While the CARES Act signals relief for many healthcare providers, it is important to remember that there are strings attached and reasons for providers to involve their compliance departments in the use and tracking of the CARES Act relief funds.

The CARES Act promised, through the Public Health and Social Services Emergency Fund, to provide $100 billion in relief funds to hospitals and other healthcare providers (collectively “providers”) for healthcare related expenses and lost revenue attributable to COVID-19. On April 10, 2020, the government started distributing the first $30 billion in funds to eligible providers throughout the healthcare system (the “Relief Funds”).

These Relief Fund payments are not loans and do not need to be repaid. However, there are strict guidelines on how the money may be used and how its use must be documented and reported. In fact, the CARES Act creates the Pandemic Response Accountability Committee to audit and review the fund recipients in order to “prevent and detect fraud, waste, abuse, and mismanagement.”

Because of the requirements associated with the Relief Fund payments, healthcare providers should involve their compliance department in implementing a strong internal process to monitor these funds in order to avoid any unintentional wrongdoing. Putting these practices in place now will relieve post-COVID stress and reduce the chances of raising governmental red flags in the future.

Understanding the Initial Disbursement

1. Which healthcare providers are eligible to receive the initial $30 billion in Relief Funds?

• All providers that received Medicare fee-for-service reimbursements in 2019;
• Provides or provided diagnoses, testing, or care for individuals with possible or actual cases of COVID-19 after January 31, 2020 (even if no patients were actually treated for COVID-19);
• Have not been terminated from participation in Medicare;
• Are not excluded from participation in Medicare, Medicaid, or any other Federal healthcare programs; and
• Have current Medicare billing privileges.

Providers that do not meet these requirements yet receive CARES funds must refund the amount to the U.S. Department of Health & Human Services (HHS) within 30 days (see below). Failure to do so could result in an over-payment, potentially triggering False Claims Act liability.

2. How will the Relief Funds be disbursed?

The Relief Funds will be disbursed automatically via Automated Clearing House account information already on file with CMS or UnitedHealth Group. Providers should look for an automatic payment from Optum Bank, with “HHSPAYMENT” as the payment description.

Large organizations, health systems, group practices, and solo practitioners will receive payments under each of their Tax Identification Numbers that bill Medicare. Employed physicians and providers in group practices should not expect to receive funds as the funds will be sent to their employer organizations.

During the COVID-19 crisis, cyber security attacks are on the rise (article available here), which makes it especially important that providers ensure they know where the funds will be arriving in order to prevent administrators from falling victim to malicious users who may try to trick them into clicking on a scam.

3. What constitutes acceptance of the funds?

Providers have 30 days from receipt of funds to sign an attestation (available here) confirming the funds were received, and agreeing to abide by the Terms and Conditions.

Failure to contact HHS within 30 days constitutes acceptance of the Terms and Conditions, which means providers may have implicitly certified compliance and could be subject to False Claims liability. More specifically, under 31 U.S.C. § 3729(1)(B), one may be in violation of the False Claims Act if he/she “knowingly makes, uses, or causes to be made or used, a false record or statement material to a false or fraudulent claim.”

4. How may the Relief Funds be used?

By accepting the funds, the recipient agrees to comply with all of the following:

• Only use the funds to prevent, prepare for, and respond to coronavirus, and agrees that this reimbursement is only for health care related expenses or lost revenues that are attributable to coronavirus. (Providers should note that, although the guidance on the HHS website said that the intent is to cover more than testing and providing care for COVID-19 patients, the Terms and Conditions with which providers must certify compliance, appear to be drafted more narrowly.)
• Not use the funds for expenses or losses that were already reimbursed by other sources or for which other sources have an obligation to reimburse. (HHS has not issued additional guidance to explain this provision further, so providers may want to proceed with caution when disbursing the Relief Funds.)
• Not seek payment from a COVID-19 patient for out-of-pocket expenses that are greater than what the patient would have had to pay for care provided by an in-network provider. (Providers should be on the lookout for additional guidance from HHS on this requirement as HHS has stated that it views “every patient as a possible case of COVID-19,” which may signify that the prohibition on seeking out-of-pocket expenses applies to services provided to all patients.)

Additionally, recipients of the Relief Funds must agree not to use the funds for, among other things, excessive executive compensation, promoting gun control, paying for abortions, embryo research, needle exchange programs, and promoting the legalization of controlled substances.

5. What type of documentation is required?

Facilities receiving more than $150,000 in total funds from the CARES Act—or from any other coronavirus response act for that matter—must submit a report to the HHS Secretary and to the Pandemic Response Accountability Committee no later than 10 days after each calendar quarter.

Among other things, this report must cover:

• Total amount of funds received;
• Detailed list of projects for which the funds were expended or obligated; and
• Detailed list of subgrants or subcontracts awarded by the recipient, its subcontractors, or subgrantees.

Additionally, all providers must maintain records and cost-documentation that substantiate that the funds were used appropriately. Such documents must be readily available at the request of the HHS Secretary or if the Inspector General or Pandemic Response Accountability Committee decides to conduct an audit. Documentation must be maintained in accordance with 45 CFR § 75.302, and 45 CFR § 75.361 through 45 CFR § 75.365.

The HHS Secretary has not yet issued specific guidance regarding reporting and auditing requirements for providers receiving less than $150,000.

Implementing a Process to Ensure Compliance

In order to avoid penalties, including False Claims Act liability, providers should implement an internal process that ensures:

• Funds are only used for approved purposes, including that the funds are only used as provided in the Terms and Conditions;
• An individual or department is designated with monitoring compliance with all the Terms and Conditions;
• The process is properly monitored and audited to routinely assess compliance with all the required elements;
• Proper documentation is maintained; and
• A “hard stop” is issued to avoid misuse of the funds whereby the funds cannot be released without receiving the requisite review and approval by a designated individual.

Providers should consider the following when deciding how to spend the Relief Funds:

• Which individual or department will be responsible for approving the use of Relief Funds?
• What specific information must the requesting individual or department provide to the approver when requesting funds (e.g., name of project, description, amount to be used, supervisor responsible for project)
• How will the provider ensure that funds are never spent without prior approval?
• Does the provider have an existing system that can be used to track approvals, or will the individual and/or department responsible for coronavirus-related approvals be required to maintain all documentation? If the latter, how will it ensure consistency?
• How will funds be monitored to ensure that the amount/use remains within the approved parameters? If additional funds are needed, will the approval process start again—or will there be a separate process to request additional funds?
• Will the requesting individual or department be responsible to check in with the approving individual or department at set times (e.g., monthly) to report and/or document progress?
• Once the project is over, will the requesting individual or department be responsible for submitting a final report?
• What specific items must be documented in order to comply with the CARES Act (e.g., facilities receiving more than $150,000 must provide information regarding “the estimated number of jobs created or retained by the project or activity”)?

Once the provider’s internal process is defined, it is essential to ensure that it is followed uniformly and that all information is retained in a consistent manner.

The process should be outlined in writing and disseminated to all the appropriate stakeholders. It is also important to ensure that everyone involved is properly trained in the process.

It is imperative that the compliance department be involved in order to help providers ensure they satisfy all the obligations discussed above. Additionally, as HHS continues to issue new guidance, the compliance department will be able to assist by checking for updates on a regular basis and reaching out to management with any changes which may need to be made to the process.

Auditing and Monitoring

Compliance programs are responsible for conducting routine auditing and monitoring of areas that have substantive exposure to government enforcement.

Providers who receive more than $150,000 in funds will be required to submit a report to the HHS Secretary and the Pandemic Response Accountability Committee no later than 10 days after the end of each calendar quarter. The Committee is responsible for closely watching how the funds are used and detecting any fraud, waste, abuse, or mismanagement. Providers that involve the compliance team upon receipt of the Relief Funds will ensure that they are able to conduct a preliminary audit of their process within two months of receiving the funds. This will help identify areas for improvement before the first COVID-19 Relief Fund report is required to be submitted.

Work Together

As discussed throughout this article, there are indeed strings attached to the CARES Act Relief Funds. Accordingly, it is imperative that providers involve their compliance department as quickly as possible to help ensure that they accurately certify to the Terms and Conditions, have policies and procedures in place to ensure the Relief Funds are properly used and accounted for, and provide continuous auditing and monitoring to check that the funds are being used appropriately and that all documentation requirements are being met.

Failure to timely involve compliance may result in more headaches rather than relief.