HHS audits: Key questions facing for-profit healthcare providers

For many, if not most, for-profit healthcare providers, the PRF distributions received from the U.S. Department of Health and Human Services (HHS) over the last two years will trigger their first audit requirement related to federal funding. If this includes your organization, there are two must-read practice aids released by the AICPA Governmental Audit Quality Center (GAQC) in February 2022. They are:

• HHS Audit Requirements for For-Profit Entities with Awards for the Provider Relief Fund Program and Other HHS Programs (audit requirements)
• Audit Scope Considerations for Provider Relief Fund General and Targeted Distributions in Parent-Subsidiary Relationships (audit scope)

These practice aids will address many of your questions concerning the HHS audit requirements, specifically those related to the financial audit option.

What are the audit requirements?

As outlined in the Provider Relief Fund and ARP Rural Payments FAQs published by the Health Resources and Services Administration (HRSA) (an agency of HHS), for-profit providers who expend more than $750,000 of funds received under HHS programs for the reporting period are required to have an audit of those funds. It’s important to note that when evaluating this threshold, the amount expended must include consideration of all HHS programs, not only funding received under the PRF program. Also note that the timing of reporting amounts related to the PRF program are uniquely prescribed by HHS, whereas other HHS programs follow the entity’s basis of accounting. The AICPA’s Audit Requirements practice aid provides additional information on this topic.

HHS allows for-profit providers two options for the audit under 45 CFR 75.216(d):

1. A financial-related audit of the awards conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS or GAO).
2. A single-audit or program-specific audit conducted in accordance with Uniform Guidance.

Table 1 of AICPA’s Audit Requirements practice aid is a great resource that illustrates the differences between the options.

If a for-profit entity has awards from more than one HHS program in the period reported on, a program-specific audit will not be an option.

Although management will need to understand what each option entails given a particular set of facts and circumstances, most for-profit providers will choose the financial-related audit. Refer to question 4 of the AICPA’s Audit Requirements practice aid for a detailed explanation of why many for-profit providers will select the GAGAS financial-related audit option.

The remaining questions focus on the financial audit option.

What will be covered in the audit?

The financial-related audit will follow the audit standards outlined in AU-C Section 805: Special Considerations — Audits of Single Financial Statements and Specific Elements, Accounts, or Items of a Financial Statement. The starting point for the AU-C 805 audit is determining what the financial statements (the Schedule) will present, which is the scope of the audit. Key areas of consideration include the following:

As mentioned previously, all HHS awards must be included in the Schedule presented. This includes funding received under the PRF program, the Uninsured Program (ALN #93.461), and any other awards received from HHS.

Funding from other non-HHS federal agencies should not be presented on this Schedule or considered as part of the $750,000 expended threshold. 

Question 17 of the AICPA’s Audit Requirements practice aid provides great clarity for providers on what basis the amounts will be presented on, stating that the Schedule may be presented following generally accepted accounting principles (GAAP), accrual basis accounting, or a special-purpose framework, like cash or income tax basis.

The period of time covered will depend on the provider’s fiscal year-end and the make-up of the distributions received. For Dec. 31, 2021 year-ends, providers will report PRF amounts from both Period 1 and Period 2 reports submitted to the HRSA PRF Reporting Portal. This will include amounts earned from PRF distributions received between April 10, 2020 and Dec. 31, 2020. The HHS FAQs and AICPA’s Audit Requirements practice aid provide additional details for providers with noncalendar year-ends to consider. HHS awards other than PRF are reported on the Schedule in accordance with the entity’s basis of accounting.

For providers that may have complex ownership structures, such as multiple entities under common control, or may have not historically issued audited financial statements following GAAP, the question of which entities should be included may involve significant judgment and may require consultation with HRSA. The AICPA’s Audit Scope practice aid provides some good food for thought, but if there’s a particularly nuanced set of circumstances that aren’t addressed in the practice aid providers should contact HRSA at this address for additional guidance.

What can providers expect when the audit is executed?

An AU-C 805 audit will be most similar to a financial statement audit, but with a much narrower scope.  Because the financial statement element being audited is the HHS program-related revenue recorded by the provider, auditors will focus their audit procedures, including gaining an understanding of the controls and processes in place, on those amounts reported. Providers can expect that the extent of audit procedures will be tailored based on the underlying nature of what the funds were used toward. At the conclusion of the AU-C 805 audit, auditors will issue two audit reports: an opinion on the Schedule and a Report on Internal Control over Financial Reporting and Compliance and Other Matters (GAGAS report). 

These audits are required to be submitted to HHS no later than 30 calendar days after receipt of the audit report or nine months after a provider’s fiscal year-end, whichever is earlier. Providers with fiscal year-ends of June 30, 2021 or earlier were granted a six-month extension. No additional extensions are expected from HHS; therefore, Dec. 31, 2021 year-ends will be due Sept. 30, 2022. Providers must submit their report via email to HRSA’s Division of Financial Integrity at PRFaudits@hrsa.gov. 

What do providers need to do now?

Here are a few actions that management can take now to ensure a smoother audit:

• Accumulate all sources of HHS funding, associated grant agreements, and copies of all HHS portal submissions completed to-date.
• Prepare the organization’s schedule and assess the need for an audit.
• Document conclusions for qualified expenses and calculations of lost revenue (in the case of PRF) as well as the relevant guidance relied upon when conclusions were made.
• Prepare to provide a detailed list of expenses and lost revenue calculation that agree to the HHS portal submissions completed to date.

Since a resolution may involve reaching out to HRSA for additional clarification, this shouldn’t be delayed. In all cases, management should clearly document its key conclusions reached as a result of its decision-making process so that it’s recorded for future inquiries.

As you navigate the complexities of the HHS for-profit audit requirements, we’re here and ready to help — don’t hesitate to reach out.