Complete Healthcare Compliance Manual

340B Program Eligibility

Only certain categories of safety-net providers are eligible to participate in the 340B program under the 340B statute. A drug company’s eligibility to participate in the program, by contrast, extends to any manufacturer willing to enter into and comply with a PPA with HHS. This section outlines the eligibility requirements applicable to both covered entities and manufacturers.

Diversion

The 340B statute prohibits a covered entity from reselling or otherwise transferring 340B drugs to any person or entity other than its “patient.” There is no definition of “patient” in the statute. Because covered entities are only entitled to 340B discounts on “covered outpatient drugs,” administration of 340B drugs to a hospital inpatient is also considered diversion even though an inpatient is as much a hospital “patient” as an outpatient.

In 1996, HRSA issued patient definition guidance that describes which individuals are eligible to receive 340B drugs. Under the guidance, an individual must satisfy three criteria in order to be eligible to receive discounted drugs, although the third criterion only applies to the grantees and subgrantees.^[54] First, the covered entity must maintain records of the individual’s healthcare. Second, the individual must be under the care of a physician or other healthcare professional who is employed by, under contract with, or in a referral relationship with the covered entity such that responsibility for the individual’s care remains with the covered entity. Third, the individual must receive a healthcare service or range of services that are consistent with the service or range services for which grant funding or FQHC-LA status has been provided to the covered entity.^[55] An individual is not eligible to receive discounted drugs if the only healthcare service received by the individual from the covered entity is the dispensing of a drug for self-administration or administration in the home setting.^[56]

Historically, in applying the patient definition guidance to prescriptions for self-administered drugs, HRSA has required that the prescription be written as the result of services provided within an OPAIS-registered location. However, based on a decline in the number of diversion findings in recent HRSA audits and HRSA’s decision in 2019 to withdraw its diversion finding against an FQHC that challenged the finding in court, it appears that HRSA is taking a more lenient approach to identifying 340B eligible prescriptions.^[57][58] With respect to infusion and injectable products, often referred to as “physician-administered drugs,” HRSA has consistently permitted covered entities to use the 340B program for such drugs if the covered entity administers the drug within the covered entity’s registered facility, even if the drug is ordered by an outside prescriber.

Duplicate Discounts

Under section 1927 of the Social Security Act, drug manufacturers are required to give rebates to state Medicaid programs on covered outpatient drugs reimbursed either through a state’s fee-for-service (FFS) program or by a managed care organization (MCO) under contract with the state. The obligation to pay a rebate, however, is lifted if the rebatable drug was sold at a 340B discount.^[59] Manufacturer protection against duplicate discounts differs depending on whether the drug is reimbursed on an FFS basis or by an MCO. With respect to FFS drugs, the obligation to protect against duplicate discounts is set forth in the 340B statute and placed squarely on the shoulders of the covered entity.^[60] Protection against MCO duplicate discounts, on the other hand, is addressed in the Medicaid drug rebate statute and is the responsibility of states.

The Medicaid MCO duplicate discount problem did not arise until Congress decided to expand the Medicaid drug rebate program to include MCO drugs in 2010 under the ACA.^[61] The language used to expand the program—which was added to section 1927 of the Social Security Act, not the 340B statute—includes a provision stating that such drugs are not subject to a Medicaid rebate if they are purchased under Section 340B.^[62] Thus, the duplicate discount provision in the 340B statute does not apply to MCO drugs because, under the Medicaid drug rebate statute, the drugs are not “subject to the payment of a rebate to the State.”^[63] Manufacturers are protected from duplicate discounts on MCO drugs because the drugs purchased through the 340B program are categorically ineligible for Medicaid drug rebates.

GPO Prohibition

DSH, children’s hospitals, and cancer hospitals are prohibited from obtaining covered outpatient drugs through a GPO or other group purchasing arrangement.^[72] Because the GPO prohibition is an eligibility requirement, noncompliance can expose the hospital to a risk of being terminated from the program. The GPO prohibition only applies to purchases of “covered outpatient drugs,” which means a hospital subject to the GPO prohibition may use a GPO to purchase inpatient drugs or drugs that otherwise fall outside the definition of a “covered outpatient drug.”^[73][74]

HRSA has recognized several exceptions to the GPO prohibition. For example, hospitals subject to the GPO prohibition may take advantage of the discounts that Apexus has negotiated through the prime vendor program even though the prime vendor program clearly operates as a “group purchasing arrangement” if not a GPO. HRSA also gives hospitals a fair amount of discretion in excluding certain drugs—primarily those that are billed with services and not as separate claims—from the definition of a “covered outpatient drug” so that they can be purchased at GPO prices.^[75] Another exception is available if the hospital is initially unable to obtain a covered outpatient drug at a 340B price. In those instances, the hospital must work with the manufacturer to try to obtain 340B pricing and, if unsuccessful, purchase the drug at a non-340B, non-GPO price which, according to HRSA, is the drug’s wholesale acquisition cost (WAC).^[76] If the hospital cannot obtain the drug on its WAC account, it may then purchase the drug through a GPO. In these instances, the hospital must immediately notify OPA of the details of its prior attempts, communications, and the transaction—all of which must be properly documented and auditable.^[77]

Lastly, HRSA established a widely publicized policy release in 2013 that allowed the offsite locations of 340B hospitals to opt out of the 340B program, including the program’s prohibition against group purchasing. According to the policy release, hospitals subject to the GPO prohibition may elect not to use 340B and instead use GPO drugs at outpatient facilities that meet the following four requirements:

1. The facility is located at a different physical address than the parent facility.

2. The facility is not registered on the OPAIS as participating in the 340B program.

3. The facility purchases drugs through a separate pharmacy wholesaler account than the 340B participating parent.

4. The hospital maintains records demonstrating that any covered outpatient drugs purchased through the GPO at the facility sites are not used or otherwise transferred to the parent hospital or any outpatient facilities registered in the OPAIS.^[78]

It is important to note that contract pharmacies may purchase their own drug inventory through a GPO; however, those drugs should not be dispensed to patients of a hospital subject to the GPO prohibition if they are purchased on behalf of the hospital. Stated differently, a hospital may not try to circumvent the GPO prohibition by purchasing GPO drugs through a contract pharmacy for its patients.^[79]

OPAIS Data Errors

HRSA requires that the information included in a covered entity’s OPAIS listing be accurate and complete. Inaccurate or incomplete database entries can result in an adverse audit finding. As discussed previously, covered entities can register additional locations during four registration periods available each year. In between those periods, covered entities can request changes to the information in the OPAIS. Covered entity medical practices that share a common building or street address must include suite numbers to help distinguish between them. Failure to separately list clinics, departments, and service lines can also lead to an OPAIS database finding.

Another risk area relates to contract pharmacy registration data. When a covered entity registers a contract pharmacy, OPAIS pulls information from the pharmacy’s Drug Enforcement Agency (DEA) records to ensure that it matches the information submitted on OPAIS. That information is then crosschecked against the pharmacy services agreement between the covered entity and contract pharmacy during a HRSA audit. Discrepancies can result in an audit finding or area for improvement.

The individuals that HRSA views as responsible for OPAIS accuracy are the covered entity’s Authorizing Official (AO) and Primary Contact (PC). HRSA requires covered entities to designate an AO and PC and these individuals are listed in OPAIS. The AO must be an individual who has authority to legally bind the organization, for example, a chief executive officer, chief operating officer, chief financial officer, president, vice president, senior vice president, clinic administrator, or program manager.^[80] The PC must be an employee of the organization and may not be the same person as the AO. Either the AO or the PC can register a covered entity or make changes to the information in OPAIS, but the AO must attest to these actions if the PC makes them. The covered entity assumes a compliance risk if its AO or PC are unfamiliar with applicable 340B program responsibilities, including maintaining its entries in the OPAIS.

Recertification

HRSA has implemented an annual recertification process that requires the AOs at covered entities to certify to the accuracy of several statements relating to the entity’s compliance status. Among other statements, AOs must attest that the information reflected on the covered entity’s OPAIS entries is correct, that the covered entity is in compliance with all 340B program requirements, and that it will notify OPA if it is in material breach of any 340B program requirements. HRSA implemented the recertification requirement to comply with two program-integrity requirements added to the 340B statute under the ACA—HRSA must “enable and require” covered entities to regularly update their 340B database entry, and HRSA must develop a system to verify the accuracy of the information listed in the database.^[81] OPA sends email notifications with information about the recertification process to the AO and PC prior to the recertification period.^[82] A covered entity that does not recertify is terminated from the 340B program.^[83]

AOs must be careful when certifying to the compliance status of their facilities during the recertification process. Although unlikely, AOs may incur criminal liability if they falsely attest to one or more of the representations required to recertify.^[84] If convicted, the AO could be fined or subject to imprisonment.^[85]

Orphan Drug Exclusion

Federal law provides incentives to manufacturers for developing a class of drugs, commonly known as “orphan drugs.” These are drugs the FDA has determined can treat a rare disease or condition affecting fewer than 200,000 people in the U.S., or more than 200,000 people if there is no reasonable expectation that the costs of developing a drug for such disease or condition would be recouped from sales of the drug in the United States.^[86] Physicians often prescribe orphan drugs to treat diseases or conditions other than the one for which the FDA granted the orphan drug designation. The 340B statute prohibits CAHs, RRCs, SCHs, and cancer hospitals from purchasing orphan drugs with 340B discounts.^[87] HRSA provides quarterly updates regarding its list of drugs designated as orphan drugs.^[88]

In 2014, pharmaceutical manufacturers challenged a HRSA policy allowing hospitals subject to the orphan-drug prohibition to purchase an orphan drug on the hospital’s 340B account if the drug was not being used for the purpose for which the drug received orphan designation.^[89] The court ruled in favor of the manufacturers and held that the statutory language clearly applies the prohibition regardless of the purpose for which the drug is being prescribed. Although manufacturers are not required to provide 340B discounts on orphan drugs to CAHs, RRCs, SCHs, and cancer hospitals, manufacturers often voluntarily provide “340B-like” discounts to hospitals subject to the orphan-drug prohibition.

A CAH, RRC, SCH, or cancer hospital that purchases an orphan drug with 340B discounts runs the risk of receiving an audit finding from HRSA, even if the drug is not being used for its orphan purpose. HRSA characterizes these instances as diversion although, from a legal perspective, the hospital is technically not violating the prohibition against diversion. If a hospital subject to the orphan-drug restriction receives a 340B-like discount on an orphan drug, it should maintain documentation demonstrating that the discount was voluntary.

Auditable Records

Covered entities must retain auditable records of their 340B operations to maintain eligibility in the 340B program.^[90] Covered entities that are audited by HRSA receive a “Data Request” that lists the information and documents that the covered entity must produce prior to the audit. Among the documentation that must be given to the auditor is a spreadsheet of all the covered entity’s 340B drug purchases. The auditors then review a sample of 340B drug purchases in more detail to determine compliance with the diversion and duplicate-discount prohibitions. The covered entity must be able to show that its 340B purchases were proper by tracking the drug from when it was ordered to the point of administration or dispensation. HRSA requires a staff member who is knowledgeable about navigating electronic health records (EHRs) (including billing information) and the split-billing software/third-party software to be available during an audit. This requirement is included in HRSA’s Fiscal Year 2021 Data Request List, which is provided before the on-site audits.

Operational Issues to Consider

Operationalizing a 340B pharmacy program can be challenging, especially for complex organizations such as hospitals or underfunded clinics such as FQHCs, FQHC-LAs, or Ryan White clinics. Improper planning and/or implementation of a 304B program can lead to compliance problems. The risk of noncompliance is particularly high in the areas of inventory management and contract-pharmacy oversight.

Audits and Enforcement

The 340B statute requires covered entities to repay their 340B discounts to drug manufacturers if the entities fail to comply with the program’s anti-diversion and duplicate-discount requirements.^[96] Covered entities may also be required to pay interest on the 340B discounts they improperly receive if the violation is “knowing and intentional.”^[97] HRSA may terminate a covered entity from the 340B program if there is evidence that the violations are not only knowing and intentional, but also systemic and egregious.^[98] A covered entity may also be terminated if it fails to maintain auditable records or to satisfy eligibility requirements, including the GPO prohibition.^[99] HRSA may only impose these sanctions after an audit, notice of findings, and a hearing.^[100]

HRSA Audits of Covered Entities

The 340B statute gives HRSA the authority to audit covered entities for compliance with 340B program requirements. HRSA’s 340B program audits review covered-entity compliance with respect to, among other things, eligibility status; compliance with the duplicate-discount and diversion prohibitions; and contract pharmacy oversight. As stated previously, HRSA holds the covered entity responsible for any compliance issues at the covered entity’s contract pharmacies.

HRSA also has authority to audit drug manufacturers for compliance; however, these types of audits are far less common. HRSA has audited more than 1,000 covered entities but only a few manufacturers.

Self-Disclosures

Covered entities are required to disclose a breach to HRSA if noncompliance meets the definition of “material breach.”^[105] Neither the 340B statute nor HRSA provides a definition for material breach. So HRSA permits each covered entity to adopt its own definition of material breach. Apexus provides a tool to help covered entities establish a “framework to guide the definition of a material breach of compliance and the process for self-disclosure to HRSA.”^[106] Covered entities are strongly encouraged to define “material breach” in their 340B policies and procedures.

If a covered entity discovers a material breach of 340B program requirements, it must submit a comprehensive self-disclosure to HRSA that contains the following:

• Letter to HRSA noting the covered entity’s 340B ID

• Description of the potential violation of 340B program requirements

• Corrective action plan addressing how the problem will be fixed

• Description of strategy to work with manufacturers that includes plans for financial remedy if repayment is necessary^[107]

In contrast to a HRSA audit finding, violations addressed in a covered entity’s self-disclosure are not posted on HRSA’s website.

Importantly, covered entities must remedy any violation they uncover, including violations that fall short of a material breach. They are obligated to repay manufacturers, for example, for engaging in diversion or causing duplicate discounts even if the repayment amount is small.

Manufacturer Audits of Covered Entities

As stated previously, the 340B statute allows manufacturers to audit covered entities, but only with respect to compliance with the diversion and duplicate-discount prohibitions.^[108] Before auditing a covered entity, the manufacturer must submit to HRSA an audit work plan and show that the manufacturer has “reasonable cause” to believe that the covered entity has violated the diversion and duplicate-discount prohibitions.^[109] If HRSA grants the manufacturer’s audit request, the manufacturer must hire an independent auditor to conduct the audit and prepare a final report. The covered entity has the opportunity to dispute any of the independent auditor’s findings. Notably, manufacturers do not have the authority to take action against a covered entity based on the outcome of its audit.^[110]

Manufacturer Compliance Obligations

Manufacturers are subject to far fewer requirements under the 340B program than covered entities. Essentially, they only have one requirement to meet—to sell their products at or below the 340B statutory ceiling price. Section 1927 of the Social Security Act, which is where the Medicaid drug rebate statute resides, states that a manufacturer’s drugs will not be covered by Medicaid or Medicare Part B unless the manufacturer signs a PPA with HHS.^[111] The PPA requires a drug manufacturer to provide covered entities with “covered outpatient drugs for purchase at or below the applicable ceiling price if such drug is made available to any other purchaser at any price.”^[112] HRSA has interpreted this so-called “must offer” provision to mean that manufacturers may not discriminate against 340B covered entities when allocating drugs in short supply or otherwise balancing the demand for products between 340B and non-340B purchasers. HRSA requests, but does not require, that manufacturers submit a written notice of any plan to limit distribution of covered outpatient drugs to HRSA at least four weeks in advance of implementation. These limited distribution plans should provide “[d]etails for a nondiscriminatory practice for restricted distribution to all purchasers, including 340B covered entities.”^[113]

Until recently, manufacturers have been under no obligation to share their 340B ceiling prices with covered entities, making it difficult for covered entities to validate whether they are receiving the discounts to which they are entitled. That changed in 2019 when HRSA created a secure website for covered entities to verify the quarterly 340B ceiling price for each covered outpatient drug available for purchase.^[114] Only the covered entity’s AO and PC have access to the website. Participating manufacturers are required to submit quarterly pricing reports that HRSA uses to populate the data on the website.^{[115][116][117]}

Manufacturers sometimes miscalculate the 340B ceiling price, which may result in an overcharge to covered entities.^[118][119] The 340B statute requires HRSA to create a system that manufacturers can use for refunding the overcharged amount to covered entities and for recalculating ceiling prices in the event post-sale rebates and discounts have the effect of lowering the 340B ceiling price.^[120] Notices informing covered entities of manufacturer overcharges are often posted on the HRSA website.^[121] Manufacturers that have overcharged a covered entity must make repayments to the covered entity.^[122][123] HRSA may recommend to the OIG that the OIG impose civil monetary penalties on a manufacturer of up to $5,000 for each instance of knowingly and intentionally overcharging a covered entity.^[124]

Manufacturers are also expected to maintain accurate information on OPAIS, although HRSA does not have the authority to require them to do so. Nevertheless, HRSA strongly urges manufacturers to verify their database information because it is the source of data that covered entities use to contact them regarding compliance issues, pricing and distribution inquiries, and repayment.^[125]