Yep. Audits. They are happening. And, chances are, if your covered entity (“CE”) hasn’t experienced one yet, it is coming to you sometime soon. At both 340B University (hosted by Apexus, the prime vendor for the 340B Drug Pricing Program) and the 340B Coalition Conference (hosted by 340B Health) many CEs we interacted with had already experienced the Health Resources and Services Administration (“HRSA”) audit process.
Audit Basics
There are two reasons a CE gets audited: (1) someone alleges violations of the 340B Drug Pricing Program (“340B Program”) (termed “targeted audits”) or (2) the CE’s system has characteristics that make its 340B program more complex (termed “risk-based audits”).
The audit process has three steps. First is the pre-audit, where HRSA provides the CE notice and requests data. About four to eight weeks later, the HRSA auditor comes onsite to actually do the audit. Sadly, at the end of the onsite audit, the auditor is prohibited from disclosing the audit findings. Third, and finally, post-audit results are shared with the CE. Apexus claims the audit findings will be sent within 30 to 90 days, but that did not seem to be the experience that most CE’s had.
Audit Finding Trends
The three most common audit findings relate to the following:
- Incorrect 340B Database Records
- Diversion
- Duplicate Discounts
HRSA has been dinging CEs who have not kept their Medicaid Exclusion File information current. About half of all diversion findings related to contract pharmacies.
If You Have Any Basis to Contest the Audit Findings – Do It!
Once the CE receives the audit findings, the CE should carefully review them. CEs have 30 days to contest the findings with supporting documentation. If anything seems off, or not quite right, or misunderstood, contest the findings. The assistance of experienced counsel can be invaluable in this process. About 50 percent of the CEs that contest audit findings succeed in overturning one or more findings.
If a CE finds itself in complete agreement with the findings and chooses not to contest, the CE has 60-days to submit a corrective action plan (“CAP”). If the 60-day deadline is blown, the CE risks termination from the 340B Program. A CAP demonstrates to HRSA that the CE takes the audit findings seriously and outlines the immediate steps that will be taken to remedy the findings. Once the CAP is approved, the CE is required to draft a mea culpa letter, which will be posted on the HRSA webpage, along with a summary of the CAP. CEs that are required to repay manufacturers are subject to a follow-up audit within a year.
Both conferences demonstrated that HRSA has stayed true to its word of focusing on compliance by conducting more audits. This blog will continue to follow the trends.