chevron-down Created with Sketch Beta.
August 24, 2022

CARES Act Update

Government Audits, Administrative Litigation, Enforcement

Morgan Nighan, Harsh Parikh and Kierstan Schultz

As the COVID-19 pandemic gripped the country in the spring of 2020, Congress passed historical bipartisan legislation, including the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), and later passed subsequent legislation, which together provided trillions of dollars to the healthcare industry. The federal support came in the form of grants, low-interest forgivable loans, and tax credits through programs like the Provider Relief Fund (PRF), Paycheck Protection Program (PPP), Employee Retention Credit, and Economic Injury Disaster Loan (EIDL). These funds financially supported healthcare providers and other businesses adversely impacted by the coronavirus pandemic. The funds from these programs were allocated at the federal level through government agencies including the Department of Health and Human Services (HHS), the Health Resources & Services Administration (HRSA), and the Small Business Administration (SBA), and at the state level through various state agencies.

Now, over two years since the distribution first began, the healthcare industry continues to grapple with how government agencies are administering these pandemic relief programs. PPP funds have been completely exhausted for some time, and PRF funds are nearly depleted as well. These programs are now in the audit and enforcement phases, and the government’s approach is beginning to materialize. For example, as of March 10, 2022, the Department of Justice’s (DOJ) criminal and civil enforcement efforts to combat COVID-19-related fraud have “resulted in criminal charges against over 1,000 defendants with alleged losses exceeding $1.1 billion; the seizure of over $1 billion in [EIDL] proceeds; and over 240 civil investigations into more than 1,800 individuals and entities for alleged misconduct in connection with pandemic relief loans totaling more than $6 billion.” Over the rest of 2022 and 2023, observers expect that recipients of pandemic stimulus funds will be audited for compliance, will engage in administrative challenges, and/or will be targeted by whistleblower or government-led enforcement actions. This article will focus on the two federal programs that constitute the lion’s share of pandemic relief in healthcare: PRF and PPP.

Provider Relief Fund (PRF)

The federal government authorized unprecedented amounts of funding through PRF in record time due to the emergency situation caused by the pandemic. But the quick distribution of funds meant that guidelines continued to shift and evolve, especially with regard to a PRF recipient’s reporting obligations. The breadth and alacrity of the PRF’s rollout, combined with HHS’s and HRSA’s subsequent narrowing of statutory interpretations and imposition of reporting methodologies, have likely contributed to relatively high rates of noncompliance on the part of PRF fund recipients.

PRF Terms and Conditions and Reporting Obligations

The Terms and Conditions that PRF recipients were required to sign (or were “deemed” to have signed) placed restrictions on fund eligibility and use. Among other conditions (including establishing that services were provided after January 1, 2020), each PRF recipient had to substantiate that the PRF funds were “used for healthcare-related expenses or lost revenues attributable to coronavirus and that those expenses or losses were not reimbursed from other sources and other sources were not obligated to reimburse them.” Funding recipients must adhere to reporting obligations through the PRF Reporting Portal detailing the use of funds received through PRF.

Importantly, providers must comply with these reporting obligations, or they will be asked to return the funds. Recently, HRSA sent notices to all providers it considered non-compliant with reporting obligations thus far, affirming its intent to enforce its strict reporting policies. Roughly 10,000 recipients of the PRF were asked to return anywhere from $30,000 to $250,000 each by April 10, 2022. It is expected that many more providers may be asked to return funds for failure to comply with the terms and conditions, including reporting obligations, in the coming months.

The American Medical Association (AMA) estimates that as many as 16,000 physicians may have missed their reporting deadlines. The AMA characterized these non-reporters as “primarily small and rural providers who are overwhelmed and have not received sufficient communications about the reporting requirements.” Recoupment of funds from these small and rural providers could have disastrous economic consequences. A nationwide survey commissioned by the AMA showed that 81 percent of physicians surveyed said “revenue was still lower than pre-pandemic and the average drop in revenue was 32 percent,” while the average increase in personal protective equipment spending was 57 percent. Thus, recoupment of PRF funds could have stark economic consequences for some providers who continue to struggle financially due to the pandemic.

PRF Audits and Oversight 

For PRF recipients, audit and enforcement are still in the early phases. According to the latest HRSA data issued in August 2021, agency documentation identified $356.4 million in payment discrepancies for potential recovery, but action to recover those funds had not yet been taken as of that time. Industry observers expect increased activity on these fronts in the second half of 2022 and the first half of 2023.

HRSA’s planned oversight for the PRF includes:

  • post-payment analysis and reviews to determine whether HRSA made PRF payments to eligible providers in the correct amounts,
  • audits to determine whether PRF funds were used by providers in accordance with laws and agency guidance, and
  • recovery of overpayments, unused payments, and payments not properly used.

The focus of government review will likely be to determine whether (1) PRF payments were correctly calculated for providers that applied for these payments, (2) the payments were used to cover eligible expenses or lost revenues attributable to the COVID-19 pandemic, (3) such uses of PRF funds were supported by appropriate and reasonable documentation, and (4) the PRF payments were made to eligible providers, in accordance with the Terms and Conditions of the PRF payments. HHS’ Office of Inspector General (OIG) is working on generating an audit report focusing on the distribution of $50 billion in PRF payments that is anticipated to be made available later in 2022.

The U.S. Government Accountability Office (GAO) also reviewed the PRF distributions and made several oversight recommendations. According to the GAO report, there is a plan for the recovery of overpayments, unused payments, and payments not properly used. HRSA officials notified the GAO in August 2021 that the agency was in the process of recovering funds for 10 of the 54 identified categories of payment discrepancies. In September 2021, HRSA reported to the GAO that, to more efficiently identify and recover overpayments, it would offset or reduce future PRF payments to be made later in 2021 by any identified overpayment amount.

Starting in April 2020, HRSA began to distribute funds to providers via multiple phases of general allocation funding and several targeted allocations. Most recently, applications for Phase 4 distributions opened in September 2021, and related payments began in December 2021. Phase 4 of PRF distribution is nearly complete, and PRF funds are nearly exhausted. Phase 1 recipients were initially required to report on their use of PRF funds by September 30, 2021, but the government offered a 90-day grace period due to many outstanding provider questions and reporting portal problems. Phase 2 reporting closed on March 31, 2022. Phase 3 reporting opened on July 1, 2022, and Phase 4 reporting opens on January 1, 2023.

This reporting schedule means that HRSA is still in the process of reviewing provider compliance reporting for Phases 1 and 2, and many providers have yet to report on their use of PRF funds. During these early stages, HRSA has issued almost no adverse decisions on the use of PRF funds, and has referred very few fraud cases to the DOJ alleging misuse of those funds. Enforcement is expected to pick up heartily in the coming months as HRSA reviews incoming reporting data, issues use-of-funds decisions, and makes referrals to the DOJ for civil or criminal enforcement. Finally, many organizations that have received $750,000 in PRF monies may be subject to auditing regulations promulgated by the Office of Management and Budget, including the requirement to conduct a “single audit” by an independent auditor.

PRF Administrative Challenges

It is important to recognize that there are few established avenues for formal administrative appeals in the PRF program. The notable exception is a reconsideration process made available to challenge PRF Phase 4 distributions. Recipients may be able to pursue legal challenges or seek judicial review under either the Social Security Act or the Administrative Procedure Act (APA). Any PRF recipient who receives an adverse determination from HRSA should consult counsel regarding these relief options. However, once PRF funds are exhausted, any APA challenges regarding those funds may be moot.

PRF Criminal Enforcement Efforts

Fraud prosecutions regarding PRF remain rare. According to the DOJ, as of April 20, 2022, a total of “10 defendants have been charged with crimes related to misappropriating PRF monies intended for frontline medical providers and three have pleaded guilty.” The prosecutions that have occurred to date concerned egregious conduct, not good-faith error or inadvertent oversight.

By way of example, in early 2022, Raymond Earl Vallier was indicted with theft of government property and aggravated identity theft in connection with a scheme to unlawfully convert CARES Act PRF monies. Vallier was the former owner and operator of North Delta Hospice and Palliative Services LLC, a hospice care center, which, on April 10, 2020, received $107,568.03 from the PRF. However, North Delta Hospice had ceased seeing patients and billing Medicare and Medicaid months earlier, by the end of September 2019. According to the indictment, rather than returning the PRF funds deposited, as North Delta Hospice did not qualify for receipt of those funds, the defendant used the name of a deceased person who owned  North Delta Hospice prior to Vallier to falsely attest to the terms and conditions of the PRF — claiming that the funds would be used for expenses related to the treatment of COVID-19 patients — and wrote a check to himself and made a payment on one of his other company’s credit card accounts with the funds.

Criminal enforcement actions regarding PRF are expected to pick up once payments for potential recoveries are identified through government audits. Pre-pandemic, the federal government had increased its emphasis on the enforcement of laws relating to healthcare fraud and abuse. This momentum has continued, and all federal and state pandemic relief funding recipients remain vulnerable to claims brought pursuant to the False Claims Act (FCA) or its state law counterparts — including whistleblower claims — which carry the potential for treble damages. The FCA’s qui tam provisions permit private citizens to sue as “relators” on behalf of the United States to recover public funds allegedly obtained through fraud. The government investigates the relator’s allegations as the complaint remains under seal and, eventually, elects whether to intervene or decline. Even if the government declines, the relator may continue to prosecute the case on the government’s behalf subject to certain restrictions. In either event, the relator may be awarded up to 30 percent of any recovery.

Paycheck Protection Program (PPP)

The Paycheck Protection Program provided low-interest loans to small businesses affected by the pandemic through the SBA. The PPP loans are subject to full forgiveness if the borrower complies with the program’s requirements and spends the funds on allowable purposes, which primarily include payroll costs and operating expenses such as rent and utilities. Importantly, eligible recipients may receive both PPP loans and PRF grants, but must not use such funds to cover the same expense.

For PPP, most successful recipients have already received and spent their funds and applied for loan forgiveness, and are either awaiting a forgiveness decision or have already received forgiveness. This is a critical juncture where borrowers should take care to monitor for any communications from either the SBA or their lender about their loan.

SBA Review of Borrower Eligibility and Administrative Challenges

To ensure that borrowers received their funds quickly, the SBA relied upon borrower certification of eligibility, and did not make an eligibility determination upfront. Now, the SBA is retroactively reviewing borrower eligibility. Typically, if the SBA is considering issuing an adverse decision to a borrower, the SBA will send a request for follow-up information to the borrower or the borrower’s lender. This gives the borrower a critical opportunity to provide the SBA with additional information supporting its application. PPP recipients should take care to monitor for and respond to any inquiries from their lender, the SBA, or any other government agency regarding their PPP loan.

Recently, the SBA has begun issuing decisions finding borrowers retroactively ineligible for a PPP loan they have already received and spent, or ineligible for loan forgiveness. Importantly, under these circumstances, time is of the essence: a borrower only has 30 calendar days to file an appeal with the SBA’s Office of Hearings and Appeals following an adverse decision. After exhausting administrative appeals, a borrower can opt to seek judicial review of the SBA’s determination from a federal district court pursuant to the APA. PPP eligibility issues have been hotly contested in litigation throughout the country and, depending on loan size, borrowers may benefit from presenting meritorious arguments for judicial review.

PPP Criminal and FCA Enforcement Efforts

Even those borrowers who have succeeded in achieving loan forgiveness from the SBA are not out of the woods yet: there is a six-year statute of limitations during which the government could bring a fraud action, even for already forgiven loans, and, as discussed below, whistleblower actions remain a threat. All borrowers, even those who receive forgiveness, are required to retain their PPP loan records for six years.

PPP fraud cases target a range of misconduct, from individual business owners who have inflated their payroll expenses to obtain larger loans than they otherwise would have qualified for, to serial fraudsters who revived dormant corporations and purchased shell companies with no actual operations to apply for multiple loans falsely stating they had significant payroll, to organized criminal networks submitting identical loan applications and supporting documents under the names of different companies. Most charged defendants had misappropriated loan proceeds for prohibited purposes, such as the purchase of houses, cars, jewelry, and other luxury items.

The majority of PPP fraud cases brought to date have involved egregious conduct. For example, in United States v. Sah, the defendant applied for 15 different PPP loans to eight different lenders, using 11 different companies, seeking a total of $24.8 million. The defendant obtained approximately $17.3 million and used the proceeds to purchase multiple homes, jewelry, and luxury vehicles. In another case, United States v. Ayvazyan, eight defendants applied for 142 PPP and EIDL loans seeking over $21 million using stolen and fictitious identities and sham companies, and laundered the proceeds through a web of bank accounts to purchase real estate, securities, and jewelry.

It is worth noting that the government may use a PPP violation as a tag-along claim to any other criminal violation. Every PPP borrower certified that it was not engaged in unlawful activity in order to obtain a PPP loan. Thus, if the borrower is later convicted of a crime that was ongoing at the time it made its certification, it could be hit with a separate criminal charge on the false PPP certification.

For example, Physician Partners of America LLC (PPOA), in Tampa, Florida, agreed to pay $24.5 million to resolve allegations that it violated the FCA by billing federal healthcare programs for unnecessary medical testing and services, paying unlawful remuneration to its physician employees, and making a false statement in connection with its PPP loan. Specifically, after Florida suspended all non-emergency medical procedures to reduce transmission of COVID-19 in March 2020, PPOA allegedly sought to compensate for lost revenue by requiring its physician employees to schedule unnecessary evaluation and management (E/M) appointments with patients every 14 days, instead of every month as had been PPOA’s prior practice. PPOA then instructed its physicians to bill these E/M visits using inappropriate high-level procedure codes. The United States alleged that at the same time PPOA was engaged in this unlawful overbilling, PPOA falsely represented to the SBA that it was not engaged in unlawful activity in order to obtain a $5.9 million PPP loan.

The government will likely rely heavily on whistleblowers with insider company knowledge to help identify fraud cases. The first settlement of a qui tam, or whistleblower-initiated, action arising out of PPP was announced in August 2021. Because whistleblower cases remain sealed for months or even years while the government investigates, many more cases filed earlier in the pandemic may come to light in 2022. Moreover, whistleblowers are often disgruntled former employees. Given the volatile labor market and the strong financial incentives whistleblowers enjoy, it can be presumed that some pandemic-era employment separations have resulted in whistleblower claims.


The government is increasingly investigating providers and others who it suspects may have inappropriately received or used CARES Act funds. Any pandemic relief recipients and their counsel should immediately suspect an investigation or enforcement action if they receive a civil investigative demand, subpoena, or similar request from the federal or state government.

    Morgan Nighan, Esq.

    Nixon Peabody, Boston, MA

    Morgan Nighan, a Partner in Nixon Peabody’s Litigation department in the Boston office, leads the firm’s Healthcare Dispute Resolution Team. She advises healthcare clients on pre-litigation compliance counseling, dispute resolution, litigation, government investigations, and corporate restructurings across the country. As a member of the COVID-19 Client Response Team, she has counseled hundreds of companies on compliance with the Coronavirus Aid, Relief, and Economic Security (CARES) Act, Economic Aid Act, and American Rescue Plan programs, including the Paycheck Protection Program (PPP) and the Provider Relief Fund (PRF). Ms. Nighan has been recognized as a Massachusetts Rising Star in the New England Super Lawyers Magazine since 2018, as well as Boston Magazine’s “Top Women Attorneys in Massachusetts.”  She may be reached at (617) 345-1031 and [email protected].

    Harsh Parikh, Esq.

    Nixon Peabody, Los Angeles, CA

    Harsh P. Parikh, a Partner in Nixon Peabody’s Los Angeles office, works with managed care organizations, hospital systems, life sciences companies, and other healthcare providers on a wide range of regulatory, reimbursement, and transactional matters. With extensive experience in corporate boardrooms, courtrooms, and before administrative agencies across the United States, Mr. Parikh guides public and private organizations on a variety of business arrangements with health plans, physicians, behavioral health providers, hospitals, hospices, nursing facilities, and drug and device manufacturers. His practice encompasses federal and California fraud and abuse compliance, licenses and permits, Medicare and Medicaid (Medi-Cal) participation and reimbursement, False Claims Act internal and government investigations, and enforcement actions. Mr. Parikh also advises clients on health information technology, bioethics, privacy, security compliance, digital health, and telemedicine matters. He has been recognized in Best Lawyers: Ones to Watch for Health Care Law from 2021-2022, and as a Southern California Super Lawyers Rising Star since 2018. He received the Emerging Lawyers in Healthcare Award from the American Bar Association in 2019.  He may be reached at (213) 629-6108 and [email protected].

    Kierstan Schultz, Esq.

    Nixon Peabody, Manchester, NH

    Kierstan Schultz, a litigator in Nixon Peabody’s Manchester office, was recently promoted to Counsel. She represents healthcare providers, businesses, and individuals, and manages discovery, motion practice and trials for complex commercial litigation matters. Her healthcare litigation practice focuses on advising hospitals, rehabilitation and long-term care providers, digital health entities, practice groups and individual practitioners in complex commercial and regulatory disputes, involving HIPAA privacy and security laws and regulations, fraud and abuse laws, licensing, billing, and reimbursement. Her commercial litigation practice focuses on representing financial institutions, corporate entities and individuals across the economic spectrum, as both plaintiffs and defendants, in disputes before state and federal courts and in alternative forums. She also engages in social impact litigation and related pro bono services to effect social change and to improve the lives of individuals in need. Ms. Schultz was selected for inclusion in The Best Lawyers in America® 2022 in the field of Commercial Litigation and has been recognized  for Commercial Litigation and Health Care Law. She may be reached at (603) 628-4031 and [email protected].  

    The material in all ABA publications is copyrighted and may be reprinted by permission only. Request reprint permission here.