BETH ISRAEL LAHEY HEALTH, INC.

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2025 Criteria: Title 2 U.S. Code of Federal Regulations Part 200 (2 CFR 200) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.430(a) states that compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Costs of compensation are allowable to the extent the compensation is reasonable for the services rendered and conforms to the established written policy of the recipient or subrecipient consistently applied to both Federal and non-Federal activities; follows an appointment made in accordance with the recipient's or subrecipient's laws, rules, or written policies and meets the requirements of Federal statute, where applicable; and is determined and supported by records that accurately reflect the work performed. 2 CFR 200.403(b) further states costs must meet the criteria of conforming to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items to be allowable under Federal awards. This includes the auditor to determine if the awards contain any negotiated wage or salary rates, or contain any restrictions on salaries and wages, such as the NIH restriction on the amount that may be charged for individual salaries (https://grants.nih.gov/grants/policy/salcap_summary.htm). Additionally, 2 CFR 200.400(d) requires the accounting practices of the recipient and subrecipient to be consistent with the cost principles and support the accumulation of costs as required by the cost principles, including maintaining adequate documentation to support costs charged to the Federal award. Furthermore, 2 CFR 200.403 states the factors affecting allowability of costs. These factors include the cost to (a) be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principes and (g) be adequately documented to meet the criteria to be allowable under Federal awards. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing of payroll for Beth Israel Deaconess Medical Center (BIDMC), an affiliate of Beth Israel Lahey Health, Inc., management did not consistently adhere to the specific award conditions set forth in the Notice of Award (NOA) related to salary limitations for 1 out of 12 of our samples related to our testing. The control operator applied an erroneous National Institutes of Health (NIH) Salary Cap limit when calculating the payroll allocation for an individual’s time allocated to a specific NIH grant selected for testing. As a result, the portion of the individual’s salary charged to the federal grant exceeded the maximum allowable NIH Salary Cap, resulting in an unallowable cost of $41 charged to the award. Furthermore, Joslin Diabetes Center (the Center), an affiliate of Beth Israel Lahey Health, Inc., manually matches purchase orders to the corresponding invoice once received. During our testing for 1 out of 25, we identified an invoice that was incorrectly matched to the purchase order for the Federal award selected for testing. This invoice was processed for payment and subsequently included in the monthly reimbursement draw. At the time of testing, the correct invoice corresponding to the valid purchase order for the selected grant had not yet been received by the Center. This resulted in the expenditure in the amount of $14 being BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2025 allocated to the incorrect Federal award as well as the Federal award charged not being supported by adequate documentation. Cause: The conditions results from a lack of effective operation of internal controls over the allowability of costs related to Federal awards; specifically, ensuring the cost conforms to any limitations set forth in the Federal award as to the amount of cost items at BIDMC as well as ensuring the cost is allocable to the Federal grant and is adequately documented at the Center. Possible Asserted Effect: Failure to maintain sufficient internal controls to ensure a cost is allowable to a Federal award may result in unallowable costs being charged to Federal awards. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that BILH enhance its internal controls over Federal award expenditures to ensure, where applicable, all costs charged to Federal awards conform to any limitations or salary caps set forth in the Federal award agreement, are accurately allocated to the correct grant and are adequately documented.

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2024 (3) Findings and Questioned Costs Relating to Federal Awards Finding 2024-001 – Subrecipient Monitoring Federal Agency: United States Department of Health and Human Services Program: Research and Development Cluster Assistance Listing Number: 93.837 and 93.847 Criteria: Criteria: 2 CFR 200.332(b) requires pass-through entities to evaluate each subrecipient’s risk of non-compliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of 200.332. Further, 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: Annually, BILH works with over 200 subrecipients in conducting its research activities. While Joslin Diabetes Center (the Center) has a subrecipient pre-award risk assessment process in place, for 5 of 9 subrecipients selected for testwork, we were unable to verify that the pre-award risk assessment procedures were fully performed. Additionally, while the Center’s risk assessment procedures correspond with a risk-based monitoring plan, for 8 of 9 subrecipients selected for testwork, we were unable to verify that the required monitoring activities were fully completed. We deemed this to be a significant deficiency in internal controls. Cause: As a result of turnover during the fiscal year within Research Finance there was a lack of effective operation of internal controls over subrecipient risk assessment and monitoring activities. Possible Asserted Effect: Without the proper operation of an effectively designed system of internal controls, the internal control system cannot be relied upon to effectively prevent or detect non-compliance. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is a repeat finding. (Prior year finding 2023-002) BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2024 Recommendation: We recommend that the Center evaluate its current Subrecipient Monitoring and Management Policy to ensure that the policy reflects each of the risk assessment and monitoring compliance requirements of the Uniform Guidance. Additionally, the results of the Center’s risk assessment and monitoring activities should be formally documented within the tracking log which should then be subject to formal review and approval by an appropriate individual within Research Finance. Views of Responsible Officials: Management acknowledges although tracking logs had been maintained, due to personnel turnover during the year, not all had been reviewed. Management has since created a shared email address to ensure communication and information sharing with all necessary parties. Management is reviewing its current policy for opportunities to strengthen internal controls and current procedures while utilizing available resources.

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2023 (3) Findings and Questioned Costs Relating to Federal Awards Finding 2023-001 Federal Agency: United States Department of Health and Human Services Program Name: Research and Development Cluster Assistance Listing Number: Various Criteria: According to 2 CFR 200.313(d)(1), property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property, who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. Per 2 CFR 200.313/(d)(3) and (4), a control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of property and adequate maintenance procedures must be developed to keep the property in good condition. Additionally, 2 CFR section 200.313(d)(2) requires a physical inventory of Federally acquired property must be taken and the results reconciled with the property records at least once every two years. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that accurate property records are maintained and equipment items are property tagged. Condition: Beth Israel Deaconess Medical Center (BIDMC), one of Beth Israel Lahey Health, Inc.’s affiliates, did not consistently follow its property management policies and procedures related to maintaining accurate property management records for equipment purchased with Federal R&D Cluster program awards. BIDMC conducts research at multiple locations throughout its campus where equipment purchased with Federal awards is utilized and maintained. As of September 30, 2023, BIDMC maintained Federally acquired property of approximately $65.5 million. BIDMC identifies all equipment in its property management records with individually assigned asset numbers and each individual asset record includes the specific location of the asset, the Federal award general ledger account number which funded the purchase of the asset, and other required information. An asset tag with the assigned asset number is affixed to each asset in accordance with BIDMC policy. BIDMC is required to safeguard equipment purchased with Federal awards, maintain current property records, and to perform a physical inventory of equipment purchased with Federal awards on a biennial basis. During our physical inspection of 40 pieces of equipment (with a cost basis of $4,562,717) purchased with Federal funds, we identified 7 items (with cost basis totaling $116,831) selected for physical observation which had not been tagged. Overall, BIDMC’s inventory listing included 34 pieces of equipment (with a cost basis of $1,500,686) acquired with Federal funds that were not tagged. Additionally, we noted that BIDMC did not conduct a physical inventory within the biennial period required. We deemed this to be a material weakness in internal controls. Cause: In discussing these conditions with BILH management, they stated the implementation of a new asset tagging system resulted in delayed tagging of purchased equipment as well as the physical inventory of Federally acquired property. Possible Asserted Effect: Failure to maintain accurate property records may prohibit BIDMC from properly safeguarding and maintaining equipment. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend BIDMC review its procedures for updating property records to ensure they accurately reflect equipment information. Additionally, management should arrange for a physical inspection and reconciliation of Federally acquired property to books and records. Views of Responsible Officials: A review of the Beth Israel Deaconess Medical Center’s (BIDMC) property records maintenance revealed incomplete biennial physical inventory and incomplete tagging of new equipment purchased on federal awards. Management agrees with the recommendation and will update the asset tagging system to support completing the biennial inventory and resume tagging new equipment according to established policy.

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2023 Finding 2023-02 – Subrecipient Monitoring Federal Agency: United States Department of Health and Human Services Program: Research and Development Cluster Assistance Listing Number: 93.837 and 93.847 Criteria: Criteria: 2 CFR 200.332(b) requires pass-through entities to evaluate each subrecipient’s risk of non- compliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of 200.332. Further, 200.332 (d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: While Joslin Diabetes Center (the Center) has a subrecipient pre-award risk assessment process in place, for 19 of 25 subrecipients, we were unable to verify that the pre-award risk assessment procedures were fully performed. Additionally, while the Center’s risk assessment procedures correspond with a risk-based monitoring plan, for 7 of 25 subrecipients, we were unable to verify that the required monitoring activities were fully completed. We deemed this to be a significant deficiency in internal controls. Cause: As a result of turnover during the fiscal year within Research Finance there was a lack of effective operation of internal controls over subrecipient risk assessment and monitoring activities. Possible Asserted Effect: Without the proper operation of an effectively designed system of internal controls, the internal control system cannot be relied upon to effectively prevent or detect non-compliance. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Center evaluate its current Subrecipient Monitoring and Management Policy to ensure that the policy reflects each of the risk assessment and monitoring compliance requirements of the Uniform Guidance. Additionally, the results of the Center’s risk assessment and monitoring activities should be formally documented within the tracking log which should then be subject to formal review and approval by an appropriate individual within Research Finance. Views of Responsible Officials: Management acknowledges although tracking logs had been maintained, due to personnel turnover during the year, not all had been reviewed. Management has since created a shared email address to ensure communication and information sharing with all necessary parties. Management is reviewing its current policy for opportunities to strengthen internal controls and current procedures while utilizing available resources.

BETH ISRAEL LAHEY HEALTH, INC. AND AFFILIATES Schedule of Findings and Questioned Costs Year ended September 30, 2023 Finding 2023-003 – Reporting Program: Provider Relief Fund and American Rescue Plan Federal Agency: Health Resources and Services Administration Assistance Listing Number: 93.498 Criteria: Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Subpart F – Audit Requirements §200.510 requires the auditee to prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with §200.502. The Uniform Guidance requires the auditor to determine whether the auditee’s schedule of expenditures of federal awards is fairly stated, in all material respects, in relation to the audited entity’s financial statements as a whole. In addition, the Uniform Guidance places the responsibility for identifying major programs on the auditor and the schedule of expenditures of federal awards serves as the primary basis for the auditor’s major program determination. Therefore, appropriate major program determination by the auditor is dependent on the accuracy and completeness of the information in the schedule of expenditures of federal awards. Condition: In preparation of the schedule of expenditures for federal awards (SEFA) management did not record the Provider Relief and American Rescue Plan expenditures on the SEFA which resulted in the SEFA being understated by $19,062,787. We deemed this to be a material weakness in internal controls. Cause: BILH did not have an adequately designed internal control to identify the error in federal awards expended as such, the amount of the errors could have been greater and not detected by BILH’s control environment. Possible Asserted Effect: Potential misstatement to the schedule of expenditures of federal awards. Questioned Costs: None noted Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is a repeat finding. Recommendation: We recommend that BILH implement a more thorough and detailed process for preparing and reviewing the SEFA to identify adjustments that could result in a misstatement of the SEFA. This should include a formalized and detailed review of the SEFA and a reconciliation to the general ledger and financial statements by someone other than the preparer. Views of Responsible Officials: Management agrees with the recommendation and moving forward, BILH will centralize the compilation of the SEFA, along with conducting periodic reconciliations between the schedule, the general ledger and supporting documentation. Management will also utilize its new accounting system to track all federal funding by requiring the appropriate worktags be utilized when recording such transactions, allowing for accurate reporting. Lastly, management will require at least two reviews of the SEFA. • Management will have training sessions with the Finance staff on the use of worktags when recording federal funding. • A new position has been created, Director of Technical Accounting, who will be responsible for compiling the SEFA and ensuring accuracy of the filing, with sign off by department managers who are submitting information • Director of Research Finance will review initial draft of SEFA for completeness and accuracy • VP of Revenue and Reimbursement will review the initial draft of SEFA for completeness and accuracy • VP of System Services Accounting and Finance will final review for completeness and accuracy Views of Responsible Officials Responsible Individual: Katherine Bacher, VP of System Services Accounting and Finance Contact Information: Katherine.bacher@bilh.org; 617-278-7059 Expected Completion Date: June 30, 2025 Status of Completion: In process

(3) Findings and Questioned Costs Relating to Federal Awards Finding 2022-001 Federal Agency: United States Department of Health and Human Services Program Name: Provider Relief Fund (PRF) Assistance Listing Number: 93.498 Criteria: PRF recipients that received one or more payments exceeding $10,000 in the aggregate during a Payment Received Period are required to report on several required data elements as part of the post-payment reporting process. Reporting must be completed and submitted to the Health Resources and Service Administration (HRSA) the reporting dates specified by HRSA. Additionally, Title 45 U.S. Code of Federal Regulations Part 75 (45 CFR 75), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 03(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit procedures for Beth Israel Lahey Health’s PRF Reporting Periods 2 and 3, we identified an error in the amount reported on the Lost Revenue in Excess of Total Distributions line item for the period of January 2020 to June 2021 for Beth Israel Deaconess Medical Center (BIDMC). Management incorrectly utilized the same quarterly budget amount for Quarter 3 and Quarter 4 within their internal lost revenue calculations spreadsheet. The error resulted in $160,417,776 being reported as Lost Revenue in Excess of Total Distributions within the report instead of $167,748,797, or understating the lost revenue amount by $7,331,021. We deemed this to be a significant deficiency in internal controls. Cause: The condition found results from the existing internal control review over the accuracy of the underlying data used to prepare the report not being performed at a precision level that detected the error duplicating the budget amounts from Quarter 3 to Quarter 4. Possible Asserted Effect: Failure to ensure accuracy of amounts reported as “Lost Revenues in Excess of Total Distributions” may result in HRSA relying on incomplete or inaccurate information associated to the BILH’s utilization of PRF funds. Questioned Costs: None. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend BILH enhance its internal controls over PRF reporting to ensure each of the data elements reported to HRSA are accurate and result in amounts consistent with its underlying records. Views of Responsible Officials: Management will enhance its internal controls over PRF reporting by requiring co-sign off by the VP of System Services Accounting and the VP of Revenue/Reimbursement.

Finding 2022-02 – Reporting Program: COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Agency: U.S. Department of Homeland Security Assistance Listing Number: 97.036 Criteria: Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Subpart F – Audit Requirements §200.510 requires the auditee to prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with §200.502. The Uniform Guidance requires the auditor to determine whether the auditee’s schedule of expenditures of federal awards is fairly stated, in all material respects, in relation to the audited entity’s financial statements as a whole. In addition, the Uniform Guidance places the responsibility for identifying major programs on the auditor and the schedule of expenditures of federal awards serves as the primary basis for the auditor’s major program determination. Therefore, appropriate major program determination by the auditor is dependent on the accuracy and completeness of the information in the schedule of expenditures of federal awards. Condition: In preparation of the schedule of expenditures for federal awards (SEFA) management did not record the COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) expenditures on the SEFA which resulted in the SEFA being understated by $14,249,269. We deemed this to be a material weakness in internal controls. Cause: BILH did not have an adequately designed internal control to identify the error in federal awards expended as such, the amount of the errors could have been greater and not detected by BILH’s control environment. Possible Asserted Effect: Potential misstatement to the schedule of expenditures of federal awards. Questioned Costs: None noted Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding was a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that BILH implement a more thorough and detailed process for preparing and reviewing the SEFA to identify adjustments that could result in a misstatement of the SEFA. This should include a formalized and detailed review of the SEFA and a reconciliation to the general ledger and financial statements by someone other than the preparer. Views of Responsible Officials: Management will enhance its review process by requiring a formal second sign-off of the SEFA with supporting documents.