There are COVID-19 hot spots and now there are potential covid audit hot spots.
The Coronavirus Aid, Relief, and Economic Security (CARES) Act was enacted on March 27, 2020. Through the CARES Act and subsequent legislation, hundreds of billions of dollars have been allocated for healthcare providers, including under the Provider Relief Fund (PRF) and the Paycheck Protection Program (PPP). These programs, in particular the PRF, are likely to give rise to a number of audit “hot spots,” or areas likely to draw increased scrutiny.
Several government agencies have promised to keep a watchful eye on the recipients of these funds. Along with the allocations themselves, the CARES Act also established the Special Inspector General for Pandemic Recovery (SIGPR) within the U.S. Department of the Treasury to conduct, supervise, and coordinate audits and investigations of the programs established under the CARES Act. The U.S. Department of Health and Human Services (HHS) has promised “significant anti-fraud and auditing work,” including by the HHS Office of Inspector General (OIG), of funds distributed under the PRF. The U.S. Department of Justice has also made pandemic-related enforcement a priority, although DOJ’s efforts thus far have largely focused on price-gouging and hoarding allegations under the Defense Production Act.
In addition to this enforcement, all recipients of PRF payments totaling $10,000 or more in aggregate will be required to file reports to demonstrate compliance with the applicable terms and conditions, including use of funds for allowable purposes, for each PRF payment. HHS has indicated that providers must file a single report covering all PRF payments expended in 2020. This report will be due Feb. 15, 2021. Any PRF funds expended after Dec. 31, 2020 must be included in a second report due July 31, 2021. HHS has released the data elements that recipients must include in these reports, but it continues to modify them.
In order to receive a payment from the PRF or to retain a payment that was deposited automatically into a provider’s account, the provider was required attest to the terms and conditions of the particular PRF program under which they received payment. Full compliance with these terms and conditions is “material” to the HHS decision to disburse the funds. This language tees up liability under the False Claims Act for statements made in the attestation, and likely in the required reports as well.
However, before a provider can attest to the terms and conditions, it must decide how to attest. HHS created two methods of attestation. First, the agency has encouraged providers to enter an online portal and affirmatively attest to the terms and conditions. Second, if a provider does not affirmatively attest or contact HHS to return the funds within a designated time frame (90 days at the time of this writing), the agency shall deem the provider to have accepted the terms and conditions. HHS and its contractor, UnitedHealth Group (UHG), have been sending reminders to providers that have not affirmatively attested to log into the portal and do so.
Some have speculated that a “deemed” attestation is preferable to an affirmative attestation, based on the theory that “deeming” a provider to have accepted the terms and conditions may not be sufficient to later enforce them. However, it is clear from the reminders sent by HHS and UHG that the agency is keeping track of which providers have affirmatively attested and which have not. This information may be used in the future in deciding which providers to audit. In other words, those that elected “deemed” attestation may be perceived by auditors to be of higher risk – and, therefore, more likely to be audited.
Among the terms and conditions that a provider must accept are restrictions on the use of PRF payments. The most common restrictions among the various allocations (and the most likely to draw scrutiny) are the following:
The first restriction often implicates other portions of the CARES Act itself, particularly the PPP. Employee payroll is explicitly listed by HHS as an eligible loss for which the PRF payment may reimburse the provider. However, these are the same costs that a PPP loan also covers. Because a provider may not “double dip” and use both the PRF payment and a PPP loan to cover the same loss, a provider that received funds from both programs should carefully document that the PRF and PPP funds were used for separate expenses in order to comply with this restriction.
The second restriction, that the PRF payment be used for eligible expenses or losses attributable to coronavirus, is also likely to be the source of significant audit enforcement. HHS has released a non-exhaustive list of examples of “healthcare-related expenses attributable to coronavirus” that includes the following:
governments;
It is important to note that HHS has repeatedly indicated that it views all patients as possible COVID-19 patients. Furthermore, HHS has released a non-exhaustive list of examples of
“lost revenues that are attributable to coronavirus” that includes the following:
As evidenced by this list, eligible losses need not be specifically for patient care. Instead, HHS has encouraged providers to use the payments to cover lost revenue in order to maintain “healthcare delivery capacity.” Providers should carefully document that any use of the PRF payment qualifies as an eligible expense or loss.
Providers should take care to document all eligible expenses and losses, including those in excess of the amount of payments they have received under the PRF or other CARES Act programs. This documentation can create a buffer of eligible expenses and losses in the event that other expenses or losses are disallowed. Moreover, documentation of eligible expenses and losses in excess of the payments received may protect against recoupment. An HHS spokesperson has indicated that “generally, HHS does not intend to recoup funds as long as a provider’s lost revenue and increased expenses exceed the amount of provider relief funding [the] provider has received.” Lastly, as of this writing, approximately $30 billion of the PRF fund has yet to be distributed, and Congress is considering proposals to increase the size of the PRF. Providers may receive further relief payments.
Providers should also be aware of the timing of the expenses and losses that they claim for the purposes of the PRF. To accept the payment, a provider must certify that it provided diagnoses, testing, or care for individuals with possible or actual cases of COVID-19 after Jan. 31, 2020. HHS plainly sees this date as pivotal in the response to COVID-19. However, HHS has stopped short of imposing a firm start date to the period for which providers may claim eligible expenses and losses. Instead, HHS expects that it would be highly unusual for a provider to have eligible expenses or losses prior to Jan. 1, 2020. It is important to note that the outbreak began at different times and progressed at different rates in different regions of the country. Therefore, information regarding the local status of the outbreak, such a local state of emergency order or the provider’s own records of increasing numbers of COVID-19 patients, may become valuable to substantiate the timing of eligible expenses and losses.
As discussed above, HHS has also drawn a distinction in the reporting requirements between funds expended in 2020 and those expended after Dec. 31, 2020, By drawing this distinction, HHS has signaled that it anticipates that providers will expend the majority of PRF funds in 2020, but they are not required to do so, and may hold over funds until 2021. However, a provider that waits to expend PRF funds until 2021 will need to document eligible losses and expenses in 2021.
Another area of the Provider Relief Fund where timing may lead to increased audit risk is in the sale of an entity. Because the initial payments were distributed to bank accounts associated with a provider’s TIN, based on 2019 fee-for-service (FFS) revenue, some payments were made to entities that had recently sold their TIN, were no longer providing services, or had recently acquired a TIN, but did not bill in 2019. Such sales implicate an entity’s eligibility for a PRF payment because the terms and conditions generally require that the entity both a) billed Medicare in 2019 and b) provided patient care on or after Jan. 31, 2020. Depending on the nature of the sale, an entity may not meet one of these eligibility requirements. Generally, if the sale was a stock transaction and the PRF payment was made to the entity, then the payment stays with the entity, regardless of the new owner. However, a seller is generally prohibited from otherwise transferring a payment to the buyer. HHS has directed sellers in this situation to return the payment, although HHS will not reissue it to the buyer. HHS has indicated that buyers in this situation may be eligible for future disbursements.
In the case of the Provider Relief Fund, the vast majority of providers that received payments must file reports demonstrating their compliance. These reports present providers with the opportunity to have the first word, rather than responding to a determination already made by an auditor.
Thorough understanding of the nuanced requirements and careful documentation indicating that a provider is in compliance can be the key to proactively addressing these potential audit hot spots.
About the Authors: (WACHLER YOU HAVE)
Stephen Shaver
Stephen Shaver is an associate attorney at Wachler & Associates, P.C. Stephen represents healthcare providers and suppliers in the defense of Medicare, Medicaid, and third-party payor audits, as well as a broad range of health professional and facility licensing and regulatory compliance matters.
Contact the Authors:
One of my favorite resources is Insights, distributed by Kodiak. Let me begin by noting that I do not have any affiliation with Kodiak. I
As discussed last week, payments to Medicare Advantage (MA) plans are adjusted to account for expected healthcare resource consumption by enrollees. Higher risk scores increase
Please log in to your account to comment on this article.
Accurately determining the principal diagnosis is critical for compliant billing, appropriate reimbursement, and valid quality reporting — yet it remains one of the most subjective and error-prone areas in inpatient coding. In this expert-led session, Cheryl Ericson, RN, MS, CCDS, CDIP, demystifies the complexities of principal diagnosis assignment, bridging the gap between coding rules and clinical reality. Learn how to strengthen your organization’s coding accuracy, reduce denials, and ensure your documentation supports true medical necessity.
Denials continue to delay reimbursement, increase administrative burden, and threaten financial stability across healthcare organizations. This essential webcast tackles the root causes—rising payer scrutiny, fragmented workflows, inconsistent documentation, and underused analytics—and offers proven, data-driven strategies to prevent and overturn denials. Attendees will gain practical tools to strengthen documentation and coding accuracy, engage clinicians effectively, and leverage predictive analytics and AI to identify risks before they impact revenue. Through real-world case examples and actionable guidance, this session empowers coding, CDI, and revenue cycle professionals to shift from reactive appeals to proactive denial prevention and revenue protection.
Sepsis remains one of the most frequently denied and contested diagnoses, creating costly revenue loss and compliance risks. In this webcast, Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, provides practical, real-world strategies to align documentation with coding guidelines, reconcile Sepsis-2 and Sepsis-3 definitions, and apply compliant queries. You’ll learn how to identify and address documentation gaps, strengthen provider engagement, and defend diagnoses against payer scrutiny—equipping you to protect reimbursement, improve SOI/ROM capture, and reduce audit vulnerability in this high-risk area.
Only ICD10monitor delivers what you need: updates on must-know changes associated with the FY26 IPPS, including new ICD-10-CM/PCS codes, CCs/MCCs, and MS-DRGs, plus insights, analysis and answers to your questions from two of the country’s most respected subject matter experts.
As AI reshapes healthcare compliance, the risk of biased outputs and opaque decision-making grows. This webcast, led by Frank Cohen, delivers a practical Four-Pillar Governance Framework—Transparency, Accountability, Fairness, and Explainability—to help you govern AI-driven claim auditing with confidence. Learn how to identify and mitigate bias, implement robust human oversight, and document defensible AI review processes that regulators and auditors will accept. Discover concrete remedies, from rotation protocols to uncertainty scoring, and actionable steps to evaluate vendors before contracts are signed. In a regulatory landscape that moves faster than ever, gain the tools to stay compliant, defend your processes, and reduce liability while maintaining operational effectiveness.
Get clear, practical answers to Medicare’s most confusing regulations. Join Dr. Ronald Hirsch as he breaks down real-world compliance challenges and shares guidance your team can apply right away.
Federal auditors are zeroing in on Inpatient Rehabilitation Facility (IRF) and hospital rehab unit services, with OIG and CERT audits leading to millions in penalties—often due to documentation and administrative errors, not quality of care. Join compliance expert Michael Calahan, PA, MBA, to learn the five clinical “pillars” of IRF-PPS admissions, key documentation requirements, and real-life case lessons to help protect your revenue.
During this essential RACmonitor webcast Michael Calahan, PA, MBA Certified Compliance Officer, will clarify the rules, dispel common misconceptions, and equip you with practical strategies to code, document, and bill high-risk split/shared, incident-to & critical care E/M services with confidence. Don’t let audit risks or revenue losses catch your organization off guard — learn exactly what federal auditors are looking for and how to ensure your documentation and reporting stand up to scrutiny.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
