Program Integrity: About 340 B Program Audits of Covered Entities
Only one audit of a covered entity will be permitted at any one time. When HRSA has received a request from a manufacturer to conduct an audit, HRSA will determine whether an audit should be performed by the Government or the manufacturer.
Audits will be performed in the minimum time necessary with the minimum intrusion on the covered entity’s operation.
HRSA’s 340B Program audits review covered entity compliance with respect to eligibility status, including compliance with the Group Purchasing Organization (GPO) prohibition as applicable (see 42 USC 256b(a)(4)(L)(iii)), duplicate discounts, and diversion as defined by42 USC 256b(a)(5)(A) and (B).
HRSA regional auditors conduct audit field work for the HRSA Office of Pharmacy Affairs (OPA).
- Covered entities selected for audit receive an engagement letter explaining what to expect and how to appropriately prepare.
- HRSA regional auditors conduct an introductory teleconference with the entity to request and obtain specified documents, including policies, procedures, and internal controls.
- HRSA regional auditors work with the entity to schedule an entrance conference with key entity management to discuss expectations for the onsite audit.
- HRSA regional auditors obtain and review select program data and internal controls.
- Audit procedures include, at a minimum:
- review of relevant policies and procedures and how they are operationalized;
- verification of eligibility, including GPO and outpatient clinic eligibility;
- verification of internal controls to prevent diversion and duplicate discounts, including appropriateness of inpatient/outpatient designations and Medicaid exclusion file designations;
- review of contract pharmacy compliance; and
- test 340B drug transaction records on a sample basis.
- HRSA regional auditors conduct an exit interview, sharing areas of concern and preliminary findings.
- HRSA regional auditors forward preliminary findings to OPA for review.
- OPA reviews the preliminary findings, drafts a Final Report and issues the report to covered entity, with a request for a corrective action plan (if applicable).
Notice and Hearing
- After HRSA issues a Final Report, the covered entity has 30 calendar days from the date of the HRSA Final Report to review findings noted in the HRSA Final Report, and to review HRSA’s request for a corrective action plan related to the findings noted.
- If a covered entity agrees with the Final Report, a covered entity must submit a corrective action plan to HRSA within 60 calendar days for HRSA’s approval. Corrective action plans for diversion or duplicate discount findings will, at a minimum, include the requirement for the entity to work with manufacturers and the state Medicaid agency, if applicable, to determine whether repayment is necessary.
- If a covered entity disagrees with the Final Report and request for corrective action plan, it shall notify HRSA in writing within 30 calendar days with appropriate supporting documentation of the covered entity’s disagreement. If an entity fails to submit a CAP, it may be removed from the 340B program.
- OPA reviews the covered entity’s response and, if appropriate, incorporates verifiable changes in the report to address disagreement supported by appropriate documentation.
- Once an audit report is finalized by OPA, the findings and any associated corrective action will be summarized on the OPA public website.
- OPA will pursue further follow-up with the entity as needed.