Posted: 06 Oct. 2020 12 min. read

Six months after CARES: Hospitals and health systems should reevaluate their tracking and use of federal funding

By Tina Wheeler, vice chair, Health Care Sector leader, US and Global Health Care Audit leader, and Kelly Sauders, partner, Deloitte & Touche LLP

Provider Relief Fund (PRF) recipients have long awaited the reporting requirement data elements that are mandated as part of receiving and attesting to PRF payments. The release of these requirements (on September 19th) poses a new challenge for recipients as the COVID-19 pandemic continues throughout the country. Providers need to pivot toward organizing their COVID-19-attributable expenses and lost revenues in a way that is compliant with the Terms & Conditions of the distributions as well as the newly released reporting requirement data elements.

Even as health systems and hospitals work to collect their share of Coronavirus Aid, Relief, and Economic Security Act (CARES) funds, they should prepare for the future audits that will determine whether the funds were allocated appropriately. This is challenging, as COVID-19 cases continue to fill hospital beds in many parts of the country—and as hospital and health-systems leaders try to stay financially prepared throughout a prolonged pandemic.


It has been six months since CARES allocated $100 billion and created the PRF to help hospitals and health systems offset expenses and revenue lost due to the COVID-19 pandemic. On April 10, two weeks after the legislation went into effect, the US Department of Health and Human Services (HHS) disbursed the first $30 billion to eligible hospitals, physicians, and other health care providers. On April 24, $75 billion was added to the PRF under the Paycheck Protection Program & Health Care Enhancement Act. Through the present emergency period,1 HHS distributed about $139.7 billion of the $175 billion allocated through General and Targeted distributions.2

Through the PRF, HHS is allocating funds to eligible providers through General and Targeted Distributions as well as Uninsured Testing and Treatment reimbursement.3 To be eligible for General funds, providers must have billed Medicare fee-for-service (FFS) and offered care for diagnosed or suspected COVID-19 cases after January 31. There were two rounds of distribution under Phase 1 of the General Distribution. During Phase 1, HHS generally allowed parent organizations to allocate funds to related subsidiaries. Tax Identification Number (TIN) validation for providers to be considered for Phase 2 of the General Distribution were due September 13. Once the TIN has been validated, the application for Phase 2 should be completed in a timely manner.

Targeted Distribution funds have gone to health systems working in areas that have been significantly impacted by COVID-19 as well as to specific types of providers, such as Skilled Nursing Facilities (SNFs) and Rural Providers. Unlike General funds, the Targeted dollars are limited to organizations receiving the funding directly.4

Summary of reporting requirements

According to HHS, health care organizations that received one or more payments from the PRF exceeding an aggregate of $10,000 must submit reports detailing how the funds were used. They must also indicate compliance with payment terms and conditions. Below are several key points to take away from the Notice of Reporting Requirements:5

  • Applicability: The reporting requirements apply to all distributions with the exception of the Nursing Home Infection Control distribution, the Rural Health Clinic Testing distribution, and the Health Resources and Services Administration (HRSA) Uninsured Program
  • Expenses: HHS’s reporting requirements indicate that health care-related expenses must be applied before lost revenue, and only after considering other sources of funding (e.g., FEMA, commercial insurance, local and/or state grants, etc.). If PRF payment amounts are not fully expended on health care-related expenses, they can then be applied to lost revenues.
    • Expenses are defined as “General & Administrative” and “Health-care-related” operating expenses and must be reported quarterly for calendar years 2019 and 2020
    • Organizations that received between $10,000 and $499,999 in PRF payments must submit expenses in the two aggregated categories
    • Organizations that received $500,000 or more in PRF payments must submit expenses with more detailed information specific to subcategories within the two categories of expenses
  •  Lost Revenue: Lost revenue is defined as “a negative change in year-over-year net patient care operating income (i.e., patient care revenue less patient care-related expenses for the Reporting Entity) net of [health care-related] expenses attributable to Coronavirus calculated.” Providers can apply PRF payments toward lost revenue only “up to the amount of their 2019 net gain from [health care-related] sources.” Given this provision, providers that reported “negative net operating income from patient care in 2019 can use PRF payments on lost revenues up to a net zero gain or loss in 2020.” 
    • The notice requests that providers share total revenue and net charges from patient care-related sources—as well as revenue from patient care payer mix—when submitting their data6

Considerations for reporting and audits: Meeting the requirements

Given the potential differences between the notice of reporting requirement data elements and previously posted responses to Frequently Asked Questions (FAQs), many organizations might need to adapt current documentation-and-tracking practices to align with the direction of the new reporting requirements. Providers that received funding through CARES and/or other federal programs should carefully document expenses and estimate revenue lost throughout the emergency period of the pandemic. They should also show how federal funding was used to ensure compliance with Terms and Conditions requirements, while carefully considering additional clarifications and FAQs that HHS has said will be released prior to reporting deadlines. Clear delineation of process and oversight will also be important as providers continue to track expenses and losses through 2021.

Audits and government accountability: Leading practices and special considerations

CFOs from hospitals and health systems that received CARES funding should establish processes, procedures, and tools to carefully document expenses and revenue lost throughout the pandemic, as well as to maintain information that details how the funding was used to meet the attestation requirements noted in each of the distributions’ Terms and Conditions. According to HHS, these funds are subject to future audits.

Nonprofit and for-profit organizations have different external compliance audit considerations. Any funds received from the PRF are considered federal awards. If a nonprofit organization’s annual total federal awards expended are $750,000 or higher, then the organization is subject to Single Audit requirements. During Single Audits, independent auditors ensure the organization has adequate internal controls, accurate financial statements, and complies with federal cost regulations and any laws governing the specific funding stream.8 Nonprofit hospitals, which might not have received funding in excess of $750,000 until now, might be newly subject to the Single Audit requirements.

For-profit organizations that received more than $750,000 in federal awards have two audit options: they can undergo a Single Audit or opt for financial-related audit of the schedule of award(s) from HHS in accordance with Government Auditing Standards. Specific details for these options have not been released.

Navigating this unprecedented time

Given the complexity of the funding in this unprecedented time, hospital and health system CFOs can collaborate with their internal auditors, compliance professionals, and accounting teams to conduct preparatory assessments to determine readiness for audits and to confirm regulatory compliance. As providers consider if, when, and how to re-work their expenses and lost-revenue calculations against reporting requirements, they should establish comprehensive yet agile processes, procedures, and tools to align with current and potential future reporting and audit guidance.

Conducting a systematic review of electronic records, financial statements, lost-revenue calculations, eligible types of reimbursable expenses, and support for the expenses can help organizations prepare for future audits. Ultimately, organizations should approach compliance with consistent and thorough processes and documentation to ameliorate risks involved with receipt of federal funding. 

Acknowledgements: Lynn Friedrichs, Melissa Jagst, Ryan DeMerlis, and Stephanie Santana


1.  On January 31, 2020 the Secretary of Health and Human Services (HHS) declared a Public Health Emergency (PHE) in response to COVID-19. This PHE declaration was renewed effective as of July 25, 2020 and is due to expire on October 23, 2020.

2.  As of September 16, 2020. We are awaiting additional clarification of the total allocation to providers as part of the Phase 2 General Distribution.

3. US Department of Health and Human Services (HHS), CARES Act Provider Relief Fund Frequently Asked Questions

4.  US Department of Health and Human Services (HHS), CARES Act Provider Relief Fund: General Information

5.  US Department of Health and Human Services (HHS), General and Targeted Distribution, Post-Payment Notice of Reporting Requirements, September 19, 2020

6.  US Department of Health and Human Services (HHS), General and Targeted Distribution, Post-Payment Notice of Reporting Requirements, September 19, 2020

7.  US Department of Health and Human Services (HHS), Coronavirus Home, Cares Act Provider Relief Fund, Reporting Requirements and Auditing

8. Council for Nonprofits, Federal Law Audit Requirements 

Return to the Health Forward home page to discover more insights from our leaders.

Subscribe to the Health Forward blog via email

Get in touch

Kelly Sauders

Kelly Sauders

Partner | Life Sciences & Health Care

Kelly, a partner at Deloitte & Touche LLP, has more than 25 years of experience in the health care industry. Over her career, Kelly has worked extensively with health care providers across many different areas, starting with audit, then spending several years working on compliance, regulatory and enterprise risk projects. She also spent several years helping providers with clinical documentation, coding and billing projects both for revenue and compliance purposes. She has served as an interim chief compliance and privacy officer for several large academic health systems in the Northeast and has also served as an interim Director of Internal Audit. She has extensive experience working with providers on matters with Centers for Medicare & Medicaid Services (CMS), the Office of Inspector General (OIG) and Department of Justice (DOJ), including leading complex investigations and several Independent Review Organization (IRO) engagements for organizations under Corporate Integrity Agreements (CIAs). Kelly’s clients include academic medical centers, cancer centers, several large multi-state health systems, CMS and several large, national retail health clients. She works frequently with executive teams and boards of directors. Kelly is a frequent national speaker on compliance programs, enterprise risk management (ERM), internal controls and other regulatory topics.