The 340B Program was created in 1992 following the creation of the Medicaid Drug Rebate Program and gives 340B covered entities—certain eligible hospitals, clinics, and other entities—discounts on covered outpatient drugs comparable to those made available to state Medicaid agencies. According to HRSA, which administers and oversees the 340B Program, the program’s purpose is to enable participating hospitals and other providers to stretch scarce federal resources to reach more eligible patients and provide more comprehensive services. In addition to realizing substantial savings through 340B Program price discounts— which HRSA estimates as 25 to 50 percent of the cost of drugs—covered entities can generate revenue through their participation in the 340B Program. For example, they can purchase covered outpatient drugs at the 340B Program price for all eligible patients regardless of the patients’ income or insurance status and generate revenue by receiving reimbursement from patients’ insurance that may exceed the 340B prices paid for the drugs. Entities are generally eligible for the 340B Program—that is, are covered entities—if they receive one of 10 federal grants or are one of six types of hospital. Hospitals must also meet additional requirements, such as being owned or operated by a state or local government, being formally granted governmental powers, or being nongovernmental. The 340B statute requires nongovernmental hospitals to be nonprofit and to have contracts with state or local governments to provide health care services to the 340B-specified low-income population. However, the requirement does not specify criteria for these contracts, such as the amount or type of services to be provided to these low-income individuals. Generally, hospitals must also meet other requirements to participate, such as treating a disproportionate number of low-income Medicare and Medicaid patients. Hospital participation in the 340B Program has more than tripled over the last decade, due, in part, to the enactment of the Patient Protection and Affordable Care Act in 2010, which expanded the types of hospitals that could qualify for the program. According to data from HRSA, in 2009, prior to the law’s enactment, there were more than 800 340B-participating hospitals, compared to more than 2,500 in 2019. The majority of participating hospitals are nongovernmental hospitals. Specifically, 1,690, or 67 percent, of the hospitals participating as of January 1, 2019 were nongovernmental hospitals. (See figure 1.) HRSA is responsible for verifying hospitals’ and other covered entities’ eligibility to participate in the 340B Program. HRSA reviews nongovernmental hospitals’ eligibility for the 340B Program at registration, recertification, and through audits. Registration. Prior to participation in the 340B Program, hospitals must register with HRSA, at which point they must self-attest to meeting the program’s eligibility requirements. Additionally, HRSA’s hospital registration instructions specify that, at the time of registration, a nongovernmental hospital must have documentation that shows it is nonprofit (such as copies of Internal Revenue Service documentation) and a copy of its contract with a state or local government to serve the 340B-specified low-income population. This documentation must be provided to HRSA upon request. During each quarterly registration period, HRSA conducts contract integrity checks for a random sample of 20 percent of newly registering nongovernmental hospitals. For the selected hospitals, HRSA requests a copy of the hospital’s contract with the state or local government, which it reviews to verify that the contract is signed by officials from both organizations, is in effect, and does not expire before program participation would begin. HRSA policy states that a hospital that cannot provide a state or local government contract when selected for a contract integrity check at registration will not be registered for the 340B Program. Recertification. To remain in the 340B Program, hospitals must annually recertify their eligibility. During recertification, hospitals are to ensure that their information (e.g. name, address, point of contact) is correct in HRSA’s internal 340B Program database and self-attest that the hospital still meets program requirements. HRSA collects documentation from the hospital if it reports changes to its name, classification (i.e., whether it is government owned or operated, delegated governmental powers, or nongovernmental), or nonprofit status. Audits. HRSA audits 200 covered entities—a combination of hospitals and federal grantees—per year. HRSA’s audits include covered entities (including hospitals) that are selected based on risk-based criteria (approximately 90 percent of the audits conducted each year), and entities that are targeted based on, for example, stakeholder allegations of noncompliance (10 percent of audits conducted). The criteria for risk- based audits include a covered entity’s changes in the volume of 340B Program drug purchases, time in the program, complexity of its program, and history of violations or allegations of noncompliance. Among other things, HRSA’s audits include assessments of each hospital’s 340B eligibility status. For a nongovernmental hospital, HRSA’s guidance indicates that auditors are expected to review the hospital’s contract with the state or local government to ensure that it is for serving the 340B-specified low-income population and is signed by both a hospital and state or local government official. Auditors are also expected to review the contract’s start and end dates to ensure that it is effective during a specific period of review. HRSA defines the audit’s period of review as the time frame beginning the first day of the audit’s sample period—a six-month period that predates and is not contiguous with the beginning of the onsite audit—and ending on the last day of the onsite audit. For example, a hospital with an onsite audit in March of 2017 may have a sample period from July 1, 2016 through December 31, 2016, which means that auditors should verify that the hospital’s contract was in effect from at least July 1, 2016 through the end of the March 2017 onsite audit. If HRSA identifies deficiencies in hospitals’ contracts, the agency may issue (1) findings of noncompliance, which are made public on HRSA’s website, or (2) areas for improvement, which are not made public. When an audit results in a finding of noncompliance, the hospital is required to submit a corrective action plan within 60 days of the audit report being finalized for HRSA’s approval. HRSA closes the audit once the hospital attests that the corrective action plan has been fully implemented, and any necessary repayments have been made to affected manufacturers. For example, if a nongovernmental hospital were unable to demonstrate that it had a contract with a state or local government when audited, HRSA policy states that the hospital would be issued a finding of noncompliance and may be subject to termination from the 340B Program for not meeting eligibility criteria. In addition, the hospital may be responsible for repayment to manufacturers for discounts it received during the period it lacked a contract. Most of the contracts we reviewed between nongovernmental hospitals and state or local governments obligated the hospitals to provide health care services to low-income individuals, but they included few details about those obligations. The 340B statute requires participating nongovernmental hospitals to have state or local government contracts to provide health care services to the 340B-specified low-income population, but does not otherwise specify details for the content of these contracts. Of the 240 contracts we reviewed, 224 (93 percent) required the hospital to provide services to low-income individuals. Of these 224 contracts, 169 (75 percent) specifically mentioned providing services to the 340B-specified low-income population (low-income individuals not eligible for Medicaid or Medicare). 55 (25 percent) specified a more general obligation to provide services to individuals who are likely low-income, uninsured, or underinsured, such as enrollees in a county program for the medically indigent, inmates at a local detention center, or individuals receiving treatment through a county mental health program. Less than one-third of the contracts we reviewed defined “low-income” or included detailed requirements for the amount or type of services to be provided. Of the 224 contracts that contained an obligation to provide services to low-income individuals, 14 (6 percent) specified what was considered low income. Of these contracts, the specific income threshold varied, generally ranging from 100 percent to 400 percent of the federal poverty level. 71 (32 percent) specified the amount of services the hospitals were to provide to low-income individuals. The contracts generally defined the amount of services as a range in the cost of care the hospital was expected to provide; the amount varied by contract. For example, one contract specified that the hospital would provide $60,000 to $100,000 of services per year, while another included a range of $62 million to $85 million per year. Contracts that did not specify dollar amounts included, for example, provisions regarding the number of staff available to provide services or requirements to provide services at certain times. One such contract required a hospital to provide at least one full-time-equivalent behavioral health provider for specified sites, while another required a hospital to administer influenza vaccines at two clinics on two Fridays each year during influenza season. 53 (24 percent) identified specific types of services that hospitals were to provide, often specifying multiple categories of services. For example, one contract required a hospital, among other things, to provide inpatient and outpatient services, obstetrics, and cardiovascular surgery. Other contracts only identified a single category of service that the hospital was required to provide. For example, nine of the 53 contracts specified that the hospitals were required to provide emergency services, although hospitals that operate emergency departments are already required, as a condition of participating in Medicare, to screen, and if necessary stabilize patients who seek emergency care, regardless of their ability to pay. Additionally, four of the contracts reviewed required the provision of behavioral health services, two specified the provision of vaccinations, and one was for the evaluation and treatment of tuberculosis. 46 of the 224 contracts (21 percent) specified that state or local governments would pay hospitals for the services provided. In some cases, the contracts specified that the hospitals would be paid to provide care for low-income individuals at rates established under other programs–such as the state’s Medicaid program. Others established rates specifically for services provided to the population covered under the contract. Finally, approximately one-third of the contracts reviewed included provisions that would allow the state and local governments contracting with hospitals to ensure that the contractually required services are being provided. Specifically, 68 of the 224 contracts (30 percent) included provisions for reporting, monitoring or enforcement, as shown below in Figure 2; some contracts included more than one type of provision. Of the 68 contracts, 56 required hospitals to report information to the state or local government. Of these 56, 40 required reporting on the services provided under the contract, including types, dollar amounts, or number of services provided to certain populations, such as “medically indigent,” “uninsured persons,” and “underinsured persons.” For example, one contract required the hospital to provide the government with an annual report containing information about the value of free care provided to indigent persons, the total value of discounted care provided to uninsured patients, and the number of declined requests for free or discounted care. The remaining 16 contracts included more general reporting requirements, such as to provide copies of any reports requested by state or federal licensing, regulatory, or accrediting entities, to the state or local government. 29 contracts included provisions for governments to monitor the hospitals’ provision of care. Specifically, 10 contracts required regular reviews, with some of those at specific time intervals (e.g. annually, quarterly), while 19 contracts required that hospitals be available for periodic audits or to provide the government access, upon request, to medical records and documents which could be used to review or evaluate the services being provided under the contract. 34 contracts included enforcement mechanisms for the government to apply consequences if the hospital did not meet the terms of the agreement. For example, one contract allowed the state government to terminate the contract 90 days after providing notice of the state’s determination that the hospital was not providing sufficient services to low-income individuals. Contracts for eight hospitals provided for monetary fines or withholding of funds if hospitals were found to be in breach of the contract. HRSA uses self-reported data to determine whether hospitals are nonprofit without assessing whether the data are reliable for that purpose. Additionally, HRSA relies primarily on nongovernmental hospitals’ self- attestations to verify the existence of state or local government contracts, and weaknesses in the reviews of contracts it does conduct hamper the identification of potential eligibility issues. HRSA uses Medicare cost report data from CMS to determine whether hospitals are nonprofit, but these data may not be sufficiently reliable for this purpose. Specifically, HRSA relies on self-reported information from cost reports on whether hospitals operate as nonprofit, proprietary, or governmental organizations. HRSA reviews this information at registration to check that hospitals have indicated that they are nonprofit organizations. Additionally, in April 2019, HRSA began conducting quarterly checks of cost report data to identify hospitals that list themselves as proprietary for further review, as this designation could be used by for-profit, rather than nonprofit, hospitals, contrary to 340B Program eligibility requirements. HRSA officials told us that the agency has not independently evaluated the reliability of the cost report data for determining nonprofit status. Additionally, a CMS official responsible for oversight of Medicare cost reports told us that CMS does not have any formal processes to assess the reliability of the data on whether a hospital is nonprofit, proprietary, or governmental, because these data do not affect Medicare reimbursement. The official added that the question on the cost report used to collect these data was not intended to assess nonprofit status, is not clearly defined, and may not be reported accurately. For example, the cost report instructions do not include definitions of nonprofit and proprietary for providers to refer to when they are completing their cost reports. HRSA requires hospitals to maintain additional documentation, such as Internal Revenue Service forms for tax-exempt organizations or documents from the state, to demonstrate their nonprofit status, but does not collect or review this documentation if hospitals indicate that they are nonprofit on their cost reports. In August 2019, HRSA submitted a proposal to the Office of Management and Budget to require hospitals registering for the 340B Program to submit documentation supporting the hospital classification that they select during registration, which would include requiring nongovernmental hospitals to submit documentation of their nonprofit status. However, this requirement, if it goes into effect, would apply only to newly registering hospitals and would not affect the nearly 1,700 nongovernmental hospitals currently participating in the 340B Program. For those hospitals, HRSA would continue to rely on the Medicare cost report data. Relying on the self-reported data from Medicare cost reports is inconsistent with federal internal control standards related to information and communication, which state that management should use quality information to achieve the entity’s objectives, such as by obtaining relevant data, based on identified information requirements, that are reasonably free from error and bias, and that management should evaluate the data for reliability. Without ensuring that the information it uses on hospitals’ nonprofit status is reliable, HRSA cannot effectively determine if nongovernmental hospitals participating, or seeking to participate, in the 340B Program meet the statutory eligibility requirements, creating a risk that for-profit hospitals could receive discounted pricing for which they are not eligible. HRSA primarily relies on self-attestations from nongovernmental hospitals to verify that they have contracts in place with state or local governments as required to participate in the 340B Program. Specifically, HRSA relies on the attestations that hospitals are required to make during registration and recertification that they meet the program’s eligibility requirements. Although HRSA requires nongovernmental hospitals to have copies of their contracts, and to provide them upon request, it does not require most hospitals to submit those contracts at either registration or recertification. Additionally, while HRSA previously required each nongovernmental hospital to submit a certification of contract form during registration that was signed by a government official and attested to the existence of a contract to serve the 340B-specified low-income population, officials said the agency stopped requiring submission of this form in July 2014. At that time, officials said HRSA initiated a process of contacting government officials directly through an online certification process to confirm that newly registering hospitals had contracts in place. However, that process was eliminated in September 2017, and HRSA no longer has a process that requires state and local government officials to confirm the existence of contracts with nongovernmental hospitals. HRSA does collect and review contracts with state or local governments for a sample of nongovernmental hospitals through its audit and contract integrity check processes, but these reviews are currently limited in number and scope. Specifically, in fiscal years 2017 and 2018, HRSA audited about 7 percent of nongovernmental hospitals per year (108 and 109 hospitals in fiscal years 2017 and 2018, respectively). Additionally, at the time of our review, HRSA conducted contract integrity checks for 20 percent of newly registering hospitals; this equated to 41 hospitals in calendar years 2017 and 2018 combined. HRSA’s August 2019 proposed information collection request, if approved, would require all newly registering nongovernmental hospitals to submit their state or local government contracts at registration. However, as previously mentioned, this new requirement would only affect newly registering hospitals and not those already participating. Consequently, for the large majority of nongovernmental hospitals already registered for the 340B Program, self-attestations made electronically at registration and recertification would remain HRSA’s sole method of verifying that hospitals have state or local government contracts as required by the 340B statute. Additionally, HRSA officials told us that when the agency does collect documents from nongovernmental hospitals through its audits or contract integrity checks, they do not review them to determine if they are contracts (i.e., mutually binding agreements to provide services or supplies in exchange for something of value). Based on our review of documentation submitted to HRSA from 258 hospitals, 18 hospitals submitted documents that did not appear to meet this common definition of a contract; examples included certification of contract forms without accompanying contracts, articles of incorporation, and descriptions of community programs. Nevertheless, these hospitals were permitted to participate in the 340B Program. HRSA’s reliance on hospitals to attest that the required contracts are in place is contrary to federal internal control standards related to information and communication, which state that management should use quality information to achieve the entity’s objectives, such as by obtaining relevant data from external sources in a timely manner based on the identified information requirements. Without a process to verify that all nongovernmental hospitals have contracts in place, HRSA does not have reasonable assurance that nongovernmental hospitals participating in, or seeking to participate in, the 340B Program have contracts with state and local governments. Consequently, this increases the risk that nongovernmental hospitals that do not have the statutorily required contracts and are thus ineligible may register for, and participate in, the program. In addition to not determining whether the documentation provided by nongovernmental hospitals during contract integrity checks and audits are contracts, weaknesses in HRSA’s reviews hamper its ability to identify and address issues that affect the hospitals’ eligibility for the 340B Program. Specifically, we identified three weaknesses: (1) contract integrity checks do not assess whether contracts require hospitals to serve the 340B-specified low-income population; (2) guidance for auditors’ review of contracts has not been consistently documented and lacks detail; and (3) HRSA allows hospitals to avoid audit findings by entering into new contracts with state and local governments while audits are being conducted. HRSA’s contract integrity checks for newly registering hospitals do not assess whether the contracts require the provision of services to the 340B-specified low-income population. HRSA’s contract integrity checks for newly registering nongovernmental hospitals are limited to verifying that contracts clearly list the names of the hospital and unit of government and have appropriate signatures and dates; procedures for conducting these checks do not instruct staff to review whether the contracts require hospitals to provide health care services to the 340B-specified low-income population, as required to participate in the 340B Program. Of the 38 contracts submitted to HRSA for contract integrity checks in 2017 and 2018, two (5 percent) did not appear to require the hospitals to serve the 340B-specified low-income population, yet HRSA allowed the hospitals to begin participating in the 340B Program. Specifically, one hospital submitted a contract with a state government that was limited to providing services to beneficiaries of the state’s Medicaid program, although nongovernmental hospitals are to have contracts to provide services to individuals who are not entitled to Medicaid benefits. The other hospital submitted an agreement with a nonprofit company for management services, including accounting and payroll services, for their hospital and nursing home facilities. To participate in the 340B Program, nongovernmental hospitals must have a contract with a state or local government to provide health care services to the 340B-specified low-income population. Thus, allowing hospitals to participate when the state or local government contracts they submitted for review do not require them to serve this population is inconsistent with HRSA’s responsibilities for oversight of the 340B Program, including ensuring that participating hospitals meet the statutory eligibility requirements. Without amending its contract integrity checks to include verifying that newly registering hospitals have contracts that meet statutory eligibility requirements, HRSA risks allowing hospitals that are not eligible, and which may not be providing services to the 340B- specified low-income population, to participate in the 340B Program. Guidance for contract reviews during audits has not been consistently documented over time and lacks detailed instructions. Although HRSA officials told us they have always expected auditors to look for a contract through which a nongovernmental hospital would be eligible for the 340B Program, we found that HRSA’s guidance for auditors has not clearly documented these expectations and lacks detailed instructions. HRSA did not document key elements to look for— signatures, dates, and a requirement to serve the 340B-specified low- income population—in its guidance for auditors until August 2018. Further, the agency has made frequent changes to its guidance and procedures. For example, between November 2017 and July 2019, HRSA modified its guidance for auditors at least six times. In addition, HRSA’s guidance states that auditors are expected to perform a “simple logic test” to determine whether contracts require the hospital to serve the 340B- specified low-income population, but HRSA has not provided any additional information about how auditors are expected to conduct such a test. The guidance also advises auditors not to “dive too deep” when reviewing contracts. Of the 202 contracts submitted by hospitals as part of HRSA’s audits that we reviewed, 11 contracts (5 percent) did not appear to require hospitals to provide care to the 340B-specified low- income population, yet HRSA allowed the hospitals to continue their participation in the program. One such contract was a consent order that stated that the state’s attorney general would defer enforcement action based on the hospital’s agreement to abide by certain medical debt collection practices, such as adopting a zero tolerance policy for abusive, harassing, oppressive, false, deceptive, or misleading language or collections conduct. Furthermore, HRSA’s procedures for audits do not require auditors to separately affirm and record their review of the dates, signatures, and services required in the contracts. Thus, HRSA has no way of knowing whether auditors have checked and verified each of these elements. In addition to the 11 contracts that did not appear to obligate the hospitals to provide health care services to the 340B-specified low-income population, our review of 202 contracts submitted to HRSA by audited hospitals found 16 contracts (8 percent) were missing one or both signatures; 15 contracts (7 percent) were missing effective dates or were expired; at least 8 contracts had dates that did not cover the audit’s period of review, which includes a 6-month sample period before the start of the audit. For at least some of these contracts, HRSA was unaware of the issues we identified; HRSA did not issue audit findings in response to any of these contracts. HRSA has taken steps to address expired contracts. Specifically, in May 2019, HRSA revised its procedures for hospital registration and contract integrity checks to include language specifying that a hospital should not be approved for registration unless a contract is currently in place and that the contract must not expire before the participation start date. In addition, HRSA officials told us that in January 2020 the agency plans to implement a quarterly check of its 340B database to identify hospitals with expired state or local government contracts. However, these efforts do not address other date-related issues such as missing effective dates, or the issues with signatures or contract service requirements. Federal internal control standards related to control activities and enforcing accountability state that agencies should (1) implement control activities through policies, such as by documenting policies in the appropriate level of detail to allow management to effectively monitor the control activity; and (2) evaluate performance and hold individuals accountable for their internal control responsibilities, such as by communicating with the service organizations contracted to perform roles about the agency’s objectives and related risks, assigned responsibilities and authorities, and the expectations of competence to enable the service organization to perform its responsibilities. Without more specific guidance for auditors’ review of contracts, and procedures requiring auditors to separately document their review of each contract element, HRSA lacks reasonable assurance that the audits are appropriately identifying deficiencies in nongovernmental hospitals’ contracts with state or local governments. As a result, some hospitals appear to be participating in the 340B Program based on contracts that are inconsistent with program requirements or HRSA’s guidance. HRSA allows audited hospitals to avoid audit findings by entering into new contracts with state and local governments while audits are being conducted. As previously noted, our review of contracts submitted to HRSA by audited hospitals found that eight hospitals provided contracts that did not appear to cover the audit’s period of review. Three of the eight hospitals entered into the contracts while the audit was ongoing. According to HRSA policy, a hospital that does not demonstrate that it had a contract for the entire audit period should be issued a finding of noncompliance and held responsible for repayment to manufacturers for any discounts received improperly during the period for which it did not have a contract. However, HRSA did not issue such findings or penalties for any of the hospitals we identified with contracts that did not cover the audit’s period of review. For example, in one case, officials said HRSA had included a finding in its draft audit report, but withdrew it when presented with a new contract with an effective date made retroactive to cover the audit’s entire period of review. in another case, a hospital that had been government-owned was sold to a private company in 2013, but did not switch its classification to nongovernmental until 2015, and did not sign a contract with a state or local government until it was audited in fiscal year 2018. The hospital’s contract, signed in 2018, included a retrospective attestation that the hospital had been providing care for the 340B-specified population since 2013. HRSA officials told us that they accept such retroactive documentation in conjunction with current, valid contracts on a case-by-case basis. As such, a hospital may avoid findings, and potential repayments to manufacturers, by asserting that it had been providing care even when a contract was not in place. To participate in the 340B Program, a nongovernmental hospital is required by statute and HRSA policy to have a contract with state or local government to serve the 340B-specified low-income population. Allowing hospitals to submit retroactive contracts after they have already begun participation in the program is inconsistent with HRSA’s responsibilities for oversight of the 340B Program, including ensuring that participating hospitals meet the statutory eligibility requirements. Further, allowing hospitals that are unable to demonstrate that they have contracts in place that cover the audit’s period of review to continue to participate in the 340B Program without consequence undermines the effectiveness of HRSA’s audit process and increases the risk that ineligible hospitals will receive discounts under the program. The 340B Program allows hospitals and certain other providers to stretch federal resources to reach more eligible patients and provide more comprehensive services. Participation in the 340B Program also can be beneficial for hospitals and other covered entities as they can realize substantial savings on covered outpatient drugs and generate revenue on those drugs. Hospital participation in the 340B Program, and hospital purchases of discounted drugs through the 340B Program, has risen rapidly over time. However, HRSA’s current processes and procedures do not provide reasonable assurance that nongovernmental hospitals seeking to participate and benefit from the 340B Program meet the program’s eligibility requirements. Given the weaknesses in HRSA’s oversight, some hospitals that do not appear to meet the statutory requirements for program eligibility are participating in the 340B Program and receiving discounted prices for drugs for which they may not be eligible. Although HRSA has initiated some efforts to strengthen its processes for assessing hospitals’ eligibility, continued growth in the number of participating hospitals and 340B- purchased drugs highlights the need for HRSA to improve its oversight processes. This is critical to safeguarding the integrity of the 340B Program. We are making the following six recommendations to HRSA: The Administrator of HRSA should ensure that the information it uses to verify nonprofit status for all nongovernmental hospitals that participate in the 340B Program is reliable—for example, by requiring and reviewing the submission of official documentation hospitals must already maintain or by ensuring the reliability of the data the agency uses. (Recommendation 1) The Administrator of HRSA should implement a process to verify that every nongovernmental hospital that participates in the 340B Program has a contract with a state or local government as required by statute. (Recommendation 2) The Administrator of HRSA should amend its contract integrity check procedures for the 340B Program to include a review of whether hospitals’ contracts with state and local governments require the provision of health care services to low-income individuals not eligible for Medicaid or Medicare as required by statute, and should provide guidance for staff to conduct these reviews. (Recommendation 3) The Administrator of HRSA should provide more specific guidance for 340B Program auditors on how to determine if nongovernmental hospitals’ contracts with state and local governments require the provision of health care services to low-income individuals not eligible for Medicaid or Medicare. (Recommendation 4) The Administrator of HRSA should revise its 340B Program audit procedures to require auditors to document their assessments of whether nongovernmental hospitals’ contracts with state and local governments are appropriately signed, cover the time periods under review, and require hospitals to serve low-income individuals not eligible for Medicaid or Medicare, such as by requiring auditors to separately affirm and record their review of each of these elements. (Recommendation 5) The Administrator of HRSA should require nongovernmental hospitals participating in the 340B Program to demonstrate that they have contracts with state or local governments in effect prior to the beginning of their audits’ periods of review and should apply consistent and appropriate consequences for hospitals that are unable to do so. (Recommendation 6) HHS provided written comments on a draft of this report, which are reproduced in appendix II, and technical comments, which we have incorporated as appropriate. In its written comments, HHS concurred with five of our six recommendations; it did not concur with one of them. In concurring with five of our recommendations, HHS stated that HRSA is evaluating its audit process and other program integrity efforts, and noted that HRSA has made improvements to strengthen its program integrity efforts that align with some of our recommendations. With respect to our recommendation to require auditors to document their assessments of the required elements of contracts, HHS concurred and noted that HRSA updated its audit procedures. Specifically, HRSA’s draft procedures for fiscal year 2020 audits require auditors to specify if the hospital provided a contract that includes the names and signatures for both the hospital and government agency, effective dates that cover the entire audit period, and that requires the provision of services to the 340B-specified low- income population. We are pleased that HRSA has already taken this step to implement our recommendation. To fully implement this recommendation, HRSA should incorporate these changes into its final audit procedures for fiscal year 2020. HHS also concurred with our recommendation to require nongovernmental hospitals to demonstrate that they have contracts in effect prior to the beginning of the audits’ periods of review, and to apply consistent and appropriate consequences if they do not. Also, as noted above, HRSA has updated its draft audit procedures to specify that auditors should look for effective dates that cover the entire audit period. While this is an important step, HRSA must also show that it has applied consistent and appropriate consequences when auditors find that nongovernmental hospitals did not have contracts in effect prior to the beginning of their audit periods. On a related issue, HHS expressed concern over and disagreed with our finding that HRSA allows hospitals to avoid audit findings by entering into new contracts while audits are being conducted, noting that HRSA assesses potential audit findings on a case-by-case basis to ensure that any necessary steps are taken to address issues. However, as we reported, HRSA officials have indicated that they accept retroactive contract documentation on a case-by-case basis; we continue to believe that this practice—accepting new contracts that are retroactive— effectively allows hospitals to avoid audit findings. In addition, while we agree that working with hospitals to address noncompliance is appropriate, we continue to believe that such efforts should be in addition to, not instead of, documenting noncompliance by issuing findings and applying appropriate consequences, in accordance with HRSA’s audit policies and procedures. To do otherwise undermines the integrity of HRSA’s audits, and increases the risk that ineligible hospitals will receive discounts under the program. HHS also concurred with our recommendation to ensure that the information HRSA uses to verify nonprofit status is reliable, but stated that HRSA believes that the information it uses from hospitals’ Medicare cost reports is reliable, because hospital administrators attest to the accuracy of their cost reports. However, as discussed in our report, neither HRSA nor CMS has evaluated the reliability of the cost report data for verifying nonprofit status, and a CMS official responsible for oversight of the cost reports told us that the question on the cost report is not clearly defined and may not be reported accurately. As such, we continue to believe that HRSA needs to assess the reliability of the Medicare cost report data should it continue to use those data for determining hospitals’ nonprofit status. Alternatively, HRSA could require hospitals to submit documentation of their nonprofit status, such as Internal Revenue Service documents, which HRSA acknowledged hospitals are required to maintain as part of their auditable records. HHS did not concur with our recommendation to implement a process to verify that every nongovernmental hospital that participates in the 340B Program has the statutorily required contract with a state or local government. HHS noted that it has requested authority to require hospitals registering for the 340B Program to submit documentation supporting the hospital classification that they select during registration. According to HHS, if approved, HRSA would begin collecting and reviewing contracts from all newly registering nongovernmental hospitals. However, HHS stated that HRSA does not have the resources to collect, review, and verify that every participating nongovernmental hospital has a contract with a state or local government. While we understand that verifying the existence of contracts for all participating nongovernmental hospitals would require additional effort on HRSA’s part, our review found that relying on hospitals’ attestations is not sufficient to ensure hospitals’ eligibility. Additionally, implementing a process to verify the existence of a contract does not necessarily require that HRSA collect and review contracts from every hospital. There are other potential options, such as obtaining confirmation from the state or local government that they indeed have a contract with the hospital to provide services to the 340B-specified low-income population. HHS also commented that implementing our recommendation would create a significant burden on covered entities. However, as we noted in our report, HRSA already requires hospitals to maintain copies of their state or local government contracts. Therefore, it is unclear how implementing a process to verify the existence of those contracts would represent a significant burden for nongovernmental hospitals already registered for the program. Ensuring the eligibility of covered entities that participate in the 340B Program is essential for program integrity. As such, we continue to believe that HRSA needs to take action, beyond relying on hospitals’ self-attestations, to verify that all participating nongovernmental hospitals have contracts with state or local governments that meet the statutory requirements of the program. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Administrator of HRSA, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or draperd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other major contributors to this report are listed in appendix III. Table 1 provides information about the 240 contracts between hospitals and state or local governments that were included in our review, including information about the type of hospital and the level of government that were parties to the contract. In at least two cases, the hospitals contracted with other health care providers who were themselves 340B Program participants, such as a community health center operated by a local health department. Officials signing on behalf of state and local governments included individuals with executive positions, such as the heads of state agencies, mayors, and county executives, but also included a city alderman, a vice-chancellor for finance at a state university health system, and a juvenile court judge. In addition to the contact named above, Michelle Rosenberg, Assistant Director; Hannah Locke, Analyst-in-Charge; Jennie Apter; George Bogart; Kaitlin Farquharson; Matthew Green; Vikki Porter; Daniel Ries; Brienne Tierney; and William T. Woods made key contributions to this report.

Summary: The number of nongovernmental hospitals participating in the 340B Program has grown over time. HRSA requires participating hospitals to register and annually recertify their eligibility. HRSA also reviews hospitals' eligibility through audits of a small sample each year. GAO was asked to provide information on 340B-participating hospitals' contracts with state and local governments. This report (1) describes any obligations in selected nongovernmental hospitals' contracts to serve low-income individuals, and (2) examines HRSA's processes to assess nongovernmental hospitals' eligibility. GAO examined contract documentation from all 258 nongovernmental hospitals HRSA reviewed in 2017 and 2018; and HRSA's policies, procedures, and guidance related to 340B hospital eligibility. GAO also interviewed HRSA officials. Under the 340B Drug Pricing Program (340B Program), administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), drug manufacturers provide discounted prices on outpatient drugs to certain hospitals and other entities. About two-thirds of hospitals participating in the 340B Program (approximately 1,700) are nongovernmental hospitals (private, nonprofit hospitals), which qualify for the program, in part, based on having contracts with state or local governments to provide health care services to the 340B-specified low-income population—low-income individuals not eligible for Medicaid or Medicare. GAO's review of contract documentation for 258 nongovernmental hospitals found that most contracts obligated these hospitals to provide health care services to low-income individuals. However, few of the contracts reviewed included details about those obligations, such as the amount or type of care hospitals were required to provide. The statute does not require the contracts to contain such details. GAO found that HRSA's processes do not provide reasonable assurance that participating nongovernmental hospitals meet eligibility requirements. For example, HRSA primarily relies on hospitals' self-attestations to verify the existence of contracts with state and local governments. The agency reviewed contract documentation for less than 10 percent of nongovernmental hospitals per year in 2017 and 2018. GAO also identified several weaknesses in HRSA's review of the nongovernmental hospital contracts: HRSA does not conduct reviews to determine whether the documents submitted by nongovernmental hospitals are actual contracts, namely that they are mutually binding agreements to provide services or supplies in exchange for something of value. GAO found that 18 of the 258 hospitals reviewed submitted documents that did not appear to be contracts, such as descriptions of community programs, yet all of these hospitals were permitted to participate in the program. When audits have identified hospitals that did not have contracts in place throughout the audits' periods of review, HRSA has allowed hospitals to avoid audit findings by, for example, entering into new contracts with retroactive start dates. This practice undermines the integrity of HRSA's audits. HRSA's contract reviews do not always include assessments of whether contracts are consistent with the statutory requirement to provide health care services to the 340B-specified low-income population and HRSA's guidance for conducting such assessments, when required, lacks detailed instructions. As a result, GAO found that contracts for 13 hospitals reviewed did not appear to require hospitals to serve the 340B-specified low-income population. Despite this, these 13 hospitals were permitted to participate in the program. Given these weaknesses, some nongovernmental hospitals that do not appear to meet the statutory requirements for program eligibility are participating in the 340B Program and receiving discounted prices for drugs for which they may not be eligible. GAO is making six recommendations, including that HRSA implement a process to verify that all nongovernmental hospitals have contracts in place, including throughout hospitals' audit periods; amend its contract reviews to include an assessment of whether contracts meet statutory requirements; and provide better guidance on contract reviews. HHS concurred with all of the recommendations except the one to implement a process to verify that all nongovernmental hospitals have contracts. GAO continues to believe this action is needed to ensure that only eligible hospitals are allowed to participate in the 340B Program.