Palo Alto County HospitalLocal Government

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail, and required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above and other supporting documentation, but there was no formal review or approval process for that report. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore more formal controls and procedures around the use of federal awards had not been in place. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: Yes – 2021-003 Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: The Code of Federal Regulations section 200.320 states the non-Federal entity must have and use documented procurement procedures following specific requirements for different methods of procurement depending on size and type of purchase. Thresholds for these categories (micro-purchase, simplified acquisition threshold) refer to using the Federal Acquisition Regulations (FAR), unless a different threshold has been specifically approved. Specifically, under FAR multiple quotes are generally required for purchases over the micro-purchase threshold, or documentation should be maintained explaining why multiple quotes were not obtained. Condition: During our testing, we noted the Health System did not have a properly documented procurement policy that met the federal requirements. As a result there were vendors over the micro purchase threshold that were tested where retained documentation was not sufficient to support procurement method or noncompetitive procurement in line with federal requirements. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. Eligible expenditures were reviewed by the CFO and followed standard organizational internal control processes (i.e., AP), but ultimately did not follow a procurement policy in line with Uniform Guidance requirements. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and policies around the use of federal awards had not been in place. Effect: The lack of documented procurement policies over these compliance requirements provides an opportunity for noncompliance. Repeat finding: No Recommendation: We recommend the Health System create and implement a procurement policy that meets the requirements of federal regulations. The Health System should also maintain documentation to support procurement method used and compliance with policy when procuring vendors for federal grant funded projects. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Rural Communities Opioid Response Program – Medication Assisted Treatment (MAT) Expansion and COVID-19 Rural Health Clinic Vaccine Confidence Assistance Listing Number: 93.912 Award Period: September 1, 2019 through August 31, 2022 Type of Finding: • Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: Per the notice of award, the annual FFR for the MAT grant is due January 30 for budget periods ending in August through October. The Health System's budget period ended on 8/31/21 for the report in question. Condition: The Health System did not have a process in place to ensure timely filing of required reports and report was filed one day late. Questioned costs: None Context: The Health System maintained detailed accounting records to accurately report on annual grant expenditures but did not have a process in place to ensure timely filing of required reports. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. Effect: Without proper control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained. We also recommend implementing procedures or a schedule to ensure required reporting is filed timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Provider Relief Fund Assistance Listing Number: 93.498 Award Period: Reporting Period 1 for funds received prior to June 30, 2020, used through June 30, 2021 Type of Finding: ? Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.303(a) states that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. The Health System did not have documented formal controls and procedures over compliance with federal awards. Condition: The Health System did not have documented formal review processes over the use of the federal awards or required reporting for the federal awards. Eligible uses of federal awards were tracked in detail and reviewed, with formal approval documented on certain larger expenditures, but there was not a formal documented review process over whether expenditures were eligible under the federal award in all cases. Required reporting under the federal award was completed, but there was not a formal review or approval process in place. Questioned costs: None Context: The Health System maintained detailed records of eligible uses of federal funds for tracking and required reporting purposes. The Health System's CFO maintained this schedule as eligible uses of funds were identified throughout the organization, reviewed activity, and reconciled the schedule to the general ledger. There was not, however, documentation of a formal review or approval, outside of the schedule being maintained and reconciled. Similarly, the Health System CFO completed the required reporting under the federal award based on the schedule discussed above, a lost revenue calculation, and other supporting documentation, but there was no formal review or approval process for that report. Management did also make regular reports to governance in monthly financial reports, including the use of COVID relief funds. These reports only covered more significant uses of funds and overall status updates on remaining funding, not a comprehensive report of all uses. The Health System does have in place review processes and controls over all expenditures (AP, Payroll), they are just not designed specifically to consider compliance with federal programs. Cause: The Health System has not previously received federal awards in an amount sufficient to require an audit under Uniform Guidance. Therefore, more formal controls and procedures around the use of federal awards had not been in place. The Provider Relief Fund, and certain other federal funds received in response to the COVID-19 pandemic were an unexpected occurrence. As the relief funds were distributed to the Health System, the focus of Health System's management and governance was on responding to the pandemic, and tracking use of related relief funds, and not necessarily on incorporating formal policies and procedures due to the time sensitive nature of the pandemic. In addition, detailed guidance surrounding the Provider Relief Fund was not immediately available and changed quite frequently over the period of the aware, making it difficult for organizations to properly incorporate more formal policies and procedures. Effect: Without formal control and review processes in place over use of federal funds or required reporting under those awards, there is a greater risk of improper use of funds or misstatement in required reporting. Repeat finding: No Recommendation: We recommend that management implement more formal control process surrounding the use of federal awards where there is segregation between individuals identifying or proposing expenditures/uses of funds and an individual reviewing and approving that expenditure/use. We also recommend for any formal reporting required under federal awards that there be a formal review process where an individual is reviewing and approving the report who did not prepare the report. Documentation of review and approval should be retained in both cases. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Health and Human Services Federal program title: Provider Relief Fund Assistance Listing Number: 93.498 Award Period: Reporting Period 1 for funds received prior to June 30, 2020, used through June 30, 2021 Type of Finding: ? Material Weakness in Internal Control over Compliance and Other Matters Criteria or specific requirement: HRSA guidance on calculation of lost revenue for Provider Relief Fund reporting provides that a facility using Option 2 for lost revenue calculation method must use a budget approved before March 27, 2020. Budgets are then compared to actual patient revenue to determine lost revenue. Condition: The Health System used budgeted revenue amounts that were adjusted from the original approved budget amounts, as the Health System wanted to take into account a change in number of providers during the year and the associated revenue with them for purposes of the lost revenue calculation. To report lost revenue under Option 2, the Health System should have used the budget as approved prior to March 27, 2020. Questioned costs: $194,122 Context: The adjustments made to the fiscal year 2020 budget did not change overall budgeted patient revenue from the original budget but did reallocate patient revenue throughout the year due to timing of a change in the number of providers at the Health System. Had the original unadjusted budget been used and spread evenly over the course of fiscal year 2020 for use in the lost revenue calculation, calculated lost revenue would have been less by $194,122. The underlying budgets used for fiscal 2020 and 2021 were approved prior to March 27, 2020 and would have otherwise met HRSA requirements. Also, there were no modifications made to the fiscal year 2021 budget used in the lost revenue calculation. Cause: The Health System used revenue amounts that did not meet the requirements of Option 2 for the lost revenue calculation, as they did not reflect unadjusted budgeted revenue amounts that were approved prior to March 27, 2020. The Health System was attempting to make the calculation more accurate based on the circumstances, but should have submitted the calculation as Option 3 to HRSA with a narrative explaining the methodology for HRSA's review. Effect: Due to the lost revenue calculation being reported as Option 2 instead of Option 3, there is the possibility HRSA would not approve the methodology used, and therefore impact the final lost revenue calculation if Option 2, without modification to budget, had to be utilized. Repeat finding: No Recommendation: We recommend that the Health System closely review requirements associated with the reporting of new grant funds received to make sure they are complying with the rules surrounding use of funds. Moving forward any modification to standard lost revenue calculations Option 1 or Option 2 should be submitted as Option 3 along with a narrative explaining the methodology for HRSA review and approval. Views of responsible officials: The Health System has a July 1st to June 30th fiscal year which both fiscal year 2020 and 2021 budgets were approved prior to the HRSA March 27,2020 cut off period for methodology #2 (lost revenue compared to budget). So lost revenue was submitted under methodology #2 per understood guidelines. HRSA did not provide specific guidelines on how the approved annual fiscal year budget should be allocated on a monthly/quarterly basis or if it was a requirement to use a 1/12th budget allocation methodology. During FY2020, the Health System added two additional physicians which was part of the FY2020 budget. They started practicing in September 2019 so the monthly/quarterly budgets were allocated based on when they actually started to practice which was more accurate than a 1/12th allocation methodology. This finding was sited because the Health System did not allocate the budget on a 1/12th basis but used a more accurate methodology in allocating it's budget.