Understanding the 340B Audit Process

December 2016 - Vol.13 No. 12 - Page #2
Category: 340B Software

Q&A with Maureen Testoni, JD, and Amanda Nagrotsky, JD
340B Health

Pharmacy Purchasing & Products (PP&P): How are covered entities notified of an impending audit?

Maureen Testoni & Amanda Nagrotsky: The audit process is initiated when the Health Resources & Services Administration (HRSA) sends an engagement letter notifying a covered entity of its selection for a 340B audit. HRSA typically contacts the covered entity within 1-2 weeks of the audit notice to coordinate the date of the audit and review other details. Shortly thereafter, HRSA sends a data request to the covered entity describing information that must be provided to the auditor(s).

Data requests typically seek the following information, although these are just some of the elements that may comprise a data request:

  • All 340B prescriptions and related information over a six-month time frame
  • Beginning and ending inventory balances for the same period
  • A schedule of 340B purchases
  • A list of the covered entity’s participating locations
  • A list of the covered entity’s physicians eligible to dispense and write 340B prescriptions
  • Medicare cost report documentation
  • 340B policies and procedures

In addition to HRSA, the 340B statute gives 340B manufacturers the authority to audit covered entities. However, the audit authority of a manufacturer is narrower than that of HRSA. Manufacturers are permitted to audit the records of a 340B covered entity pertaining to the entity’s compliance with the statutory prohibitions against duplicate discounts and diversion of 340B drugs. If a manufacturer has a concern related to a covered entity’s compliance with 340B, the manufacturer must notify the covered entity of its concern and work in good faith with the entity to resolve the issue. If the matter is not resolved, the manufacturer may audit the covered entity, but before doing so, it must demonstrate that it has reasonable cause to conduct the audit and outline such cause in an audit work plan, which must be submitted to HRSA for approval.

PP&P: What issues can trigger a HRSA audit?

Testoni & Nagrotsky: HRSA chooses entities for audit by identifying those they believe most likely to be at risk for a compliance issue. Risk determination is based on purchasing volume, complexity of program administration, the number of contract pharmacies, and the number of outpatient facilities. HRSA also conducts targeted audits based on allegations of 340B violations.

PP&P: How regularly should an entity expect to be audited?

Testoni & Nagrotsky: This varies based on the covered entity—those that have been required to make repayments as a result of a previous HRSA audit are subject to another audit after one year, and we have begun to see re-audits of hospitals.

PP&P: What trends are unfolding in audits of late?

Testoni & Nagrotsky: Recent audits have focused on a variety of key areas of 340B program compliance, with an emphasis on compliance with the statutory prohibitions against diversion and duplicate discounts.

In this context, diversion is the act of providing a 340B drug to an ineligible patient (note that HRSA issued patient definition guidelines in 1996 that describe patient eligibility for receiving 340B drugs). HRSA audits have clarified that prescriptions should be written by providers that are employed by, or under a contractual or other arrangement with, the covered entity and at sites that are reimbursable on the covered entity’s cost report. HRSA auditors look for evidence that the hospital had responsibility for either the care that led to the prescription (eg, the script was written as a result of a service received at the hospital) or for the administration of a drug (eg, infusions).

Federal law protects manufacturers from having to provide a 340B discount and a Medicaid rebate on the same drug (ie, duplicate discount). Covered entities must inform the Office of Pharmacy Affairs (OPA) whether its sites will be using 340B drugs for Medicaid Fee-for-Service (FFS) patients (ie, carving in) or whether non-340B drugs will be used for those patients (ie, carving out) and provide OPA with the billing number(s) used for those sites that carve in. OPA lists those billing numbers on the Medicaid Exclusion File, which state Medicaid agencies then use to identify claims to exclude from rebate requests to manufacturers. Recently, duplicate discount audit findings have occurred whereby 340B drugs are used for out-of-state Medicaid patients. If a covered entity uses 340B for out-of-state Medicaid patients and bills for those services, all state-assigned billing numbers must be listed on the Medicaid Exclusion File so states are aware that rebates are not to be collected on those claims.

The following are other key areas of audit focus:

  • For virtual inventory systems in mixed-use settings, drugs must be replenished based on their 11-digit National Drug Code (NDC).
  • For disproportionate share, children’s, and cancer hospitals only, covered outpatient drugs cannot be obtained through a group purchasing organization (GPO) or other group purchasing arrangement.
  • The hospital information in OPA’s database must be correct (eg, confirm the hospital address, contact information, etc).
  • Hospitals must maintain active oversight of contract pharmacies; this can include an annual independent audit (preferred by HRSA) or another regular oversight process, such as self-auditing of 340B claims.

PP&P: Should adverse findings be substantiated, what is typically required in a corrective action plan?

Testoni & Nagrotsky: Hospitals that have received an audit finding from HRSA must submit a corrective action plan (CAP) for HRSA’s approval. The CAP must describe how the problem has been fixed and identify the process that the covered entity will use to ensure the problem will not recur (eg, internal or independent audit process, quarterly review of database information, etc). The CAP also must identify the implementation date, the individual responsible for implementation, and the education strategy addressing 340B program compliance.

Some audit findings may require the covered entity to repay manufacturers, if diversion, duplicate discount, and/or GPO violations are discovered. The covered entity is responsible for identifying all affected manufacturers and must notify each of program violations and discuss methods of repayment.

PP&P: What recourse does the covered entity have to dispute findings or fines?

Testoni & Nagrotsky: HRSA typically issues a final audit report (FAR) 3-12 months after the audit. If the FAR contains an adverse finding(s), the covered entity may accept HRSA’s finding(s) or submit a Notice of Disagreement within 30 days explaining why the entity disagrees and include any relevant evidence to support that position. Should the covered entity’s appeal ultimately be unsuccessful, a CAP must be filed. Once the covered entity accepts HRSA’s findings and does not appeal, it has 60 days from receipt of the FAR to submit a CAP. If the entity fails to submit a CAP, it may be removed from the 340B program.

Hospitals that wish to contest audit findings should consult with their legal counsel. We also encourage our 340B Health member hospitals to confer with us regarding their audits. Given our experience working with dozens of hospitals that have been audited, 340B Health can provide insight into the types of findings that are likely to be overturned, as well as which findings are less likely to be successfully appealed. We also are able to connect member hospitals with entities that have received and challenged similar findings, which has proved helpful.

PP&P: What is the current status of the so-called mega-guidance?

Testoni & Nagrotsky: As of November 30, 2016, HRSA has yet to publish a final version of its 340B program omnibus guidance (also referred to as the mega-guidance). HRSA published this proposed guidance in August 2016 and received over 1,200 comments from program stakeholders, nearly 800 of which were from hospitals. The proposed guidance, if implemented, would affect various aspects of the 340B program. Of particular concern to 340B hospitals are the following proposed changes:

  • Prescriptions given to patients upon discharge from a hospital would be ineligible for 340B discounts. This would be a major departure from how 340B has always functioned; it would eliminate an important tool in preventing hospital readmissions and undermine the ability of safety net hospitals to treat uninsured and underinsured patients.
  • Cancer drug prescriptions written outside of the hospital would be ineligible for 340B. This new interpretation of the 340B patient definition would penalize hospitals when patients consult outside experts for diagnoses and treatment plans and then return to their local hospital for drug administration—a practice particularly common at rural hospitals that may not have an oncologist on staff.
  • 340B discounts could no longer be used for outpatients later admitted to the hospital. This proposal would disallow certain outpatient drugs provided in the emergency room from 340B discounts, including lifesaving medicines administered to stroke patients upon arrival in the emergency room prior to being admitted.

PP&P: Are there additional 340B policy changes on the horizon that will impact program compliance efforts?

Testoni & Nagrotsky: In addition to the mega-guidance, HRSA recently proposed two regulations that would implement provisions added to the 340B statute in 2010.1 In August 2016, HRSA proposed a rule to create a binding administrative dispute resolution (ADR) process for the 340B program.2 HRSA proposes to use this process to address and resolve two scenarios: first, for covered entities’ claims that a manufacturer overcharged for a covered outpatient drug, and second, for manufacturers’ claims that after an audit of a covered entity, it was determined the entity committed diversion or violated the duplicate discount provision.

HRSA also proposed a rule regarding 340B ceiling price calculations and civil monetary penalties for manufacturers that knowingly and intentionally overcharge covered entities. HRSA sent the final rule to the Office of Management and Budget (OMB) in late October 2016. It remains to be seen when HRSA will publish these rules in final form in the Federal Register.


  1. HHS Releases 340B Manufacturer Civil Monetary Penalty Proposed Rule. 340B Informed website. June 16, 2015. http://340binformed.org/2015/06/hhs-releases-340b-manufacturer-civil-monetary-penalty-proposed-rule/
    Accessed 12.1.16
  2. HRSA Releases 340B Dispute Resolution Proposed Rule. 340B Informed website. August 11, 2016. http://340binformed.org/2016/08/hrsa-releases-340b-dispute-resolution-proposed-rule/
    Accessed 12.1.16

Maureen Testoni, JD, is General Counsel and Senior Vice President of 340B Health, a non-profit organization of more than 1,200 hospitals and health systems enrolled in the 340B program. She oversees a team of attorneys and government relations staff that work to influence law and policy regarding the 340B program. Maureen provides assistance to hospitals on 340B implementation, program compliance, and policy guidance. She received her JD with honors from The George Washington University National Law Center and her BA in public policy from the University of Chicago. She is a member of the Washington D.C. and Virginia bars.

Amanda Nagrotsky, JD, is the Assistant Counsel at 340B Health and educates member hospitals on 340B program implementation, compliance, and developments. Amanda received her JD with honors from the George Washington University Law School and her bachelor’s degree with high distinction from the University of Michigan. She is a member of the New York and Virginia bars.


Like what you've read? Please log in or create a free account to enjoy more of what www.pppmag.com has to offer.

Current Issue