San Antonio Regional HospitalNon-Profit

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the four FEMA projects in 2024, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $8,121,828. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and has implemented procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Homeland Security Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Award Period of Performance: January 1, 2020 – July 1, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) had processes and internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management represented they reviewed and approved the FEMA expenditures; however, supporting documentation to evidence the review and approval was not maintained. Effect or potential effect: A lack of internal controls over the review and approval of FEMA expenditures could result in unallowable expenses being charged to the federal program. Questioned Costs: None. Context: During our testing over the two FEMA projects in 2023, we observed that management did not retain evidence of controls surrounding the review and approval over the expenses submitted to FEMA. Total federal expenditures for Assistance Listing No. 97.036 totaled $3,463,657. Identification as a repeat finding, if applicable: Not applicable Recommendation: The Hospital should refine its process and retain documentation to evidence management’s internal controls in place to review and approve FEMA expenditures submitted to the FEMA Portal. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services Assistance Listing No.: 93.498 COVID-19 Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution Award Period of Performance: January 1, 2020 ? December 31, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) has processes and internal controls in place to ensure lost revenues submitted in the Health Resources and Services Administration (HRSA) Portal were allowable under the terms and conditions of the award. These internal controls include ensuring the completeness and accuracy of the lost revenue calculation. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: Management did not retain documentation evidencing the performance of this control. Effect or potential effect: The Hospital did not consistently retain documentation to evidence the performance of internal controls over the lost revenue calculation submitted to HRSA, which could lead to noncompliance. Questioned Costs: None. Context: During our testing over the PRF program, we observed that management did not retain evidence of controls surrounding the lost revenue calculation during January 1, 2020 ? December 31, 2022. Total federal expenditures for Assistance Listing No. 93.498 totaled $1,360,603 for the year ended December 31, 2022. Identification as a repeat finding, if applicable: The finding is a repeat finding of 2021-001. Recommendation: The Hospital should refine its process and retain documentation to evidence management?s review of the lost revenue calculation submitted to HRSA. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services Assistance Listing No.: 93.498 COVID-19 Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution Award Period of Performance: January 1, 2020 ? December 31, 2022 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The terms and conditions of the award requires the following: ? The recipient certified that the payment will only be used to prevent, prepare for, and respond to coronavirus, and that the payment shall reimburse the recipient only for health care related expenses or lost revenues that are attributable to coronavirus. ? The recipient certifies that it will not use the payment to reimburse expenses or losses that have been reimbursed from other sources or that other sources are obligated to reimburse. ? The recipient shall submit reports as the secretary of Health and Human Services (HHS) determines are needed to ensure compliance with conditions that are imposed on the payment, and such reports shall be in such form, with such content, as specified by the secretary of HHS in future program instructions directed to all recipients. Condition: Per discussion with management, the Company has processes and internal controls over compliance with the terms and conditions of the award; however, management did not retain documentation evidencing the performance of these controls. Cause: Due to turnover, management did not retain documentation evidencing the performance of controls. Effect or potential effect: The Hospital did not consistently retain documentation to evidence the performance of internal controls over compliance with the terms and conditions of the award. Questioned Costs: None. Context: During our testing over the PRF program, we observed that management did not retain evidence of controls surrounding compliance with terms and conditions of the award. Total federal expenditures for Assistance Listing No. 93.498 totaled $1,360,603 for the year ended December 31, 2022. Identification as a repeat finding, if applicable: The finding is not a repeat finding. Recommendation: Management should refine its process and retain documentation evidencing that management reviewed compliance with the terms and conditions of the award. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.

Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services Assistance Listing No.: 93.498 COVID-19 Provider Relief Fund (PRF) and American Rescue Plan (ARP) Rural Distribution Award Period of Performance: January 1, 2020 ? December 31, 2022 Criteria or specific requirement (Including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Providers who received one or more PRF or ARP payments greater than $10,000 in the aggregate were required to report on the use of the funds to the Health Resources & Services Administration (HRSA) Reporting Portal. The U.S. Department of Health and Human Services (HHS) requires the nonfederal entity to report lost revenues in order to support that funding received has been appropriately earned. HHS provided specific guidance in the June 11, 2021 Post-Payment Notice on how to complete the required reporting of lost revenues in the HRSA Reporting Portal. Under this guidance, recipients may choose to apply PRF and ARP payments towards lost revenues using one of the following options: ? Option i ? Up to the amount of the difference between actual patient care revenue ? Option ii ? Up to the amount of the difference between budgeted and actual patient care revenue, if the budget was established and approved prior to March 27, 2020 ? Option iii ? Up to the amount calculated by any reasonable method of estimating revenue Condition: The Hospital?s reporting submissions did not follow the published HRSA guidance related to the reporting of lost revenues. Cause: Internal controls over the review of the method used to report lost revenues in the HRSA reports were not designed with the level of precision necessary to identify submissions that were not compliant with HRSA reporting guidance. Effect or potential effect: Noncompliance with HRSA reporting guidance could result in the submission of incorrect lost revenues to the HRSA Reporting Portal. Questioned costs: None. Context: We inspected lost revenues reported for the Phase 4 PRF submission to HHS using Option ii, whereby the lost revenues reported should be up to the amount of the difference between budgeted and actual patient care revenue, if the budget was established and approved prior to March 27, 2020. However, we determined that the calculation used to report lost revenues was based on the 2022 budget, which was not approved prior to March 27, 2020. Total federal expenditures for Assistance Listing No. 93.498 totaled $1,360,603 for the year ended December 31, 2022. Identification as a repeat finding: This is not a repeat finding. Recommendation: HRSA does not allow reporting entities to amend a previously submitted report after the reporting period has passed. If any future PRF submissions are required, the Hospital should select Option iii for the calculation of lost revenues if a budget approved prior to March 27, 2020 does not exist. Views of responsible officials: Management agrees that the 2022 budget was not approved prior to March 27, 2020, but concluded that the method used is supportable under Option iii. Furthermore, management asserts the amount of lost revenues submitted would not change regardless of the Option selected to calculate lost revenues.

Identification of the federal program: Federal Grantor: U.S. Department of Health and Human Services Assistance Listing No.: 93.498 COVID-19 Provider Relief Fund and American Rescue Plan Rural Distributions Award Period of Performance: January 16, 2020 ? December 31, 2021 Criteria or Specific Requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: Per discussion with management, San Antonio Regional Hospital (the Hospital) has processes and internal controls in place to ensure lost revenues submitted in the HRSA Portal were allowable under the terms and conditions of the award. These internal controls include ensuring the completeness and accuracy of the lost revenue calculation. However, management did not consistently retain documentation to evidence the performance of these controls. Cause: The Hospital did not consistently retain documentation to evidence the performance of internal controls over the lost revenue calculation submitted to HRSA. Effect or potential effect: The Hospital did not consistently retain documentation to evidence the performance of internal controls over the lost revenue calculation submitted to HRSA, which could lead to noncompliance. Questioned Costs: None. Context: Total lost revenues reported for Assistance Listing No. 93.498 amounted to $41.5 million. The calculation used was Option 2 whereby, the calculation compared the net patient revenue in the 2020 budget to the adjusted 2020 actual net patient revenue. Identification as a repeat finding, if applicable: The finding is not a repeat finding. Recommendation: The Hospital should refine its process and retain documentation to evidence management?s review of the lost revenue calculation submitted to HRSA. View of Responsible Officials: The Hospital agrees with the finding and will implement procedures to ensure control documentation is retained.