340B Tips for Grantees: Understanding the HRSA Audit Process
By William Wood and Kristin Fox-Smith
Visante provides “Key Takeaways for Grantees,” a series of articles to help newly enrolled Grantees and Specialty Clinics understand important aspects of the 340B Program and how to attain full compliance with the Program. These articles can be found with additional resources on Visante’s web site.
In this article, we would like to cover the important area of Health Resources and Services Administration (HRSA) audits and the audit process. To begin, let’s review the statutory provision regarding audits.
From: Federal Register/ Vol. 58, No. ll7/ Friday, May 7, 1993/ Notices (e) Audit Provision
Each covered entity will be required to retain records of purchases of covered outpatient drugs under the Agreement and of any claims for reimbursement submitted for such drugs under title XIX of the Social Security Act. When a covered entity is making purchases through a wholesaler, it will be required to provide the manufacturer with information necessary to arrange for such purchases consistent with the terms of the Agreement. A covered entity shall permit the Secretary and the manufacturer of a covered outpatient drug that is the subject of an Agreement to audit, at the Secretary’s or manufacturer’s expense, the records of the entity that directly pertain to the entity’s compliance with the resale or duplicate discount prohibition .
Audits of Manufacturers
Under section 340B(a)(1) of the Public Health Service Act, manufacturers of covered outpatient drugs that participate in the 340B Drug Pricing Program (340B Program) must offer all covered outpatient drugs at no more than the 340B ceiling price to a covered entity listed on HRSA’s public 340B database if such drug is made available to any other purchaser at any price. Manufacturers are subject to auditing by HRSA to ensure compliance with the 340B Program, pursuant to section 340B(d)(1)(B)(v) of the PHSA. Failure to comply with 340B pricing requirements may make the manufacturer liable to covered entities for refunds of overpriced 340B drugs.
HRSA’s audit policy is further detailed in:
340B DRUG PRICING PROGRAM NOTICE Release No. 2012-1, Date: March 5, 2012 CLARIFICATION OF HRSA AUDITS OF 340B COVERED ENTITIES
HRSA and manufacturers have had the authority to audit covered entities regarding their compliance with diversion of drugs and duplicate discounts since the inception of the 340B Program. As stated in the Government Accountability Office (GAO) September 2011 Report (GAO-11-836), the GAO recommended HRSA conduct selective audits of 340B covered entities to provide additional program oversight, monitor for program violations and prevent diversion and duplicate discounts. HRSA has recently begun audits of 340B covered entities as part of its efforts toward strengthening program integrity and oversight
HRSA has developed a program-specific audit process for its 340B compliance audits. 340B compliance audits are conducted by highly trained auditors in accordance with this process. Unlike other statutorily authorized programs, the 340B statute does not require HRSA to use Generally Accepted Government Auditing Standards (GAGAS) for 340B Program audits.
HRSA has contracted with the Bizzell Group, LLC to perform audits of 340B CEs starting in fiscal year 2017, which began Oct. 1. Audits of 340B covered entities, which began in January 2012, were previously conducted by auditors within HRSA.
Audit Number, Duration, and Scope
Only one audit of a CE will be permitted at any one time. When HRSA has received a request from a manufacturer to conduct an audit, HRSA will determine whether an audit should be performed by the Government or the manufacturer.
HRSA states that audits will be performed in the minimum time necessary with the minimum intrusion on the CE’s operation.
HRSA’s 340B Program audits review covered entity compliance with respect to eligibility status, including compliance with the Group Purchasing Organization (GPO) prohibition as applicable (GPO Prohibition does not apply to grantees).
The process consists of a Pre-Audit, during which a CE is notified by an engagement letter explaining what to expect and how to appropriately prepare. The auditors conduct an introductory teleconference with the CE to request and obtain specified documents, including policies, procedures and internal controls. Auditors work with the CE to schedule an opening meeting with key CE management to discuss expectations for the onsite audit.
Following the Pre-Audit call, HRSA auditors conduct either an on-site (temporarily on hold due to the pandemic) or virtual audit that will include, at a minimum:
- Review of relevant policies and procedures and how they are operationalized
- Verification of eligibility, including GPO (as applicable) and outpatient clinic eligibility
- Verification of internal controls to prevent diversion and duplicate discounts, including How the CE defines whether a patient is considered inpatient or outpatient
- HRSA Medicaid Exclusion File designations, and
- accuracy of CE’s 340B OPAIS record.
- Review of 340B Program compliance at CE outpatient or associated facilities, and contract pharmacies, and
- testing of 340B drug transaction records on a sample basis.
Auditors collect the facts throughout the audit but are not authorized to summarize any findings to the CE. Their report to OPA will contain the facts as they understand it and must undergo OPA review. Additionally, any auditor statements made during the audit are not considered final and are subject to change.
The actual audit is followed by a Post-Audit process during which:
- Auditors forward a preliminary report to OPA for review.
- OPA reviews the preliminary report, drafts a Final Report and issues the report to the CE with a request for a corrective action plan (CAP), if applicable.
Following the Post-Audit, a Notice and Hearing includes:
- A Final Report. The CE has 30 calendar days from the date of the HRSA Final Report to review findings noted in the HRSA Final Report and to review HRSA’s request for a CAP related to the findings noted.
- If a CE agrees with the Final Report, a CE must submit a CAP to HRSA within 60 calendar days for HRSA’s approval. If a CE is submitting disagreement with the audit findings, the CE should not submit a CAP until HRSA’s review of the disagreement is complete. When HRSA’s review of the disagreement is complete, HRSA will request a CAP at that time, if one is still required.
- If a CE disagrees with the Final Report, it must notify HRSA in writing within 30 calendar days with appropriate supporting documentation of the CE’s disagreement. OPA reviews the CE’s response and, if appropriate, may reissue the Final Report if changes are made based on documentation submitted.
- If a CE fails to submit a CAP, it may be removed from the 340B Program.
- Once an audit report is finalized by OPA, the findings and any associated corrective action will be summarized on the OPA public website.
If a Corrective Action Plan Implementation and Repayment are required:
- Unless otherwise approved by HRSA, full CAP implementation and settlement with manufacturers is expected to be complete within six months of the CAP approval date.
- CEs unable to meet this expectation may be subject to termination from the 340B Program.
- For audits beginning after October 1, 2015, CEs will no longer be required to post a public letter to manufacturers on HRSA’s website. Instead, HRSA will post a notice on its website to alert manufacturers to the extent that violations have occurred. This notice will include findings of the 340B Program audit requiring repayment and CE contact information for manufacturers to utilize. CEs are responsible for identifying and contacting all affected manufacturers to notify them of 340B Program violations and to discuss a method for possible repayment.
- HRSA will close out the audit once the covered entity attests that all repayments have been resolved (if necessary), and that the CAP has been fully implemented.
- The CE may be required to submit additional documentation, as determined by HRSA, to demonstrate its CAP implementation, including any applicable repayment to manufacturers.
- HRSA may re-audit a CE to assess compliance with 340B Program requirements.
- CEs with a re-audit that identifies the same exact finding of non-compliance, may be subject to additional audits.
- A finding of non-compliance with the diversion prohibition in two or more audits, depending on the nature of the violation, may be considered systematic and egregious, as well as knowing and intentional, which may result in the CE being removed from the 340B Program in accordance with section 340B(d)(2)(B)(v) of the Public Health Service Act. Such a finding may also disqualify the CE from re-entry into the 340B Program for a reasonable period of time.
In October 2014 HRSA sent the following information to grantees:
Grantee Site Visits
Starting in Fiscal Year 2015, grantees that participate in the 340B program and are scheduled for a HRSA site visit will be asked to demonstrate compliance with the 340B program. While the primary focus of the site visit remains on the HRSA grant, several basic questions will serve as an important reminder for grantees of the importance of 340B compliance, as well as a potential trigger for further investigation by the Office of Pharmacy Affairs (OPA). As a result of these site visits, the OPA will also be able to highlight best practices to assist covered entities with compliance. Our goal is to maximize the reach of our program integrity efforts, while ensuring transparency for all stakeholders to understand 340B compliance requirements and site visit expectations.
Take Away: Audits of Covered Entities (CE) and manufacturers have been a statutory requirement since the inception of the 340B Program and are NOT new. However, audits of CE did not begin until FY 2012 and audits of manufacturers did not begin until FY 2015.
Take Away: The primary focus of a grantee site visit is the grant, given that this is the primary focus of 340B eligibility for 340B.
As of the last posting of Integrity Audits on December 3, 2020, HRSA has conducted a total of 294 audits of all types of grantees. Findings were issued in 162 of these audits and 105 of these resulted in repayment to manufacturers.
As we stated above, random audits will first include CEs randomly chosen from program types determined to be at higher program risk due to volume of purchases, increased complexity of program administration and use of contract pharmacies.
Based on this policy the greatest volume of Grantee audits to date has been Federally Qualified Health Centers (FQHCs). Of these audits, 70% have resulted in findings and 48% of the audits resulted in repayment to manufacturers.
Title X Family Planning Clinics, Sexually Transmitted Disease Clinics, and Tuberculosis Clinics were the next most frequently audited grantees.
To date there have been no audits of Native Hawaiian Health Centers or Black Lung Clinics and there have been only 3 audits of Tribal / Urban Indian Health Centers
In September, 2019, HRSA announced that it was evaluating its enforcement authority. Subsequently, HRSA “paused” release of new audit reports from June 2019 – October 2019. However, the audits continued. Following HRAS’s review of its enforcement authority it renewed its request for regulatory authority.
At the 340B Coalition 2020 Summer Virtual Conference, Admiral Krista Pedley, Director of HRSA’s Office of Pharmacy Affairs (OPA) stated: “HRSA’s enforcement ability is limited, as guidance does not provide HRSA appropriate enforcement capability.”This statement came shortly after the U.S. House Appropriations Committee turned down HRSA’s request to give it broad regulatory authority over the 340B program.
Since HRSA’s evaluation of its limited enforcement authority, audits have focused on those areas governed by statute:
- CE eligibility
- Maintaining the accuracy of the OPAIS database. (OPAIS findings have trended downward for FY2020)
- Duplicate discount prevention
- Auditable records
2019 Audit Developments
Trump Administration Executive Order issued in October (EO 13892, October 9, 2019) limits enforcement of guidance for all federal agencies:
- Guidance demonstrates an agency’s understanding of how a statute or regulation applies in a given circumstance.
- Guidance can be cited in enforcement actions only if the agency has notified the public in advance of what is expected.
Examples from Post-June 2019 Audits
- More flexible enforcement of patient definition and Medicare cost report test guidance (hospitals only)
- Case-by-case evaluation
- Fewer posted diversion findings
- Increased number of No adverse findings
- Increased number of Duplicate Discount and Incorrect 340B OPAIS record findings
Take Away: Following HRSA’s evaluation of its enforcement authority, audits have focused on only those areas governed by statute.
Future Covered Entity Audit Expectations
Given HRSA’s announcement that its enforcement is limited to those areas covered by statute, we can expect future audits of CEs to focus on:
- Eligibility of the CE
- Accuracy of the OPAIS database
- Duplicate discount prevention
- Maintenance of auditable records
Future Manufacturer Audits
As we stated above, manufacturers are subject to auditing by HRSA to ensure compliance with the 340B Program, pursuant to section 340B(d)(1)(B)(v) of the PHSA.
Although HRSA began its audits of CE’s in FY 2012, it did not conduct its first manufacturer audit until FY 2015. Since that time, HRSA has conducted only 26 audits of manufacturers with the following results:
- No adverse findings: 16
- Repayment to covered entities: 7
- The first findings did not occur until FY 2018
Take Away: Manufacturers have been audited far less than Covered Entities and audits have resulted in far fewer findings.
How can we explain and justify the number and findings of manufacturers? Have manufacturers been given a “free pass”?
The 340B statute gives the HHS Secretary a number of administrative rights and obligations regarding the 340B program. However, the statute does not give HHS the ability to make rules and regulations with respect to most of these rights or responsibilities. At this time, HRSA is focusing its limited enforcement activity on brazen offenses of the clear language of the 340B statute, as opposed to potential noncompliance with requirements as stated in HRSA’s interpretive guidance that are not clearly mandated in the 340B statute. HRSA has asked Congress for more regulatory authority since fiscal year (FY) 2017. This authority has not been granted.
With the focus now on only those areas included in the 340B statute, can we expect to see changes in HRSA’s statutory authority? With the House of Representatives and the Senate now controlled by the Democrats, how likely is this to happen?
HRSA has been seeking increased statutory authority without success since 2017. In its budget request for fiscal year 2020, HRSA asked the House and Senate Appropriations committees to add language to the coming fiscal year’s health care spending bill giving it general regulatory authority over 340B. In the House Appropriations Committee report that accompanies the spending bill that covers HRSA, the committee acknowledged HRSA’s request for more regulatory power, but the panel noted that HRSA “already has existing oversight authority” it is not using. The committee stated: “The committee is concerned that HRSA is not using their existing oversight authority to pursue balanced oversight of both providers and drug manufacturers,” Note the use of the word “balanced.” It would appear that the House Appropriations Committee has the same concerns about the vast difference between the number of CE audits and manufacturer audits that we mentioned above.
Although the House is still controlled by the Democrats, the Republicans did make significant gains during the November elections. Is this likely to have any significant effect on the House’s position on granting HRSA more 340B regulatory authority? Visante feels this is very much a “wait and see” issue.
Take Away: Grantees should expect to see no change in the number of HRSA 340B compliance audits, although the focus has changed.
Other changes to 340B, including HRSA’s request for increased statutory authority are very much a “wait and see” issue. Visante cautions all CEs to remain vigilant in all aspects of Program compliance, stay tuned and become vocal advocates for the 340B Program.
Federal Register/ Vol. 58, No. ll7/ Friday, May 7, 1993/ Notices
340B DRUG PRICING PROGRAM NOTICE Release No. 2012-1
Government Accountability Office (GAO) September 2011 Report (GAO-11-836),
Office of Pharmacy Affairs Policy Release No. 2011-3 at http://www.hrsa.gov/opa/Docs/PolicyReleaseManufacturerAudits.pdf
HRSA website, Audit Process, April 2020
42 USC 256b(a)(4)(L)(iii)) and 42 USC 256b(a)(5)(A) and (B)
section 340B(d)(1)(B)(v) of the PHSA
Executive Order October 2019 (EO 13892