Cash Handling Guidance & Best Practices
 
Introduction
The Fall 2021 South Compass edition focused on general internal controls. In this edition, we apply those principles to CASH!! Proper cash collection, security, reconciliation and disbursement are extremely important functions, and those charged with cash responsibilities need to be diligent to minimize the possibility of loss.
 
Cash Handling Policies in PolicyStat
USA Health entities (USA Health general, University Hospital, Mitchell Cancer Institute, Children’s & Women’s Hospital, Physicians Group) have adopted various policies regarding cash handling:

Below are some highlights from the policies, as well as additional best practices.
 
Various Policy Highlights (may not apply to all USA Health entities)
  • The safe must always remain locked and be located in a secure area
  • The number of employees who have access to the safe should be limited to two or three individuals
  • The combination of the safe should be changed if an associate given the combination is transferred or terminated
  • Cashing of personal checks or employee payroll checks is not allowed, additionally, no IOUs
  • Do not leave the operator key in the register unattended
  • Checks should be restrictively endorsed
  • Deposits must be prepared daily and stored in a secure safe, and should not be left in the safe over the weekend for units operating on a Monday-Friday schedule
  • Dual verification of cash drawer counts and deposits is required
  • Secure, sealed and properly labeled bags must be used for deposits
  • Only management employees should take deposits to the bank
 
Additional Best Practices
  • Record cash receipts when received and issue receipts to customers
  • Cashiers should have separate drawers
  • Supervisors should approve all voids or refunds
  • Provide safe access (combinations, passwords, keys) only to authorized personnel
  • Minimize the amount of funds held overnight
  • Count cash in a non-public area that is not easily visible to others
  • Use the buddy system when taking funds from one location to another
Minimum Necessary

What is the HIPAA Minimum Necessary Standard?
HIPAA-covered entities are required to make reasonable efforts to ensure that access to Protected Health Information (PHI) is limited to the minimum necessary to accomplish the intended purpose of a particular use, disclosure, or request. USA Health continually monitors and evaluates practices and procedures to limit unnecessary and inappropriate access to, disclosure of, and requests for PHI.

Expanded Protection
USA Health expands protection of protected health information through the use of Maize Analytics®, a privacy monitoring software that utilizes artificial intelligence to evaluate the appropriateness of access and actions involving a patient’s protected health information maintained in the electronic medical record.

Patients trust USA Health as their healthcare provider and ensuring the privacy of their protected health information is an essential part of maintaining that trust, thus impacting patient compliance and outcomes. Protecting this information gives patients the confidence to share their most sensitive information and to seek care from USA Health.

Among the activities detected by Maize are:
  • Accessing medical records outside the normal scope of business.
  • Detecting shared or compromised login credentials (usernames and passwords).

USA Health employees who access medical records should:
  • Only access patient health information when there is a business need.
  • Not access a family member’s record, a co-worker’s record, or any record in which the employee is not a part of the care team or performing a job-related duty.
  • Only access the minimum necessary information to perform one’s job.

Policy Spotlight:
Minimum Necessary (https://usahealthsystem.policystat.com/policy/10617721/latest/): This policy details how PHI should be used, accessed, and disclosed; as well as general exceptions to this rule.

In the News! – Violations to the Minimum Necessary rule:
The South Compass is a joint newsletter from the Offices of
Internal Audit and Compliance at the University of South Alabama.

HELPFUL RESOURCES

Ethics & Compliance Hotline or Direct Dial 1-844-666-3569