ADVI Analysis: HRSA 340B Covered Entity Audits

Analysis of HRSA 340B Covered Entity Audits

Since the 340B Drug Pricing Program began in 1992, covered entities’ participation has been contingent on compliance with specified statutory program requirements. The Health Resources & Services Administration (HRSA), which oversees the 340B program, has issued guidance setting forth the agency’s interpretation of several statutory requirements that are intended to guide covered entities’ program compliance efforts.

HRSA began conducting audits of covered entities in fiscal year (FY)  2012, when sales at the 340B price totaled $6.9B.[i] Today the most recent data available for 2023 show sales at the 340B price reached a record $66.3B.[ii] This increase from 2022 340B sales ($53.7B) continues the same trend observed over the last decade, where the average annual growth in 340B sales remained about 23 percent between 2012 and 2023.[iii] The number of covered entity sites also experienced dramatic growth, more than tripling from less than 20,000 covered entity sites in 2012 to more than 60,000 in 2024.[iv] Despite this growth, HRSA has limited its audits to 200 covered entities per year since FY 2015, shrinking its already small oversight from less than 1.0 percent of covered entities to 0.33 percent in 2024.[v] In contrast, the Medicare program’s Part C and D Audits covered 29 percent of the program’s contracts in 2022.[vi]

According to the GAO, approximately 90% percent of 340B audits are conducted on randomly selected covered entities using HRSA’s risk-based criteria, and the remaining 10 percent are targeted based on information from stakeholders (e.g., drug manufacturers) or covered entities that are being reaudited as the result of findings from a prior audit.[vii] Since 2015, 68 covered entities have been subject to reaudits, and 46 of these reaudited covered entities (68 percent) continued to be non-compliant with 340B requirements.

Figure 1: Approximate Number of Covered Entities vs. Percent of Covered Entities Audited [viii]

Building on a previous analysis of HRSA audits, ADVI Health reviewed HRSA’s FY 2022 and FY 2023 covered entity final audit results to assess covered entity compliance at the national and state levels.[i] The following table summarizes the findings on a national level, while the appendix breaks down the number of audits in each state compared to the increasing number of the 340B covered entities.

Table 1: Analysis of National Level FY 2017 – FY 2023 HRSA Audits

*Note: Total does not include audits where the findings have not yet been finalized

HRSA’s audits focus on several areas of covered entity compliance, including 340B/Medicaid duplicate discounts,[1]^,[i],[ii] medicine diversion,[iii] and data submission and reporting errors and inaccuracies.

Though HRSA acknowledges it uses a program-specific audit process[iv], it is not clear what standards the agency and its audit contractors follow to assess covered entity compliance. Because statute does not require HRSA to use Generally Accepted Government Auditing Standards, 340B program audits may not meet federal program audit standards. The lack of clarity around program requirements and limited oversight has been well documented by the Government Accountability Office (GAO), which has previously stated that “HRSA’s oversight of the 340B program is inadequate.”[v] As of May 2023, HRSA had only implemented five of twenty GAO recommendations related to oversight of the 340B Program.[vi]

Following a legal challenge related to HRSA’s enforcement of the diversion prohibition, the GAO reported that HRSA “concluded that in the absence of binding and enforceable regulations, the agency would no longer issue findings based solely on noncompliance with guidance” and starting in 2019 would issue findings “only when audit information presents a clear and direct violation of the 340B Program statute.”[vii] HRSA told GAO that this change includes covered entity non-compliance based solely on HRSA’s 1996 patient definition guidance. As a result of this policy change, HRSA stated there were 36 instances during its FY 2019 audits that did not result in a finding of noncompliance but would have resulted in one in the past.[viii] HRSA’s statements to GAO suggest that 340B covered entities could engage in diversion based on the agency’s interpretation of the 340B statute without receiving a negative audit finding as long as 340B drugs were dispensed to an individual the covered entity considers to be its patient.

Despite the limitations of HRSA’s audits, 70 percent of covered entities audited in FY 2022 were non-compliant. Of the FY 2023 audit results that have been finalized as of January 2025, 63 percent of audited covered entities have an adverse finding. The most common sanction imposed on these covered entities was a requirement that they repay affected manufacturers discounts for which the covered entities were not eligible. Covered entities were not required to pay penalties, nor did HRSA terminate any covered entities from the 340B program as a result of noncompliance identified during these audits. This includes cases where the covered entity was found to not meet statutory eligibility criteria for program participation—such as the requirement that disproportionate share hospitals, children’s hospitals, and free-standing cancer hospitals not use a group purchasing organization or arrangement to obtain covered outpatient drugs.[ix]

Appendix

Table A1: ADVI’s Analysis of FY 2021 – FY 2023 HRSA Audits

*Note: Total does not include audits where the findings have not yet been finalized

[1] Covered entities with at least one adverse finding are referred to in this analysis as “non-compliant” entities

[2] Covered entities can have more than one adverse finding

[3] Note: HRSA limits the scope of its audit reviews for 340B/Medicaid duplicate discounts to Medicaid fee-for-service claims; in 2018, GAO recommended HRSA audit for duplicate discounts in Medicaid managed care, but to date HRSA has not acted on this recommendation.

Table A2: ADVI’s Analysis of State Level FY22 & FY23 HRSA Audit Results and 2023 340B CE Registrations

^Prior ADVI analysis of the HRSA Office of Pharmacy Affairs (OPA) Database, 340B covered entities participating as of 1/31/2023. Analysis is at the parent level, identified based on “340B ID.” Does not take into account registrations/de-registrations throughout a year.

Funding for this research was provided by Pharmaceutical Research and Manufacturers of America (PhRMA). ADVI Health retained full editorial control.

[i] Fein AJ. Exclusive: The 340B program hits $16.2 billion in 2016; now 5% of U.S. drug market. Drug Channels. May 18, 2017. Accessed November 1, 2024. https://www.drugchannels.net/2017/05/exclusive-340b-program-hits-162-billion.html.

[ii] 2023 340B covered entity purchases. HRSA. Accessed November 1, 2024. https://www.hrsa.gov/opa/updates/2023-340b-covered-entity-purchases.

[iii] ADVI analysis of compound annual growth rate (CAGR) from 2012 340B spend (Drug Channels) and 2023 340B spend (HRSA)

[iv] Karen Mulligan P. The 340B Drug Pricing Program: Background, ongoing challenges and recent developments. USC Schaeffer. October 13, 2022. Accessed November 1, 2024. https://healthpolicy.usc.edu/research/the-340b-drug-pricing-program-background-ongoing-challenges-and-recent-developments/. ADVI analysis of the HRSA OPA Covered Entity Database, accessed November 2024.

[v] HHS Uses Multiple Mechanisms to Help Ensure Compliance with 340B Requirements. GAO. December 2020, Accessed December 9, 2024. https://www.gao.gov/assets/gao-21-107.pdf

[vi] 2022 Part C and Part D Program Audit and Enforcement Report. CMS. Accessed November 1, 2024. https://www.cms.gov/medicare/audits-compliance/part-c-d/program-audits

[vii] 340B Drug Discount Program: Information about Hospitals That Received an Eligibility Exception as a Result of COVID-19 . May 11, 2023. Accessed November 1, 2024. https://www.gao.gov/assets/gao-23-106095.pdf.

[viii] 2015, 2018, and 2021 Covered Entity Estimates Adapted from Karen Mulligan P. The 340B Drug Pricing Program: Background, ongoing challenges and recent developments. USC Schaeffer. October 13, 2022. Accessed November 1, 2024. https://healthpolicy.usc.edu/research/the-340b-drug-pricing-program-background-ongoing-challenges-and-recent-developments/. ADVI analysis of the HRSA OPA Covered Entity Database, accessed November 2024.

[ix] Audit results downloaded from the HRSA website in January 2025 – (Program integrity: FY22 audit results. HRSA. Accessed January 24, 2025. https://www.hrsa.gov/opa/program-integrity/fy-22-audit-results. Program integrity: FY23 audit results. HRSA. Accessed January 24, 2025. https://www.hrsa.gov/opa/program-integrity/fy-23-audit-results. ADVI sorted audit findings into four categories: 1) diversion, 2) duplicate discounts, 3) incorrect records and 4) other. This is generally consistent with GAO, Drug Pricing Program: HHS Uses Multiple Mechanisms to Help Ensure Compliance with 340B Requirements (Dec. 2020).

[x] Public Health Service Act Sec. 340B(a)(5)(A).

[xi] 340B Drug Discount Program: Oversight of the Intersection with the Medicaid Drug Rebate Program Needs Improvement. GAO. January 21, 2020. Accessed December 9, 2024. https://www.gao.gov/products/gao-20-212

[xii] Public Health Service Act Sec. 340B(a)(5)(B).

[xiii] Program integrity: Covered entity audit standards. HRSA. Accessed November 1, 2024. https://www.hrsa.gov/opa/program-integrity

[xiv] Manufacturer Discounts in the 340B Program Offer Benefits, but Federal Oversight Needs Improvement. Accessed November 1, 2024. https://www.gao.gov/assets/gao-11-836.pdf.

[xv] 340B Drug Discount Program: Information about Hospitals That Received an Eligibility Exception as a Result of COVID-19. Accessed November 1, 2024. https://www.gao.gov/assets/gao-23-106095.pdf.

[xvi] HHS Uses Multiple Mechanisms to Help Ensure Compliance with 340B Requirements. Accessed November 1, 2024. https://www.gao.gov/assets/gao-21-107.pdf.

[xvii] HHS Uses Multiple Mechanisms to Help Ensure Compliance with 340B Requirements. Accessed November 1, 2024. https://www.gao.gov/assets/gao-21-107.pdf.

[xviii] Public Health Service Act Sec. 340B(a)(4)(L)(iii), (a)(4)(M).

---