A hospital employee in New Zealand diverted $1 million from patient payments by secretly changing bank details on documents; investigators identified unusual behaviour that helped expose the fraud

A hospital employee in New Zealand diverted more than $1 million in patient payments over 6 years by manipulating the organisation’s accounting system and changing bank details on official documents. The money, which should have gone to Christchurch Hospital, was instead transferred to accounts controlled by the employee. The fraud came to light after a patient questioned an invoice for medical treatment they had already paid for. An investigation by the Serious Fraud Office (SFO) later revealed how the employee had exploited weaknesses in the hospital’s payment procedures while displaying unusual workplace behaviour.How did the hospital employee divert $1 million in patient paymentsAccording to a case study published by New Zealand’s Serious Fraud Office, the employee worked as an internal eligibility specialist at Christchurch Hospital, which was part of the Canterbury District Health Board. Her responsibilities included invoicing patients who were not eligible for publicly funded free healthcare and collecting payments for their treatment.The position gave her access to the hospital’s billing and payment processes. Over a 6-year period, she used that access to redirect 475 patient payments into bank accounts she controlled. The total financial loss to the hospital exceeded $1 million.The SFO identified several methods used to carry out the fraud. In some instances, the employee offered patients unauthorised discounts if they paid in cash, but kept the money instead of passing it to the hospital. She also created false invoices containing her own bank account details, making it appear that patients were paying through an official hospital process.Another method involved entering incorrect patient information into the hospital's system. By changing details, she made certain patients appear eligible for free healthcare, allowing her to manipulate the records associated with their treatment and payments.The employee also used a manual accounting process to remove outstanding debts from patients' accounts. Since this system did not record the changes made, the adjustments were difficult to identify. It also made some debts appear as though they had never existed.What brought the 6-year fraud to lightThe fraud was eventually uncovered after a patient contacted the hospital about an invoice for medical treatment that had already been paid for several months earlier.The patient's query prompted the hospital to examine the payment document. During the initial checks, staff discovered that the bank account listed on the invoice was not owned by the hospital. This raised concerns about whether the payment had reached its intended destination.Further enquiries uncovered additional emails sent by the employee to patients. These messages requested that patients transfer money directly into bank accounts that were not associated with the hospital.The discovery led to a more detailed internal examination of the payment records. With assistance from an external consultant, the hospital conducted an internal audit, which identified that the employee had been directing payments from patients who were required to pay for their treatment into accounts under her control.The findings were subsequently referred to the Serious Fraud Office for investigation. The employee was prosecuted and sentenced to 3 years in prison, according to the SFO case study.Unusual workplace behaviour raised further concernsThe investigation also highlighted several warning signs in the employee's conduct that could have attracted attention earlier.One unusual pattern was her reluctance to take time away from work. The SFO reported that she sometimes visited the office on days when she was not scheduled to work or even when she was officially on leave. Such behaviour allowed her to maintain control over tasks and processes that might otherwise have been handled by other employees.She also resisted sharing responsibilities with colleagues. In particular, she insisted that she should be the only person dealing with certain patients. This limited the involvement of other staff members and reduced the chances of someone independently checking her work.Another warning sign involved her communication with patients outside normal working hours. The employee contacted some patients through social media platforms, rather than relying exclusively on the hospital's usual communication channels.The SFO also identified a lack of oversight as an important factor. The employee had considerable control over the payment process, with little supervision or independent checking of the transactions she handled.Together, these behaviours created an environment in which irregular payments and altered records could continue without being noticed for an extended period.The fraud affected patients and hospital staff beyond the financial lossThe SFO reported that the financial loss exceeded $1 million, an amount that could have covered the salaries of 18 graduate nurses.Discovering that a colleague had manipulated internal processes and diverted patient payments affected staff members who were responsible for maintaining the organisation's financial operations.Patients were also placed in a vulnerable position. The employee had misused private information relating to sensitive medical procedures to identify and approach people who were less familiar with the costs associated with their treatment.Because these patients had limited knowledge of what they were required to pay, they could be more easily persuaded to transfer money into accounts presented as legitimate payment destinations.Hospital introduced changes to prevent similar fraudThe Canterbury District Health Board engaged a consultant who examined the existing financial controls and helped develop a new framework to reduce the risk of similar incidents.The hospital also reviewed its payment procedures and stopped accepting cash payments. This change was intended to reduce opportunities for employees to collect money directly from patients, without a record.In addition, the organisation increased internal fraud awareness and communicated information about the appropriate people and channels employees could contact if they suspected wrongdoing.Several measures that organisations can adopt include restricting access to sensitive financial information, introducing automatic systems that record changes to transactions and documents, and ensuring that unauthorised individuals cannot alter official records.You use AI every day. Now get your AI Quotient. Take the AIQ test.