Okay, I've read some of the previous posts on lockbox operations but I don't have my answer I'm looking for. We started performing a lockbox service to the local hospital here. We provide all the service internally. We even may at times have to go and pick up the payments from the lockbox if the post office couriers cannot. I'm trying to formulate an audit program and identify the risks and what kinds of controls I'm looking for. We probably will go this route for future customers vs. remote deposit capture. Any help or ideas, sources, compliance issues, etc.? Thanks so much!

A few things come to mind:

Ironclad contract (I would have one approved by bank counsel for lockbox services).

Documenting dual control over the lockbox contents from acquisition at post office through processing.

Procedures for documentation and processing of any cash received.

Procedures for handling other items received (letters, etc.).

Segregation of duties for individuals involved in processing payments vs. account access on internal system/balancing responsibilities.

Because this is a hospital, you will likely receive medical information (i.e. Explanation of Benefits [EOB] forms). You will also be subject to HIPAA requirements.


Al

Thread link.

Al is correct. You should consider HIPAA. See this thread.

Are you recommending dual control from at the post office as well as the whole processing process? What if the post office employee takes a bag from our employee, puts all mail in it, and locks the bag? Ours is a small town post office and they would probalby do this for us.