Skip to main content

Drug Discount Program: Federal Oversight of Compliance at 340B Contract Pharmacies Needs Improvement

GAO-18-480 Published: Jun 21, 2018. Publicly Released: Jun 28, 2018.
Jump To:

Fast Facts

To have their drugs covered under Medicaid, the "340B" program requires drug manufacturers to sell outpatient drugs to covered entities—certain hospitals and clinics—at a discount. These entities are increasingly contracting with pharmacies to dispense 340B drugs. Doing so can make it harder to ensure compliance with 340B rules. For example, contract pharmacies may also fill prescriptions for the general public, increasing the risk of dispensing 340B drugs to ineligible patients.

We recommended ways to improve federal oversight of covered entities to help ensure compliance with 340B requirements.

 

Photograph of a prescription pill bottle and pills.

Photograph of a prescription pill bottle and pills.

Skip to Highlights

Highlights

What GAO Found

The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies—contract pharmacies—to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription.

Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis.

GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as:

HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care.

HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance.

HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements.

Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements.

Why GAO Did This Study

Covered entities can provide 340B drugs to eligible patients and generate revenue by receiving reimbursement from patients' insurance. The number of pharmacies covered entities have contracted with has increased from about 1,300 in 2010 to nearly 20,000 in 2017. GAO was asked to provide information on the use of contract pharmacies. Among other things, this report: 1) describes financial arrangements selected covered entities have with contract pharmacies; 2) describes the extent that selected covered entities provide discounts on 340B drugs dispensed by contract pharmacies to low-income, uninsured patients; and 3) examines HRSA's efforts to ensure compliance with 340B Program requirements at contract pharmacies. GAO selected and reviewed a nongeneralizable sample of 30 contracts between covered entities and pharmacies, 20 HRSA audit files, and 55 covered entities to obtain variation in the types of entities and other factors. GAO also interviewed officials from HRSA and 10 covered entities.

Recommendations

GAO is making seven recommendations, including that HRSA's audits assess for duplicate discounts in Medicaid managed care, and HRSA require information on how entities determined the scope of noncompliance and evidence of corrective action prior to closing audits. HHS agreed with four of the recommendations, but disagreed with three recommendations, which GAO continues to believe are warranted to improve HRSA's oversight as explained in the report.

Recommendations for Executive Action

Agency Affected Recommendation Status
Health Resources and Services Administration The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1)
Open
HHS does not concur with this recommendation and, as of March 2021, indicated that it did not plan to take any actions to implement the recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability. In January 2023, HRSA noted that the agency had requested regulatory authority for all aspects of the 340B Program in the FY 2023 President's Budget. However, HRSA already requires covered entities to register contract pharmacies, just not for each site of the entity for which a contract exists. Thus, it is unclear why regulatory authority would be needed to implement this recommendation. Furthermore, as noted in our report, without complete information on contract pharmacy arrangements--including information on with sites of a covered entity have contracts with a contract pharmacy--HRSA cannot ensure that it is optimally targeting the limited number of audits done each year. Additionally, manufacturers lack important information to help ensure that 340B discounted drugs are only provided to pharmacies with a valid 340B contract with the covered entity site for which the drug is being dispensed.
Health Resources and Services Administration
Priority Rec.
The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs.(Recommendation 2)
Open
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In February 2024, HRSA noted that the agency may be able to issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care pending the outcome of a proposed CMS rule related to the Medicaid Drug Rebate program.
Health Resources and Services Administration
Priority Rec.
The Administrator of HRSA should incorporate an assessment of covered entities' compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3)
Open
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In February 2024, HRSA noted that the agency may be able to issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care pending the outcome of a proposed CMS rule related to the Medicaid Drug Rebate program. HRSA would then need to update its audit processes accordingly to implement this recommendation.
Health Resources and Services Administration The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit.(Recommendation 4)
Open
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In January 2023, HRSA noted that the agency had requested regulatory authority for all aspects of the 340B Program in the FY 2023 President's Budget.
Health Resources and Services Administration The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5)
Open
HHS does not concur with this recommendation and, as of January 2023, did not plan to take any actions to implement the recommendation. HHS noted that requiring all covered entities subject to an audit to specify their methodology for identifying the full scope of noncompliance identified during the audit would create a significant burden for covered entities. However, as noted in our report, HRSA already requires covered entities with audit findings to determine the full scope of noncompliance and requires entities subject to a targeted audit to provide their methodology for such assessments to HRSA. Thus, it is unclear how requiring covered entities subject to risk-based, as opposed to targeted, audits to provide HRSA with a written description of methodologies that they are already required to formulate and implement would create a significant additional burden. Without this information, HRSA does not have reasonable assurance that the majority of covered entities have adequately identified all instances of noncompliance.
Health Resources and Services Administration The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities' assessments of the full scope of noncompliance identified during each audit.(Recommendation 6)
Open
HHS does not concur with this recommendation and, as of January 2023, did not plan to take any actions to implement the recommendation. HHS stated that requiring all covered entities with audit findings to provide evidence that their corrective action plans have been successfully implemented would create an undue burden for covered entities. However, HRSA already requires such evidence from covered entities subject to targeted audits, and it is unclear how providing evidence of implementation of corrective actions that entities developed and are required to implement would create significant additional burden for these entities. Additionally, without such evidence HRSA does not have a reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance.
Health Resources and Services Administration The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7)
Open
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In January 2023, HRSA noted that the agency had requested regulatory authority for all aspects of the 340B Program in the FY 2023 President's Budget.

Full Report

GAO Contacts

Office of Public Affairs

Topics

Discount ratesDrug pricesDrugsHealth careHealth care centersHospitalsInternal controlsMedicaidMedicaid programPatient careMedically uninsuredOutpatient carePharmacyPrescription drugs