340B Audits (OPA and Manufacturers)

  • 0

340B Audits (OPA and Manufacturers)

340B Audits Are Increasing, Are You Ready?

340B Audit Letter340B Audits by Manufacturers: While formal audits of 340B covered entities by manufacturers are less common than those conducted by the Health Resources and Services Administration (HRSA), they are nevertheless a reality. As with government audits, there is a statutory basis for manufacturer audits, and in 1996 HRSA set forth certain guidelines for how these manufacturer audits should be conducted. A brief overview of these guidelines is provided below followed by some interesting points and comments that were recently expressed by a manufacturer and two recently-audited covered entities. Finally, some basic manufacturer audit tips are provided.

Audit Guidelines: In 1996, HRSA (under the Department of Health and Human Services (DHHS)) set forth a Compliance Audit Guide for manufacturers that was provided by DHHS. (61 Fed. Reg. 65406 12/12/1996). Generally speaking, this guide indicates that a manufacturer must first notify a covered entity (CE) in writing when it believes the CE has violated a provision of the 340B statute by allowing either 340B-purchased drugs to be diverted or the manufacturer to be subjected to duplicate discounts. The CE and manufacturer then have at least 30 days to make a good faith attempt to resolve the matter. If the matter is not resolved during this “informal process”, the manufacturer can proceed with formal dispute resolution steps if it believes it has enough evidence without having to conduct an audit. If it needs to gather more evidence, the manufacturer can proceed with initiating an audit by first submitting an audit plan to the Office of Pharmacy Affairs (OPA) under HRSA. The audit plan must include a clear explanation of why the manufacturer believes a violation has occurred along with supportive evidence.

If within 15 days after receiving the audit plan the OPA/HRSA finds that reasonable cause exists, it may then review the plan to ensure that certain auditing elements are present. If the elements are not present in the plan, the OPA/HRSA may work with the manufacturer to ensure that the necessary elements are included. The manufacturer may then, after giving 15 days notice to the CE, commence with the audit. This notice is typically provided to the CE’s authorizing official and contact official of record.

Once approved by the OPA/HRSA, the audit must be conducted by an independent public accountant that is employed by the manufacturer specifically for this task. The auditor must adhere to current official government auditing standards and must observe patient confidentiality. As an initial step, the auditor may request various records and other data associated with the alleged violation. In the above-mentioned 1996 audit guidelines, HRSA provided suggested audit steps to be followed.

At the completion of its audit, the manufacturer must provide the CE with an audit report that includes findings and recommendations. The manufacturer must also provide this audit report to both HRSA and the Office of Inspector General (OIG) of Audit Services. The CE then has 30 days from receiving the audit report to respond. If the CE agrees with the report, it must include actions that it has taken, or will take, to address the findings and recommendations. If the CE disagrees with the report, it must provide the manufacturer with its rationale. The parties may then file a request for dispute resolution through the DHHS.

Manufacturer Points/Comments:
• Rather than denying or approving a submitted audit plan, the OPA/HRSA has been known to request that the manufacturer and CE again try to reach a resolution through an informal process.

• If a resolution between the CE and manufacturer can be reached during an informal process, the manufacturer is not required to notify the OPA/HRSA. However, once the formal auditing process begins, the manufacturer must notify the OPA/HRSA.

• Manufacturer audits are usually narrower in scope than government 340B audits and typically last 2-3 days.

• One manufacturer voiced the opinion that most manufacturers would prefer to first be contacted by a CE if the CE suspects a violation rather than simply first receiving a check from the CE or finding out about a credit/re-bill.

Audited CE’s Points/Comments:
• Although diversion and duplicate discounts are the formal focus of manufacturer audits, auditors have been known to ask questions concerning other types of potential violations while conducting their audit, such as enquiring about the CE’s participation in group purchasing organization (GPO) purchasing for instance.

• Auditors have been known to contact the CE’s wholesaler directly without the CE knowing beforehand.

• Manufacturers may ask details about the CE’s split-billing process, accumulation process, and/or Medicaid patient identification process to determine if diversion and/or duplicate discounts have occurred.

• Auditors will typically first ask for the CE’s 340B policies and procedures.

• When an auditor requests records and/or other data within a short time (e.g., 24 hours), CE’s are often hard-pressed to identify the correct individuals and gather the records/data within that time. This is often due to the wide variety of individuals that may need to be contacted. Examples of such individuals can include representatives from areas such as: information technology, pharmacy, compliance, legal, payroll/human resources, supply chain, physician/provider credentialing, and/or physician/provider contracting.

• Auditors do not always focus the majority of their efforts on contract pharmacy operations.

• Auditors have been known to ask for individual physician/provider contracts with the CE and to scrutinize whether individual practitioners are listed in these contracts.

• The actual formal audit process can vary. For example, one CE reported that an initial audit kick-off meeting was conducted by the auditor while another CE reported that there was no kick-off meeting held at all. As another example, the types and amounts of records and other data initially requested by an auditor can vary significantly.

Basic Audit Tips for CEs
• Proactively identify an audit-response team and process before being audited to allow for timely and accurate responses to auditor requests. Include the types of individuals mentioned above in the group and provide them with a basic understanding of what a 340B audit might entail.

• Identify a “gate-keeper” that will act as a point person for the CE to field auditor requests, coordinate responses, and ensure that the appropriate accurate information is provided in each response.

• Ensure that the gate-keeper or other audit-response team member becomes familiar with the 1996 audit guidelines set forth by HRSA.

• When necessary, it is acceptable to try and negotiate with an auditor when the response time mandated by the auditor is not realistic. For example, if 24 hours is not enough, try negotiating for more time to allow for an accurate and pertinent response to be prepared.

• Consider reviewing physician/provider contracts proactively to ensure that the appropriate providers are listed, that the contracts are current, etc.

• Try to resolve alleged violations during an informal process whenever possible.

• Make sure that the CE’s 340B policies and procedures are readily retrievable upon request by the auditor.

• Sample audit data requests from HRSA are provided by SNHPA to its members. These samples may be helpful in anticipating data requests from HRSA and manufacturer auditors.

• Obtaining the assistance of trained 340B experts to help establish a comprehensive 340B compliance plan will help ensure success when responding to HRSA and manufacturer audits.

About Author

Rich Bucher, JD, RPh, 340B ACE

Pharmacist with experience in pharmacy leadership, compliance, and contracting for a large healthcare organization and for a large regional health plan. This includes practical experience dealing with operational, compliance, and legal issues associated with managing a system-wide 340B Program. Also, over 10 years of legal practice experience, including in health care law and contracting. Rich has presented on 340B and other health care compliance topics at numerous conferences. Rich has conducted many external 340B audits and provided consultation for various covered entity types, including providing onsite support during HRSA audits. Rich is a lead auditor on our 340B independent auditing team, oversees legal and compliance issues, and provides client contract and policy/procedure reviews.

Leave a Reply