For example, covered entities are prohibited from  subjecting manufacturers to “duplicate discounts” in which drugs  prescribed to Medicaid beneficiaries are subject to both the 340B  price and a rebate through the Medicaid Drug Rebate Program. Since that time,  the number of contract pharmacies has increased more than fifteen-fold,  from about 1,300 to approximately 20,000. Among other things, HRSA’s audits include reviews of each covered  entity’s policies and procedures, including those for overseeing contract  pharmacies; an assessment of the entity’s compliance with respect to  340B eligibility status, the prevention of duplicate discounts and diversion,  and other program requirements; and reviews of a sample of  prescriptions filled during a 6-month period, including prescriptions  dispensed by contract pharmacies, to identify instances of non- compliance. About One-Third of Covered Entities Had One or More Contract Pharmacies, and Pharmacy Characteristics Varied

As of July 1, 2017, about one-third of the more than 12,000 covered  entities in the 340B Program had contract pharmacies, but the extent to  which covered entities had contract pharmacies varied by type of entity. Contracts Reviewed Showed Covered Entities Agreed to Pay Contract Pharmacies a Fee per 340B Prescription; Some Also Agreed to Additional Fees

Twenty-nine of the 30 contracts we reviewed between covered entities  and contract pharmacies included provisions for the entities to pay flat  fees for each eligible 340B prescription. We found a wide range in the amount of flat fees covered entities agreed  to pay pharmacies in the contracts we reviewed, though they generally  ranged from $6 to $15 per 340B prescription. About Half of the Covered Entities Reviewed Provided Low-Income, Uninsured Patients Discounts on 340B Drugs at Some or All of Their Contract Pharmacies

Of the 55 covered entities responding to our questionnaire, 30 reported  providing low-income, uninsured patients discounts on 340B drugs  dispensed at some or all of their contract pharmacies, and 25 said they  did not offer discounts at their contract pharmacies. Of the 30 covered entities that responded to our questionnaire that they  provided discounts on the drug price, 23 reported providing patients the  full 340B discount—the patients obtained drugs from contract pharmacies  at the 340B price or less. In many cases, these covered entities indicated  that patients received drugs at no cost. Fourteen of the  covered entities said they determined eligibility for discounts based on  whether a patient’s income was below certain thresholds as a percentage  of the federal poverty level, 11 reported providing discounts to all patients,  and 5 said they determined eligibility for discounts on a case-by-case  basis. HRSA’s audits  only assess the potential for duplicate discounts in Medicaid fee-for- service. As HRSA does  not provide guidance on how covered entities are to assess the full scope  of noncompliance and does not review most entities’ methodology for  making such assessments, the agency does not have reasonable  assurances that entities have adequately identified all instances of  noncompliance. Second, HRSA generally relies on each covered entity to self-attest that  all audit findings have been addressed and that the entity is now in  compliance with 340B Program requirements. Beginning April 1, 2018,  HRSA requires the 10 percent of covered entities that are subject to  targeted audits to provide documentation that they implemented their  corrective action plans prior to HRSA closing the audits. Specifically, HRSA’s 2010 guidance on contract pharmacy services  specifies that covered entities are responsible for overseeing their  contract pharmacies to ensure that drugs the entity distributes through  them comply with 340B Program requirements, but states that, “the exact  method of ensuring compliance is left up to the covered entity.” The  guidance also states that, “annual audits performed by an independent,  outside auditor with experience auditing pharmacies are expected,” but  HRSA officials told us that covered entities are not required to conduct  independent audits and instead are expected to do some form of periodic  oversight of their contract pharmacies. Conclusions

The 340B Program provides covered entities with discounts on outpatient  drugs and the ability to generate revenue on drugs purchased under the  program. As currently structured, weaknesses in HRSA’s oversight impede its  ability to ensure compliance with 340B Program requirements at contract  pharmacies. HRSA’s audits do  not assess compliance with a key 340B Program requirement (the  prohibition regarding duplicate discounts) as it relates to Medicaid  managed care, and HRSA does not provide audited entities with  guidance for determining the full scope of noncompliance, which reduces  the effectiveness of HRSA’s audits in identifying drug diversion and  duplicate discounts.
Why GAO Did This Study

Covered entities can provide 340B drugs to eligible patients and generate revenue by receiving reimbursement from patients' insurance. The number of pharmacies covered entities have contracted with has increased from about 1,300 in 2010 to nearly 20,000 in 2017. GAO was asked to provide information on the use of contract pharmacies. Among other things, this report: 1) describes financial arrangements selected covered entities have with contract pharmacies; 2) describes the extent that selected covered entities provide discounts on 340B drugs dispensed by contract pharmacies to low-income, uninsured patients; and 3) examines HRSA's efforts to ensure compliance with 340B Program requirements at contract pharmacies. GAO selected and reviewed a nongeneralizable sample of 30 contracts between covered entities and pharmacies, 20 HRSA audit files, and 55 covered entities to obtain variation in the types of entities and other factors. GAO also interviewed officials from HRSA and 10 covered entities.

What GAO Found

The 340B Drug Pricing Program (340B Program), which is administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), requires drug manufacturers to sell outpatient drugs at a discount to covered entities so that their drugs can be covered by Medicaid. Covered entities include certain hospitals and federal grantees (such as federally qualified health centers). About one-third of the more than 12,000 covered entities contract with outside pharmacies—contract pharmacies—to dispense drugs on their behalf. GAO's review of 30 contracts found that all but one contract included provisions for the covered entity to pay the contract pharmacy a flat fee for each eligible prescription. The flat fees generally ranged from $6 to $15 per prescription, but varied by several factors, including the type of drug or patient's insurance status. Some covered entities also agreed to pay pharmacies a percentage of revenue generated by each prescription.
Thirty of the 55 covered entities GAO reviewed reported providing low-income, uninsured patients discounts on 340B drugs at some or all of their contract pharmacies. Of the 30 covered entities that provided discounts, 23 indicated that they pass on the full 340B discount to patients, resulting in patients paying the 340B price or less for drugs. Additionally, 14 of the 30 covered entities said they determined patients' eligibility for discounts based on whether their income was below a specified level, 11 reported providing discounts to all patients, and 5 determined eligibility for discounts on a case-by-case basis.
GAO found weaknesses in HRSA's oversight that impede its ability to ensure compliance with 340B Program requirements at contract pharmacies, such as:
HRSA audits do not fully assess compliance with the 340B Program prohibition on duplicate discounts for drugs prescribed to Medicaid beneficiaries. Specifically, manufacturers cannot be required to provide both the 340B discount and a rebate through the Medicaid Drug Rebate Program. However, HRSA only assesses the potential for duplicate discounts in Medicaid fee-for-service and not Medicaid managed care. As a result, it cannot ensure compliance with this requirement for the majority of Medicaid prescriptions, which occur under managed care.
HRSA requires covered entities that have noncompliance issues identified during an audit to assess the full extent of noncompliance. However, because HRSA does not require all the covered entities to explain the methodology they used for determining the extent of the noncompliance, it does not know the scope of the assessments and whether they are effective at identifying the full extent of noncompliance.
HRSA does not require all covered entities to provide evidence that they have taken corrective action and are in compliance with program requirements prior to closing the audit. Instead, HRSA generally relies on each covered entity to self-attest that all audit findings have been addressed and that the entity came into compliance with 340B Program requirements.
Given these weaknesses, HRSA does not have a reasonable assurance that covered entities have adequately identified and addressed noncompliance with 340B Program requirements.

What GAO Recommends

GAO is making seven recommendations, including that HRSA's audits assess for duplicate discounts in Medicaid managed care, and HRSA require information on how entities determined the scope of noncompliance and evidence of corrective action prior to closing audits. HHS agreed with four of the recommendations, but disagreed with three recommendations, which GAO continues to believe are warranted to improve HRSA's oversight as explained in the report.