HRSA’s “Audit Reporting Requirement Attestations” arrived in inboxes on Friday, March 22, 2024, and require a response by Friday, April 5, 2024.  The government is under pressure to show that the money distributed under the CARES Act and the American Rescue Plan was used responsibly.  These notices are frustrating and frightening, and a two-week turnaround may seem a bit callous, but the situation could certainly be worse—the government could have simply demanded a return of the funds.  If an organization expended more than $750,000 in a single fiscal year and does not comply with the new deadlines, it is in violation of the terms and conditions and the government may request that the money be returned.

From the government’s perspective, providers and entities receiving these notices may be delinquent and in breach of the terms and conditions of the various government relief programs authorized by the CARES Act and the American Rescue Plan.  Organizations that expended $750,000 or more in a fiscal year from the Provider Relief Fund (PRF) and/or certain other federal funds were required to submit Single Audits first in 2021, but the Government gave an extension until 2022. 

What Is a Single Audit?

A Single Audit is an audit of your organization’s financial statements and compliance with federal award requirements for the distributions that your organization has received. A Single Audit is different than an annual financial audit; you will receive a separate audit opinion to submit. A Single Audit must be performed by an independent Certified Public Accountant.  The audit evaluates the controls an entity has in accounting for federal grant money.  Your auditor will look at compliance with the terms and conditions of the government grant, which may include PRF reports that were submitted with the supporting documentation or the controls around billing for uninsured patient COVID-19 testing.   

Three Scenarios

Ultimately, organizations fall into one of three scenarios:

  1. You expended less than $750,000 in funds from government sources (including PRF, FEMA, and others, but excluding PPP loans) in each fiscal year (not in aggregate). Presumably, you filled out PRF reports showing that.  You should be certain that you are correct, and you should alert HRSA that it sent the “Audit Reporting Requirement Attestation” in error.
  2. You expended $750,000 or more in funds from government sources in each fiscal year and you conducted a Single Audit. You should submit it per the instructions in the “Audit Reporting Requirement Attestation” Notice. 
  3. You expended $750,000 in funds from government sources in each fiscal year, you do not have the report, but you have engaged an independent Certified Public Accountant to conduct the Single Audit. You may submit to HRSA your engagement letter pending completion of the Single Audit report, and then submit the Single Audit report, once you have it, pursuant to the instructions in the notice.

If you fall under Scenario 3, but do not yet have an engagement letter, you should act with utmost speed to get one.  It is absolutely imperative that you submit an engagement letter to HRSA.  At this point, you have one week to engage an auditor, which is very, very little time. 

If you spent the money on COVID-related expenses, per HRSA’s terms and conditions, but are still having difficulty navigating the labyrinthine post-COVID requirements, please do not hesitate to reach out to the authors.

Back to Health Law Advisor Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.