340B Tips for Grantees: Understanding the HRSA Audit Process
By William Wood and Kristin Fox-Smith
Visante provides “Key Takeaways for Grantees,” a series of articles to help newly enrolled Grantees and
Specialty Clinics understand important aspects of the 340B Program and how to attain full compliance
with the Program. These articles can be found with additional resources on Visante’s web site at
visanteinc.com/for-grantees-and-non-hospitals/.
In this article, we would like to cover the important area of Health Resources and Services
Administration (HRSA) audits and the audit process. To begin, let’s review the statutory provision
regarding audits.
From: Federal Register/ Vol. 58, No. ll7/ Friday, May 7, 1993/ Notices
(e) Audit Provision
Each covered entity will be required to retain records of purchases of covered outpatient drugs
under the Agreement and of any claims for reimbursement submitted for such drugs under title
XIX of the Social Security Act. When a covered entity is making purchases through a wholesaler,
it will be required to provide the manufacturer with information necessary to arrange for such
purchases consistent with the terms of the Agreement. A covered entity shall permit the
Secretary and the manufacturer of a covered outpatient drug that is the subject of an
Agreement to audit, at the Secretary's or manufacturer's expense, the records of the entity
that directly pertain to the entity's compliance with the resale or duplicate discount
prohibition .
Audits of Manufacturers
Under section 340B(a)(1) of the Public Health Service Act, manufacturers of covered outpatient
drugs that participate in the 340B Drug Pricing Program (340B Program) must offer all covered
outpatient drugs at no more than the 340B ceiling price to a covered entity listed on HRSA’s
public 340B database if such drug is made available to any other purchaser at any price.
Manufacturers are subject to auditing by HRSA to ensure compliance with the 340B Program,
pursuant to section 340B(d)(1)(B)(v) of the PHSA. Failure to comply with 340B pricing
requirements may make the manufacturer liable to covered entities for refunds of overpriced
340B drugs.
HRSAS’s audit policy is further detailed in:
340B DRUG PRICING PROGRAM NOTICE Release No. 2012-1, Date: March 5, 2012
CLARIFICATION OF HRSA AUDITS OF 340B COVERED ENTITIES
HRSA and manufacturers have had the authority to audit covered entities regarding their
compliance with diversion of drugs and duplicate discounts since the inception of the 340B
Program. As stated in the Government Accountability Office (GAO) September 2011 Report
(GAO-11-836), the GAO recommended HRSA conduct selective audits of 340B covered entities
to provide additional program oversight, monitor for program violations and prevent diversion
and duplicate discounts. HRSA has recently begun audits of 340B covered entities as part of its
efforts toward strengthening program integrity and oversight
Audit Standards
HRSA has developed a program-specific audit process for its 340B compliance audits. 340B compliance
audits are conducted by highly trained auditors in accordance with this process. Unlike other statutorily
authorized programs, the 340B statute does not require HRSA to use Generally Accepted Government
Auditing Standards (GAGAS) for 340B Program audits.
HRSA has contracted with the Bizzell Group, LLC to perform audits of 340B CEs starting in fiscal year
2017, which began Oct. 1. Audits of 340B covered entities, which began in January 2012, were
previously conducted by auditors within HRSA.
Audit Number, Duration, and Scope
Only one audit of a CE will be permitted at any one time. When HRSA has received a request from a
manufacturer to conduct an audit, HRSA will determine whether an audit should be performed by the
Government or the manufacturer.
HRSA states that audits will be performed in the minimum time necessary with the minimum intrusion
on the CE’s operation.
HRSA’s 340B Program audits review covered entity compliance with respect to eligibility status,
including compliance with the Group Purchasing Organization (GPO) prohibition as applicable (GPO
Prohibition does not apply to grantees).
Audit Process
The process consists of a Pre-Audit, during which a CE is notified by an engagement letter explaining
what to expect and how to appropriately prepare. The auditors conduct an introductory teleconference
with the CE to request and obtain specified documents, including policies, procedures and internal
controls. Auditors work with the CE to schedule an opening meeting with key CE management to discuss
expectations for the onsite audit.
Following the Pre-Audit call, HRSA auditors conduct either an on-site (temporarily on hold due to the
pandemic) or virtual audit that will include, at a minimum:
▪ Review of relevant policies and procedures and how they are operationalized
▪ Verification of eligibility, including GPO (as applicable) and outpatient clinic eligibility
▪ Verification of internal controls to prevent diversion and duplicate discounts, including
How the CE defines whether a patient is considered inpatient or outpatient
▪ HRSA Medicaid Exclusion File designations, and
▪ accuracy of CE’s 340B OPAIS record.
▪ Review of 340B Program compliance at CE outpatient or associated facilities, and
contract pharmacies, and
▪ testing of 340B drug transaction records on a sample basis.
Auditors collect the facts throughout the audit but are not authorized to summarize any findings to the
CE. Their report to OPA will contain the facts as they understand it and must undergo OPA review.
Additionally, any auditor statements made during the audit are not considered final and are subject to
change.
The actual audit is followed by a Post-Audit process during which:
▪ Auditors forward a preliminary report to OPA for review.
▪ OPA reviews the preliminary report, drafts a Final Report and issues the report to the CE
with a request for a corrective action plan (CAP), if applicable.
Following the Post-Audit, a Notice and Hearing includes:
▪ A Final Report. The CE has 30 calendar days from the date of the HRSA Final Report to
review findings noted in the HRSA Final Report and to review HRSA’s request for a CAP
related to the findings noted.
▪ If a CE agrees with the Final Report, a CE must submit a CAP to HRSA within 60 calendar
days for HRSA’s approval. If a CE is submitting disagreement with the audit findings, the
CE should not submit a CAP until HRSA’s review of the disagreement is complete. When
HRSA’s review of the disagreement is complete, HRSA will request a CAP at that time, if
one is still required.
▪ If a CE disagrees with the Final Report, it must notify HRSA in writing within 30 calendar
days with appropriate supporting documentation of the CE’s disagreement. OPA reviews
the CE’s response and, if appropriate, may reissue the Final Report if changes are made
based on documentation submitted.
▪ If a CE fails to submit a CAP, it may be removed from the 340B Program.
▪ Once an audit report is finalized by OPA, the findings and any associated corrective
action will be summarized on the OPA public website.
If a Corrective Action Plan Implementation and Repayment are required:
▪ Unless otherwise approved by HRSA, full CAP implementation and settlement with
manufacturers is expected to be complete within six months of the CAP approval date.
▪ CEs unable to meet this expectation may be subject to termination from the 340B
Program.
▪ For audits beginning after October 1, 2015, CEs will no longer be required to post a
public letter to manufacturers on HRSA’s website. Instead, HRSA will post a notice on its
website to alert manufacturers to the extent that violations have occurred. This notice
will include findings of the 340B Program audit requiring repayment and CE contact
information for manufacturers to utilize. CEs are responsible for identifying and
contacting all affected manufacturers to notify them of 340B Program violations and to
discuss a method for possible repayment.
▪ HRSA will close out the audit once the covered entity attests that all repayments have
been resolved (if necessary), and that the CAP has been fully implemented.
▪ The CE may be required to submit additional documentation, as determined by HRSA, to
demonstrate its CAP implementation, including any applicable repayment to
manufacturers.
▪
▪
▪
HRSA may re-audit a CE to assess compliance with 340B Program requirements.
CEs with a re-audit that identifies the same exact finding of non-compliance, may be
subject to additional audits.
A finding of non-compliance with the diversion prohibition in two or more audits,
depending on the nature of the violation, may be considered systematic and egregious,
as well as knowing and intentional, which may result in the CE being removed from the
340B Program in accordance with section 340B(d)(2)(B)(v) of the Public Health Service
Act. Such a finding may also disqualify the CE from re-entry into the 340B Program for a
reasonable period of time.
In October 2014 HRSA sent the following information to grantees:
Grantee Site Visits
Starting in Fiscal Year 2015, grantees that participate in the 340B program and are scheduled for a HRSA
site visit will be asked to demonstrate compliance with the 340B program. While the primary focus of
the site visit remains on the HRSA grant, several basic questions will serve as an important reminder for
grantees of the importance of 340B compliance, as well as a potential trigger for further investigation by
the Office of Pharmacy Affairs (OPA). As a result of these site visits, the OPA will also be able to highlight
best practices to assist covered entities with compliance. Our goal is to maximize the reach of our
program integrity efforts, while ensuring transparency for all stakeholders to understand 340B
compliance requirements and site visit expectations.
Take Away: Audits of Covered Entities (CE) and manufacturers have been a statutory requirement since
the inception of the 340B Program and are NOT new. However, audits of CE did not begin until FY 2012
and audits of manufacturers did not begin until FY 2015.
Take Away: The primary focus of a grantee site visit is the grant, given that this is the primary focus of
340B eligibility for 340B.
Grantee Audits
As of the last posting of Integrity Audits on December 3, 2020, HRSA has conducted a total of 294 audits
of all types of grantees. Findings were issued in 162 of these audits and 105 of these resulted in
repayment to manufacturers.
As we stated above, random audits will first include CEs randomly chosen from program types
determined to be at higher program risk due to volume of purchases, increased complexity of program
administration and use of contract pharmacies.
Based on this policy the greatest volume of Grantee audits to date has been Federally Qualified Health
Centers (FQHCs). Of these audits, 70% have resulted in findings and 48% of the audits resulted in
repayment to manufacturers.
Title X Family Planning Clinics, Sexually Transmitted Disease Clinics, and Tuberculosis Clinics were the
next most frequently audited grantees.
To date there have been no audits of Native Hawaiian Health Centers or Black Lung Clinics and there
have been only 3 audits of Tribal / Urban Indian Health Centers
Recent Trends
In September, 2019, HRSA announced that it was evaluating its enforcement authority. Subsequently,
HRSA “paused” release of new audit reports from June 2019 – October 2019. However, the audits
continued. Following HRAS’s review of its enforcement authority it renewed its request for regulatory
authority.
At the 340B Coalition 2020 Summer Virtual Conference, Admiral Krista Pedley, Director of HRSA’s Office
of Pharmacy Affairs (OPA) stated: “HRSA’s enforcement ability is limited, as guidance does not provide
HRSA appropriate enforcement capability.” This statement came shortly after the U.S. House
Appropriations Committee turned down HRSA’s request to give it broad regulatory authority over the
340B program.
Since HRSA’s evaluation of its limited enforcement authority, audits have focused on those areas
governed by statute:
▪ CE eligibility
▪ Maintaining the accuracy of the OPAIS database. (OPAIS findings have trended downward for
FY2020)
▪ Duplicate discount prevention
▪ Auditable records
2019 Audit Developments
Trump Administration Executive Order issued in October (EO 13892, October 9, 2019) limits
enforcement of guidance for all federal agencies:
• Guidance demonstrates an agency’s understanding of how a statute or regulation applies in a
given circumstance.
• Guidance can be cited in enforcement actions only if the agency has notified the public in
advance of what is expected.
Examples from Post-June 2019 Audits
• More flexible enforcement of patient definition and Medicare cost report test
guidance (hospitals only)
• Case-by-case evaluation
▪ Fewer posted diversion findings
▪ Increased number of No adverse findings
▪ Increased number of Duplicate Discount and Incorrect 340B OPAIS record findings
Take Away: Following HRSA’s evaluation of its enforcement authority, audits have focused on only
those areas governed by statute.
Future Covered Entity Audit Expectations
Given HRSA’s announcement that its enforcement is limited to those areas covered by statute, we can
expect future audits of CEs to focus on:
▪ Eligibility of the CE
▪ Accuracy of the OPAIS database
▪ Duplicate discount prevention
▪ Maintenance of auditable records
Future Manufacturer Audits
As we stated above, manufacturers are subject to auditing by HRSA to ensure compliance with the 340B
Program, pursuant to section 340B(d)(1)(B)(v) of the PHSA.
Although HRSA began its audits of CE’s in FY 2012, it did not conduct its first manufacturer audit until FY
2015. Since that time, HRSA has conducted only 26 audits of manufacturers with the following results:
▪ No adverse findings: 16
▪ Repayment to covered entities: 7
▪ The first findings did not occur until FY 2018
Take Away: Manufacturers have been audited far less than Covered Entities and audits have resulted
in far fewer findings.
How can we explain and justify the number and findings of manufacturers? Have manufacturers been
given a “free pass”?
Future Expectations
The 340B statute gives the HHS Secretary a number of administrative rights and obligations regarding
the 340B program. However, the statute does not give HHS the ability to make rules and regulations
with respect to most of these rights or responsibilities. At this time, HRSA is focusing its limited
enforcement activity on brazen offenses of the clear language of the 340B statute, as opposed to
potential noncompliance with requirements as stated in HRSA's interpretive guidance that are not
clearly mandated in the 340B statute. HRSA has asked Congress for more regulatory authority since
fiscal year (FY) 2017. This authority has not been granted.
With the focus now on only those areas included in the 340B statute, can we expect to see changes in
HRSA’s statutory authority? With the House of Representatives and the Senate now controlled by the
Democrats, how likely is this to happen?
HRSA has been seeking increased statutory authority without success since 2017. In its budget request
for fiscal year 2020, HRSA asked the House and Senate Appropriations committees to add language to
the coming fiscal year’s health care spending bill giving it general regulatory authority over 340B.
In the House Appropriations Committee report that accompanies the spending bill that covers HRSA, the
committee acknowledged HRSA’s request for more regulatory power, but the panel noted that HRSA
“already has existing oversight authority” it is not using. The committee stated: “The committee is
concerned that HRSA is not using their existing oversight authority to pursue balanced oversight of both
providers and drug manufacturers,” Note the use of the word “balanced.” It would appear that the
House Appropriations Committee has the same concerns about the vast difference between the number
of CE audits and manufacturer audits that we mentioned above.
Although the House is still controlled by the Democrats, the Republicans did make significant gains
during the November elections. Is this likely to have any significant effect on the House’s position on
granting HRSA more 340B regulatory authority? Visante feels this is very much a “wait and see” issue.
Take Away:
Grantees should expect to see no change in the number of HRSA 340B compliance audits, although the
focus has changed.
Other changes to 340B, including HRSA’s request for increased statutory authority are very much a “wait
and see” issue. Visante cautions all CEs to remain vigilant in all aspects of Program compliance, stay
tuned and become vocal advocates for the 340B Program.
References:
Federal Register/ Vol. 58, No. ll7/ Friday, May 7, 1993/ Notices
340B DRUG PRICING PROGRAM NOTICE Release No. 2012-1
Government Accountability Office (GAO) September 2011 Report (GAO-11-836),
Office of Pharmacy Affairs Policy Release No. 2011-3 at
http://www.hrsa.gov/opa/Docs/PolicyReleaseManufacturerAudits.pdf
HRSA website, Audit Process, April 2020
42 USC 256b(a)(4)(L)(iii)) and 42 USC 256b(a)(5)(A) and (B)
section 340B(d)(1)(B)(v) of the PHSA
Executive Order October 2019 (EO 13892