Hartford HealthCare Corporation

Identification of the Federal Program: Grantor: U.S. Department of Health and Human Services Program Name: COVID-19 ? Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Assistance Listing No. / FAIN / Pass-Through Entity / Pass-Through Entity Identifying Number: 93.498 / Not Applicable / Not Applicable / Not Applicable Section III?Federal Award Findings and Questioned Costs (continued) Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): The Provider Relief Funds were provided under the Coronavirus Aid, Relief, and Economic Security Act (Pub. L. No. 116-136, 134 Stat. 563) and are to be used to prevent, prepare for, and respond to coronavirus. The funds shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: During our testing we observed management did not have effective internal controls in place to ensure expenses reported in the Health Resources and Services Administration PRF Reporting Portal (the Portal) were not duplicated. This resulted in an overstatement of expenses reported in the Portal. Cause: Management did not have effective internal controls in place to ensure the reported expenses attributable to Coronavirus reported in the Portal were not duplicated. Effect or Potential Effect: The result of the condition caused overreporting of eligible expenses reported within the Corporation?s PRF ? Reporting Period 2 submission. Section III?Federal Award Findings and Questioned Costs (continued) Questioned Costs: $592,928 Context: During our internal control and compliance testing, we obtained listings of payroll expenses management had identified as eligible expenditures. In order to aggregate and report total eligible expenses, the Corporation used system reports which detailed payroll, supplies and related expenditures. Certain system reports contained expenses that were duplicated. While duplication of these expenses resulted in an overstatement of eligible expenses in the Portal submission, the amount of lost revenues reported was far in excess of the Provider Relief Funding received. As such, there is no impact on meeting the requirements to retain the funding received as expenses and lost revenues attributable to COVID-19 significantly exceeded the Provider Relief Funds received. Recommendation: We recommend that management develop and implement effective internal controls to ensure accurate reporting in the Portal. This will ensure the expenses reported in the Portal are not duplicated.

Finding 2021-001 Identification of the Federal Program: Grantor: Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity / Pass-Through Entity Identifying Number: 93.273 / P50AA012870 / Yale University / M16A12471 Criteria or Specific Requirement: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management has an established time and effort reporting policy which appropriately considers the time and effort requirements necessary to comply with grants under the Research and Development Cluster. However, management did not have an effective control in place to identify when the policy was not followed. As a result, management did not ensure that key personnel were appropriately reporting time and effort on a monthly basis and did not identify inaccurate reporting. Cause: Management did not follow its established time and effort reporting policy. Effect or Potential Effect: The lack of an effective control over time and effort reporting has the potential to result in noncompliance. Questioned Costs: Not applicable. Context: In a sample of five awards within the Research and Development Cluster, management?s controls failed to identify that time and effort reporting for one award had not been completed accurately and that the inaccurately reported level of effort required approval by the grantor. Recommendation: Management should implement a control such that time and effort reports are reviewed on a monthly basis to identify any inaccurate reports or any reported information that requires federal agency approval under the applicable requirements. Views of Responsible Officials: Management concurs with this finding. Management will implement a monthly review control whereby the reports will be reviewed to ensure accuracy and compliance with federal agency requirements.

Finding 2021-002 Identification of the Federal Program: Grantor: Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN: 93.242 / R01MH119069 93.242 / R61MH122444 Criteria or Specific Requirement: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management has an established procurement and suspension and debarment policy which appropriately considers the vendor suspension and debarment requirements. However, management did not have an effective control in place to evaluate suspension and debarment for all procurement actions. As a result, there were instances of procurement actions where the vendor was not subjected to suspension and debarment evaluation procedures. Cause: Certain procurement actions bypassed management?s established suspension and debarment control. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance. Questioned Costs: Not applicable. Context: In a sample of forty procurement actions within the Research and Development Cluster, three selections bypassed management?s control to perform a suspension and debarment evaluation of the related vendor(s). Recommendation: Management should enhance its controls and reeducate responsible parties to ensure that procurement actions cannot bypass the evaluation of suspension and debarment. Views of Responsible Officials: Management concurs with this finding. Management checked these vendors subsequent to this finding and determined that they were neither suspended nor debarred. Management will implement new procedures to ensure no wires are sent to a vendor before the vendor is properly set up in our procurement system, which is what triggers our suspension and debarment procedures. In addition, we will reeducate the responsible parties to ensure that all vendors submitted for employee reimbursement are properly checked for suspension and debarment.

Finding 2021-003 Identification of the Federal Program: Grantor: Department of Health and Human Services Program Name: COVID-19 ? HRSA COVID-19 Claims Reimbursement for the Uninsured Program Assistance Listing No.: 93.461 Criteria or Specific Requirement: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? A. Activities Allowed or Unallowed ? Activities allowed include required health services as described in the terms and conditions of the award for uninsured individuals, including reimbursement of payments for COVID-19 testing, testing-related items, treatment, or vaccine administration fees for individuals who do not have any health care coverage at the time the services were rendered. E. Eligibility ? Services must be for individuals, who at the time the services were provided, were uninsured as described in the terms and conditions of the award. Condition: Certain claims submitted to the Health Resources and Services Administration (HRSA) for reimbursement were for insured individuals. The Corporation?s controls did not prevent or detect this noncompliance. Cause: A control was performed to verify that, to the best of management?s knowledge, patients were uninsured at the time services were provided prior to the initial submission of a claim to HRSA. This control did not detect that certain patients had insurance coverage effective as of the date of service. Additionally, management did not have a detect control in place to identify when insurance effective as of the date of service for a claim billed to HRSA was subsequently identified for the patient. Effect or Potential Effect: The lack of an effective control over these compliance requirements resulted in noncompliance including questioned costs. Questioned Costs: Questioned costs of $495 were identified, representing payments retained from HRSA on claims for which active insurance coverage was identified subsequent to payment receipt. The total sample value tested was $4,749 and total program expenditures were $9,337,650. Context: In a sample of 60 claims, six claims were identified as having active insurance coverage identified subsequent to the related claim being submitted to HRSA. The HRSA payment for each claim had not been returned as of the testing date. Recommendation: Management should implement a detect control to identify when insurance is subsequently identified on a patient account and is active as of a service date related to a claim that was billed to HRSA. Views of Responsible Officials: Management concurs with this finding. Management has repaid HRSA for the claims that are reported as questioned costs in this finding.

Finding 2020-001 Identification of the Federal Program: Grantor: Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing No. / FAIN / Pass-Through Entity (if applicable) / Pass-Through Entity Identifying Number (if applicable): 93.242 / R01MH102854 93.242 / R01MH119069 93.242 / R21MH122182 93.242 / R21MH116131 / University of Miami / SPC-001205 and OS00005162 93.279 / R01DA041067 / University of Connecticut / 148876 Criteria or Specific Requirement: N. Special Tests and Provisions ? Determine whether the non-federal entity adhered to key personnel commitments specified in the application/proposal or award and obtained any required federal awarding agency approval for changes. For grants and cooperative agreements, this may include not only a change in the principal investigator or project director but also the disengagement from the project for more than three months, or a 25 percent reduction in time devoted to the project, by the approved project director or principal investigator (OMB Circular A-110 sections_.25(c)(2) and (3)/2 CFR sections 200.308(c)(1) (ii) and (iii)). Condition: Management has an established time and effort reporting policy which addresses the requirement identified above. However, management did not have an effective control in place to identify when the policy was not followed. As a result, management did not ensure that key personnel were appropriately reporting time and effort on a monthly basis and did not identify changes requiring federal agency approval. Cause: Management did not follow its established time and effort reporting policy. Effect or Potential Effect: The lack of an effective control over time and effort reporting resulted in multiple instances of noncompliance identified. Questioned Costs: Not applicable. Context: In a sample of nine awards within the Research and Development Cluster, three instances of noncompliance were identified, where no federal agency approval was obtained for a 25 percent or greater reduction in time devoted to the respective project. In each instance, management?s controls failed to identify that time and effort reporting had not been completed timely or that the level of effort for an individual required federal agency approval per the compliance requirement. In addition, for one award within this sample of nine awards, management was unable to provide documentation to support whether key personnel had been disengaged from the project for more than three months or had a 25 percent reduction in time devoted to the project. Recommendation: Management should implement a control where time and effort reports are reviewed on a monthly basis to identify any incomplete reports or any reported information that requires federal agency approval per the requirement. Views of Responsible Officials: Management concurs with this audit finding. Management will implement a monthly review control whereby the reports will be reviewed to ensure compliance with federal agency requirements.

Finding 2020-002 Identification of the Federal Program: Grantor: Department of Housing and Urban Development Program Name: Continuum of Care Program Assistance Listing No. / FAIN: 14.267 / CT0083L1E031811 14.267 / CT0083L1E031912 14.267 / CT0041L1E031811 14.267 / CT0041L1E031912 Criteria or Specific Requirement: I. Procurement and Suspension and Debarment ? Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA). Condition: Management has an established suspension and debarment screening process which addresses the requirement identified above. However, certain vendors were incorrectly not subjected to this process in the current year. Therefore, management did not have in place an effective control over compliance for this requirement. Cause: The suspension and debarment screening process established by management did not address all active vendors across the Corporation. Effect or Potential Effect: The lack of an effective control over suspension and debarment has the potential to result in noncompliance with the requirement. Questioned Costs: None. Context: Management?s control is to perform a monthly suspension and debarment screening over its vendors. In a sample of 40 selections, there were 24 instances where the selected vendor was not subjected to the suspension and debarment screening in the selected month. None of the selected vendors were suspended or debarred. Recommendation: Management should refine its control to ensure it encompasses all vendors utilized by the Corporation. Views of Responsible Officials: Management concurs with this audit finding. St. Vincent?s Medical Center was acquired by Hartford HealthCare on October 1, 2019. St. Vincent?s Medical Center utilized provisional accounting and reporting systems during the transition period of October 1, 2019 to September 30, 2020. St. Vincent?s Medical Center transitioned to Hartford HealthCare?s standard accounting and reporting systems effective October 1, 2020. A review of the suspension and debarment files subsequent to October 1, 2020 has confirmed that the missing vendors are being addressed under Hartford HealthCare?s current process.

Finding 2020-003 Identification of the Federal Program: Grantor: Department of Housing and Urban Development Program Name: Continuum of Care Program Assistance Listing No. / FAIN: 14.267 / CT0083L1E031811 Criteria or Specific Requirement: G. Matching, Level of Effort, Earmarking ? The recipient or subrecipient must match all grant funds, except for leasing funds, with no less than 25 percent of cash or in-kind contributions from other sources. For Continuum of Care geographic areas in which there is more than one grant agreement, the 25 percent match must be provided on a grant-by-grant basis. Recipients that are a Unified Funding Agency or are the sole recipient for their Continuum may provide match on a Continuum-wide basis (24 CFR section 578.73(a)). Condition: The Corporation?s awards that require an annual 25 percent match. Management did not have in place an effective control over compliance for this requirement. This resulted in material noncompliance with the requirement. Cause: Management did not consider program income in its assessment as to whether the matching requirement had been met. As a result, management?s calculation incorrectly identified that its matching requirement had been met based on 25 percent of program expenditures in excess of the federal funding received. Management?s control over compliance did not prevent or detect the incorrect calculation of the matching requirement. Effect or Potential Effect: The lack of an effective control over this compliance requirement resulted in noncompliance including questioned costs. Questioned Costs: Questioned costs were identified as $63,400, representing the reduction in the federal share of program expenditures upon correction of the matching calculation. Context: Awards under the Continuum of Care Program with an annual matching requirement were subjected to our testing. One of the awards did not meet its matching requirement, resulting in the questioned costs identified previously. For this award, the Corporation did not first utilize program income to address program costs, which resulted in reporting a higher federal share of expenditures than actually incurred. After consideration of program income, the actual federal share of expenditures for this award would be reduced by $63,400, which has been identified as questioned costs. Recommendation: Management should enhance its control to ensure the review of matching requirements includes consideration of the effect of program income on reportable expenditures. Views of Responsible Officials: Management concurs with this audit finding. St. Vincent?s Medical Center was acquired by Hartford HealthCare on October 1, 2019. St. Vincent?s Medical Center utilized provisional accounting and reporting systems during the transition period of October 1, 2019 to September 30, 2020. St. Vincent?s Medical Center transitioned to Hartford HealthCare?s standard accounting and reporting systems effective October 1, 2020. St. Vincent?s Medical Center has enhanced their internal reporting process to clearly identify the required match on all grants. In addition, the internal grant reporting will be distributed monthly to the Vice President of Finance for the region and the Sr. Director ? Administrative Services over the grants.

Finding 2020-004 Identification of the Federal Program: Grantor: Department of Housing and Urban Development Program Name: Continuum of Care Program Assistance Listing No. / FAIN: 14.267 / CT0041L1E031811 14.267 / CT0041L1E031912 Criteria or Specific Requirement: H. Period of Performance ? A non-federal entity may charge to the federal award only allowable costs incurred during the period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR section 200.309). Condition: The Corporation included out of period costs within the expenditures reported during the fiscal year. The Corporation?s controls did not prevent or detect the reporting of out of period costs. Cause: Management?s controls did not prevent or detect the inclusion of out of period costs within reported expenditures. Management followed the cash basis of accounting for the program, reporting expenditures when paid instead of when the costs were incurred. Effect or Potential Effect: The lack of an effective control over this compliance requirement resulted in noncompliance including questioned costs. Questioned Costs: Questioned costs were identified as $39,577. Context: In a sample of nine selections addressing the beginning of the period of performance, five selections included expenditures for costs that were incurred prior to the start of the award and no grantor prior authorization had been obtained. Each of the five selections with costs incurred prior to the start of the award were for utilities expenses. The total of the costs incurred prior to the start of the award for these five selections was $4,740; total utilities expense in the population for the beginning of the period of performance was $20,201. In a sample of 13 selections addressing the end of the period of performance, two selections included expenditures for costs that were not incurred as of the end of the award. Each of the two selections with costs incurred after the end of the award were for rental expenses. The total of the costs incurred after the end of the award for these two selections was $34,837; total rental expense in the population for the end of the period of performance was $35,325. Recommendation: Management should ensure that it is recording program expenditures on the accrual basis of accounting and should enhance its control to assess whether recorded costs have been incurred within the period of performance prior to finalizing its reporting. Views of Responsible Officials: Management concurs with this audit finding. St. Vincent?s Medical Center was acquired by Hartford HealthCare on October 1, 2019. St. Vincent?s Medical Center utilized provisional accounting and reporting systems during the transition period of October 1, 2019 to September 30, 2020. St. Vincent?s Medical Center transitioned to Hartford HealthCare?s standard accounting and reporting systems effective October 1, 2020. St. Vincent?s Medical Center has enhanced their internal reporting process to clearly identify expenses not related to the period of performance. In addition, the internal grant reporting will be distributed monthly to the Vice President of Finance for the region and the Sr. Director ? Administrative Services over the grants.

Finding 2020-005 Identification of the Federal Program: Grantor: Department of Housing and Urban Development (HUD) Program Name: Continuum of Care Program Assistance Listing No. / FAIN: 14.267 / CT0041L1E031811 14.267 / CT0041L1E031912 Criteria or Specific Requirement: N. Special Tests and Provisions ? When grants are used to pay rent for individual housing units, the rent paid must be reasonable in relation to rents being charged for comparable units, taking into account the location, size, type, quality, amenities, facilities, and management services. In addition, the rents may not exceed rents currently being charged for comparable units, and the rent paid may not exceed HUD-determined fair market rents (24 CFR section 578.49(b)(2)). Condition: Management was unable to provide evidence of a control being performed in the fiscal year to address this requirement. Cause: Management did not retain evidence of the annual review and approval of lease agreements during which rent reasonableness studies are performed to address this requirement. Effect or Potential Effect: As no evidence of the control could be provided, the control is considered to be ineffective. The lack of an effective control over this compliance requirement has the potential to result in noncompliance, including questioned costs. Questioned Costs: None. Context: Management asserts that it performs an annual review of all leases funded through this program and that this review addresses all components of the compliance requirement identified previously. Management did not retain evidence that the control was performed during the fiscal year. No instances of noncompliance were noted in a sample of six leases selected in our testing. Recommendation: Management should refine its control to ensure that evidence of review and approval sufficient to illustrate compliance with the requirement identified previously is retained and readily available. Views of Responsible Officials: Management concurs with this audit finding. St. Vincent?s Medical Center was acquired by Hartford HealthCare on October 1, 2019. St. Vincent?s Medical Center utilized provisional accounting and reporting systems during the transition period of October 1, 2019 to September 30, 2020. St. Vincent?s Medical Center transitioned to Hartford HealthCare?s standard accounting and reporting systems effective October 1, 2020. St. Vincent?s Medical Center has adopted Hartford Healthcare?s protocols for retention of support and documentation of the review of market rent.

Finding 2020-006 Identification of the Federal Program: Grantor: Department of Health and Human Services Program Name: COVID-19 Testing for the Uninsured Assistance Listing No.: 93.461 Criteria or Specific Requirement: A. Activities Allowed or Unallowed ? Activities allowed include required primary health services as described in the terms and conditions of the award for uninsured individuals, including reimbursement of payments for COVID-19 testing and testing-related items for individuals who do not have coverage through an individual or employer-sponsored plan, a federal healthcare program, or the Federal Employees Health Benefits Program at the time the services were rendered. E. Eligibility ? Services must be for individuals who at the time the services were provided were uninsured as described in the terms and conditions of the award. Condition: Certain claims submitted to the Health Resources and Services Administration (HRSA) for reimbursement were for insured individuals. The Corporation?s controls did not prevent or detect this noncompliance. Cause: A control was performed to verify that, to the best of management?s knowledge, patients were uninsured at the time services were provided prior to the initial submission of a claim to HRSA. Certain claims did not successfully transmit to HRSA upon initial submission. Prior to resubmitting the claims, it was identified that certain patients were insured at the date services were provided. Management?s controls did not detect the identified coverage that was added subsequently and did not prevent the associated claims from being re-submitted to HRSA. Effect or Potential Effect: The lack of an effective control over these compliance requirements resulted in noncompliance including questioned costs. Questioned Costs: Questioned costs of $254 were identified, representing payments received from HRSA on claims for which active insurance coverage had been identified prior to claim submission. The total sample value tested was $4,444 and total program expenditures were $2,359,755. Context: In a sample of 40 claims, two claims were identified as having active insurance coverage identified prior to the related claim being submitted to HRSA. Each of these two claims had previously failed to transmit to HRSA. The active insurance coverage was identified after the initial submission of the claim that failed to transmit and prior to the resubmission of the claim which resulted in payment from HRSA. Recommendation: Management should refine its control to ensure that claims are being reassessed for insurance coverage prior to resubmitting claims. Views of Responsible Officials: Management concurs with the audit finding. Management will refine its control to ensure that claims are being reassessed for insurance coverage prior to resubmitting claims. Standard work documentation will be updated to include instructions to remove HRSA coverage when other insurance coverage is identified. All staff working the HRSA submission claims will be retrained to incorporate this step in the control process.