AUBURN COMMUNITY HOSPITAL

2024-001 – Reporting – Significant Deficiency in Internal Control over Compliance Federal program: All programs impacted. Criteria: In accordance with 2 CFR Section 200.512(a), the audit must be completed and the data collection form and reporting package must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report, or nine months after the end of the audit period, adjusted for any extensions permitted by the Office of Management and Budget. Condition: The reporting package and data collection form for the year ended December 31, 2024, was not filed by the deadline of September 30, 2025, to the Federal Audit Clearinghouse. Context: The reporting package and data collection form for the year ended December 31, 2024, were filed late to the Federal Audit Clearinghouse. Effect: The reporting package and data collection form for the year ended December 31, 2024, were not accessible to the Federal Audit Clearinghouse in a timely manner. Cause: Due to delays in completing the financial statement audit, which was issued on February 11, 2026, the Hospital was unable to submit the reporting package and data collection form to the Federal Audit Clearinghouse by the required timeline. Recommendation: We recommend the Hospital adopt policies and procedures, including tracking and monitoring of reporting requirements, to ensure that the audit, reporting package, and data collection form are electronically filed with the Federal Audit Clearinghouse within the applicable deadline. Views of Responsible Official: See management’s Corrective Action Plan on page 51.

2021-001 ? Unapproved Budget Revenues included in Lost Revenue Calculation ? Significant Deficiency in Internal Control over Compliance U.S. Department of Health and Human Services: Provider Relief Fund and American Rescue Plan (ARP) Rural Distributions (Federal Assistance Listing Number 93.498) Criteria: Under the terms and conditions of the awards, the recipient certifies it will include only budgeted revenues approved prior to March 27, 2020, for the entire period of availability, in its calculation of lost revenues. Condition: The Hospital selected Option 2 for their reporting method in Period 1 reporting. The Hospital used its 2020 budget which was approved prior to March 27, 2020, for its calendar year 2020 lost revenues calculation; however, the 2020 budget didn?t cover the entire period of availability for Period 1. The Hospital used their 2021 budget for the remaining period of availability (through June 30, 2021), which was not approved prior to March 27, 2020, in their calculations of lost revenues for the calendar year 2021, in its reporting of the Provider Relief Fund to the Health Resources and Services Administration. The Hospital realized the error and changed its lost revenue reporting method to Option 3 for reporting Period 2. Context: This finding appears to be an isolated instance. Effect: The use of the 2021 budget did not have an effect on the Provider Relief Funds the Hospital retained based on the Period 1 reporting. Cause: The Hospital mis-interpreted the instructions related to reporting for Period 1 reporting. Recommendation: We recommend the Hospital continue to report under lost revenue reporting method to Option 3, which allows for any reasonable method. This could include budgeted revenues approved after March 27, 2020 to be used in the lost revenue calculation for calendar year 2021 and 2022. Views of Responsible Official: See management?s Corrective Action Plan

2021-002 ? Reporting ? Significant Deficiency in Internal Control over Compliance U.S. Department of Health and Human Services: Provider Relief Fund and American Rescue Plan (ARP) Rural Distributions (Federal Assistance Listing Number 93.498) Criteria: In accordance with 2 CFR Section 200.512(a), the audit must be completed and the data collection form and reporting package must be submitted within the earlier of 30 calendar days after receipt of the auditor?s report, or nine months after the end of the audit period, adjusted for any extensions permitted by the Office of Management and Budget. Condition: The reporting package and data collection form for the year ended December 31, 2021, was not filed by the deadline of September 30, 2022, to the Federal Audit Clearinghouse. Context: The reporting package and data collection form for the year ended December 31, 2021, was filed late to the Federal Audit Clearinghouse. Effect: The reporting package and data collection form for the year ended December 31, 2021, was not accessible to the Federal Audit Clearinghouse in a timely manner. Cause: Due to delays in completing the financial statement audit, which was issued on December 2, 2022, the Hospital was unable to submit the reporting package and data collection form to the Federal Audit Clearinghouse by the required timeline. Recommendation: We recommend the Hospital adopt policies and procedures, including tracking and monitoring of reporting requirements, to ensure that the audit, reporting package, and data collection form are electronically filed with the Federal Audit Clearinghouse within the applicable deadline. Views of Responsible Official: See management?s Corrective Action Plan