The practice manager who closes payroll has done it for 11 years. She built the spreadsheet that reconciles the timekeeping export to the general ledger. She knows which two pay codes need a manual correction every cycle. She has never missed a deadline.

She is also the only person in the building who can do it, and that is not a compliment. It is a description of a risk the practice is carrying without having priced it.

A risk with no symptoms

Concentration risk is what a practice absorbs when a function depends on a single point — one employee, one credential, one vendor, one site, one machine — with no alternative that has ever been tested. It behaves differently from most operational exposures because it produces no warning signs. A dependency that has never been stressed is indistinguishable from a process that works well.

Which is why it tends to surface on the worst available day: the week the payer file is due, the morning of a survey, the Monday after a resignation. Staff turnover in medical practices has settled into a steadier pattern than it held a few years ago, though steadier is not the same as solved, and the departures that hurt most are rarely the ones a staffing dashboard predicts.¹ Staffing pressure remains the thread running through most of the operational problems practice leaders report.²

Build the inventory before you build the fix

Start with a list rather than a solution. For each function that would be disrupted if one person were unavailable for two weeks, capture five things:

• The function. Specific enough to act on — "submits the month-end payer file," not "billing."
• The dependency. Person, system, vendor, site or device.
• Time to failure. How long absence takes to become an operational problem. Some functions tolerate a month. Refrigerator-temperature escalation tolerates hours.
• The current alternative. Not the theoretical one. Has anyone else actually performed this task in the past year?
• Who decides whether the function gets paused, deferred or handed outside.

Business-continuity practice calls the underlying exercise a business impact analysis: identify the activities that matter, establish what they depend on, and set recovery expectations before an interruption forces the question.³ The vocabulary is heavier than most ambulatory practices need, but the habit is not.

Where to look first

Dependencies cluster in predictable places: Month-end close and payroll. Controlled-substance records and witnessing. Credentialing deadlines and payer enrollment. Vaccine cold-chain monitoring. Refund processing and bank reconciliation. Scheduling-template configuration in the practice-management system. And increasingly, administrative credentials to core systems, where one person holding the only admin login turns an ordinary absence into a lockout.⁴

Vendor and site concentration deserve their own lines. A sole distributor for a critical item, a single clearinghouse, one internet provider with no failover — each is a dependency the practice accumulated rather than chose.

Four responses, and how to choose

Each entry on the list gets one of four treatments.

1. Document it. Cheapest and least durable. A written procedure with screenshots, stored where a covering employee can find it under pressure. Adequate for low-frequency, low-urgency tasks.
2. Cross-train it. A second person performs the task for real, on a schedule — not in a shadowing session. The test is whether the backup has done the work unsupervised in the past two quarters.
3. Split it. Some functions should not sit with one person even when that person is available. The segregation logic that governs purchasing applies equally to closing, refunds and access provisioning.
4. Accept it, with a trigger. Some dependencies are not worth removing in a six-provider group. Accepting one is legitimate when it is an actual decision: named, dated and paired with a threshold that would force reconsideration.

Keep it short and keep it current

An inventory running to 40 lines will not be maintained; 10 to 15 entries, reviewed twice a year and whenever the practice changes shape — a new site, a departure, a vendor switch, a system migration — does more work than a comprehensive document nobody opens.

The question worth asking at each review is narrow and uncomfortable: if this person gave notice tomorrow, what could we not do two weeks from now? Practices that can answer it carry the same risks as everyone else. They have simply chosen which ones.

Notes

1. MGMA HR Insights. "Stabilized but not solved: Staff turnover in medical practices looking no better, no worse in 2026." MGMA. May 28, 2026. https://www.mgma.com/mgma-stat/stabilized-but-not-solved-staff-turnover-in-2026
2. Harrop C. "5 big challenges for medical practices (and why they all tie back to staffing)." MGMA. Aug. 20, 2025. https://www.mgma.com/mgma-stat/5-big-challenges-for-medical-practices
3. International Organization for Standardization. ISO 22301:2019, Security and Resilience — Business Continuity Management Systems — Requirements. https://www.iso.org/standard/75106.html
4. Ealey T, Wilczynski J. "Cybersecurity basics for physician practices." MGMA. Aug. 8, 2025. https://www.mgma.com/articles/cybersecurity-basics-for-physician-practices