Recommendation: The Administrator of HRSA should incorporate assessments of covered entities' compliance with state Medicaid programs' policies and procedures regarding the use and identification of 340B drugs into its audit process, working with CMS as needed to obtain states' policies and procedures. (Recommendation 2)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS did not concur with this recommendation and, as of August 2020, did not plan to take any actions to implement the recommendation. As noted in our report, covered entities' compliance with state Medicaid programs' policies and procedures is fundamental to preventing duplicate discounts. Thus, we continue to believe that HRSA's audit process should include an assessment of covered entities' compliance with state Medicaid programs' policies and procedures related to 340B drugs as it is necessary to identify potential duplicate discounts and to ensure covered entities' compliance with 340B Program requirements.

Recommendation: The Administrator of HRSA should require covered entities to work with affected drug manufacturers regarding repayment of identified duplicate discounts in Medicaid managed care. (Recommendation 3)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS did not concur with this recommendation and, as of August 2020, did not plan to take any actions to implement the recommendation. As noted in our report, HRSA officials told us that covered entities' obligations for preventing duplicate discounts are the same for Medicaid fee-for-service and managed care. Thus, we continue to believe that when duplicate discounts related to Medicaid managed care have been identified, the agency should require covered entities to work with manufacturers to remedy them as they do for duplicate discounts related to Medicaid fee-for-service to help ensure compliance with 340B Program requirements.

Recommendation: The Administrator of HRSA should ensure that the information it uses to verify nonprofit status for all nongovernmental hospitals that participate in the 340B Program is reliable—for example, by requiring and reviewing the submission of official documentation hospitals must already maintain or by ensuring the reliability of the data the agency uses. (Recommendation 1)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation and in June 2020, reiterated that HRSA believes that the information it uses to determine nonprofit status is reliable, because hospital administrators attest to its accuracy. However, as discussed in our report, neither HRSA nor the agency that collects the data has evaluated the reliability of the data for verifying nonprofit status. Without ensuring it is using reliable information, HRSA cannot effectively determine if nongovernmental hospitals participating, or seeking to participate, in the 340B Program meet the statutory eligibility requirements.

Recommendation: The Administrator of HRSA should implement a process to verify that every nongovernmental hospital that participates in the 340B Program has a contract with a state or local government as required by statute. (Recommendation 2)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS did not concur with this recommendation and, as of June 2, 2020, did not plan to take any actions to implement the recommendation. HHS noted that requiring all covered entities to submit a state or local government contract would create a significant burden for covered entities. However, as we noted in our report, HRSA already requires hospitals to maintain copies of their state or local government contracts. Therefore, it is unclear how implementing a process to verify the existence of those contracts would represent a significant burden. Without this information, HRSA does not have reasonable assurance that nongovernmental hospitals have the statutorily required contracts to participate in the 340B Program.

Recommendation: The Administrator of HRSA should provide more specific guidance for 340B Program auditors on how to determine if nongovernmental hospitals' contracts with state and local governments require the provision of health care services to low-income individuals not eligible for Medicaid or Medicare. (Recommendation 4)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation and in June 2020, indicated that HRSA had updated its audit guidance and procedures to more clearly specify that contracts must contain requirements for the provision of health care services to low-income individuals. However, these documents do not contain any specific guidance on how auditors are to evaluate whether contracts require these services. Without more specific guidance for auditors' review of contracts, HRSA lacks reasonable assurance that the audits are appropriately identifying deficiencies in nongovernmental hospitals' contracts with state or local governments.

Recommendation: The Administrator of HRSA should require nongovernmental hospitals participating in the 340B Program to demonstrate that they have contracts with state or local governments in effect prior to the beginning of their audits' periods of review and should apply consistent and appropriate consequences for hospitals that are unable to do so. (Recommendation 6)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation. As noted in our report, HRSA updated its draft audit procedures for fiscal year 2020 audits in September 2019 to specify that auditors should look for effective dates that cover the entire audit period. While this is an important step, HRSA must also show that it has ceased accepting retroactive contract documentation, and has applied consistent and appropriate consequences when auditors find that nongovernmental hospitals did not have contracts in effect prior to the beginning of their audit periods. As of June 2020, HHS indicated that HRSA had not taken these actions. Allowing hospitals that are unable to demonstrate that they have contracts in place that cover their audits' periods of review to continue to participate without consequences undermines the effectiveness of HRSA's audit process and increases the risk that ineligible hospitals will receive discounts under the program.

Recommendation: The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. As noted in our report, without complete information on contract pharmacy arrangements--including information on with sites of a covered entity have contracts with a contract pharmacy--HRSA cannot ensure that it is optimally targeting the limited number of audits done each year. Additionally, manufacturers lack important information to help ensure that 340B discounted drugs are only provided to pharmacies with a valid 340B contract with the covered entity site for which the drug is being dispensed.

Recommendation: The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs.(Recommendation 2)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should incorporate an assessment of covered entities' compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit.(Recommendation 4)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. HHS noted that requiring all covered entities subject to an audit to specify their methodology for identifying the full scope of noncompliance identified during the audit would create a significant burden for covered entities. However, as noted in our report, HRSA already requires covered entities with audit findings to determine the full scope of noncompliance and requires entities subject to a targeted audit to provide their methodology for such assessments to HRSA. Thus, it is unclear how requiring covered entities subject to risk-based, as opposed to targeted, audits to provide HRSA with a written description of methodologies that they are already required to formulate and implement would create a significant additional burden. Without this information, HRSA does not have reasonable assurance that the majority of covered entities have adequately identified all instances of noncompliance.

Recommendation: The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities' assessments of the full scope of noncompliance identified during each audit.(Recommendation 6)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. HHS stated that requiring all covered entities with audit findings to provide evidence that their corrective action plans have been successfully implemented would create an undue burden for covered entities. However, HRSA already requires such evidence from covered entities subject to targeted audits, and it is unclear how providing evidence of implementation of corrective actions that entities developed and are required to implement would create significant additional burden for these entities. Additionally, without such evidence HRSA does not have a reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance.

Recommendation: The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.