Centra Health, Inc.

Information on the Federal Program - Federal Pell Grant Program (ALN: 84.063) and Federal Direct Stafford Loans (ALN: 84.268) Criteria or Specific Requirement – N. Special Tests and Provisions - The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the GLBA because they appear to be significantly engaged in wiring funds to consumers. Under an institution’s Program Participation Agreement with the Department of Education (ED) and the GLBA, institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the federal student financial aid programs. Accordingly, institutions are required to develop, implement, and maintain a written comprehensive information security program. Condition – During our audit procedures, we noted that Centra’s written information security program did not entirely meet all minimum requirements of the GLBA and therefore was not fully in compliance with the requirement. Cause – Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect – Centra is not fully in compliance with the GLBA requirement for the year ended December 31, 2024. Questioned Costs – None. Context – Centra had designated a qualified individual responsible for overseeing and implementing and enforcing an information security program (16 CFR 314.4(a)) and have completed the risk assessment (16 CFR 314.4(b)), as required by the GLBA. However, the remaining five elements of the GLBA (16 CFR 314.4(c)–(g)) were still in process of being implemented as of December 31, 2024. As of December 31, 2024, five of the seven elements were partially implemented. Repeat Finding – This is a repeat of prior year finding 2023-001. Recommendation - We recommend that Centra maintain appropriate internal controls and administrative oversight in order to fully comply with the GLBA requirements of 16 CFR 314.4(c)–(g). Such would include (i) assessment, design, and implementation of safeguards; (ii) regularly test and monitor the safeguards; (iii) ensure ability to enact the information security program; (iv) oversee service providers and (v) adjust in light of results of testing and monitoring. Views of Responsible Officials – Centra management agrees with this finding and is in process of implementing a corrective action plan.

Information on the Federal Program - Federal Pell Grant (ALN: 84.063); Federal Direct Loans (ALN: 84.268) Criteria or Specific Requirement – The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the GLBA because they appear to be significantly engaged in wiring funds to consumers. Under an institution’s Program Participation Agreement with the Department of Education (ED) and the GLBA, institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the federal student financial aid programs. Accordingly, institutions are required to develop, implement, and maintain a written comprehensive information security program. Condition – During our audit procedures, we noted that Centra’s written information security program did not meet all minimum requirements of the GLBA and therefore was not fully in compliance with the requirement. Cause – Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect – Centra is not fully in compliance with the GLBA requirement for the year ended December 31, 2023. Questioned Costs – None. Context – During 2023, Centra designated a qualified individual responsible for overseeing and implementing and enforcing a information security program (16 CFR 314.4(a)). However, the remaining six elements of the GLBA (16 CFR 314.4(b)–(g)) were still in process of being implemented as of December 31, 2023. As of December 31, 2023, six of the seven elements were either partially implemented or not implemented. Repeat Finding – This is a repeat of prior year finding 2022-001. Recommendation - We recommend that Centra maintain appropriate internal controls and administrative oversight in order to fully comply with the GLBA requiremenets of 16 CFR 314.4(b)–(g). Such would include (i) performance of a risk assessment; (ii) assessment, design, and implementation of safeguards; (iii) regularly test and monitor the safeguards; (iv) ensure ability to enact the information security program; (v) oversee service providers; and (vi) adjust in light of results of testing and monitoring. Views of Responsible Officials – Centra management agrees with this finding and is in process of implementing a corrective action plan.

2022-001 ? Special tests and provisions Information on Federal Program(s) - Federal Pell Grant (ALN: 84.063); Federal Direct Loans (ALN: 84.268) Criteria or Specific Requirement ? The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers. Under an institution?s Program Participation Agreement with the ED and the Gramm-Leach-Bliley Act, institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the federal student financial aid programs. Accordingly, the Gramm-Leach-Bliley Act of the Special tests and provisions (N) compliance requirement states that the institution must designate an employee or employees to coordinate the information security program, perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), and document safeguards for identified risks. Condition ? During our review of the special tests and provisions (N) compliance requirement, we noted that Centra did not perform the Gramm-Leach-Bliley Act risk assessment during the year under audit and therefore was not in compliance with the requirement. Cause ? Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect ? Centra is not in compliance with the Gramm-Leach-Bliley Act requirement for the year ended December 31, 2022. Questioned Costs ? None. Context ? Centra did not perform the Gramm-Leach-Bliley Act risk assessment for the year under audit. Recommendation - We recommend that Centra maintain appropriate internal controls and administrative oversight in order to comply with the special tests and provisions (N) compliance requirement and to designate an employee or employees to coordinate the information security program, perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), and document safeguards for identified risks. Views of Responsible Officials ? Centra management agrees with this finding. While Centra had information security measures in place during the 2022 audit year, Centra was not aware of the specific GLBA requirements and did not complete the required risk assessment or have a designated individual responsible for coordinating the assessment. Centra has taken measures to ensure compliance going forward.

2022-002 ? Activities Allowed or Unallowed Information on Federal Program(s) - Provider Relief Fund and American Rescue Plan Rural Distribution (ALN: 93.498) Criteria or Specific Requirement ? The activities allowed or unallowed (A) compliance requirements of the program states that funds shall be available for building or construction of temporary structures, leasing of properties, medical supplies and equipment, including personal protective equipment and testing. Condition ? During our testing of the controls over and compliance with activities allowed or unallowed (A) by the program, we noted three instances of documentation that did not support the allowablility of the activity expensed to the program. Cause ? Controls as designed failed due to inadequate education of the respective control owner over proper execution of the control activity. Effect or Potential Effect ? Inappropriate execution of controls can result in expenses charged to the program that are for unallowable activities. Questioned Costs ? None. Context ? For three of 60 expenses selected for tests of controls and compliance, two items were found to be miscoded and for expenses that represent unallowable activities, and one item lacked complete supporting documentation of the allowable activity. Recommendation - We recommend that Centra continue to provide additional and ongoing education related to the specific requirements of the federal award programs and proper execution of related control activities. Views of Responsible Officials ? Centra management agrees with this recommendation. While Centra provides education on proper coding of expenses, human error can occur. Current internal controls are focused around compliance to Centra?s spend policy and authority limits. While human error is difficult to detect, management can work to prevent future errors by enhancing training materials and providing ongoing education to staff.

2021-001 - Eligibility Information on Federal Program(s) - Assistance Listing No. 93.461 COVID-19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine Administration for the Uninsured Criteria or Specific Requirement ? The Eligibility (E) compliance requirements of the program states that services must be for individuals who at the time the services were provided were uninsured as described in the terms and conditions of the award. Condition ? We were unable to test controls over compliance related to the activities performed by Centra that ensure each claim is for services provided to an eligible individual, i.e. an individual who did not have medical insurance coverage at the time of testing, treatment or vaccination. Cause ? Supporting documentation of the policies, procedures, and internal controls to ensure that only eligible costs were submitted for reimbursement from the federal program was not maintained in such a manner to allow for selection and tests of those controls during the audit. Effect or Potential Effect - We were unable to test the controls related to ensuring the allowability and validity of expenses that were claimed as federal expenditures. Questioned Costs ? None. Context ? We were unable to test internal controls over compliance. Repeat Finding - This is a repeat finding from prior year. This was reported as finding 2020-001 in the 2020 report. Recommendation - We recommend that Centra maintain documentation of its policies, procedures, and internal controls in an auditable fashion. Views of Responsible Officials ? Centra management agrees with this finding. Due to the timing of the finding listed in the report dated March 31, 2022, testing of internal controls over compliance on 2021 records was not able to be achieved. Subsequent to issuance of the report, new procedures were adopted to ensure policies and procedures are followed.

2020-001 - Eligibility Information on Federal Program(s) - Assistance Listing No. 93.461 COVID-19 Testing for the Uninsured Criteria or Specific Requirement ? The compliance requirements of the program states that services must be for individuals who at the time the services were provided were uninsured as described in the terms and conditions of the award. Condition ? During our testing of disbursements, we noted the following exceptions: ? Two of the 60 expenditures tested included supporting documentation indicating that the services were provided to an individual who had medical insurance coverage. Cause ? Policies, procedures, and internal controls were not adhered to rigorously in certain instances to ensure that only eligible costs were submitted for reimbursement from the federal program. Effect or Potential Effect - We were unable to confirm the allowability and validity of expenses that were claimed as federal expenditures. Questioned Costs ? Known questioned costs of $412. Context ? We tested a sample of 60 items and found two exceptions as noted in the condition. The dollar amount determined to be in error in that sample was $412, or 2.57% of the tested population dollar amount. This is a condition identified per review of Centra?s compliance with specified requirements using a randomly generated sample. Recommendation - We recommend that Centra ensure its policies, procedures, and internal controls are followed on a consistent basis. Views of Responsible Officials ? Centra management agrees with this finding. A need for new procedures and additional training has been identified. As such, management will add a second level review and formal sign-off process to ensure policies and procedures are followed.

2020-002 ? Aggregation of amounts to be included in the Schedule of Expenditures of Federal Awards Information on Federal Program(s) - Assistance Listing No. 93.461 COVID-19 Testing for the Uninsured Criteria or Specific Requirement ? CFR Section ?200.510(b) states in part: ?The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with ?200.502.? In accordance with ?200.302 Financial Management, a non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. The financial management system of the non-Federal entity must provide for the following: (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in ?200.328 Financial Reporting. (3) Records that identify adequately the source and application of funds for federally-funded activities. (4) Effective control over, and accountability for, all funds, property, and other assets. The Schedule should be reviewed for both completeness and accuracy and include all expenditures of Federal awards incurred in the period reported and exclude any costs that are not expenditures of Federal awards. Condition ? During our testing of disbursements, we noted the following exceptions: ? Five of the 60 expenditures tested included supporting documentation indicating that the amount recorded in the Schedule was incorrect. In three instances, supporting documentation indicated that additional funds should have been reported for each claim as amounts received and thus expended. In two instances, supporting documentation indicated that a party other than HRSA remitted payment for the claim and the amount should have been excluded from the Schedule as it was neither received from HSRA or incurred as an expenditure of the Federal award. Cause ? There were not policies, procedures, and internal controls developed to review revisions to amounts originally categorized as payments made from or due from the HRSA COVID-19 Testing and Treatment of the Uninsured program such that when amounts changed, or should have been recategorized as a self-pay or payment from another insurer, no change was made to the claim designation which was the criteria used for generating reports on the amounts of Federal awards received and expended for this Federal program. Effect or Potential Effect - We were unable to confirm the completeness and accuracy of the expenditures included in the amounts reported under the program. Questioned Costs - none Context ? We tested a sample of 60 items and found five exceptions as noted in the condition. The dollar amount determined to be in error in that sample was $314, or 1.96% of the tested population dollar amount. This is a condition identified per review of Centra?s compliance with specified requirements using a randomly generated sample. Recommendation - We recommend that Centra develop procedures and internal controls to review and revise the designated Payor Name and other relevant fields when a claim amount is changed, and ensure these policies and procedures are followed on a consistent basis so that only valid charges are aggregated for reporting under Uniform Guidance and that all amounts reported are complete. Views of Responsible Officials ? Centra management agrees with this finding and accepts the recommendation to develop a procedure to review and revise the designated payor name. Additionally, management will add a formal sign-off process to ensure compliance and to document verification of valid charges to be submitted.

2019-002 ? Special Tests and Provisions: Verification Information on Federal Program(s): Federal Pell Grant Program Federal Direct Student Loans Program CFDA No. 84.063 CFDA No. 84.268 OPE ID: 02175800 OPE ID: 02175800 IPEDS ID: 232618 IPEDS ID: 232618 Criteria or Specific Requirement: Per 34 CFR section ?668.56(a), for Federal Pell Grant Programs and Federal Direct Student Loans Programs that are subsidized student financial assistance programs as defined by 34 CFR section ?668.52(2), each award year the Secretary publishes in the Federal Register notice the FAFSA information that an institution and an applicant may be required to verify. Condition: During our testing of Verifications processed for award years within the current fiscal year, we noted one (1) of the seventeen (17) Verifications sampled and tested noted that information the institution was required to verify was not accurately verified. Cause: In the ordinary course of processing Verifications the institution reviews various documents, deemed to be acceptable by the Department of Education, that are provided by the applicant. Preparation of an application by an applicant and Verification of information on the application by the institution omitted untaxed income information reflected on the applicant?s Internal Revenue Service Form W?2. This omission caused the applicant?s expected family contribution (EFC) to be lower than it would have been if the untaxed income information was not omitted. The lower EFC resulted in a higher calculation of allowable student financial assistance. Effect or Potential Effect: The subsidized student financial assistance processed from the Federal Pell Grant Program was in the amount of $504 based on the incomplete information for the applicant instead of a $317 amount that would have been processed should the additional income been included and verified in the ordinary course of the institution?s Federal Pell Grant Program administration. Questioned Costs: Less than the reportable threshold. Context: See the condition section above with regard to the items tested from the population and the related compliance requirements specified above. Recommendation: We recommend that the institution consider improvements to established policies and procedures over reviews of documents obtained for Verification. Improvements, such as establishing a checklist in addition to template documents used to process Verifications, would ensure that documents and applications are accurately verified. Views of Responsible Officials: Centra College Management agrees with finding. As such, the college has abided by recommendations and implemented a checklist to ensure accurate verification. Similarly, the college has implemented a quality control program where an estimated 30% of the Financial Aid Manager?s verifications will be audited to further ensure accurate processing.

2019-003 - Special Tests and Provisions: Return of Title IV Funds Information on Federal Program(s): Federal Pell Grant Program Federal Direct Student Loans Program CFDA No. 84.063 CFDA No. 84.268 OPE ID: 02175800 OPE ID: 02175800 IPEDS ID: 232618 IPEDS ID: 232618 Criteria or Specific Requirement: Per 34 CFR section 668.22, the unearned amount of title IV assistance to be returned is calculated by subtracting the amount of title IV assistance earned from the amount of title IV aid that was disbursed as of the date of the institution's determination that the student withdrew. An institution must return the amount of title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: During our Return of Title IV Funds testing, we noted the following exceptions: ? One (1) of the three (3) Return of Title IV Funds sampled and tested noted that the institution inaccurately calculated and returned $1,836 instead of an accurately calculated $1,815 amount. ? Two (2) of the three (3) Return of Title IV Funds sampled and tested noted that the institution returned 47 days and 50 days after the institutions? determination that the student withdrew. Cause: Policies and procedures were not appropriately adhered to in certain instances to ensure that an accurate calculation of funds to be returned and timely return of funds were processed. Effect or Potential Effect: The Department of Education received a larger refund amount than required. The Department of Education received untimely payments from the institution based on Department of Education requirements. Questioned Costs: None. Context: See the condition section above with regard to the items tested from the population and the related compliance requirements specified above. Recommendation: We recommend that the institution consider improvements to established policies and procedures over accurate and timely completion of Return of Title IV Funds. Improvements, such as establishing a checklist and requiring a secondary review would ensure that Return of Title IV Funds are accurately and timely processed. Views of Responsible Officials: Centra College Management agrees with finding. The college has implemented a secondary review of all R2T4 calculations to ensure accurate processing. Similarly, the college has collaborated with the Centra Finance Department to setup a Microsoft Outlook reminder to return funds in G5 at the 40-day mark to allow enough time to meet the 45-day requirement.

2019-004 - Special Tests and Provisions: Enrollment Reporting Information on Federal Program(s): Federal Pell Grant Program Federal Direct Student Loans Program CFDA No. 84.063 CFDA No. 84.268 OPE ID: 02175800 OPE ID: 02175800 IPEDS ID: 232618 IPEDS ID: 232618 Criteria or Specific Requirement: Per 34 CFR section 685.309 and 34 CFR section 690.83 for Federal Direct Student Loans Programs and Federal Pell Grant Programs respectively, institutions are required to report student enrollment data to the Department of Education using the National Student Loan Data System (NSLDS), update all information included in the report on a periodic basis and ensure that the reports are correct. Condition: Testing of each enrollment report submitted to NSLDS during the period under audit identified that although each report was timely submitted, for five (5) out of seventy-one (71) student enrollment terms tested, respective students were inappropriately excluded from enrollment report(s) submitted to NSLDS and for eight (8) out of seventy-one (71) student enrollment terms tested, respective students? enrollment statuses were inaccurate on enrollment report(s) submitted to NSLDS. The manual control over the process for updating enrollment rosters on NSLDS is insufficient to ensure that omissions and inaccuracies are entirely detected and corrected during periodic reporting. Cause: In the ordinary process of ensuring timely reporting to NSLDS, on the required submission date, the institution prepares an initial report of students currently enrolled at the institution along with students that require a change in enrollment status. Upon resolution of all errors noted by NSLDS that preclude report acceptance, which at times require deletion of individual student records that observed a change in status, a final report is submitted by the institution and accepted by NSLDS. The institution is then required to further ensure the accuracy of accepted enrollment reports by updating NSLDS on an individual student record basis for student records that require additional updates. In the course of periodic enrollment report processing, student record omissions and errors occur. Effect or Potential Effect: The institution did not submit fully accurate reports supplemented by updates to individual student records on the required submission dates. Questioned Costs: None. Context: See the condition section above with regard to the items tested from the population and the related compliance requirements specified above. Repeat Finding: This is a repeat finding from prior year. This was reported as finding 2018-002 in the 2018 report. Recommendation: We recommend that the institution implements controls that require maintenance of student records deleted from institutional student rosters in the course of ensuring enrollment report acceptance by NSLDS and establish a policy to review these deleted student records to ensure that individual student records requiring additional reporting on NSLDS are accurately updated. Views of Responsible Officials: Centra College Management agrees with finding. We experienced several issues while implementing our NSLDS report in Microsoft SSRS which led to the report continuing to be created manually. The college had to outsource this report to a third-party vendor, and the report was not completed until March 2020. At this time, the report is being used and working as intended.

2019-005 - Special Tests and Provisions: Disbursements To or On Behalf of Students Information on Federal Program(s): Federal Pell Grant Program Federal Direct Student Loans Program CFDA No. 84.063 CFDA No. 84.268 OPE ID: 02175800 OPE ID: 02175800 IPEDS ID: 232618 IPEDS ID: 232618 Criteria or Specific Requirement: Per 34 CFR section 668.164 for Federal Pell Grant Programs and Federal Direct Student Loans Programs, institutions that opt to issue checks for direct payments are required to hold these checks for no longer than twenty-one (21) days after the date it notifies the student or parent of the direct payment. A credit balance must be paid directly to the student or parent as soon as possible, but no later than fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class for the payment period or fourteen (14) days after the first day of class for a payment period if the credit balance occurred on or before the first day of class for that payment period. Condition: Tests of credit balance direct payments to students for the period under audit identified the following: ? Two (2) of thirty (30) direct payments tested were held longer than twenty-one (21) days after the date the institution informed the student of the direct payment. ? Three (3) of (30) credit balances were paid later than fourteen (14) days after the balance occurred when the balance occurred after the first day of class for the payment period. ? Five (5) of (30) direct payments tested were not monitored in order to determine whether the direct payment checks were held longer than twenty-one (21) days after the date the institution informed the student of the direct payment. Cause: In the ordinary course of requesting drawdowns from the Department of Education via the institution?s centralized Finance Department, the institution concurrently requests checks for expected student account credit balances from its Finance Department. Often, these initially determined expected student account credit balances do not include scholarship funds. The institution?s Student Accounts Office applies scholarships, Federal Pell Grants and Federal Direct Student Loans immediately after checks are received at the Student Accounts Office from the Finance Department. At times, scholarship checks are received and applied to student accounts after Federal Pell Grant and Federal Direct Student Loan checks have been requested from the Finance Department but prior to receipt of those checks for application to student accounts. In these instances, rather than request new checks for student account credit balances that now include for scholarship funds received, the institution processes a refund of the excess student account credit balances as a refund of scholarship funds, when in fact, the refund is derived from Federal Pell Grants and Federal Direct Student Loans that were applied subsequent to the scholarship funds. Effect or Potential Effect: The institution did not timely disburse credit balances derived from Title IV, HEA funds to the respective students. Questioned Costs: None. Context: See the condition section above with regard to the items tested from the population and the related requirements specified above. Repeat Finding: This is a repeat finding from prior year. This was reported as finding 2018-003 in the 2018 report. Recommendation: We recommend that the institution considers improvements to established policies and procedures related to Student Account Statement determination of credit balance refund sources. Improvements such as including expected scholarship funds prior to determination of expected student account credit balances and processing refunds of scholarship funds in accordance with the requirements specified above, would ensure that student account credit balances are timely disbursed. Views of Responsible Officials: Centra College management agrees with this finding. As such, the Student Accounts Office has implemented a new system of tracking the receipt of these funds, and any impending credit thereafter, to include scholarship funds when appropriate. This system includes working with the administrative assistant to update and track student credit balances via Excel and notifying students accordingly.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION