Audit 334747

FY End
2023-12-31
Total Expended
$4.93M
Findings
8
Programs
7
Organization: Frederiksted Health Care, Inc. (VI)
Year: 2023 Accepted: 2024-12-24
Auditor: Cohnreznick LLP

Organization Exclusion Status:

Checking exclusion status...

Findings

ID Ref Severity Repeat Requirement
516861 2023-003 Material Weakness - N
516862 2023-003 Material Weakness - N
516863 2023-003 Material Weakness - N
516864 2023-003 Material Weakness - N
1093303 2023-003 Material Weakness - N
1093304 2023-003 Material Weakness - N
1093305 2023-003 Material Weakness - N
1093306 2023-003 Material Weakness - N

Contacts

Name Title Type
J6RKFSB6KL59 Jacquelynn Rhymer-George Auditee
3407721992 Steven D. Schwartz Auditor
No contacts on file

Notes to SEFA

Title: Basis of Presentation Accounting Policies: Expenditures reported on the Schedule are reported on the accrual basis of accounting. Such expenditures are recognized following the cost principles contained in the Uniform Guidance wherein certain types of expenditures are not allowable or are limited as to reimbursement. De Minimis Rate Used: N Rate Explanation: The Center has elected not to use the 10% de minimis indirect cost rate as allowed under the Uniform Guidance. The accompanying schedule of expenditures of federal awards (the "Schedule") includes the federal award activity of Frederiksted Health Care, Inc. (the "Center") under programs of the federal government for the year ended December 31, 2023. The information in this Schedule is presented in accordance with the requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards ("Uniform Guidance"). Because the Schedule presents only a selected portion of the operations of the Center, it is not intended to and does not present the financial position, change in net assets, or cash flows of the Center.
Title: Donated and nonmonetary assistance Accounting Policies: Expenditures reported on the Schedule are reported on the accrual basis of accounting. Such expenditures are recognized following the cost principles contained in the Uniform Guidance wherein certain types of expenditures are not allowable or are limited as to reimbursement. De Minimis Rate Used: N Rate Explanation: The Center has elected not to use the 10% de minimis indirect cost rate as allowed under the Uniform Guidance. Donated and nonmonetary assistance is reported in the Schedule at the fair value of the vaccinations received. The total federal share of vaccinations distributed by the Center amounted to $188,512 and is included in the statement of activities and change in net assets. This amount is included in the Schedule.

Finding Details

Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.
Finding 2023-003 - Special Tests and Provisions: Sliding Fee Discounts Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Health Centers Program Cluster (93.224 & 93.527) Federal Award Identification Number and Year: H8000372 03/01/2022 – 2/28/2023 & 03/01/2023 – 02/29/2024 Criteria In accordance with 42 CFR sections 51c.303(f) and (g), health centers must prepare and apply a sliding fee discount schedule ("SFDS") so that the amounts paid for health center services by eligible patients are adjusted (discounted) based on the patient's ability to pay. Statement of Condition While performing the audit, we noted that the Center was unable to provide supporting documentation to verify that the visit occurred and that the proper amounts were billed and adjusted. We were also unable to obtain documentation to support the patient's income level and family size. As a result, we were unable to determine proper application of the SFDS. Cause The Center suffered a cyber incident in October 2023 that compromised their electronic medical records system. As a result, all patient information, including progress notes and proof of income level and family size, were unable to be recovered. Effect The Center may not have properly calculated the sliding fee or discount given to the patients and the discount given, if any, may not have been based on the patient's ability to pay. Questioned Costs None Context While performing the audit we noted the Center was unable to provide sufficient and appropriate audit evidence to support proper application of the SFDS for any patients who visited the Center prior to the electronic medical record system becoming compromised in October 2023. Identification as a Repeat Finding This finding is not a repeat finding. Recommendation We recommend the Center enhance their data recovery procedures to ensure that information necessary for compliance, in the event it becomes compromised, can be recovered. View of Responsible Officials While Management is in agreement with this finding, we would like to state that during our 2023 HRSA site visit, our sliding fee discount program was found to be in compliance. Due to the cyber-attack, FHC was not able to access its practice management system for 2023. To reduce future breaches, FHC implemented the following changes: The virtual machine hosts were re-initialized, and the latest version of VMWare were installed. Advanced endpoint protection was also installed on all computers and servers; Multi-factor authentication (MFA) for email use was established; the remote workers access was changed to TruGrid, a platform that provides secure remote desktop protocol (RDP) connections. Backup redundancy was established, following the 3-2-1 method of three backups, two different locations, one copy always offline. Servers are constantly replicated in the Cloud, differential backups are run every two hours, and one copy is always kept offline. FHC is confident that these changes will greatly reduce the likelihood of another cyberattack. Frederiksted Health Care has arranged a cybersecurity partnership with High Tide Solutions, a technology firm. High Tide Solutions now provides a suite of services including server management, penetration testing, data backup management, network management, Ransomware protection, cybersecurity training and cloud platform support. As a result of the implementation of the above-mentioned changes, FHC is now confident that we will have the appropriate safeguards in place to protect pertinent data in the event of another cyberattack.