EIN: 237426300
UEI: ZY63XPTXNZC3
237017276, 331065485, 465562403, 830433165, 930281321, 930386793, 930386823, 930591528, 930618975, 930773410, 930794951, 930848530, 930848538, 930913392, 931272735, 931314469, 936095667, 936095677 · unlinked EINs have no separate FAC filing
Audited by: KPMG LLP
Oversight agency: 93 [Department of Health and Human Services]
View federal awards & risk assessment →
Data as of September 2, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on July 28, 2025. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by January 28, 2026 (218 days ago).
What is a management decision? →FAC accepted this audit on September 9, 2024 — management decision was due March 9, 2025.
FAC accepted this audit on December 29, 2023 — management decision was due June 29, 2024.
FAC accepted this audit on December 19, 2022 — management decision was due June 19, 2023.
Program Information: Federal Program: Provider Relief Fund (PRF) Assistance Listing Number: 93.498 Federal Agency: Department of Health & Human Services Award Year: PRF Periods 1 and 2: Funds received April 10, 2020 through December 31, 2020 Criteria or requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CRF 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Award, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Activities Allowed and Unallowed and Allowable Costs (AB): Per the Terms and Conditions of the Provider Relief Fund program, as described in the July 2021 OMB Compliance Supplement, payments may not be used to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. Reporting (L) - Special Reporting Under the terms and conditions of the award, Provider Relief Funds (PRF) is subject to 45 CFR section 75.302 (Financial management and standards for financial management systems). The PRF program requires special reporting through the Provider Relief Fund Reporting Portal that contains key line items containing critical information based on the period reported on. Other Provider Relief Fund Expenses for Payments Received During Payment Period for Payment Received Period is specified as a key line item. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: For 2 of 40 samples of expenditures, the expenditure claimed represented an amount that was claimed twice by the Company in their expenditures reporting in the Provider Relief Fund portal. Additionally, Legacy claimed expenses that were duplicated within the reporting portal. The general distribution report for Legacy Health for Period 1 shows $35,760,843 in expenses applied against the PRF funds in the PRF portal report for Legacy as a consolidated entity. Separately, the stand-alone reports for targeted funds received by Emanuel Hospital & Health Center for Period 1, Legacy Silverton Medical Center for Period 1, Legacy Clinics, LLC for Period 1, and Legacy Meridian Park Hospital for Period 2 also include expenses totaling $12,291,293 that are included in the $35,760,843 listed in the consolidated report above. This results in duplicate reporting of the same expenditures. During our testing over reporting and allowability we observed the lost revenues attributable to Coronavirus were reported in both the parent entity?s PRF reports on the general distribution payments and the subsidiary entities? PRF reports on the targeted distribution payments (i.e., lost revenues were duplicated). Lost revenues shown on the subsidiary reports as available to be applied against PRF that related to lost revenues also reported in the parent entity?s report were related to Emanuel Hospital & Health Center for Period 1 in the amount of $27,106,110 and Legacy Silverton Medical Center for Period 1 in the amount of $10,269,349. Cause and possible asserted effect: Controls were not operating effectively to detect and correct duplicate expenses shown on the portal reporting between the consolidated and stand-alone subsidiary reports for targeted funds. Identification of questioned costs and how they were computed: $12,291,293, which represents the accumulation of expenses included on the consolidated and subsidiary targeted fund portal reports. Sample Statistically Valid: The sample was not intended to be, and was not, a statistically valid sample. Repeat finding from prior year: This finding is not a repeat of a finding in the immediately prior audit. Recommendation: We recommend Legacy management enhance their control process by 1) developing a methodology to identify areas within the portal reporting requirements that are inconclusive, in conflict or ambiguous, and 2) developing a process to access subject matter expertise to resolve issues identified. Views of Responsible Officials: As noted within the portal filing summary, for reporting period 1, Legacy consolidated COVID-19 expenses ($35,760,843) plus lost revenue ($150,037,450) totaled $185,798,293. Payments from the PRF totaled $89,818,954. As a result, there were sufficient qualifying lost revenues to receive and earn all PRF funds received, regardless of the questioned costs above. Therefore, management believes no repayment of PRF funds received would be required. Further, management considered the finding. Reporting for the Legacy parent reporting entity was based on the ?Post-Payment Notice of Reporting Requirements (6/11/21)?, which includes the following requirement: ?Reporting entities will submit consolidated reports.? Neither the methodology utilized by Legacy or application of the methodology advocated by KPMG result in repayment of any of the funds received from the PRF. Management is implementing a process to identify and resolve situations in which reporting requirements are inconclusive, in conflict, or ambiguous. Outside subject matter expertise will be accessed as needed.
Show full finding ▾Hide full finding ▴Program Information: Federal Program: Provider Relief Fund (PRF) Assistance Listing Number: 93.498 Federal Agency: Department of Health & Human Services Award Year: PRF Periods 1 and 2: Funds received April 10, 2020 through December 31, 2020 Criteria or requirement: Per Title 2, U.S. Code of Federal Regulations Part 200 (2 CRF 200), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Award, (Subpart D, Section 200.303), the nonfederal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Activities Allowed and Unallowed and Allowable Costs (AB): Per the Terms and Conditions of the Provider Relief Fund program, as described in the July 2021 OMB Compliance Supplement, payments may not be used to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. Reporting (L) - Special Reporting Under the terms and conditions of the award, Provider Relief Funds (PRF) is subject to 45 CFR section 75.302 (Financial management and standards for financial management systems). The PRF program requires special reporting through the Provider Relief Fund Reporting Portal that contains key line items containing critical information based on the period reported on. Other Provider Relief Fund Expenses for Payments Received During Payment Period for Payment Received Period is specified as a key line item. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: For 2 of 40 samples of expenditures, the expenditure claimed represented an amount that was claimed twice by the Company in their expenditures reporting in the Provider Relief Fund portal. Additionally, Legacy claimed expenses that were duplicated within the reporting portal. The general distribution report for Legacy Health for Period 1 shows $35,760,843 in expenses applied against the PRF funds in the PRF portal report for Legacy as a consolidated entity. Separately, the stand-alone reports for targeted funds received by Emanuel Hospital & Health Center for Period 1, Legacy Silverton Medical Center for Period 1, Legacy Clinics, LLC for Period 1, and Legacy Meridian Park Hospital for Period 2 also include expenses totaling $12,291,293 that are included in the $35,760,843 listed in the consolidated report above. This results in duplicate reporting of the same expenditures. During our testing over reporting and allowability we observed the lost revenues attributable to Coronavirus were reported in both the parent entity?s PRF reports on the general distribution payments and the subsidiary entities? PRF reports on the targeted distribution payments (i.e., lost revenues were duplicated). Lost revenues shown on the subsidiary reports as available to be applied against PRF that related to lost revenues also reported in the parent entity?s report were related to Emanuel Hospital & Health Center for Period 1 in the amount of $27,106,110 and Legacy Silverton Medical Center for Period 1 in the amount of $10,269,349. Cause and possible asserted effect: Controls were not operating effectively to detect and correct duplicate expenses shown on the portal reporting between the consolidated and stand-alone subsidiary reports for targeted funds. Identification of questioned costs and how they were computed: $12,291,293, which represents the accumulation of expenses included on the consolidated and subsidiary targeted fund portal reports. Sample Statistically Valid: The sample was not intended to be, and was not, a statistically valid sample. Repeat finding from prior year: This finding is not a repeat of a finding in the immediately prior audit. Recommendation: We recommend Legacy management enhance their control process by 1) developing a methodology to identify areas within the portal reporting requirements that are inconclusive, in conflict or ambiguous, and 2) developing a process to access subject matter expertise to resolve issues identified. Views of Responsible Officials: As noted within the portal filing summary, for reporting period 1, Legacy consolidated COVID-19 expenses ($35,760,843) plus lost revenue ($150,037,450) totaled $185,798,293. Payments from the PRF totaled $89,818,954. As a result, there were sufficient qualifying lost revenues to receive and earn all PRF funds received, regardless of the questioned costs above. Therefore, management believes no repayment of PRF funds received would be required. Further, management considered the finding. Reporting for the Legacy parent reporting entity was based on the ?Post-Payment Notice of Reporting Requirements (6/11/21)?, which includes the following requirement: ?Reporting entities will submit consolidated reports.? Neither the methodology utilized by Legacy or application of the methodology advocated by KPMG result in repayment of any of the funds received from the PRF. Management is implementing a process to identify and resolve situations in which reporting requirements are inconclusive, in conflict, or ambiguous. Outside subject matter expertise will be accessed as needed.
Finding 2022-001 Federal program: Provider Relief Fund Assistance Listing Number 93.498 Statement of Condition For 2 of 40 samples of expenditures, the expenditure claimed represented an amount that was claimed twice by the Company in their expenditures reporting in the Provider Relief Fund portal. Additionally, Legacy claimed expenses that were duplicated within the reporting portal. The general distribution report for Legacy Health for Period 1 shows $35,760,843 in expenses applied against the PRF funds in the PRF portal report for Legacy as a consolidated entity. Separately, the stand-alone reports for targeted funds received by Emanuel Hospital & Health Center for Period 1, Legacy Silverton Medical Center for Period 1, Legacy Clinics, LLC for Period 1, and Legacy Meridian Park Hospital for Period 2 also include expenses totaling $12,291,293 that are included in the $35,760,843 listed in the consolidated report above. This results in duplicate reporting of the same expenditures. During testing over reporting and allowability it was observed that the lost revenues attributable to Coronavirus were reported in both the parent entity?s PRF reports on the general distribution payments and the subsidiary entities? PRF reports on the targeted distribution payments (i.e., lost revenues were duplicated). Lost revenues shown on the subsidiary reports as available to be applied against PRF that related to lost revenues also reported in the parent entity?s report were related to Emanuel Hospital & Health Center for Period 1 in the amount of $27,106,110 and Legacy Silverton Medical Center for Period 1 in the amount of $10,269,349. Actions Taken and Status As noted within the portal filing summary, for reporting period 1, Legacy consolidated COVID-19 expenses ($35,760,843) plus lost revenue ($150,037,450) totaled $185,798,293. Payments from the PRF totaled $89,818,954. As a result, there were sufficient qualifying lost revenues to receive and earn all PRF funds received, regardless of the questioned costs above. Therefore, management believes no repayment of PRF funds received would be required. Further, management considered the finding. Reporting for the Legacy parent reporting entity was based on the ?Post-Payment Notice of Reporting Requirements (6/11/21)?, which includes the following requirement: ?Reporting entities will submit consolidated reports.? Neither the methodology utilized by Legacy or application of the methodology advocated by KPMG result in repayment of any of the funds received from the PRF. Management is implementing a process to identify and resolve situations in which reporting requirements are inconclusive, in conflict, or ambiguous. Outside subject matter expertise will be accessed as needed. Person responsible for the implementation of the corrective action plan: Tom Haywood Legacy Health 1919 NW Lovejoy St Portland OR 97219 503-415-5793 thaywood@lhs.org
FAC accepted this audit on June 16, 2022 — management decision was due December 16, 2022.
FAC accepted this audit on July 6, 2020 — management decision was due January 6, 2021.
FAC accepted this audit on June 19, 2019 — management decision was due December 19, 2019.
Finding 2019-001: Program information: Research and Development Cluster. Criteria or requirement: Per 2 CFR Part 200 Subpart D section ? 200.303 ? Internal controls states that: The non-Federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: KPMG identified that reimbursement requests sent to prime recipients where Legacy was a subrecipient did not have a layer of review and approval prior to submission to the prime recipients. Cause and possible asserted effect: Legacy does not have adequate controls in place to ensure that reimbursement requests from Legacy to a prime recipient are reviewed for accuracy and completeness in accordance with 2 CFR 200. Without effective controls in place, expenditures could be submitted for reimbursement that do not meet all relevant compliance requirements under Common Rule A-102 and the specific requirements of the grant agreement. Identification of questioned costs and how they were computed: Not applicable. No questioned costs were identified. Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No Recommendations: KPMG recommends that Legacy implement a control to ensure reimbursement requests from Legacy to a prime recipient are appropriately reviewed. Views of responsible officials: Management acknowledges the importance of an effective control environment, including appropriate segregation of duties. We are currently evaluating the most appropriate individual to fulfill this additional role and anticipate that the deficiency will be remediated no later than June 30, 2019.
Show full finding ▾Hide full finding ▴Finding 2019-001: Program information: Research and Development Cluster. Criteria or requirement: Per 2 CFR Part 200 Subpart D section ? 200.303 ? Internal controls states that: The non-Federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: KPMG identified that reimbursement requests sent to prime recipients where Legacy was a subrecipient did not have a layer of review and approval prior to submission to the prime recipients. Cause and possible asserted effect: Legacy does not have adequate controls in place to ensure that reimbursement requests from Legacy to a prime recipient are reviewed for accuracy and completeness in accordance with 2 CFR 200. Without effective controls in place, expenditures could be submitted for reimbursement that do not meet all relevant compliance requirements under Common Rule A-102 and the specific requirements of the grant agreement. Identification of questioned costs and how they were computed: Not applicable. No questioned costs were identified. Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No Recommendations: KPMG recommends that Legacy implement a control to ensure reimbursement requests from Legacy to a prime recipient are appropriately reviewed. Views of responsible officials: Management acknowledges the importance of an effective control environment, including appropriate segregation of duties. We are currently evaluating the most appropriate individual to fulfill this additional role and anticipate that the deficiency will be remediated no later than June 30, 2019.
An additional person has been tasked with reviewing invoices for reasonableness and accuracy before being sent.
FAC accepted this audit on July 10, 2018 — management decision was due January 10, 2019.
FAC accepted this audit on August 14, 2017 — management decision was due February 14, 2018.
FAC accepted this audit on August 14, 2016 — management decision was due February 14, 2017.
GSA_MIGRATION
Show full finding ▾Hide full finding ▴GSA_MIGRATION
GSA_MIGRATION
GSA_MIGRATION
Show full finding ▾Hide full finding ▴Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Browse other Single Audit organizations in Oregon →
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and filing records.
Start monitoring →© 2026 Single Audit Intelligence. All data is public domain.