Audit Hot Spots and the CARES Act

There are COVID-19 hot spots and now there are potential covid audit hot spots.

The Coronavirus Aid, Relief, and Economic Security (CARES) Act was enacted on March 27, 2020. Through the CARES Act and subsequent legislation, hundreds of billions of dollars have been allocated for healthcare providers, including under the Provider Relief Fund (PRF) and the Paycheck Protection Program (PPP). These programs, in particular the PRF, are likely to give rise to a number of audit “hot spots,” or areas likely to draw increased scrutiny.

Several government agencies have promised to keep a watchful eye on the recipients of these funds. Along with the allocations themselves, the CARES Act also established the Special Inspector General for Pandemic Recovery (SIGPR) within the U.S. Department of the Treasury to conduct, supervise, and coordinate audits and investigations of the programs established under the CARES Act. The U.S. Department of Health and Human Services (HHS) has promised “significant anti-fraud and auditing work,” including by the HHS Office of Inspector General (OIG), of funds distributed under the PRF. The U.S. Department of Justice has also made pandemic-related enforcement a priority, although DOJ’s efforts thus far have largely focused on price-gouging and hoarding allegations under the Defense Production Act.

In addition to this enforcement, all recipients of PRF payments totaling $10,000 or more in aggregate will be required to file reports to demonstrate compliance with the applicable terms and conditions, including use of funds for allowable purposes, for each PRF payment. HHS has indicated that providers must file a single report covering all PRF payments expended in 2020. This report will be due Feb. 15, 2021. Any PRF funds expended after Dec. 31, 2020 must be included in a second report due July 31, 2021. HHS has released the data elements that recipients must include in these reports, but it continues to modify them.

In order to receive a payment from the PRF or to retain a payment that was deposited automatically into a provider’s account, the provider was required attest to the terms and conditions of the particular PRF program under which they received payment. Full compliance with these terms and conditions is “material” to the HHS decision to disburse the funds. This language tees up liability under the False Claims Act for statements made in the attestation, and likely in the required reports as well.

However, before a provider can attest to the terms and conditions, it must decide how to attest. HHS created two methods of attestation. First, the agency has encouraged providers to enter an online portal and affirmatively attest to the terms and conditions. Second, if a provider does not affirmatively attest or contact HHS to return the funds within a designated time frame (90 days at the time of this writing), the agency shall deem the provider to have accepted the terms and conditions. HHS and its contractor, UnitedHealth Group (UHG), have been sending reminders to providers that have not affirmatively attested to log into the portal and do so.

Some have speculated that a “deemed” attestation is preferable to an affirmative attestation, based on the theory that “deeming” a provider to have accepted the terms and conditions may not be sufficient to later enforce them. However, it is clear from the reminders sent by HHS and UHG that the agency is keeping track of which providers have affirmatively attested and which have not. This information may be used in the future in deciding which providers to audit. In other words, those that elected “deemed” attestation may be perceived by auditors to be of higher risk – and, therefore, more likely to be audited.

Among the terms and conditions that a provider must accept are restrictions on the use of PRF payments. The most common restrictions among the various allocations (and the most likely to draw scrutiny) are the following:

• The recipient certifies that it will not use the payment to reimburse expenses or losses that have been reimbursed from other sources, or that other sources are obligated to reimburse.

• The recipient certifies that the payment will only be used to prevent, prepare for, and respond to coronavirus, and that the payment shall reimburse the recipient only for healthcare-related expenses or lost revenues that are attributable to coronavirus.

The first restriction often implicates other portions of the CARES Act itself, particularly the PPP. Employee payroll is explicitly listed by HHS as an eligible loss for which the PRF payment may reimburse the provider. However, these are the same costs that a PPP loan also covers. Because a provider may not “double dip” and use both the PRF payment and a PPP loan to cover the same loss, a provider that received funds from both programs should carefully document that the PRF and PPP funds were used for separate expenses in order to comply with this restriction.

The second restriction, that the PRF payment be used for eligible expenses or losses attributable to coronavirus, is also likely to be the source of significant audit enforcement. HHS has released a non-exhaustive list of examples of “healthcare-related expenses attributable to coronavirus” that includes the following:

• Supplies used to provide healthcare services for possible or actual COVID-19 patients;

• Equipment used to provide healthcare services for possible or actual COVID-19 patients;

• Developing and staffing emergency operation centers;

• Reporting COVID-19 test results to federal, state, or local

governments;

• Building or constructing temporary structures to expand capacity for COVID-19 patient care, or to provide healthcare services to non-COVID-19 patients in a separate area from where COVID-19 patients are being treated;

• Acquiring additional resources, including facilities, equipment, supplies, healthcare practices, staffing, and technology to expand or preserve care delivery and

• Workforce training;

It is important to note that HHS has repeatedly indicated that it views all patients as possible COVID-19 patients. Furthermore, HHS has released a non-exhaustive list of examples of     

“lost revenues that are attributable to coronavirus” that includes the following:

• Losses associated with fewer outpatient visits, canceled elective procedures or services, or increased uncompensated care;

• Employee or contractor payroll;

• Employee health insurance;

• Rent or mortgage payments;

• Equipment lease payments; and

• Electronic health record licensing fees

As evidenced by this list, eligible losses need not be specifically for patient care. Instead, HHS has encouraged providers to use the payments to cover lost revenue in order to maintain “healthcare delivery capacity.” Providers should carefully document that any use of the PRF payment qualifies as an eligible expense or loss.

Providers should take care to document all eligible expenses and losses, including those in excess of the amount of payments they have received under the PRF or other CARES Act programs. This documentation can create a buffer of eligible expenses and losses in the event that other expenses or losses are disallowed. Moreover, documentation of eligible expenses and losses in excess of the payments received may protect against recoupment. An HHS spokesperson has indicated that “generally, HHS does not intend to recoup funds as long as a provider’s lost revenue and increased expenses exceed the amount of provider relief funding [the] provider has received.” Lastly, as of this writing, approximately $30 billion of the PRF fund has yet to be distributed, and Congress is considering proposals to increase the size of the PRF. Providers may receive further relief payments.

Providers should also be aware of the timing of the expenses and losses that they claim for the purposes of the PRF. To accept the payment, a provider must certify that it provided diagnoses, testing, or care for individuals with possible or actual cases of COVID-19 after Jan. 31, 2020. HHS plainly sees this date as pivotal in the response to COVID-19. However, HHS has stopped short of imposing a firm start date to the period for which providers may claim eligible expenses and losses. Instead, HHS expects that it would be highly unusual for a provider to have eligible expenses or losses prior to Jan. 1, 2020. It is important to note that the outbreak began at different times and progressed at different rates in different regions of the country. Therefore, information regarding the local status of the outbreak, such a local state of emergency order or the provider’s own records of increasing numbers of COVID-19 patients, may become valuable to substantiate the timing of eligible expenses and losses.

As discussed above, HHS has also drawn a distinction in the reporting requirements between funds expended in 2020 and those expended after Dec. 31, 2020, By drawing this distinction, HHS has signaled that it anticipates that providers will expend the majority of PRF funds in 2020, but they are not required to do so, and may hold over funds until 2021. However, a provider that waits to expend PRF funds until 2021 will need to document eligible losses and expenses in 2021.

Another area of the Provider Relief Fund where timing may lead to increased audit risk is in the sale of an entity. Because the initial payments were distributed to bank accounts associated with a provider’s TIN, based on 2019 fee-for-service (FFS) revenue, some payments were made to entities that had recently sold their TIN, were no longer providing services, or had recently acquired a TIN, but did not bill in 2019. Such sales implicate an entity’s eligibility for a PRF payment because the terms and conditions generally require that the entity both a) billed Medicare in 2019 and b) provided patient care on or after Jan. 31, 2020. Depending on the nature of the sale, an entity may not meet one of these eligibility requirements. Generally, if the sale was a stock transaction and the PRF payment was made to the entity, then the payment stays with the entity, regardless of the new owner. However, a seller is generally prohibited from otherwise transferring a payment to the buyer. HHS has directed sellers in this situation to return the payment, although HHS will not reissue it to the buyer. HHS has indicated that buyers in this situation may be eligible for future disbursements.

In the case of the Provider Relief Fund, the vast majority of providers that received payments must file reports demonstrating their compliance. These reports present providers with the opportunity to have the first word, rather than responding to a determination already made by an auditor.

Thorough understanding of the nuanced requirements and careful documentation indicating that a provider is in compliance can be the key to proactively addressing these potential audit hot spots.

About the Authors: (WACHLER YOU HAVE)

Stephen Shaver

Stephen Shaver is an associate attorney at Wachler & Associates, P.C. Stephen represents healthcare providers and suppliers in the defense of Medicare, Medicaid, and third-party payor audits, as well as a broad range of health professional and facility licensing and regulatory compliance matters.

Contact the Authors:

sshaver@wachler.com