MERCY HEALTHNon-Profit

Finding 2025-001 – N. Special Tests and Provisions – N6. NSLDS Reporting Identification of the federal program: Federal Agency: U.S. Department of Education Federal Cluster: Student Financial Assistance (SFA) Cluster Assistance Listing Nos.: 84.063, Federal Pell Grant Program, and 84.268, Federal Direct Student Loans Award Year: July 1, 2024–June 30, 2025 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The internal controls should align with the guidance in ”Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the ”Internal Control — Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Internal controls over the review and approval of the enrollment report sent to the third-party servicer, National Student Clearinghouse (NSC), were not adequately designed or operating effectively as follows: • A record count reconciliation between the enrollment report submitted to the NSC and the number of files received by the NSC, and documentation over how any rejected records were addressed, is not performed as part of the internal control. • Details of the validation of student information included in the enrollment report for accuracy prior to being sent to the NSC were not retained by Mercy Health. • Details of the NSC error report and corrections made were not retained by Mercy Health. Cause: Mercy Health did not have adequately designed internal controls in place surrounding the enrollment reporting process to the National Student Loan Data System (NSLDS). Effect or Potential Effect: Mercy Health may not report accurate and complete enrollment data timely to the NSLDS. Questioned Costs: $0 Context: Total SFA Cluster expenditures reported in the schedule of expenditures of federal awards were $1,715,151, of which $674,824 represents Federal Pell Grant Program expenditures and $1,019,508 represents Federal Direct Student Loans. Identification as a Repeat Finding: This finding is not a repeat finding from the prior year. Recommendation: The internal control should be designed to include a reconciliation of records transmitted and received by NSC as well as maintain documentation over the review and approval of the enrollment report for accuracy and completeness prior to sending to NSC. Further, we recommend that documentation over rejections and details of NSC error report and corrections made should be retained to evidence the operating effectiveness of internal controls. Views of Responsible Officials: Mercy Health will implement a mandatory, documented reconciliation process for every submission, formalize the validation process and retain evidence of accuracy checks, and establish a procedure for downloading and retaining error reports. By implementing these actions, Southeast Missouri Hospital College of Nursing & Health Sciences will ensure compliance with federal regulations regarding the accuracy and timeliness of student enrollment reporting to the NSC and NSLDS.

Finding 2023-001 Activities Allowed or Unallowed Identification of the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.498, COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Period of Availability: 01/01/2020–12/31/2022 (Period 4) and 01/01/2020–06/30/2023 (Period 5) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The American Rescue Plan Act requires that the Recipients of Provider Relief Fund payments must agree to the Terms and Conditions specific to the distribution in which they received a payment or reimbursement, such as: Funding cannot be used where another source has reimbursed or is obligated to reimburse those expenses or losses. Condition: Management performed a duplication of benefits analysis to ensure expenses to be used to substantiate PRF funding received were not reimbursed or obligated to be reimbursed by another source. The methodology included the development of estimated cost reimbursement rates by location that was applied to the PRF expenditures. During our allowable costs testing of expenditures, we noted errors in the duplication of benefits analysis and/or misapplication of the estimated cost reimbursement rates, which resulted in a net overstatement of expenses totaling $2,078,408. In addition, we noted instances where employees’ hours reported on the timecards for substantiation of funding for the federal program were not consistently evidenced as reviewed and approved. Cause: Duplication of Benefits Analysis – The internal controls over management’s duplication of benefits analysis and application of the estimated cost reimbursement rates were ineffective. Timecards – Timecards were processed without manager approval. Effect or potential effect: Duplication of Benefits Analysis – Mercy Health overstated expenses and is not in compliance with the terms and conditions of the federal award. Timecards – Mercy Health may incur unallowable expenses or not be compliant with the terms and conditions of the federal program. Questioned costs: $2,078,408 – Assistance Listing No. 93.498 (COVID-19). Context: Duplication of Benefits Analysis – For four of five sampled facilities, management did not calculate overtime and contract labor expenses using the correct estimated cost reimbursement rates or did not calculate the duplication of benefits analysis accurately resulting in a net overstatement of reported expenditures of $2,078,408. Timecards – For three (totaling $765) of 40 (totaling $16,939) (4.5%) overtime and contract labor transactions tested, Mercy Health or contracted employees’ timecards did not have evidence of review and approval by the Mercy Health or contracted employees’ manager. Total overtime and contract labor costs were $9,811,805 under Assistance Listing No. 93.498 for the year ended June 30, 2023. Total federal expenditures for Assistance Listing No. 93.498 totaled $104,538,125 for the year ended June 30, 2023, of which $10,154,731 were expenditures. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Duplication of Benefits Analysis – Management should design and implement effective internal controls over the review and approval of the duplication of benefits analysis and ensure the correct estimated cost reimbursement rates are being applied to the expenditures. Timecards – Mercy Health should reinforce the importance of adhering to its internal controls over the review and approval of timecards. Views of Responsible Officials: Management agrees to the finding and has developed a corrective action plan. While we overstated the expenses submitted totaling $2.1 million, this was an oversight during our review process. There are additional expenditures available in excess of funding received; therefore, we believe we have incurred either lost revenues or expenditures in excess of funding received. Mercy Health’s Finance team will continue to stress the importance of timecard approval to leadership.

Finding 2023-002 Reporting Identification of the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.498, COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Period of Availability: 01/01/2020–12/31/2022 (Period 4) and 01/01/2020–06/30/2023 (Period 5) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The terms and conditions of the award require the recipient to submit reports as the secretary of HHS determines are needed to ensure compliance with the conditions that are imposed on the payment, and such reports shall be in such form, with such content, as specified by the secretary of HHS in future program instructions directed to all recipients. Condition: For one of the sampled PRF reports (Mercy Hospital South Period 5 PRF Report), the amount reported for net patient service revenue (NPSR) for calendar year 2023 quarter 2 (CY2023 Q2) was incorrect for one reporting tax identification number (TIN). Cause: Management’s review of the NPSR for CY2023 Q2 in Mercy Hospital South’s Period 5 PRF Report was not sufficiently precise to detect the error. Effect or potential effect: NPSR was incorrectly reported for CY2023 Q2 for one reporting TIN. Questioned costs: None. Context: We tested seven of 38 Periods 4 and 5 PRF Reports submitted to HRSA. For one of the seven reports tested, we noted the NPSR amount reported was incorrect by $6,749,388. For CY2023 Q2, Mercy Hospital South Period 5 reported NPSR of $135,729,608 while the correct amount that should have been reported is $128,980,220. However, since the incorrectly reported NPSR amount did not result in any lost revenues reported for this quarter (lost revenues reported for CY2023 Q2 were $0), this error did not result in a questioned cost. Total federal expenditures for Assistance Listing 93.498 totaled $104,538,125 for the year ended June 30, 2023, of which $94,383,394 were lost revenues. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Mercy Health should ensure internal controls over the review of PRF Reports are enhanced to include sufficient precision to allow for accurate reporting. Views of Responsible Officials: Management agrees to the finding and has developed a corrective action plan. One cost report adjustment for the current year was inaccurately labeled as a prior year adjustment. This was an isolated oversight by our revenue analysis team.

Finding 2023-003 Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions Identification of the federal program: Federal Grantor: United States Department of Homeland Security Pass-Through Grantors: State of Missouri, State Emergency Management Agency Arkansas Division of Emergency Management Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Award Numbers and Award Periods: Project# 185883 P/W# 529 01/20/2020–09/14/2020 Project# 699963 P/W# 624 01/01/2022–07/01/2022 Project# 699667 P/W# 233 01/01/2022–07/01/2022 Project# 699670 P/W# 211 01/01/2022–07/01/2022 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As described in Title 2 Code of Federal Regulations (C.F.R.) § 200.333, financial records, supporting documents, statistical records and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three (3) years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. In addition, 2 CFR Section 200.403 of the Uniform Guidance states the following regarding the factors affecting the allowability of costs: “Except where otherwise authorized by statue, costs must meet the following general criteria in order to be allowable under Federal awards: (g) Be adequately documented.” Condition: Adequate documentation was not retained to support the average unit cost applied to COVID-19 personal protective equipment (PPE) inventory usage charged to the FEMA program as Force Account Material (FAM) costs. In addition, for 12 of 40 non-FAM costs (including purchased equipment, purchased supplies, and rental equipment) charged to the program, we noted adequate documentation was not retained to evidence review and approval of the expenditure for allowability. Cause: Management did not have sufficiently designed internal controls in place over the review and approval of average unit costs applied to FAM usage charged to the FEMA program. In addition, for 11 non-FAM (purchased equipment) transactions from fiscal year 2020 charged to the FEMA program, expenditure approvals were maintained in a legacy general ledger system and upon migration to the current general ledger system, the approval trail was not retained. For one other non-FAM (purchased equipment) transaction from fiscal year 2022 charged to the FEMA program, the required level of approvals of the purchase-card transaction was not retained. Effect or potential effect: For FAM costs, Mercy Health is not in compliance with the general criteria of maintaining adequate documentation that supports the average unit costs used in the calculation and determination of the costs charged to the federal program. For non-FAM costs, Mercy Health may not be compliant with the allowability of costs requirements of the FEMA program. Questioned costs: $45 – Assistance Listing No. 97.036 (COVID-19). Context: We sampled 40 FAM costs (totaling $2,826 in federal expenditures) and agreed the PPE inventory item’s usage to supporting requisition documentation. In addition, we obtained the external vendor invoice for the purchase of the PPE inventory item immediately prior to the usage of the PPE inventory item. However, for all 40 sampled FAM costs, we could not verify the average unit cost that is used in determining the amount charged to the FEMA program. The net overstatement of the costs based on the average unit cost for these 40 sampled FAM costs in comparison to the external vendor invoices was $45. In addition, we sampled 40 non-FAM costs (totaling $218,110 in federal expenditures) and noted that 12 purchased equipment transactions (totaling $182,048 in federal expenditures) did not have support retained to evidence review and approval of the expenditure for allowability. FAM costs and non-FAM costs represent 71% and 29%, respectively, of total federal expenditures for the FEMA program of $3,383,897 for the year ended June 30, 2023. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Management should design and implement effective internal controls over the review and approval of all costs charged to the FEMA program. Views of Responsible Officials: Mercy Health has a system to calculate average cost of inventory items. We rely on this system, but it was not tested as part of compliance. In addition, Mercy Health has a robust capital approval process (for all equipment) and financial approval thresholds. All COVID purchases were logged in the capital system (VFA) and approvals were documented. During this time, we changed approval systems from VFA to Strata. We will ensure all capital is reviewed and approved in Strata going forward.

Finding 2023-004 Reporting Identification of the federal program: Federal Grantor: United States Department of Homeland Security Pass-Through Grantor: State of Missouri, State Emergency Management Agency Assistance Listing No.: 97.036, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA) Pass-Through Award Numbers: Project# 699963 P/W# 624; Project# 185883 P/W# 529; and Project# 150136 P/W# 171 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Instructions from State of Missouri, State Emergency Management Agency states “In accordance with Public Assistance Program policy, applicants, on quarterly basis, must submit a report identifying the status of each of their open/incomplete projects in each disaster for which they are applicant”. Condition: Timeliness and submission of the quarterly reports required by the State of Missouri could not be verified. Cause: Management did not retain the supporting documentation to evidence the submission of the quarterly reports. Effect or potential effect: Mercy Health potentially did not file the required reports with the State of Missouri on a timely basis and was not in compliance with the program reporting requirements. Questioned costs: None. Context: Mercy Health had a total of eight quarterly report submissions for the year ended June 30, 2023. We tested five of the eight quarterly reports and management did not retain supporting documentation of timely submission for any of the reports. The total federal expenditures for the program in fiscal year 2023 related to the FEMA grants was $3,383,897. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Mercy Health should implement internal controls over the retention of supporting evidence of timely submission of the reports. Views of Responsible Officials: The state of Missouri requires all quarterly reports be mailed. While we did send in our quarterly reports to the state of Missouri as required, we do not have proof of submissions as we did not send by certified mail. All future quarterly reporting will be documented with an email to our state SEMA representative when we send out quarterly reports so there is documentation for our records.

Finding 2022-001 Activities Allowed or Unallowed and Eligibility Information on the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID-19 HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund (HRSA COVID-19 Uninsured Program) Award Period of Performance: 07/01/2021?06/30/2022 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Mercy Health did not retain supporting documentation over the HRSA COVID-19 Uninsured Program report query logic (the Report) that was developed to identify patients that meet the allowability and eligibility requirements of the HRSA COVID-19 Uninsured Program. In addition, supporting documentation was not retained to validate who had access to modify and run the script, what changes were made to the script, and how any changes to the script were tested and implemented during the fiscal year based on changes to Health Resources and Services Administration (HRSA) guidance. Further, management did not maintain supporting documentation to demonstrate how it validated the completeness and accuracy of the data extracted by the script. In addition, Mercy Health did not retain supporting documentation over its approval of HRSA COVID-19 Uninsured Program claims, determination of a patient?s uninsured/self-pay status, and review of credit balances. While management had a process to identify and review claims for allowability under the HRSA COVID-19 Uninsured Program, determine a patient?s uninsured/self-pay status through third-party insurance discovery, and review of credit balances, sufficient supporting documentation was not retained to support internal controls over the process. Cause: Development of the Report occurred outside of the Information Technology (IT) department that would require a formal process for the development of IT reports, access and program changes; the report resided in the Revenue Cycle department. The Revenue Cycle department did not develop internal control over report writing, program changes and user access. In addition, while management represented that the Report?s logic and subsequent changes to the Report?s logic were reviewed, no audit evidence was retained to support internal controls over that process. Management represented it performed a review of claims charged to the HRSA COVID-19 Uninsured Program for allowability; however, supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Standard policies, procedures, and internal controls over the review for patient insurance coverage and review of credit balances used in the federal program were not suitability designed to address the unique aspects of the HRSA COVID-19 Uninsured Program. Effect or potential effect: The Report used to identify eligible federal program participants could be inaccurate or incomplete. Unallowable services may be submitted for reimbursement to the HRSA COVID-19 Uninsured Program. A patient may not be uninsured and, therefore, the related encounter may be ineligible for reimbursement under the HRSA COVID-19 Uninsured Program. Credit balances may not be resolved timely and refunds to the HRSA COVID-19 Uninsured Program may not be identified or completed in a timely manner. Questioned costs: None. Context: Total federal expenditures for Assistance Listing 93.461 totaled $14,281,788 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: The finding is a repeat of finding 2021-001 from the prior year. Recommendation: The HRSA COVID-19 Uninsured Program ended in the first quarter of 2022. Therefore, no further changes are required to the current internal controls over this program or the related documentation of the operation of internal controls. If the program were to be reinstated, Mercy Health should implement sufficiently precise internal controls to review changes to the HRSA COVID-19 Uninsured Program to ensure it is administering the program in compliance with the HRSA COVID-19 Uninsured Program regulations. In addition, internal controls should be implemented to ensure claims submitted to the HRSA COVID-19 Uninsured Program meet the allowability criteria established by the HRSA COVID-19 Uninsured Program regulations before claims are submitted to HRSA for reimbursement. Management should retain documentation of the operation of controls responsive to risks related to the data stored in its IT systems as evidence of control activities. Credit balances should be resolved on a timely basis to ensure the HRSA COVID-19 Uninsured Program is refunded timely if third-party insurance is subsequently identified. Views of Responsible Officials: In March 2022, HRSA announced that the HRSA COVID-19 Uninsured Program was ending. Therefore, remediation of internal controls is no longer applicable. If this program is reinstated, Mercy Health will take the necessary steps to ensure proper documentation is retained to provide evidence of our internal control processes.

Finding 2022-002 Reporting Information on the federal program: Federal Grantor: United States Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.498, COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Provider Relief Fund Reporting Entities: Mercy Hospital Fort Smith, Mercy Hospital Springfield, Mercy Hospital Oklahoma City, Mercy Hospital Joplin Tax Identification Numbers: 710240352, 440552485, 730579285, 270814858 Period of Availability: 01/01/2020?12/31/2021 (Period 2) and 01/01/2020?06/30/2022 (Period 3) Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The terms and conditions of the award require the recipient to submit reports as the secretary of HHS determines are needed to ensure compliance with the conditions that are imposed on the payment, and such reports shall be in such form, with such content, as specified by the secretary of HHS in future program instructions directed to all recipients. Condition: The amounts reported for net patient service revenue (NPSR) by payer for calendar year 2021 Quarter 4 (CY2021 Q4) were incorrect. However, total NPSR was correct. Cause: Management?s review of the allocation of total NPSR to the payer classification required in the PRF report was not sufficiently precise to detect that the incorrect quarter?s payer percentages were used to allocate gross revenue for CY2021 Q4. Effect or potential effect: NPSR by payer was incorrectly reported for CY2021 Q4. Questioned costs: None. Context: We tested 5 of 14 Period 2 and 3 PRF Reports submitted to HRSA. For 4 of the 5 Period 2 and 3 PRF reports tested, the NPSR amounts reported by payer were incorrect for CY2021 Q4 as follows (increase/(decrease)): See chart/table in the Schedule of Findings and Questioned Costs. The differences noted by payer resulting from the use of incorrect allocation percentages did not impact total NPSR reported for CY2021 Q4. Total federal expenditures for Assistance Listing 93.498 totaled $81,685,379 for the year ended June 30, 2022. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Mercy Health should ensure internal controls over the review of PRF Reports are enhanced to include sufficient precision to allow for accurate reporting of NPSR by payer. Views of Responsible Officials: While there was no impact on total NPSR reported for Q4 2021, we agree that the percentages used to allocate gross revenue by payer were incorrect. Going forward, we will provide additional review of payer allocation percentages to ensure accuracy.

Finding 2021-001 Activities Allowed or Unallowed, Eligibility and Special Tests and Provisions Information on the federal program: Federal Grantor: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID-19 HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund (HRSA COVID-19 Uninsured Program) Mercy Community: Various Award Number: Various Award Period of Performance: 07/01/2020?06/30/2021 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Mercy Health did not retain supporting documentation over the Uninsured COVID-19 report query logic (the Report) that was developed to identify patients that meet the allowability and eligibility requirements of the HRSA COVID-19 Uninsured Program. In addition, supporting documentation was not retained to validate who had access to modify and run the script, what changes were made to the script, and how any changes to the script were tested and implemented during the fiscal year based on changes to Health Resources and Services Administration (HRSA) guidance. Further, management did not maintain supporting documentation to demonstrate how it validated the completeness and accuracy of the data extracted by the script. In addition, Mercy Health did not retain supporting documentation over its approval of HRSA COVID-19 Program claims, determination of a patient's uninsured/self-pay status, and review of credit balances. While management had a process to identify and review claims for allowability under the HRSA COVID-19 Uninsured Program, determine a patient's uninsured/self-pay status through third-party insurance discovery, and review of credit balances, sufficient supporting documentation was not retained to support internal controls over the process. Cause: Development of the Report occurred outside of the Information Technology (IT) department that would require a formal process for the development of IT reports, access and program changes; the report resided in the Revenue Cycle department. The Revenue Cycle department did not develop internal control over report writing, program changes and user access. In addition, while management represented that the Report?s logic and subsequent changes to the Report?s logic were reviewed, no audit evidence was retained to support internal controls over that process. Management represented it performed a review of claims charged to the HRSA COVID-19 Uninsured Program for allowability; however, supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Standard policies, procedures, and internal controls over the review for patient insurance coverage and review of credit balances used in the federal program were not suitability designed to address the unique aspects of the HRSA COVID-19 Uninsured Program. Questioned costs: None. Context: Total federal expenditures for Assistance Listing 93.461 totaled $16,078,539 for the year ended June 30, 2021. Effect or potential effect: The Report used to identify eligible federal program participants could be inaccurate or incomplete. Unallowable services may be submitted for reimbursement to the HRSA COVID-19 Uninsured Program. A patient may not be uninsured and therefore the related encounter may be ineligible for reimbursement under the HRSA COVID-19 Uninsured Program. Credit balances may not be resolved timely and refunds to the HRSA COVID-19 Uninsured Program may not be identified or completed in a timely manner. Identification as a repeat finding, if applicable: The finding is a repeat of finding 2020-001 from the prior year. Recommendation: The HRSA COVID-19 Uninsured Program ended in the first quarter of 2022. Therefore, no further changes are required to the current internal controls over this program or the related documentation of the operation of internal controls. If the program were to be reinstated, Mercy Health should implement sufficiently precise internal controls to review changes to the HRSA COVID-19 Uninsured Program to ensure it is administering the program in compliance with the HRSA COVID-19 Uninsured Program regulations. In addition, internal controls should be implemented to ensure claims submitted to the HRSA COVID-19 Uninsured Program meet the allowability criteria established by the HRSA COVID-19 Uninsured Program regulations before claims are submitted to HRSA for reimbursement. Management should retain documentation of the operation of controls responsive to risks related to the data stored in its IT systems as evidence of control activities. Credit balances should be on a timely basis to ensure the HRSA COVID-19 Uninsured Program is refunded timely if third party insurance is subsequently identified. Views of Responsible Officials and Planned Corrective Actions: In March 2022, HRSA announced that the HRSA COVID-19 Uninsured Program was ending. Therefore, remediation of internal controls is no longer applicable. If this program is reinstated, Mercy will take the necessary steps to ensure proper documentation is retained to provide evidence of our internal control processes.

Finding 2021-002 Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance Information of the federal program: Federal Grantor: United States Department of Treasury Pass-Through Entities: See table Assistance Listing No.: 21.019, COVID-19 Coronavirus Relief Fund (CRF) Mercy Entity: See table Pass-Through Award Numbers: See table Pass-Through Award Period of Performance: See table Pass-Through Entity Mercy Entity Pass-Through Award Number Pass-Through Award Period of Performance Jefferson County Mercy Foundation Jefferson Not specified 03/01/2020-12/31/2021 State of Arkansas Child Advocacy Not specified 03/18/2020-11/16/2020 Jefferson County Jefferson RR18835 03/01/2020-12/31/2020 Lincoln County Lincoln Not specified 03/01/2020-12/31/2020 Greene County Springfield 554 03/01/2020-12/31/2020 Oklahoma Ambulance Association Ada Not specified 03/01/2020-12/31/2020 Chickasaw Nation Ada 1391713 03/01/2020-04/30/2021 Chickasaw Nation Ardmore 1428136 03/01/2020-12/31/2020 Chickasaw Nation Healdton 1428152 03/01/2020-07/15/2021 Chickasaw Nation Tishomingo 1391016 03/01/2020-04/30/2021 Newton County Joplin 310-67, 310-68, 310-69, 310-70 03/01/2020-12/31/2020 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Management did not retain supporting documentation over its review and approval of CRF expenses, including the benefit rate used to determine fringe benefits. While management had a process to identify and review expenses for allowability under the CRF program, sufficient supporting documentation was not retained to support internal controls over the process. Cause: Management represented it performed a review and approval of CRF expenses for allowability and period of performance; however, supporting documentation to evidence that the internal controls were sufficiently designed and operating effectively was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of expenses for allowability and period of performance could result in unallowable expenses being charged to the CRF program. Questioned costs: None. Context: Total federal expenditures for Assistance Listing No. 21.019 reported in the SEFA totaled $5,185,815 for the year ended June 30, 2021. Identification as a repeat finding, if applicable: The finding is partially a repeat of Finding 2020-002 from the prior year. Recommendation: Although this federal pass-through program has ended, for similar federal pass-through programs in the future, Mercy Health should formalize internal controls related to review and approval of expenditures, including elements of the review process validated by the reviewer and related underlying support for all significant inputs to calculations (and changes thereto) used in the performance of the control should be maintained. Views of Responsible Officials: The funding received in the table above were one-time awards, so remediation of internal controls is no longer applicable. However, for future funding, Mercy?s Grant Center of Excellence (COE) within Finance will work with local Finance and Grant Operational areas to develop a checklist and/or formal Memo of the review and approval of key inputs to strengthen our internal documentation of internal controls. We also will ensure a layer of review and approval that checks that the analysis of allowable costs is consistent across our facilities when the program spans multiple facilities with different management oversight.

Finding 2021-003 Reporting (SEFA Preparation) Information of the federal program: Federal Grantor: United States Department of Treasury Pass-Through Entity: Chickasaw Nation Assistance Listing No.: 21.019, COVID-19 Coronavirus Relief Fund (CRF) Mercy Entity: Mercy Hospital Healdton Pass-Through Award Number: 1428152 Pass-Through Award Period of Performance: 03/01/2020-07/15/2021 Federal Grantor: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID-19 HRSA COVID-19 Claims Reimbursement for the Uninsured Program and the COVID-19 Coverage Assistance Fund (HRSA COVID-19 Uninsured Program) Mercy Community: Various Award Number: Various Award Period of Performance: 07/01/2020?06/30/2021 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The Uniform Guidance 2 CFR section 200.510 states, ?(b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of federal awards (SEFA) for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with ?200.502 Basis for determining Federal awards expended.? Condition: CRF ? In preparing the schedule of expenditures of federal awards (SEFA), management improperly included two invoices totaling $255,481 in federal expenditures for the CRF program that were not incurred until fiscal year 2022. HRSA COVID-19 Uninsured Program ? In preparing the SEFA, management double-counted vaccine administration costs in the total federal expenditures reported for the program by $582,052. Cause: Mercy Health?s internal controls in place over the preparation of the SEFA were not sufficient to accurately report expenditures of federal awards for the CRF and HRSA COVID-19 Uninsured Program. Effect or potential effect: Federal expenditures may be inappropriately included or excluded from the SEFA. Questioned costs: None. Context: CRF ? Total federal expenditures for Assistance Listing No. 21.019 reported in the SEFA after adjustment totaled $5,185,815 for the year ended June 30, 2021. HRSA COVID-19 Uninsured Program ? Total federal expenditures for Assistance Listing No. 93.461 reported in the SEFA after adjustment totaled $16,078,539 for the year ended June 30, 2021. Identification as a repeat finding, if applicable: This is not a repeat finding. Recommendation: Mercy Health should strengthen its internal controls over the preparation and review of the SEFA. Views of Responsible Officials: Mercy?s Grants Center of Excellence (COE) within Finance will work with teams providing information to ensure proper understanding of what to report for the Schedule of Expenditures of Federal Awards. Additionally, the COE will ensure that as they compile and review the expenditure information that they do a specific check for these types of programs to ensure that the reporting is not duplicated and reported in the correct fiscal year.

Finding 2020-001 Activities Allowed or Unallowed and Eligibility Information on the federal program: Federal Grantor: United States Department of Health and Human Services, Health Resources and Services Administration (HRSA) Assistance Listing No.: 93.461, COVID-19 Testing for the Uninsured Mercy Community: Various Pass-Through Award Number: Various Pass-Through Award Period of Performance: 02/04/2020?06/30/2020 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Mercy Health did not retain supporting documentation over the Uninsured COVID-19 report query logic (the Report) that was developed to identify patients that meet the allowability and eligibility requirements of the federal program. In addition, supporting documentation was not retained to validate who had access to modify and run the script, what changes were made to the script, and how any changes to the script were tested and implemented during the fiscal year based on changes to Health Resources and Services Administration (HRSA) guidance. Further, management did not maintain supporting documentation to demonstrate how it validated the completeness and accuracy of the data extracted by the script. Cause: Development of the Report occurred outside of the Information Technology (IT) department that would require a formal process for the development of IT reports, access and program changes; the report resided in the Revenue Cycle department. The Revenue Cycle department did not develop internal control over report writing, program changes and user access. In addition, while management represented that the Report?s logic and subsequent changes to the Report?s logic were reviewed, no audit evidence was retained to support that process. Questioned costs: None. Context: Total federal expenditures for Assistance Listing 93.461 totaled $1,855,550 for the year ended June 30, 2020. Effect or potential effect: The Report used to identify eligible federal program participants could be inaccurate or incomplete. Identification as a repeat finding, if applicable: The finding is not a repeat finding. Recommendation: Mercy Health should implement internal controls related to access, change management, and completeness/accuracy over the Report. Views of Responsible Officials: Mercy Health agrees with the finding and has developed a plan to correct the finding. Mercy Health?s Revenue Management team has added a workflow to retain documentation of the process for report development and changes. This process now requires report changes be requested and tracked within the change ticketing system within Mercy Health?s IT Department. This process will include the testing of a sample of uninsured claims before a report is released to production. The report will then be scheduled to be distributed to the insurance collection members who are responsible for submission to HRSA for enrollment of uninsured qualified COVID-19 patients.

Finding 2020-002 Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance Information on the federal program: Federal Grantor: United States Department of Treasury Pass-Through Entity: Arkansas Department of Human Services Assistance Listing No.: 21.019, COVID-19 Coronavirus Relief Fund Mercy Community: Various Pass-Through Award Number: Not specified Pass-Through Award Period of Performance: 04/05/2020?05/30/2020 Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The Arkansas Department of Human Services? (DHS) Instructions to Claim Funds for Direct Care and Non-Direct Care Workers in Hospitals Due to COVID-19 Emergency (Instructions) and Payments to Direct Care Workers and Non-direct Care Workers in Hospitals and Long-term Services and Supports (LTSS) Settings Frequently Asked Questions (FAQs) dated May 5, 2020, and May 11, 2020, outline the purpose of the federal pass-through program made available to the state under Section 601 of PL 116-136, the ?Coronavirus Relief Fund? of the Coronavirus Aid, Relief, and Economic Security Act (?CARES?) Act and the related allowable costs. The federal pass-through program allows for the following: ? Payments to workers through the hospital which employs or contracts for the worker whom are classified as 1) direct care workers in hospitals, 2) non-direct care workers in hospitals, and 3) non-direct caseworkers in nursing/LTSS facilities and employer contributions to FICA and retirement accounts. ? Payments for an eight-week period beginning April 5, 2020, and ending May 30, 2020. The amount of payments per designated worker is contingent upon 1) the number of hours worked in a week for direct care and non-direct care workers and 2) whether there were COVID-19 positive patients in the hospital for the weeks being paid, determined on a weekly basis. Amount of the payment is based on the tables published in the Instructions and FAQs. Condition: Although a process was in place to manage the federal pass-through program, internal controls were not effectively designed or in place over the review and approval of key inputs to the direct care and non-direct care worker payments calculation, including 1) the accumulation of productive hours, 2) identification and classification of workers as direct care and non-direct care, and 3) identification of COVID-19 positive patients in the hospital for the weeks being paid. Specifically, Mercy Health did not retain adequate supporting documentation over the eligible co-workers and hours report query logic (the Report) that was developed to identify workers eligible as direct care and non-direct care workers as defined by the Arkansas DHS and determine productive versus non-productive hours. In addition, adequate supporting documentation was not retained to validate who had access to modify and run the Report, what changes were made to the Report, how changes to the Report were tested and implemented, and how management validated the completeness and accuracy of the data extracted by the Report. Furthermore, the reports created from Mercy Health?s electronic medical records system to track COVID-19 confirmed patients and populate the COVID-19 dashboard that was used in the direct care and non-direct care worker payments calculation were not retained. As part of compliance testing over allowability, we identified exceptions related to three of 44 workers sampled where the incorrect amount was used from the payment tables published by the Arkansas DHS, resulting in total underpayments from the federal pass-through program. Through additional testing procedures performed, we noted exceptions to direct care and non-direct care worker classifications also resulting in net underpayments from the federal pass-through program. Cause: The review and approval process over the key inputs to the direct care and non-direct care worker payment calculation workbooks was not formalized and was documented primarily through email correspondence that did not include the specific elements of the review process validated by the reviewers. Related to the identification of productive hours used in the calculation, certain payroll codes identified as productive per the report query logic were not used in the direct care and non-direct care worker payments calculation. Related to the classification of direct care and non-direct care workers, each Mercy Health hospital in Arkansas was responsible for determining the appropriate classification; however, there was not an internal control in place to review the consistency of the classifications between the hospitals and in accordance with the Arkansas DHS FAQs. Since the inception of the pandemic, Mercy Health tracked and continues to track COVID-19 patients in their hospitals daily. The reports created from Mercy Health?s electronic medical records system to track COVID-19 confirmed patients and used to populate its COVID-19 dashboard used in the direct care and non-direct care worker payments calculation were not retained specific to the eight-week period of the federal pass-through program. COVID-19 patients continue to be documented in Mercy Health?s electronic health record. Questioned costs: None. Context: For three (totaling $1,250 in federal expenditures) of 44 (totaling $19,375 in federal expenditures) workers sampled (6.8%), the incorrect amount was used from the payment tables published by the Arkansas DHS based on incorrect productive hours accumulation resulting in total underpayments of $375 from the federal pass-through program. To determine the consistency of direct care and non-direct care worker classifications across the Mercy Health Arkansas hospitals sampled, we tested 69 direct care worker classifications and 82 non-direct care worker classifications. Of these, we noted three (4.3%) direct care worker classifications and three (3.7%) non-direct care worker classifications that were not in compliance with the May 11, 2020, Arkansas DHS FAQ, resulting in net underpayments of $11,909 from the federal pass-through program. Total federal expenditures for Assistance Listing 21.019 totaled $4,344,418 for the year ended June 30, 2020. Effect or potential effect: Certain amounts paid to direct care and non-direct care workers had errors. Identification as a repeat finding, if applicable: The finding is not a repeat finding. Recommendation: Although this federal pass-through program has ended, for similar federal pass-through programs in the future, Mercy Health should formalize internal controls related to review and approval, including elements of the review process validated by the reviewer and related underlying support for all significant inputs to calculations (and changes thereto) used in the performance of the control should be maintained. Views of Responsible Officials: Mercy Health agrees with the finding and has developed a plan to correct the finding. This program was a one-time program that covered an eight-week period of fiscal year 2020. It was unlike any federal award program Mercy Health had dealt with previously. There were several layers of review and approval that Mercy Health incorporated into the reporting processes for this funding. However, sufficient documentation was not retained that outlined step by step the work done to ensure compliance. Mercy Health?s Finance Grants Center of Excellence will work with local Finance and Grant Operational areas to develop a checklist and/or formal memo of the review and approval of key inputs to strengthen internal documentation of internal controls. We also will ensure a layer of review and approval that checks the analysis of allowable costs is consistent across our facilities when the program spans multiple facilities with different management oversight.

Finding 2019-001 (Subrecipient Monitoring) Information on the federal program Federal Agency: U.S. Department of Health and Human Services Pass-Through Agency: Medical Device Innovation Consortium (6292-2019-R1TC1-007) Federal Cluster: Research and Development (R&D) CFDA No.: 93.103, Food and Drug Administration_Research Award Number: 5U01FD005476-03 REVISED and 6292-2019-R1TC1-007 Award Project Period: September 15, 2015?June 30, 2019 and May 1, 2019?Ongoing Criteria or specific requirement (including statutory, regulatory or other citation) Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Section 200.331 of the Uniform Guidance states that all pass-through entities must: ?(b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F?Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency).? Section 200.331 of the Uniform Guidance further states that all pass-through entities must: ?(g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records.? Condition Although subrecipient monitoring procedures were performed and documented during the fiscal year, Mercy Health did not perform a risk assessment upon entering into subaward agreements with its subrecipients in order to determine the extent of monitoring procedures that should be performed to be responsive to the assessed risk. In addition, although Mercy Health obtained the Uniform Guidance audit report from its subrecipients, Mercy Health did not document its review of and conclusions reached on the subrecipient Uniform Guidance audit reports. Cause Mercy Health does not have a written subrecipient monitoring policy. Questioned costs None. Context Mercy Health had two subrecipients that required monitoring during the fiscal year. Federal expenditures passed through to subrecipients as reported in the schedule of expenditures of federal awards were $71,429 for the fiscal year ended June 30, 2019, representing 13% of total R&D Cluster expenditures of $554,806. Effect or potential effect Monitoring performed over a subrecipient may not be responsive to the risk for that subrecipient. A subrecipient?s Uniform Guidance audit report could contain findings that are not properly reviewed and evaluated. Identification as a repeat finding, if applicable The finding is not a repeat finding. Recommendation Mercy Health should establish a written subrecipient monitoring policy to address all aspects of the subrecipient monitoring compliance requirements outlined in Uniform Guidance Section 200.331 and perform and document a risk assessment of its subrecipients in accordance with Uniform Guidance Section 200.331(b). In addition, Mercy Health should modify the subrecipient Uniform Guidance audit report certification to include a section for Mercy Health to document its review of and conclusions reached over the subrecipient?s Uniform Guidance audit report. Views of responsible officials Management agrees with the finding and has developed a plan to correct the finding.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION