A Lucrative Cardiology Recruit and a Controller With Wire Authority

The physician will refer designated health services, including hospital outpatient and imaging services, to an entity with which he has a compensation arrangement, so Stark applies and the arrangement must fit an exception. The employment exception requires that compensation be set in advance, be consistent with fair market value, not take into account the volume or value of referrals, and be commercially reasonable even if no referrals were generated.

Three defects are visible. The medical director stipend of $180,000 for vaguely described duties has no documented time and no FMV support specific to those duties, which is exactly the fact pattern that draws scrutiny. The income guarantee relies on a stale appraisal prepared for another specialty, so there is no defensible FMV opinion for this arrangement. And without a productivity ceiling or referral tracking, the hospital cannot demonstrate that compensation is not tracking the value or volume of the $2.4 million in projected downstream referrals; that projection is itself the risk, because a guarantee grounded in anticipated referrals looks like remuneration to induce them.

Remediate now: suspend the medical director agreement until duties, hours, and FMV are documented and approved; obtain a current, specialty-specific FMV appraisal; convert the guarantee to a structure with a defined productivity component tied to the physician's own professional services rather than hospital referrals; add a cap, a term, and a termination right; and build a compliance monitoring file with annual FMV review and referral pattern analysis. Because compliance discovered the problem, treat it as a potential identified overpayment and assess the sixty-day repayment obligation for any tainted claims. Present the analysis to counsel and the audit committee, and evaluate self-disclosure through the CMS self-referral disclosure protocol with a parallel OIG disclosure, weighing cost, certainty, and the risk of a False Claims Act exposure if the arrangement continues unremediated.

The controller holds incompatible duties across all three legs of the control triad: custody through sole wire authority, recordkeeping through bank reconciliation, and authorization through vendor approval. Any one of those paired with another is a deficiency; all three together is a material weakness. The duplicate payment and the email-initiated bank change are the predictable symptoms.

Specific deficiencies: no independent verification of vendor master changes, no call-back to a known telephone number before changing remittance data, no positive pay or ACH filter, no duplicate invoice detection in the payment run, no second approval on wires, and reconciliation performed by someone with the ability to move cash. The email request is consistent with business email compromise, so the bank must be contacted immediately; recalls succeed only within a short window and depend on whether funds remain in the receiving account.

Corrective actions: move bank reconciliation to a person with no cash or vendor authority and have the controller or CFO sign off on it; require dual approval for wires above a threshold and a documented call-back for any bank detail change; enroll in positive pay with payee matching; route all vendor master changes through a controlled workflow with a change log reviewed monthly; add duplicate-payment analytics to every payment run; and restrict email authority to change banking data by policy, communicated to vendors.

Recovery: notify the bank and request a recall in writing the same day, file a crime insurance or fidelity bond claim, report to law enforcement, and review the vendor's own compromise. Escalate to the audit committee now rather than waiting six weeks, because the same control weakness may have produced other losses that have not surfaced.

The audit committee should not wait for its scheduled meeting. Both items involve financial reporting integrity and potential legal exposure, and the six-week delay itself becomes a governance finding if a regulator or auditor later asks when the board knew.

Recommend an immediate executive session of the audit committee without management present, then three parallel actions. First, engage outside counsel with health care regulatory experience to direct the Stark and Anti-Kickback review so the work is privileged, and engage a forensic accountant or internal audit resource for the payment-loss review. Second, suspend the payment authority and vendor-approval rights of the controller pending review, and reassign bank reconciliation to an independent preparer; this is a precaution, not an accusation, and should be documented that way. Third, instruct management to preserve all email, vendor records, and bank documentation relevant to the bank change request.

Address the conflict directly. If the CFO has a close relationship with the controller or was aware of the control design and did not remediate it, the audit committee needs to determine whether the CFO's oversight can be relied upon for the investigation and whether interim reporting responsibilities should be reassigned. Independence of the investigation matters more than continuity.

Finally, map the disclosure consequences: whether the matters affect the audited financial statements, related-party disclosures, the management letter, or any covenant certificate or representation letter. Deliver a written report to the full board with a remediation plan, owners, and dates, and set a standing quarterly follow-up until the controls are tested and operating.