The 340B Program was created in 1992 following the enactment of the Medicaid Drug Rebate Program and gives 340B covered entities discounts on outpatient drugs comparable to those made available to state Medicaid agencies. HRSA is responsible for administering and overseeing the 340B Program. Eligibility for the 340B Program, which is defined in the Public Health Service Act, has expanded over time. Covered entities generally become eligible for the 340B Program by qualifying as certain federal grantees or as one of six specified types of hospitals. Eligible federal grantees include federally qualified health centers (FQHCs), which provide comprehensive community-based primary and preventive care services to medically underserved populations, as well as certain other federal grantees, such as family planning clinics and Ryan White HIV/AIDS program grantees. Eligible hospitals include critical access hospitals—small, rural hospitals with no more than 25 inpatient beds; disproportionate share hospitals— general acute care hospitals that serve a disproportionate number of low- income patients; and four other types of hospitals (see fig. 1). Some covered entities, typically hospitals and FQHCs, have multiple sites: the main site, which HRSA refers to as the parent site, and one or more other associated sites referred to as child sites. Child sites can include satellite clinics, off-site outpatient facilities, hospital departments, and other facilities. According to HRSA officials, to participate in the 340B Program and be considered part of the covered entity, the associated sites must meet program requirements and be registered with HRSA as a child site. The 340B price for a drug—often referred to as the 340B ceiling price—is based on a statutory formula and represents the highest price a participating drug manufacturer may charge covered entities. Covered entities must follow certain requirements as a condition of participating in the 340B Program. For example, covered entities are prohibited from subjecting manufacturers to “duplicate discounts” in which drugs prescribed to Medicaid beneficiaries are subject to both the 340B price and a rebate through the Medicaid Drug Rebate Program. diverting any drug purchased at the 340B price to an individual who is not a patient of the covered entity. Under HRSA guidance defining this term, diversion generally occurs when 340B drugs are given to individuals who are not receiving health care services from covered entities or are receiving services that are not consistent with the type of services for which the covered entity qualified for 340B status. (See table 1 for more information on HRSA’s definition of an eligible patient.) Covered entities are permitted to use drugs purchased at the 340B price for all individuals who meet the 340B Program definition of a patient regardless of their financial or insurance status. Covered entities may choose to dispense 340B drugs they purchase through contract pharmacies. The adoption and use of contract pharmacies in the 340B Program is governed by HRSA guidance. HRSA’s original guidance permitting the use of contract pharmacies limited their use to entities that did not have in-house pharmacies and allowed each entity to contract with only one outside pharmacy. However, March 2010 guidance lifted the restriction on the number of pharmacies with which a covered entity could contract. Since that time, the number of contract pharmacies has increased more than fifteen-fold, from about 1,300 to approximately 20,000. According to HRSA guidance, a covered entity is required to have a written contract in place with each pharmacy through which it intends to dispense 340B drugs, but is not generally required to submit its pharmacy contracts to HRSA. A covered entity that has more than one site at which it provides health care may enter into separate pharmacy contracts for the parent site and each child site, or one comprehensive pharmacy contract including all sites intending to use the pharmacy. It is up to the covered entity to determine which of its sites will be included in a contract with a pharmacy, and thus have what is referred to as a contract pharmacy arrangement with that pharmacy. Figure 2 provides an illustration of a covered entity that has four contract pharmacies but a total of six contract pharmacy arrangements, as not all of the entity’s sites have contracts with each of the pharmacies. Covered entities that choose to have contract pharmacies are required to register with HRSA the names of each of the pharmacies with which they contract. Covered entities may register their contract pharmacies in one of two ways: 1) only in relation to the parent site (use by child sites would be allowed as long as the sites were included in a comprehensive contract between the entity and the contracted pharmacies); or 2) separately for each site (parent and child) involved in a contractual arrangement with the pharmacy. As part of this registration, HRSA guidance specifies that covered entities must certify that they have signed and have in effect an agreement with each contract pharmacy and have a plan to ensure compliance with the statutory prohibitions on 340B drug diversion and duplicate discounts at their contract pharmacies. Like other pharmacies, when contract pharmacies fill prescriptions, they collect payments from the patient; if the patient has health insurance, the pharmacy will bill the insurer for the drug. In addition, each covered entity must determine which prescriptions are for eligible patients of the entity, and thus, can be filled with 340B drugs. One way that a covered entity could choose to do this is to employ a TPA to review all the prescriptions filled by a contract pharmacy to determine which, if any, prescriptions were issued by the covered entity to an eligible patient, and thus are eligible for the 340B discount. The covered entity then pays both the contract pharmacy and the TPA fees that they have negotiated for their roles in managing and distributing 340B drugs. These fees are typically deducted from the reimbursed amounts received from patients and their health insurers by the pharmacy and TPA, and then the balance is forwarded to the covered entity. (See fig. 3 for an example of how covered entities work with contract pharmacies and TPAs to dispense 340B drugs.) In fiscal year 2012, HRSA implemented a systematic approach to conducting audits of covered entities that is outlined on its website. HRSA has increased the number of covered entities audited since it began audits in fiscal year 2012, and now audits 200 entities per year. (See table 2.) HRSA’s audits include covered entities that are randomly selected based on risk-based criteria (approximately 90 percent of all audits conducted each year), and covered entities that are targeted based on information from stakeholders such as drug manufacturers (10 percent of the audits conducted). The criteria for risk-based audits include a covered entity’s volume of 340B drug purchases, number of contract pharmacies, time in the 340B Program, complexity of its program, and history of violations or allegations of noncompliance associated with diversion and duplicate discounts. Among other things, HRSA’s audits include reviews of each covered entity’s policies and procedures, including those for overseeing contract pharmacies; an assessment of the entity’s compliance with respect to 340B eligibility status, the prevention of duplicate discounts and diversion, and other program requirements; and reviews of a sample of prescriptions filled during a 6-month period, including prescriptions dispensed by contract pharmacies, to identify instances of non- compliance. As a result of the audits conducted, HRSA has identified instances of non-compliance with program requirements, including violations related to drug diversion and the potential for duplicate discounts. Based on the audits for which results were posted on HRSA’s website as of February 8, 2018, 72 percent of the covered entities audited in fiscal years 2012 through 2017 had one or more findings of noncompliance. When an audit of a covered entity has a finding of noncompliance, covered entities are required to submit a corrective action plan within 60 days of the audit being finalized for HRSA approval. HRSA closes out the audit once the entity attests that the corrective action plan has been fully implemented and any necessary repayments have been made to affected manufacturers. As of July 1, 2017, about one-third of the more than 12,000 covered entities in the 340B Program had contract pharmacies, but the extent to which covered entities had contract pharmacies varied by type of entity. Overall, a higher percentage of hospitals (69.3 percent) had at least one contract pharmacy compared to federal grantees (22.8 percent). Among the six types of hospitals, the percentage that had at least one contract pharmacy ranged from 39.2 percent of children’s hospitals to 74.1 percent of critical access hospitals. Among the 10 types of federal grantees, the percentage with at least one contract pharmacy ranged from 3.9 percent of family planning clinics to 75.2 percent of FQHCs (see fig.4). Among covered entities that had at least 1 contract pharmacy, the number of contract pharmacies ranged from 1 to 439, with an average of 12 contract pharmacies per entity. However, the number of contract pharmacies varied by covered entity type, with disproportionate share hospitals having the most on average (25 contract pharmacies), and critical access hospitals having the least (4 contract pharmacies). (See fig. 5 for the distribution of contract pharmacies by covered entity type.) However, we found that a covered entity that contracts with a pharmacy may not actually use the pharmacy to dispense 340B drugs. For example, three covered entities that received our questionnaire told us that although they had one or more contract pharmacies registered with HRSA, they did not use those pharmacies to dispense 340B drugs. Moreover, officials from a covered entity we interviewed reported that while the entity maintained a contract with a specialty pharmacy, it had not dispensed 340B drugs through that pharmacy in several years. Officials explained that the covered entity maintained its contract and continued to register this pharmacy with HRSA because it would be financially beneficial should it have a patient fill a 340B-eligible specialty drug at this pharmacy in the future. The actual number of 340B contract pharmacy arrangements—the number of contractual arrangements between contract pharmacies and the sites of a covered entity—is unknown because HRSA does not require a covered entity to register pharmacies with each of its child sites. Rather, HRSA gives covered entities the option to register contract pharmacies only in relation to the parent site: child sites may use that pharmacy if included in the written contract between the entity and the pharmacy. Based on our analysis of HRSA data, 1,645 covered entities that had at least one child site registered their contract pharmacies only with their parent sites. These 1,645 covered entities had a total of 25,481 registered contract pharmacy arrangements. However, if the pharmacies were contracted to work with all of the covered entities’ sites—the parents and all the child sites—then these 1,645 entities could have as many as 866,388 contract pharmacy arrangements. Therefore, the number of contract pharmacy arrangements is likely higher than what is reported in HRSA’s database. Nearly 93 percent of the approximately 20,000 pharmacies that 340B covered entities contracted with as of July 1, 2017, were classified as community/retail pharmacies, less than 1 percent were classified as specialty pharmacies, and about 7 percent were other types of pharmacies including institutional and mail order pharmacies. Furthermore, the majority (75 percent) of 340B contract pharmacies were chain pharmacies, while 20 percent were independent pharmacies and 5 percent were other pharmacies. In contrast, slightly over half of all pharmacies nationwide are chain pharmacies and about one-third are independent. The five biggest pharmacy chains—CVS, Walgreens, Walmart, Rite-Aid, and Kroger—represented a combined 60 percent of 340B contract pharmacies, but only 35 percent of all pharmacies nationwide. Figure 6 shows how the types of pharmacies varied by type of covered entity. Critical access hospitals had a higher proportion of independent contract pharmacies (40 percent of their pharmacies) compared to other covered entity types (which ranged from 11 percent for disproportionate share hospitals to 21 percent for other federal grantees). Our analysis suggests that this is likely due, in part, to a larger proportion of critical access hospitals compared to other types of covered entities being located in rural areas; independent contract pharmacies are also more likely than other contract pharmacies to be located in rural areas. Across all covered entities, the distance between the entities and their contract pharmacies ranged from 0 miles (meaning that the contract pharmacy and entity were co-located) to more than 5,000 miles; the median distance was 4.2 miles. Table 3 shows the distribution of distances between covered entities and their pharmacies overall and by entity type. While there was a range in distances between covered entities and each of their pharmacies, about half of the entities had all their contract pharmacies located within 30 miles, but this varied by entity type. Specifically, more than 60 percent of critical access hospitals and FQHCs had all of their contract pharmacies within 30 miles. In contrast, 45 percent of disproportionate share hospitals had at least one pharmacy that was more than 1,000 miles away compared to 11 percent or less for grantees and critical access hospitals. (See fig. 7.) Contracts we reviewed between selected covered entities and contract pharmacies showed that entities generally agreed to pay their contract pharmacies a flat fee per 340B prescription, with some entities also paying additional fees based on a percentage of revenue. Selected covered entities and TPAs included in our review indicated two main methods entities use to pay for TPA services: 1) per prescription processed, or 2) per contract pharmacy. Twenty-nine of the 30 contracts we reviewed between covered entities and contract pharmacies included provisions for the entities to pay flat fees for each eligible 340B prescription. For the remaining contract, the covered entity and the contract pharmacy were part of the same hospital system, and the contract provided that the entity would not pay fees for 340B prescriptions. In addition to payment of flat fees, 13 of the 29 contracts required the covered entity to pay the contract pharmacy a fee based on a percentage of revenue generated for each 340B prescription. Among the contracts we reviewed, more federal grantees than hospitals had contracts that included both flat fees and fees based on the percentage of revenue (see fig. 8). We found a wide range in the amount of flat fees covered entities agreed to pay pharmacies in the contracts we reviewed, though they generally ranged from $6 to $15 per 340B prescription. (See Appendix I for a description of fees listed in each of the contracts we reviewed.) The amount of the flat fees per 340B prescription varied by several factors according to our review, including covered entity type, type of drug, and patient insurance status: Flat fees were generally higher for hospitals than federal grantees. In general, hospitals’ flat fees were higher than those for grantees, with most flat fees ranging from $15 to $25 per 340B prescription for hospitals, compared to from $6 to $13 for grantees. Flat fees were sometimes higher for brand drugs. Three of the 29 contracts we reviewed specified different flat fees for brand and generic drugs. In 2 of these contracts flat fees were $5 or $7 higher for brand drugs. In the remaining contract, the fees for some brand drugs were substantially higher, ranging from $75 to $1,750 for brand drugs, compared to $0 for generic drugs. Additionally, some contracts we reviewed only specified a fee for brand drugs, and 4 of the contracts either excluded generic drugs from being purchased at the 340B price or limited the use of the 340B Program to brand drugs. Flat fees were different or substantially higher for certain specialty drugs. For 2 of the 29 contracts we reviewed, flat fees were for drugs to treat hemophilia. Given the different nature of hemophilia treatment drugs, fees for these drugs were different than those in the other contracts for other types of drugs, and provided for payments of $.06 and $.09 per unit of blood clotting factor. Additionally, 2 contracts contained substantially higher flat fees for specialty medications. In 1 contract, the flat fees were $125 per prescription for brand and generic human immunodeficiency virus drugs, and $1,750 for brand hepatitis C drugs. In another contract the flat fees were $65 for all specialty drugs, compared to $13 for other drugs. Flat fees were sometimes higher for 340B prescriptions dispensed to patients with insurance. Seven of the 29 contracts we reviewed specified different flat fees for prescriptions provided to patients with health insurance than for patients paying with cash or through a drug discount card provided by the covered entity. The flat fees entities would pay under these contracts ranged from $1 to $16 higher per 340B prescription dispensed to insured patients compared to patients not using insurance. As previously noted, in addition to requiring flat fees for dispensing prescriptions, 13 of the 29 contracts we reviewed included provisions for the covered entity to pay the pharmacy a fee based on the percentage of revenue generated by each prescription. These percentage fees only applied to prescriptions provided to patients with insurance, and ranged from 12 to 20 percent of the revenue generated by the prescriptions. Generally there were two methods for determining the amount of revenue generated. The first method used the reimbursement the pharmacy received for the prescription, while the second method used the net revenue after subtracting the 340B cost of the drug from the reimbursement received by the pharmacy. Officials from the two TPAs we interviewed and questionnaire respondents from the 39 covered entities that use TPAs described two main methods entities use to reimburse TPAs for 340B services: 1) a fee for each prescription processed by the TPA, and 2) a fee for each contract pharmacy for which the TPA processes 340B claims on behalf of the entity. Example of Fees between a Covered Entity and Third-Party Administrator (TPA) In the hypothetical example below, the TPA receives $85 from the contract pharmacy. This amount represents the total reimbursement for the 340B drug, less fees deducted by the contract pharmacy. Pursuant to an agreement with the covered entity, the TPA deducts a fee of $5, and forwards the remaining balance of $80 to the covered entity. This represents the total revenue the covered entity generated from the 340B drug. Officials with the two TPAs we interviewed told us that their agreements with covered entities most frequently involve covered entities compensating them based on a fee for each prescription they process on behalf of the entity. Officials from one of these TPAs described three different fee-per-prescription options they offer to covered entities, with the amount of the fees varying based on the option selected: A small fee, for example, 20 cents, for every prescription filled by the covered entity’s contract pharmacy, and reviewed and processed by the TPA. This includes prescriptions that may not have originated from the covered entity, and may not be 340B eligible, as contract pharmacies can also fill prescriptions for individuals who are not patients of the entity. A mid-sized fee, for example, $1.90, for each prescription filled by the covered entity’s contract pharmacy that the TPA reviewed and determined originated from the covered entity. These prescriptions may or may not be 340B eligible. A larger fee, for example, $5 to $7, for each prescription filled by the covered entity’s contract pharmacy that the TPA determined originated from the entity and is 340B eligible. The 39 covered entities that responded to our questionnaire and reported using a TPA most frequently reported paying their TPAs a fee per each prescription processed, but the exact method varied. For example, some covered entities said they paid their TPAs for each prescription regardless of whether it was determined to be 340B eligible, others limited the fees to prescriptions that were 340B eligible, and some reported paying TPAs for 340B-eligible prescriptions dispensed to an insured patient. (See table 4.) Among the 10 covered entities we interviewed, officials from 8 of these entities said they used TPAs; 5 said they pay their TPAs a fee per prescription, 1 reported paying a fee per contract pharmacy, and 2 reported using both options. Among the covered entities that used fees per prescription and told us the amounts of the fees they pay, the fees ranged from $3.50 to $10.00 per 340B eligible prescription or $3.95 per prescription regardless of whether the prescription was 340B eligible. For those that pay their TPA a fee per contract pharmacy, the fee was $25,000 a year per pharmacy. Of the 55 covered entities responding to our questionnaire, 30 reported providing low-income, uninsured patients discounts on 340B drugs dispensed at some or all of their contract pharmacies, and 25 said they did not offer discounts at their contract pharmacies. All 30 covered entities providing patients with discounts reported providing discounts on the drug price for some or all 340B drugs dispensed at contract pharmacies. Federal grantees were more likely than hospitals to provide such discounts and to provide them at all contract pharmacies (see fig. 9). Of the 30 covered entities that responded to our questionnaire that they provided discounts on the drug price, 23 reported providing patients the full 340B discount—the patients obtained drugs from contract pharmacies at the 340B price or less. In many cases, these covered entities indicated that patients received drugs at no cost. Some covered entities reported that patients would pay more than the 340B price, but less than the wholesale price of the drug or what a self-paying patient would pay, and others indicated they determined discounts for patients on a case-by-case basis. A larger number of federal grantees than hospitals (15 compared to 8) indicated their patients would pay the 340B price or less for their drugs at contract pharmacies where discounts were available. (See fig. 10.) In addition to providing discounts on the 340B drug price, some of the 30 covered entities also reported providing discounts on fees patients may pay to contract pharmacies for 340B drugs. Contract pharmacies may charge fees to dispense 340B drugs or cover administrative costs of participating in a covered entity’s 340B program, including costs associated with tracking drug inventories and ordering new drugs. In general, about two-thirds of the covered entities with patients who would be subject to dispensing or administrative fees at contract pharmacies reported providing discounts on the fees at some or all of their contract pharmacies. Hospitals were more likely than grantees to provide discounts on these fees when applicable. (See fig.11.) The 30 covered entities providing 340B discounts to low-income, uninsured patients reported using a variety of methods to determine whether patients were eligible for these discounts. Fourteen of the covered entities said they determined eligibility for discounts based on whether a patient’s income was below certain thresholds as a percentage of the federal poverty level, 11 reported providing discounts to all patients, and 5 said they determined eligibility for discounts on a case-by-case basis. For those 14 covered entities determining eligibility based on income as a percentage of the federal poverty level, the threshold used to determine who was eligible for discounts varied but most reported that patients with incomes at or below 250 percent of the federal poverty level would be eligible for discounts. (See table 5.) Covered entities reported making patients aware of the availability of discounts at contract pharmacies primarily through oral communication by staff located at either the entity or the pharmacy. In addition, the covered entities reported using a variety of methods to inform contract pharmacies about which patients were eligible for discounts, including through notes in patient medical records sent to the pharmacy or by placing codes on the patient’s prescriptions sent to or presented at the pharmacy. (See table 6.) Officials from one covered entity we interviewed said that it provides patients eligible for discounts with an identification card (which they referred to as a drug discount card) that patients present at the contract pharmacy; this card informs pharmacy staff of the specific discount amount. Officials from another covered entity said they place codes on electronic prescriptions which informs the pharmacy about discounts. Some covered entities that did not provide discounts on 340B drugs at their contract pharmacies reported assisting patients with drug costs through other mechanisms. For example, 6 of the 10 covered entities we interviewed said that while they did not provide discounts on 340B drugs dispensed at their contract pharmacies, they provide charity care to low- income patients, including free or discounted prescriptions. Additionally, 4 of the 25 covered entities that reported on our questionnaire that they did not provide discounts at their contract pharmacies said they provided patients with discounts on 340B drugs at their in-house pharmacies. HRSA does not have complete data on the total number of contract pharmacy arrangements in the 340B Program to inform its oversight efforts, including information that could be used to better target its audits. Additionally, weaknesses in HRSA’s audit process compromise its oversight of covered entities. Finally, the lack of specificity in HRSA’s guidance to covered entities potentially impedes covered entities’ oversight of contract pharmacies. HRSA does not have complete data on all contract pharmacy arrangements in the 340B Program to inform its oversight efforts. HRSA requires covered entities to register their contract pharmacies with the agency and recertify that registration annually. Contract pharmacies registered to each covered entity are recorded in a publicly available database, which according to HRSA, is used by various stakeholders to validate the eligibility of entities and confirm shipping addresses for each contract pharmacy eligible to receive 340B drugs on an entity’s behalf. However, because covered entities differ in the way they register their contract pharmacies, HRSA, and its publicly available database, does not have information on all of an entity’s contract pharmacy arrangements. Specifically, because HRSA does not require covered entities to separately register contract pharmacies to each child site for which a contractual relationship exists, HRSA does not have complete information on which sites of an entity have contracted with a pharmacy to dispense 340B drugs. Our analysis of HRSA data showed that the registration of contract pharmacies for 57 percent of covered entities with child sites only specified relationships between contract pharmacies and the parent site; thus HRSA may only have information on a portion of the actual number of 340B contract pharmacy arrangements. Additionally, manufacturers do not have complete information on which covered entity sites have contracts with a pharmacy to dispense 340B drugs, according to HRSA officials. Manufacturers could use such information to help ensure that 340B discounted drugs are only provided to pharmacies on behalf of a covered entity site with a valid 340B contract with that site. HRSA officials told us that the number of contract pharmacy arrangements recorded in HRSA’s database increases a covered entity’s chance of being randomly selected for a risk-based audit. However, since HRSA gives covered entities multiple contract pharmacy registration options, the likelihood of an entity being selected for an audit is dependent, at least in part, on how an entity registers its pharmacies as opposed to the entity’s actual number of pharmacy arrangements. Without more complete information on covered entities’ contract pharmacy arrangements, HRSA cannot ensure that it is optimally targeting the limited number of risk-based audits done each year to entities with more contract pharmacy arrangements. Federal internal control standards related to information and communication state that management should use quality information to achieve the entity’s objectives, such as by obtaining relevant data that are reasonably free from error and bias and represent what they purport to represent so that they can be used for effective monitoring. Without complete information on covered entities’ use of contract pharmacies, HRSA does not have the information needed to effectively oversee the 340B Program, including information that could be used to better target its audits of covered entities. HRSA primarily relies on audits to assess covered entities’ compliance with 340B Program requirements, including compliance at contract pharmacies, according to HRSA officials; however weaknesses in its audit process impede the effectiveness of its oversight. As a result of its audits, HRSA has identified instances of diversion and the potential for duplicate discounts at contract pharmacies, among other findings of noncompliance. Specifically, through the audits conducted since fiscal year 2012, HRSA identified at least 249 instances of diversion at contract pharmacies and 15 instances of the potential for duplicate discounts for drugs dispensed at contract pharmacies, as of February 2018. HRSA had also identified 33 covered entities with insufficient contract pharmacy oversight. (See Table 7.) However, we identified two areas of weaknesses in HRSA’s audit process that impede its oversight of covered entities’ compliance with 340B Program requirements at contract pharmacies: 1) the process does not include an assessment of all potential duplicate discounts, and 2) the process for closing audits does not ensure all covered entities have fully addressed any noncompliance identified. Medicaid Delivery Systems States provide Medicaid services through either fee-for-service or managed care. Under fee-for-service, states reimburse providers directly for each service delivered. For example, a pharmacy would be paid by the state for each drug dispensed to a Medicaid beneficiary. Under a capitated managed care model, states typically contract with managed care organizations to provide a specific set of services to Medicaid beneficiaries (which could include drugs) and prospectively pays each organization a set amount per beneficiary per month to provide or arrange those services. Not all potential duplicate discounts are assessed. HRSA’s audits only assess the potential for duplicate discounts in Medicaid fee-for- service. They do not include a review of covered entities’ processes to prevent duplicate discounts for drugs dispensed through Medicaid managed care. The potential for duplicate discounts related to Medicaid managed care has existed since 2010 when manufacturers were required to pay Medicaid rebates under managed care, and currently, there are more Medicaid enrollees, prescriptions, and spending for drugs under managed care than fee-for-service. HRSA officials told us that they do not assess the potential for duplicate discounts in Medicaid managed care as part of their audits because they have yet to issue guidance as to how covered entities should prevent duplicate discounts in Medicaid managed care. They agreed that the lack of Medicaid managed care guidance for covered entities was problematic, and HRSA’s December 2014 policy release stated, “HRSA recognizes the need to address covered entities’ role in preventing duplicate discounts under Medicaid managed care, and is working with the Centers for Medicare & Medicaid Services (CMS) to develop policy in this regard.” According to HRSA, in the absence of formal guidance, covered entities should work with their states to develop strategies to prevent duplicate discounts in Medicaid managed care. However, 8 of the 10 covered entities we spoke with described challenges working with their states and local Medicaid managed care organizations to ensure that duplicate discounts were not occurring or expressed the need for more guidance from HRSA on how to comply with 340B requirements related to duplicate discount prevention. As a result of these challenges, some covered entities acknowledged that they did not have assurance that duplicate discounts were not occurring with their Medicaid managed care claims, while other entities told us that they did not seek discounts for the drugs of managed care patients due to compliance challenges. Federal internal control standards related to control activities and monitoring state that agencies should 1) implement control activities through policies, such as by determining the necessary policies based on the objectives and related risks for the operational process; and 2) establish and operate monitoring activities to monitor the internal control system and evaluate results, such as by establishing and operating monitoring activities that are built into each entity’s operations, performed continually, and responsive to change. In addition, federal law directs the agency to develop detailed guidance describing methodologies and options for avoiding duplicate discounts. Until HRSA develops guidance and includes an assessment of the potential for duplicate discounts in Medicaid managed care as part of its audits, the agency does not have assurance that covered entities’ efforts are effectively preventing noncompliance. As a result, manufacturers are at risk of being required to erroneously provide duplicate discounts for Medicaid prescriptions. Audit closure process does not ensure all identified issues of noncompliance are addressed. Under HRSA’s audit procedures, covered entities with audit findings are required to 1) submit corrective action plans to HRSA that indicate that the entities will determine the full scope of any noncompliance (beyond the sample of prescriptions reviewed during an audit); 2) outline the steps they plan to take to correct findings of noncompliance, including any necessary repayments to manufacturers; and 3) specify the timelines for implementing the corrective action plans. HRSA closes the audit when a covered entity submits a letter attesting that its corrective action plan, including its assessment of the full scope of noncompliance, has been implemented and any necessary repayments to manufacturers have been completed. However, we identified two specific deficiencies in HRSA’s approach. First, although HRSA requires that covered entities determine the full scope of noncompliance found in audits, it does not provide guidance as to how entities should make this assessment. Specifically, HRSA does not specify how far back in time covered entities must look to see if any related noncompliance occurred and instead, relies on each entity to make this determination. For example, a document from a fiscal year 2017 audit revealed that a covered entity that had participated in the 340B Program for 3 years only reviewed 5 months of claims to determine whether any other instances of diversion had occurred, diminishing the likelihood that its efforts identified the full scope of noncompliance. Additionally, until April 2018, HRSA did not require covered entities that were audited to communicate the methodology used to assess the full scope of noncompliance, or the findings of their assessments, including how many or which manufacturers were due repayment. Beginning April 1, 2018, HRSA requires covered entities subject to targeted audits to document their methodology for assessing the full scope of noncompliance. However, as previously noted, only 10 percent of the 200 audits HRSA currently conducts each year are targeted audits. Consequently, the vast majority of covered entities audited are not required to provide HRSA with information on their methodology for assessing the full scope of noncompliance. Furthermore, HRSA officials told us that they believe determining the scope of noncompliance is a matter between the covered entities and manufacturers. Thus, HRSA relies on manufacturers to determine the adequacy of a covered entity’s effort to assess the full scope of noncompliance. However, covered entities only contact the manufacturers that they determine were affected by the noncompliance based on the methodology they choose to apply; thus, it is unclear how manufacturers not contacted would be in a position to negotiate an acceptable assessment of the scope of noncompliance and any applicable repayment. Federal internal control standards related to control activities state that agencies should implement control activities through policies, such as by documenting policies in the appropriate level of detail to allow management to effectively monitor the control activity. As HRSA does not provide guidance on how covered entities are to assess the full scope of noncompliance and does not review most entities’ methodology for making such assessments, the agency does not have reasonable assurances that entities have adequately identified all instances of noncompliance. Second, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity is now in compliance with 340B Program requirements. Beginning April 1, 2018, HRSA requires the 10 percent of covered entities that are subject to targeted audits to provide documentation that they implemented their corrective action plans prior to HRSA closing the audits. However, it still relies on the remaining 90 percent of audited covered entities to self- attest to their compliance with program requirements. HRSA officials told us they believe that a covered entity providing a description of the corrective actions is sufficient, and that the self- attestation of corrective action plan implementation provides HRSA with the information necessary to close the audit. However, aside from the self-attestation, HRSA’s only mechanism to ensure that the majority of audited covered entities have implemented their corrective action plans is to re-audit the entities—in other words, subject the entity to a targeted audit. To date, the agency told us that it has re-audited 21 covered entities, and based on those re-audits, determined that 1 entity did not fully implement its corrective action plan from the original audit. However, we found that of the 19 re-audited covered entities for which results were available, 12 had similar findings of noncompliance in their second audits, as were identified in their original audits (e.g., diversion findings in both audits), 3 of which were caused by the same issue, according to information provided to us by HRSA. Federal internal control standards for monitoring specify that agencies should establish and operate monitoring activities to monitor the internal control system and evaluate the results, for example by using ongoing monitoring to obtain reasonable assurance of the operating effectiveness of the service organization’s internal controls over the assigned process. By only reviewing evidence of corrective action plan implementation for the limited number of covered entities subject to targeted audits, HRSA does not have reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance, thus increasing the risk of diversions, duplicate discounts, and other violations of 340B Program requirements. HRSA guidance for covered entities on their oversight of contract pharmacies lacks specificity and thus provides entities with considerable discretion on the scope and frequency of their oversight practices. Specifically, HRSA’s 2010 guidance on contract pharmacy services specifies that covered entities are responsible for overseeing their contract pharmacies to ensure that drugs the entity distributes through them comply with 340B Program requirements, but states that, “the exact method of ensuring compliance is left up to the covered entity.” The guidance also states that, “annual audits performed by an independent, outside auditor with experience auditing pharmacies are expected,” but HRSA officials told us that covered entities are not required to conduct independent audits and instead are expected to do some form of periodic oversight of their contract pharmacies. Thus, according to HRSA officials, if a covered entity indicates that it has performed oversight in the 12 months prior to a HRSA audit, then HRSA considers the entity to have met HRSA’s standards for conducting contract pharmacy oversight regardless of what the oversight encompassed. Due, at least in part, to a lack of specific guidance, we found that some covered entities performed minimal contract pharmacy oversight. Officials from a grantee reported auditing claims of 5 randomly selected patients quarterly, despite treating approximately 900 patients each month. Officials from a critical access hospital that serves about 21,000 patients a year at its outpatient clinics reported that the annual independent audit of their hospital system reviewed five claims. Officials from two entities reported that they did not contract for an independent audit of their 340B Program, despite HRSA’s expectation to do so. Additionally, of the 20 covered entities whose audits we reviewed, 6 had no documented processes for conducting contract pharmacy oversight. The identified noncompliance at contract pharmacies raises questions about the effectiveness of covered entities’ current oversight practices. Specifically, 66 percent of the 380 diversion findings in HRSA audits involved drugs distributed at contract pharmacies, and 33 of the 813 audits for which results were available had findings for lack of contract pharmacy oversight. However, the number of contract pharmacy oversight findings may be limited by the fact that officials from HRSA’s contractor said that its auditors rely on verbal responses from entity officials about any internal review or self-audits conducted by the entity. This is despite the fact that HRSA officials told us that the agency requires auditors to review documentation of covered entities’ oversight activities. Federal internal control standards related to control activities state that agencies should implement control activities through policies, such as by documenting the responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. The standards also specify that management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving its objectives or addressing related risks. As a result of the lack of specific guidance and its numerous audit findings of noncompliance, HRSA does not have assurance that covered entities’ contract pharmacy oversight practices are sufficiently detecting 340B noncompliance. The 340B Program provides covered entities with discounts on outpatient drugs and the ability to generate revenue on drugs purchased under the program. Use of contract pharmacies enables covered entities to increase the use of 340B drugs by expanding their distribution networks, thereby increasing the volume of 340B drugs dispensed and generating associated savings and revenue. The expansion of contract pharmacies presents an opportunity for entities to fill more prescriptions with discounted 340B drugs, but it also increases potential risks to the 340B Program, such as risks related to diversion and duplicate discounts. Although covered entities and HRSA have taken steps to ensure that 340B Program requirements are being met at contract pharmacies, HRSA’s audits continue to identify instances of noncompliance. As currently structured, weaknesses in HRSA’s oversight impede its ability to ensure compliance with 340B Program requirements at contract pharmacies. HRSA cannot ensure that its limited number of audits target covered entities with the most complex 340B programs, and thus the greatest risk of noncompliance, because the agency does not have complete data on entities’ contract pharmacy arrangements. Additionally, HRSA’s audit process does not adequately identify compliance issues, nor does it ensure that identified issues are corrected. HRSA’s audits do not assess compliance with a key 340B Program requirement (the prohibition regarding duplicate discounts) as it relates to Medicaid managed care, and HRSA does not provide audited entities with guidance for determining the full scope of noncompliance, which reduces the effectiveness of HRSA’s audits in identifying drug diversion and duplicate discounts. Moreover, where audits identify instances of noncompliance, HRSA’s process does not confirm that all covered entities successfully correct the deficiencies and take steps to prevent future noncompliance. Although HRSA made improvements to its process for targeted audits during the course of our review, the agency does not require most covered entities subject to an audit to provide evidence of corrective actions taken. Moreover, the lack of specificity in HRSA’s guidance to covered entities on the methods through which they should ensure compliance may impede the effectiveness of entities’ oversight. For example, without guidance instructing covered entities how to prevent duplicate discounts in Medicaid managed care, entities are left to individually navigate the policies and practices of states and private insurers. Furthermore, by not clearly communicating expectations for covered entities’ oversight of their contract pharmacies, HRSA faces the risk that instances of noncompliance, such as diversion, at contract pharmacies will not be identified and addressed. As the 340B Program continues to grow, it is essential that HRSA address these shortcomings. We are making the following seven recommendations to HRSA: The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1) The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs. (Recommendation 2) The Administrator of HRSA should incorporate an assessment of covered entities’ compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3) The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit. (Recommendation 4) The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5) The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities’ assessments of the full scope of noncompliance identified during each audit. (Recommendation 6) The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7) HHS provided written comments on a draft of this report, which are reproduced in app. II, and technical comments, which we have incorporated as appropriate. In its written comments, HHS concurred with four of our seven recommendations, did not concur with three of our recommendations, and stated that it had concerns with some of the other information in our report. In concurring with four of our recommendations, HHS stated that HRSA is making changes to its audit process to strengthen oversight of the 340B Program. Regarding our recommendation related to guidance on duplicate discounts, HHS concurred, but commented that the recommendation did not account for the critical role that CMS would play in its successful implementation. We agree that CMS would play an important role in ensuring compliance with the prohibition on duplicate discounts in Medicaid managed care, which is why we recommended that HRSA coordinate with CMS on the guidance. HHS indicated that HRSA and CMS are strategizing on effective ways to address this issue. HHS also concurred with our recommendations to issue guidance related to identifying the full scope of noncompliance and covered entities’ oversight of their contract pharmacies, although it noted that HRSA would face challenges in issuing guidance related to areas where it does not have explicit regulatory authority. While we recognize that HRSA’s authority to issue regulations governing the 340B Program may be limited, our recommendations were focused on HRSA clarifying certain program requirements through whatever format the agency deems appropriate. Since the establishment of the 340B Program, HRSA has used interpretative guidance and statements of policy to provide guidance to covered entities regarding compliance with program requirements. HRSA has also used certain of its audit procedures, such as the template provided to covered entities for the development of corrective action plans, to provide such clarifications. Our recommendations are intended to expand the availability of information HRSA provides to covered entities to help them improve compliance with existing program requirements. As such, we continue to believe that further clarification, whether provided as interpretive guidance, audit procedures, or another format, is necessary to help ensure compliance with program requirements. Among the recommendations with which HHS did not concur was our recommendation to require covered entities to register contract pharmacies for each site of the entity for which a contract exists. HHS stated that its current registration process is responsive to our concerns for all covered entity types other than hospitals and health centers. However, as we note in the report, hospitals and FQHCs are typically the covered entity types that have multiple sites, and are generally more likely to have contract pharmacies. HHS cited administrative burden for both covered entities and HRSA as a reason not to require covered entities to provide more complete information about contract pharmacy arrangements. However, given that HRSA requires covered entities to register both their sites and their contract pharmacies with the agency, it is unclear why there would be significant additional burden for covered entities to indicate which of the previously registered sites had contracts with which contract pharmacies. It is also important to note that contract pharmacy use by covered entities is voluntary, and covered entities that choose to have contract pharmacies are required to oversee those pharmacies to ensure compliance with 340B Program requirements. Therefore, the use of contract pharmacies inherently comes with additional administrative responsibilities for the covered entity, and we believe that the requirement to register each contract pharmacy arrangement with HRSA should present limited additional burden on covered entities. Rather than implementing our recommendation, HHS stated that HRSA will make changes to its audit selection process; HRSA will assume that all contract pharmacies registered with the parent site would also be used by all sites of the covered entity prior to selecting entities for risk-based audits. Although this may be a good step forward, it does not provide information on the actual number of contract pharmacy arrangements for each covered entity. As such, we continue to believe that HRSA needs more complete information on contract pharmacy arrangements to best target its limited number of audits to covered entities with the most complex 340B programs. This is also important information to provide manufactures to help ensure that 340B discounted drugs are only provided to pharmacies on behalf of a covered entity site with a valid 340B contract with that site. HHS also did not concur with our two recommendations to require covered entities to specify their methodologies for identifying the full scope of noncompliance identified during their audits as part of their corrective action plans, and to provide evidence that these plans have been successfully implemented prior to HRSA closing audits. In its response, HHS noted that on April 1, 2018, HRSA implemented these requirements for entities subject to targeted audits (including re-audits), which represent 10 percent of all entities audited. However, HRSA indicated that implementing these requirements for all covered entities that are audited would create a significant burden for these entities. As we previously noted, HRSA already requires covered entities with audit findings to determine the full scope of noncompliance and to submit corrective action plans. Thus, it is unclear how requiring covered entities to include written descriptions of their methodologies for identifying the full scope of noncompliance, which should already be formulated, and to provide evidence that the corrective actions that entities developed have been implemented, would create significant additional burden for these entities. HHS also expressed concern that these additional steps would significantly delay the audit process and repayments to manufacturers. We recognize that reviewing these documents may create some additional work for HRSA and possibly require additional time to close audits. However, we believe this additional work and time is necessary for the audits to be effective at adequately identifying compliance issues and ensuring that those issues are corrected. Furthermore, these additional actions could reduce the need for re-audits which are burdensome in terms of cost and time, for both the covered entity and HRSA. Finally, HHS also expressed concerns about some of the other information included in the draft report. HHS stated that disclosing actual fees paid by covered entities to pharmacies and TPAs could cause disruptions in the drug pricing market and fluctuations in fees entities pay. Our report provides fees for a small and nongeneralizable sample of contracts, covered entities, and TPAs. For example, we provide contract pharmacy fees for 30 of the thousands of contracts that exist between covered entities and pharmacies. It is unclear how this information could cause disruptions in the drug pricing market or lead to fluctuations in fees covered entities may pay, and HHS did not provide any evidence to support its assertion. Additionally, HHS has raised questions about the effect of the 340B Program on drug pricing. As such, we believe that our discussion of fees brings enhanced transparency to the 340B Program, and provides Congress with important information it requested to gain a better understanding of the program and enhance its oversight. Regarding the distance between contract pharmacies and covered entities, HHS noted that the longest distance was for a specialty pharmacy that was registered for 17 days. As noted in our scope and methodology, our analysis was of covered entities and contract pharmacies participating as of July 1, 2017. Additionally, there were other contract pharmacy arrangements of similarly long distances. HHS also expressed concern that the draft report did not note that such specialty pharmacies may be needed due to restricted distribution by a manufacturer, which would be outside a covered entity’s control. In our report, we noted that the 340B database does not provide information on why a covered entity may choose to contract with a pharmacy that is located a long distance away. However, the report does include some potential reasons HRSA provided us as to why this may occur. HHS also commented that our table on the number and percent of covered entities audited does not fully reflect HRSA’s auditing efforts because it does not include the number of entity sites and contract pharmacies included within each audit. However, HRSA’s audits of covered entities generally do not include visits to multiple covered entity sites, or all contract pharmacies that distribute 340B drugs on a covered entity’s behalf. Additionally, while the audits include a review of a sample of 340B drugs distributed, that sample may not include prescriptions written at, or dispensed from, all of the covered entity’s sites or contract pharmacies. As a result, information in our report highlights the number of entities that were audited. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of HRSA, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at DraperD@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix III. Table 8 provides a brief description of the fees that covered entities pay pharmacies with which they contracted to dispense 340B drugs based on our review of 30 contracts. In addition to the contact named above, Michelle Rosenberg (Assistant Director), N. Rotimi Adebonojo (Analyst in Charge), Jennie Apter, George Bogart, Amanda Cherrin, David Lichtenfeld and Dan Ries made key contributions to this report. Also contributing were Julianne Flowers and Vikki Porter.

Summary: Covered entities can provide 340B drugs to eligible patients and generate revenue by receiving reimbursement from patients' insurance. The number of pharmacies covered entities have contracted with has increased from about 1,300 in 2010 to nearly 20,000 in 2017. GAO was asked to provide information on the use of contract pharmacies. Among other things, this report: 1) describes financial arrangements selected covered entities have with contract pharmacies; 2) describes the extent that selected covered entities provide discounts on 340B drugs dispensed by contract pharmacies to low-income, uninsured patients; and 3) examines HRSA's efforts to ensure compliance with 340B Program requirements at contract pharmacies. GAO selected and reviewed a nongeneralizable sample of 30 contracts between covered entities and pharmacies, 20 HRSA audit files, and 55 covered entities to obtain variation in the types of entities and other factors. GAO also interviewed officials from HRSA and 10 covered entities. The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies—contract pharmacies—to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription. Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis. GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as: HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care. HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance. HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements. Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements. GAO is making seven recommendations, including that HRSA's audits assess for duplicate discounts in Medicaid managed care, and HRSA require information on how entities determined the scope of noncompliance and evidence of corrective action prior to closing audits. HHS agreed with four of the recommendations, but disagreed with three recommendations, which GAO continues to believe are warranted to improve HRSA's oversight as explained in the report.