HHS's and HRSA's Controls Related To Selected Provider Relief Fund Program Requirements Could Be Improved, A-09-21-06001
- Issuer
- Office of Inspector General
- Document type
- Report
- Date
- 2020-12-17
Summary
An audit report by the Department of Health and Human Services Office of Inspector General, Report No. A-09-21-06001, dated September 2022, on HHS and HRSA controls over selected Provider Relief Fund requirements for the Phase 1 General Distribution. The audit covered about $48 billion in payments disbursed to 323,498 Medicare providers from April 10 through December 17, 2020, and tested controls on a random sample of 45 providers. OIG found that procedures did not include verifying estimated revenue losses, subtracting automatic payments to subsidiaries, or a deadline to return rejected payments, and that payment thresholds left only 2 percent of providers for manual review. The report makes five recommendations to HRSA, including reviewing 189 providers, and states that HRSA concurred. An appendix tabulates round 2 payments totaling $17,785,878,517.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cited in: Provider Relief Fund: The Formula That Paid Medicare First
Full text
Department of Health and Human Services
OFFICE OF
INSPECTOR GENERAL
HHS’S AND HRSA’S CONTROLS
RELATED TO SELECTED PROVIDER
RELIEF FUND PROGRAM REQUIREMENTS
COULD BE IMPROVED
Inquiries about this report may be addressed to the Office of Public Affairs at
Public.Affairs@oig.hhs.gov.
Christi A. Grimm
Inspector General
September 2022
A-09-21-06001
Office of Inspector General
https://oig.hhs.gov
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as amended, is
to protect the integrity of the Department of Health and Human Services (HHS) programs, as well as the
health and welfare of beneficiaries served by those programs. This statutory mission is carried out
through a nationwide network of audits, investigations, and inspections conducted by the following
operating components:
Office of Audit Services
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting audits with
its own audit resources or by overseeing audit work done by others. Audits examine the performance of
HHS programs and/or its grantees and contractors in carrying out their respective responsibilities and are
intended to provide independent assessments of HHS programs and operations. These audits help reduce
waste, abuse, and mismanagement and promote economy and efficiency throughout HHS.
Office of Evaluation and Inspections
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide HHS, Congress,
and the public with timely, useful, and reliable information on significant issues. These evaluations focus
on preventing fraud, waste, or abuse and promoting economy, efficiency, and effectiveness of
departmental programs. To promote impact, OEI reports also present practical recommendations for
improving program operations.
Office of Investigations
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations of fraud and
misconduct related to HHS programs, operations, and beneficiaries. With investigators working in all 50
States and the District of Columbia, OI utilizes its resources by actively coordinating with the Department
of Justice and other Federal, State, and local law enforcement authorities. The investigative efforts of OI
often lead to criminal convictions, administrative sanctions, and/or civil monetary penalties.
Office of Counsel to the Inspector General
The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, rendering
advice and opinions on HHS programs and operations and providing all legal support for OIG’s internal
operations. OCIG represents OIG in all civil and administrative fraud and abuse cases involving HHS
programs, including False Claims Act, program exclusion, and civil monetary penalty cases. In
connection with these cases, OCIG also negotiates and monitors corporate integrity agreements. OCIG
renders advisory opinions, issues compliance program guidance, publishes fraud alerts, and provides
other guidance to the health care industry concerning the anti-kickback statute and other OIG enforcement
authorities.
Notices
THIS REPORT IS AVAILABLE TO THE PUBLIC
at https://oig.hhs.gov
Section 8M of the Inspector General Act, 5 U.S.C. App., requires
that OIG post its publicly available reports on the OIG website.
OFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS
The designation of financial or management practices as
questionable, a recommendation for the disallowance of costs
incurred or claimed, and any other conclusions and
recommendations in this report represent the findings and
opinions of OAS. Authorized officials of the HHS operating
divisions will make final determination on these matters.
Report in Brief
Date: September 2022
Report No. A-09-21-06001
Why OIG Did This Audit HHS’s and HRSA’s Controls Related to Selected
The Provider Relief Fund (PRF)
provides funds to eligible hospitals Provider Relief Fund Program Requirements
and other health care providers Could Be Improved
(providers) for health-care-related
expenses or lost revenue attributable
to COVID-19. HHS is responsible for
What OIG Found
In the context of unprecedented challenges from the COVID-19 national
PRF program oversight and policy
emergency, HHS and HRSA developed controls related to selected PRF
decisions, and the Health Resources
program requirements designed to ensure that providers received the correct
and Services Administration (HRSA)
PRF payments from the Phase 1 General Distribution in a fast, fair, and
within HHS provides day-to-day
transparent manner. However, we determined that some of these controls
oversight and management of the
could be improved.
program. Providers that received PRF
payments under the Phase 1 General
We found that HHS and HRSA did not have certain procedures. Specifically,
Distribution are subject to
HHS’s and HRSA’s procedures did not include: (1) requesting and reviewing
requirements for submission of
providers’ supporting documentation to verify the estimated revenue losses in
revenue information and attestation
March and April 2020, (2) subtracting the automatic payments made to
of acceptance or rejection of
providers’ subsidiaries when certain nonautomatic payments were calculated,
payments. This audit is part of OIG’s
and (3) specifying a deadline for providers to return rejected payments. We
oversight of HHS’s COVID-19
also found that HHS’s and HRSA’s procedures had weaknesses. Specifically:
response and recovery efforts.
(1) HHS’s and HRSA’s payment thresholds for manual review of information
submitted by providers were set at a level that resulted in only 2 percent of
Our objective was to determine
providers undergoing manual review, and (2) HRSA’s process to open and view
whether HHS’s and HRSA’s controls
the data file containing subsidiaries’ taxpayer identification numbers
related to selected PRF program
(subsidiary TINs) extracted from providers’ applications led to an error that
requirements (i.e., those related to
caused the use of incorrect subsidiary TINs when payments were calculated.
the requirements for submission of
revenue information and attestation
We understand that HHS and HRSA’s operational objective at the beginning of
of rejection of payments) ensured
the national emergency was to rapidly disburse PRF payments to support
that providers received the correct
providers facing severe economic hardship during the national emergency
payments from the Phase 1 General
because the Coronavirus Aid, Relief, and Economic Security Act required HHS
Distribution.
and HRSA to make payments considering “the most efficient payment systems
practicable to provide emergency payment.” We also understand that because
How OIG Did This Audit of this statutory requirement, HHS and HRSA prioritized rapid disbursement of
Our audit covered about $48 billion payments over the risk of making improper payments, because HHS and HRSA
in PRF payments that were disbursed determined that activities to lower the risk would have delayed the payments.
to 323,498 Medicare providers from However, as HRSA fully implements postpayment quality control review
April 10 through December 17, 2020. processes, it should consider the information and recommendations included in
We performed audit procedures, this report.
including interviewing HRSA officials
and contractors and analyzing In addition, to prepare for a possible public health emergency in the future,
payment and attestation data. To HHS should use the information and recommendations included in this report
test controls, we selected a random when determining lessons learned from administering PRF distributions during
sample of 45 providers.
Report in Brief | Page 1 of 2
Report in Brief
Date: September 2022
Report No. A-09-21-06001
the COVID-19 national emergency, and look for additional ways to safeguard taxpayers’ money when rapidly disbursing
assistance payments to health care providers in response to future national emergencies.
What OIG Recommends and HRSA Comments
We made five recommendations to HRSA, including that HRSA continue to perform postpayment quality control reviews of
selected providers, consider reviewing 189 providers that were identified for manual review, and seek repayment of any
overpayments from providers. We also recommended that HRSA ensure that the HHS Program Support Center collects
payments made to selected providers that did not return their rejected payments as of March 9, 2022. Furthermore, we
recommended that HRSA could conduct a cost-benefit analysis for manual review of additional providers that had the
potential to receive payments below existing payment thresholds and, if the benefit outweighs the cost, it could select
additional providers for review. The full text of our recommendations is shown in the report.
HRSA concurred with all of our recommendations and provided information on actions that it had taken or planned to take
to address our recommendations. These actions included reviewing the 189 providers identified for manual review and
seeking repayments for any overpayments, sending rejected but not returned payments to the Program Support Center for
collection of any outstanding amounts owed, and conducting a cost-benefit analysis for manual review of providers.
Report in Brief | Page 2 of 2
The full report can be found at https://oig.hhs.gov/oas/reports/region9/92106001.asp.
TABLE OF CONTENTS
INTRODUCTION ............................................................................................................................. 1
Why We Did This Audit...................................................................................................... 1
Objective ........................................................................................................................... 2
Background ....................................................................................................................... 3
COVID-19 National Emergency and the Provider Relief Fund ................................ 3
General Distributions Under the Provider Relief Fund .......................................... 4
Provider Relief Fund Program Requirements for Providers ................................... 8
HHS’s and HRSA’s Oversight of the Provider Relief Fund Program ........................ 9
Standards for Internal Control in the Federal Government ................................. 10
HHS’s and HRSA’s Control Activities Related to Selected Provider Relief Fund
Program Requirements ..................................................................................... 11
How We Conducted This Audit........................................................................................ 15
FINDINGS .................................................................................................................................... 16
HHS’s and HRSA’s Controls Did Not Include Certain Procedures To Ensure That
Providers Received the Correct Provider Relief Fund Payments................................... 18
HHS and HRSA Did Not Have Procedures To Request and Review Providers’
Supporting Documentation To Verify Estimated Revenue Losses in
March and April 2020 ....................................................................................... 18
HHS Did Not Have Procedures To Subtract Automatic Payments Made to
Providers’ Subsidiary Organizations When Certain Nonautomatic Payments
Were Calculated ............................................................................................... 20
HHS and HRSA Did Not Have Procedures That Specified a Deadline for
Providers To Return Rejected Payments ........................................................... 22
HHS’s and HRSA’s Procedures To Ensure That Providers Received the Correct
Provider Relief Fund Payments Had Weaknesses ......................................................... 24
HHS’s and HRSA’s Payment Thresholds Were Set at a Level That Resulted in
Only 2 Percent of Providers Undergoing Manual Review for Submitted
Information ....................................................................................................... 24
HRSA’s Process To Open and View the Data File Containing Subsidiary
Organizations’ Taxpayer Identification Numbers Extracted From Providers’
Applications Led to an Error That Caused the Use of Incorrect Numbers
When Payments Were Calculated .................................................................... 27
CONCLUSION............................................................................................................................... 28
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001)
RECOMMENDATIONS.................................................................................................................. 29
HRSA COMMENTS ....................................................................................................................... 30
OTHER MATTERS: METHODOLOGY USED IN CALCULATING PROVIDER RELIEF FUND
PAYMENTS CHANGED OVER TIME FOR THE PHASE 1 GENERAL DISTRIBUTION ....................... 31
APPENDICES
A: Audit Scope and Methodology .................................................................................... 34
B: Round 1 and Round 2 Payments From the Phase 1 General Distribution ................... 37
C: HRSA Comments ......................................................................................................... 39
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001)
INTRODUCTION
WHY WE DID THIS AUDIT
On March 13, 2020, then President Trump declared the COVID-19 outbreak a national
emergency. In response, Congress passed three separate laws to establish the Provider Relief
Fund (PRF) and provide funds to eligible hospitals and other health care providers (providers)
for: (1) health-care-related expenses or lost revenue (e.g., due to canceled elective services)
attributable to COVID-19 and (2) COVID-19 testing and treatment for uninsured individuals. 1
These Federal laws appropriated to the PRF a combined $178 billion in funds, which are
generally distributed as direct payments to providers in a series of General and Targeted
Distributions. 2
The national emergency posed unprecedented challenges to the Department of Health and
Human Services (HHS) to distribute PRF payments in a fast, fair, and transparent manner and
provide immediate financial relief to providers on the front lines of the COVID-19 response.
Within a month of the signing of the first Federal law appropriating funds for the PRF, HHS
developed initial PRF distribution and payment calculation methodologies, PRF requirements
for providers, and oversight procedures designed to help ensure that correct payments were
rapidly disbursed to eligible providers. 3 Then, on April 10, 2020, HHS began distributing PRF
payments to Medicare providers under the Phase 1 General Distribution. As of
December 17, 2020, HHS had distributed about $48 billion to more than 320,000 Medicare
providers. 4
1
The Coronavirus Aid, Relief, and Economic Security Act, P.L. No. 116-136, signed into law on March 27, 2020; the
Paycheck Protection Program and Health Care Enhancement Act, P.L. No. 116-139, signed into law on
April 24, 2020; and the Consolidated Appropriations Act, 2021, P.L. No. 116-260, signed into law on December 27,
2020.
2
Under the General Distributions, PRF payments are distributed in four phases (Phases 1, 2, 3, and 4). For
example, under the Phase 1 General Distribution, PRF payments are distributed to eligible Medicare providers that
billed Medicare fee-for-service (Medicare Parts A or B) in calendar year 2019. Under the Targeted Distributions,
PRF payments are distributed to specific eligible provider types or to providers in areas particularly affected by the
COVID-19 outbreak.
3
HHS refined and updated these methodologies, requirements, and oversight procedures as PRF payments were
being disbursed to providers.
4
The payment data provided by the Health Resources and Services Administration (HRSA) within HHS included
423,644 payments made to 323,498 unique taxpayer identification numbers (TINs) from April 10, 2020, through
December 17, 2020 (our audit period). Throughout this report, we use the term “Medicare billing TINs” to refer to
the TINs that providers entered on Medicare claims. This category of TINs consisted of providers that were
standalone, parent, and subsidiary organizations, each of which could bill Medicare on its own behalf. We use the
term “tax filing TINs” to refer to TINs that providers entered on their Federal income tax or annual information
returns, which included parent organizations that filed returns on behalf of themselves and their subsidiary
organizations. For the purposes of this report, we refer to a provider’s Medicare billing TIN or tax filing TIN as a
“provider.”
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 1
HHS is responsible for PRF program oversight and policy decisions, and the Health Resources
and Services Administration (HRSA) within HHS provides day-to-day oversight and management
of the program. Providers that received PRF payments under the Phase 1 General Distribution
are subject to program requirements, such as the requirements to submit revenue information
and attest to the acceptance or rejection of payments. 5 To ensure that providers received the
correct PRF payments from the Phase 1 General Distribution, HHS and HRSA established
controls related to these requirements. For example, HHS and HRSA developed guidance to
help providers apply for PRF payments and attest to acceptance or rejection of payments they
received.
This audit assessed HHS’s and HRSA’s controls related to the requirements for submission of
revenue information and attestation of rejection of PRF payments disbursed under the Phase 1
General Distribution. These PRF payments were disbursed from April 10 through
December 17, 2020 (audit period). (We refer to these requirements as “selected PRF program
requirements” in this report.) Furthermore, this audit is the first of several Office of Inspector
General (OIG) audits that will examine various aspects of PRF payments, including HHS’s and
HRSA’s controls over payment calculation and provider eligibility, COVID-19 diagnostic testing
and treatment services under HRSA’s COVID-19 uninsured program, and providers’ compliance
with Federal requirements for reporting and using PRF payments. 6
COVID-19 has created extraordinary challenges for the delivery of health care and human
services to the American people. As the oversight agency for HHS, OIG oversees HHS’s
COVID-19 response and recovery efforts. This audit is part of the OIG’s COVID-19 response
strategic plan. 7
OBJECTIVE
Our objective was to determine whether HHS’s and HRSA’s controls related to selected PRF
program requirements ensured that providers received the correct payments from the Phase 1
General Distribution.
5
There are other PRF program requirements, such as the requirement that a provider must not have been
terminated from participation in Medicare.
6
Under the COVID-19 uninsured program, HHS reimbursed health care providers’ claims generally at Medicare
rates for testing uninsured individuals for COVID-19, treating uninsured individuals with a COVID-19 diagnosis, and
administering COVID-19 vaccines to uninsured individuals.
7
OIG’s COVID-19 response strategic plan and oversight activities can be accessed at HHS-OIG's Oversight of
COVID-19 Response and Recovery | HHS-OIG.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 2
BACKGROUND
COVID-19 National Emergency and the Provider Relief Fund
COVID-19 is a disease caused by a highly contagious coronavirus, called SARS-CoV-2. On
January 30, 2020, the World Health Organization (WHO) declared the COVID-19 outbreak a
Public Health Emergency of International Concern and on March 11, 2020, the WHO
characterized COVID-19 as a pandemic. 8 Later, on March 13, 2020, then-President Trump
declared the COVID-19 outbreak a national emergency.
In response to the national emergency, Congress passed three separate laws to establish the
PRF and provide funds to eligible hospitals and other health care providers for: (1) health-care-
related expenses or lost revenue attributable to COVID-19 and (2) COVID-19 testing and
treatment for uninsured individuals. 9 The PRF program received a combined $178 billion in
funding from the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which was signed
into law on March 27, 2020; the Paycheck Protection Program and Health Care Enhancement
Act, which was signed into law on April 24, 2020; and the Consolidated Appropriations
Act, 2021, which was signed into law on December 27, 2020. 10 Under the CARES Act, Congress
directed that PRF payments be distributed to “eligible healthcare providers” using the “most
efficient payment systems practicable to provide emergency payment.”
Because of the unprecedented national emergency, HHS faced substantial challenges in
distributing PRF payments in a fast, fair, and transparent manner to provide immediate
financial relief to providers on the front lines of the COVID-19 response. Within a month of the
signing of the first Federal law appropriating funds for the PRF, HHS developed initial PRF
distribution and payment calculation methodologies, PRF requirements for providers, and
oversight procedures designed to help ensure that correct payments were rapidly disbursed to
eligible providers. HHS refined and updated these methodologies, requirements, and oversight
procedures as PRF payments were being disbursed to providers.
8
A pandemic is an epidemic that has spread over several countries or continents, usually affecting many people.
An epidemic is an increase, often sudden, in the number of cases of a disease above what is normally expected in a
population in a specific area.
9
According to HHS’s Instructions for the Distribution for Medicaid, CHIP, and Dental Providers Via Enhanced
Provider Relief Fund Payment Portal, “lost revenue attributable to COVID-19” means “the amount of any patient
care revenue that you as a healthcare provider lost due to coronavirus, net of any increased revenues due to
coronavirus (e.g., insurance reimbursed treatment).” This revenue may include revenue losses associated with
fewer outpatient visits or canceled elective procedures or services. (In August 2020, HRSA removed from the
instructions the field for lost revenue and the definition of “lost revenue attributable to COVID-19.”)
10
Congress appropriated $8.5 billion of COVID-19-related relief for rural providers that are enrolled in the
Medicare or Medicaid programs (American Rescue Plan Act of 2021, P.L. No. 117-2). This funding is administered
by HRSA and has similar limitations and requirements as the PRF but is not part of the PRF.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 3
General Distributions Under the Provider Relief Fund
To support providers facing severe economic hardship that affected their ability to respond to
emerging health crises and to prevent the loss of life during the national emergency, HHS
allocated most of the PRF funds in a series of General and Targeted Distributions.
For the General Distributions, HHS initially allocated $109.5 billion to providers in four phases: 11
• $50 billion under Phase 1 for eligible providers that billed Medicare fee-for-service (FFS);
• $18 billion under Phase 2 for Medicaid and Children’s Health Insurance Program (CHIP)
providers, dental providers, and assisted living facilities; 12
• $24.5 billion under Phase 3 for:
o behavioral health providers that were not previously eligible for the General
Distribution and
o previously eligible providers with losses or incurred expenses during the first half
of calendar year 2020; 13 and
• $17 billion under Phase 4 for eligible providers with losses or incurred expenses from
July 1, 2020, through March 31, 2021. 14
Phase 1 General Distribution Under the Provider Relief Fund
There were two rounds of the Phase 1 General Distribution under the PRF: 15
• Round 1 (Automatic Payments). Beginning on April 10, 2020, round 1 payments were
distributed to providers. About $30.2 billion in payments were distributed automatically
11
These providers consisted of for-profit and not-for-profit organizations.
12
Providers that received previous PRF payments under the Phase 1 General Distribution may have been eligible to
apply for Phase 2 payments.
13
Providers that received previous PRF payments under the Phase 1 or Phase 2 General Distributions may have
been eligible to apply for Phase 3 payments.
14
According to HRSA, allocations changed over time when funding was not fully obligated under the initial
allocation. For example, the allocated funds in Phase 2 changed from $18 billion to $5.1 billion because HHS
received less than $18 billion in requests for funding from eligible applicants. As a result, as of January 6, 2022,
about $86.3 billion of the initial $109.5 billion was allocated for the General Distributions.
15
For each round of the Phase 1 General Distribution, HHS and HRSA assigned a “wave” and “subwave” number to
a group of payments based on the payment issuance date.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 4
to 322,854 providers under waves 1 through 3, for which the providers did not need to
apply or submit documentation (e.g., Federal income tax returns) in advance of
receiving these payments. 16 We refer to these payments as “automatic payments.”
• Round 2 (Automatic and Nonautomatic Payments). Beginning on April 24, 2020, round 2
payments were distributed to providers. First, about $9.2 billion in automatic payments
were distributed to 14,834 providers under wave 4 based on revenue data from
providers’ Medicare cost reports on file with the Centers for Medicare & Medicaid
Services (CMS). 17 Second, about $8.6 billion in payments were distributed to 85,956
providers under waves 5 and 13 based on completed applications submitted through
HHS’s online application portal (i.e., nonautomatic payments). 18 In total, as of
December 17, 2020, about $17.8 billion in round 2 payments had been distributed to
100,790 providers. 19
As of December 17, 2020, a total of about $48 billion had been distributed to 323,498 Medicare
providers. 20 Appendix B shows the distribution date, total number of taxpayer identification
numbers (TINs), and total PRF payments distributed for each wave and subwave under round 1
and round 2 payments from the Phase 1 General Distribution.
Figure 1 on the next page illustrates how payments under the Phase 1 General Distribution
were disbursed in two rounds and the designated waves and subwaves.
16
HHS and HRSA assigned waves 1 through 3 and their related subwaves 1a, 1b, 2a, and 3a to round 1 payments
under the Phase 1 General Distribution.
17
Wave 4 did not have any related subwaves.
18
HHS and HRSA assigned waves 5 and 13 and their related subwaves 5a through 5p and 13a through 13i to
round 2 payments under the Phase 1 General Distribution. Waves 6 through 12 were assigned to payments for
other distributions. For example, wave 8 was assigned to payments for the Phase 2 General Distribution.
19
As of January 6, 2022, the payment distribution for round 2 was still ongoing.
20
The payment data for the Phase 1 General Distribution, provided by HRSA, included 423,644 payments made to
323,498 provider TINs (either Medicare billing TINs or tax filing TINs). Each provider, represented by a TIN, may
receive more than one payment.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 5
Figure 1: Disbursement of Payments Under Phase 1 General Distribution in Two Rounds
and the Designated Waves and Subwaves
Calculation of Payments Under the Phase 1 General Distribution
The HHS Immediate Office of the Secretary (IOS) calculated the payments for waves 1 through 4
(automatic payments) and subwaves 5a through 5c (nonautomatic payments). 21 HRSA, through
one of its contractors, calculated the payments for subwaves 5d through 5p (nonautomatic
payments) and subwaves 13a through 13i (nonautomatic payments).
Round 1 payments (i.e., waves 1 through 3) were determined using the providers’
proportionate share of Medicare FFS reimbursements in 2019. Round 2 payments (i.e., waves
4, 5, and 13) were generally determined based on the lesser of: (1) 2 percent of a provider’s
2018 or most recent complete tax year’s gross receipts or (2) the sum of estimated revenue
losses in March and April 2020. 22 If a provider received a round 1 payment equal to or more
than 2 percent of its 2018 or most recent complete tax year’s gross receipts, the provider could
not receive a round 2 payment. 23
Figure 2 on the next page shows the overall payment calculation methodology for round 1 and
round 2 payments.
21
IOS is responsible for operations and coordination of the work of the Secretary of HHS.
22
According to HRSA, only patient care revenues from providing diagnoses, testing, or care for individuals with
possible or actual cases of COVID-19 may be included in the gross receipts.
23
It is possible that a provider may have received a payment of more than 2 percent of its 2018 gross receipts
because round 1 payments were based on the share of Medicare FFS reimbursements in 2019.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 6
Figure 2: Overall Payment Calculation Methodology for Round 1 and Round 2 Payments
Figure 3 on the next page shows an example of how HHS and HRSA calculated a provider’s
round 2 payment.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 7
Figure 3: Example of a Provider’s Payment Calculation for a Round 2 Payment
Provider Relief Fund Program Requirements for Providers
Providers receiving PRF payments must meet PRF program requirements, such as submitting
revenue information and attesting to the acceptance or rejection of PRF payments. 24
Requirement for Submission of Revenue Information
Providers are required to submit general revenue data for calendar year 2018 when applying to
receive a round 2 payment (i.e., nonautomatic payment).
Requirement for Attestation of Acceptance or Rejection of Payments
Providers formally acknowledge (i.e., attest to) acceptance or rejection of a payment through
the online attestation portal. 25 If a provider chooses to keep the payment, the provider can:
24
There are other PRF requirements, such as the requirement that a provider must not have been terminated from
participation in Medicare. Furthermore, each phase of the General Distribution has its own provider-eligibility
requirement. For example, to be eligible for a Phase 1 General Distribution payment, providers must have billed
Medicare FFS (Parts A or B) in calendar year 2019.
25
The attestation portal is an online portal that guides providers through the attestation process to accept or
reject their PRF payments. UnitedHealth Group, a HRSA contractor, designs and maintains the attestation portal.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 8
(1) attest to being eligible for the payment by acknowledging acceptance of the payment and
(2) accept the terms and conditions of the payment. (This is referred to as “active attestation.”)
If a provider chooses to reject the payment, it can do so through the attestation portal by
attesting, “I am not accepting payment and I will either destroy the check or refund the full
amount . . .” and clicking the “I Reject Payment” button. Furthermore, the provider is given
instructions on how to return the rejected payment. A provider that received a PRF payment
and kept it for at least 90 days without performing active attestation of the payment or
rejecting the payment is deemed to have attested to accepting both the payment and its
associated terms and conditions. This is referred to as “deemed attestation.”
HHS’s and HRSA’s Oversight of the Provider Relief Fund Program
The HHS Office of the Secretary is responsible for PRF program oversight and policy decisions so
that the program can meet its mission to distribute funds as quickly as possible for providers’
health-care-related expenses or lost revenue attributable to COVID-19. Within HHS, HRSA is
responsible for providing day-to-day oversight and management of all aspects of the PRF
program. 26
At the start of the Phase 1 General Distribution (i.e., in early April 2020), HHS and HRSA
developed prepayment validation processes to help ensure that correct payments were
disbursed to eligible providers. 27 For example, HRSA would determine whether providers were
included in several sanctions lists (e.g., CMS’s list of individuals or entities that are currently
barred from participation in Medicare and OIG’s list of individuals and entities excluded from
participation in Federal health care programs). If the providers were included on any of these
lists, HRSA would remove them from the payment files used to disburse payments to providers.
Furthermore, on December 14, 2020, HRSA developed a postpayment manual to outline
postpayment quality control review processes to help verify that providers had received correct
payments and to recover any overpayments. 28 The manual stated that because “payment
inaccuracies and full provider eligibility data may not have been available at the time of
payment and is now available during the post-payment period,” HRSA would: (1) review
application information, payment calculations, and source data (e.g., data that included prior
payments made to providers) to identify errors in payments that were disbursed to providers;
(2) reassess provider eligibility and improper payments; and (3) recover an overpayment that
26
HHS and HRSA, PRF General & Targeted Distribution Cycle Memo, dated September 30, 2020.
27
HHS had prepayment validation processes for payments made under waves 1 through 4 (automatic payments)
and subwaves 5a through 5c (nonautomatic payments). HRSA had prepayment validation processes for payments
made under subwaves 5d through 5p and wave 13 (nonautomatic payments).
28
Post-Payment Manual—Post-Payment Matrix, Quality Control Review (QCR), and Post-Payment QCR Recovery
Standard Operating Procedures (SOP). From December 14, 2020, through September 22, 2021, HRSA revised this
manual 14 times.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 9
exceeded a threshold of $10,000. 29, 30 The manual also stated that HRSA’s assessment would
include reviews of data submitted by providers to confirm that PRF payments were used in
accordance with the terms and conditions. 31
HRSA received support from contractors for overseeing the PRF program. For example,
Acumen, LLC, calculated payments and prepared payment files for HRSA’s use, and
UnitedHealth Group processed and disbursed payments.
Standards for Internal Control in the Federal Government
Federal agencies, including HHS and HRSA, are required to comply with the Government
Accountability Office’s (GAO’s) Standards for Internal Control in the Federal Government (Green
Book). Internal control is a process that management uses to help an entity achieve its
objectives. GAO’s standards provide criteria for designing, implementing, and operating an
effective internal control system. Among other requirements, an agency must design control
activities to achieve objectives and respond to risks. 32
The Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility
for Enterprise Risk Management and Internal Control (July 15, 2016), page 28, states:
When determining risk tolerance in disaster situations, managers weigh the
program’s operational objective of expeditiously providing assistance against the
objective of lowering the likelihood of fraud, because activities to lower fraud
risks—such as the risk that ineligible individuals submit fraudulent applications
for benefits—[cause] delays in service. As a result, managers are willing to
accept a somewhat higher risk of fraud than under normal circumstances in
order to provide emergency assistance in a timely manner.
In addition, Government Auditing Standards, known as the Yellow Book (2018 revision,
paragraph 8.75), states that in some circumstances, certain conditions could indicate a
heightened risk of fraud. Examples of these conditions include when management is willing to
29
According to the manual, an improper payment is defined as any payment that should not have been made or
that was made in an incorrect amount (including overpayments and underpayments).
30
If HRSA identified an overpayment that exceeded a threshold of $10,000, it notified the provider to initiate
repayment of the overpayment. If a payment was made to an ineligible provider, HRSA would seek repayment for
a payment greater than $100, or if a provider rejected a payment, HRSA would seek repayment for the entire
payment even if it was less than $10,000.
31
Providers that received one or more payments that exceeded $10,000 in aggregate during the established
reporting period were required to report on their use of PRF payments using their normal basis of accounting (e.g.,
cash basis). For example, providers that received payments from April 10 through June 30, 2020, were required to
report during period 1 (July 1 through September 30, 2021), with a grace period through November 30, 2021.
32
Green Book, “Control Activities,” paragraph 10.01.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 10
accept unusually high levels of risk in making significant decisions or the nature of the entity’s
operations provide opportunities to engage in fraud.
HHS’s and HRSA’s Control Activities Related to Selected Provider Relief Fund Program
Requirements
Within a month from the national emergency declaration, HHS and HRSA established several
control activities related to submission of revenue information and attestation of acceptance or
rejection of payments. 33, 34 Specifically, they developed: (1) guidance; (2) application and
attestation portals; and (3) procedures for calculating payments, verifying information
submitted by providers, and collecting overpayments, rejected payments, or other repayments
from providers. 35, 36
Guidance
HHS and HRSA developed the following guidance:
• Provider Relief Programs: Provider Relief Fund and American Rescue Plan Rural
Payments Frequently Asked Questions (PRF FAQs): The PRF FAQs were developed to
help providers apply for PRF payments and attest to acceptance or rejection of
payments they received. 37 For example, the PRF FAQs stated that a provider should
submit an application to request nonautomatic payments under the Phase 1 General
Distribution. 38 The PRF FAQs included instructions for providers to provide the
following four pieces of information:
o the provider’s “Gross Receipts or Sales” or “Program Service Revenue” as
submitted on its Federal income tax return,
33
According to HRSA, during 2020 many providers had to close their businesses and, as a result, the ability of
providers to get information needed to apply for the PRF was hampered. In addition, HRSA’s efforts to obtain and
assess this information in real time was significantly hampered, especially as the number of PRF payments
increased over time.
34
HHS and HRSA continued to refine and update these control activities as the PRF payments were being disbursed
to providers.
35
HHS allocates returned payments to future distributions of the PRF.
36
Other repayments included unspent funds as a result of HRSA’s assessment of whether providers used PRF
payments for COVID-19-related expenses.
37
According to HRSA, the first version of the PRF FAQs was publicly available on HRSA’s website on April 25, 2020.
The title and the content of these FAQs changed over time. The title of the first version was “General Distribution
Portal FAQs,” and the content has been continuously updated as PRF payments have been disbursed to providers.
38
For those providers who received the automatic payments, HHS sent an email informing them to submit an
application for additional payments (i.e., nonautomatic payments).
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 11
o the provider’s estimated revenue losses in March and April 2020 due to
COVID-19,
o a copy of the provider’s most recently filed Federal income tax return, 39 and
o a list of the TINs for any of the provider’s subsidiary organizations that received
relief funds but did not file separate Federal income tax returns. 40
• PRF General & Targeted Distribution Cycle Memo: This memo identified key processes
and controls related to disbursement of the General and Targeted Distributions. For
example, one key process was the payment rejection and return process. According to
the memo, each rejected and returned transaction through the Automated Clearing
House (ACH) includes a specific “reject and return reason code” (i.e., an R code) and a
description of the code (e.g., “R23: Credit Entry Refused by Receiver”). 41 If a return with
an R23 code was made, HRSA’s contractor Optum Bank contacted the provider and
confirmed whether the provider intentionally rejected the payment. If the provider
confirmed that it wanted to reject the payment, Optum Bank validated the integrity of
the returned transaction by matching the provider’s TIN with the TIN identified on a
transaction returned through the ACH to make sure that the return was correct and
identified the transaction with the R23 code in the payment file.
Application and Attestation Portals
Under the direction of HHS and HRSA, UnitedHealth Group developed the application and
attestation portals to facilitate the collection of information from providers during the
application and attestation processes. Table 1 on the next page lists the application and
attestation portals used for the Phase 1 General Distribution.
39
Although HRSA requested that providers submit copies of their Federal income tax returns, it requested that
not-for-profit organizations submit their annual information returns (Internal Revenue Service Form 990, Return of
Organization Exempt From Income Tax).
40
These organizations are accounted for in the parent organization’s tax filing.
41
ACH is the primary system used for transfers of electronic funds between financial institutions and allows
payments to be made online.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 12
Table 1: Application and Attestation Portals for the Phase 1 General Distribution*
Deployment
Portal Name Date Other Names Purpose
CARES Act PRF 4/13/2020 Attestation Portal 1.0 To allow providers to attest to
Attestation Portal acceptance or rejection of a
payment.
General 4/27/2020 Portal 1.0 To allow providers to apply for
Distribution Portal payments under wave 5.
CARES Act PRF
Application Portal
PRF Application 6/9/2020 Portal 2.0 To allow providers to: (1) apply
and Attestation for payments under wave 13
Portal and (2) attest to acceptance or
rejection of a payment.†
PRF Application 10/5/2020 Portal 3.0 To allow providers to: (1) apply
and Attestation for payments under wave 13
Portal and (2) attest to acceptance or
rejection of a payment.‡
*
According to HRSA, these portals and phases had different payment methodologies and expanded eligibility
criteria to support distribution of funds to a broader group of providers and took into account “changing dynamics
on the ground.”
†
This portal replaced Attestation Portal 1.0 and Portal 1.0 and also allowed providers to apply for payments under
Phase 2 of the General Distributions.
‡
This portal replaced Portal 2.0 and also allowed providers to apply for payments under Phases 2 and 3 of the
General Distributions.
The application and attestation portals guided providers when they applied for additional
payments or attested to accepting or rejecting payments. For example, for the providers’
Medicare billing TINs in Attestation Portal 1.0 or tax filing TINs in Portal 2.0, providers were
asked to enter the last six digits of their bank account numbers and the payment amounts that
were disbursed to providers using these TINs. Providers were then asked to review the
information for each TIN and click either “Review and Accept” or “Reject” for each payment. If
“Review and Accept” was clicked, the provider was asked to check the box acknowledging
receipt of the payment and agreeing to the PRF terms and conditions. If “Reject” was clicked,
the provider was given instructions on how to return the payment.
Procedures for Calculating Payments, Verifying Information Submitted by Providers, and
Collecting Overpayments or Rejected Payments From Providers
HRSA developed procedures for calculating PRF payments; verifying information submitted by
providers on applications (i.e., manual review); and collecting overpayments, rejected
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 13
payments, or other repayments from providers. HRSA hired contractors to support HRSA in
carrying out these procedures: 42
• Acumen: Acumen implemented the PRF payment calculation methodologies developed
by HHS and developed payment files for HRSA’s use. It calculated payments for
subwaves 5d through 5p and wave 13. 43 Acumen developed and provided the payment
files to and for approval by HRSA, which then sent the payment files to UnitedHealth
Group and Optum Bank to direct disbursement of payments to providers. 44
Acumen also implemented the validation methodology, which HHS and HRSA
developed, to identify: (1) characteristics that would preclude a provider from receiving
payments or (2) an application as requiring manual review. For example, if a provider
had the potential to receive more than $2 million under wave 5 or more than $1 million
under wave 13, the provider was identified for manual review by other contractors
(i.e., McKinsey & Company or CliftonLarsonAllen). 45
• McKinsey & Company: For providers that Acumen identified as having the potential to
receive more than $2 million under subwaves 5b and 5c, McKinsey & Company verified
the revenue information included in a provider’s application by manually reviewing
documentation submitted by the provider to support the information. 46 For example,
McKinsey & Company confirmed that the provider’s submitted documentation was an
approved document (e.g., the Federal income tax return). Furthermore, for providers
that Acumen identified as having the potential to receive more than $2 million under
subwaves 5d through 5p and more than $1 million under subwaves 13a through 13i,
McKinsey & Company prepared a list of those providers and submitted the list to
CliftonLarsonAllen for manual review.
• CliftonLarsonAllen: For the providers on the list from McKinsey & Company,
CliftonLarsonAllen verified the revenue information on each application by manually
42
HHS, IOS, requested that the Office of the Assistant Secretary for Planning and Evaluation (ASPE) use ASPE’s
existing contract with Acumen to initially support HHS’s work for the PRF distribution. Acumen’s work was
subsequently moved to a contract directly with HRSA in June 2020.
43
HRSA stated that an official from the Council of Economic Advisers (an agency within the Executive Office of the
President), who was on detail to HHS, IOS, was involved in calculating and disbursing PRF payments for waves 1
through 4 and subwaves 5a through 5c.
44
Acumen issued methodology memos to document its process for developing the payment files, which included
the calculation of payments.
45
HHS and HRSA set these payment thresholds for manual review of submitted information.
46
Payments to providers that Acumen identified as having the potential to receive more than $2 million under
subwave 5a were not included as part of HHS IOS’s calculation of payments. The list of providers was submitted to
CliftonLarsonAllen for manual review.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 14
reviewing documentation submitted by the provider to support the information. For
example, if the amount reported on the application was above the established threshold
(e.g., a provider’s reported gross receipts on the application was more than the
established percentage of the reported gross receipts on the Federal income tax return),
the application was not processed for payment. HHS and HRSA required that the
provider resubmit its revenue information and include supporting documentation to be
considered for an additional payment.
• HHS’s Program Support Center: The Program Support Center (PSC) performed activities
related to collecting overpayments, rejected payments, or other repayments from
providers. 47 For example, HRSA set up a procedure to send to PSC a list of the providers
that had not returned their rejected payments for recovery.
HOW WE CONDUCTED THIS AUDIT
Our audit covered about $48 billion in PRF payments that were disbursed to 323,498 providers
from April 10 through December 17, 2020. 48 We obtained from HRSA the payment and
attestation data for our audit period.
HHS and HRSA’s control objective was to ensure that providers received the correct PRF
payments from the Phase 1 General Distribution in a fast, fair, and transparent manner. We
assessed the design and implementation of HHS’s and HRSA’s controls that were related to
selected PRF program requirements (i.e., for the submission of revenue information and
attestation of rejection of payments) and determined whether these controls achieved the
control objective by:
• performing audit procedures, which included conducting interviews with HRSA officials
and HRSA contractors, reviewing the guidance developed by HHS and HRSA (i.e., the PRF
FAQs and the PRF General & Targeted Distribution Cycle Memo), reviewing screenshots
of the steps from the application and attestation portals, reviewing Acumen’s
methodology memos on calculating payments, and analyzing payment and attestation
data (e.g., identifying rejected and returned payments); and
• testing the controls by selecting a random sample of 45 providers that kept all their
payments, totaling $194.1 million, to determine whether the reported revenue
47
According to HRSA, a Memorandum of Understanding with PSC was signed and effective November 18, 2020.
48
The last date that providers attested to acceptance or rejection of these payments was December 19, 2020.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 15
information on each provider’s application was supported by documentation (e.g.,
Federal income tax returns). We reviewed 40 of the 45 sampled providers. 49
We did not assess HHS’s and HRSA’s controls for providers’ attestation of acceptance of
payments, because a provider was allowed to make a deemed attestation (i.e., the provider
was not required to make an active attestation) that it was eligible for a payment and that it
was accepting the terms and conditions of the payment.
Because this audit assessed HHS’s and HRSA’s controls related to selected PRF program
requirements, we did not determine whether the payments made to providers were correct or
incorrect. Although we determined for each finding the amount of the payments made to
providers (i.e., the potential effect), we could not conclusively determine that these payments
were correct or incorrect, because payment calculations for future distributions of the PRF may
take previous payments into account. 50
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
Appendix A describes our audit scope and methodology.
FINDINGS
In the context of unprecedented challenges from the COVID-19 national emergency, HHS and
HRSA developed controls related to selected PRF program requirements designed to ensure
that providers received the correct PRF payments from the Phase 1 General Distribution in a
fast, fair, and transparent manner. However, we determined that some of these controls could
be improved.
To ensure that providers received the correct PRF payments from the Phase 1 General
Distribution, HHS and HRSA developed the PRF guidance; application and attestation portals;
and procedures for calculating PRF payments, verifying revenue information submitted by
providers, and collecting overpayments, rejected payments, or other repayments from
providers. However, HHS’s and HRSA’s procedures may not have ensured that all providers
49
In general, we reviewed providers that submitted an application for nonautomatic payments and made an active
attestation or a deemed attestation of acceptance of all payments (automatic and nonautomatic payments). Of
the 45 sampled providers, we did not review 5 providers because these providers received only automatic
payments and did not apply for additional payments (nonautomatic payments) during our audit period. There
were no applications or supporting documentation to review.
50
OIG has planned audits that include an objective to identify improper payments.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 16
received the correct PRF payments from the Phase 1 General Distribution because these
procedures did not include:
• requesting and reviewing providers’ supporting documentation to verify the estimated
revenue losses in March and April 2020,
• subtracting the automatic payments made to providers’ subsidiary organizations when
certain nonautomatic payments were calculated, and
• specifying a deadline for providers to return rejected payments.
According to HRSA officials, they, along with HHS, did not want to overburden providers by
requesting supporting documentation for March and April 2020 estimated revenue losses that
may not have been accessible (because of a provider’s office closure or quarantine due to
COVID-19). In addition, during the early implementation of the PRF program, it was not
apparent to HRSA that it needed to provide additional guidance to encourage the timely return
of funds by providers that rejected the payments.
We also determined that some providers may not have received the correct PRF payments
from the Phase 1 General Distribution because certain HHS and HRSA procedures had
weaknesses. Specifically, HHS’s and HRSA’s payment thresholds for manual review of
information submitted by providers were set at a level that resulted in only 2 percent of
providers undergoing manual review. In addition, HRSA’s process to open and view the data
file containing subsidiary organizations’ taxpayer identification numbers (subsidiary TINs)
extracted from providers’ applications led to an error that caused the use of incorrect
subsidiary TINs when payments were calculated. According to HRSA, it established payment
thresholds for manual review based on its risk tolerance given the unprecedented public health
emergency (i.e., HRSA’s willingness to accept a somewhat higher risk of improper payments
than under normal circumstances). HRSA also stated that establishing a comprehensive review
of submitted information from all providers would have delayed the PRF payments, which were
intended to prevent severe disruption to the Nation’s health care system.
Because HHS and HRSA did not have certain procedures and had weaknesses in other
procedures, some providers may not have received the correct PRF payments. Furthermore,
the allocation of returned payments to future PRF distributions may have been delayed.
We understand that HHS and HRSA’s operational objective at the beginning of the national
emergency was to rapidly disburse PRF payments to support providers facing severe economic
hardship during the national emergency because the CARES Act required HHS and HRSA to
make payments considering “the most efficient payment systems practicable to provide
emergency payment.” We also understand that because of this statutory requirement, HHS
and HRSA prioritized the rapid disbursement of payments over the risk of making improper
payments because HHS and HRSA determined that activities to lower the risk would have
delayed the payments. However, as HRSA fully implements postpayment quality control review
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 17
processes, it should consider the information and recommendations included in this report. For
example, the established payment thresholds for manual review may have been reasonable at
the beginning of the national emergency; however, they were set at a level that resulted in only
2 percent of providers undergoing manual review. HRSA could conduct a cost-benefit analysis
for manual review of additional providers and, if the benefit outweighs the cost, HRSA could
select additional providers for review.
In addition, to prepare for a possible public health emergency in the future, HHS should use the
information and recommendations included in this report when determining lessons learned
from administering PRF distributions during the COVID-19 national emergency, and look for
additional ways to safeguard taxpayers’ money when rapidly disbursing assistance payments to
health care providers in response to future national emergencies.
HHS’S AND HRSA’S CONTROLS DID NOT INCLUDE CERTAIN PROCEDURES TO ENSURE THAT
PROVIDERS RECEIVED THE CORRECT PROVIDER RELIEF FUND PAYMENTS
HHS’s and HRSA’s controls related to submitted revenue information and attestation of
rejection of payments may not have ensured that certain providers received the correct
payments because HHS’s and HRSA’s procedures did not include: (1) reviewing providers’
supporting documentation to verify the estimated revenue losses in March and April 2020,
(2) subtracting the automatic payments made to providers’ subsidiary organizations when
certain nonautomatic payments were calculated, and (3) specifying a deadline for providers to
return rejected payments.
Without these procedures, there was a risk that providers may have received incorrect
payments.
HHS and HRSA Did Not Have Procedures To Request and Review Providers’ Supporting
Documentation To Verify Estimated Revenue Losses in March and April 2020
HHS and HRSA developed the following control activities for submission of revenue information
to ensure that providers received the correct PRF payments:
• Providers were requested to provide the following information through the application
portal: (1) a provider’s “Gross Receipts or Sales” or “Program Service Revenue” (i.e.,
revenue) as reported on the provider’s Federal income tax return, (2) the provider’s
estimated revenue losses in March and April 2020 due to COVID-19, and (3) a copy of
the provider’s most recently filed Federal income tax return. 51 The reported revenue or
estimated revenue losses were used to calculate payments disbursed to providers under
wave 5, and the copy of the Federal income tax return was used to verify the reported
revenue information on a provider’s application.
51
HHS and HRSA required providers to submit audited financial statements or management-prepared financial
statements to support the reported revenue if providers’ Federal income tax returns were not available.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 18
• Providers that had the potential to receive more than $2 million in payments under
wave 5 were identified for manual review. The manual review included comparing the
revenue reported on the provider’s application with the gross receipts reported on the
Federal income tax return and determining the reasonableness of the provider’s
reported revenue.
However, HHS and HRSA did not have procedures to request and review providers’ supporting
documentation to verify the estimated revenue losses in March and April 2020 when
calculating providers’ payments based on the estimated revenue losses under wave 5.
Although the application and attestation portals collected the providers’ estimated revenue
losses for these months, and providers were notified by email to resubmit their applications if
those losses met certain characteristics, HHS and HRSA did not require providers to submit
supporting documentation for the estimated revenue losses. As a result, HHS and HRSA were
unable to verify those losses.
Of the 3,834 providers whose payments were calculated based on their estimated revenue
losses in March and April 2020 under wave 5, 3,767 providers attested to acceptance of
payments and kept payments of about $756 million. 52 HHS and HRSA disbursed payments to
these providers without requesting that they submit supporting documentation. Furthermore,
of the 3,767 providers, 189 were identified for manual review because they had the potential to
receive more than $2 million in payments under wave 5. These 189 providers attested to
acceptance of payments and kept a total of $538 million. 53 However, the providers’ reported
estimated revenue losses were not verified with supporting documentation because HHS and
HRSA did not have supporting documentation to use for verification. 54
According to HRSA, HRSA was required by statute to rapidly distribute funds to providers.
Therefore, HRSA did not want to overburden providers by requesting supporting
documentation that may not have been accessible because of a provider’s office closure or
quarantine due to COVID-19 and by creating obstacles or delays in receiving PRF payments.
Additionally, HRSA took into account that providers may not have known what their estimated
revenue losses would amount to at the start of the pandemic and that they needed time to
calculate their estimated revenue losses.
52
The unrounded amount is $755,624,100.
53
The unrounded amount is $537,985,907.
54
If it is not feasible to review all 3,767 providers that attested to acceptance of payments and kept the payments
based on the estimated revenue losses in March and April 2020 under wave 5, HRSA could consider reviewing
189 providers that were identified for manual review and attested to acceptance of payments and kept a total of
$538 million, which was about 71 percent of the $756 million. HRSA could also conduct a cost-benefit analysis for
the manual review of additional providers and, if the benefit outweighs the cost, it could select additional
providers for review.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 19
Because HHS and HRSA did not have procedures to request and review providers’ supporting
documentation to verify the estimated revenue losses in March and April 2020, there was a risk
that some providers may have received incorrect payments that were calculated using incorrect
estimated revenue losses.
HHS Did Not Have Procedures To Subtract Automatic Payments Made to Providers’ Subsidiary
Organizations When Certain Nonautomatic Payments Were Calculated
HHS developed the following control activities to prevent providers that file Federal income tax
returns covering multiple legal entities (e.g., parent organizations that include their subsidiary
organizations’ revenue information in their consolidated tax returns) from being overpaid:
• HHS requested that providers with subsidiary organizations report during the
application process the TINs of subsidiary organizations that received payments but did
not file separate Federal income tax returns.
• When calculating round 2 payments (i.e., waves 4, 5, and 13), HHS developed a payment
calculation methodology that would generally prevent a provider from receiving a
payment if round 1 payments (including payments to the provider’s subsidiary
organizations) were equal to or more than 2 percent of the provider’s gross receipts.
• HRSA’s payment calculation methodology for subwaves 5d through 5p and subsequent
wave 13 included subtracting automatic payments that providers’ subsidiary
organizations received under waves 1 through 4.
However, HHS did not have procedures to subtract the automatic payments made under waves
1 through 4 to providers’ subsidiary organizations when nonautomatic payments under
subwaves 5a through 5c were calculated. 55, 56
Of the 22,645 providers that attested to acceptance of payments and kept all of their payments
under subwaves 5a through 5c, 315 providers had 476 subsidiary organizations that received
payments totaling $46.5 million under waves 1 through 4 and did not file their own Federal
55
According to Acumen, this issue was identified after disbursing the wave 5 payments and HRSA began to
establish a postpayment quality control process to resolve the issue. Furthermore, Acumen officials stated that
the overpayments would most likely be taken into account when calculating payments under the Phase 3 General
Distribution (i.e., the Phase 3 “true-up” process). We verified that this issue is being resolved through the
established postpayment quality control review process.
56
Based on Acumen’s document describing its payment calculation methodology, we confirmed that the payments
made under waves 1 through 4 to a provider’s subsidiary organization were subtracted when calculating a
provider’s payments under subwaves 5d through 5p and subwaves 13a through 13i.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 20
income tax returns. 57 However, HHS did not subtract $46.5 million in payments when it
calculated the payments disbursed under subwaves 5a through 5c to these 315 providers.
Because HHS did not have procedures to subtract these payments, the 315 providers received
$46.5 million more than they should have.
Figure 4 shows an example of the effect of not subtracting a payment made under wave 1 to a
provider’s subsidiary organization when calculating the provider’s subsequent payment under
subwave 5c.
Figure 4: Example of the Effect of Not Subtracting a Payment Made Under Wave 1
to a Provider’s Subsidiary Organization When Calculating the
Provider’s Subsequent Payment Under Subwave 5c
57
The unrounded amount is $46,485,609. As of December 17, 2020, these 22,645 providers had not received any
subsequent payments under subwaves 5d through 5p and subwaves 13a through 13i. Because our audit covered
the Phase 1 General Distribution, we do not have the payment data for the Phase 3 General Distribution.
Therefore, we do not know whether the 315 providers applied for and received payments under the Phase 3
General Distribution, which would have triggered the true-up process.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 21
HHS and HRSA Did Not Have Procedures That Specified a Deadline for Providers To Return
Rejected Payments
HHS and HRSA developed the following control activities to ensure that providers returned
payments they rejected because if a provider does not return a rejected payment, the total
payment that the provider receives will be incorrect:
• HHS gave providers the option to attest to acceptance or rejection of their payments by
accessing the attestation portal within a specified number of days (e.g., 90 days) of
receiving payments. If a provider chose to reject the payment, it could do so through
the attestation portal by attesting, “I am not accepting payment and I will either destroy
the check or refund the full amount . . .” and clicking the “I Reject Payment” button. If
a provider received two payments, the provider could reject one payment and accept
the other one.
• HHS and HRSA instructed providers to contact their financial institution and ask the
institution to refuse the received ACH credit by initiating an ACH return using the ACH
return code “R23 - Credit Entry Refused by Receiver.” 58
• HHS and HRSA requested that providers that were paid by paper check and rejected a
payment destroy the check if it was not deposited or mail the check to UnitedHealth
Group with a written request to return the payment.
• HRSA contracted with PSC to collect rejected payments from providers. 59
Figure 5 on the next page shows the instructions in the PRF FAQs for rejecting payments in the
attestation portal and highlights a key change related to returning the rejected payments.
58
If a provider received PRF payments via ACH, the provider was required to return the payments via ACH.
59
According to HRSA, a Memorandum of Understanding with PSC was signed and effective November 18, 2020.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 22
Figure 5: Instructions in the Provider Relief Fund FAQs for Rejecting Payments in the
Attestation Portal and Returning Rejected Payments*
May 6, 2020 May 20, 2020 June 12, 2020 August 10, 2020
Within 30 days of Within 45 days of Within 90 days of Within 90 days of
receiving payment, receiving payment via receiving payment, receiving payment,
providers may return the ACH or within 60 providers may return a providers may return a
their General days of check payment payment by going into payment by going into
Distribution payment by issuance, providers may the attestation portal to the attestation portal to
going into the attestation return a payment by indicate that they are indicate that they are
portal to indicate they going into the attestation rejecting the funds. The rejecting the funds. The
are rejecting the funds. portal to indicate that CARES Act Provider Relief CARES Act Provider Relief
The CARES Act Provider they are rejecting the Fund Payment Fund Payment
Relief Fund Payment funds. The CARES Act Attestation Portal will Attestation Portal or the
Attestation Portal will Provider Relief Fund guide providers through Provider Relief Fund
guide providers through Payment Attestation the attestation process Application and
the attestation process Portal will guide to reject the funds. Attestation Portal will
to reject the funds. providers through the guide providers through
attestation process to the attestation process
reject the funds. to reject the funds.
Providers must return
the payment within 15
calendar days of
rejecting the payment.
*
The dates shown in the figure are the dates when the PRF FAQs’ section on rejecting payments was updated.
The yellow highlight indicates a change in the instructions that established a specific deadline for returning
rejected payments.
Although HHS and HRSA had procedures that specified a deadline (e.g., within 90 days of
receiving payment) for providers to reject payments in the attestation portal by indicating that
they were rejecting the payments (i.e., by clicking the “I Reject Payment” button), the
procedures laid out in the PRF FAQs did not include until August 10, 2020, a specific deadline
for returning rejected payments. 60 On that date, HHS updated the PRF FAQs, instructing
providers to return payments within 15 calendar days of rejecting them (i.e., the 15-day limit).
60
Until August 10, 2020, neither the PRF FAQs nor any of HRSA’s written correspondence to providers included a
specific deadline for returning rejected payments. Before May 6, 2020, UnitedHealth Group sent an email or a
letter to providers informing them that they must sign an attestation confirming receipt of the funds and agreeing
to the terms and conditions of payment within 30 days of receipt. UnitedHealth Group also informed providers
that a failure to return payments within 30 days of receipt would be considered acceptance of the terms and
conditions. However, the email or letter did not include a specific deadline for providers to return rejected
payments.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 23
Of the 323,498 providers that received PRF payments, 144 providers rejected payments that
they received in the amount of $10,000 or more by clicking the “I Reject Payment” button in
the attestation portal but had not returned the rejected payments of $52.8 million as of
December 17, 2020. 61, 62 Of the 144 providers, 140 rejected their payments in the attestation
portal before August 10, 2020. According to HRSA, as of March 9, 2022, of the 144 providers,
26 had returned their payments, totaling $2.9 million, but there were still 118 providers that
had not returned their payments, totaling $49.9 million. 63
According to HRSA, as the PRF program matured and through discussions of the process for
collecting overpayments, rejected payments, or other repayments from providers, it became
apparent that HRSA needed to provide additional guidance to encourage the timely return of
payments by providers that rejected payments. To provide additional guidance, in August 2021
HRSA added information in the PRF FAQs clarifying that if a provider does not return the
payment within 15 calendar days of rejecting the payment in the attestation portal, the
provider is considered to have accepted the payment and must abide by the terms and
conditions associated with the payment.
If HRSA does not ensure that providers return their rejected payments in a timely manner, the
allocation of returned payments to future PRF distributions may be delayed. 64
HHS’S AND HRSA’S PROCEDURES TO ENSURE THAT PROVIDERS RECEIVED THE CORRECT
PROVIDER RELIEF FUND PAYMENTS HAD WEAKNESSES
HHS’s and HRSA’s payment thresholds for manual review of revenue information that providers
submitted on their applications were set at a level that resulted in only 2 percent of providers
undergoing manual review. In addition, HRSA’s process to open and view the data file
containing subsidiary TINs extracted from providers’ applications led to an error that caused the
use of incorrect subsidiary TINs when payments were calculated.
HHS’s and HRSA’s Payment Thresholds Were Set at a Level That Resulted in Only 2 Percent of
Providers Undergoing Manual Review for Submitted Information
HHS and HRSA developed the following control activities to ensure that providers received the
correct PRF payments:
61
The unrounded amount is $52,794,028.
62
According to HRSA, after establishing the deadline in the August 10, 2020, guidance, UnitedHealth Group sent
instructions on returning the rejected payments, including instructions regarding the 15-day limit, to providers that
rejected them.
63
The unrounded amounts were $2,909,700 and $49,884,328, respectively.
64
According to the PRF FAQs, HHS will allocate returned payments to future distributions of the PRF (e.g.,
distributions in subsequent phases of the General Distributions).
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 24
• Providers were requested to upload copies of their Federal income tax returns to the
application and attestation portals. If a provider was not required to file a Federal
income tax return, the provider was requested to upload a statement explaining the
reason and to submit the most recent audited or management-prepared financial
statement.
• Providers that had the potential to receive more than $2 million in payments under
wave 5 and more than $1 million in payments under wave 13 were identified for manual
review of their submitted information. The manual review included reviewing
providers’ supporting documentation (e.g., a Federal income tax return) to verify the
reported revenue and determining the reasonableness of the revenue reported on the
application.
Although HHS’s and HRSA’s procedures included manually reviewing providers that had the
potential to receive payments above $2 million for wave 5 and $1 million for wave 13, these
thresholds resulted in HHS and HRSA reviewing only 2 percent of providers, which received
about 57 percent of the total payments. Specifically, HHS and HRSA did not review providers’
supporting documentation to verify the reported revenue for providers that had a potential to
receive $2 million or less in payments under wave 5 or $1 million or less in payments under
wave 13.
Of the 78,718 providers that received payments under either waves 5 or 13, 72,646 providers
attested to acceptance of at least 1 payment and kept at least 1 payment, collectively totaling
$6.6 billion. 65 Table 2 shows the number of unique providers that attested to acceptance of
payments and kept their payments under waves 5 or 13 and whether their reported revenues
were verified with supporting documentation.
Table 2: Number of Unique Providers That Attested to Acceptance of Payments and Kept
Their Payments Under Waves 5 or 13 and Whether Their Reported Revenues Were Verified
Reported Revenue No. of Unique Percentage of Total Percentage of
Verified? Providers Providers Payments* Payments
Yes 1,625 2% $3.8 billion 57%
No 71,021 98% 2.8 billion 43%
Total 72,646 100% $6.6 billion 100%
*
The unrounded amounts are $3,766,224,919, $2,837,029,108, and $6,603,254,027.
For our audit period, HHS and HRSA reviewed providers’ supporting documentation to verify
the reported revenue for only 1,625 providers (or 2 percent of the total number of providers)
that attested to acceptance of payments and kept their payments under waves 5 and 13. These
1,625 providers received and kept $3.8 billion (or 57 percent) of the total payments. However,
65
The unrounded amount is $6,603,254,027.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 25
71,021 providers (or 98 percent of the total number of providers) attested to acceptance of
payments and kept $2.8 billion (or 43 percent) of the total payments without HHS and HRSA
verification of their reported revenue.
According to HRSA, reviewing submitted information for all providers would have delayed the
distribution of PRF payments intended to prevent severe disruption to the Nation’s health care
system. HRSA stated that it established payment thresholds for manual review of information
submitted by providers on their applications based on HHS and HRSA’s risk tolerance given the
unprecedented public health emergency. 66 HRSA cited the OMB Circular No. A-123,
Management’s Responsibility for Enterprise Risk Management and Internal Control. 67
We understand that the statute required HHS and HRSA to distribute PRF payments rapidly to
providers at the beginning of the public health emergency. However, HRSA could perform
reviews of additional providers as the postpayment quality control review processes are being
fully implemented. Although the existing payment thresholds for manual review may have
been reasonable at the beginning of the public health emergency, they were set at a level that
resulted in only 2 percent of the total number of providers undergoing manual review. Because
the PRF program was quickly implemented based on statutory language requiring HRSA to
distribute payments quickly, HRSA said it was willing to accept a somewhat higher risk of
improper payments than under normal circumstances. However, the higher risk of improper
payments may exist not only among providers that were reviewed but also among providers
that were not reviewed. 68 Therefore, HRSA could conduct a cost-benefit analysis for manual
review of additional providers and, if the benefit outweighs the cost, HRSA could select
additional providers for review.
Because HHS and HRSA did not perform manual reviews of providers’ supporting
documentation to verify the reported revenue for 98 percent of the total number of providers,
there was a risk that some of these providers may have received incorrect PRF payments, which
may have been calculated using incorrect revenue on their applications.
66
HRSA refers to the payment thresholds for manual review as “data checks.”
67
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control
(July 15, 2016), p. 28, states: “When determining risk tolerance in disaster situations, managers weigh the
program’s operational objective of expeditiously providing assistance against the objective of lowering the
likelihood of fraud, because activities to lower fraud risks—such as the risk that ineligible individuals submit
fraudulent applications for benefits—[cause] delays in service. As a result, managers are willing to accept a
somewhat higher risk of fraud than under normal circumstances in order to provide emergency assistance in a
timely manner.”
68
According to Government Auditing Standards, paragraph 8.75, in some circumstances, certain conditions could
indicate a heightened risk of fraud. Examples include when management is willing to accept unusually high levels
of risk in making significant decisions or the nature of the entity’s operations provide opportunities to engage in
fraud.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 26
HRSA’s Process To Open and View the Data File Containing Subsidiary Organizations’
Taxpayer Identification Numbers Extracted From Providers’ Applications Led to an Error That
Caused the Use of Incorrect Numbers When Payments Were Calculated
HRSA developed a procedure to prevent providers that file Federal income tax returns covering
multiple legal entities (e.g., parent organizations that include their subsidiary organizations’
revenue information in their consolidated tax returns) from being overpaid. Specifically, HRSA
developed an automated process to extract subsidiary TINs from providers’ applications and
used the extracted subsidiary TINs when it calculated the payments for subwaves 5d through
5p and subsequent wave 13.
However, HRSA’s process to open and view the data file containing extracted subsidiary TINs
led to a transcription error in which a “leading zero” was added in front of the digits in a
subsidiary TIN and the last digit of the TIN was dropped. HRSA used Microsoft Excel to open
and view subsidiary TINs after extracting those TINs from providers’ applications. To prevent
the transcription error, HRSA should have imported the extracted data into Microsoft Excel
before opening and viewing subsidiary TINs. 69 This error caused the use of incorrect subsidiary
TINs when HRSA calculated payments under subwaves 5d through 5e.
Figure 6 shows an example of the differences between two subsidiary TINs reported on
applications and the TINs that were opened and viewed.
Figure 6: Example of the Differences Between Subsidiary Organizations’ TINs Reported on the
Applications and TINs That Were Opened and Viewed
Of the 9 sampled providers that had subsidiary organizations that received payments but did
not file their own Federal income tax returns (out of 40 sampled providers we reviewed),
2 sampled providers had subsidiary organizations whose extracted TINs were incorrect as a
result of a transcription error. HRSA did not verify that the subsidiary TINs were correct after
opening and viewing the extracted subsidiary TINs. If HRSA had imported the extracted data
into Microsoft Excel, HRSA would not have had to verify that the subsidiary TINs were correct
because Microsoft Excel would have not caused the transcription error. HRSA used the
incorrect subsidiary organization TINs for two providers when it calculated the payments under
69
According to HRSA, in July 2020 it implemented a quality control process to verify that the correct subsidiary
TINs were used when calculating payments (i.e., subsidiary TINs without transcription errors).
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 27
subwaves 5d through 5e. As a result, these two sampled providers received more payments
than they should have.
Example of a Provider That Received a Larger Payment Than It Should Have Because an
Extracted Subsidiary TIN Did Not Match the Reported Subsidiary TIN
For one sampled provider that reported three subsidiary TINs on its application, one of the
TINs extracted from the application did not match one of the three TINs reported on the
application because of a transcription error. The payment received by the subsidiary
organization was $1,139,932. Acumen did not subtract this amount when calculating the
provider’s payment under subwave 5e. As a result, this provider received $1,139,932 more
than it should have.
CONCLUSION
In the context of unprecedented challenges from the COVID-19 national emergency, HHS and
HRSA developed controls related to selected PRF program requirements (i.e., for providers’
submission of revenue information and attestation of rejection of payments) designed to
ensure that providers received the correct PRF payments from the Phase 1 General Distribution
in a fast, fair, and transparent manner. However, we determined that some of these controls
could be improved.
HHS and HRSA did not have certain procedures. For example, HHS did not have procedures to
subtract the automatic payments made to providers’ subsidiary organizations when certain
nonautomatic payments were calculated. In addition, HHS and HRSA’s procedures had
weaknesses. For example, HRSA’s process to open and view the data file containing subsidiary
TINs extracted from providers’ applications led to an error that caused the use of incorrect
subsidiary TINs when payments were calculated.
Because HHS and HRSA did not have certain procedures and had weaknesses in other
procedures, some providers may not have received correct PRF payments. Furthermore, the
allocation of returned payments to future PRF distributions may have been delayed.
We understand that HHS and HRSA’s operational objective at the beginning of the national
emergency was to rapidly disburse PRF payments to support providers facing severe economic
hardship during the national emergency, because the CARES Act required HHS and HRSA to
make payments considering “the most efficient payment systems practicable to provide
emergency payment.” We also understand that because of this statutory requirement, HHS
and HRSA prioritized the rapid disbursement of payments over the risk of making improper
payments, because HHS and HRSA determined that activities to lower the risk would have
delayed the payments. However, as HRSA fully implements postpayment quality control review
processes, it should consider the information and recommendations included in this report. For
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 28
example, the established payment thresholds for manual review may have been reasonable at
the beginning of the national emergency; however, they were set at a level that resulted in only
2 percent of providers undergoing manual review. HRSA could conduct a cost-benefit analysis
for manual review of additional providers and, if the benefit outweighs the cost, HRSA could
select additional providers for review.
In addition, to prepare for a possible public health emergency in the future, HHS should use the
information and recommendations included in this report when determining lessons learned
from administering PRF distributions during the COVID-19 national emergency, and look for
additional ways to safeguard taxpayers’ money when rapidly disbursing assistance payments to
health care providers in response to future national emergencies.
RECOMMENDATIONS
As the postpayment quality control review processes are being fully implemented, we
recommend that the Health Resources and Services Administration do the following to verify
that providers received the correct PRF payments from the Phase 1 General Distribution of the
PRF:
• Continue to perform postpayment quality control reviews, including the review of 3,767
providers that attested to acceptance of payments and kept payments of about
$756 million under wave 5 based on the estimated revenue losses in March and
April 2020, and seek repayment of any overpayments from providers. If it is not feasible
to review all providers, HRSA could consider reviewing 189 providers that were
identified for manual review and attested to acceptance of payments and kept a total of
$538 million, which was about 71 percent of the $756 million. Furthermore, HRSA could
conduct a cost-benefit analysis for manual review of additional providers and, if the
benefit outweighs the cost, it could select additional providers for review.
• Determine the impact on subsequent payments of the $46.5 million in payments that
HRSA made to 315 providers for which HHS did not subtract the automatic payments
made to the providers’ subsidiary organizations, and seek repayment of any
overpayments from providers. Furthermore, for subsequent payments, identify
whether there were any other providers for which HHS did not subtract the automatic
payments made to the providers’ subsidiary organizations, determine the impact of not
subtracting these payments, and seek repayment of any overpayments.
• Ensure that PSC collects payments made to the 118 providers that did not return their
rejected payments as of March 9, 2022.
• Establish a process to review providers’ supporting documentation to verify the
reported revenue for the 71,021 providers that had the potential to receive $2 million or
less in payments under wave 5 or $1 million or less in payments under wave 13 and had
attested to acceptance of payments and kept their total payments of $2.8 billion. HRSA
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 29
could conduct a cost-benefit analysis for manual review of additional providers that had
the potential to receive payments below the existing payment thresholds and, if the
benefit outweighs the cost, it could select additional providers for review.
• Determine whether there were other providers that were impacted by the use of
incorrect TINs for subsidiary organizations, recalculate the payments for these
providers, and seek repayment of any overpayments.
HRSA COMMENTS
In written comments on our draft report, HRSA concurred with all of our recommendations and
provided information on actions that it had taken or planned to take to address our
recommendations. 70 However, HRSA noted concerns with some of our findings. HRSA also
provided technical comments on our draft report, which we addressed as appropriate. HRSA’s
comments, excluding the technical comments, are included as Appendix C.
HRSA had the following comments on our five recommendations:
• Regarding our first recommendation, HRSA stated that it will review the 189 providers
identified for manual review and will also conduct a cost-benefit analysis to determine
whether manual reviews of additional providers are feasible.
• Regarding our second recommendation, HRSA stated that it has already begun to
resolve the issue (i.e., determining the impact on subsequent payments of the
$46.5 million in payments that HRSA made to 315 providers) through the established
postpayment quality review process, including seeking repayments for any
overpayments identified.
• Regarding our third recommendation, HRSA stated that it will send rejected but not
returned payments to the Program Support Center for collection of any outstanding
amounts owed.
• Regarding our fourth recommendation, HRSA stated that it will conduct a cost-benefit
analysis for manual review of providers and will assess adding “a new discrepancy to
[its] post payment quality control review process to include manual review of Phase 1
providers meeting this criteria.” 71
70
We provided a copy of the draft report to HHS and requested that HHS provide any written comments on the
report’s findings and conclusions. However, HHS did not provide us with written comments.
71
HRSA’s postpayment manual refers to “discrepancies” as issues that require analyzing provider data and
documenting evidence to support repayment decisions.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 30
• Regarding our fifth recommendation, HRSA stated that it has already begun to resolve
the issue (i.e., determining whether there were other providers that were impacted by
the use of incorrect TINs for subsidiary organizations) through the established
postpayment quality review process. HRSA also stated that it conducted an initial
impact analysis in March 2021 on wave 5 and found providers impacted by this issue.
HRSA stated, however, that the potential overpayment could have reduced future
payments for those providers that applied for funding through the various portals (e.g.,
Portal 3).
Furthermore, HRSA noted concerns with some of our findings. First, HRSA noted that the
reference to fraud throughout the report is incongruent with the audit objective because the
audit specifically focused on payment calculation methodology and related internal controls
rather than provider fraud, which would have involved the review of submitted documentation
for fraudulent information. HRSA requested that the term “fraud” be replaced with the term
“improper payments.” We considered this request and replaced the term as appropriate.
Second, HRSA noted that the finding regarding the deadline to return rejected payments does
not relate to the audit’s focus on correct payment calculation. We want to clarify that the
audit’s focus was not on correct payment calculation. Rather, the audit’s focus was on HHS’s
and HRSA’s controls related to selected PRF program requirements for ensuring that providers
received the correct payments from the Phase 1 General Distribution. Finally, HRSA noted
concerns with the remaining findings regarding (1) supporting documentation and estimated
revenue losses and (2) the payment threshold for manual review of documentation. For those
findings, we made appropriate changes based on the technical comments that HRSA provided.
OTHER MATTERS: METHODOLOGY USED IN CALCULATING PROVIDER RELIEF FUND PAYMENTS
CHANGED OVER TIME FOR THE PHASE 1 GENERAL DISTRIBUTION
To receive additional PRF payments from round 2, providers completed an application and
submitted supporting documentation through HHS’s application portal. HRSA used the
information provided through the application portal to calculate the payments for waves 5 and
13.
HRSA used different methodologies when calculating the payments for waves 5 and 13. 72
Table 3 on the next page shows the differences between the payment calculation
methodologies used for waves 5 and 13.
72
According to HRSA officials, the methodologies used to calculate the payments related to waves 5 and 13
differed because of changes in the application and attestation portals over time. Providers that used Portal 1 or
the CARES Act PRF Application Portal to submit their applications received the payments under wave 5. Providers
that used Portals 2.0 and 3.0 (PRF Application and Attestation Portal) to submit their applications received the
payments under wave 13 and Phases 2 and 3 of the General Distributions.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 31
Table 3: Differences in Methodologies That HRSA
Used To Calculate the Payments for Waves 5 and 13
Methodology That HRSA Used To Calculate Methodology That HRSA Used To Calculate
Payments for Wave 5 Payments for Wave 13
HRSA requested that providers enter on their HRSA requested that providers subtract
applications “Gross Receipts or Sales” or returns and allowances and exclude: (1) any
“Program Service Revenue” (i.e., gross income reported on the Internal Revenue
revenue) from their Federal income tax Service’s Wage and Tax Statement Form
returns. (W-2), (2) joint venture income, and (3) bad
debts from the gross receipts or sales
reported on their applications. HRSA also
requested that providers enter on their
applications the gross receipts and the
percentage of patient care from their gross
receipts. HRSA then determined net patient
revenue, which was used in part to calculate
the payments related to wave 13. The
following is a simplified version of the new
patient revenue calculation:
(Gross Receipts – Returns and Allowances,
Any Income Reported on the W-2, Joint
Venture Income, and Bad Debts) ×
(Percentage Related to Patient Care) = Net
Patient Revenue
HRSA requested that providers enter on their HRSA did not request that providers enter on
applications the estimated revenue losses in their applications the estimated revenue
March and April 2020. losses in March and April 2020 for
applications collected in Portal 2. However,
for applications collected in Portal 3, HRSA
requested that providers enter operating
revenues and operating expenses from
patient care for quarters 1 and 2 of 2019 and
2020. HRSA used this information to
calculate the losses.*
HRSA calculated and disbursed payments to HRSA calculated and disbursed payments to
providers using the providers’ Medicare providers using the providers’ tax filing TINs
billing TINs. because using these TINs would provide
more complete financial information to the
provider.†
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 32
Methodology That HRSA Used To Calculate Methodology That HRSA Used To Calculate
Payments for Wave 5 Payments for Wave 13
HRSA calculated the payments based on the HRSA calculated the payments for the
lesser of 2 percent of a provider’s 2018 (or applications collected in Portal 2 based on
most recent complete tax year) gross receipts 2 percent of net patient revenue from the
or the sum of estimated revenue losses in providers’ most recent financial
March and April 2020. documentation (e.g., the Federal income tax
returns for 2017, 2018, or 2019 or audited
financial statements).
HRSA calculated the payments for the
applications collected in Portal 3 based on
the greater of up to 88 percent of a
providers’ reported losses or 2 percent of net
patient revenue from the providers’ most
recent financial documentation (e.g., the
Federal income tax returns for 2017, 2018, or
2019 or internal audited financial
statements).
*
HRSA required providers to submit supporting documentation (e.g., internally prepared financial statements) for
operating revenues and expenses.
†
HRSA said it observed the following when disbursing payments under wave 5: (1) several applications had
different Medicare billing TINs but had the same parent organization, (2) only parent organizations filed the
Federal income tax return, and (3) it made more sense to have providers apply under the parent organization that
files the tax return and use the providers’ tax filing TINs to calculate and disburse payments.
Differences in the payment calculation methodology may result in providers receiving different
payments, depending on the waves (waves 5 or 13) for which providers submit their
applications. For example, if a provider’s 2018 gross receipts used under the wave-5 payment
calculation were not the same as the net patient revenue used under the wave-13 payment
calculation, the payment that the provider would receive under wave 5 would be different than
the payment the same provider would receive under wave 13.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 33
APPENDIX A: AUDIT SCOPE AND METHODOLOGY
SCOPE
Our audit covered $47,951,935,987 in PRF payments that were disbursed to 323,498 providers
from April 10 through December 17, 2020. 73 We obtained from HRSA the payment data and
the attestation data for our audit period.
HHS and HRSA’s control objective was to ensure that providers received the correct PRF
payments from the Phase 1 General Distribution in a fast, fair, and transparent manner. We
assessed the design and implementation of HHS’s and HRSA’s controls that were related to
selected PRF program requirements (i.e., for the submission of revenue information and
attestation of rejection of payments) and determined whether these controls achieved the
control objective by:
• performing audit procedures detailed in the “Methodology” section on the next page
and
• testing the controls by selecting a random sample of 45 providers that kept all of their
payments, totaling $194,068,160, to determine whether the reported revenue
information on each provider’s application was supported by documentation (e.g.,
Federal income tax returns). We reviewed 40 of the 45 sampled providers. 74
We did not assess HHS’s and HRSA’s controls for providers’ attestation of acceptance of
payments, because a provider was allowed to make a deemed attestation (i.e., the provider
was not required to make an active attestation) that it was eligible for a payment and that it
was accepting the terms and conditions of the payment.
Because this audit assessed HHS’s and HRSA’s controls related to selected PRF program
requirements, we did not determine whether the payments made to providers were correct or
incorrect. Although we determined for each finding the amount of the payments made to
providers (i.e., the potential effect), we could not conclusively determine that these payments
were correct or incorrect, because payment calculations for future distributions of the PRF may
take previous payments into account.
73
The last date that providers attested to acceptance of these payments and kept these payments was
December 19, 2020.
74
In general, we reviewed providers that submitted an application for nonautomatic payments and made an active
attestation or a deemed attestation of acceptance of all payments (automatic and nonautomatic payments). Of
the 45 sampled providers, we did not review 5 providers because these providers received only automatic
payments and did not apply for additional payments (nonautomatic payments) during our audit period. There
were no applications or supporting documentation to review.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 34
We reviewed all five components of internal controls: control environment, risk assessment,
control activities, information and communication, and monitoring. 75 Because our audit was
designed to provide only reasonable assurance that the internal controls we reviewed were
effective, it would not necessarily have detected all internal control deficiencies.
We conducted our audit from October 2020 to June 2022.
METHODOLOGY
To accomplish our objective, we:
• reviewed applicable Federal laws, regulations, and guidance;
• reviewed the Green Book’s components and principles to determine their significance to
our audit objective;
• reviewed the PRF FAQs, the PRF General & Targeted Distribution Cycle Memo, and the
screenshots of the steps from the application and attestation portals to obtain an
understanding of HHS’s and HRSA’s policies and procedures related to selected PRF
program requirements;
• interviewed officials from HRSA and its contractors to obtain an understanding of
controls related to selected PRF program requirements;
• obtained from HRSA and analyzed the payment and attestation data to determine:
o the total payments disbursed as of December 17, 2020, and
o the attestation status of the payment (e.g., whether the provider attested to
acceptance of the payment and kept the payment);
• reviewed Acumen’s methodology memos to obtain an understanding of the calculation
of payments under the Phase 1 General Distribution;
• randomly selected 45 providers that kept all of their payments, totaling $194,068,160,
and for 40 of these sampled providers, reviewed:
o the gross revenue on the providers’ application forms and supporting
documentation (e.g., the Federal income tax returns) and
75
GAO’s Standards for Internal Control in the Federal Government: September 2014 (GAO-14-704G), known as the
Green Book, sets the internal control standards for Federal entities. The Green Book defines internal control as the
plans, methods, policies, and procedures used by management to fulfill the mission, strategic plan, goals, and
objectives of the entity. The Green Book approaches internal control through a hierarchal structure made up of
the five components.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 35
o the subsidiary TINs reported on the providers’ application forms (for providers
with any related subsidiary TINs) and the subsidiary TINs used when the
providers’ payments were calculated; and
• discussed the results of our audit with HRSA officials.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 36
APPENDIX B: ROUND 1 AND ROUND 2 PAYMENTS FROM THE
PHASE 1 GENERAL DISTRIBUTION
Table 4 shows the distribution date, total number of TINs, and total PRF payments for each
wave or subwave under round 1 payments from the Phase 1 General Distribution as of
December 17, 2020.
Table 4: Round 1 Payments From the $30 Billion Allocation of the Phase 1
General Distribution (Automatic Payments)*
Wave or Distribution Total Number of Taxpayer Total Payment
Subwave Date Identification Numbers Amount
1 4/10/2020 144,173 $26,143,124,405
1a 4/21/2020 497 104,622,495
2 4/17/2020 151,504 3,655,751,295
2a 4/17/2020 532 14,223,628
3 4/17/2020 22,492 216,679,469
3a 4/17/2020 270 8,272,031
1b 7/2/2020 3,386 23,384,147
Total 322,854 $30,166,057,470
*
The total number of TINs includes TINs that received more than one payment across the different waves.
Table 5 shows the distribution date, total number of TINs, and total PRF payments for each
wave or subwave under round 2 payments from the Phase 1 General Distribution as of
December 17, 2020.
Table 5: Round 2 Payments From the $20 Billion Allocation of the Phase 1
General Distribution (Automatic and Nonautomatic Payments)* †
Wave or Distribution Total Number of Taxpayer Total Payment
Subwave Date Identification Numbers Amount
4 4/24/2020 14,834 $9,177,151,026
5a 5/15/2020 11,025 451,405,406
5b 5/26/2020 11,987 261,906,075
5c 5/28/2020 2,399 625,100,850
5d 6/15/2020 18,071 1,079,058,004
5e 6/19/2020 12,412 1,483,390,451
5f 7/7/2020 2,690 778,953,776
5g 7/16/2020 899 92,491,846
5h 7/21/2020 284 1,549,729,160
5i 7/27/2020 496 53,806,552
5j 8/3/2020 168 113,723,266
5k 8/10/2020 469 237,208,491
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 37
Wave or Distribution Total Number of Taxpayer Total Payment
Subwave Date Identification Numbers Amount
5l 8/17/2020 191 128,814,027
5m 8/24/2020 96 140,907,170
5n 8/31/2020 51 41,136,723
5o 9/8/2020 402 45,162,111
5p 9/28/2020 34 86,904,293
13a 9/11/2020 2,611 112,034,682
13b 9/14/2020 5,169 238,915,350
13c 9/24/2020 1,799 84,880,634
13d 10/1/2020 2,097 219,245,498
13e 10/16/2020 1,581 165,594,484
13f 10/29/2020 417 97,247,069
13g 11/9/2020 149 37,352,697
13h 11/23/2020 216 163,842,983
13i 12/17/2020 10,243 319,915,893
Total 100,790 $17,785,878,517
*
All payments disbursed from round 2 were nonautomatic payments except for wave 4 payments, which
were disbursed as automatic payments.
†
The total number of TINs includes TINs that received more than one payment across the different waves.
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 38
APPENDIX C: HRSA COMMENTS
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 39
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 40
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 41
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 42
HHS’s and HRSA’s Controls Related to Selected Provider Relief Fund Program Requirements
for the Phase 1 General Distribution (A-09-21-06001) 43
File and source
- File
- A-09-21-06001-hhs-s-and-hrsa-s-controls-related-to-selected-provider-relief-fund-program-requi.pdf
- Size
- 5,401,591 bytes
- SHA-256
- 83a72efc7054312146cbec9d51ea31b0de96d4edd42bde0c54865ccf2293b64f
- Our copy
- A-09-21-06001-hhs-s-and-hrsa-s-controls-related-to-selected-provider-relief-fund-program-requi.pdf
- Original
- oig.hhs.gov