Drug Discount Program: Federal Oversight of Compliance at 340B Contract Pharmacies Needs Improvement

Covered entities can provide 340B drugs to eligible patients and generate revenue by receiving reimbursement from patients' insurance. The number of pharmacies covered entities have contracted with has increased from about 1,300 in 2010 to nearly 20,000 in 2017. GAO was asked to provide information on the use of contract pharmacies. Among other things, this report: 1) describes financial arrangements selected covered entities have with contract pharmacies; 2) describes the extent that selected covered entities provide discounts on 340B drugs dispensed by contract pharmacies to low-income, uninsured patients; and 3) examines HRSA's efforts to ensure compliance with 340B Program requirements at contract pharmacies. GAO selected and reviewed a nongeneralizable sample of 30 contracts between covered entities and pharmacies, 20 HRSA audit files, and 55 covered entities to obtain variation in the types of entities and other factors. GAO also interviewed officials from HRSA and 10 covered entities.

The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies—contract pharmacies—to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription.

Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis.

GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as:

HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care.

HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance.

HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements.

Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements.

GAO is making seven recommendations, including that HRSA's audits assess for duplicate discounts in Medicaid managed care, and HRSA require information on how entities determined the scope of noncompliance and evidence of corrective action prior to closing audits. HHS agreed with four of the recommendations, but disagreed with three recommendations, which GAO continues to believe are warranted to improve HRSA's oversight as explained in the report.

The 340B Drug Pricing Program (340B Program), named for the statutory  provision authorizing it in the Public Health Service Act, requires drug  manufacturers to sell outpatient drugs at discounted prices to covered  entities—certain hospitals and recipients of federal grants—to have their  drugs covered by Medicaid. According to the Health Resources and  Services Administration (HRSA), the agency within the Department of  Health and Human Services (HHS) responsible for administering and  overseeing the 340B Program, the purpose of the 340B Program is to  enable covered entities to stretch scarce federal resources to reach more  eligible patients and provide more comprehensive services. In 2017,  there were more than 12,000 covered entities and more than 38,000 total  sites participating in the 340B Program.

Participation in the 340B Program is voluntary for both covered entities  and drug manufacturers, but there are strong incentives to participate.  Covered entities can realize substantial savings through 340B price  discounts—an estimated 20 to 50 percent of the cost of the drugs,  according to HRSA. In addition, covered entities can generate revenue as  they can purchase 340B drugs for eligible patients whose insurance  reimbursement exceeds the 340B price paid for the drugs. The statute  authorizing the 340B Program does not dictate how covered entities  should use this revenue or require discounts on the drugs to be passed  along to patients. Incentives for participation by drug manufacturers are  strong because they must participate in the 340B Program to receive  Medicaid reimbursement for their drugs.

A covered entity typically purchases and dispenses 340B drugs through  pharmacies—either through an in-house pharmacy; through the use of a  contract pharmacy arrangement, in which the entity contracts with an  outside pharmacy and pays it to dispense drugs on its behalf; or both.  The adoption and use of contract pharmacies in the 340B Program is  governed by HRSA guidance, and in March 2010, HRSA issued final  guidance allowing covered entities to have an unlimited number of  contract pharmacies. Since that time, the number of contract pharmacies  has increased significantly, from about 1,300 at the beginning of 2010 to  around 20,000 in 2017.

Covered entities are required to meet certain conditions set forth both in  law and interpretive agency guidance. For example, they are prohibited  from diverting 340B drugs—that is, transferring 340B drugs to individuals  who are not eligible patients of the covered entities. They are also  prohibited from subjecting manufacturers to “duplicate discounts” in which  drugs prescribed to Medicaid beneficiaries are subject to both the 340B  price and a rebate through the Medicaid Drug Rebate Program. Covered  entities that use contract pharmacies are responsible for overseeing  those pharmacies to ensure compliance with 340B Program prohibitions  on drug diversion and duplicate discounts. Some covered entities hire  and pay a private company, referred to as a third-party administrator  (TPA), to help determine patient eligibility and manage 340B inventory as  a means to ensure compliance with 340B Program requirements at  contract pharmacies.

In a September 2011 report, we identified inadequacies in HRSA’s  oversight of the 340B Program and recommended ways for HRSA to  improve oversight and ensure appropriate use of the program. In  response, HRSA has taken action to improve its oversight of covered  entities, including implementing a systematic approach to conducting  audits of covered entities. Given the growth in the 340B Program, there  has been continued interest in program oversight, and how the increase  in contract pharmacies affects the integrity of the program. You asked us  to review the use of contract pharmacies in the 340B Program. In this  report we  1.  describe the extent to which covered entities contract with pharmacies  to distribute 340B drugs, and characteristics of these pharmacies;  2.  describe financial arrangements selected covered entities have with  contract pharmacies and TPAs related to the administration and  dispensing of 340B drugs;  3.  describe the extent to which selected covered entities provide  discounts on 340B drugs dispensed by contract pharmacies to low- income, uninsured patients; and  4.  examine HRSA’s efforts to ensure compliance with 340B Program  requirements at contract pharmacies.

To examine the extent to which covered entities contract with pharmacies  to distribute 340B drugs and the characteristics of these pharmacies, we  analyzed HRSA’s 340B Program database to identify the covered entities  registered to participate in the 340B Program and the contract  pharmacies registered to dispense 340B drugs for each entity, as of July  1, 2017—the most current data available when we began our analysis.  The pharmacy characteristics we reviewed included the type of pharmacy  and the distance between the pharmacy and the covered entities with  which it had a contract. To determine the types of pharmacies that  participated as contract pharmacies, we matched the pharmacies  included in the 340B database with data from the National Council for  Prescription Drug Programs’ DataQ—a database used by health care  payers and claims processors across the country to identify pharmacies,  which contains information reported by pharmacies on their pharmacy  type and ownership, among other items. We used the addresses  included in the 340B database to determine the location of each covered  entity, its affiliated sites, and its contract pharmacies and used this  information to determine the distance between the entity and its contract  pharmacies. We calculated the distance (in miles) from the pharmacy to  the nearest site of the covered entity. To assess the reliability of the 340B  and DataQ databases, we obtained information from officials who are  knowledgeable about them regarding steps taken to ensure the accuracy  of the information contained in each, and performed checks to identify  missing or incorrect data. Based on these steps, we determined that the  data were sufficiently reliable for the purposes of our reporting objective.

To describe financial arrangements selected covered entities have with  contract pharmacies and TPAs, we reviewed a sample of contracts  between entities and pharmacies and collected information from selected  entities and TPAs. We selected a nongeneralizable sample of 30  pharmacy contracts from among those that HRSA had collected— contracts the agency obtained during audits of covered entities from fiscal  years 2014 through 2016. We selected contracts to obtain variation in  the type of covered entity (15 hospitals and 15 federal grantees) and  geographic location. For these selected contracts, we identified the types  and amounts of fees that covered entities agreed to pay contract  pharmacies for dispensing and managing 340B prescriptions, as well as  determined factors that may have impacted the fee amounts. To describe  financial arrangements covered entities have with TPAs, beginning in  September 2017, we sent a data collection instrument—which we refer to  as a questionnaire in this report—to a nongeneralizable sample of 60  covered entities that had contract pharmacies to obtain information about  the arrangements they had with TPAs. We received responses from 55  of the covered entities—28 hospitals and 27 federal grantees. In addition,  we interviewed 10 of the 55 covered entities that responded to our  questionnaire to obtain more detailed information about the fees they pay  their TPAs. We selected covered entities to receive the questionnaire and  for interviews to achieve variation in terms of their type, geographic  location, and number of contract pharmacies. Finally, we interviewed two  TPAs to gain insights about the types of financial arrangements they have  with covered entities.

To describe the extent to which selected covered entities provide  discounts on 340B drugs dispensed by contract pharmacies to low- income, uninsured patients, we used the same questionnaire as  previously noted to collect information about any discounts provided. This  included information on the proportion of pharmacies at which discounts  on 340B drugs were available, how covered entities determined which  patients were eligible for those discounts, the prices these patients  generally paid to obtain the drugs, and how covered entities inform  patients and contract pharmacies about the availability of discounts.  Additionally, we asked officials from the 10 covered entities we  interviewed for additional information about discounts provided on 340B  drugs dispensed to low-income, uninsured patients at contract  pharmacies.

To examine HRSA’s efforts to ensure compliance with 340B Program  requirements at contract pharmacies, we reviewed relevant policies,  procedures, and guidance, including HRSA’s 2010 guidance on contract  pharmacy services and documentation of the agency’s audit procedures.  We also analyzed summaries of HRSA’s audits of covered entities for  fiscal years 2012 through 2017, posted on its website as of February 8,  2018. We conducted an in-depth review of a nongeneralizable sample  of 20 audits that were conducted from fiscal years 2014 through 2016 for  covered entities that had contract pharmacies at the time of the audit.  We selected this sample from among audits that were closed by HRSA to  obtain variation in terms of covered entity type and audit findings. We  also interviewed HRSA officials about their oversight activities, including  their audit process, and spoke with the contractor that has conducted  audits on HRSA’s behalf since fiscal year 2017. Additionally, we asked  officials from the 10 covered entities interviewed about their practices for  overseeing contract pharmacies. Finally, we evaluated HRSA’s contract  pharmacy guidance, covered entity oversight, and audit process against  federal internal control standards related to control activities, information  and communication, and monitoring.

We conducted this performance audit from January 2017 to June 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The 340B Program was created in 1992 following the enactment of the  Medicaid Drug Rebate Program and gives 340B covered entities  discounts on outpatient drugs comparable to those made available to  state Medicaid agencies. HRSA is responsible for administering and  overseeing the 340B Program.

Eligibility for the 340B Program, which is defined in the Public Health  Service Act, has expanded over time. Covered entities generally become  eligible for the 340B Program by qualifying as certain federal grantees or  as one of six specified types of hospitals. Eligible federal grantees include  federally qualified health centers (FQHCs), which provide comprehensive  community-based primary and preventive care services to medically  underserved populations, as well as certain other federal grantees, such  as family planning clinics and Ryan White HIV/AIDS program grantees.  Eligible hospitals include critical access hospitals—small, rural hospitals  with no more than 25 inpatient beds; disproportionate share hospitals— general acute care hospitals that serve a disproportionate number of low- income patients; and four other types of hospitals (see fig. 1).

Some covered entities, typically hospitals and FQHCs, have multiple  sites: the main site, which HRSA refers to as the parent site, and one or  more other associated sites referred to as child sites. Child sites can  include satellite clinics, off-site outpatient facilities, hospital departments,  and other facilities. According to HRSA officials, to participate in the 340B  Program and be considered part of the covered entity, the associated  sites must meet program requirements and be registered with HRSA as a  child site.

Program Structure, Operation, and Key Requirements

The 340B price for a drug—often referred to as the 340B ceiling price—is  based on a statutory formula and represents the highest price a  participating drug manufacturer may charge covered entities. Covered  entities must follow certain requirements as a condition of participating in  the 340B Program. For example, covered entities are prohibited from  subjecting manufacturers to “duplicate discounts” in which drugs  prescribed to Medicaid beneficiaries are subject to both the 340B  price and a rebate through the Medicaid Drug Rebate Program. diverting any drug purchased at the 340B price to an individual who is  not a patient of the covered entity. Under HRSA guidance defining this  term, diversion generally occurs when 340B drugs are given to  individuals who are not receiving health care services from covered  entities or are receiving services that are not consistent with the type  of services for which the covered entity qualified for 340B status. (See  table 1 for more information on HRSA’s definition of an eligible  patient.) Covered entities are permitted to use drugs purchased at the  340B price for all individuals who meet the 340B Program definition of  a patient regardless of their financial or insurance status.

Covered entities may choose to dispense 340B drugs they purchase  through contract pharmacies. The adoption and use of contract  pharmacies in the 340B Program is governed by HRSA guidance.  HRSA’s original guidance permitting the use of contract pharmacies  limited their use to entities that did not have in-house pharmacies and  allowed each entity to contract with only one outside pharmacy.  However, March 2010 guidance lifted the restriction on the number of  pharmacies with which a covered entity could contract. Since that time,  the number of contract pharmacies has increased more than fifteen-fold,  from about 1,300 to approximately 20,000. According to HRSA guidance,  a covered entity is required to have a written contract in place with each  pharmacy through which it intends to dispense 340B drugs, but is not  generally required to submit its pharmacy contracts to HRSA. A covered  entity that has more than one site at which it provides health care may  enter into separate pharmacy contracts for the parent site and each child  site, or one comprehensive pharmacy contract including all sites intending  to use the pharmacy. It is up to the covered entity to determine which of  its sites will be included in a contract with a pharmacy, and thus have  what is referred to as a contract pharmacy arrangement with that  pharmacy. Figure 2 provides an illustration of a covered entity that has  four contract pharmacies but a total of six contract pharmacy  arrangements, as not all of the entity’s sites have contracts with each of  the pharmacies.

Covered entities that choose to have contract pharmacies are required to  register with HRSA the names of each of the pharmacies with which they  contract. Covered entities may register their contract pharmacies in one  of two ways: 1) only in relation to the parent site (use by child sites would  be allowed as long as the sites were included in a comprehensive  contract between the entity and the contracted pharmacies); or 2)  separately for each site (parent and child) involved in a contractual  arrangement with the pharmacy. As part of this registration, HRSA  guidance specifies that covered entities must certify that they have signed  and have in effect an agreement with each contract pharmacy and have a  plan to ensure compliance with the statutory prohibitions on 340B drug  diversion and duplicate discounts at their contract pharmacies.

Like other pharmacies, when contract pharmacies fill prescriptions, they  collect payments from the patient; if the patient has health insurance, the  pharmacy will bill the insurer for the drug. In addition, each covered entity  must determine which prescriptions are for eligible patients of the entity,  and thus, can be filled with 340B drugs. One way that a covered entity  could choose to do this is to employ a TPA to review all the prescriptions  filled by a contract pharmacy to determine which, if any, prescriptions  were issued by the covered entity to an eligible patient, and thus are  eligible for the 340B discount. The covered entity then pays both the  contract pharmacy and the TPA fees that they have negotiated for their  roles in managing and distributing 340B drugs. These fees are typically  deducted from the reimbursed amounts received from patients and their  health insurers by the pharmacy and TPA, and then the balance is  forwarded to the covered entity. (See fig. 3 for an example of how  covered entities work with contract pharmacies and TPAs to dispense  340B drugs.)

In fiscal year 2012, HRSA implemented a systematic approach to  conducting audits of covered entities that is outlined on its website. HRSA  has increased the number of covered entities audited since it began  audits in fiscal year 2012, and now audits 200 entities per year. (See  table 2.) HRSA’s audits include covered entities that are randomly  selected based on risk-based criteria (approximately 90 percent of all  audits conducted each year), and covered entities that are targeted based  on information from stakeholders such as drug manufacturers (10 percent  of the audits conducted). The criteria for risk-based audits include a  covered entity’s volume of 340B drug purchases, number of contract  pharmacies, time in the 340B Program, complexity of its program, and  history of violations or allegations of noncompliance associated with  diversion and duplicate discounts.

Among other things, HRSA’s audits include reviews of each covered  entity’s policies and procedures, including those for overseeing contract  pharmacies; an assessment of the entity’s compliance with respect to  340B eligibility status, the prevention of duplicate discounts and diversion,  and other program requirements; and reviews of a sample of  prescriptions filled during a 6-month period, including prescriptions  dispensed by contract pharmacies, to identify instances of non- compliance. As a result of the audits conducted, HRSA has identified  instances of non-compliance with program requirements, including  violations related to drug diversion and the potential for duplicate  discounts. Based on the audits for which results were posted on  HRSA’s website as of February 8, 2018, 72 percent of the covered  entities audited in fiscal years 2012 through 2017 had one or more  findings of noncompliance. When an audit of a covered entity has a  finding of noncompliance, covered entities are required to submit a  corrective action plan within 60 days of the audit being finalized for HRSA  approval. HRSA closes out the audit once the entity attests that the  corrective action plan has been fully implemented and any necessary  repayments have been made to affected manufacturers.

About One-Third of Covered Entities Had One or More Contract Pharmacies, and Pharmacy Characteristics Varied

As of July 1, 2017, about one-third of the more than 12,000 covered  entities in the 340B Program had contract pharmacies, but the extent to  which covered entities had contract pharmacies varied by type of entity.  Overall, a higher percentage of hospitals (69.3 percent) had at least one  contract pharmacy compared to federal grantees (22.8 percent). Among  the six types of hospitals, the percentage that had at least one contract  pharmacy ranged from 39.2 percent of children’s hospitals to 74.1 percent  of critical access hospitals. Among the 10 types of federal grantees, the  percentage with at least one contract pharmacy ranged from 3.9 percent  of family planning clinics to 75.2 percent of FQHCs (see fig.4).

Among covered entities that had at least 1 contract pharmacy, the  number of contract pharmacies ranged from 1 to 439, with an average of  12 contract pharmacies per entity. However, the number of contract  pharmacies varied by covered entity type, with disproportionate share  hospitals having the most on average (25 contract pharmacies), and  critical access hospitals having the least (4 contract pharmacies). (See  fig. 5 for the distribution of contract pharmacies by covered entity type.)  However, we found that a covered entity that contracts with a pharmacy  may not actually use the pharmacy to dispense 340B drugs. For example,  three covered entities that received our questionnaire told us that  although they had one or more contract pharmacies registered with  HRSA, they did not use those pharmacies to dispense 340B drugs.  Moreover, officials from a covered entity we interviewed reported that  while the entity maintained a contract with a specialty pharmacy, it had  not dispensed 340B drugs through that pharmacy in several years.  Officials explained that the covered entity maintained its contract and  continued to register this pharmacy with HRSA because it would be  financially beneficial should it have a patient fill a 340B-eligible specialty  drug at this pharmacy in the future.

The actual number of 340B contract pharmacy arrangements—the  number of contractual arrangements between contract pharmacies and  the sites of a covered entity—is unknown because HRSA does not  require a covered entity to register pharmacies with each of its child sites.  Rather, HRSA gives covered entities the option to register contract  pharmacies only in relation to the parent site: child sites may use that  pharmacy if included in the written contract between the entity and the  pharmacy. Based on our analysis of HRSA data, 1,645 covered entities  that had at least one child site registered their contract pharmacies only  with their parent sites. These 1,645 covered entities had a total of 25,481  registered contract pharmacy arrangements. However, if the  pharmacies were contracted to work with all of the covered entities’  sites—the parents and all the child sites—then these 1,645 entities could  have as many as 866,388 contract pharmacy arrangements. Therefore,  the number of contract pharmacy arrangements is likely higher than what  is reported in HRSA’s database.

Nearly 93 percent of the approximately 20,000 pharmacies that 340B  covered entities contracted with as of July 1, 2017, were classified as  community/retail pharmacies, less than 1 percent were classified as  specialty pharmacies, and about 7 percent were other types of  pharmacies including institutional and mail order pharmacies.  Furthermore, the majority (75 percent) of 340B contract pharmacies were  chain pharmacies, while 20 percent were independent pharmacies and 5  percent were other pharmacies. In contrast, slightly over half of all  pharmacies nationwide are chain pharmacies and about one-third are  independent. The five biggest pharmacy chains—CVS, Walgreens,  Walmart, Rite-Aid, and Kroger—represented a combined 60 percent of  340B contract pharmacies, but only 35 percent of all pharmacies  nationwide. Figure 6 shows how the types of pharmacies varied by type  of covered entity. Critical access hospitals had a higher proportion of  independent contract pharmacies (40 percent of their pharmacies)  compared to other covered entity types (which ranged from 11 percent for  disproportionate share hospitals to 21 percent for other federal grantees).  Our analysis suggests that this is likely due, in part, to a larger proportion  of critical access hospitals compared to other types of covered entities  being located in rural areas; independent contract pharmacies are also  more likely than other contract pharmacies to be located in rural areas.

Across all covered entities, the distance between the entities and their  contract pharmacies ranged from 0 miles (meaning that the contract  pharmacy and entity were co-located) to more than 5,000 miles; the  median distance was 4.2 miles. Table 3 shows the distribution of  distances between covered entities and their pharmacies overall and by  entity type.

While there was a range in distances between covered entities and each  of their pharmacies, about half of the entities had all their contract  pharmacies located within 30 miles, but this varied by entity type.  Specifically, more than 60 percent of critical access hospitals and FQHCs  had all of their contract pharmacies within 30 miles. In contrast, 45  percent of disproportionate share hospitals had at least one pharmacy  that was more than 1,000 miles away compared to 11 percent or less for  grantees and critical access hospitals. (See fig. 7.)

Selected Covered Entities Used Various Methods to Pay Contract Pharmacies and TPAs

Contracts we reviewed between selected covered entities and contract  pharmacies showed that entities generally agreed to pay their contract  pharmacies a flat fee per 340B prescription, with some entities also  paying additional fees based on a percentage of revenue. Selected  covered entities and TPAs included in our review indicated two main  methods entities use to pay for TPA services: 1) per prescription  processed, or 2) per contract pharmacy.

Contracts Reviewed Showed Covered Entities Agreed to Pay Contract Pharmacies a Fee per 340B Prescription; Some Also Agreed to Additional Fees

Twenty-nine of the 30 contracts we reviewed between covered entities  and contract pharmacies included provisions for the entities to pay flat  fees for each eligible 340B prescription. For the remaining contract, the  covered entity and the contract pharmacy were part of the same hospital  system, and the contract provided that the entity would not pay fees for  340B prescriptions. In addition to payment of flat fees, 13 of the 29  contracts required the covered entity to pay the contract pharmacy a fee  based on a percentage of revenue generated for each 340B prescription.  Among the contracts we reviewed, more federal grantees than hospitals  had contracts that included both flat fees and fees based on the  percentage of revenue (see fig. 8).

We found a wide range in the amount of flat fees covered entities agreed  to pay pharmacies in the contracts we reviewed, though they generally  ranged from $6 to $15 per 340B prescription. (See Appendix I for a  description of fees listed in each of the contracts we reviewed.) The  amount of the flat fees per 340B prescription varied by several factors  according to our review, including covered entity type, type of drug, and  patient insurance status:

Flat fees were generally higher for hospitals than federal  grantees. In general, hospitals’ flat fees were higher than those for  grantees, with most flat fees ranging from $15 to $25 per 340B  prescription for hospitals, compared to from $6 to $13 for grantees.

Flat fees were sometimes higher for brand drugs. Three of the 29  contracts we reviewed specified different flat fees for brand and  generic drugs. In 2 of these contracts flat fees were $5 or $7 higher  for brand drugs. In the remaining contract, the fees for some brand  drugs were substantially higher, ranging from $75 to $1,750 for brand  drugs, compared to $0 for generic drugs. Additionally, some contracts  we reviewed only specified a fee for brand drugs, and 4 of the  contracts either excluded generic drugs from being purchased at the  340B price or limited the use of the 340B Program to brand drugs.

Flat fees were different or substantially higher for certain  specialty drugs. For 2 of the 29 contracts we reviewed, flat fees were  for drugs to treat hemophilia. Given the different nature of  hemophilia treatment drugs, fees for these drugs were different than  those in the other contracts for other types of drugs, and provided for  payments of $.06 and $.09 per unit of blood clotting factor.  Additionally, 2 contracts contained substantially higher flat fees for  specialty medications. In 1 contract, the flat fees were $125 per  prescription for brand and generic human immunodeficiency virus  drugs, and $1,750 for brand hepatitis C drugs. In another contract the  flat fees were $65 for all specialty drugs, compared to $13 for other  drugs.

Flat fees were sometimes higher for 340B prescriptions  dispensed to patients with insurance. Seven of the 29 contracts we  reviewed specified different flat fees for prescriptions provided to  patients with health insurance than for patients paying with cash or  through a drug discount card provided by the covered entity. The flat  fees entities would pay under these contracts ranged from $1 to $16  higher per 340B prescription dispensed to insured patients compared  to patients not using insurance.

As previously noted, in addition to requiring flat fees for dispensing  prescriptions, 13 of the 29 contracts we reviewed included provisions for  the covered entity to pay the pharmacy a fee based on the percentage of  revenue generated by each prescription. These percentage fees only  applied to prescriptions provided to patients with insurance, and ranged  from 12 to 20 percent of the revenue generated by the prescriptions.  Generally there were two methods for determining the amount of revenue  generated. The first method used the reimbursement the pharmacy  received for the prescription, while the second method used the net  revenue after subtracting the 340B cost of the drug from the  reimbursement received by the pharmacy.

Selected Covered Entities Use Two Main Methods to Pay TPAs

Officials from the two TPAs we interviewed and questionnaire  respondents from the 39 covered entities that use TPAs described two  main methods entities use to reimburse TPAs for 340B services: 1) a fee  for each prescription processed by the TPA, and 2) a fee for each  contract pharmacy for which the TPA processes 340B claims on behalf of  the entity.

Example of Fees between a Covered Entity  and Third-Party Administrator (TPA)  In the hypothetical example below, the TPA  receives $85 from the contract pharmacy.   This amount represents the total  reimbursement for the 340B drug, less fees  deducted by the contract pharmacy. Pursuant  to an agreement with the covered entity, the  TPA deducts a fee of $5, and forwards the  remaining balance of $80 to the covered  entity. This represents the total revenue the  covered entity generated from the 340B drug.

Officials with the two TPAs we interviewed told us that their agreements  with covered entities most frequently involve covered entities  compensating them based on a fee for each prescription they process on  behalf of the entity. Officials from one of these TPAs described three  different fee-per-prescription options they offer to covered entities, with  the amount of the fees varying based on the option selected:

A small fee, for example, 20 cents, for every prescription filled by the  covered entity’s contract pharmacy, and reviewed and processed by  the TPA. This includes prescriptions that may not have originated  from the covered entity, and may not be 340B eligible, as contract  pharmacies can also fill prescriptions for individuals who are not  patients of the entity.

A mid-sized fee, for example, $1.90, for each prescription filled by the  covered entity’s contract pharmacy that the TPA reviewed and  determined originated from the covered entity. These prescriptions  may or may not be 340B eligible.

A larger fee, for example, $5 to $7, for each prescription filled by the  covered entity’s contract pharmacy that the TPA determined  originated from the entity and is 340B eligible.

The 39 covered entities that responded to our questionnaire and reported  using a TPA most frequently reported paying their TPAs a fee per each  prescription processed, but the exact method varied. For example, some  covered entities said they paid their TPAs for each prescription regardless  of whether it was determined to be 340B eligible, others limited the fees  to prescriptions that were 340B eligible, and some reported paying TPAs  for 340B-eligible prescriptions dispensed to an insured patient. (See table  4.)

Among the 10 covered entities we interviewed, officials from 8 of these  entities said they used TPAs; 5 said they pay their TPAs a fee per  prescription, 1 reported paying a fee per contract pharmacy, and 2  reported using both options. Among the covered entities that used fees  per prescription and told us the amounts of the fees they pay, the fees  ranged from $3.50 to $10.00 per 340B eligible prescription or $3.95 per  prescription regardless of whether the prescription was 340B eligible.

For those that pay their TPA a fee per contract pharmacy, the fee was  $25,000 a year per pharmacy.

About Half of the Covered Entities Reviewed Provided Low-Income, Uninsured Patients Discounts on 340B Drugs at Some or All of Their Contract Pharmacies

Of the 55 covered entities responding to our questionnaire, 30 reported  providing low-income, uninsured patients discounts on 340B drugs  dispensed at some or all of their contract pharmacies, and 25 said they  did not offer discounts at their contract pharmacies. All 30 covered  entities providing patients with discounts reported providing discounts on  the drug price for some or all 340B drugs dispensed at contract  pharmacies. Federal grantees were more likely than hospitals to provide  such discounts and to provide them at all contract pharmacies (see fig.  9).

Of the 30 covered entities that responded to our questionnaire that they  provided discounts on the drug price, 23 reported providing patients the  full 340B discount—the patients obtained drugs from contract pharmacies  at the 340B price or less. In many cases, these covered entities indicated  that patients received drugs at no cost. Some covered entities reported  that patients would pay more than the 340B price, but less than the  wholesale price of the drug or what a self-paying patient would pay, and  others indicated they determined discounts for patients on a case-by-case  basis. A larger number of federal grantees than hospitals (15 compared to  8) indicated their patients would pay the 340B price or less for their drugs  at contract pharmacies where discounts were available. (See fig. 10.)

In addition to providing discounts on the 340B drug price, some of the 30  covered entities also reported providing discounts on fees patients may  pay to contract pharmacies for 340B drugs. Contract pharmacies may  charge fees to dispense 340B drugs or cover administrative costs of  participating in a covered entity’s 340B program, including costs  associated with tracking drug inventories and ordering new drugs. In  general, about two-thirds of the covered entities with patients who would  be subject to dispensing or administrative fees at contract pharmacies  reported providing discounts on the fees at some or all of their contract  pharmacies. Hospitals were more likely than grantees to provide  discounts on these fees when applicable. (See fig.11.)

The 30 covered entities providing 340B discounts to low-income,  uninsured patients reported using a variety of methods to determine  whether patients were eligible for these discounts. Fourteen of the  covered entities said they determined eligibility for discounts based on  whether a patient’s income was below certain thresholds as a percentage  of the federal poverty level, 11 reported providing discounts to all patients,  and 5 said they determined eligibility for discounts on a case-by-case  basis. For those 14 covered entities determining eligibility based on  income as a percentage of the federal poverty level, the threshold used to  determine who was eligible for discounts varied but most reported that  patients with incomes at or below 250 percent of the federal poverty level  would be eligible for discounts. (See table 5.)

Covered entities reported making patients aware of the availability of  discounts at contract pharmacies primarily through oral communication by  staff located at either the entity or the pharmacy. In addition, the covered  entities reported using a variety of methods to inform contract pharmacies  about which patients were eligible for discounts, including through notes  in patient medical records sent to the pharmacy or by placing codes on  the patient’s prescriptions sent to or presented at the pharmacy. (See  table 6.) Officials from one covered entity we interviewed said that it  provides patients eligible for discounts with an identification card (which  they referred to as a drug discount card) that patients present at the  contract pharmacy; this card informs pharmacy staff of the specific  discount amount. Officials from another covered entity said they place  codes on electronic prescriptions which informs the pharmacy about  discounts.

Some covered entities that did not provide discounts on 340B drugs at  their contract pharmacies reported assisting patients with drug costs  through other mechanisms. For example, 6 of the 10 covered entities we  interviewed said that while they did not provide discounts on 340B drugs  dispensed at their contract pharmacies, they provide charity care to low- income patients, including free or discounted prescriptions. Additionally, 4  of the 25 covered entities that reported on our questionnaire that they did  not provide discounts at their contract pharmacies said they provided  patients with discounts on 340B drugs at their in-house pharmacies.

Oversight Weaknesses Impede HRSA’s Ability to Ensure Compliance at 340B Contract Pharmacies

HRSA does not have complete data on the total number of contract  pharmacy arrangements in the 340B Program to inform its oversight  efforts, including information that could be used to better target its audits.  Additionally, weaknesses in HRSA’s audit process compromise its  oversight of covered entities. Finally, the lack of specificity in HRSA’s  guidance to covered entities potentially impedes covered entities’  oversight of contract pharmacies.

HRSA Does Not Have Complete Data on Contract Pharmacy Arrangements to Use for Its Oversight

HRSA does not have complete data on all contract pharmacy  arrangements in the 340B Program to inform its oversight efforts. HRSA  requires covered entities to register their contract pharmacies with the  agency and recertify that registration annually. Contract pharmacies  registered to each covered entity are recorded in a publicly available  database, which according to HRSA, is used by various stakeholders to  validate the eligibility of entities and confirm shipping addresses for each  contract pharmacy eligible to receive 340B drugs on an entity’s behalf.  However, because covered entities differ in the way they register their  contract pharmacies, HRSA, and its publicly available database, does not  have information on all of an entity’s contract pharmacy arrangements.  Specifically, because HRSA does not require covered entities to  separately register contract pharmacies to each child site for which a  contractual relationship exists, HRSA does not have complete information  on which sites of an entity have contracted with a pharmacy to dispense  340B drugs. Our analysis of HRSA data showed that the registration of  contract pharmacies for 57 percent of covered entities with child sites only  specified relationships between contract pharmacies and the parent site;  thus HRSA may only have information on a portion of the actual number  of 340B contract pharmacy arrangements. Additionally, manufacturers do  not have complete information on which covered entity sites have  contracts with a pharmacy to dispense 340B drugs, according to HRSA  officials. Manufacturers could use such information to help ensure that  340B discounted drugs are only provided to pharmacies on behalf of a  covered entity site with a valid 340B contract with that site.

HRSA officials told us that the number of contract pharmacy  arrangements recorded in HRSA’s database increases a covered entity’s  chance of being randomly selected for a risk-based audit. However, since  HRSA gives covered entities multiple contract pharmacy registration  options, the likelihood of an entity being selected for an audit is  dependent, at least in part, on how an entity registers its pharmacies as  opposed to the entity’s actual number of pharmacy arrangements.  Without more complete information on covered entities’ contract  pharmacy arrangements, HRSA cannot ensure that it is optimally  targeting the limited number of risk-based audits done each year to  entities with more contract pharmacy arrangements. Federal internal  control standards related to information and communication state that  management should use quality information to achieve the entity’s  objectives, such as by obtaining relevant data that are reasonably free  from error and bias and represent what they purport to represent so that  they can be used for effective monitoring. Without complete information  on covered entities’ use of contract pharmacies, HRSA does not have the  information needed to effectively oversee the 340B Program, including  information that could be used to better target its audits of covered  entities.

Weaknesses in HRSA’s Audit Process Impede Its Oversight of 340B Program Compliance at Contract Pharmacies

HRSA primarily relies on audits to assess covered entities’ compliance  with 340B Program requirements, including compliance at contract  pharmacies, according to HRSA officials; however weaknesses in its  audit process impede the effectiveness of its oversight. As a result of its  audits, HRSA has identified instances of diversion and the potential for  duplicate discounts at contract pharmacies, among other findings of  noncompliance. Specifically, through the audits conducted since fiscal  year 2012, HRSA identified at least 249 instances of diversion at contract  pharmacies and 15 instances of the potential for duplicate discounts for  drugs dispensed at contract pharmacies, as of February 2018. HRSA had  also identified 33 covered entities with insufficient contract pharmacy  oversight. (See Table 7.)

However, we identified two areas of weaknesses in HRSA’s audit process  that impede its oversight of covered entities’ compliance with 340B  Program requirements at contract pharmacies: 1) the process does not  include an assessment of all potential duplicate discounts, and 2) the  process for closing audits does not ensure all covered entities have fully  addressed any noncompliance identified.

Medicaid Delivery Systems  States provide Medicaid services through  either fee-for-service or managed care. Under  fee-for-service, states reimburse providers  directly for each service delivered. For  example, a pharmacy would be paid by the  state for each drug dispensed to a Medicaid  beneficiary. Under a capitated managed care  model, states typically contract with managed  care organizations to provide a specific set of  services to Medicaid beneficiaries (which  could include drugs) and prospectively pays  each organization a set amount per  beneficiary per month to provide or arrange  those services.

Not all potential duplicate discounts are assessed. HRSA’s audits  only assess the potential for duplicate discounts in Medicaid fee-for- service. They do not include a review of covered entities’ processes to  prevent duplicate discounts for drugs dispensed through Medicaid  managed care. The potential for duplicate discounts related to Medicaid  managed care has existed since 2010 when manufacturers were required  to pay Medicaid rebates under managed care, and currently, there are  more Medicaid enrollees, prescriptions, and spending for drugs under  managed care than fee-for-service.

HRSA officials told us that they do not assess the potential for duplicate  discounts in Medicaid managed care as part of their audits because they  have yet to issue guidance as to how covered entities should prevent  duplicate discounts in Medicaid managed care. They agreed that the  lack of Medicaid managed care guidance for covered entities was  problematic, and HRSA’s December 2014 policy release stated, “HRSA  recognizes the need to address covered entities’ role in preventing  duplicate discounts under Medicaid managed care, and is working with  the Centers for Medicare & Medicaid Services (CMS) to develop policy in  this regard.” According to HRSA, in the absence of formal guidance,  covered entities should work with their states to develop strategies to  prevent duplicate discounts in Medicaid managed care. However, 8 of the  10 covered entities we spoke with described challenges working with their  states and local Medicaid managed care organizations to ensure that  duplicate discounts were not occurring or expressed the need for more  guidance from HRSA on how to comply with 340B requirements related to  duplicate discount prevention. As a result of these challenges, some  covered entities acknowledged that they did not have assurance that  duplicate discounts were not occurring with their Medicaid managed care  claims, while other entities told us that they did not seek discounts for the  drugs of managed care patients due to compliance challenges.

Federal internal control standards related to control activities and  monitoring state that agencies should 1) implement control activities  through policies, such as by determining the necessary policies based on  the objectives and related risks for the operational process; and 2)  establish and operate monitoring activities to monitor the internal control  system and evaluate results, such as by establishing and operating  monitoring activities that are built into each entity’s operations, performed  continually, and responsive to change. In addition, federal law directs  the agency to develop detailed guidance describing methodologies and  options for avoiding duplicate discounts. Until HRSA develops guidance  and includes an assessment of the potential for duplicate discounts in  Medicaid managed care as part of its audits, the agency does not have  assurance that covered entities’ efforts are effectively preventing  noncompliance. As a result, manufacturers are at risk of being required to  erroneously provide duplicate discounts for Medicaid prescriptions.

Audit closure process does not ensure all identified issues of  noncompliance are addressed. Under HRSA’s audit procedures,  covered entities with audit findings are required to 1) submit corrective  action plans to HRSA that indicate that the entities will determine the full  scope of any noncompliance (beyond the sample of prescriptions  reviewed during an audit); 2) outline the steps they plan to take to correct  findings of noncompliance, including any necessary repayments to  manufacturers; and 3) specify the timelines for implementing the  corrective action plans. HRSA closes the audit when a covered entity submits a letter attesting that its corrective action plan, including its  assessment of the full scope of noncompliance, has been implemented  and any necessary repayments to manufacturers have been completed.

However, we identified two specific deficiencies in HRSA’s approach.  First, although HRSA requires that covered entities determine the full  scope of noncompliance found in audits, it does not provide guidance as  to how entities should make this assessment. Specifically, HRSA does  not specify how far back in time covered entities must look to see if any  related noncompliance occurred and instead, relies on each entity to  make this determination. For example, a document from a fiscal year  2017 audit revealed that a covered entity that had participated in the  340B Program for 3 years only reviewed 5 months of claims to determine  whether any other instances of diversion had occurred, diminishing the  likelihood that its efforts identified the full scope of noncompliance.  Additionally, until April 2018, HRSA did not require covered entities that  were audited to communicate the methodology used to assess the full  scope of noncompliance, or the findings of their assessments, including  how many or which manufacturers were due repayment. Beginning April  1, 2018, HRSA requires covered entities subject to targeted audits to  document their methodology for assessing the full scope of  noncompliance. However, as previously noted, only 10 percent of the 200  audits HRSA currently conducts each year are targeted audits.  Consequently, the vast majority of covered entities audited are not  required to provide HRSA with information on their methodology for  assessing the full scope of noncompliance. Furthermore, HRSA officials  told us that they believe determining the scope of noncompliance is a  matter between the covered entities and manufacturers. Thus, HRSA  relies on manufacturers to determine the adequacy of a covered entity’s  effort to assess the full scope of noncompliance. However, covered  entities only contact the manufacturers that they determine were affected  by the noncompliance based on the methodology they choose to apply;  thus, it is unclear how manufacturers not contacted would be in a position  to negotiate an acceptable assessment of the scope of noncompliance  and any applicable repayment.

Federal internal control standards related to control activities state that  agencies should implement control activities through policies, such as by documenting policies in the appropriate level of detail to allow  management to effectively monitor the control activity. As HRSA does  not provide guidance on how covered entities are to assess the full scope  of noncompliance and does not review most entities’ methodology for  making such assessments, the agency does not have reasonable  assurances that entities have adequately identified all instances of  noncompliance.

Second, HRSA generally relies on each covered entity to self-attest that  all audit findings have been addressed and that the entity is now in  compliance with 340B Program requirements. Beginning April 1, 2018,  HRSA requires the 10 percent of covered entities that are subject to  targeted audits to provide documentation that they implemented their  corrective action plans prior to HRSA closing the audits. However, it still  relies on the remaining 90 percent of audited covered entities to self- attest to their compliance with program requirements.

HRSA officials told us they believe that a covered entity providing a  description of the corrective actions is sufficient, and that the self- attestation of corrective action plan implementation provides HRSA with  the information necessary to close the audit. However, aside from the  self-attestation, HRSA’s only mechanism to ensure that the majority of  audited covered entities have implemented their corrective action plans is  to re-audit the entities—in other words, subject the entity to a targeted  audit. To date, the agency told us that it has re-audited 21 covered  entities, and based on those re-audits, determined that 1 entity did not  fully implement its corrective action plan from the original audit. However,  we found that of the 19 re-audited covered entities for which results were  available, 12 had similar findings of noncompliance in their second audits,  as were identified in their original audits (e.g., diversion findings in both  audits), 3 of which were caused by the same issue, according to  information provided to us by HRSA.

Federal internal control standards for monitoring specify that agencies  should establish and operate monitoring activities to monitor the internal  control system and evaluate the results, for example by using ongoing  monitoring to obtain reasonable assurance of the operating effectiveness  of the service organization’s internal controls over the assigned process.

By only reviewing evidence of corrective action plan implementation for  the limited number of covered entities subject to targeted audits, HRSA  does not have reasonable assurance that the majority of covered entities  audited have corrected the issues identified in the audit, and are not  continuing practices that could lead to noncompliance, thus increasing the  risk of diversions, duplicate discounts, and other violations of 340B  Program requirements.

HRSA’s Guidance for Covered Entities’ Oversight of Contract Pharmacies Lacks Specificity

HRSA guidance for covered entities on their oversight of contract  pharmacies lacks specificity and thus provides entities with considerable  discretion on the scope and frequency of their oversight practices.  Specifically, HRSA’s 2010 guidance on contract pharmacy services  specifies that covered entities are responsible for overseeing their  contract pharmacies to ensure that drugs the entity distributes through  them comply with 340B Program requirements, but states that, “the exact  method of ensuring compliance is left up to the covered entity.” The  guidance also states that, “annual audits performed by an independent,  outside auditor with experience auditing pharmacies are expected,” but  HRSA officials told us that covered entities are not required to conduct  independent audits and instead are expected to do some form of periodic  oversight of their contract pharmacies. Thus, according to HRSA  officials, if a covered entity indicates that it has performed oversight in the  12 months prior to a HRSA audit, then HRSA considers the entity to have  met HRSA’s standards for conducting contract pharmacy oversight  regardless of what the oversight encompassed.

Due, at least in part, to a lack of specific guidance, we found that some  covered entities performed minimal contract pharmacy oversight.

Officials from a grantee reported auditing claims of 5 randomly  selected patients quarterly, despite treating approximately 900  patients each month.

Officials from a critical access hospital that serves about 21,000  patients a year at its outpatient clinics reported that the annual  independent audit of their hospital system reviewed five claims.

Officials from two entities reported that they did not contract for an  independent audit of their 340B Program, despite HRSA’s expectation  to do so.

Additionally, of the 20 covered entities whose audits we reviewed, 6 had  no documented processes for conducting contract pharmacy oversight.

The identified noncompliance at contract pharmacies raises questions  about the effectiveness of covered entities’ current oversight practices.  Specifically, 66 percent of the 380 diversion findings in HRSA audits  involved drugs distributed at contract pharmacies, and 33 of the 813  audits for which results were available had findings for lack of contract  pharmacy oversight. However, the number of contract pharmacy  oversight findings may be limited by the fact that officials from HRSA’s  contractor said that its auditors rely on verbal responses from entity  officials about any internal review or self-audits conducted by the entity.  This is despite the fact that HRSA officials told us that the agency  requires auditors to review documentation of covered entities’ oversight  activities.

Federal internal control standards related to control activities state that  agencies should implement control activities through policies, such as by  documenting the responsibility for an operational process’s objectives and  related risks, and control activity design, implementation, and operating  effectiveness. The standards also specify that management should  periodically review policies, procedures, and related control activities for  continued relevance and effectiveness in achieving its objectives or  addressing related risks. As a result of the lack of specific guidance and  its numerous audit findings of noncompliance, HRSA does not have  assurance that covered entities’ contract pharmacy oversight practices  are sufficiently detecting 340B noncompliance.

The 340B Program provides covered entities with discounts on outpatient  drugs and the ability to generate revenue on drugs purchased under the  program. Use of contract pharmacies enables covered entities to increase  the use of 340B drugs by expanding their distribution networks, thereby  increasing the volume of 340B drugs dispensed and generating  associated savings and revenue. The expansion of contract pharmacies  presents an opportunity for entities to fill more prescriptions with  discounted 340B drugs, but it also increases potential risks to the 340B  Program, such as risks related to diversion and duplicate discounts.  Although covered entities and HRSA have taken steps to ensure that  340B Program requirements are being met at contract pharmacies,  HRSA’s audits continue to identify instances of noncompliance.

As currently structured, weaknesses in HRSA’s oversight impede its  ability to ensure compliance with 340B Program requirements at contract  pharmacies. HRSA cannot ensure that its limited number of audits target  covered entities with the most complex 340B programs, and thus the  greatest risk of noncompliance, because the agency does not have  complete data on entities’ contract pharmacy arrangements. Additionally,  HRSA’s audit process does not adequately identify compliance issues,  nor does it ensure that identified issues are corrected. HRSA’s audits do  not assess compliance with a key 340B Program requirement (the  prohibition regarding duplicate discounts) as it relates to Medicaid  managed care, and HRSA does not provide audited entities with  guidance for determining the full scope of noncompliance, which reduces  the effectiveness of HRSA’s audits in identifying drug diversion and  duplicate discounts. Moreover, where audits identify instances of  noncompliance, HRSA’s process does not confirm that all covered  entities successfully correct the deficiencies and take steps to prevent  future noncompliance. Although HRSA made improvements to its process  for targeted audits during the course of our review, the agency does not  require most covered entities subject to an audit to provide evidence of  corrective actions taken.

Moreover, the lack of specificity in HRSA’s guidance to covered entities  on the methods through which they should ensure compliance may  impede the effectiveness of entities’ oversight. For example, without  guidance instructing covered entities how to prevent duplicate discounts  in Medicaid managed care, entities are left to individually navigate the  policies and practices of states and private insurers. Furthermore, by not  clearly communicating expectations for covered entities’ oversight of their  contract pharmacies, HRSA faces the risk that instances of  noncompliance, such as diversion, at contract pharmacies will not be  identified and addressed. As the 340B Program continues to grow, it is  essential that HRSA address these shortcomings.

We are making the following seven recommendations to HRSA:  The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1)

The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs. (Recommendation 2)

The Administrator of HRSA should incorporate an assessment of covered entities’ compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3)

The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit. (Recommendation 4)

The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5)

The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities’ assessments of the full scope of noncompliance identified during each audit. (Recommendation 6)

The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7)

HHS provided written comments on a draft of this report, which are  reproduced in app. II, and technical comments, which we have  incorporated as appropriate. In its written comments, HHS concurred with  four of our seven recommendations, did not concur with three of our  recommendations, and stated that it had concerns with some of the other  information in our report.

In concurring with four of our recommendations, HHS stated that HRSA is  making changes to its audit process to strengthen oversight of the 340B  Program. Regarding our recommendation related to guidance on  duplicate discounts, HHS concurred, but commented that the  recommendation did not account for the critical role that CMS would play  in its successful implementation. We agree that CMS would play an  important role in ensuring compliance with the prohibition on duplicate  discounts in Medicaid managed care, which is why we recommended that  HRSA coordinate with CMS on the guidance. HHS indicated that HRSA  and CMS are strategizing on effective ways to address this issue. HHS  also concurred with our recommendations to issue guidance related to  identifying the full scope of noncompliance and covered entities’ oversight  of their contract pharmacies, although it noted that HRSA would face  challenges in issuing guidance related to areas where it does not have  explicit regulatory authority. While we recognize that HRSA’s authority to  issue regulations governing the 340B Program may be limited, our  recommendations were focused on HRSA clarifying certain program  requirements through whatever format the agency deems appropriate.  Since the establishment of the 340B Program, HRSA has used  interpretative guidance and statements of policy to provide guidance to  covered entities regarding compliance with program requirements. HRSA  has also used certain of its audit procedures, such as the template  provided to covered entities for the development of corrective action  plans, to provide such clarifications. Our recommendations are intended  to expand the availability of information HRSA provides to covered  entities to help them improve compliance with existing program  requirements. As such, we continue to believe that further clarification,  whether provided as interpretive guidance, audit procedures, or another  format, is necessary to help ensure compliance with program  requirements.

Among the recommendations with which HHS did not concur was our  recommendation to require covered entities to register contract  pharmacies for each site of the entity for which a contract exists. HHS  stated that its current registration process is responsive to our concerns  for all covered entity types other than hospitals and health centers.  However, as we note in the report, hospitals and FQHCs are typically the  covered entity types that have multiple sites, and are generally more likely  to have contract pharmacies. HHS cited administrative burden for both  covered entities and HRSA as a reason not to require covered entities to  provide more complete information about contract pharmacy  arrangements. However, given that HRSA requires covered entities to  register both their sites and their contract pharmacies with the agency, it  is unclear why there would be significant additional burden for covered  entities to indicate which of the previously registered sites had contracts  with which contract pharmacies. It is also important to note that contract  pharmacy use by covered entities is voluntary, and covered entities that  choose to have contract pharmacies are required to oversee those  pharmacies to ensure compliance with 340B Program requirements.  Therefore, the use of contract pharmacies inherently comes with  additional administrative responsibilities for the covered entity, and we  believe that the requirement to register each contract pharmacy  arrangement with HRSA should present limited additional burden on  covered entities.

Rather than implementing our recommendation, HHS stated that HRSA  will make changes to its audit selection process; HRSA will assume that  all contract pharmacies registered with the parent site would also be used  by all sites of the covered entity prior to selecting entities for risk-based  audits. Although this may be a good step forward, it does not provide  information on the actual number of contract pharmacy arrangements for  each covered entity. As such, we continue to believe that HRSA needs  more complete information on contract pharmacy arrangements to best  target its limited number of audits to covered entities with the most  complex 340B programs. This is also important information to provide  manufactures to help ensure that 340B discounted drugs are only  provided to pharmacies on behalf of a covered entity site with a valid  340B contract with that site.

HHS also did not concur with our two recommendations to require  covered entities to specify their methodologies for identifying the full  scope of noncompliance identified during their audits as part of their  corrective action plans, and to provide evidence that these plans have  been successfully implemented prior to HRSA closing audits. In its  response, HHS noted that on April 1, 2018, HRSA implemented these  requirements for entities subject to targeted audits (including re-audits),  which represent 10 percent of all entities audited. However, HRSA  indicated that implementing these requirements for all covered entities  that are audited would create a significant burden for these entities. As  we previously noted, HRSA already requires covered entities with audit  findings to determine the full scope of noncompliance and to submit  corrective action plans. Thus, it is unclear how requiring covered entities  to include written descriptions of their methodologies for identifying the full  scope of noncompliance, which should already be formulated, and to  provide evidence that the corrective actions that entities developed have  been implemented, would create significant additional burden for these  entities.

HHS also expressed concern that these additional steps would  significantly delay the audit process and repayments to manufacturers.  We recognize that reviewing these documents may create some  additional work for HRSA and possibly require additional time to close  audits. However, we believe this additional work and time is necessary for  the audits to be effective at adequately identifying compliance issues and  ensuring that those issues are corrected. Furthermore, these additional  actions could reduce the need for re-audits which are burdensome in  terms of cost and time, for both the covered entity and HRSA.

Finally, HHS also expressed concerns about some of the other  information included in the draft report.

HHS stated that disclosing actual fees paid by covered entities to  pharmacies and TPAs could cause disruptions in the drug pricing  market and fluctuations in fees entities pay. Our report provides fees  for a small and nongeneralizable sample of contracts, covered  entities, and TPAs. For example, we provide contract pharmacy fees  for 30 of the thousands of contracts that exist between covered  entities and pharmacies. It is unclear how this information could cause  disruptions in the drug pricing market or lead to fluctuations in fees  covered entities may pay, and HHS did not provide any evidence to  support its assertion. Additionally, HHS has raised questions about  the effect of the 340B Program on drug pricing. As such, we believe  that our discussion of fees brings enhanced transparency to the 340B  Program, and provides Congress with important information it  requested to gain a better understanding of the program and enhance  its oversight.

Regarding the distance between contract pharmacies and covered  entities, HHS noted that the longest distance was for a specialty  pharmacy that was registered for 17 days. As noted in our scope and  methodology, our analysis was of covered entities and contract  pharmacies participating as of July 1, 2017. Additionally, there were  other contract pharmacy arrangements of similarly long distances.  HHS also expressed concern that the draft report did not note that  such specialty pharmacies may be needed due to restricted  distribution by a manufacturer, which would be outside a covered  entity’s control. In our report, we noted that the 340B database does  not provide information on why a covered entity may choose to  contract with a pharmacy that is located a long distance away.  However, the report does include some potential reasons HRSA  provided us as to why this may occur.

HHS also commented that our table on the number and percent of  covered entities audited does not fully reflect HRSA’s auditing efforts  because it does not include the number of entity sites and contract  pharmacies included within each audit. However, HRSA’s audits of  covered entities generally do not include visits to multiple covered  entity sites, or all contract pharmacies that distribute 340B drugs on a  covered entity’s behalf. Additionally, while the audits include a review  of a sample of 340B drugs distributed, that sample may not include  prescriptions written at, or dispensed from, all of the covered entity’s  sites or contract pharmacies. As a result, information in our report  highlights the number of entities that were audited.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of HRSA, and other interested  parties. In addition, the report will be available at no charge on GAO’s  website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at DraperD@gao.gov. Contact points for our  Office of Congressional Relations and Office of Public Affairs can be  found on the last page of this report. Other major contributors to this  report are listed in appendix III.

Appendix I: Summary of Fees Included in 340B Pharmacy Contracts Reviewed

Table 8 provides a brief description of the fees that covered entities pay  pharmacies with which they contracted to dispense 340B drugs based on  our review of 30 contracts.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contacts and Staff Acknowledgments

In addition to the contact named above, Michelle Rosenberg (Assistant  Director), N. Rotimi Adebonojo (Analyst in Charge), Jennie Apter, George  Bogart, Amanda Cherrin, David Lichtenfeld and Dan Ries made key  contributions to this report. Also contributing were Julianne Flowers and  Vikki Porter.

To have their drugs covered under Medicaid, the "340B" program requires drug manufacturers to sell outpatient drugs to covered entities—certain hospitals and clinics—at a discount. These entities are increasingly contracting with pharmacies to dispense 340B drugs. Doing so can make it harder to ensure compliance with 340B rules. For example, contract pharmacies may also fill prescriptions for the general public, increasing the risk of dispensing 340B drugs to ineligible patients.

We recommended ways to improve federal oversight of covered entities to help ensure compliance with 340B requirements.