What Is the 340B Drug Pricing Program?
Section 340B of the Public Health Services Act, enacted in 1992, entitles certain safety-net hospitals and clinics, referred to as “covered entities,” to purchase outpatient drugs at discounted prices from drug manufacturers. Companion legislation that amended Section 1927 of the Social Security Act requires drug manufacturers to enter into a Pharmaceutical Pricing Agreement (PPA) with the U.S. Department of Health & Human Services (HHS) to provide such drugs at or below a statutorily defined ceiling price as a condition of the manufacturers’ drugs being reimbursable under the Medicaid program and Medicare Part B. These two pieces of legislation launched a new federal program that is known today as the “340B program.” The intent of the 340B program is to allow covered entities serving vulnerable populations to “stretch scarce federal resources as far as possible, reaching more eligible patients and providing more comprehensive care.”
The 340B program is administered by the Office of Pharmacy Affairs (OPA), which is a division of the Health Resources and Services Administration (HRSA) of HHS. HRSA also relies on a government contractor to help administer the 340B program. The government contractor, which is currently Apexus, Inc. (Apexus), is the 340B prime vendor and responsible for operating a program that provides a range of services to covered entities, including distribution of 340B drugs and negotiation of purchasing terms for both 340B and non-340B products. The 340B prime vendor is also responsible for staffing a call center and providing education, training, and technical assistance to the broader 340B stakeholder community.
This article provides a high-level overview of the requirements and compliance issues applicable to covered entities as well as resources available to covered entities for meeting their 340B program obligations. It also briefly discusses 340B program requirements applicable to manufacturers.
Risk Area Governance
Most of the 340B program’s compliance requirements applicable to covered entities and manufacturers are set forth in the 340B statute. Congress gave HRSA rulemaking authority to implement program requirements but only in three narrow areas: (1) the establishment of an administrative dispute resolution process; (2) the development of a methodology for calculating ceiling prices; and (3) the imposition of manufacturer civil monetary penalties. HRSA has adopted regulations in each of these areas. Because HRSA has limited regulatory authority, many of HRSA’s policies governing covered-entity compliance with the 340B program are published in guidance documents and frequently asked questions (FAQs) issued by HRSA and Apexus.
The 340B statute imposes not only general compliance responsibilities on all covered entities, but also more specific requirements that are unique to certain categories of covered entities. The general compliance obligations include the following:
Prohibition against reselling 340B drugs to anyone other than the covered entity’s patients, a practice commonly known as “diversion.”
Obligation of the covered entity to protect a manufacturer from “duplicate discounts” which occurs when a company gives both a 340B discount and Medicaid rebate on the same drug.
Requirement that the covered entity maintains auditable records of its 340B program activities.
Covered entities are also responsible for complying with OPA’s Information System (OPAIS) registration requirements, ensuring the accuracy and completeness of information submitted to and contained in OPAIS, and certifying to the accuracy of the information on OPAIS annually. Compliance obligations that are specific to certain types of covered entities include (1) the prohibition against purchasing drugs through a group purchasing organization (GPO), which only applies to disproportionate share hospitals (DSHs) and children’s and cancer hospitals, and (2) the prohibition against purchasing orphan drugs, which only applies to sole community hospitals (SCHs), critical access hospital (CAHs), rural referral center (RRCs), and cancer hospitals. 
340B Program Eligibility
Only certain categories of safety-net providers are eligible to participate in the 340B program under the 340B statute. A drug company’s eligibility to participate in the program, by contrast, extends to any manufacturer willing to enter into and comply with a PPA with HHS. This section outlines the eligibility requirements applicable to both covered entities and manufacturers.
Eligibility and Registration of Covered Entities and Their Contract Pharmacies
Discounted pricing on drugs purchased through the 340B program is only available to safety-net providers that qualify for and register in the program. Although only covered entities are eligible to purchase 340B drugs, they are entitled to dispense their discounted drugs through any pharmacy willing to contract with the covered entity and to abide by 340B program requirements and terms of the contract. The requirements applicable to a covered entity’s eligibility, registration, and contract pharmacy arrangements include the following.
Prior to 2010, participation in the 340B program was statutorily limited to the following categories of healthcare entities:
Federally qualified health centers (FQHCs) and FQHC look-alikes (FQHC-LAs)
Native Hawaiian health centers
Tribal/urban Indian health centers
Ryan White HIV/AIDS program grantees
Disproportionate share hospitals (DSH)
Black lung clinics
Comprehensive hemophilia diagnostic treatment centers
Title X family planning clinics
AIDS drug-assistance programs
Sexually transmitted disease (STD) clinics
In 2010, Congress expanded the list of eligible covered entities when it included in the Affordable Care Act (ACA) five additional categories of hospitals:
Sole community hospitals (SCHs)
Rural referral centers (RRCs)
Critical access hospitals (CAHs)
Hospitals are the largest purchasers of 340B drugs and comprise the largest share of covered entity sites participating in the 340B program. To be eligible, hospitals must satisfy an array of requirements that vary depending on the category in which they fall. For example, with the exception of CAHs, every hospital must have a payer mix that, when used to calculate its reimbursement adjustment through the Medicare DSH program, generates an adjustment percentage that meets or exceeds a threshold set forth in the 340B statute. DSH, children’s hospitals, and cancer hospitals must have a DSH adjustment percentage that exceeds 11.75%. SCHs and RRCs must have a DSH adjustment percentage of at least 8%. 
(Please note: The DSH payment percentage is not the same as the DSH patient percentage. A hospital must have a DSH patient percentage of (1) .2733 to have a DSH adjustment percentage of at least 11.75% and (2) .2277 to have a DSH adjustment percentage of at least 8%. If a hospital’s DSH adjustment percentage falls below the requisite level based on its most recently filed Medicare cost report, it must notify HRSA and stop purchasing 340B drugs immediately.)
Hospitals are also subject to organizational standards. A 340B hospital must be (1) owned or operated by a state or local government; (2) a private nonprofit organization under contract with a unit of state or local government to provide healthcare services to low-income individuals who are not Medicare or Medicaid beneficiaries; or (3) a public or private nonprofit corporation that is formally granted governmental powers by a unit of state or local government.  Another condition of eligibility for DSH, children’s hospitals, and cancer hospitals is that they are prohibited from obtaining covered outpatient drugs through a GPO or other group purchasing arrangement.
Nonhospital covered entities are subject to far fewer eligibility requirements under the 340B statute. With the exception of FQHC-LAs, they are eligible to participate in the program simply as a result of receiving federal funding under one of the federal grant programs enumerated in the statute. FQHC-LAs meet all the federal requirements applicable to FQHCs but, unlike FQHCs, are not federally funded. STD clinics may also be eligible to participate by virtue of receiving an “in-kind,” or nonmonetary, contribution that is funded under Section 318 of the Public Health Service Act. If a grantee loses its grant or if an FQHC-LA no longer qualifies as an FQHC-LA, the grantee must immediately notify HRSA and stop purchasing 340B drugs. Importantly, 340B grantees and subgrantees may only purchase and use 340B drugs within the scope of their qualifying federal grant.
Entities eligible to participate in the 340B program must first register through HRSA’s 340B Office of Pharmacy Affairs Information System (OPAIS). OPAIS provides a listing of and information about covered entities that are eligible to purchase 340B drugs. During registration, covered entities must attest that their entries in OPAIS are complete and accurate. 
HRSA requires covered entities to register for the 340B program during one of four registration periods available each year. The registration periods are:
January 1–15 for an effective start date of April 1
April 1–15 for an effective start date of July 1
July 1– 15 for an effective start date of October 1
October 1–15 for an effective start date of January 1
A hospital must register its main facility as well as all outpatient departments located outside of the “four walls” of the main facility that will be dispensing, administering, or prescribing 340B drugs.  OPA refers to these clinics as “child sites.” HRSA will not register these child sites on OPAIS until the costs and charges for the sites appear on a filed Medicare cost report. However, hospitals may begin using 340B drugs at new outpatient department sites that are eligible to participate in the 340B program but are not yet reflected on a filed Medicare cost report. The 340B registration requirements applicable to federal grantees and subgrantees are similar to the hospital requirements. If a grantee or FQHC-LA operates more than one service location that uses 340B drugs, it must register each location on OPAIS.
Contract Pharmacy Program
When Congress created the 340B program, it did not consider that some covered entities—especially FQHCs, Ryan White and STD clinics, and other smaller facilities—would be unable to participate because they lacked pharmacies capable of purchasing and dispensing 340B drugs. Soon after the 340B program began, these facilities expressed concerns to OPA over the cost and expertise required to build and operate an in-house pharmacy. They feared that these costs would offset the benefits of participating in the program. They began pressuring OPA to find a way for them to participate without having to incur the start-up and overhead costs of running their own pharmacies.
In 1996, HRSA responded to these complaints by publishing guidelines that allowed covered entities to use third-party contract pharmacies to dispense their 340B drugs. Under the 1996 guidelines, a covered entity could enter into a “ship to, bill to” arrangement with a pharmacy contractor in which manufacturers would bill the covered entity for the 340B drugs that the entity purchases, but ship the drugs to the pharmacy with which the entity contracts. Patients of the covered entity could then receive the 340B drugs from the entity’s contract pharmacy, although the pharmacy would not be entitled to dispense the discounted drugs to its other customers. Though the contract-pharmacy program was primarily intended for covered entities that did not own and operate their own outpatient pharmacies, all covered entities were permitted to enter into a contract-pharmacy arrangement.
HRSA initially only permitted covered entities to work with a single contract pharmacy. However, on March 5, 2010, HRSA expanded the contract-pharmacy program by allowing covered entities to contract with an unlimited number of pharmacies. HRSA’s 2010 guidelines also increased covered entities’ responsibility to monitor compliance of their contract pharmacy arrangements.
Because contract pharmacies are retail pharmacies that are not part of the same legal entity as the covered entity and are not covered entities themselves, they must be registered in the OPAIS under the covered entity’s registration. Contract pharmacies act as agents of the covered entity by dispensing drugs to the covered entity’s patients. The contract pharmacy typically orders, receives, and dispenses 340B drugs, but only in its capacity as the covered entity’s agent. The contract pharmacy also bills insurers, collects reimbursement, and maintains 340B drug inventories on behalf of the covered entity.
As previously mentioned, manufacturer participation in the 340B program is subject to fewer eligibility requirements. Section 1927 of the Social Security Act states that a manufacturer’s drugs will not be covered by Medicaid or Medicare Part B unless the manufacturer signs a PPA with HHS. The PPA requires the drug manufacturer to provide 340B covered entities with “covered outpatient drugs for purchase at or below the applicable ceiling price if such drug is made available to any other purchaser at any price.” Manufacturers must offer these discounted prices without any restrictions with respect to where the covered entity requests that they be delivered, including to contract pharmacies. Manufacturers, like covered entities, must register in OPAIS and keep their OPAIS entries up-to-date and accurate.
The 340B statute prohibits a covered entity from reselling or otherwise transferring 340B drugs to any person or entity other than its “patient.” There is no definition of “patient” in the statute. Because covered entities are only entitled to 340B discounts on “covered outpatient drugs,” administration of 340B drugs to a hospital inpatient is also considered diversion even though an inpatient is as much a hospital “patient” as an outpatient.
In 1996, HRSA issued patient definition guidance that describes which individuals are eligible to receive 340B drugs. Under the guidance, an individual must satisfy three criteria in order to be eligible to receive discounted drugs, although the third criterion only applies to the grantees and subgrantees. First, the covered entity must maintain records of the individual’s healthcare. Second, the individual must be under the care of a physician or other healthcare professional who is employed by, under contract with, or in a referral relationship with the covered entity such that responsibility for the individual’s care remains with the covered entity. Third, the individual must receive a healthcare service or range of services that are consistent with the service or range services for which grant funding or FQHC-LA status has been provided to the covered entity. An individual is not eligible to receive discounted drugs if the only healthcare service received by the individual from the covered entity is the dispensing of a drug for self-administration or administration in the home setting.
Historically, in applying the patient definition guidance to prescriptions for self-administered drugs, HRSA has required that the prescription be written as the result of services provided within an OPAIS-registered location. However, based on a decline in the number of diversion findings in recent HRSA audits and HRSA’s decision in 2019 to withdraw its diversion finding against an FQHC that challenged the finding in court, it appears that HRSA is taking a more lenient approach to identifying 340B eligible prescriptions. With respect to infusion and injectable products, often referred to as “physician-administered drugs,” HRSA has consistently permitted covered entities to use the 340B program for such drugs if the covered entity administers the drug within the covered entity’s registered facility, even if the drug is ordered by an outside prescriber.
Under section 1927 of the Social Security Act, drug manufacturers are required to give rebates to state Medicaid programs on covered outpatient drugs reimbursed either through a state’s fee-for-service (FFS) program or by a managed care organization (MCO) under contract with the state. The obligation to pay a rebate, however, is lifted if the rebatable drug was sold at a 340B discount. Manufacturer protection against duplicate discounts differs depending on whether the drug is reimbursed on an FFS basis or by an MCO. With respect to FFS drugs, the obligation to protect against duplicate discounts is set forth in the 340B statute and placed squarely on the shoulders of the covered entity. Protection against MCO duplicate discounts, on the other hand, is addressed in the Medicaid drug rebate statute and is the responsibility of states.
The Medicaid MCO duplicate discount problem did not arise until Congress decided to expand the Medicaid drug rebate program to include MCO drugs in 2010 under the ACA. The language used to expand the program—which was added to section 1927 of the Social Security Act, not the 340B statute—includes a provision stating that such drugs are not subject to a Medicaid rebate if they are purchased under Section 340B. Thus, the duplicate discount provision in the 340B statute does not apply to MCO drugs because, under the Medicaid drug rebate statute, the drugs are not “subject to the payment of a rebate to the State.” Manufacturers are protected from duplicate discounts on MCO drugs because the drugs purchased through the 340B program are categorically ineligible for Medicaid drug rebates.
Carve In/Carve Out Election and Use of the Medicaid Exclusion File
HRSA allows covered entities to decide whether they will use 340B drugs for Medicaid FFS beneficiaries. A covered entity’s decision to use 340B drugs for its Medicaid population is generally referred to as “carving in,” whereas excluding drugs for Medicaid beneficiaries from the covered entity’s 340B program is called “carving out.” Covered entities are required to keep HRSA informed of their election. They must answer “yes” or “no” to the question on OPAIS regarding whether they will use 340B drugs for Medicaid beneficiaries. Shortly after the 340B program was launched, HRSA created the Medicaid Exclusion File (MEF) as a tool for documenting a covered entity’s decision to carve in or carve out. Covered entities that carve in are listed on the MEF, along with their Medicaid billing numbers and national provider identifiers (NPIs). In addition to affording state Medicaid programs and drug manufacturers visibility into a covered entity’s decision to use 340B drugs for its FFS Medicaid patients, the MEF actually protects against duplicate discounts because state Medicaid programs are prohibited from seeking rebates for claims submitted under the NPIs and billing numbers reflected in the MEF. In 2014, HRSA clarified that the MEF is not intended to provide information about whether a covered entity dispenses or administers 340B drugs to beneficiaries enrolled with a Medicaid MCO.
A covered entity has less discretion to carve in its Medicaid FFS drugs when those drugs are dispensed by a contract pharmacy. Under HRSA’s contract-pharmacy guidelines, covered entities may not use 340B drugs to fill FFS Medicaid prescriptions at contract pharmacies, unless (1) the covered entity, state Medicaid agency, and contract pharmacy have an arrangement in place to prevent duplicate discounts and (2) the covered entity has reported the arrangement to HRSA. Nothing in the guidelines, however, precludes them from carving in FFS claims at their in-house retail pharmacies.
Many state Medicaid agencies have regulations or policies governing identification of 340B claims for both FFS and MCO beneficiaries. For example, some states require that a covered entity’s “carve in” or “carve out” election be the same for Medicaid FFS and Medicaid MCO beneficiaries, and they use the MEF to determine whether a covered entity has elected to carve in or carve out for both categories of beneficiaries. Other states require the covered entity to identify 340B drug claims by use of a claims-level modifier, typically either the UD modifier for 340B physician-administered drug claims or a value of 20 in the submission clarification code field for self-administered drug claims. These requirements generally are found in a Medicaid state plan, regulations, or guidance issued by the state Medicaid agency or in Medicaid MCO contracts.
DSH, children’s hospitals, and cancer hospitals are prohibited from obtaining covered outpatient drugs through a GPO or other group purchasing arrangement. Because the GPO prohibition is an eligibility requirement, noncompliance can expose the hospital to a risk of being terminated from the program. The GPO prohibition only applies to purchases of “covered outpatient drugs,” which means a hospital subject to the GPO prohibition may use a GPO to purchase inpatient drugs or drugs that otherwise fall outside the definition of a “covered outpatient drug.”
HRSA has recognized several exceptions to the GPO prohibition. For example, hospitals subject to the GPO prohibition may take advantage of the discounts that Apexus has negotiated through the prime vendor program even though the prime vendor program clearly operates as a “group purchasing arrangement” if not a GPO. HRSA also gives hospitals a fair amount of discretion in excluding certain drugs—primarily those that are billed with services and not as separate claims—from the definition of a “covered outpatient drug” so that they can be purchased at GPO prices. Another exception is available if the hospital is initially unable to obtain a covered outpatient drug at a 340B price. In those instances, the hospital must work with the manufacturer to try to obtain 340B pricing and, if unsuccessful, purchase the drug at a non-340B, non-GPO price which, according to HRSA, is the drug’s wholesale acquisition cost (WAC). If the hospital cannot obtain the drug on its WAC account, it may then purchase the drug through a GPO. In these instances, the hospital must immediately notify OPA of the details of its prior attempts, communications, and the transaction—all of which must be properly documented and auditable.
Lastly, HRSA established a widely publicized policy release in 2013 that allowed the offsite locations of 340B hospitals to opt out of the 340B program, including the program’s prohibition against group purchasing. According to the policy release, hospitals subject to the GPO prohibition may elect not to use 340B and instead use GPO drugs at outpatient facilities that meet the following four requirements:
The facility is located at a different physical address than the parent facility.
The facility is not registered on the OPAIS as participating in the 340B program.
The facility purchases drugs through a separate pharmacy wholesaler account than the 340B participating parent.
The hospital maintains records demonstrating that any covered outpatient drugs purchased through the GPO at the facility sites are not used or otherwise transferred to the parent hospital or any outpatient facilities registered in the OPAIS.
It is important to note that contract pharmacies may purchase their own drug inventory through a GPO; however, those drugs should not be dispensed to patients of a hospital subject to the GPO prohibition if they are purchased on behalf of the hospital. Stated differently, a hospital may not try to circumvent the GPO prohibition by purchasing GPO drugs through a contract pharmacy for its patients.
OPAIS Data Errors
HRSA requires that the information included in a covered entity’s OPAIS listing be accurate and complete. Inaccurate or incomplete database entries can result in an adverse audit finding. As discussed previously, covered entities can register additional locations during four registration periods available each year. In between those periods, covered entities can request changes to the information in the OPAIS. Covered entity medical practices that share a common building or street address must include suite numbers to help distinguish between them. Failure to separately list clinics, departments, and service lines can also lead to an OPAIS database finding.
Another risk area relates to contract pharmacy registration data. When a covered entity registers a contract pharmacy, OPAIS pulls information from the pharmacy’s Drug Enforcement Agency (DEA) records to ensure that it matches the information submitted on OPAIS. That information is then crosschecked against the pharmacy services agreement between the covered entity and contract pharmacy during a HRSA audit. Discrepancies can result in an audit finding or area for improvement.
The individuals that HRSA views as responsible for OPAIS accuracy are the covered entity’s Authorizing Official (AO) and Primary Contact (PC). HRSA requires covered entities to designate an AO and PC and these individuals are listed in OPAIS. The AO must be an individual who has authority to legally bind the organization, for example, a chief executive officer, chief operating officer, chief financial officer, president, vice president, senior vice president, clinic administrator, or program manager. The PC must be an employee of the organization and may not be the same person as the AO. Either the AO or the PC can register a covered entity or make changes to the information in OPAIS, but the AO must attest to these actions if the PC makes them. The covered entity assumes a compliance risk if its AO or PC are unfamiliar with applicable 340B program responsibilities, including maintaining its entries in the OPAIS.
HRSA has implemented an annual recertification process that requires the AOs at covered entities to certify to the accuracy of several statements relating to the entity’s compliance status. Among other statements, AOs must attest that the information reflected on the covered entity’s OPAIS entries is correct, that the covered entity is in compliance with all 340B program requirements, and that it will notify OPA if it is in material breach of any 340B program requirements. HRSA implemented the recertification requirement to comply with two program-integrity requirements added to the 340B statute under the ACA—HRSA must “enable and require” covered entities to regularly update their 340B database entry, and HRSA must develop a system to verify the accuracy of the information listed in the database. OPA sends email notifications with information about the recertification process to the AO and PC prior to the recertification period. A covered entity that does not recertify is terminated from the 340B program.
AOs must be careful when certifying to the compliance status of their facilities during the recertification process. Although unlikely, AOs may incur criminal liability if they falsely attest to one or more of the representations required to recertify. If convicted, the AO could be fined or subject to imprisonment.
Orphan Drug Exclusion
Federal law provides incentives to manufacturers for developing a class of drugs, commonly known as “orphan drugs.” These are drugs the FDA has determined can treat a rare disease or condition affecting fewer than 200,000 people in the U.S., or more than 200,000 people if there is no reasonable expectation that the costs of developing a drug for such disease or condition would be recouped from sales of the drug in the United States. Physicians often prescribe orphan drugs to treat diseases or conditions other than the one for which the FDA granted the orphan drug designation. The 340B statute prohibits CAHs, RRCs, SCHs, and cancer hospitals from purchasing orphan drugs with 340B discounts. HRSA provides quarterly updates regarding its list of drugs designated as orphan drugs.
In 2014, pharmaceutical manufacturers challenged a HRSA policy allowing hospitals subject to the orphan-drug prohibition to purchase an orphan drug on the hospital’s 340B account if the drug was not being used for the purpose for which the drug received orphan designation. The court ruled in favor of the manufacturers and held that the statutory language clearly applies the prohibition regardless of the purpose for which the drug is being prescribed. Although manufacturers are not required to provide 340B discounts on orphan drugs to CAHs, RRCs, SCHs, and cancer hospitals, manufacturers often voluntarily provide “340B-like” discounts to hospitals subject to the orphan-drug prohibition.
A CAH, RRC, SCH, or cancer hospital that purchases an orphan drug with 340B discounts runs the risk of receiving an audit finding from HRSA, even if the drug is not being used for its orphan purpose. HRSA characterizes these instances as diversion although, from a legal perspective, the hospital is technically not violating the prohibition against diversion. If a hospital subject to the orphan-drug restriction receives a 340B-like discount on an orphan drug, it should maintain documentation demonstrating that the discount was voluntary.
Covered entities must retain auditable records of their 340B operations to maintain eligibility in the 340B program. Covered entities that are audited by HRSA receive a “Data Request” that lists the information and documents that the covered entity must produce prior to the audit. Among the documentation that must be given to the auditor is a spreadsheet of all the covered entity’s 340B drug purchases. The auditors then review a sample of 340B drug purchases in more detail to determine compliance with the diversion and duplicate-discount prohibitions. The covered entity must be able to show that its 340B purchases were proper by tracking the drug from when it was ordered to the point of administration or dispensation. HRSA requires a staff member who is knowledgeable about navigating electronic health records (EHRs) (including billing information) and the split-billing software/third-party software to be available during an audit. This requirement is included in HRSA’s Fiscal Year 2021 Data Request List, which is provided before the on-site audits.
Operational Issues to Consider
Operationalizing a 340B pharmacy program can be challenging, especially for complex organizations such as hospitals or underfunded clinics such as FQHCs, FQHC-LAs, or Ryan White clinics. Improper planning and/or implementation of a 304B program can lead to compliance problems. The risk of noncompliance is particularly high in the areas of inventory management and contract-pharmacy oversight.
As is evident from the previous discussion, a covered entity must maintain documentation in order to demonstrate that it is in compliance with the diversion, duplicate-discount, GPO, and orphan-drug restrictions. Compliance with this documentation standard requires the covered entity to maintain controls over its 340B drug inventory. Covered entities track their 340B inventory by using either a physical inventory-management system or a virtual system that manages drug inventories using split-billing software. Under the physical inventory management system, 340B drug inventory is physically stored in a separate location from non-340B drug inventory, or 340B and non-340B inventory is kept in the same space but labeled so that it can be identified and used separately.
A virtual inventory system, by contrast, tracks use of covered outpatient drugs by patients through a computerized software-operated “accumulator.” Use of drugs for individuals who are eligible patients under HRSA guidelines is counted under the 340B accumulator and use of all other drugs is counted under non-340B accumulators. Once a sufficient number of 340B dispenses are recorded in the accumulator to allow the covered entity to repurchase a full package size of the drug, the package is purchased “or replenished” with 340B discounts. HRSA requires that covered entities that use a virtual inventory system track drugs at an 11-digit National Drug Code (NDC) level. Therefore, the covered entity purchases and retains title to the drug only after a sufficient number of 340B-eligible prescriptions have been dispensed. Records of a virtual inventory system must demonstrate that the appropriate quantity of a drug was replenished from the correct manufacturer.
A virtual inventory system provides flexibility to covered entities because it allows the covered entity to physically mix its 340B and non-340B inventory and to determine whether a patient is eligible to receive 340B drugs after the drug has been dispensed or administered. A virtual inventory system creates some additional compliance risks, however. For example, if a hospital that is subject to the GPO prohibition uses a virtual inventory system, it must ensure that each initial purchase of a drug that carries a new NDC is at WAC. Similarly, if the hospital under-replenishes 340B drugs by mistakenly under-accumulating its 340B eligible dispenses or administrations, the hospital could violate the GPO prohibition by over-purchasing covered outpatient drugs on its GPO account. Over-replenishment on the 340B account, which is considered to be diversion, is another risk.
Efficient inventory management is essential for a covered entity to maintain compliance with the diversion, duplicate-discount, orphan-drug, and GPO prohibitions. Covered entities typically use a 340B administrator to track and manage records of inventories through processing software and platform integration. Moreover, selection of the appropriate inventory management system can reduce compliance risk.
Contract Pharmacy Oversight
Risks of noncompliance with 340B program requirements may increase if the covered entity uses a contract pharmacy to dispense 340B drugs to its patients, because the covered entity is responsible for 340B compliance at the pharmacy and will be responsible for any 340B compliance violations related to prescriptions filled by the contract pharmacy. A covered entity must maintain auditable records to demonstrate 340B compliance and verify that the contract pharmacy has a tracking system to ensure that the covered entity’s 340B drugs are not diverted to non-patients or that a manufacturer is not subject to duplicate discounts. HRSA expects covered entities to have policies and procedures describing their oversight of any contract pharmacies with which they contract, and to conduct annual independent audits of their contract pharmacies to ensure compliance with 340B program requirements.
Audits and Enforcement
The 340B statute requires covered entities to repay their 340B discounts to drug manufacturers if the entities fail to comply with the program’s anti-diversion and duplicate-discount requirements. Covered entities may also be required to pay interest on the 340B discounts they improperly receive if the violation is “knowing and intentional.” HRSA may terminate a covered entity from the 340B program if there is evidence that the violations are not only knowing and intentional, but also systemic and egregious. A covered entity may also be terminated if it fails to maintain auditable records or to satisfy eligibility requirements, including the GPO prohibition. HRSA may only impose these sanctions after an audit, notice of findings, and a hearing.
HRSA Audits of Covered Entities
The 340B statute gives HRSA the authority to audit covered entities for compliance with 340B program requirements. HRSA’s 340B program audits review covered-entity compliance with respect to, among other things, eligibility status; compliance with the duplicate-discount and diversion prohibitions; and contract pharmacy oversight. As stated previously, HRSA holds the covered entity responsible for any compliance issues at the covered entity’s contract pharmacies.
HRSA also has authority to audit drug manufacturers for compliance; however, these types of audits are far less common. HRSA has audited more than 1,000 covered entities but only a few manufacturers.
Covered entities are selected for a HRSA audit either through a random selection process or based on information that indicates that the covered entity may have compliance issues. Covered entities that are selected for a HRSA audit receive a letter notifying the covered entity of the audit. HRSA auditors have a preliminary call with the covered entity to discuss logistics, then send a data-request list containing any documents or information that the auditor requires initially. Auditors may request other records during the audit. HRSA typically audits a recent six-month period. Onsite HRSA visits typically last one to three days.
Following an audit, HRSA issues an initial report that may include audit “finding(s)” or “area(s) for improvement.” An audit finding, if not reversed, requires the covered entity to take corrective action. Findings reflect a determination by HRSA that the covered entity violated the 340B statute. As its name implies, an area for improvement is a suggestion from HRSA for improvement with respect to 340B compliance. An area for improvement does not require the covered entity to make any repayments. For example, HRSA may issue in its report an area for improvement if auditors believe that the covered entity’s 340B policies and procedures are not sufficiently comprehensive.
If HRSA’s audit report contains findings of noncompliance, the covered entity may dispute the findings by submitting a notice of disagreement within 30 days. HRSA will review the arguments presented by the covered entity and issue an updated final report that incorporates any changes HRSA may make in response to the covered entity’s appeal. After the audit report is finalized, or if the covered entity does not dispute HRSA’s findings, the covered entity has 60 days to submit a corrective-action plan explaining how it will address and remedy the noncompliance issues identified in the report. Covered entities are not required to submit a corrective action plan to address areas for improvement.
Covered entities that submit a corrective action plan are expected to complete the plan within six months of the date HRSA approves the corrective action plan. It is the covered entity’s responsibility to identify and contact all manufacturers regarding a possible violation of 340B program requirements and negotiate potential remedies. HRSA closes out the audit once it has determined that the covered entity has fully implemented the corrective action plan and the covered entity has reached an agreement with any manufacturers regarding repayment. HRSA posts a listing of the audits conducted each year and the results of the audits.
HRSA may re-audit a covered entity to determine whether it has corrected the compliance issues found in the first audit. If HRSA finds that the covered entity has not corrected a diversion and/or duplicate-discount violation in the second audit, the violation may be considered “systematic and egregious as well as knowing and intentional,” justifying removal from the program.
Covered entities are required to disclose a breach to HRSA if noncompliance meets the definition of “material breach.” Neither the 340B statute nor HRSA provides a definition for material breach. So HRSA permits each covered entity to adopt its own definition of material breach. Apexus provides a tool to help covered entities establish a “framework to guide the definition of a material breach of compliance and the process for self-disclosure to HRSA.” Covered entities are strongly encouraged to define “material breach” in their 340B policies and procedures.
If a covered entity discovers a material breach of 340B program requirements, it must submit a comprehensive self-disclosure to HRSA that contains the following:
Letter to HRSA noting the covered entity’s 340B ID
Description of the potential violation of 340B program requirements
Corrective action plan addressing how the problem will be fixed
Description of strategy to work with manufacturers that includes plans for financial remedy if repayment is necessary
In contrast to a HRSA audit finding, violations addressed in a covered entity’s self-disclosure are not posted on HRSA’s website.
Importantly, covered entities must remedy any violation they uncover, including violations that fall short of a material breach. They are obligated to repay manufacturers, for example, for engaging in diversion or causing duplicate discounts even if the repayment amount is small.
Manufacturer Audits of Covered Entities
As stated previously, the 340B statute allows manufacturers to audit covered entities, but only with respect to compliance with the diversion and duplicate-discount prohibitions. Before auditing a covered entity, the manufacturer must submit to HRSA an audit work plan and show that the manufacturer has “reasonable cause” to believe that the covered entity has violated the diversion and duplicate-discount prohibitions. If HRSA grants the manufacturer’s audit request, the manufacturer must hire an independent auditor to conduct the audit and prepare a final report. The covered entity has the opportunity to dispute any of the independent auditor’s findings. Notably, manufacturers do not have the authority to take action against a covered entity based on the outcome of its audit.
Manufacturer Compliance Obligations
Manufacturers are subject to far fewer requirements under the 340B program than covered entities. Essentially, they only have one requirement to meet—to sell their products at or below the 340B statutory ceiling price. Section 1927 of the Social Security Act, which is where the Medicaid drug rebate statute resides, states that a manufacturer’s drugs will not be covered by Medicaid or Medicare Part B unless the manufacturer signs a PPA with HHS. The PPA requires a drug manufacturer to provide covered entities with “covered outpatient drugs for purchase at or below the applicable ceiling price if such drug is made available to any other purchaser at any price.” HRSA has interpreted this so-called “must offer” provision to mean that manufacturers may not discriminate against 340B covered entities when allocating drugs in short supply or otherwise balancing the demand for products between 340B and non-340B purchasers. HRSA requests, but does not require, that manufacturers submit a written notice of any plan to limit distribution of covered outpatient drugs to HRSA at least four weeks in advance of implementation. These limited distribution plans should provide “[d]etails for a nondiscriminatory practice for restricted distribution to all purchasers, including 340B covered entities.”
Until recently, manufacturers have been under no obligation to share their 340B ceiling prices with covered entities, making it difficult for covered entities to validate whether they are receiving the discounts to which they are entitled. That changed in 2019 when HRSA created a secure website for covered entities to verify the quarterly 340B ceiling price for each covered outpatient drug available for purchase. Only the covered entity’s AO and PC have access to the website. Participating manufacturers are required to submit quarterly pricing reports that HRSA uses to populate the data on the website.
Manufacturers sometimes miscalculate the 340B ceiling price, which may result in an overcharge to covered entities. The 340B statute requires HRSA to create a system that manufacturers can use for refunding the overcharged amount to covered entities and for recalculating ceiling prices in the event post-sale rebates and discounts have the effect of lowering the 340B ceiling price. Notices informing covered entities of manufacturer overcharges are often posted on the HRSA website. Manufacturers that have overcharged a covered entity must make repayments to the covered entity. HRSA may recommend to the OIG that the OIG impose civil monetary penalties on a manufacturer of up to $5,000 for each instance of knowingly and intentionally overcharging a covered entity.
Manufacturers are also expected to maintain accurate information on OPAIS, although HRSA does not have the authority to require them to do so. Nevertheless, HRSA strongly urges manufacturers to verify their database information because it is the source of data that covered entities use to contact them regarding compliance issues, pricing and distribution inquiries, and repayment.