Finding 2025-001 Internal control deficiency and noncompliance over Eligibility. Identification of the federal program: Assistance Listing Number 93.914: • HIV Emergency Relief Project Grants • U.S. Department of Health and Human Services • Federal award identification number – Not available • Federal award year – March 1, 2022 to February 28, 2028 • Pass-through entity – City of Newark Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 Internal controls. The recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The grant agreement of the award requires the following: • Re-certification is required six months after certification and must include verification of income and household size < 500% of federal poverty level, residency, and health insurance status. Changes in status must be documented. • Clients must be certified upon determination of eligibility, and every 12 months thereafter, by documentation of HIV/AIDS status (new clients only), income, household size, residency, and health insurance status. Condition: During our testing of eligibility, we observed management did not have effective internal controls in place to ensure patients were checked for eligibility every six months, annually, and retain supporting documentation to support income and HIV diagnosis. This resulted in the Clinic being out of compliance with the program requirements outlined in the grant agreement. Cause: Management did not have effective internal controls in place over the compliance requirements as stated in the criteria or specific requirement section above. Effect or potential effect: Patients receiving services from this grant could potentially be ineligible to be in the program. Questioned costs: Questioned costs for Assistance Listing Number 93.914 – HIV Emergency Relief Project Grants are indeterminable as patients receiving services from this grant could potentially be ineligible to be in the program. Context: During our testing over eligibility, we obtained a listing of 1,815 patients and selected a sample of 60. The sampling was a statistically valid sample. We found the following: • There were 6 out of 60 selections where the patient was not checked for eligibility as part of the six month and/or annual certification requirement. • There were 4 out of 60 selections where the patient’s six month and/or annual certification requirement was not signed at the date of service. • There was 1 out of 60 selections where the Clinic did not have supporting documentation to support income related to the six month and annual eligibility check. • There were 4 out of 60 selections where the Clinic did not retain supporting documentation to support HIV diagnosis related to the six month and annual eligibility check. Identification as a repeat finding, if applicable: Yes – 2024-001 Recommendation: Management should develop and implement effective internal controls to ensure patients are checked for eligibility every six months, annually, and retain supporting documentation to support income and HIV diagnosis. Views of responsible officials: Clinic management team acknowledges that from the audit selection made of 60 patients, 15 selections had findings. We agree with you that seven (7) of the 15 did not meet either, the six-month recertification requirements or had missing proof of income findings. We agree and are not contesting patient selection numbers: 25, 27, 31, 38, 52, 56 and 59. We will address this in our corrective action plan. Staff have completed the six-month recertifications and gathered the missing income data Four (4) of the findings related to certification data being collected and uploaded in the hospital EPIC electronic medical records but were not formally signed by a case manager. We are in partial compliance with the data requirements, but we needed to finalize and ensure that controls are in place, so the service provider must sign the note. We had situations where the provider passed away or left the Peter Ho clinic, due to relocation. Staff have since completed the notes and we have developed a report within our EMR to notify the service provider that the note requires signature. The four missing signatures by the service provider were patient selections: 9, 24, 29, 41. Four (4) of the findings related to not having the original HIV diagnosis confirmed on the patient not successfully migrated into the new electronic medical record, EPIC. For three of these patients, the staff could not find the original HIV diagnosis on the chart. The patients were treated properly, but the original data was not retained. This was caused by not all data being successfully migrated when Peter Ho updated its EMR during CY 2021. The Peter Ho Clinic switched from Centricity to EPIC during 2021. The selected patients have been treated at Peter Ho prior to CY 2021. We did provide other supporting documentation that the patient has HIV, but we could not find the original documentation. The four patient selections that fell into this category are: 19, 30, 34 and 39. The corrective action plan as developed for CY 2024 will be continued to be reinforced and followed. A few new bullets have been added below to further assist in meeting the compliance guidance. A detailed plan of correction is identified below: • Quality management process, where Clinic clients are called ahead of time to notify them of their recertification requirements. This process will remain in place. • Assistant Manager will implement an EPIC (EMR) precheck process for current assessments. All future assessments will have proof of diagnosis, proof of income, proof of ID, proof of address and proof of insurance on the template to include the dates in which those documents were collected. (new) • Data Analyst(s) generate a report of patients due for recertification 60 days in advance of the due date. The CCC-Lead will remain directly accountable to review the progress of re-certifications. Further monitoring by the Assistant Manager of the clinic will continue. • An EPIC (EMR) report of unsigned encounters will be generated biweekly and reviewed by staff for open encounters and notes to be signed. (new) • The CCC-Lead and the Assistant Manager will continue to monitor retention of income verification documentation to ensure compliance purposes. • Document scanners will be provided to individual Certified Case Counselors to alleviate late or missed filings, documents will be scanned directly into EMR at the time of capture. • The Clinic staff will continue follow up with the patients that were non-compliant during the prior year audit and asked for the missing information. The medical record will be updated with any new information received. • Chart review for all upcoming appointments will be performed to capture/locate missing diagnosis because of data transfer failure from old EMR. If diagnosis is missing, rapid testing to be performed by the Counseling and Testing Department at that time to continue current treatment. (new) Conclusion: We conclude that a finding is warranted based on the items noted in our condition and context sections above based on the criteria or specific requirement section above.