Hospital Comunitario Buen Samaritano, Inc.

Finding No. 2023-001 – Reporting - Late filing of data collection form and reporting package Federal Programs Assistance Listing Number 93.498 – COVID -19 Provider Relief Fund Name of Federal Agency U.S. Department of Health and Human Services Category Internal Control/Compliance; Significant Deficiency Criteria 2 CFR 200.512 (a) (1) establishes that the audit must be completed, and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditors' report(s), or nine months after the end of the audit period. Condition The Hospital did not submit the required data collection form and reporting package within the required period of September 30, 2024 (9 months after the end of fiscal year). Cause This condition was caused by the fact that the financial statements, which are part of the reporting package, were not ready to be released by the required date of September 30, 2024 (9 months after the end of fiscal year). Finding No. 2023-001 – Reporting - Late filing of data collection form and reporting package – (continued) Effect Federal grantors were prevented from being informed on a timely basis of the current audit findings and results. Consequently, any action, further requirements or support from the federal grantor could not be executed on a timely basis or at all. Context No context for this finding since this is a single audit annual reporting requirement to submit the Data Collection Form and the Reporting Package to the Federal Audit Clearinghouse. Identification of a repeat finding Yes. This is an immediate repeat of prior year finding 2022-001. Questioned costs None Recommendation The single audit reporting package must be submitted within the required due dates. Also, we strongly suggest that the accounting department take the steps necessary to ensure that senior management receives current and accurate financial information on a timely basis. Enhancing communication and coordination between departments involved in financial reporting to ensure that necessary data and approvals are obtained without delay. Reviewing and updating internal policies for timely financial statement preparation, including resource allocation and responsibility assignments, with regular oversight by senior management. Views of responsible officials and planned corrective actions The Hospital’s management agrees with this finding. Please refer to the corrective action plan on page 40.

Finding No. 2022-001 – Reporting - Late filing of data collection form and reporting package Federal Programs Assistance Listing Number 10.766 – Community Facilities Loans and Grants Assistance Listing Number 93.498 – COVID -19 Provider Relief Fund Name of Federal Agency U.S. Department of Agriculture U.S. Department of Health and Human Services Category Internal Control/Compliance; Significant Deficiency Criteria 2 CFR 200.512 (a) (1) establishes that the audit must be completed, and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditors' report(s), or nine months after the end of the audit period. Condition The Hospital did not submit the required data collection form and reporting package within the required period of September 30, 2023 (9 months after the end of fiscal year). Cause This condition was caused by the fact that the audited financial statements, which are part of the reporting package, were not ready to be released by the required period of September 30, 2023 (9 months after the end of fiscal year). Effect Federal grantors were prevented from being informed on a timely basis of the current audit findings and results. Consequently, any action, further requirements or support from the federal grantor could not be executed on a timely basis or at all. Context No context for this finding since this is a single audit annual reporting requirement to submit the Data Collection Form and the Reporting Package to the Federal Audit Clearinghouse. Identification of a repeat finding Yes. This is an immediate repeat of prior year finding 2021-002. Questioned costs None Recommendation We recommend that the Hospital establish calendars to review the submission of required annual reporting to ensure that all team members are aware of due dates, including filing extensions. These calendars should be regularly updated and shared across relevant departments, promoting accountability and ensuring that tasks are tracked in a timely manner. Additionally, periodic meetings to review progress and address potential delays can help prevent last-minute issues and ensure compliance with regulatory deadlines. Views of responsible officials and planned corrective actions The Hospital’s management agrees with this finding. Please refer to the corrective action plan on pages 47-48.

Finding No. 2021-001 - Activities Allowed or Unallowed - Hazard Pay Eligibility Federal Program Assistance Listing Number 21.019 - Coronavirus Relief Fund Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria As stated in the Federal Register, Hazard Pay may be covered using payments from the Coronavirus Relief Fund (the Fund) if it is provided for performing hazardous duty or work involving physical hardship that, in each case, is related to COVID–19. This means that the payroll and benefits of an employee who is substantially dedicated to mitigating or responding to the COVID–19 public health emergency may generally be covered in full using payments from the Fund. Hazard Pay may only be covered to the extent it is directly related to COVID-19. In addition, per the Puerto Rico Fiscal Agency and Financial Advisory Authority (AAFAF) guidelines, Hazard Pay is allowable only if it is related to duties to directly respond to COVID-19, independent of the category of employee, usually reserved for First Responders. The guidelines recommend the following model for Hazard Pay: a. First Responders: are those employees that, because of the nature of their responsibilities, are continuously exposed to COVID-19 contagion and are employees performing substantial services within the emergency rooms and the COVID-19 intensive care units. b. Temporary COVID-19 triage areas that a hospital may have established in response to the pandemic. c. The Hazard Pay program suggests the following apportionment for First Responders and the hospital has the discretion to classify the employees within the risk categories stated below: i. Very High Risk: $1,250 each ii. High Risk: $1,000 each iii. Medium Risk: $900 each iv. Lower Risk: $800 each Condition During our audit procedures, we identified certain ineligible employees that were included as part of the Hazard Pay program incentive. Cause The original guidelines issued by the Puerto Rico Fiscal Agency and Financial Advisory Authority (AAFAF) for the Hazard Pay program provided a general definition for qualifying employees and that the eligibility criteria could be determined based on the Occupational Safety and Health Administration (OSHA) guidelines. However, such original Hazard Pay program guidelines were subsequently clarified by AAFAF, providing more specific criteria and definitions for qualifying employees. Based on the general guidelines issued by AAFAF, the Hospital included certain employees that did not meet the Hazard Pay program criteria, since the Hospital did not consult with AAFAF about the eligibility of certain Not Substantially Dedicated employees, as defined in the Federal Register. Effect The condition above resulted in the inclusion of ineligible employees in the payment of the Hazard Pay incentive. Questioned Cost Question cost amounted to $6,200 which represents the payments made to ineligible employees. Context Of the 325 employees that received the Hazard Pay incentive, we identified 31 employees that worked on departments not directly related to COVID 19. Total ineligible Hazard Pay incentives paid amounted to $6,200, out of total incentives paid of $125,089. Identification of a repeat finding Yes. This is an immediate repeat of prior year finding 2020-001. Recommendation The Hospital should continue to monitor and review guidelines for federal awards under the CARES Act to ensure it is up-to-date on the applicable requirements and changes therein. In addition, the Hospital should consider consulting with AAFAF when available guidance may be subject to interpretation or when new awards, if any, are received. We recommend the Hospital to revise the guidelines to include only the first responders employees to receive the hazard pay. The meaning of first responders are those employees that, because of the nature of their responsibilities, are continuously exposed to COVID-19 contagion. Views of responsible officials and planned corrective actions The Hospital’s management agrees with this finding. Please refer to the corrective action plan on pages 53-54.

Federal Programs Assistance Listing Number 21.019 - Coronavirus Relief Fund Assistance Listing Number 21.027 - Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency U.S. Department of Treasury U.S. Department of Health and Human Services Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria 2 CFR 200.512 (a) (1) establishes that the audit must be completed, and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditors' report(s), or nine months after the end of the audit period. Condition The Hospital did not submit the required data collection form and reporting package within the required period of September 30, 2022 (9 months after the end of fiscal year). Cause This condition was caused by the fact that the financial statements, which are part of the reporting package, were not ready to be released by the required period of September 30, 2022 (9 months after the end of fiscal year). Effect Federal grantors were prevented from being informed on a timely basis of the current audit findings and results. Consequently, any action, further requirements or support from the federal grantor could not be executed on a timely basis or at all. Context No context for this finding since this is a single audit annual reporting requirement to submit the Data Collection Form and the Reporting Package to the Federal Audit Clearinghouse. Identification of a repeat finding Yes. This is an immediate repeat of prior year finding 2020-002. Questioned costs None Recommendation We recommend to the Hospital to establish calendars to review submission of required annual reporting in order to ascertain that all team members are aware of due dates, including filing extensions. Views of responsible officials and planned corrective actions The Hospital’s management agrees with this finding. Please refer to the corrective action plan on pages 53-54.

Federal Programs Assistance Listing Number 21.027 - Coronavirus State and Local Fiscal Recovery Funds Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria According to the 31 CFR Subtitle A Part 35 Subpart 35.6 (c)(1) A recipient may use funds to provide premium pay to eligible workers of the recipient who perform essential work or to provide grants to eligible employers that have eligible workers who perform essential work, eligible workers performing essential work during the COVID-19 public health emergency. A recipient uses premium pay or grants provided to eligible workers performing essential work during the COVID-19 public health emergency if: 1) The eligible worker's total wages and remuneration, including the premium pay, is less than or equal to 150 percent of the greater of such eligible worker's residing State's or county's average annual wage for all occupations as defined by the Bureau of Labor Statistics' Occupational Employment and Wage Statistics. Accordingly, the Puerto Rico Treasury Department created the "Comité de Supervisión de Desembolsos de los fondos del CRF". It established the guidelines under the ARPA Act and determined that an individual will be eligible if he was and employee of an Eligible Employer and meets the following requirements: a. The employee or worker has earned a base salary or annual compensation less than $40,000 for the calendar year 2020 or 2021; and b. When applying, the employee or worker is actively working for an Eligible Employer and has also completed at least five hundred (500) hours of essential work in person since March 1, 2020, carrying out essential work. Condition During our audit procedures on the expenses of the federal program, we found that one payment was made to an employee who did not meet the eligibility requirements. In addition, we identified a payment claimed to the federal program as being made to a specific employee, however, while performing audit procedures on the payment, we noted that the Hospital did not make the payment to the employee and did not return it to the grantor. Cause Involuntary error by an employee who worked with an eligible employee's report used to apply for the funds. The payroll department prepared the report with information from employees' records using specific program eligibility criteria. Then, the report was reviewed and approved by the finance department director. The employee for whom payment was not made resigned in August 2021 after the Hospital determined the eligible employees to be paid but before disbursement of payments. Premium pay funds were received by the Hospital on October 18, 2021 and considered the payment of the employee who resigned. The funds were disbursed to employees on October 29, 2021. Effect As a result of this condition, the U.S. Department of Treasury may request the return of funds, issue warnings and/or impose penalties to the Hospital. Questioned cost Question cost amounted to $4,000. The known questioned cost was calculated by the amount disbursed ($2,000) to the ineligible employee plus the payment not paid ($2,000) to the other employee. Context Of the three hundred fifty-one (351) premium pay payments made, we selected forty (40) payments for testing and noted one (1) instance of noncompliance. When we assessed the entire population, we extended the sample, selected ten (10) additional premium pay payments, and noted the exceptions of the payment not paid to an employee. Identification of a Repeat Finding This is not a repeat finding from the immediate previous audit. Recommendation The management of the Hospital should reinforce its procedures of the administration of federal funds to ensure the compliance with the requirements with each program. Also, the Hospital should establish communication with the Health Department of Puerto Rico in order to obtain instructions for the correction of the non-compliance event and the related questioned cost. Views of responsible officials and planned corrective actions The Hospital’s management agrees with this finding. Please refer to the corrective action plan on pages 53-54.

Finding No. 2020-001 - Activities Allowed or Unallowed - Hazard Pay Eligibility Federal Program Assistance Listing Number 21.019 - Coronavirus Relief Fund Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria As stated in the Federal Register, Hazard Pay may be covered using payments from the Coronavirus Relief Fund (the Fund) if it is provided for performing hazardous duty or work involving physical hardship that in each case is related to COVID?19. This means that, whereas payroll and benefits of an employee who is substantially dedicated to mitigating or responding to the COVID?19 public health emergency may generally be covered in full using payments from the Fund. Hazard Pay specifically, may only be covered to the extent it is directly related to COVID-19. In addition, as per the Puerto Rico Fiscal Agency and Financial Advisory Authority (AAFAF) guidelines, Hazard Pay is allowable only if it is related for duties to directly respond to COVID-19, independent of the category of employee, usually reserved for First Responders. The guidelines recommend the following model for Hazard Pay: a. First Responders: are those employees that, because of the nature of their responsibilities, are continuously exposed to COVID-19 contagion and are employees performing substantial services within the emergency rooms, the COVID-19 intensive care units and within the temporary COVID-19 triage areas that a hospital may have established in response to the pandemic.Criteria ? (Continued) b. The Hazard Pay program suggests the following apportionment for First Responders and the hospital has the discretion to classify the employees within the risk categories stated below: i. Very High Risk: $1,250 each ii. High Risk: $1,000 each iii. Medium Risk: $900 each iv. Lower Risk: $800 each Condition During our audit procedures, we identified certain ineligible employees that were included as part of the Hazard Pay program incentive. Cause The original guidelines issued by the Puerto Rico Fiscal Agency and Financial Advisory Authority (AAFAF) for the Hazard Pay program provided a general definition for qualifying employees and that the eligibility criteria could be determined based on the Occupational Safety and Health Administration (OSHA) guidelines. However, such original Hazard Pay program guidelines were subsequently clarified by AAFAF, providing more specific criteria and definitions for qualifying employees. Based on the general guidelines issued by AAFAF, the Hospital included certain employees that did not meet the Hazard Pay program criteria, since the Hospital did not consult with AAFAF about the eligibility of certain Not Substantially Dedicated employees, as defined in the Federal Register. Effect The condition above resulted in the inclusion of ineligible employees in the payment of the Hazard Pay incentive. However, no questioned costs resulted from this instance of noncompliance, since the Hospital revised the Coronavirus Relief Fund Midterm Use of Funds Report submitted to AAFAF for the month of December 2020 to reflect the funds allocated to ineligible employees as additional compensation paid by the Hospital from its own resources, instead of the Hazard Pay program.Questioned Cost None, since payments to ineligible employees were recharacterized as additional compensation paid from the Hospital?s own resources, instead of federal awards. Such federal awards remained available for use under other assistance programs provided by the CARES Act through December 2021. Context Of the 356 employees that received the Hazard Pay incentive, we identified 33 employees that worked on departments not directly related to COVID 19. Total ineligible Hazard Pay incentives paid amounted to $24,900, out of total incentives paid of $378,597. Identification of a repeat finding None Recommendation The Hospital should continue to monitor and review guidelines for federal awards under the CARES Act to ensure it is up-to-date on the applicable requirements and changes therein. In addition, the Hospital should consider consulting with AAFAF when available guidance may be subject to interpretation or when new awards, if any, are received. We recommend the Hospital to review the guidelines to include only the first responders? employees to receive the hazard pay. The meaning of first responders are those employees that, because of the nature of their responsibilities, are continuously exposed to COVID-19 contagion. Views of responsible officials and planned corrective actions The Hospital?s management agrees with this finding. Please refer to the corrective action plan on pages 52-53.

Finding No. 2020-002 ? Reporting - Late filing of data collection form and reporting package Federal Programs Assistance Listing Number 21.019 - Coronavirus Relief Fund Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria 2 CFR 200.512 (a) (1) establishes that the audit must be completed, and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. Condition The Hospital did not submit the required data collection form and reporting package within the required period of September 30, 2021 (9 months after the end of fiscal year). Cause This condition was caused by the fact that the financial statements, which are part of the reporting package, were not ready to be released by the required period of September 30, 2021 (9 months after the end of fiscal year).Effect Federal grantors were prevented from being informed on a timely basis of the current audits findings and results. Consequently, any action, further requirements or support from the federal grantor could not be executed on a timely basis or at all. Context No context for this finding since this is a single annual reporting requirement to submit the Data Collection Form and the Reporting Package to the Federal Audit Clearinghouse. Identification of a repeat finding None Questioned costs None Recommendation We recommend to the Hospital to establish calendars to review submission of required annual reporting in order to ascertain that all team members be aware of due dates, including filing extensions. Views of responsible officials and planned corrective actions The Hospital?s management agrees with this finding. Please refer to the corrective action plan on pages 52-53.

Finding No. 2020-003 ? Period of Performance ? Invoice Cut off days outside the Period of Performance Federal Programs Assistance Listing Number 21.019 - Coronavirus Relief Fund Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria Internal control should include activities to detect any transactions outside the period of performance. Costs must be incurred during the period that begins on March 1, 2020, and ends on December 30, 2021, per section 601(d) of the Social Security Act, as added by section 5001 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). Condition During our audit procedures, we detected certain transactions that included costs allocated to February 2020, outside the period of performance. Cause This condition was caused by the fact that the invoices were dated March 2020, however such invoices included charges for days in February 2020 that should have been excluded from eligible expenses to be funded by the federal program. Effect No questioned costs resulted from this instance of noncompliance, since the Hospital revised the Coronavirus Relief Fund Midterm Use of Funds Report submitted to AAFAF for the month of December 2020 and removed transactions for invoices containing days of February. Context We examined thirty-six (36) invoices and detected five (5) of them that included days of February 2020. Identification of repeat finding None Questioned Costs None, since ineligible costs were removed and replaced with allowable transaction under the period of performance. Recommendation We recommend the Hospital to establish internal control procedures to detect any transaction outside the period of performance. Cost must be incurred during the period that begins on March 1, 2020 and ends on December 30, 2021. Views of responsible officials and planned corrective actions The Hospital?s management agrees with this finding. Please refer to the corrective action plan on pages 52-53.

Finding No. 2020-004 ? Activities Allowed? Other internal control deficiencies Federal Programs Assistance Listing Number 21.019 - Coronavirus Relief Fund Name of Federal Agency U.S. Department of Treasury Pass-through Entity Puerto Rico Department of Treasury Category Internal Control/Compliance; Significant Deficiency Criteria Internal control activities should include activities to review accounting procedures and the accuracy of the amounts included as part of the Federal Awards. Condition During our audit procedures, we identified certain errors in the transactions included in the Use of Funds Report: ? Transaction for the acquisition of equipment in the ?Other? category of $60,000 had not occurred yet, therefore no evidence was available for examination. ? Transaction related to building improvements in the ?Other? category of $150,000 and 60,000 had not occurred yet, therefore no evidence was examination. ? Evidence related to cafeteria improvements in the ?Other? category of $82,000 was not completely sustained with evidence because part of the transaction had not yet occurred. ? Payroll cost claimed on the federal program included the Christmas bonus of $78,698 which is not allowable. Cause These transactions were originally estimated to be obligated to the program and deferred to 2021 as permitted by the program. However, the transaction procurement was not finalized which made the transaction ineligible to be included. The monthly Use of Funds report was not corrected to reflect this change. The Christmas bonus was inadvertently included incorrectly due to human error. Effect Original Use of Funds Report submitted to the primary federal grants recipient in December 2020 was overstated. Context Context cannot be determined since these errors were identified through different audit procedures performed. Identification of repeat finding None Questioned Costs None, since ineligible costs were removed and replaced with allowable transaction under the program requirements. Recommendation We recommend the Hospital to establish internal control procedures to include activities to review accounting procedures and the accuracy of the amounts included as part of the federal award, since the transaction procurement was not finalized which made it ineligible to be included. Views of responsible officials and planned corrective actions The Hospital?s management agrees with this finding. Please refer to the corrective action plan on pages 52-53.