We found that as of July 1, 2017, about one-third of the more than 12,000 covered entities in the 340B Program had contract pharmacies. A higher percentage of hospitals (69.3 percent) had at least one contract pharmacy compared to federal grantees (22.8 percent). Among covered entities that had at least one contract pharmacy, the number of contract pharmacies ranged from 1 to 439, with an average of 12 contract pharmacies per entity. The number of contract pharmacies varied by covered entity type, with disproportionate share hospitals having the most on average (25 contract pharmacies), and critical access hospitals having the least (4 contract pharmacies). Across all covered entities, the distance between the entities and their contract pharmacies ranged from 0 miles (meaning that the contract pharmacy and entity were co-located) to more than 5,000 miles; the median distance was 4.2 miles. About half of the entities had all their contract pharmacies located within 30 miles, but this varied by entity type. Specifically, more than 60 percent of critical access hospitals and federally qualified health centers, a type of federal grantee, had all of their contract pharmacies within 30 miles. In contrast, 45 percent of disproportionate share hospitals had at least one pharmacy that was more than 1,000 miles away compared to 11 percent or less for critical access hospitals and grantees. Contracts we reviewed between selected covered entities and contract pharmacies showed that entities generally agreed to pay their contract pharmacies a flat fee per 340B prescription, with some entities also paying additional fees based on a percentage of revenue. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of covered entity and drug, as well as the patient’s insurance status. In addition to flat fees, many of the contracts we reviewed included provisions for the covered entity to pay the pharmacy a fee based on the percentage of revenue generated by each prescription. These percentage fees only applied to prescriptions provided to patients with insurance, and ranged from 12 to 20 percent of the revenue generated by the prescriptions. Selected covered entities and TPAs included in our review indicated two main methods entities use to pay for TPA services: 1) per prescription processed, or 2) per contract pharmacy. Officials with the two TPAs we interviewed and the covered entities that responded to our questionnaire reported that agreements between the parties most frequently involved covered entities compensating their TPAs with a fee for each prescription processed on behalf of the entity, but the exact method and the amount of the fee varied. For example, some covered entities reported paying their TPAs for each prescription regardless of whether it was determined to be 340B eligible, others limited the fees to prescriptions that were 340B eligible, and some reported paying TPAs for 340B-eligible prescriptions dispensed to an insured patient. Thirty of the 55 covered entities responding to our questionnaire reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Federal grantees were more likely than hospitals to provide patients with discounts on the price of drugs and to provide them at all contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. In many cases, these covered entities indicated that patients received drugs at no cost. The 30 covered entities providing 340B discounts to low-income, uninsured patients, reported using a variety of methods to determine whether patients were eligible for these discounts. Fourteen of the covered entities said they determined eligibility for discounts based on whether a patient’s income was below certain thresholds as a percentage of the federal poverty level, 11 reported providing discounts to all patients, and 5 said they determined eligibility for discounts on a case-by-case basis. Some covered entities that did not provide discounts on 340B drugs at their contract pharmacies reported assisting patients with drug costs through other mechanisms. For example, some covered entities reported providing charity care to low-income patients, including free or discounted prescriptions; and some reported providing discounts on drugs dispensed by their in-house pharmacies. We found weaknesses in HRSA’s oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies. Specifically: Incomplete Data. We found that HRSA does not have complete data on all contract pharmacy arrangements in the 340B Program to inform its oversight efforts, including its audits of covered entities—the agency’s primary method for assessing entity compliance with program requirements. Although HRSA requires covered entities to register their contract pharmacies with the agency, it does not require covered entities to separately register contract pharmacies to each site of the covered entity with which a contractual relationship exists. HRSA officials told us that the number of registered contract pharmacy arrangements increases a covered entity’s chance of being randomly selected for a risk-based audit. Our analysis of HRSA data showed that the registration of contract pharmacies for 57 percent of covered entities with multiple sites only specified relationships between contract pharmacies and each entity’s main site, as opposed to all sites contracted to distribute drugs on that entity’s behalf. Thus, the likelihood of an entity being selected for an audit is dependent, at least in part, on how an entity registers its pharmacies as opposed to the entity’s actual number of pharmacy arrangements. We concluded that without more complete information on covered entities’ contract pharmacy arrangements, HRSA cannot ensure that it is optimally targeting the limited number of risk-based audits done each year to entities that are at a higher risk for compliance issues because they have more contract pharmacy arrangements. Limited Oversight of Duplicate Discounts. We found that HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, covered entities are prohibited from subjecting manufacturers to “duplicate discounts” in which drugs prescribed to Medicaid beneficiaries are subject to both the 340B price and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care, despite the fact that the majority of Medicaid enrollees, prescriptions and spending for drugs were in managed care. HRSA officials told us that they do not assess the potential for duplicate discounts in Medicaid managed care as part of their audits because they have yet to issue guidance as to how covered entities should prevent these duplicate discounts. We concluded that until HRSA develops guidance and includes an assessment of the potential for duplicate discounts in Medicaid managed care as part of its audits, the agency does not have assurance that covered entities’ efforts are effectively preventing noncompliance, and manufacturers are at risk of being required to erroneously provide duplicate discounts for Medicaid prescriptions. Lack of Information on Full Scope of Noncompliance. We found that HRSA requires covered entities for which it identifies issues of noncompliance during audits to assess the full extent of the noncompliance, but it does not provide guidance as to how entities should make these assessments. Specifically, HRSA does not specify the time period covered entities must review to see if any related noncompliance occurred and instead, relies on each entity to make this determination. Additionally, HRSA does not require most covered entities that were audited to communicate the methodology used to assess the full scope of noncompliance, or the findings of their assessments, including how many or which manufacturers were due repayment. As a result, we concluded that HRSA does not know the scope of covered entities’ assessments and whether they were effective at identifying the full extent of the noncompliance identified in the audit. Lack of Evidence of Corrective Actions. We found that prior to closing an audit, HRSA’s audit procedures do not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements. Instead, HRSA relies on the 90 percent of covered entities subject to risk-based audits to self-attest that all audit findings have been addressed and that the entity has come into compliance with 340B Program requirements. We concluded that HRSA, therefore, does not have reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance, thus increasing the risk of diversions, duplicate discounts, and other violations of 340B Program requirements. Limited Guidance on Contract Pharmacy Oversight. We found that HRSA’s contract pharmacy oversight guidance for covered entities lacks specificity and thus, provides entities with considerable discretion on the scope and frequency of their oversight practices. Specifically, HRSA’s 2010 guidance on contract pharmacy services specifies that covered entities are responsible for overseeing their contract pharmacies to ensure that the drugs entities distribute through them comply with 340B Program requirements, but states that, “the exact method of ensuring compliance is left up to the covered entity.” According to HRSA officials, if a covered entity indicates that it has performed oversight in the 12 months prior to a HRSA audit, then HRSA considers the entity to have met its standards for conducting contract pharmacy oversight, regardless of what the oversight encompassed. However, due, at least in part, to a lack of specific guidance, we found that some covered entities performed minimal contract pharmacy oversight. Additionally, the identified noncompliance at contract pharmacies raises questions about the effectiveness of covered entities’ current oversight practices. For example, 66 percent of the 380 diversion findings in HRSA audits since 2012 involved drugs distributed at contract pharmacies, and 33 of the 813 audits for which results were available had findings for lack of contract pharmacy oversight. We concluded that as a result of the lack of specific guidance and the numerous HRSA audit findings of noncompliance occurring at contract pharmacies, HRSA does not have assurance that covered entities’ contract pharmacy oversight practices are sufficiently identifying 340B noncompliance. Our June 2018 report contained seven recommendations to HRSA to strengthen its oversight of the 340B Program. HHS concurred with our four recommendations that HRSA should 1) issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care; 2) incorporate an assessment of covered entities’ compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process once the guidance is issued; 3) issue guidance on the length of time covered entities must look back following audits to identify the full scope of noncompliance identified during audits; and 4) provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. HHS did not concur with our three recommendations that HRSA should 1) require covered entities to register contract pharmacies for each site of the entity for which a contract exists; 2) require all covered entities to specify their methodology for determining the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of covered entities’ methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance; and 3) require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities’ assessments of the full scope of noncompliance identified during each audit. HHS cited concerns that implementing these recommendations would be burdensome on covered entities and HRSA. However, as explained in our report, we believe that these recommendations would only create limited additional burden on covered entities and the agency and are warranted to improve HRSA’s oversight of the 340B Program. Chairman Burgess, Ranking Member Green, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to answer any questions that you may have at this time. If you or your staff members have any questions concerning this testimony, please contact Debra A. Draper at (202) 512-7114 or draper@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact named above, Michelle Rosenberg (Assistant Director), Amanda Cherrin (Analyst in Charge), Jennie Apter, George Bogart, and David Lichtenfeld made key contributions to this statement. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony summarizes the information contained in GAO's June 2018 report, entitled Drug Discount Program: Federal Oversight of Compliance at 340B Contract Pharmacies Needs Improvement ( GAO-18-480 ). The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies--contract pharmacies--to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription. Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis. GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as: HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care. HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance. HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements. Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements.