Internal Controls For Mental Health Practices

Key Takeaways

• Trust alone isn't enough — even good employees make mistakes. Simple checks in place can catch errors before they cost you money.

• Write down how things are done — if only one person knows how a task works, you're at risk if they leave or get sick. Writing it down protects the practice.

• Don't give everyone access to everything — staff should only be able to see or touch the systems they actually need for their job (like payroll or billing).

• No one person should handle a task from start to finish alone — for example, the person who enters bills shouldn't also be the one who approves paying them. Having a second person involved helps catch mistakes.

• If you want to assess your practice's situation, you can use our free Internal Controls Checklist here for a quick self-assessment.

-------

Internal controls aren’t something practice owners think about very often. That’s because internal controls are usually associated with large companies, auditors, and complicated regulations. But basic internal controls can benefit even small practices and they don’t need to be overly complicated.  

I know this firsthand as I’ve spent over a decade as an auditor helping small and large organizations figure out how to build processes that are efficient and accurate. 

What Are Internal Controls?

Mental health practices are built on trust, and that's an admirable strength. We trust our clinicians, administrative staff, and billing partners to do their jobs well. But trust alone is not a business process. Even in well-run organizations, mistakes happen. Claims are never submitted, payments are missed, invoices are paid twice, payroll is incorrect or insurance companies underpay a claim without anyone noticing.

Most of these situations are not the result of fraud. They are simply process failures.

Internal controls are the day-to-day processes that help your practice operate accurately, consistently, and with adequate oversight. They reduce the chances of billing errors, duplicate payments, lost revenue, unauthorized spending, and other mistakes that can silently affect the financial health of the practice.

As a practice grows, building a few simple controls into everyday operations helps protect both the practice and the people working in it.

Type of Controls to Consider

Documenting Processes: If only one person knows how to do it, you don't have a process, you have institutional knowledge.

Internal controls aren't about distrusting your employees. They're about designing a process that doesn't depend entirely on one person's judgment or memory. Documenting how work should be completed creates consistency and helps ensure important steps aren't forgotten as the practice grows. It also makes your life easier when you have a sudden turnover and need to pick the work where it was left off. You can also use it to train new staff. When processes are not documented, it puts a lot of pressure on you since you are the only one with all the knowledge in your head. 

Limiting Access: People should have access to the systems and information they need to do their jobs, not everything.

Not everyone needs access to payroll, banking, billing adjustments, accounting or refund approvals. Access should generally reflect staff's responsibilities and be reviewed whenever someone's role changes or they leave the practice. Strong access controls are also an important part of protecting patient information under HIPAA. They also reduce the risk of unauthorized access to your financial systems and accounts. If you lack the key controls needed, your money and financial information may not be safe.

Separating Responsibilities: Whenever possible, don't let one person control an entire financial transaction from beginning to end.

Ideally, these tasks are separated:

• The person entering vendors shouldn't also approve payments.

• The person processing payroll shouldn't be the only person approving payroll.

• The person posting insurance payments shouldn't be moving funds in the bank account.

• The person issuing refunds shouldn't be the only person reviewing refunds.

A small practice can't always fully separate key tasks. When complete separation isn't possible, regular reviews from the owner can serve as a compensating control.

We often see people wearing multiple hats in small practices, but be mindful of who you assign financial responsibilities to. Don't solve an administrative problem by giving a financial responsibility to whoever happens to be available. For example, you might have a trusted therapist suddenly take over billing, payroll approval, or bookkeeping because “she's trustworthy and organized.” That doesn't necessarily mean she is appropriately trained for a financial responsibility or that the appropriate separation of duties is in place.

Reviewing The Work: Someone other than the person performing the task should periodically check that it was done correctly.

Perhaps the simplest control is having someone review the work. A second set of eyes often catches mistakes that would otherwise go unnoticed. Regular checks also help identify trends, broken processes, or unusual activity.

A review control would look like this: someone reviewing the list of no shows at month-end to make sure the correct charges were captured. Or your finance person checking bank transactions to verify that no unauthorized transactions or payments occurred — for example if a scammer got hold of your card or an employee purchased something they weren’t authorized to.

Where Should a Practice Start?

Every practice is different, but there are several operational areas where basic controls are worth implementing. I recommend starting with these three areas that we will review in future articles.

• Revenue and billing: Are all services being billed, collected, and posted correctly?

• Cash and payments: Who can move money, approve payments, issue refunds, or use the practice credit card?

• Payroll: Who enters hours, approves payroll, and reviews the final payroll?

Why This Matters

Internal controls aren't about assuming your employees will do something wrong. They're about designing your practice so that mistakes are less likely to happen, and more likely to be caught when they do.

As reimbursement becomes tighter and operating costs continue to increase, every missed claim, duplicate payment, or forgotten patient balance matters a little more.

Strong internal controls prevent process failures and financial leaks. They also create better visibility into how your practice operates so you can make informed decisions and avoid financial surprises.