The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), authorized more than $2 trillion in federal loans, grants, and other financial assistance focused on COVID-19 relief. The CARES Act cast a wide net, including authorizing direct cash payments to individuals, loans to small businesses, advanced payments to health care providers, health care sector relief funds, and spending flexibility to certain federal contractors.1 Receipt of CARES Act funds was not without strings attached, usually in the form of various certifications regarding eligibility and/or how the funds would be used. Those certifications can be open to interpretation and/or require compliance obligations that early signs indicate are proving difficult to meet. As a result, CARES Act recipients face False Claims Act (FCA) risk under, among others, express false or implied false certification theories. We discuss below some of these risks in various sectors of the U.S. economy.

The Paycheck Protection Program & Main Street Lending Program

The Paycheck Protection Program (PPP) is a primary CARES Act relief program. The PPP provides small businesses with loans for payroll and certain non-payroll business expenses, and offers loan forgiveness to borrowers who meet employee retention requirements and can show that the funds were used for eligible expenses during a “covered period” of up to 24 weeks from the date of loan origination (but not extending beyond December 31, 2020).2

The PPP has a number of eligibility requirements regarding the type of organization that can apply.3 Borrowers must make numerous certifications, including that the “uncertainty of current economic conditions” makes the loans “necessary” to support “ongoing operations,” representations that the costs covered by the loan are eligible payroll and non-payroll costs, and that the borrower does not have other pending PPP loans, or has not received duplicative PPP loans. There is also a detailed loan necessity questionnaire for loans of more than $2 million, the accuracy of which must be certified. Finally, there are certifications required for loan forgiveness requests and lenders may also face FCA risk on the basis that they were reckless in making loans4 to businesses that they knew or should have known were ineligible or unduly risky recipients. 

If accurate, public reporting has already identified numerous types of PPP loans that could be subject to FCA enforcement, ranging from borrowers who received funds for businesses that were purportedly not in existence and operating as of February 15, 2020 (the date at which eligible small businesses must have been operating), to those who inflated payroll costs or used loan funds to pay personal and non-business expenses.

The Main Street Lending Program is another form of CARES Act support with FCA risk. Here, borrowers certify that the loan is “necessary,” that the borrower will “make reasonable efforts to maintain” payroll and retain employees, and that the funds will not be used to repay other loans. There are additional requirements for borrowers with 500-10,000 employees, including requirements regarding not offshoring or outsourcing jobs. Lenders also make certifications under this program, including that the funds will not be used to address prior loans from the lender to the borrower.

Public Health and Social Services Emergency Fund

The CARES Act and related legislation also appropriated funds to reimburse eligible health care providers for health care-related expenses or lost revenues attributable to COVID-19 through the HHS-administered Provider Relief Fund (PRF).

All facilities and providers that received Medicare fee-for-service (FFS) reimbursements in 2019 are eligible for PRF funds as long as they continued providing medical services after January 31, 2020, and have not had Medicare billing privileges revoked.5 Providers that ceased operation as a result of COVID-19 are still eligible to receive PRF funds if they provide proof of diagnoses, testing, or care for individuals with possible or actual cases of COVID-19.

Under Phase 1, all eligible providers automatically received PRF funds, which meant that rejecting CARES Act funding required affirmatively returning the funds to HHS. The funds were deemed accepted through an attestation or non-action after 90 days. HHS created an application and attestation portal through which eligible providers could confirm they will comply with all terms and conditions of PRF, which included representations that the provider: 6

  • Provided diagnosis, testing, or care for actual or possible COVID-19 patients on or after January 31, 2020. For purposes of this requirement, HHS broadly views every patient as a possible case of COVID-19.
  • Will use the payment to prevent, prepare for, and respond to coronavirus,and reimburse health care-related expenses or lost revenues attributable to coronavirus. Certain types of health care-related expenses cannot be paid using these funds (e.g. executive compensation). These expenses or lost revenues must exceed the total payments received under PRF. Lost revenues cannot exceed the difference of 2019 and 2020 actual patient care revenues.
  • Will not use the payment for expenses or losses that have been or will be reimbursed from other sources (e.g., payments cannot be used for expenses otherwise reimbursable through Medicare).
  • Consent to public disclosure of the payment.

Providers receiving more than $10,000 of PRF funds will be required to report the use of these funds by February 15, 2021 or July 31, 2021 (for providers that did not expend all funds prior to December 31, 2020).7 Providers receiving $500,000 or more will be required to complete more detailed reports. HHS has stated that PRF recipients providing inaccurate information will be subject to payment recoupment and other legal actions, presumably including FCA claims through false or implied certification theories.

Section 3610 of the CARES Act

For government contractors, Section 3610 of the CARES Act allows federal agencies, at their discretion, to modify the terms of existing contracts or other agreements to reimburse any paid leave, including sick leave, which a contractor provides to keep its employees in a ready state.9 Each agency can issue its own guidance regarding what certifications are required and what costs can be billed.

In general, eligible contractors are those with employees who cannot perform work on a government-owned, government-leased, contractor-owned, or contractor-leased facility or site due to closure or other restrictions related to COVID-19. Additionally, these contractors’ employees must also be unable to telework because their duties cannot be performed remotely.

As a representative example, the Department of Defense (DoD) issued a new cost principle, DFARS 231.205-79, under which contractors can only seek reimbursements if they make the following representations, among others:

  • The contractor can support all claimed costs with appropriate documentation.
  • The contractor identifies other relief funds claimed or received related to COVID-19 (e.g., PPP loans).
  • The contractor affirms it has not and will not pursue reimbursement elsewhere for the same costs accounted for under their Section 3610 request.

FCA risk under Section 3610 may arise due to the prohibition on double payments to cover the same costs and ambiguous documentation requirements. For example, what sort of documentation supports an inability to work remotely? Likewise, DoD requires that the government receive a credit or reduction in billing for any PPP loans or loan payments that are forgiven if PPP credits are allocable as costs allowed under a contract.

Looking ahead

There was significant FCA enforcement activity after the 2008 financial crisis and its associated relief efforts and we may well see a similar uptick in FCA activity in 2021 related to CARES Act funding. The CARES Act itself was a hastily written statute that lacks clarity with respect to its requirements. In addition, the need to distribute funds quickly meant that agencies had little time to offer guidance. When they did so, it often took the form of FAQs or other similar informal sub-regulatory guidance. While the climate in which CARES Act funds were dispersed created risk, it may also contribute to defenses of FCA claims. For example, CARES Act certifications may in some cases be sufficiently ambiguous so as to undermine efforts to establish scienter. Similarly, guidance evolved over time and that fluidity alone may give rise to defenses. In some areas, defendants may try to advance a public disclosure bar defense based on databases offering detailed information about CARES Act funding recipients. Ultimately, while we can expect to see CARES Act-related FCA activity, the statute and its implementing guidance can be expected to offer several avenues of defense.


1. Public Law No. 116-136. 
2. U.S. Small Business Administration, Paycheck Protection Program, (last visited Nov. 18, 2020).
3. See 15 U.S.C. §636(a)(36)(D)(i); 13 C.F.R. § 121.301(a)(2).
4. See 15 U.S.C. §636(a)(36)(G)(i); 13 C.F.R. § 121.301(a)(2).
5. U.S. Dep’t of Health and Human Servs., CARES Act Provider Relief Fund: For Providers, (last visited Nov. 20, 2020).
6. Full list of terms and conditions for each type of payment under PRF is available on the HHS website. See U.S. Dep’t of Health and Human Servs., CARES Act Provider Relief Fund: For Providers, Terms and Conditions, (last visited Nov. 20, 2020).
7. See U.S. Dep’t of Health and Human Servs., Reporting Requirement and Auditing, (last visited Nov. 20, 2020).
8. See U.S. Dep’t of Health and Human Servs., Reporting Requirement and Auditing, (last visited Nov. 20, 2020).
9. See Public Law 116–136, div. A, title III, §3610.