Prior to the audit, the Human Resources and Services Administration (HRSA) will send the covered entity a request for a large amount of information—usually about six months’ worth of data from a period in the year prior to the date of the audit. Typically, the information requested includes claims data, policies and procedures, a list of all locations where 340B drugs are used, and possibly the contracts with all contract pharmacies. After this information is received by HRSA, the auditor will select a number of the claims (usually between 30 and 90) and then visit the hospital to review the patient records associated with those claims to ensure that the 340B requirements were met. In addition, the auditor will verify that the correct Medicaid billing information and number were sent to the government to ensure no duplicate discounts were created. HRSA also will examine inventory management procedures to ensure that processes are in place to keep 340B charges separate from other charges and that replenishment occurs only on an NDC to NDC basis.

Some auditors will request a tour of the facility, while others will not. They also may request a visit to one of your contract pharmacy locations to witness its 340B management practices and interview the staff there. It is important for the covered entity to have a good understanding of the contract pharmacy arrangement, including how the contract pharmacy is audited to ensure 340B compliance. HRSA would like covered entities to use an outside group to audit contract pharmacies on an annual basis, and while this is not required, it demonstrates HRSA’s high expectation that covered entities make a significant investment in contract pharmacy compliance. 

Auditors will be on the lookout for several additional hot-button issues: 

• All child sites (ie, offsite clinics and departments) must be registered properly. This is a complex area, as HRSA issued an FAQ in 2011 that made significant changes to the offsite clinic registration rules. Starting in 2012, HRSA audits have revealed that some hospitals were not aware of this change, and had an offsite building registered as a single site (which was compliant under the old rule) instead of registering each individual clinic housed in that building (as required under the new rule). Under current guidance, if an offsite building houses five clinics, the hospital must separately register each of those five clinics.
• The auditor will verify that all contract pharmacy locations are registered and that all those registered are currently functioning as contract pharmacies. It is not uncommon for hospitals to terminate a relationship with a contract pharmacy and neglect to inform HRSA, so they remain on the government Web site. 
• The auditor will review how patients are tracked within the covered entity to ensure that upon admission, 340B drugs are no longer provided. For example, an individual in the emergency department is eligible for 340B drugs as an outpatient, but once admitted, that patient becomes ineligible. 
• Another issue of concern is ensuring that both the patient and the health care provider have the proper relationship with the hospital. In other words, a physician that works in both the hospital and a private office cannot write prescriptions out of the private office for individuals who have never received a hospital service and then have the hospital fill the prescriptions with 340B drugs. The hospital must be able to demonstrate that it has the appropriate relationship with the health care provider and the patient, and that the hospital is, in fact, responsible for the patient’s care.

During an audit, be sure your facility’s medical records staff is available for the length of the audit, as a large amount of the auditor’s time will be spent reviewing a sample of claims. Access to patient records must be prioritized throughout the audit. 

Following an audit, it can take months, or even  over a year, for HRSA to issue its preliminary audit results. If there are findings, the covered entity must respond to HRSA in writing to either challenge or agree with those findings. A few months later, the covered entity will receive the final audit report. If those findings remain at this final stage, and the covered entity chooses not to challenge the findings, the covered entity is required to prepare a corrective action plan (CAP). The CAP must explain how the covered entity will ensure the behavior underlying the finding does not reoccur. In situations in which the hospital improperly received a 340B discount, the covered entity must outline how it will contact the manufacturer to discuss repayment. If the covered entity disagrees with the findings, another challenge must be submitted. We are aware of HRSA agreeing to reverse findings at both the preliminary and final stages.

Maureen Testoni is General Counsel of Safety Net Hospitals for Pharmaceutical Access (SNHPA), which represents hospitals and health systems enrolled in the 340B program. Maureen oversees a team of attorneys that works to influence law and policy regarding the 340B program. With extensive experience in health care regulatory law and policy, she provides assistance to hospitals on 340B implementation and compliance matters, as well as policy guidance. Maureen received her law degree from The George Washington University National Law Center, with honors, and her BA in public policy from the University of Chicago. She is a member of the DC and Virginia bars.