CARES Act Compliance for Healthcare Organizations: Minimizing Risk after Securing Funding

Click Here to Download Our CARES Act Compliance Checklist for Healthcare Providers

The Current Environment for Healthcare

When the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was signed into law on March 27, 2020, it provided many healthcare organizations impacted by COVID-19 with a collective sense of hope and relief, and laid the groundwork for critical financial assistance. As part of Phase 1 of the Provider Relief Fund allocation under the CARES Act, the Department of Health and Human Services (HHS), announced that, to deliver financial support during the pandemic, it would distribute $50 billion to providers who bill Medicare on a “fee-for-service” basis. The Phase 1 distributions were released in one of two ways: funding automatically distributed to providers and funding requiring the submission of an application.

On June 9, 2020, HHS announced that the Phase 2 distribution of the Provider Relief Fund would consist of an additional $15 billion dispersed to eligible providers in Medicaid managed care, Medicaid/Children’s Health Insurance Programs (CHIP), and dental care programs that had not received a payment under Phase 1. On July 31, 2020, HHS extended the deadline for Phase 2 applications, which must now be submitted by August 28, 2020.

For providers who received (or will receive) funding under either Phase 1 or Phase 2, HHS requires compliance with reporting and other requirements described in the Provider Relief Fund terms and conditions – and as will be specified in future directions issued by HHS.

Indeed, the CARES Act generated three new compliance oversight and enforcement entities:

The Pandemic Response Accountability Committee (PRAC)
The Special Inspector General for Pandemic Recovery (SIGPR)
A Congressional Oversight Commission.

Further, existing enforcement and regulatory bodies such as the Department of Justice (DOJ), Securities and Exchange Commission (SEC), Internal Revenue Service (IRS), and various State Attorneys General have indicated the intention to investigate misconduct associated with the CARES Act.

Therefore, failure to integrate CARES Act compliance measures, enhance internal compliance and finance resources and, perhaps most importantly, monitor compliance with applicable requirements, will increase the risk of government scrutiny. This could result in False Claims Act complaints, whistleblower suits and related liability concerns.

In order to mitigate risks associated with active government oversight of the use (or misuse) of CARES Act funding, providers receiving money should consider swiftly implementing the best practices set forth in Buchanan’s CARES Act Compliance Checklist for Healthcare Providers. These proactive compliance steps can assist providers considerably in managing the danger of unwelcome scrutiny or liabilities.

Considerations for Accepting or Rejecting Funds

Providers who have received payments under Phase 1 funding have 90 days from the date of receipt to accept the terms and conditions or to return the funds to HHS. If a provider receives payment and fails to accept the terms and conditions within 90 days after receipt, the organization is deemed to have automatically accepted the terms and conditions. The same rules apply for those providers that apply for and receive funds under Phase 2.

Any eligible provider who receives funding under either Phase 1 or Phase 2 of the CARES Act distribution must attest to the following terms and conditions within 90 days of receiving payment (in addition to any other certifications that HHS may require at a future time):

Recipient provided, on or after January 31, 2020, diagnosis, testing or care for actual or possible COVID-19 patients (HHS broadly views every patient as a possible case);
Provider is not terminated, revoked, or precluded from participating in Medicare, Medicaid or other federal healthcare programs;
Payment must be used to prevent, prepare for, and respond to coronavirus, and reimburse healthcare-related expenses or lost revenues attributable to coronavirus (more details for providers on what qualifies in these categories can be found here);
Funds were used only to reimburse healthcare-related expenses or lost revenues attributable to COVID-19, and these expenses (or losses) were not refunded by other sources (and other sources were not obligated to reimburse them);
Recipient will comply with all reporting and information requirements;
Provider’s information, both in its payment application as well as all future reports to HHS or other agencies, is true, accurate and complete to the best of its knowledge;
Recipient consents to public disclosure of funds payment.

If a provider does not have (or anticipates not having) coronavirus-related eligible expenses or lost revenues equal to or in excess of the Provider Relief Fund payment received, it should reject the payment in the Provider Relief Fund Attestation Portal and return the payment.

While providers do not need to be able to prove, at the time they accept a Provider Relief Fund payment, that prior and/or future lost revenues and increased expenses attributable to COVID-19 meet or exceed their relief fund payment, HHS expects that providers will only use relief fund payments for permissible purposes under the terms and conditions.

If, when the pandemic is over, providers have any leftover relief funds that they cannot expend on permissible expenses or losses, providers must return this funding to HHS. Additional guidance on returning or rejecting funds can be found here.

Accessing HHS and Related Government Agencies

While there appears to be some flexibility for providers in terms of how losses due to COVID-19 may be calculated, any confusion in adhering to the relevant accounting terms and conditions could pose legal challenges in the future if, for example, HHS interprets such guidelines differently than providers. In these instances, having government relations expertise and experience in dealing with leadership at HHS, the Centers for Medicare & Medicaid Services (CMS) and other involved agencies will be extremely valuable to Provider Relief Fund recipients. At Buchanan, our government relations team is in regular discussions with HHS and other pertinent agencies about how the government interprets relevant CARES Act rules.

Mitigating Risk through Leadership and Training

Considering the many requirements relating to the qualification for, and use of, funds under the CARES Act, compliance is much easier said than done. Now is the time for provider-recipients to bolster compliance resources to allow for the appropriate monitoring of compliance with applicable requirements and to oversee those managing CARES Act funds.

This includes, but is certainly not limited to, ensuring that provider leadership is fully integrated into the compliance enhancement and communications process. This should include CARES Act training to ensure that executives, managers and other key personnel fully comprehend the terms and conditions for Provider Relief Fund payments and can assist with implementation and oversight throughout the organization. Designating a specific CARES Act compliance officer and retaining experienced legal counsel to provide guidance will also help reduce risk.

Maintaining Accurate Accounting and Documentation

Providers should carefully maintain all CARES Act-related documentation and ensure books and records are accurate and in good standing, both before applying for relief through the Provider Relief Fund and after receiving any funding. These records should memorialize all steps taken to secure funds, including attestations and certifications made by authorized provider signatories.

Recipients will be required to submit documents to substantiate that funds received by the government were used for increased healthcare-related expenses or lost revenue attributable to COVID-19, and that those expenses or losses were not reimbursed from other sources.

HHS and the oversight entities created by the CARES Act will carefully track funds and, as resources permit, investigate potential fraud to ensure that federal dollars are used properly. Moreover, providers that received more than $150,000 in funding through the initial distribution will need to file detailed quarterly reports no later than 10 days after the end of each calendar quarter. Those that received more than $750,000 will be automatically audited beginning in the fiscal or calendar year in which the provider spends the funds.

Key Compliance Program Actions

CARES Act compliance efforts designed, implemented and acted upon by providers before reports are filed with HHS – and prior to any required audits – will pay dividends for healthcare companies. Such efforts will likely be the most important components of each recipient’s plan for alleviating the risk of compliance failures and future civil or criminal legal issues related to funding. Please review our Compliance Checklist for details on mitigation measures, including:

Adapting and strengthening your current compliance program to account for expectations, guidelines and requirements for Provider Relief Fund recipients;
Assigning and training a dedicated CARES Act specialist to spearhead CARES Act compliance and manage any questions, concerns or potential issues as they arise;
Depositing CARES Act funds into a segregated account with limited access – and perhaps even a multi-signature access requirement;
As resources permit, arranging for virtual or safe in-person training for those who have access to CARES Act monies to ensure, among other things, compliance, proper accounting, and the preparation of supporting documentation for expenditures;
Given the frequent updates from HHS and others, actively monitoring guidance and regulations about the CARES Act, as they may affect compliance and eligibility.

One Stop for Experienced Legal Counsel and Government Relations

When confronted with new, unprecedented challenges, as is the case with COVID-19, the CARES Act, and evolving executive, legislative, judicial, and enforcement priorities, providers should consider retaining experienced counsel to help manage daily difficulties. Healthcare providers have been hit particularly hard by the pandemic. Having legal counsel by your side throughout the crisis can help you deter, detect and prevent issues before they occur. And in the event that concerns escalate and perhaps involve government scrutiny or commercial disputes, experienced attorneys will be invaluable to problem-solving and resolution.

At Buchanan, our coordinated team of healthcare lawyers, veteran compliance program specialists, former federal investigators and prosecutors, seasoned commercial litigators, criminal defense attorneys, and widely respected government relations professionals can help providers with the full gambit of COVID-19-era concerns and considerations – from daily crisis counseling, to CARES Act compliance, to investigations and litigation defense. We view our healthcare clients as top-priority partners in managing the myriad issues arising from the pandemic and are fully committed to helping them create and maintain robust compliance programs to ensure their continued business success.