Drug Discount Program: Federal Oversight of Compliance at 340B Contract Pharmacies Needs Improvement
Fast Facts
To have their drugs covered under Medicaid, the "340B" program requires drug manufacturers to sell outpatient drugs to covered entities—certain hospitals and clinics—at a discount. These entities are increasingly contracting with pharmacies to dispense 340B drugs. Doing so can make it harder to ensure compliance with 340B rules. For example, contract pharmacies may also fill prescriptions for the general public, increasing the risk of dispensing 340B drugs to ineligible patients.
We recommended ways to improve federal oversight of covered entities to help ensure compliance with 340B requirements.
Photograph of a prescription pill bottle and pills.
Highlights
What GAO Found
The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies—contract pharmacies—to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription.
Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis.
GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as:
HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care.
HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance.
HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements.
Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements.
Why GAO Did This Study
Covered entities can provide 340B drugs to eligible patients and generate revenue by receiving reimbursement from patients' insurance. The number of pharmacies covered entities have contracted with has increased from about 1,300 in 2010 to nearly 20,000 in 2017. GAO was asked to provide information on the use of contract pharmacies. Among other things, this report: 1) describes financial arrangements selected covered entities have with contract pharmacies; 2) describes the extent that selected covered entities provide discounts on 340B drugs dispensed by contract pharmacies to low-income, uninsured patients; and 3) examines HRSA's efforts to ensure compliance with 340B Program requirements at contract pharmacies. GAO selected and reviewed a nongeneralizable sample of 30 contracts between covered entities and pharmacies, 20 HRSA audit files, and 55 covered entities to obtain variation in the types of entities and other factors. GAO also interviewed officials from HRSA and 10 covered entities.
Recommendations
GAO is making seven recommendations, including that HRSA's audits assess for duplicate discounts in Medicaid managed care, and HRSA require information on how entities determined the scope of noncompliance and evidence of corrective action prior to closing audits. HHS agreed with four of the recommendations, but disagreed with three recommendations, which GAO continues to believe are warranted to improve HRSA's oversight as explained in the report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Health Resources and Services Administration | The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1) |
HHS does not concur with this recommendation and, as of March 2024, did not plan to take any actions to implement the recommendation. In March 2023, HRSA noted that as long as the contract with a pharmacy says it includes all of the covered entities' sites, HRSA does not require the entity to register the pharmacy for each individual site. HRSA's draft audit protocols call for auditors to verify if the pharmacy contract specifies it includes all entity sites, and, if it does not, the auditor is to verify whether the pharmacy is registered for each entity site that is included in the contract. However, since HRSA only audits 200 covered entities per year, such procedures do not provide HRSA with complete data on entities' contract pharmacy arrangements. In March 2024, HRSA said that contracts with a pharmacy generally state that the contracted relationship applies to all sites of the covered entity. However, it is unclear how HRSA would know this since it only reviews contracts for a small sample of covered entities each year. Thus, HRSA does not know the extent to which covered entities' contracts with pharmacies may not apply to all entities sites and therefore does not have complete data on contract pharmacy arrangements. Such data are also important for manufacturers to help ensure that 340B discounted drugs are only shipped to pharmacies on behalf of a covered entity site with a valid 340B contract with that site.
|
| Health Resources and Services Administration |
Priority Rec.
The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs.(Recommendation 2) |
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In February 2024, HRSA noted that the agency may be able to issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care pending the outcome of a proposed CMS rule related to the Medicaid Drug Rebate program.
|
| Health Resources and Services Administration |
Priority Rec.
The Administrator of HRSA should incorporate an assessment of covered entities' compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3) |
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In February 2024, HRSA noted that the agency may be able to issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care pending the outcome of a proposed CMS rule related to the Medicaid Drug Rebate program. HRSA would then need to update its audit processes accordingly to implement this recommendation.
|
| Health Resources and Services Administration | The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit.(Recommendation 4) |
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In March 2024, HRSA noted that its existing regulatory authority to issue guidance is subject to ongoing legal challenges. HRSA officials told us that since FY2017 it had requested additional regulatory authority for the program. The FY2025 President's Budget includes a proposal to provide HRSA explicit regulatory authority to define necessary terms for the program.
|
| Health Resources and Services Administration | The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5) |
HHS does not concur with this recommendation and, as of March 2024, did not plan to take any actions to implement the recommendation. HHS noted that requiring all covered entities subject to an audit to specify their methodology for identifying the full scope of noncompliance identified during the audit would create a significant burden for covered entities. However, as noted in our report, HRSA already requires covered entities with audit findings to determine the full scope of noncompliance and requires entities subject to a targeted audit to provide their methodology for such assessments to HRSA. Thus, it is unclear how requiring covered entities subject to risk-based, as opposed to targeted, audits to provide HRSA with a written description of methodologies that they are already required to formulate and implement would create a significant additional burden. Without this information, HRSA does not have reasonable assurance that the majority of covered entities have adequately identified all instances of noncompliance.
|
| Health Resources and Services Administration | The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities' assessments of the full scope of noncompliance identified during each audit.(Recommendation 6) |
HHS does not concur with this recommendation and, as of March 2024, did not plan to take any actions to implement the recommendation. HHS stated that requiring all covered entities with audit findings to provide evidence that their corrective action plans have been successfully implemented would create an undue burden for covered entities. However, HRSA already requires such evidence from covered entities subject to targeted audits, and it is unclear how providing evidence of implementation of corrective actions that entities developed and are required to implement would create significant additional burden for these entities. Additionally, without such evidence HRSA does not have a reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance.
|
| Health Resources and Services Administration | The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7) |
HHS concurred with this recommendation. After the report was issued, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. In March 2024, HRSA noted that its existing regulatory authority to issue guidance is subject to ongoing legal challenges. HRSA officials told us that since FY2017 it had requested additional regulatory authority for the program. The FY2025 President's Budget includes a proposal to provide HRSA explicit regulatory authority to define necessary terms for the program.
|