepares the day’s deposit slip from the system.
• Office manager: checks the slip against the payments report before the deposit leaves, approves every refund and every subtraction adjustment above the owner’s dollar line, and works the credit-balance list.
• Owner, or an outside bookkeeper who posts no payments: reads the weekly reports, sees the bank account under their own login, and reconciles the bank each month.
• Kept away from the front desk: the security administrator role, the permission to view the audit trail, and the authority to change lock dates.

When the office is too small for even that, the alternatives carry the weight: the owner reads the reports and bank statements personally, every refund carries the owner’s name, and the person who posts payments takes real time off while someone else does the job, which brings to light anything that only works while one person is at the desk.

Logins, permissions and lock dates that keep the record honest

Every report above is only as good as the name on each entry. HIPAA’s Security Rule already asks a practice to “Assign a unique name and/or number for identifying and tracking user identity,” at 45 CFR 164.312(a)(2)(i). A shared front-desk login defeats that and the audit trail with it, since every entry then carries the same name. Compliance with the Security Rule is for the practice’s compliance officer; here, the rule is one person, one login.

Permissions decide who can change what. In Open Dental, Payment Edit lets a user edit existing patient payments, and Adjustment Type Deny can block a user group from particular adjustment types, so courtesy write-offs stay with the people who approve them. Only users with the Audit Trail permission can open the main audit trail, and opening it is itself logged.

Lock dates close a month once it is reconciled. Open Dental’s global lock date blocks edits to items on or before a set date, and its manual calls it the only way to stop new items from being backdated; lock dates set per user group still allow backdating. A Lock includes administrators setting applies it to security administrators too, and a change to it is logged as SecurityGlobal. The same page recommends that offices using global lock dates show insurance write-offs in reports by insurance payment date. Set the lock after each month’s reconciliation, and a change to a closed month becomes something someone does on purpose, under a name.

A deposit and bank reconciliation routine that closes the gap

The routine has three rhythms: a short check every day, a look at the bank every week, and a full reconciliation every month by someone who posts no payments.

Reading the statement promptly also matters under the law on checks. The model Uniform Commercial Code, §4-406, asks a bank customer to examine statements with reasonable promptness and report an unauthorized signature or alteration; a customer who does not can lose claims against the bank for later checks forged or altered by the same wrongdoer once a reasonable period, at most 30 days, has passed, and the model text bars claims not reported within one year of the statement. States enact their own versions: Florida’s §674.406 sets “180 days” for an unauthorized signature or alteration and “1 year” for an unauthorized endorsement. What applies to a given account is for the practice’s attorney and bank.

• Daily, at close: run the Daily Payments report for the day and count the cash and checks against it. Create the deposit slip in the system; Open Dental’s new-deposit screen lists the payments not yet attached to any deposit, so a payment left off yesterday’s slip is still on today’s list, as long as the Start Date filter reaches back to it.
• Daily, before the deposit leaves: a second person checks the slip against the report and initials it, and the bank’s receipt goes into the file with the slip. Card payments get the same check against the processor’s batch total.
• Weekly, the owner: open the bank account under the owner’s own login and match each deposit to a deposit slip by date and amount.
• Monthly, someone who posts no payments: reconcile the account line by line, write down any check out of sequence or to a payee nobody recognizes, then set the lock date.

Illustrative example: on a hypothetical Tuesday, the Daily Payments report shows $2,140 in cash and checks, the deposit slip lists $2,140, and the bank records $1,940 on Wednesday. The $200 matches one cash payment. It may be a counting error or an envelope left in a drawer; found on Thursday, it is one question about one day. The same comparison for the month, in the books, is part of the monthly production and collections reconciliation.

If something looks wrong: what to do, and whom to call

A gap is not proof. A payment posted to the wrong family member or a card batch that settles a day late can explain a difference, and the person who handles the money is owed that check first. Look at the records quietly, keep the circle small, then work in this order:

• Save the record: the audit trail for the period, the payment, adjustment and refund lists, the deposit slips and the bank statements. Ask no one to correct the entries in question, and note who holds the permissions to edit them.
• Call the practice’s attorney before speaking with the employee. What to say, whether to suspend anyone, any recovery and any criminal referral are questions for counsel under state law.
• Bring in a CPA who does forensic accounting to measure what happened, and over what period. If that accountant will see patient-level records, whether a business associate agreement is needed is for the compliance officer or attorney to decide.
• Ask the insurance agent whether the practice’s policies cover employee theft and what notice they require, by when.
• Call the bank about any check on the practice’s account that looks forged, altered or endorsed without authority, with the deadlines above in mind.

Whether and when to involve law enforcement is a question to settle with the attorney. This is an order of steps, not legal advice.

When there is nothing to buy, and where the Review fits

If each person has their own login, refunds and larger adjustments carry a second name, deposits match the bank weekly and each month locks after reconciliation, there is nothing here to buy. If something specific already looks wrong, the next calls are to the attorney and a forensic accountant, not an operations consultant.

An outside look fits when the reports cannot be read: adjustment types mixed together, a shared login, deposits nobody can match to slips. The Revenue Review reads this under the Invoice → Payment hand-off. From read-only exports of the practice’s own reports and deposit records, starting with aggregate reports that carry no patient names, it sets twelve months of posted payments against deposits and lists adjustments, refunds and credit balances by type. It is not a forensic investigation and does not judge whether anyone took anything; where a difference cannot be explained from the records, the report says so, and the next call is the attorney’s. It takes two weeks and ends in a written report the practice keeps.

It is built for owner-led practices with $2 million or more in annual collections and two or more doctors or locations. If the numbers suggest it, the next step is a free 20-minute call, where a practice that already runs the routine above is told it does not need the Review.