Embezzlement: freeze, document, report, claim — in that order

The first hour: freeze, do not confront

The first hour is about containment, not confrontation. Before you say a word to the employee, secure the money and the systems: change online-banking and payroll credentials, revoke the person's access to the practice-management system, the merchant account, the credit card, and the checkbook, and put a hold on any pending transfers you can still stop. A confrontation now warns the person to move funds, delete records, or build a story — freeze first, talk later.

Do not let instinct override sequence. The urge to demand an explanation, or to fire someone on the spot, is understandable and almost always the wrong first move. If you accuse before you have secured accounts and preserved evidence, you can lose the very records that prove the theft, hand the employee a wrongful-termination angle, and forfeit an insurance claim that required you to act reasonably. Say nothing about your suspicion to staff or patients while you contain.

Protect the evidence trail as you lock things down. Take screenshots, export transaction logs, and note timestamps rather than deleting or 'cleaning up' anything, because altering records to build your case is as damaging as the theft. If you use a bookkeeper or accountant, loop them in under confidence now — you will need their reconstruction next — but keep the circle as small as it can be until you know the scope.

Document before you accuse

Build the evidence file before anyone is accused, because a suspicion is not a case and an insurer, a prosecutor, and a court all want the same thing: a documented, quantified loss. Assemble bank and card statements, deposit records, payer remittances and EOBs, payroll runs, refund and void logs, and the practice-management audit trail, and reconcile what was billed and collected against what actually reached your accounts. The gap, dated and itemized, is your case.

Work the reconstruction methodically and keep it clean:

• Pull the raw sources yourself — statements from the bank and processor, not summaries the suspected employee prepared.
• Build a timeline of each suspect transaction: date, amount, method, and where the money went.
• Quantify the loss conservatively and separately from anything you cannot yet prove; a defensible smaller number beats an inflated one.
• Preserve originals and work from copies, so the source records stay untouched for police and your insurer.
• Log your own steps with dates — when you discovered it, what you secured, and who you told.

Expect the number to move as you dig, and do not wait for a perfect total before you report. Insurers and police can work from a documented preliminary loss, and the clock on some of your obligations starts at discovery, not at final reconciliation. The point of this stage is a file solid enough that the next three steps rest on evidence rather than on your word against the employee's.

Report: police, your insurer, and possibly the feds

Reporting is where you convert a private loss into a recoverable and, if necessary, prosecutable one — and the order matters. File a police report: it creates the official record most crime policies require before they will pay, and it is the predicate for any restitution in a criminal case. Notify your insurer promptly under your crime or fidelity coverage, because these policies carry discovery-based deadlines that a delayed report can blow. Only then plan the confrontation and termination.

Escalate to a federal channel if the theft rode on health-program billing. If the employee submitted false claims, diverted payer payments, or billed for services that never happened under your provider number, the conduct may implicate federal health-care fraud laws, and HHS OIG maintains a self-disclosure protocol for exactly that situation — a voluntary route that is far better received than a discovered scheme 1Ref 1HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG maintains a self-disclosure protocol for providers who discover conduct implicating federal health-program fraud laws, giving a voluntary escalation path when an employee's theft involved false claims or diverted payer payments.. This is the point to bring in a health-care attorney, because how and when you disclose materially changes your exposure.

Be ready for the case to reach back for records. A criminal prosecution or a law-enforcement inquiry can generate a subpoena or a court order for patient records, and HIPAA treats those differently: a court order lets you disclose exactly what the order authorizes, while a subpoena without a court order requires satisfactory assurances of notice to the patient or a protective order before you release anything 2Ref 2HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That HIPAA distinguishes a court order (disclose only what the order authorizes) from a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order), governing how a practice responds to records demands arising from the criminal case.. Respond through counsel, disclose only the minimum the instrument actually compels, and log every release.

The insurance claim: fidelity and crime coverage

The money you recover most reliably usually comes from your own policy, not from the employee, so treat the insurance claim as a real project. Employee-dishonesty coverage — a fidelity bond, a crime policy, or the crime endorsement on a business owner's policy — is designed for exactly this loss, but it pays only on proof and only inside its deadlines. Read the declarations page for the coverage limit, the deductible, and, critically, the discovery and proof-of-loss windows, because those clocks start when you discover the theft.

Build the proof of loss to the insurer's specification, not to your own sense of the number. That usually means the itemized, dated loss you already reconstructed, the police report, the supporting statements and logs, and a sworn proof-of-loss form by the policy's deadline. Cooperate fully and answer promptly; the fastest way to sink a valid claim is to miss a documentation request or a filing date. If the loss is large or the policy language is ambiguous, a coverage attorney or a public adjuster can be worth the cost.

Know the coverage gaps before you count on a number. Many policies exclude losses you cannot document, cap 'money and securities' separately from other property, and reduce or deny recovery if you failed to report timely. Coverage also does not erase a federal overpayment obligation — insurance may reimburse your loss while you still owe a payer for claims the employee falsified. Treat the insurance recovery and any payer-refund duty as two separate ledgers.

Terminating the employee cleanly

Termination is the hardest firing a solo owner faces, and doing it cleanly protects you as much as the money does. By the time you sit down with the employee, the accounts should be secured, the evidence preserved, and the reports filed — so the meeting is short, factual, and witnessed where possible. State the decision and the general basis, collect keys and access, and do not deliver a courtroom monologue; anything you say can surface later, and accusations you cannot yet prove invite a defamation claim.

Your employment-law obligations do not pause because the person stole from you. Final-pay rules vary by state, and some require the last paycheck within a tight window regardless of the reason for separation — pay what is owed on time and dispute the theft through the proper channels, not by withholding wages. Your other duties as an employer, from workers' comp coverage to the small-employer thresholds that decide which statutes even apply to a practice your size, still govern the separation. When any of this is unclear, a brief consult with an employment attorney is cheaper than the claim it prevents.

Be realistic about restrictive covenants. A departing employee taking clients or knowledge is a separate worry from the theft, and the enforceability of non-competes and similar clauses is governed by state law: the Federal Trade Commission's 2024 rule that would have banned most non-competes was set aside in federal court and remains under appeal, so as of mid-2026 state law still controls 3Ref 3Federal Trade Commission (2024).Noncompete Rule.That the FTC's 2024 rule banning most non-competes was set aside in federal court and remains under appeal, so as of mid-2026 the enforceability of an employer's restrictive covenants against a departing employee is governed by state law.. Rely on your confidentiality and non-solicitation terms, and on the criminal and insurance tracks, rather than assuming a non-compete will do the work.

Recovering the money from the person

Recovering directly from the employee is the least certain path, so pursue it with clear eyes about collectability. The three realistic routes are restitution ordered as part of a criminal case, a civil suit for the full documented loss, and small-claims court for amounts under your state's limit where the process is faster and does not require a lawyer. Restitution attaches to a conviction and can be enforced over years; a civil judgment is only as good as the assets behind it.

Sequence these against your insurance recovery so you do not double-count or undercut a claim. If your crime policy pays your loss, the insurer typically takes over the right to recover from the employee through subrogation, so coordinate before you file your own suit. Where the insurer has made you whole, chasing the individual separately may duplicate effort the policy now owns; where a deductible or an uncovered portion remains, that gap is what you personally pursue.

Weigh the cost of pursuit honestly. A civil suit against a judgment-proof former employee can cost more than it returns, while a criminal restitution order rides along the prosecution you already triggered by filing the police report. Many solo owners let the criminal and insurance tracks do the recovery work and reserve civil action for cases where the person plainly has assets. Whatever you choose, keep pursuing the money separate from the emotional need to be vindicated — the two rarely line up.

Prevent the next one: the controls of one

Embezzlement in a solo practice almost always traces to one root cause: a single trusted person controlled money end to end with no second set of eyes. The fix is prevention by design — building the internal-controls that a larger practice gets from headcount into a workflow you can run alone. You do not need a finance department; you need to break the chain so that no one person both moves money and reconciles it.

Build the controls of one into your monthly routine:

• Reconcile the bank and merchant statements yourself, every month, from the raw statements — this single habit catches most schemes early.
• Separate duties even across just you and one employee: whoever posts payments should not also make deposits or reconcile the account.
• Read your own remittances and EOBs, so diverted payer payments and phantom refunds surface against what you expected.
• Require dual sign-off or your own approval for refunds, voids, write-offs, and any transfer above a set threshold.
• Review payroll and vendor lists periodically for ghost employees and fake vendors, the classic long-running frauds.

Close the bookkeeping gaps that let theft hide. If you commingled personal and practice funds, clean that up — a commingled account makes it far harder to spot a diverted dollar — and keep the practice's money in accounts only you can open and control. Good controls are not a statement of distrust; they protect the honest employee as much as they deter the dishonest one, and they turn the disaster you just survived into a scheme that cannot run twice.