HRSA Is Auditing More and Finding More
HRSA’s Office of Pharmacy Affairs significantly increased its covered entity audit activity in recent years. The findings paint a clear picture of where 340B compliance breaks down.
The most common audit findings haven’t changed much in the last five years: duplicate discounts, diversion, and inadequate oversight of contract pharmacy arrangements. What has changed is the specificity of HRSA’s expectations and the consequences of non-compliance.
Entities with serious audit findings now face corrective action plans with defined timelines, follow-up audits within 12 months, and potential referral to the OIG for further investigation. The days of informal remediation conversations are largely behind us.
Finding 1: Duplicate Discounts on Medicaid Claims
The 340B statute prohibits covered entities from receiving both a 340B discount and a Medicaid rebate on the same drug. This is the “duplicate discount” prohibition, and it’s the most frequently cited audit finding.
The compliance mechanism is straightforward in theory: covered entities must carve in (use Medicaid managed care plans to avoid manufacturer rebates) or carve out (bill Medicaid at the non-340B price). In practice, the implementation is error-prone.
Common failures include drugs purchased at 340B prices that are dispensed to Medicaid managed care patients without proper carve-in/carve-out designation. State Medicaid programs that don’t have a functioning mechanism for covered entities to prevent duplicate discounts. And contract pharmacy claims where the 340B identification occurs after the point of sale, making it difficult to apply the Medicaid exclusion retroactively.
The fix requires a reliable system for identifying Medicaid patients at the point of dispensing and applying the correct billing pathway every time.
Finding 2: Drug Diversion
Diversion occurs when a 340B-priced drug is dispensed to a patient who doesn’t qualify as a patient of the covered entity. HRSA’s patient definition requires that the covered entity has established a relationship with the individual and maintains records of the individual’s healthcare.
Audit findings related to diversion typically fall into two categories. The first is dispensing 340B drugs to individuals who received only a limited service, such as a single lab test ordered by an outside provider, without establishing an ongoing patient relationship. The second is contract pharmacy arrangements where the pharmacy dispenses 340B drugs to individuals who have a prescription from a non-covered-entity provider.
FQHCs have a clearer patient definition than some other entity types, but the challenge intensifies with contract pharmacies. Your contract pharmacy compliance program must verify that every 340B claim is tied to a prescription from a covered entity provider and that the patient meets your entity’s patient definition.
Finding 3: Insufficient Contract Pharmacy Oversight
HRSA expects covered entities to exercise meaningful oversight of their contract pharmacy arrangements. This isn’t satisfied by having a contract on file.
Audit findings in this area include failure to conduct annual reviews of contract pharmacy 340B utilization data. Lack of documented policies and procedures for contract pharmacy management. Inability to produce reports showing which prescriptions were dispensed at 340B pricing through each contract pharmacy. And absence of corrective action documentation when discrepancies are identified.
The covered entity, not the contract pharmacy, is responsible for 340B compliance. If your contract pharmacy processes 10,000 prescriptions per year under your 340B program, you need to be able to demonstrate how you verify the accuracy and compliance of those claims.
Building an Audit-Ready Program
Audit readiness isn’t about last-minute preparation. It’s about maintaining a program that can withstand scrutiny at any time.
Conduct quarterly internal audits of a statistically valid sample of 340B claims. Document every finding and every corrective action. Maintain a current 340B policy and procedure manual that reflects your actual operations, not aspirational practices.
Keep your HRSA registration current. Update your 340B OPAIS profile whenever you add or remove contract pharmacies, change entity sites, or modify your covered entity type. Registration discrepancies are among the easiest findings for HRSA to identify and among the most preventable.
Train your staff annually. Every person involved in 340B purchasing, dispensing, billing, or compliance should understand the program requirements relevant to their role. Document the training and keep records.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Nexwell Health Partners provides management services, telehealth solutions, and compliance support for safety-net hospitals, FQHCs, and specialty practices. Contact us to schedule a consultation.
Sources