Internal Controls in a Growing Behavioral Health Practice: Where the Money Leaks and How to Stop It

Behavioral health practices are built on trust — clinically and administratively. That is a virtue in the treatment room and a vulnerability in the back office. A growing group typically has one or two people handling scheduling, billing, payments, adjustments, refunds, and payroll, with the owner reviewing little because the owner is seeing clients. The conditions for loss, whether through error or through misappropriation, are all present.

Where the leaks occur

• Copays and self-pay collected at the front desk, especially cash, without a reconciliation to the schedule.
• Billing adjustments and write-offs applied without review; a claim marked "contractual adjustment" that was actually never billed or was diverted.
• Refunds to clients issued without a second approval — a classic vehicle for diverting funds.
• Payroll: hours or session counts self-reported by clinicians and unreviewed; bonus calculations done by the person receiving them; fictitious or terminated employees still paid.
• Vendor payments: one person creating vendors, approving invoices, and releasing payments; recurring charges nobody reviews.
• Company cards and reimbursements with no receipt requirement or review.
• Client credit balances that accumulate and are never refunded or are quietly reversed.

Worked example

A group with $2.6 million in revenue and a two-person office team discovers, during a routine review the new CFO institutes, that patient refunds over the prior 22 months total $61,000 — roughly three times what the practice's volume and payer mix would predict.

Illustrative figures for a hypothetical practice; not a client's data.

The dollars matter; the disruption matters more — the investigation, the staffing gap, the legal process, and the owner's realization that nobody had looked at a refund report in two years.

A control framework that fits a small office

• Segregate: the person who records a transaction does not approve it or handle the cash. With two office staff and an owner this is achievable — it means the owner approves refunds and adjustments above a threshold, and someone other than the biller reconciles deposits.
• Reconcile monthly: bank to books, deposits to the schedule and the practice management system, payroll to session counts and contracts, credit card statements to receipts.
• Review exception reports monthly: refunds, adjustments and write-offs by user, credit balances, voided transactions, new vendors, payroll changes.
• Dual approval: refunds, write-offs above a set amount, new vendors, payroll changes, and any payment above a threshold.
• Restrict system rights: no single user with the ability to schedule, bill, adjust, and refund; access reviews when roles change.
• Rotate and cross-train: vacations taken, duties covered by someone else, which is itself a detective control.
• Whistleblower path: a way for any staff member to raise a concern outside the office chain.

The owner's role

The owner does not need to do the bookkeeping. The owner does need to look, monthly, at a short set of reports — refunds, adjustments, payroll changes, new vendors — and sign the review. Fifteen minutes a month with the right reports is the most cost-effective control the practice has.

What we would do in the first 30 days

1. Map who does what across scheduling, billing, cash, adjustments, refunds, payroll, and vendor payments; identify every single-person control gap.
2. Pull 24 months of refunds, adjustments, credit balances, payroll changes, and new vendors; review for anomalies.
3. Implement dual approval and threshold rules, and restrict system permissions to match roles.
4. Build the monthly exception-report package and the owner's sign-off.
5. Establish the reconciliation calendar and assign each reconciliation to someone other than the person who records the underlying transactions.