The Medicaid Drug Rebate Program was established through the Omnibus Budget Reconciliation Act of 1990 and requires drug manufacturers to pay rebates to states on outpatient drugs as a condition of having their drugs covered by Medicaid. The 340B Program, named for the statutory provision authorizing it in the Public Health Service Act, was created in 1992 following the enactment of the Medicaid Drug Rebate Program and allows covered entities to purchase outpatient drugs at discounted prices. HRSA and CMS both have roles in overseeing compliance with the prohibition on duplicate discounts. The Medicaid Drug Rebate Program helps to offset the federal and state costs of most outpatient prescription drugs dispensed to Medicaid beneficiaries. Under the rebate program, drug manufacturers pay rebates to states as a condition for the federal contribution to Medicaid spending for the manufacturers’ outpatient drugs. State Medicaid programs generally must cover all of the drugs of manufacturers that participate in the rebate program. Originally, rebates were available only for drugs paid for by the state on a FFS basis, but the Patient Protection and Affordable Care Act extended the program to outpatient drugs paid for under Medicaid managed care; there are more Medicaid enrollees, prescriptions, and spending for drugs under managed care than FFS. The rebates received for both FFS and managed care are shared by the federal government and states. The amount of Medicaid rebates for a drug is based on a statutory formula. Using that formula CMS calculates a unit rebate amount for each drug and provides that amount to states so they can determine the amount of rebates to request. Every quarter, each state multiplies the number of units of each drug it either paid for on a FFS basis or provided through its managed care plans by the CMS-provided unit rebate amount. For drugs provided under FFS, the state calculates the number of units based on drug claims it reimbursed, while states use drug utilization data provided by managed care plans to determine the number of units of each drug that were provided by the plans to Medicaid beneficiaries. Each state then sends rebate requests to each manufacturer reflecting the total quarterly amount of rebates owed for each of the manufacturer’s drugs. States are to exclude claims for 340B drugs from their rebate requests. Participation in the 340B Program is voluntary for both covered entities and drug manufacturers, but there are strong incentives for both to do so. Covered entities can realize substantial savings through the program’s price discounts. In addition, covered entities can generate revenue to the extent that they can purchase 340B drugs for eligible patients whose insurance reimbursement exceeds the price paid. Incentives for participation by drug manufacturers are strong because they must participate in the 340B Program to receive Medicaid reimbursement for their drugs. Covered entities generally become eligible for the 340B Program by qualifying as certain federal grantees or as one of six specified types of hospitals. Eligible federal grantees include federally qualified health centers, which provide comprehensive community-based primary and preventive care services to medically underserved populations, as well as certain other federal grantees, such as family planning clinics and Ryan White HIV/AIDS program grantees, among others. Eligible hospitals include critical access hospitals—small, rural hospitals with no more than 25 inpatient beds; disproportionate share hospitals—general acute care hospitals that serve a disproportionate number of low-income patients; and four other types of hospitals. To participate in the 340B Program, covered entities must register with HRSA and annually recertify their continuing eligibility. Once their eligibility is approved by HRSA, covered entities can begin purchasing drugs from manufacturers at the 340B discounted prices. Covered entities may provide drugs, including 340B drugs, to patients through one or more dispensing methods. Specifically, covered entities may dispense these drugs through pharmacies—either through in-house pharmacies they own; through the use of contract pharmacy arrangements, in which they contract with outside pharmacies and pay them to dispense drugs on their behalf; or both. In addition, providers who work at covered entities, such as doctors and nurses, may administer 340B drugs to patients directly, such as during office visits. These are known as provider-administered drugs. As a condition of participating in the 340B Program, covered entities must follow certain requirements. For example, they are prohibited from diverting a 340B drug to an individual who is not a patient of the covered entity. Covered entities are also prohibited from subjecting manufacturers to duplicate discounts. Both states and covered entities play key roles in preventing duplicate discounts and forgone rebates. States must know whether covered entities provided 340B drugs to Medicaid beneficiaries in order to exclude those drugs from the rebate requests they submit to manufacturers. When covered entities provide 340B drugs to Medicaid beneficiaries, it is known as “carving in;” if covered entities do not dispense these drugs to Medicaid beneficiaries, it is known as “carving out.” As shown in figure 1, if a state is not aware that a covered entity provided 340B drugs to Medicaid beneficiaries, it would not know to exclude those drugs from its rebate requests, which could lead to duplicate discounts. In contrast, if a state mistakenly believes the entity used 340B drugs when it did not, it might exclude those drugs from its rebate requests and would forgo eligible rebates. To help prevent duplicate discounts, in 1993, HRSA and CMS collaborated to establish the Medicaid Exclusion File (MEF) as a mechanism to assist in the identification of 340B drugs provided to Medicaid FFS beneficiaries. The MEF lists the covered entities that reported to HRSA that they choose to use or “carve in” 340B drugs for their Medicaid FFS patients. Specifically, HRSA requires that covered entities that decide to carve in these drugs for Medicaid provide the agency with the provider number or numbers that the entities use to bill the state for those drugs. The entity and the provider number or numbers it specifies are then listed on the MEF. HRSA guidance specifies that all drugs billed with the provider numbers listed on the MEF should be 340B drugs so a state that choses to use the MEF knows the drugs should be excluded from rebate requests; there is no requirement for states to use the MEF to identify 340B drugs. If a covered entity wants its contract pharmacy to dispense 340B drugs to patients covered under Medicaid FFS, HRSA guidance requires the covered entity, the contract pharmacy, and the state Medicaid program to have an arrangement to prevent duplicate discounts; any such arrangement must be reported to HRSA. When the MEF was created, Medicaid drug rebates were only required for drugs provided under FFS. As such, in a 2014 policy release, HRSA clarified that the MEF is only intended for use for Medicaid FFS, that is, only covered entities that elect to carve in 340B drugs for Medicaid FFS are required to provide the provider numbers used for billing Medicaid FFS for inclusion on the MEF. The MEF is not intended to capture whether covered entities have decided to carve in 340B drugs for Medicaid managed care and, if so, what provider numbers they use for billing for those drugs. HRSA has not created a mechanism for covered entities to use to identify 340B drugs provided to Medicaid managed care beneficiaries, but encourages covered entities to work with states to develop strategies to prevent duplicate discounts for drugs reimbursed through managed care. While HRSA requires covered entities to use the MEF, there is no similar requirement for state Medicaid programs. CMS provides states the flexibility to determine procedures for identifying and excluding 340B drugs from their Medicaid rebate requests. Under a May 2016 final rule, states’ contracts with Medicaid managed care plans that provide coverage of outpatient drugs must require the plans to provide the states with drug utilization data that is necessary for the states to claim Medicaid rebates. In addition, the contracts must require the plans to establish procedures for excluding 340B drugs from the drug utilization data provided to states for purposes of rebate collection. To oversee covered entities’ compliance with 340B Program requirements, in fiscal year 2012, HRSA implemented a systematic approach to conducting audits of a small sample of covered entities, and began conducting audits of 200 entities per year in fiscal year 2015. HRSA audits include covered entities that are randomly selected based on risk-based criteria (approximately 90 percent of all audits conducted each year), or targeted based on information from stakeholders such as drug manufacturers about potential noncompliance (10 percent of the audits conducted). HRSA’s criteria for risk-based audits include a covered entity’s volume of 340B drug purchases, number of contract pharmacies, time in the program, and complexity of its program. Among other things, HRSA’s audits include reviews of each covered entity’s policies and procedures, an assessment of the entity’s compliance with respect to 340B Program requirements, including the prevention of duplicate discounts in Medicaid FFS, and reviews of a sample of prescriptions filled during a 6-month period to identify any instances of noncompliance. Under HRSA’s audit procedures, a covered entity with audit findings is required to 1) submit a corrective action plan to HRSA that indicates it will determine the full scope of any noncompliance (beyond the sample of prescriptions reviewed during an audit) and 2) outline the steps it plans to take to correct findings of noncompliance, including any necessary repayments to manufacturers, among other things. If the HRSA audit shows that duplicate discounts may have occurred, the covered entity must, as part of its corrective action plan, contact the state Medicaid program to determine whether duplicate discounts actually occurred—namely, whether the state requested a rebate on the claims in question, and if so, contact the drug manufacturer to offer repayment. HRSA closes the audit when a covered entity submits a letter attesting that its corrective action plan, including its assessment of the full scope of noncompliance, has been implemented and any necessary repayments to manufacturers have been resolved. In addition, HRSA may re-audit a covered entity (i.e. subject it to a targeted audit) to determine whether it has implemented its corrective action plan. To oversee the Medicaid Drug Rebate Program, CMS receives copies of states’ Medicaid rebate requests each quarter. States are required to submit this data to manufacturers for FFS and managed care drugs, which should not include drugs purchased through the 340B Program, within 60 days of the end of the quarterly rebate period. Specifically, states provide drug utilization data that includes the drug name, national drug code (a unique identifier for each drug), the unit rebate amount, the number of units reimbursed, the rebate amount claimed, and the number of prescriptions, among other things. CMS has a system that reviews this information for errors, such as the inclusion of drugs from manufacturers that no longer participate in the Medicaid Drug Rebate Program, and generates a discrepancy report for the state. CMS also has a system in place to identify, for state review, cases in which the utilization data reflect a substantial increase or decrease in the number of FFS records submitted compared to prior quarters; such a review is not currently performed for managed care. In addition, CMS reviews state Medicaid programs’ contracts with managed care plans using a checklist to ensure that the contracts include elements required by statute or regulation. State Medicaid programs’ policies varied in whether they allowed covered entities to use 340B Program drugs for Medicaid beneficiaries. Most states allowed covered entities to decide whether to use, or “carve in,” 340B drugs for Medicaid beneficiaries at their in-house pharmacies and for provider-administered drugs. Fewer states allowed covered entities to dispense these drugs to Medicaid beneficiaries at contract pharmacies, particularly beneficiaries whose drugs were covered under FFS. Table 1 below summarizes states’ policies on covered entities’ use of 340B drugs for Medicaid beneficiaries for both FFS and managed care by dispensing method. In addition to varying by state, policies on the use of 340B drugs sometimes varied within a state; that is, some states had different policies depending on whether the drugs were provided to Medicaid FFS or managed care beneficiaries, the dispensing method used, or both. For example, Oregon allowed covered entities to decide whether to dispense 340B drugs at contract pharmacies to Medicaid managed care beneficiaries, but required covered entities to carve out (not use) these drugs at contract pharmacies under Medicaid FFS. Illinois required covered entities to carve in 340B provider-administered drugs and those dispensed at in-house pharmacies for Medicaid beneficiaries in both FFS and managed care, but prohibited their use for Medicaid beneficiaries at contract pharmacies. See appendix II for information on each state Medicaid program’s policies regarding covered entities’ use of 340B drugs. The states that allowed or required covered entities to carve in 340B drugs for Medicaid beneficiaries used several different procedures to identify and exclude those drugs from Medicaid rebate requests. These procedures included relying on the MEF, requiring covered entities to use a 340B claim identifier—a code on the claim that indicates that the drug used was purchased at the 340B discounted price, or using other state- developed procedures to identify and exclude 340B drugs from rebate requests. The procedures states used varied between Medicaid FFS and managed care, and among dispensing methods. For example, states were more likely to use HRSA’s MEF to identify and exclude provider- administered drugs in both Medicaid FFS and Medicaid managed care and to use a 340B claim identifier to identify and exclude drugs dispensed at in-house pharmacies. Some states used a combination of procedures or created their own state-specific procedures. For example, 11 states required that covered entities inform them of their decisions to carve in 340B drugs for Medicaid beneficiaries. The states then maintained a list of these covered entities or their providers, which they used to exclude 340B drugs from rebate requests. Oregon required covered entities to provide the state with a list of each 340B drug dispensed to a Medicaid managed care beneficiary at a contract pharmacy so that the state could exclude those drugs from its rebate requests. Vermont required covered entities, on a monthly basis, to send the state a file listing each 340B drug provided to a Medicaid beneficiary; the state used this information to exclude those drugs from rebate requests. See table 2 for a summary of the procedures used by states to identify 340B drugs provided to Medicaid beneficiaries, and appendix III for a listing of the procedures by state. State Medicaid programs’ policies related to 340B drugs were not always documented and some states’ policies may not prevent duplicate discounts. Some states had written policies for the use of 340B drugs, and procedures to identify them, for some dispensing methods, but not for others, such as states that had documented policies for in-house pharmacies but not contract pharmacies. Without written policies, covered entities in those states may not be aware of requirements for dispensing and identifying 340B drugs, increasing the risk of duplicate discounts. Specifically, we found that nine states did not have written policies or procedures on the use or identification of 340B drugs for all dispensing methods. Seven of the nine states had policies or procedures regarding the use and identification of 340B drugs that were used in practice, but these policies and procedures were not always documented. For example: Connecticut did not have documented policies on the use and identification of 340B drugs, but officials from the state reported that it allowed covered entities to provide these drugs to Medicaid beneficiaries and relied on the MEF to identify and exclude them from rebate requests. While Pennsylvania and Ohio had written policies regarding the use of 340B drugs in Medicaid FFS and for some dispensing methods under managed care, the states’ policies requiring covered entities to carve out these drugs for Medicaid managed care beneficiaries at contract pharmacies were not documented. The remaining two states did not have policies or procedures, documented or otherwise, for all dispensing methods: Officials from Washington, D.C. reported that D.C. did not have a policy regarding the use of provider-administered 340B drugs nor did it have procedures to identify and exclude those drugs from its Medicaid drug rebate requests. A Rhode Island Medicaid official told us that the state did not have written policies regarding the identification of 340B drugs dispensed to Medicaid FFS beneficiaries at in-house pharmacies, and that the state did not have procedures, written or otherwise, by which to exclude such drugs from rebate requests. Additionally, while the state had a written policy for identifying and excluding 340B drugs administered by providers at hospitals, officials told us that they had no policy or exclusion procedures for drugs administered by providers at other types of covered entities. In addition, we found that states’ policies may not prevent duplicate discounts. For example, some states used the MEF to identify and exclude 340B drugs from their rebate requests in a manner contrary to the MEF’s purpose as set forth by HRSA. As noted previously, HRSA guidance specifies that the MEF is not intended to be used to identify and exclude 340B drugs provided to Medicaid managed care beneficiaries from Medicaid drug rebate requests. Covered entities are only required to be listed on the MEF if they carve in 340B drugs for Medicaid FFS. Since the MEF may not accurately reflect covered entities’ use of 340B drugs for Medicaid managed care, states’ use of the MEF in this instance may increase the risk of duplicate discounts or forgone rebates unless states require covered entities to make the same decisions on the use of 340B drugs for FFS and managed care. For example, as shown in figure 2, a state’s use of the MEF for managed care would likely result in a duplicate discount if covered entities carve out 340B drugs for Medicaid FFS, but carve in these drugs for managed care, as those entities would not be listed on the MEF. Consequently, the state would not know to exclude drugs provided by those entities from the managed care plans’ utilization data that are used for requesting rebates. If covered entities did the opposite—carved in for FFS and carved out for Medicaid managed care—then the state would likely forgo Medicaid rebates as it would exclude drugs from its rebate request that were not purchased through the 340B Program. Seven of the 13 states that used the MEF exclusively to identify and exclude Medicaid managed care drugs from rebate requests for at least one dispensing method did not require covered entities to make the same carve-in decisions for both FFS and managed care. Additionally, while the six remaining states required covered entities to make the same decision regarding use of 340B drugs in FFS and managed care, that requirement was not always clearly explained in the states’ policies. For example, an official from Arkansas, which used the MEF for identifying and excluding 340B drugs from rebate requests, told us that covered entities are required to make the same carve-in decisions for both Medicaid FFS and managed care. However, it is unclear how covered entities would be aware of that requirement, as it was not documented in the state’s policy manuals at the time of our information request. Finally, states that rely on the MEF or state-developed lists of providers carving in 340B drugs for Medicaid beneficiaries may not be able to identify instances where covered entities are unable to purchase drugs at the 340B Program discounted price, and instead need to purchase drugs outside of the 340B Program. For example, orphan drugs are excluded from the discounted 340B Program price for some covered entities. In these situations, states that rely on the MEF or other state-developed lists of providers may be forgoing rebates. For example, if covered entities do not have a separate provider number for billing Medicaid for these non- 340B drugs, the states would be excluding both 340B and non-340B drugs from their rebate requests. State Medicaid officials in Oregon and Pennsylvania acknowledged that their states were likely forgoing rebates when covered entities listed on the MEF were unable to purchase drugs at the 340B Program price. While these state officials indicated that they did not consider the lost rebates financially significant, the loss of these rebates would also increase federal Medicaid expenditures, since rebates are shared between the state and the federal government. CMS oversight of state Medicaid programs’ efforts to prevent duplicate discounts is limited. States have the flexibility to select the procedures used for identifying and excluding 340B drugs from rebate requests. Although CMS collaborated with HRSA to establish the MEF as a tool for identifying 340B drugs in Medicaid FFS, CMS does not require states to use the MEF in their duplicate discount prevention efforts. Instead, CMS has provided states with options of procedures they could consider for identifying and excluding 340B drugs from rebate requests. For example, CMS’s February 2016 final rule on covered outpatient drugs, which detailed requirements for Medicaid reimbursement of covered outpatient drugs, included in its preamble examples of procedures that states could use to identify and exclude 340B drugs in FFS without prescribing any specific required procedure. Additionally, as noted earlier, the final rule CMS issued in May 2016 on Medicaid managed care included a provision relating to duplicate discounts for Medicaid managed care drugs. Specifically, it mandated that state Medicaid programs’ contracts with managed care plans that provide outpatient drugs require the plans to establish procedures for excluding 340B drugs from utilization data provided to states for use in seeking rebates, but did not specify what procedures plans should use. Most recently, in January 2020, CMS released a bulletin to state Medicaid programs on best practices for preventing duplicate discounts. CMS has some visibility into state Medicaid programs’ 340B-related policies and procedures through its oversight activities, but these activities are not intended to, and do not enable CMS to, assess compliance with the duplicate discount prohibition. For example, CMS has a system in place that reviews copies of states’ quarterly Medicaid drug rebate requests; however, CMS officials told us that these requests do not contain detailed, claim-level information that could be used to determine if specific drugs purchased through the 340B Program were incorrectly included. Additionally, CMS reviews states’ contracts with Medicaid managed care plans to ensure that they include language requiring the plans to have procedures to exclude 340B drugs from Medicaid rebate data provided to states, but CMS officials told us that the contract language does not have to specify or describe those mechanisms, limiting the information available regarding duplicate discount prevention efforts. CMS also required states to submit their plans for reimbursing covered entities for 340B drugs provided under Medicaid FFS to ensure that the states’ payment methodologies complied with federal requirements, but these reviews were not focused on ensuring that such drugs were excluded from rebate requests. CMS officials told us that they do not track which procedures states use to prevent duplicate discounts; review states’ policies or procedures for identifying and excluding 340B drugs from rebate requests for deficiencies or to ensure effectiveness; or audit states’ compliance with the prohibition on duplicate discounts. This is problematic because, as noted previously, we found that not all state Medicaid programs have written policies and procedures that specify the extent to which covered entities can use 340B drugs for Medicaid beneficiaries, or how they are to identify these drugs so the state can exclude them from Medicaid rebate requests. If states do not have written policies, covered entities may not be aware of whether, or under what circumstances, they are permitted to provide 340B drugs to Medicaid beneficiaries or how to properly inform the state of their use, which could result in errors that lead to duplicate discounts and forgone rebates. We found some evidence of confusion from covered entities about state policies. For example, officials from Apexus, which manages HRSA’s 340B Prime Vendor Program, told us that Apexus’s call center, which fields questions from covered entities and other stakeholders about the 340B Program, most frequently receives questions related to clarifying states’ duplicate discount-related policies. These inquiries about state requirements indicate that there is currently confusion among covered entities. CMS’s limited oversight of state Medicaid programs’ efforts to prevent duplicate discounts is also problematic because we found that states’ policies and procedures were not always effective at preventing duplicate discounts, or in line with federal guidance. For example, the MEF is only intended to be used for Medicaid FFS. CMS officials told us that, while the agency was not aware of any states using the MEF for Medicaid managed care, such use would be concerning because it is not an accurate tool for that purpose. However, as previously shown in table 2, we found that eight states relied on the MEF to identify and exclude Medicaid managed care drugs dispensed at in-house pharmacies from rebate requests and 13 states used the MEF to identify and exclude managed care drugs administered by providers. The lack of CMS oversight of state Medicaid programs’ policies and procedures related to duplicate discount prevention is inconsistent with federal standards for internal control for information and communication, which state that management should obtain relevant data from reliable internal and external sources in a timely manner based on the identified information requirements so that data can be used for effective monitoring. Without reviewing states’ policies and procedures, CMS does not have the information needed to effectively oversee states’ compliance with the Medicaid drug rebate statute, which exempts 340B drugs from Medicaid rebate requirements, and ensure that states have effective policies and procedures for preventing duplicate discounts. The lack of oversight of states’ policies and procedures also results in CMS not having reasonable assurance that states are seeking rebates for all eligible drugs, and since Medicaid rebates are shared by the states and the federal government, forgoing rebates increases Medicaid costs for both states and the federal government. We identified several areas of weaknesses in HRSA’s oversight processes that impede its ability to ensure that duplicate discounts are prevented or remedied: Covered entities’ compliance with state policies and procedures is not assessed. HRSA’s auditors are instructed to look for the potential for duplicate discounts in Medicaid FFS by assessing whether the covered entity’s information on the MEF is correct; whether the entity is following its policies and procedures to prevent duplicate discounts; and whether a sample of claims reveals any noncompliance. Auditors are also instructed to use information provided by the covered entity to determine if the covered entity is following state policies. However, HRSA officials told us that its auditors are not expected to independently identify or verify state Medicaid programs’ policies to determine whether the covered entity is actually following what the state requires. Instead, HRSA officials stated that it is a best practice for covered entities to include a description of state Medicaid programs’ policies related to the 340B Program, such as how relevant drugs are to be identified, in their policy and procedure manuals. In addition, HRSA told us that its auditors interview covered entity staff about the controls in place to prevent duplicate discounts, and may discuss state requirements during these interviews. The auditor is then required to use this information to determine whether the covered entity is following state policy. For example, if the covered entity says that the state requires a 340B claim identifier, the auditor is to look to see if the covered entity used that identifier in the sample of claims that are reviewed. However, the auditor is not expected to determine if the state actually requires a claim identifier, or allows covered entities to use 340B drugs. The fact that HRSA does not assess whether covered entities are actually following state policies and procedures regarding the use and identification of 340B drugs for Medicaid beneficiaries is inconsistent with federal standards for internal control related to information and communication. Those standards state that management should obtain relevant data from reliable internal and external sources in a timely manner based on the identified information requirements and evaluate both internal and external sources of data for reliability so that it can be used for effective monitoring. This lack of HRSA oversight is especially concerning because we found that the covered entities we interviewed did not always have a correct understanding of their states’ policies. For example, officials from two of the four Pennsylvania covered entities we spoke with told us they were dispensing 340B drugs to Medicaid managed care beneficiaries at contract pharmacies, despite state officials telling us the state does not allow that practice. As a result of this confusion, duplicate discounts may have occurred as the state was not excluding drugs dispensed by contract pharmacies from its Medicaid rebate requests. Additionally, of the 13 covered entity policy and procedure manuals we reviewed, only four had descriptions of their states’ policies and two of those descriptions were incorrect. If HRSA were to audit the majority of those 13 covered entities, its auditors would likely be unable to appropriately assess the entities’ compliance with state requirements. Without fully assessing compliance with state policy, HRSA’s audits do not provide the agency with reasonable assurance that covered entities are taking the necessary steps to prevent duplicate discounts. As a result, drug manufacturers are at risk of being required to erroneously provide duplicate discounts for Medicaid drugs. Not all identified duplicate discounts are repaid. HRSA officials told us that covered entities’ obligations for preventing duplicate discounts are the same for Medicaid FFS and managed care. However, as we reported in 2018, HRSA audits do not assess for the potential for duplicate discounts in Medicaid managed care despite the fact that the potential for duplicate discounts related to Medicaid managed care has existed since 2010, when manufacturers were required to begin paying Medicaid rebates under managed care in addition to FFS. As we noted in 2018, HRSA indicated that it does not audit for duplicate discounts in managed care because the agency has not issued guidance on how covered entities should prevent this. As a result, we recommended that HRSA issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care and incorporate into its audit process an assessment of covered entities’ compliance with the prohibition on duplicate discounts as it relates to Medicaid managed care claims. HHS concurred with these recommendations and, as of October 2019, HRSA reported that it was working to determine next steps related to these recommendations. However, HRSA has noted that the agency lacks explicit general regulatory authority to issue regulations on most aspects of the 340B Program, and also told us, in October 2019, that guidance does not provide the agency with appropriate enforcement capability. As a result, HRSA requested authority in the President’s budget request for fiscal year 2020 to issue regulations on all aspects of the 340B Program, as the agency believes that binding and enforceable regulations would provide it with the ability to more clearly define and enforce policy. In addition, the agency is not pursuing additional guidance under the 340B Program at this time. We note, however, that the law prohibits the payment of duplicate discounts and requires HRSA to issue guidance to covered entities describing methodologies and options for avoiding duplicate discounts. In the absence of federal guidance, HRSA instructs covered entities to work with their states on duplicate discount prevention. HRSA requires covered entities to work with affected drug manufacturers regarding the repayment of duplicate discounts in FFS that are identified through HRSA or manufacturer audits. However, HRSA officials told us that the agency does not require covered entities to take the same actions to address duplicate discounts for managed care claims that HRSA learns about through its audits or other means. For example, HRSA officials told us that they did not follow up on a letter from a state that confirmed a duplicate discount occurred on a Medicaid managed care claim, because the agency did not yet have guidance for covered entities related to Medicaid managed care claims. Additionally, HRSA officials told us they would not require a covered entity to develop a corrective action plan or make offers of repayment to a manufacturer if a drug manufacturer’s audit of that covered entity identified a duplicate discount in managed care. Although HRSA officials told us that they expect covered entities to work in good faith with all parties involved to resolve potential duplicate discounts in managed care, HRSA does not require these actions if a duplicate discount is identified in managed care, as it does in FFS. This is particularly problematic as the majority of Medicaid enrollees, prescriptions, and spending for drugs are in managed care, and the drug manufacturers we contacted believe that duplicate discounts are more prevalent in Medicaid managed care than FFS. HRSA expecting but not requiring covered entities to address identified duplicate discounts related to Medicaid managed care is contrary to federal law, which provides that covered entities are liable to drug manufacturers for duplicate discounts that are identified through HRSA or manufacturer audits. It is also inconsistent with federal internal control standards related to monitoring, which state that management should oversee the prompt remediation of deficiencies and the audit resolution process, which begins when the results of an audit or other review are reported to management, and is completed only after action has been taken that corrects identified deficiencies. Without HRSA requiring covered entities to address identified duplicate discounts in Medicaid managed care as they would duplicate discounts in FFS, drug manufacturers may erroneously provide both 340B discounts and Medicaid rebates on the same drug claim. The prevention of duplicate discounts in the 340B and Medicaid Drug Rebate Programs requires extensive coordination between state Medicaid programs and covered entities, and among agencies within HHS. Similar levels of coordination are required to ensure that states are not forgoing rebates on drugs not purchased at the 340B price, which would result in increased costs for both state and federal governments. Limitations in federal oversight impede CMS’s and HRSA’s ability to ensure compliance with the prohibition on duplicate discounts. CMS does not assess whether states have 340B policies and procedures and, if so, whether they are documented, effective, and accessible to stakeholders. As a result, it is unable to proactively identify and correct problematic policies and procedures, and prevent duplicate discounts and forgone rebates. Additionally, without knowing state Medicaid programs’ 340B policies, HRSA is unable to perform a comprehensive review of whether covered entities are taking the necessary actions to prevent duplicate discounts. In addition, HRSA’s audits are not assessing compliance with the prohibition against duplicate discounts in managed care because the agency has yet to put forth guidance on this issue. While HRSA is not currently pursuing 340B-related guidance, the agency continues to work on determining next steps to respond to our 2018 recommendations on the issue. In the meantime, however, HRSA still must ensure that covered entities are complying with 340B Program requirements, including the prohibition on duplicate discounts in managed care. Failure to do so not only puts drug manufacturers at risk of providing duplicate discounts, but also compromises the integrity of the 340B Program. We are making a total of three recommendations, including one to CMS and two to HRSA. Specifically: The Administrator of CMS should ensure that state Medicaid programs have written policies and procedures that specify the extent to which covered entities can use 340B drugs for Medicaid beneficiaries, are designed to effectively identify if 340B drugs were used, and if so, how they should be excluded from Medicaid rebate requests. The policies and procedures should be made publically available and cover FFS, managed care, and all of the dispensing methods for outpatient drugs. (Recommendation 1) The Administrator of HRSA should incorporate assessments of covered entities’ compliance with state Medicaid programs’ policies and procedures regarding the use and identification of 340B drugs into its audit process, working with CMS as needed to obtain states’ policies and procedures. (Recommendation 2) The Administrator of HRSA should require covered entities to work with affected drug manufacturers regarding repayment of identified duplicate discounts in Medicaid managed care. (Recommendation 3) HHS provided written comments, which are reproduced in app. IV, and technical comments, which we have incorporated as appropriate. In its written comments, HHS concurred with one of our three recommendations and did not concur with the remaining two recommendations. HHS concurred with our recommendation that CMS ensure that state Medicaid programs have written policies and procedures for identifying 340B drugs and excluding them from Medicaid rebate requests and stated that it will work with states to strengthen policies and procedures related to 340B drugs for Medicaid beneficiaries. HHS did not concur with our recommendation that HRSA incorporate assessments of covered entities’ compliance with state Medicaid programs’ policies and procedures into its audit process. HHS stated that HRSA does not have authority to determine whether state Medicaid policies and procedures are “accurate and appropriate.” We agree that HRSA is not the appropriate party for reviewing and assessing state Medicaid programs’ policies and procedures, which is why we recommended that CMS, not HRSA, strengthen its oversight of states’ 340B-related policies and procedures, a recommendation with which HHS concurred. We recommended that HRSA update its 340B Program audits to include assessments of whether covered entities are following state Medicaid programs’ policies and procedures regarding the use and identification of 340B drugs. HHS stated that HRSA does not have authority to enforce covered entities’ compliance with state Medicaid programs’ policies and procedures and that doing so would be “beyond the scope of the 340B Program” and would require additional training for HRSA auditors, who currently “do not have this level of expertise.” While we understand that HRSA does not have authority to enforce compliance with state Medicaid programs’ policies and procedures, covered entities’ compliance with state Medicaid programs’ policies and procedures is fundamental to preventing duplicate discounts and assessing compliance with state policies and procedures is essential to ensuring covered entities’ compliance with the 340B Program’s prohibition on duplicate discounts. Further, HRSA already audits for compliance with certain aspects of states’ 340B-related Medicaid policies for preventing duplicate discounts. Specifically, HHS states that covered entities are expected to include a description of state policy in their policy and procedure manuals. If such descriptions exist, HRSA auditors are required to review those descriptions and determine if covered entities are following them. Thus, HRSA auditors already interpret state Medicaid policies and procedures when performing audits and the agency already enforces compliance with state policies by issuing audit findings when covered entities are not following them. However, as noted in our report, HRSA does not require its auditors to review state Medicaid programs’ actual policies and procedures. Instead, the auditors currently rely on covered entities’ descriptions of those policies and procedures, which we found were not always accurate. Additionally, knowledge of state policies would allow HRSA to incorporate an assessment of compliance into all audits as opposed to only those of covered entities that have such descriptions in their manuals. Finally, without considering states’ actual policies and procedures and ensuring that covered entities are following them, HRSA’s audits cannot effectively identify the potential for duplicate discounts. For example, simply checking covered entities’ actions against information on the MEF does not provide useful information if the covered entities are in one of the many states that do not use the MEF and instead direct entities to identify 340B drugs dispensed to Medicaid beneficiaries via a different mechanism, such as 340B identifiers. HHS states that implementing this recommendation would be burdensome and difficult to operationalize because HRSA would need to be notified of any changes to states’ policies and procedures. We understand that the lack of knowledge of state Medicaid programs’ policies related to duplicate discount prevention at the federal level complicates the ability of HRSA and its auditors to determine what state- level requirements exist and to apply them to audits. This is, in part, why we recommended that CMS ensure that state Medicaid programs’ policies are publicly available—a recommendation that, as noted above, HHS concurred with—and that HRSA work with CMS to obtain these policies as needed. Though we understand that this creates an additional step in HRSA’s audit process, we continue to believe that including an assessment of covered entities’ compliance with state Medicaid programs’ policies and procedures related to 340B drugs is necessary to identify potential duplicate discounts and to ensure covered entities’ compliance with 340B Program requirements. HHS also did not concur with our recommendation that HRSA should require covered entities to work with affected drug manufacturers regarding repayment of identified duplicate discounts in Medicaid managed care. In its response, HHS noted that because HRSA does not have guidance related to preventing duplicate discounts in Medicaid managed care, “it is difficult to assess compliance in this area.” However, our recommendation is not asking HRSA to assess compliance related to duplicate discounts in Medicaid managed care; instead, we are recommending that, when actual duplicate discounts have been identified, HRSA require covered entities to remedy those duplicate discounts. As noted in the report, actual duplicate discounts may be identified and confirmed by state Medicaid agencies through audits or other means. Given that HRSA officials told us that covered entities’ obligations for preventing duplicate discounts are the same for Medicaid FFS and managed care, the steps for addressing identified noncompliance should be similar, and thus, the agency should require and not just “encourage” covered entities to work with manufacturers to remedy any duplicate discounts related to managed care as they do for those related to FFS. Additionally, the potential for duplicate discounts related to Medicaid managed care has existed since 2010, when manufacturers were required to begin paying Medicaid rebates under managed care in addition to FFS. Ten years later, HRSA still has not issued guidance on how covered entities should prevent duplicate discounts in Medicaid managed care and has indicated that it is not pursuing new guidance at this time. This inaction continues to leave the 340B Program vulnerable to noncompliance with federal law. HHS concurred with our 2018 recommendations that HRSA issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care and incorporate into its audit process an assessment of covered entities' compliance with the prohibition on duplicate discounts as it relates to Medicaid managed care claims. Until these recommendations are implemented, HRSA must, at a minimum, ensure that covered entities work with manufacturers regarding any identified duplicate discounts in managed care to help ensure compliance with 340B Program requirements. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of HRSA, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at DraperD@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix V. Officials from all three drug manufacturers and the organizations that work on their behalf that we contacted reported challenges preventing and detecting duplicate discounts due to a lack of information. For example, officials from drug manufacturers told us that state Medicaid programs do not always provide data on the individual claims for which they were requesting rebates. Specifically, to obtain rebates, states submit requests to participating manufacturers for all drug purchases made that quarter; these requests contain the total quarterly amount owed for each of the manufacturers’ drugs, but not information detailing each claim for which rebates are being sought. Although the Centers for Medicare & Medicaid Services (CMS) encourages states to respond to reasonable manufacturer requests for claim-level data, the provision of such data is not required. Without this claim-level data, manufacturers reported that it is difficult to determine if rebate requests include claims for drugs purchased at the 340B discounted price. Additionally, manufacturers lack complete information on the extent to which covered entities use 340B drugs for Medicaid beneficiaries. This is because the Medicaid Exclusion File (MEF), a list maintained by the Health Resources and Services Administration (HRSA) to assist in the prevention of duplicate discounts, is only required to reflect the provider numbers used by covered entities that choose to use (carve in) 340B drugs provided directly by the covered entity to Medicaid fee-for-service (FFS) beneficiaries. The MEF does not include information on whether covered entities are using 340B drugs for Medicaid managed care beneficiaries and may not include information on contract pharmacies that are dispensing these drugs to Medicaid beneficiaries on covered entities’ behalf. Despite these limitations, the drug manufacturers we contacted reported that when claim-level data is available they review that data to detect potential duplicate discounts before they issue rebate payments. For example, officials from one drug manufacturer told us that they compare the provider numbers on the claim-level data obtained from states with the information on the MEF and dispute rebate requests for any claims from a provider number listed on the MEF. However, officials from some drug manufacturers told us that this approach is ineffective for preventing duplicate discounts for drugs dispensed at contract pharmacies because, as noted above, the MEF may not include information on contract pharmacies, and the claim-level data may only list the provider number for the dispensing pharmacy, not the prescribing covered entity. The drug manufacturers we contacted also reported trying to identify duplicate discounts after rebates have been paid by looking at 340B purchasing patterns. For example, officials from one drug manufacturer told us they look at covered entities’ purchases and assess whether the proportion of 340B purchases is consistent with their carve-in status. Specifically, these officials explained that if a covered entity is not listed on the MEF, then the entity should not be using 340B drugs for Medicaid FFS patients. Therefore, if all or nearly all of the purchases made by that covered entity were at the discounted price, it could indicate the presence of duplicate discounts. While the MEF is only intended to indicate covered entities that are using 340B drugs for Medicaid FFS beneficiaries, officials reported that drug manufacturers also rely on the MEF as a proxy for covered entities’ carve-in practices for Medicaid managed care since there is no equivalent data source. If there are concerns that duplicate discounts occurred, officials from the drug manufacturers we contacted indicated that they may conduct what is referred to as a “good faith inquiry,” in which the manufacturer, or a consultant working on the manufacturer’s behalf, requests data from covered entities on a specific set of drug claims for which they have paid rebates to determine if those claims involved 340B drugs. If drug manufacturers confirm that a duplicate discount did occur, officials reported that they may work to negotiate a repayment from the state or covered entity, depending on which party was responsible for the error. Additionally, one official who works on behalf of manufacturers told us that manufacturers also will work with covered entities to remedy the cause of the duplicate discount to prevent future occurrences. Drug manufacturers told us that it is not always clear whether states or covered entities are responsible for duplicate discounts, and thus, which party should be contacted regarding repayment. Additionally, drug manufacturers reported that some states refer them directly to covered entities to resolve all inquiries. Medicaid program officials in Michigan and Texas, for example, said that their states refer manufacturers to the covered entities because they believe that the covered entities would most likely be responsible for any duplicate discounts that occurred due to a failure to correctly apply the required claim identifiers. If drug manufacturers need assistance resolving their concerns or obtaining repayment for duplicate discounts, they can access options made available by HRSA and CMS. Specifically, drug manufacturers can request approval from HRSA to audit a covered entity to investigate suspicions of duplicate discounts in both Medicaid FFS and managed care. To receive approval from HRSA to conduct an audit, a drug manufacturer must document reasonable cause and provide an audit plan. In addition, HRSA requires the drug manufacturer to use an independent auditor who follows government auditing standards. According to HRSA, from October 2011 through August 2019, 45 audits were requested by drug manufacturers and 26 requests were approved. Of the 26 audits approved by HRSA, the agency received 13 final audit reports, six of which had duplicate discount-related findings. However, while audits can be a tool for identifying duplicate discounts and obtaining repayment, some drug manufacturers we spoke with indicated that the cost of audits may outweigh the benefits received in the form of repayments. Additionally, as noted previously, HRSA does not require covered entities to repay manufacturers for duplicate discounts that occur in managed care. Drug manufacturers also may use the state hearing process or pursue a dispute resolution in conjunction with states through CMS if their issues with state Medicaid programs cannot be resolved through inquires. According to CMS officials, through the dispute resolution process, the agency provides drug manufacturers and states with guidance to assist in determining responsibilities and identifying next steps to work through conflicts. CMS officials said that, in general, they have received five to 10 Medicaid drug rebate disputes per year, about half of which are related to 340B duplicate discount issues. Appendix II: State Medicaid Programs’ Policies on Covered Entities’ Use of 340B Drugs, by Dispensing Method California allows covered entities to dispense 340B drugs at contract pharmacies if there is an approved arrangement between the state, the covered entity, and the contract pharmacy. At the time of our information request, California officials indicated that they only had approved arrangements for certain hemophilia centers and had no approved arrangements with other types of covered entities. New Hampshire allows covered entities to provide 340B drugs to Medicaid beneficiaries, but generally does not allow them to bill Medicaid for these drugs. The one exception is that the state does allow covered entities that are approved family planning clinics to bill Medicaid for 340B drugs administered by providers to Medicaid beneficiaries. The term 340B drugs refers to drugs purchased by covered entities at a discounted price through the 340B Program. Carve out means that the state did not allow covered entities to provide 340B drugs to Medicaid beneficiaries. Carve in means that the state required covered entities to provide 340B drugs to eligible Medicaid beneficiaries. New Hampshire allows covered entities to provide 340B drugs to Medicaid beneficiaries, but generally does not allow them to bill Medicaid for these drugs. The one exception is that the state does allow covered entities that are approved family planning clinics to bill Medicaid for 340B drugs administered by providers to Medicaid beneficiaries. Managed care plans in this state do not cover outpatient drugs dispensed at pharmacies; they only cover provider-administered drugs. Appendix III: State Medicaid Programs’ Procedures for Identifying 340B Drugs, by Dispensing Method State does not allow covered entities to use 340B drugs for Medicaid fee-for-service beneficiaries for this dispensing method, and thus does not need a procedure to identify these drugs. Massachusetts requires contract pharmacies to include the covered entities’ National Provider Identifier on claims using 340B drugs, which the state then uses to exclude those claims from its rebate request. New Hampshire allows covered entities to provide 340B drugs through this dispensing method, but does not allow them to bill Medicaid for these drugs. Rhode Island uses a 340B claim identifier to identify and exclude associated drugs administered by providers at hospitals, but does not have any procedures to identify these drugs administered by providers at other types of covered entities. State does not allow covered entities to use 340B drugs for Medicaid managed care beneficiaries for this dispensing method and thus does not need a procedure to identify these drugs. New Hampshire allows covered entities to provide 340B drugs through this dispensing method, but does not allow them to bill Medicaid for these drugs. Managed care plans in this state do not cover outpatient drugs dispensed at pharmacies; they only cover provider-administered drugs. In addition to the contact named above, Michelle Rosenberg (Assistant Director), David Lichtenfeld (Analyst-in-Charge), Amanda Cherrin, and Sarah Tempel made key contributions to this report. Also contributing were Jennie Apter, Ethiene Salgado-Rodriguez, and Jennifer Whitworth.

Summary: Covered entities can receive substantial discounts on outpatient drugs through the 340B Program, an estimated 25 to 50 percent of the cost of the drugs, according to HRSA. Additionally, Medicaid drug rebates are an important source of savings for states and the federal government, saving more than $36 billion in fiscal year 2018. However, ensuring that manufacturers are not subject to both discounts requires coordination within HHS, and between covered entities and states. GAO was asked to provide information on the prevention of duplicate discounts. Among other things, this report examines HHS's efforts to ensure compliance with the prohibition on duplicate discounts. GAO reviewed documentation, including federal policies and those from all 50 states and Washington, D.C. on preventing duplicate discounts. GAO also interviewed officials from CMS, HRSA, and 16 covered entities from four states selected to obtain variation in the types of entities and other factors. The 340B Drug Pricing Program (340B Program) and the Medicaid Drug Rebate Program require manufacturers to provide discounts on outpatient drugs in order to have their drugs covered by Medicaid. These discounts take the form of reduced sales prices for covered entities participating in the 340B Program—eligible hospitals and federal grantees—and rebates on drugs dispensed to Medicaid beneficiaries, shared by states and the federal government. However, federal law prohibits subjecting manufacturers to “duplicate discounts” in which drugs provided to Medicaid beneficiaries are subject to both 340B Program discounted prices (i.e., are 340B drugs) and Medicaid rebates. To prevent duplicate discounts, state Medicaid programs must know when covered entities dispense 340B drugs to Medicaid beneficiaries, so the state programs can exclude those drugs from their Medicaid rebate requests. GAO found that limitations in the Department of Health and Human Services's (HHS) oversight of the 340B and Medicaid Drug Rebate Programs may increase the risk that duplicate discounts occur. HHS's Centers for Medicare & Medicaid Services (CMS) conducts limited oversight of state Medicaid programs' efforts to prevent duplicate discounts. CMS does not track or review states' policies or procedures for preventing duplicate discounts, and GAO found that the procedures states used to exclude 340B drugs are not always documented or effective at identifying these drugs. As a result, CMS does not have the information needed to effectively ensure that states exclude 340B drugs from Medicaid rebate requests. CMS also does not have a reasonable assurance that states are seeking rebates for all eligible drugs, potentially increasing costs to state and federal governments due to forgone rebates. HHS's Health Resources and Services Administration's (HRSA) audits of covered entities do not include reviews of states' policies and procedures for the use and identification of 340B drugs. As a result, the audits are unable to determine whether covered entities are following state requirements, and taking the necessary steps to comply with the prohibition on subjecting manufacturers to duplicate discounts. GAO reported in 2018 that HRSA had not issued guidance on, and did not audit for, duplicate discounts in Medicaid managed care and recommended the agency do so as the majority of Medicaid enrollees, prescriptions, and spending for drugs are in managed care. HRSA is working to determine next steps to address these recommendations. In this report, GAO found that, unlike Medicaid fee-for-service, when duplicate discounts in Medicaid managed care claims are identified, HRSA does not require covered entities to address them or work with manufacturers to repay them. As a result, manufacturers may be subject to duplicate discounts for drugs provided under managed care. Given these limitations in federal oversight, HHS does not have reasonable assurance that states and covered entities are complying with the prohibition on duplicate discounts. GAO is making three recommendations, namely that: 1) CMS ensure that state Medicaid programs have written policies and procedures that are designed to prevent duplicate discounts and forgone rebates; and that HRSA 2) incorporate covered entities' compliance with state policies into its audits, and 3) require covered entities to work with manufacturers regarding repayment of identified duplicate discounts in managed care. HHS agreed with the recommendation to CMS, but disagreed with those to HRSA. GAO continues to believe these are needed to improve oversight and the integrity of the 340B Program, as explained in the report.