Q&A with Michael Muir

340B Apexus Certified Expert (ACE)

Peninsula Regional Medical Center

Salisbury, Maryland

Pharmacy Purchasing & Products: How is a facility notified that they have been selected for a 340B audit?

Michael Muir: When a covered entity is chosen to be audited by the Health Resources and Services Administration (HRSA), they will receive an engagement letter from the auditors that will outline what to expect during the audit and how to appropriately prepare. There will also be a teleconference with the entity, in which the auditors will request documents and information related to the covered entity’s 340B program, prior to the onsite portion of the audit.

PP&P: How often should an entity conduct an independent audit?

Muir: The Apexus 340B Prime Vendor Program recommends that a covered entity engage in an independent audit on an annual basis. These independent audits should be performed under similar conditions as a HRSA audit, which allows the entity to experience how a HRSA audit will commence and what documentation may be required, which helps prepare for the actual HRSA audit.

PP&P: What factors most commonly trigger an audit?

Muir: There are some areas of the 340B program that are more likely to put a covered entity in the spotlight for a HRSA audit; these include a significant number of contract pharmacy agreements, multiple registered sites, and the overall complexity of the 340B program. A multifaceted program translates to an increased risk of noncompliance, which is more likely to trigger an audit.

PP&P: What areas of documentation are particularly important to focus on?

Muir: The main areas of documentation that the auditors will focus on include the entity’s Medicare Cost Report, policies and procedures (P&Ps), and the details reported on the Office of Pharmacy Affairs Information System (OPAIS) website (available at: https://340bopais.hrsa.gov/). The Medicare Cost Report provides proof of program eligibility based on the reported disproportionate share and also shows which locations are eligible to dispense 340B drugs. P&Ps should provide an outline of 340B program operations, which the auditors will use to compare to actual program practices. The OPAIS website is used by HRSA and the auditors to understand the size and complexity of the program based on registered sites and contract pharmacy agreements. In addition, auditors will view other areas of the OPAIS website, including the Medicaid Exclusion File, Medicaid billing numbers, and general covered entity information.

PP&P: How should facilities prepare for audits over the long- and short-term?

Muir: Over the long term, it is best practice to schedule an annual independent audit in order to become comfortable with the audit process. It is also critical for a covered entity to select and test a random sample of dispenses of all registered sites and contract pharmacies on a monthly basis. Specific areas to test might include Medicaid dispenses, location eligibility, and provider eligibility. It is best practice to review other 340B program areas, such as the OPAIS website, Medicare Cost Report, and 340B program P&Ps on a periodic basis.

Right before the audit, thoroughly review the P&Ps, as auditors are likely to examine these first to develop a general framework of the entity’s 340B program. A significant portion of the testing performed by the auditors will be based on the P&Ps, so it is imperative that the specific operations of the 340B program match what is outlined in the P&Ps.

PP&P: What should be expected during the onsite portion of a HRSA audit?

Muir: An outline of the onsite process will be sent to the covered entity by the auditors prior to the audit. The general audit process will consist of an introductory meeting, pharmacy walkthrough, review of documents, and audit sample testing. After all testing is complete, the auditors will hold an exit conference. The results of the audit will not be provided to the covered entity by the auditors. Rather, the auditors will submit a preliminary report of the audit results to OPA to review; OPA will then draft a final report including requests for a corrective action plan, if applicable. This post-audit process will be discussed during the exit conference with the auditors.

PP&P: What practices invite risk of duplicate discounts and thus need to be avoided?

Muir: Duplicate discounts occur when a manufacturer provides a discounted 340B price and a Medicaid drug rebate is received for the same drug; covered entities are responsible for implementing safeguards to prevent duplicate discounts from occurring. Depending on whether the entity carves-in or carves-out Medicaid will determine which safeguards are necessary.

For carving-out Medicaid, the entity would need to avoid dispensing 340B drugs to Medicaid patients. When operating under a virtual/WAC-based inventory, this is accomplished by not accumulating to 340B for outpatient drugs dispensed to Medicaid patients. For separate inventories, the entity would need to ensure that the 340B inventory is not dispensed to Medicaid patients.

Carving-in Medicaid is a bit more complex, and requires cooperation between the covered entity and the state Medicaid offices that are billed for covered outpatient drugs. The necessary safeguards are determined by state requirements but will likely require that Medicaid billing numbers are listed on the Medicaid Exclusion File, and possibly that claim modifiers are included on the Medicaid claims. Lack of these safety measures will surely result in duplicate discounts, putting the covered entity at risk of being removed from the 340B program.

Apexus provides resources on specific state requirements for billing Medicaid. In addition, it is best practice to also work directly with the state on Medicaid billing requirements for 340B drug dispenses.

PP&P: Should adverse findings be substantiated, what is typically required in a corrective action plan?

Muir: At the conclusion of the audit, the auditors will forward a preliminary report to OPA for review. OPA will review the preliminary report, draft a Final Report, and issue the report to the covered entity, along with a request for a corrective action plan, if applicable. If the covered entity agrees with the Final Report, a corrective action plan must be submitted to HRSA for approval within 60 calendar days. Once the plan has been approved by HRSA, a full corrective action plan implementation and settlement is expected to be complete within 6 months of the plan’s approval date. The covered entity may be required to submit additional documentation, as determined by HRSA, to demonstrate its corrective action plan implementation, including any applicable repayment to manufacturers.

If the entity disagrees with the Final Report, the entity can notify HRSA in writing within 30 calendar days and provide them with appropriate documentation supporting the entity’s position of disagreement. OPA will review the covered entity’s response and, if appropriate, may reissue the Final Report if changes are made based on the submitted documentation.

PP&P: How should a covered entity respond in the event of adverse findings during an audit?

Muir: Adverse findings, also called Areas for Improvement, are listed in the Final Report. Areas for Improvement are findings noted during the audit that HRSA expects to be corrected by the covered entity; these often involve minor adjustments to contracts or agreements, policy updates, and changes to the information listed on the OPAIS website. Even though these are listed on the Final Report, the covered entity is not required to provide a formal response to HRSA to verify that these changes have been implemented.

PP&P: Are there any recent or upcoming changes to 340B policy that are relevant to program compliance?

Muir: HRSA has made several announcements and policy changes over the last few months in response to the COVID-19 pandemic. One of the more significant changes is the relaxed requirements around covered outpatient drugs purchased on a GPO account. If the covered entity is unable to purchase a covered outpatient drug at 340B or WAC pricing due to shortages, HRSA has stated that1:

. . . a hospital may use a GPO (or GPO private label products). Hospitals do not need to report this information to HRSA under the COVID-19 public health emergency. The covered entity should address these situations in their P&Ps and it must continue to keep auditable records.

This change is intended to relieve some of the stress of product procurement from covered entities, given the abundance of drug shortages of late.

HRSA has also made changes to the OPAIS registration process, specifically making it possible to register outside of the open registration periods. HRSA will evaluate covered entity registration requests on a case-by-case basis. These registered sites will still be required to meet all of the program eligibility requirements, such as patient eligibility, and be listed as reimbursable on the Medicare Cost Report.

NOTE: The responses herein are from the perspective of a Disproportionate Share Hospital entity. Some of the details may not pertain to other covered entity types.

Reference

1. Health Resources and Services Administration website. 340B Drug Pricing Program. COVID-19 Resources. www.hrsa.gov/opa/COVID-19-resources. Accessed May 13, 2020.

Michael Muir is a 340B coordinator at Peninsula Regional Medical Center (PRMC) in Salisbury, Maryland. He holds a Bachelor’s Degree in accounting from Salisbury University and is also a 340B Apexus Certified Expert (ACE). Michael is tasked with the compliance and oversight of all areas of the 340B program at PRMC.