- Statutory Prohibition on Group Purchasing Organization Participation (PDF - 194 KB) 02/07/2013
- Clarification of HRSA Audits of 340B Covered Entities (PDF - 30 KB) 03/05/2012
- Clarification of Manufacturer Audits of 340B Covered Entities (PDF - 40 KB) 11/21/2011
- Stakeholders Letter: Program Integrity (PDF - 128 KB) 02/10/2012
HRSA's program integrity efforts aim to maximize oversight reach and manage compliance risks. We perform program integrity checks on eligibility requirements and documentation needed for compliance. Our self-disclosure process allows covered entities to evaluate and correct aspects of their 340B Program through self-reporting.
Other efforts include annual recertification. This gives covered entities a chance to review their 340B Drug Pricing Program (340B Program) responsibilities and let us know they're still in full compliance.
We also perform audits of covered entities and manufacturers. Covered entities participating in the 340B Drug Pricing Program must maintain accurate records to ensure compliance. Under section 340B(a)(5)(C) (PDF - 39 KB), we have authority to audit these entities for program adherence. Non-compliance may lead to refunds to drug manufacturers or removal from the program.
Audit Number
Only one audit of a covered entity is allowed at a time. When we receive a request from a drug manufacturer to conduct an audit, we'll decide if the government or the drug manufacturer should conduct the audit.
Audit Duration
The government or the drug manufacturer will conduct audits as quickly as they can.
Audit Scope
Audits include reviews of covered entity compliance with:
- Eligibility requirements
- Group Purchasing Organization (GPO) prohibition as applicable (see section 340B(a)(4)(L)(iii)) (PDF - 39 KB)
- Duplicate discounts (see 42 USC 256b(a)(5)(A))
- Diversion (see 42 USC 256b(a)(5)(B))
Contracted auditors conduct 340B Program audit field work for the HRSA Office of Pharmacy Affairs (OPA).
Pre-Audit
We conduct both onsite and remote audits.
Covered entities selected for audit receive an engagement letter explaining what to expect and how to prepare.
Auditors conduct an introductory teleconference with the entity to request and get specified documents related to policies, procedures, and internal controls.
Auditors work with the entity to schedule an introductory meeting with key covered entity management to discuss expectations for the audit.
During the Audit
Auditors get and review select 340B Program data and internal controls.
Audit procedures include:
- Review of relevant policies and procedures and how they are operationalized
- Verification of eligibility (including the GPO prohibition, maintaining auditable records, and outpatient clinic eligibility)
- Verification of internal controls to prevent diversion and duplicate discounts, including how the covered entity defines whether a patient is considered inpatient or outpatient, HRSA Medicaid Exclusion File designations, and accuracy of covered entity's 340B OPAIS record
- Review of 340B Program compliance at covered entity, outpatient or associated facilities, and contract pharmacies
- Testing of 340B drug transaction records on a sample or judgmental basis
For remote audits, we use the same audit procedures, except the auditor communicates with the covered entity using secure workspaces, secured email, and Zoom platform. The auditor will ensure appropriate communications are encrypted and secure, and the auditor will test those communications with the covered entity before beginning the remote audit. Zoom is the preferred method to review sample items and patient records. Secure workspaces and secured email can be used in the case of scanning paper documents.
Auditors collect the facts throughout the audit but are not authorized to summarize any findings to the entity. Their report for our review will contain the facts as they understand it. Additionally, any auditor statements made during the audit are not considered final and are subject to change.
Post Audit
Auditors forward a preliminary report to us for review.
We review the preliminary report, draft a Final Report and issue the report to the covered entity, with a request for a corrective action plan (CAP), if applicable.
Notice and Hearing
After we issue a Final Report, the covered entity has 30 calendar days from the date of the report to review noted findings and our request for a CAP, if applicable.
If a covered entity agrees with the Final Report, a covered entity must submit a CAP to us within 60 calendar days for HRSA's approval. If a covered entity submits a disagreement with the audit findings, the covered entity should not submit a CAP until our review of the disagreement is complete. When our review of the disagreement is complete, HRSA will request a CAP at that time, if one is still required.
If a covered entity disagrees with the Final Report, it must notify us in writing within 30 calendar days with appropriate supporting documentation of the covered entity's disagreement. We review the covered entity's response and, if appropriate, may reissue the Final Report if changes are made based on documentation submitted.
If an entity fails to submit a CAP, we may remove them from the 340B Program.
Once an audit report is finalized by OPA, the findings and any associated sanctions will be summarized on the OPA public website.
Corrective Action Plan (CAP) Implementation and Repayment
Unless otherwise approved by HRSA, we expect full CAP implementation and settlement with manufacturers, to be complete within six months of the CAP approval date. Covered entities unable to meet this expectation may be subject to termination from the 340B Program.
We'll post a notice on our website to alert manufacturers to the extent that violations have occurred. This notice will include findings of the 340B Program audit requiring repayment and entity contact information for manufacturers to utilize. Covered entities are responsible for identifying and contacting all affected manufacturers to notify them of 340B Program violations and to discuss a method for possible repayment. We'll close out the audit once the covered entity confirms that all repayments have been resolved (if necessary), and that the CAP has been fully implemented.
We may require covered entities to submit additional documentation to demonstrate their CAP implementation, including any applicable repayment to manufacturers.
We may re-audit a covered entity to assess compliance with 340B Program requirements.
Covered entities with a re-audit that identifies the same exact finding of non-compliance, may be subject to additional audits. A finding of non-compliance with the diversion prohibition in two or more audits, depending on the nature of the violation, may be considered systematic and egregious, as well as knowing and intentional, which may result in the covered entity being removed from the 340B Program in accordance with section 340B(d)(2)(B)(v) of the Public Health Service Act. Such a finding may also disqualify the covered entity from re-entry into the 340B Program for a reasonable period of time.
Audit Standards
We've developed a program-specific audit process for its 340B compliance audits. 340B compliance audits are conducted by highly trained auditors in accordance with this process. Unlike other statutorily authorized programs, the 340B statute does not require HRSA to use Generally Accepted Government Auditing Standards (GAGAS) for 340B Program audits.
Audits of manufacturers
Under section 340B(a)(1), manufacturers of covered outpatient drugs that participate in the 340B Program, must offer all covered outpatient drugs at no more than the 340B ceiling price to a covered entity listed on our public 340B database if such drug is made available to any other purchaser at any price.
Manufacturers are subject to auditing by HRSA to ensure compliance with the 340B Program, pursuant to section 340B(d)(1)(B)(v) of the PHSA. Failure to comply with 340B pricing requirements may make the manufacturer liable to covered entities for refunds of overpriced 340B drugs.
We'll conduct audits as soon as possible with minimum disruption on the covered entity's operation
Audit Duration
We'll conduct audits as soon as possible with minimum disruption on the manufacturer's operation.
Audit Scope
HRSA's 340B Program audits review manufacturer compliance with respect to eligibility status, including compliance with 340B Program requirements and the determination that the manufacturer provided 340B drugs at or below the 340B ceiling price to participating covered entities.
Pre-Audit
We conduct both onsite and remote audits.
Manufacturers selected for audit receive an engagement letter explaining what to expect and how to appropriately prepare.
Auditors conduct an introductory teleconference with the manufacturer to request and obtain specified documents, including policies, procedures, and internal controls.
Auditors work with the manufacturer to schedule an opening meeting with key management to discuss expectations for the audit.
During the Audit
Auditors obtain and review select 340B Program data and internal controls.
Audit procedures include, at a minimum:
review of relevant policies and procedures and how they are operationalized;.
verification of internal controls to determine if the manufacturer is abiding by the terms of the 340B statute (section 340B of the Public Health Service Act (''PHS Act'')), including offering registered covered entities access to covered outpatient drugs at statutorily required pricing and;.
testing of 340B sales transaction records on a sample basis.
Auditors collect the facts throughout the audit but are not authorized to summarize any findings to the manufacturer. Their report to us will contain the facts as they understand it and must undergo OPA review. Additionally, any auditor statements made during the audit are not considered final and are subject to change.
Remote Audits
Except for the on-site visit, normal 340B audit procedures are followed for a remote audit. In place of the on-site visit, the auditor communicates with the manufacturer using secure workspaces, secured email, Adobe Connect, and teleconference. The auditor will ensure appropriate communications are encrypted and secure, and test those communications with the manufacturer before beginning the desk audit. Abode Connect is the preferred method to review sample items and policies and procedures. Secure workspaces and Sscured email could be used in the case of scanning paper documents.
Post Audit
Auditors forward a preliminary report to us for review.
We review the preliminary report, draft a Final Report and issue the report to the manufacturer, with a request for a corrective action plan (CAP), if applicable.
Notice and Hearing
After we issue a Final Report, the manufacturer has 30 calendar days from the date of our Final Report to review any noted findings and our request for a CAP, if applicable. If no adverse findings are cited, a letter will be sent to the manufacturer stating such, and the audit is considered closed at that point.
If a manufacturer agrees with the Final Report, a manufacturer must submit a CAP to us within 60 calendar days for our approval, if applicable.
If a manufacturer disagrees with the Final Report, it must notify HRSA in writing within 30 calendar days with appropriate supporting documentation of the manufacturer's disagreement. We review the response and, if appropriate, may reissue the Final Report if changes are made based on documentation submitted.
Once our audit report is finalized , the findings and any associated corrective action will be summarized on the our public website.
CAP Implementation and Repayment
We will post a public notice to publicly alert covered entities to the extent that violations have occurred. This notice will include findings of the 340B Program audit requiring repayment and manufacturer contact information for covered entities to utilize. Manufacturers are responsible for identifying all affected covered entities and for contacting each to notify them of program violations and to begin a dialogue on a method for possible repayment. We close out the audit once the manufacturer confirms that all repayment is resolved (if necessary) and that the CAP has been fully implemented.
Audit Standards
HRSA has developed a program-specific audit process for its 340B compliance audits. 340B compliance audits are conducted by highly trained auditors in accordance with this process.
HRSA correspondence to stakeholders
- Updated HRSA Letter to Johnson & Johnson Regarding Their Decision to Proceed With Their Unapproved Rebate Proposal (PDF - 135 KB)
- HRSA Letter to Johnson & Johnson Regarding Their Rebate Proposal (PDF - 192 KB)
- Updated HRSA Letter to Merck Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 77 KB)
- HRSA Letter to AbbVie Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 116 KB)
- HRSA Letter to Amgen Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 116 KB)
- HRSA Letter to UCB Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 36 KB)
- HRSA Letter to Merck Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 36 KB)
- Updated HRSA Letter to Boehringer Ingelheim Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 110 KB)
- HRSA Letter to Boehringer Ingelheim Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 123 KB)
- Updated HRSA Letter to AstraZeneca Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 130 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against AstraZeneca its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- Updated HRSA Letter to Lilly USA, LLC Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 127 KB)
- Updated HRSA Letter to Novartis Pharmaceuticals Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 128 KB)
- Updated HRSA Letter to Novo Nordisk Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 56 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against Novo Nordisk its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- Updated HRSA Letter to Sanofi Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 127 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against Sanofi its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- Updated HRSA Letter to United Therapeutics Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 130 KB)
- HRSA Letter to AstraZeneca Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 124 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against AstraZeneca its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- HRSA Letter to Lilly USA, LLC Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 122 KB)
- HRSA Letter to Novartis Pharmaceuticals Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 115 KB)
- HRSA Letter to Novo Nordisk Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 123 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against Novo Nordisk its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- HRSA Letter to Sanofi Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 117 KB) (This letter has been vacated by a ruling in the Sanofi Aventis US LLC v. United States HHS, et al 58 F.4th 696 (3rd Cir. 2023) litigation, and HHS has been enjoined from enforcing against Sanofi its reading of Section 340B as requiring delivery of discounted drugs to an unlimited number of contract pharmacies. For more information, see the 3rd Circuit decision.) (PDF - 320 KB)
- HRSA Letter to United Therapeutics Regarding Sales to Covered Entities through Contract Pharmacy Arrangements (PDF - 117 KB)
Audit results
- FY 2024 Audit Results (updated 9/20/24)
- FY 2023 Audit Results (updated 9/20/24)
- FY 2022 Audit Results (updated 7/24/24)
- FY 2021 Audit Results (updated 7/24/24)
- FY 2020 Audit Results (updated 1/31/23)
- FY 2019 Audit Results (updated 8/30/24)
- FY 2018 Audit Results (updated 11/28/23)
- FY 2017 Audit Results (updated 11/28/23)
- FY 2016 Audit Results (updated 12/1/23)
- FY 2015 Audit Results (updated 2/25/20)
- FY 2014 Audit Results (updated 2/20/19)
- FY 2013 Audit Results (updated 5/30/18)
- FY 2012 Audit Results (updated 7/14/17)
- FY 2024 Mftr Audit Results (updated 7/29/24)
- FY 2023 Mftr Audit Results (updated 6/28/24)
- FY 2022 Mftr Audit Results (updated 9/12/23)
- FY 2021 Mftr Audit Results (updated 8/29/22)
- FY 2020 Mftr Audit Results (updated 9/22/21)
- FY 2019 Mftr Audit Results (updated 3/19/21)
- FY 2018 Mftr Audit Results (updated 5/23/19)
- FY 2017 Mftr Audit Results (updated 9/11/18)
- FY 2016 Mftr Audit Results (updated 9/11/18)
- FY 2015 Mftr Audit Results (updated 9/11/18)