340B Drug Discount Program: Oversight of the Intersection with the Medicaid Drug Rebate Program Needs Improvement

Covered entities can receive substantial discounts on outpatient drugs through the 340B Program, an estimated 25 to 50 percent of the cost of the drugs, according to HRSA. Additionally, Medicaid drug rebates are an important source of savings for states and the federal government, saving more than $36 billion in fiscal year 2018. However, ensuring that manufacturers are not subject to both discounts requires coordination within HHS, and between covered entities and states. GAO was asked to provide information on the prevention of duplicate discounts. Among other things, this report examines HHS's efforts to ensure compliance with the prohibition on duplicate discounts. GAO reviewed documentation, including federal policies and those from all 50 states and Washington, D.C. on preventing duplicate discounts. GAO also interviewed officials from CMS, HRSA, and 16 covered entities from four states selected to obtain variation in the types of entities and other factors.

The 340B Drug Pricing Program (340B Program) and the Medicaid Drug Rebate Program require manufacturers to provide discounts on outpatient drugs in order to have their drugs covered by Medicaid. These discounts take the form of reduced sales prices for covered entities participating in the 340B Program—eligible hospitals and federal grantees—and rebates on drugs dispensed to Medicaid beneficiaries, shared by states and the federal government. However, federal law prohibits subjecting manufacturers to “duplicate discounts” in which drugs provided to Medicaid beneficiaries are subject to both 340B Program discounted prices (i.e., are 340B drugs) and Medicaid rebates. To prevent duplicate discounts, state Medicaid programs must know when covered entities dispense 340B drugs to Medicaid beneficiaries, so the state programs can exclude those drugs from their Medicaid rebate requests.

GAO found that limitations in the Department of Health and Human Services's (HHS) oversight of the 340B and Medicaid Drug Rebate Programs may increase the risk that duplicate discounts occur.

HHS's Centers for Medicare & Medicaid Services (CMS) conducts limited oversight of state Medicaid programs' efforts to prevent duplicate discounts. CMS does not track or review states' policies or procedures for preventing duplicate discounts, and GAO found that the procedures states used to exclude 340B drugs are not always documented or effective at identifying these drugs. As a result, CMS does not have the information needed to effectively ensure that states exclude 340B drugs from Medicaid rebate requests. CMS also does not have a reasonable assurance that states are seeking rebates for all eligible drugs, potentially increasing costs to state and federal governments due to forgone rebates.

HHS's Health Resources and Services Administration's (HRSA) audits of covered entities do not include reviews of states' policies and procedures for the use and identification of 340B drugs. As a result, the audits are unable to determine whether covered entities are following state requirements, and taking the necessary steps to comply with the prohibition on subjecting manufacturers to duplicate discounts.

GAO reported in 2018 that HRSA had not issued guidance on, and did not audit for, duplicate discounts in Medicaid managed care and recommended the agency do so as the majority of Medicaid enrollees, prescriptions, and spending for drugs are in managed care. HRSA is working to determine next steps to address these recommendations. In this report, GAO found that, unlike Medicaid fee-for-service, when duplicate discounts in Medicaid managed care claims are identified, HRSA does not require covered entities to address them or work with manufacturers to repay them. As a result, manufacturers may be subject to duplicate discounts for drugs provided under managed care.

Given these limitations in federal oversight, HHS does not have reasonable assurance that states and covered entities are complying with the prohibition on duplicate discounts.

GAO is making three recommendations, namely that: 1) CMS ensure that state Medicaid programs have written policies and procedures that are designed to prevent duplicate discounts and forgone rebates; and that HRSA 2) incorporate covered entities' compliance with state policies into its audits, and 3) require covered entities to work with manufacturers regarding repayment of identified duplicate discounts in managed care. HHS agreed with the recommendation to CMS, but disagreed with those to HRSA. GAO continues to believe these are needed to improve oversight and the integrity of the 340B Program, as explained in the report.

The 340B Drug Pricing Program (340B Program) and the Medicaid Drug  Rebate Program require drug manufacturers to provide discounts on  outpatient drugs in order to have their drugs covered by Medicaid. For  the 340B Program, administered by the U.S. Department of Health and  Human Services’s (HHS) Health Resources and Services Administration  (HRSA), these discounts take the form of reduced sales prices for  participating covered entities—eligible hospitals and federal grantees.  The discounts, which HRSA estimates to be 25 to 50 percent of the cost  of the drugs, are comparable to the rebates made available to state  Medicaid programs through the Medicaid Drug Rebate Program,  overseen by HHS’s Centers for Medicare & Medicaid Services (CMS).  While both covered entities and state Medicaid programs are eligible for  these discounts, federal law prohibits subjecting drug manufacturers to  duplicate discounts in which drugs provided to Medicaid beneficiaries are  subject to both the 340B Program discounted price and a Medicaid  rebate.

To prevent duplicate discounts, covered entities and states must work  together to identify when covered entities provide drugs purchased at  discounted prices through the 340B Program to Medicaid beneficiaries so  states can exclude those purchases from rebate requests sent to drug  manufacturers. (In this report, we refer to the discounted price through the  340B Program as the 340B price, and to drugs purchased by covered  entities at that price as 340B drugs.) States also need to know when the  drugs provided to Medicaid beneficiaries by covered entities were not  purchased at 340B prices, so they do not forgo rebates for which they are  legally entitled, which may increase their costs, as well as that of federal  taxpayers.

In recent years, the potential for duplicate discounts has increased due to  substantial growth in the 340B Program and the expansion of the  Medicaid Drug Rebate Program. Specifically, from 2010 to 2019, the  number of covered entities participating in the 340B Program increased  from nearly 9,700 to nearly 13,000. In addition, since a change in HRSA  guidance allowed covered entities to have an unlimited number of  contract pharmacies, there also has been a large increase in the number  of contract pharmacies—outside pharmacies that covered entities  contract with and pay to dispense 340B drugs on their behalf.  Specifically, the number of contract pharmacies increased from about  1,300 at the beginning of 2010 to around 23,000 in 2019. Furthermore,  while the Medicaid Drug Rebate Program had historically been limited to  drugs provided under Medicaid fee-for-service (FFS), in 2010, the Patient  Protection and Affordable Care Act expanded the program by also  requiring drug manufacturers to provide rebates for drugs provided under  Medicaid managed care. Since that time, total Medicaid drug rebates  more than doubled from about $15 billion in fiscal year 2011 to more than  $36 billion in fiscal year 2018.

In recent years, the HHS Office of Inspector General and others have  identified challenges covered entities and states face in identifying 340B  drugs provided to Medicaid beneficiaries, and thus in preventing duplicate  discounts. In addition, in a June 2018 report, we identified weaknesses  in HRSA’s oversight that impede its ability to ensure compliance with  340B Program requirements, including the prohibition on duplicate  discounts. We reported that HRSA had not issued guidance as to how  covered entities should prevent duplicate discounts in Medicaid managed  care and thus, did not include reviews of covered entities’ processes to  prevent duplicate discounts for drugs dispensed through Medicaid  managed care in its audits of the entities. As a result, we found that drug  manufacturers were at risk of providing duplicate discounts. We  recommended that HRSA address these issues. HRSA concurred with  our recommendations, and as of October 2019, reported that it was  continuing to work to determine next steps to address them.

You asked us to examine stakeholders’ efforts to prevent duplicate  discounts under the 340B and Medicaid Drug Rebate Programs. In this  report, we  1.  describe state Medicaid programs’ policies on the use and  identification of 340B drugs provided to their beneficiaries to prevent  duplicate discounts; and   2.  examine HHS’s efforts, specifically those of CMS and HRSA, to  ensure compliance with the prohibition on duplicate discounts in the  Medicaid Drug Rebate and 340B Programs.

To describe state Medicaid programs’ policies on the use and  identification of 340B drugs provided to their beneficiaries to prevent  duplicate discounts, we collected information from states and covered  entities. Specifically, in January 2019, we sent a data collection  instrument to all 50 states and the District of Columbia requesting  documentation of, and information about, their policies related to 340B  drugs. The data collection instrument requested the states’ policies  related to the use and identification of 340B drugs in both Medicaid FFS  and managed care for three different methods in which outpatient drugs  can be dispensed to Medicaid beneficiaries. We received responses  from all states, and reviewed their available policies to determine whether  they allowed covered entities to provide 340B drugs to beneficiaries  covered under Medicaid FFS or managed care for each dispensing  method, and how the state identified and excluded 340B drugs provided  to such beneficiaries from rebate requests sent to drug manufacturers.  For states that indicated they did not have written policies or procedures  for using or identifying 340B drugs, we asked for a description of how  they prevented duplicate discounts in practice.

In order to gain a more in-depth understanding of how states worked with  covered entities to implement policies and procedures to prevent  duplicate discounts, we also interviewed Medicaid officials from a  nongeneralizable sample of four states. We selected the four states— Michigan, Oregon, Pennsylvania, and Texas—to obtain variation in  factors such as the amount of Medicaid expenditures and rebates on  outpatient drugs under both Medicaid FFS and managed care, and  geographic location. In addition, we interviewed officials from a  nongeneralizable sample of four covered entities located in each of the  four selected states (for a total of 16 covered entities) about their  understanding of their individual states’ policies and the covered entities’  actions to prevent duplicate discounts. We selected covered entities of  various types that had either high quantities or dollar amounts of 340B  drug purchases and that varied as to whether or not they were providing  these drugs to Medicaid FFS beneficiaries.

To examine HHS’s efforts, specifically those of CMS and HRSA, to  ensure compliance with the prohibition on duplicate discounts in the  Medicaid Drug Rebate and 340B Programs, we reviewed relevant laws,  policies, procedures, and guidance, including HRSA’s audit procedures.  In addition, we interviewed CMS and HRSA officials responsible for  overseeing and administering the Medicaid Drug Rebate and 340B  Programs, respectively, about their oversight of duplicate discounts, and  any potential actions or initiatives the agencies were undertaking, such as  updating or clarifying guidance for covered entities, states, and  manufacturers. Additionally, as part of the interviews with the states and  covered entities described earlier, we asked officials for their perspectives  on federal guidance related to preventing duplicate discounts, and  whether they believed any clarifications were needed. We also contacted  and obtained information about federal oversight, including CMS’s and  HRSA’s efforts to resolve disputes about duplicate discounts, from three  drug manufacturers that had high 340B Program participation based on  either total 340B drug sales in dollars or in units sold, as well as  consultants that research duplicate discount issues on behalf of  manufacturers, and a trade organization that represents drug  manufacturers. (Appendix I provides information on manufacturers’ efforts  to detect and avoid duplicate discounts.) Finally, we evaluated CMS’s and  HRSA’s guidance and oversight against federal internal control standards  related to information and communication and monitoring.

We conducted this performance audit from July 2018 to January 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The Medicaid Drug Rebate Program was established through the  Omnibus Budget Reconciliation Act of 1990 and requires drug  manufacturers to pay rebates to states on outpatient drugs as a condition  of having their drugs covered by Medicaid. The 340B Program, named  for the statutory provision authorizing it in the Public Health Service Act,  was created in 1992 following the enactment of the Medicaid Drug  Rebate Program and allows covered entities to purchase outpatient drugs  at discounted prices. HRSA and CMS both have roles in overseeing  compliance with the prohibition on duplicate discounts.

The Medicaid Drug Rebate Program helps to offset the federal and state  costs of most outpatient prescription drugs dispensed to Medicaid  beneficiaries. Under the rebate program, drug manufacturers pay rebates  to states as a condition for the federal contribution to Medicaid spending  for the manufacturers’ outpatient drugs. State Medicaid programs  generally must cover all of the drugs of manufacturers that participate in  the rebate program. Originally, rebates were available only for drugs paid  for by the state on a FFS basis, but the Patient Protection and Affordable  Care Act extended the program to outpatient drugs paid for under  Medicaid managed care; there are more Medicaid enrollees,  prescriptions, and spending for drugs under managed care than FFS.  The rebates received for both FFS and managed care are shared by the  federal government and states.

The amount of Medicaid rebates for a drug is based on a statutory  formula. Using that formula CMS calculates a unit rebate amount for  each drug and provides that amount to states so they can determine the  amount of rebates to request. Every quarter, each state multiplies the  number of units of each drug it either paid for on a FFS basis or provided  through its managed care plans by the CMS-provided unit rebate amount.  For drugs provided under FFS, the state calculates the number of units  based on drug claims it reimbursed, while states use drug utilization data  provided by managed care plans to determine the number of units of  each drug that were provided by the plans to Medicaid beneficiaries.  Each state then sends rebate requests to each manufacturer reflecting  the total quarterly amount of rebates owed for each of the manufacturer’s  drugs. States are to exclude claims for 340B drugs from their rebate  requests.

Participation in the 340B Program is voluntary for both covered entities  and drug manufacturers, but there are strong incentives for both to do so.  Covered entities can realize substantial savings through the program’s  price discounts. In addition, covered entities can generate revenue to the  extent that they can purchase 340B drugs for eligible patients whose  insurance reimbursement exceeds the price paid. Incentives for  participation by drug manufacturers are strong because they must  participate in the 340B Program to receive Medicaid reimbursement for  their drugs.

Covered entities generally become eligible for the 340B Program by  qualifying as certain federal grantees or as one of six specified types of  hospitals. Eligible federal grantees include federally qualified health  centers, which provide comprehensive community-based primary and  preventive care services to medically underserved populations, as well as  certain other federal grantees, such as family planning clinics and Ryan  White HIV/AIDS program grantees, among others. Eligible hospitals  include critical access hospitals—small, rural hospitals with no more than  25 inpatient beds; disproportionate share hospitals—general acute care  hospitals that serve a disproportionate number of low-income patients;  and four other types of hospitals.

To participate in the 340B Program, covered entities must register with  HRSA and annually recertify their continuing eligibility. Once their  eligibility is approved by HRSA, covered entities can begin purchasing  drugs from manufacturers at the 340B discounted prices. Covered entities  may provide drugs, including 340B drugs, to patients through one or more  dispensing methods. Specifically, covered entities may dispense these  drugs through pharmacies—either through in-house pharmacies they  own; through the use of contract pharmacy arrangements, in which they  contract with outside pharmacies and pay them to dispense drugs on their  behalf; or both. In addition, providers who work at covered entities, such  as doctors and nurses, may administer 340B drugs to patients directly,  such as during office visits. These are known as provider-administered  drugs.

As a condition of participating in the 340B Program, covered entities must  follow certain requirements. For example, they are prohibited from  diverting a 340B drug to an individual who is not a patient of the covered  entity. Covered entities are also prohibited from subjecting manufacturers  to duplicate discounts.

Preventing Duplicate Discounts and Forgone Rebates

Both states and covered entities play key roles in preventing duplicate  discounts and forgone rebates. States must know whether covered  entities provided 340B drugs to Medicaid beneficiaries in order to exclude  those drugs from the rebate requests they submit to manufacturers.  When covered entities provide 340B drugs to Medicaid beneficiaries, it is  known as “carving in;” if covered entities do not dispense these drugs to  Medicaid beneficiaries, it is known as “carving out.” As shown in figure 1,  if a state is not aware that a covered entity provided 340B drugs to  Medicaid beneficiaries, it would not know to exclude those drugs from its rebate requests, which could lead to duplicate discounts. In contrast, if a  state mistakenly believes the entity used 340B drugs when it did not, it  might exclude those drugs from its rebate requests and would forgo  eligible rebates.

To help prevent duplicate discounts, in 1993, HRSA and CMS  collaborated to establish the Medicaid Exclusion File (MEF) as a  mechanism to assist in the identification of 340B drugs provided to  Medicaid FFS beneficiaries. The MEF lists the covered entities that  reported to HRSA that they choose to use or “carve in” 340B drugs for  their Medicaid FFS patients. Specifically, HRSA requires that covered  entities that decide to carve in these drugs for Medicaid provide the  agency with the provider number or numbers that the entities use to bill  the state for those drugs. The entity and the provider number or  numbers it specifies are then listed on the MEF. HRSA guidance specifies  that all drugs billed with the provider numbers listed on the MEF should  be 340B drugs so a state that choses to use the MEF knows the drugs  should be excluded from rebate requests; there is no requirement for  states to use the MEF to identify 340B drugs. If a covered entity wants its  contract pharmacy to dispense 340B drugs to patients covered under  Medicaid FFS, HRSA guidance requires the covered entity, the contract  pharmacy, and the state Medicaid program to have an arrangement to  prevent duplicate discounts; any such arrangement must be reported to  HRSA.

When the MEF was created, Medicaid drug rebates were only required  for drugs provided under FFS. As such, in a 2014 policy release, HRSA  clarified that the MEF is only intended for use for Medicaid FFS, that is,  only covered entities that elect to carve in 340B drugs for Medicaid FFS  are required to provide the provider numbers used for billing Medicaid  FFS for inclusion on the MEF. The MEF is not intended to capture  whether covered entities have decided to carve in 340B drugs for  Medicaid managed care and, if so, what provider numbers they use for  billing for those drugs. HRSA has not created a mechanism for covered  entities to use to identify 340B drugs provided to Medicaid managed care  beneficiaries, but encourages covered entities to work with states to  develop strategies to prevent duplicate discounts for drugs reimbursed  through managed care.

While HRSA requires covered entities to use the MEF, there is no similar  requirement for state Medicaid programs. CMS provides states the  flexibility to determine procedures for identifying and excluding 340B  drugs from their Medicaid rebate requests. Under a May 2016 final rule,  states’ contracts with Medicaid managed care plans that provide  coverage of outpatient drugs must require the plans to provide the states  with drug utilization data that is necessary for the states to claim Medicaid  rebates. In addition, the contracts must require the plans to establish  procedures for excluding 340B drugs from the drug utilization data  provided to states for purposes of rebate collection.

To oversee covered entities’ compliance with 340B Program  requirements, in fiscal year 2012, HRSA implemented a systematic  approach to conducting audits of a small sample of covered entities, and  began conducting audits of 200 entities per year in fiscal year 2015.  HRSA audits include covered entities that are randomly selected based  on risk-based criteria (approximately 90 percent of all audits conducted  each year), or targeted based on information from stakeholders such as  drug manufacturers about potential noncompliance (10 percent of the  audits conducted). HRSA’s criteria for risk-based audits include a covered  entity’s volume of 340B drug purchases, number of contract pharmacies,  time in the program, and complexity of its program.

Among other things, HRSA’s audits include reviews of each covered  entity’s policies and procedures, an assessment of the entity’s  compliance with respect to 340B Program requirements, including the  prevention of duplicate discounts in Medicaid FFS, and reviews of a  sample of prescriptions filled during a 6-month period to identify any  instances of noncompliance. Under HRSA’s audit procedures, a covered  entity with audit findings is required to 1) submit a corrective action plan  to HRSA that indicates it will determine the full scope of any  noncompliance (beyond the sample of prescriptions reviewed during an  audit) and 2) outline the steps it plans to take to correct findings of  noncompliance, including any necessary repayments to manufacturers,  among other things. If the HRSA audit shows that duplicate discounts  may have occurred, the covered entity must, as part of its corrective  action plan, contact the state Medicaid program to determine whether  duplicate discounts actually occurred—namely, whether the state  requested a rebate on the claims in question, and if so, contact the drug  manufacturer to offer repayment. HRSA closes the audit when a covered  entity submits a letter attesting that its corrective action plan, including its  assessment of the full scope of noncompliance, has been implemented  and any necessary repayments to manufacturers have been resolved. In  addition, HRSA may re-audit a covered entity (i.e. subject it to a targeted  audit) to determine whether it has implemented its corrective action plan.

To oversee the Medicaid Drug Rebate Program, CMS receives copies of  states’ Medicaid rebate requests each quarter. States are required to  submit this data to manufacturers for FFS and managed care drugs,  which should not include drugs purchased through the 340B Program,  within 60 days of the end of the quarterly rebate period. Specifically,  states provide drug utilization data that includes the drug name, national  drug code (a unique identifier for each drug), the unit rebate amount, the  number of units reimbursed, the rebate amount claimed, and the number  of prescriptions, among other things. CMS has a system that reviews this  information for errors, such as the inclusion of drugs from manufacturers  that no longer participate in the Medicaid Drug Rebate Program, and  generates a discrepancy report for the state. CMS also has a system in  place to identify, for state review, cases in which the utilization data reflect  a substantial increase or decrease in the number of FFS records  submitted compared to prior quarters; such a review is not currently  performed for managed care. In addition, CMS reviews state Medicaid  programs’ contracts with managed care plans using a checklist to ensure  that the contracts include elements required by statute or regulation.

State Medicaid Programs’ Policies on the Use and Identification of 340B Drugs Vary, Are Not Always Documented, and May Not Prevent Duplicate Discounts State Medicaid Programs’ Policies for Use and Identification of 340B Drugs Vary

State Medicaid programs’ policies varied in whether they allowed covered  entities to use 340B Program drugs for Medicaid beneficiaries. Most  states allowed covered entities to decide whether to use, or “carve in,”  340B drugs for Medicaid beneficiaries at their in-house pharmacies and  for provider-administered drugs. Fewer states allowed covered entities to  dispense these drugs to Medicaid beneficiaries at contract pharmacies,  particularly beneficiaries whose drugs were covered under FFS. Table 1  below summarizes states’ policies on covered entities’ use of 340B drugs  for Medicaid beneficiaries for both FFS and managed care by dispensing  method.

In addition to varying by state, policies on the use of 340B drugs  sometimes varied within a state; that is, some states had different policies  depending on whether the drugs were provided to Medicaid FFS or  managed care beneficiaries, the dispensing method used, or both. For  example, Oregon allowed covered entities to decide whether to dispense  340B drugs at contract pharmacies to Medicaid managed care  beneficiaries, but required covered entities to carve out (not use) these  drugs at contract pharmacies under Medicaid FFS. Illinois required  covered entities to carve in 340B provider-administered drugs and those  dispensed at in-house pharmacies for Medicaid beneficiaries in both FFS  and managed care, but prohibited their use for Medicaid beneficiaries at  contract pharmacies. See appendix II for information on each state  Medicaid program’s policies regarding covered entities’ use of 340B  drugs.

The states that allowed or required covered entities to carve in 340B  drugs for Medicaid beneficiaries used several different procedures to  identify and exclude those drugs from Medicaid rebate requests. These  procedures included relying on the MEF, requiring covered entities to use  a 340B claim identifier—a code on the claim that indicates that the drug  used was purchased at the 340B discounted price, or using other state- developed procedures to identify and exclude 340B drugs from rebate  requests. The procedures states used varied between Medicaid FFS  and managed care, and among dispensing methods. For example, states  were more likely to use HRSA’s MEF to identify and exclude provider- administered drugs in both Medicaid FFS and Medicaid managed care  and to use a 340B claim identifier to identify and exclude drugs dispensed  at in-house pharmacies. Some states used a combination of procedures  or created their own state-specific procedures. For example,

11 states required that covered entities inform them of their decisions  to carve in 340B drugs for Medicaid beneficiaries. The states then  maintained a list of these covered entities or their providers, which  they used to exclude 340B drugs from rebate requests.

Oregon required covered entities to provide the state with a list of  each 340B drug dispensed to a Medicaid managed care beneficiary at  a contract pharmacy so that the state could exclude those drugs from  its rebate requests.

Vermont required covered entities, on a monthly basis, to send the  state a file listing each 340B drug provided to a Medicaid beneficiary;  the state used this information to exclude those drugs from rebate  requests.

See table 2 for a summary of the procedures used by states to identify  340B drugs provided to Medicaid beneficiaries, and appendix III for a  listing of the procedures by state.

State Medicaid Programs’ Policies on the Use and Identification of 340B Drugs Are Not Always Documented and May Not Prevent Duplicate Discounts

State Medicaid programs’ policies related to 340B drugs were not always  documented and some states’ policies may not prevent duplicate  discounts. Some states had written policies for the use of 340B drugs,  and procedures to identify them, for some dispensing methods, but not for  others, such as states that had documented policies for in-house  pharmacies but not contract pharmacies. Without written policies, covered  entities in those states may not be aware of requirements for dispensing  and identifying 340B drugs, increasing the risk of duplicate discounts.  Specifically, we found that nine states did not have written policies or  procedures on the use or identification of 340B drugs for all dispensing  methods. Seven of the nine states had policies or procedures regarding  the use and identification of 340B drugs that were used in practice, but  these policies and procedures were not always documented. For  example:

Connecticut did not have documented policies on the use and  identification of 340B drugs, but officials from the state reported that it  allowed covered entities to provide these drugs to Medicaid  beneficiaries and relied on the MEF to identify and exclude them from  rebate requests.

While Pennsylvania and Ohio had written policies regarding the use of  340B drugs in Medicaid FFS and for some dispensing methods under  managed care, the states’ policies requiring covered entities to carve  out these drugs for Medicaid managed care beneficiaries at contract  pharmacies were not documented.

The remaining two states did not have policies or procedures,  documented or otherwise, for all dispensing methods:

Officials from Washington, D.C. reported that D.C. did not have a  policy regarding the use of provider-administered 340B drugs nor did  it have procedures to identify and exclude those drugs from its  Medicaid drug rebate requests.

A Rhode Island Medicaid official told us that the state did not have  written policies regarding the identification of 340B drugs dispensed to  Medicaid FFS beneficiaries at in-house pharmacies, and that the state  did not have procedures, written or otherwise, by which to exclude  such drugs from rebate requests. Additionally, while the state had a  written policy for identifying and excluding 340B drugs administered  by providers at hospitals, officials told us that they had no policy or  exclusion procedures for drugs administered by providers at other  types of covered entities.

In addition, we found that states’ policies may not prevent duplicate  discounts. For example, some states used the MEF to identify and  exclude 340B drugs from their rebate requests in a manner contrary to  the MEF’s purpose as set forth by HRSA. As noted previously, HRSA  guidance specifies that the MEF is not intended to be used to identify and  exclude 340B drugs provided to Medicaid managed care beneficiaries  from Medicaid drug rebate requests. Covered entities are only required to  be listed on the MEF if they carve in 340B drugs for Medicaid FFS. Since  the MEF may not accurately reflect covered entities’ use of 340B drugs  for Medicaid managed care, states’ use of the MEF in this instance may  increase the risk of duplicate discounts or forgone rebates unless states  require covered entities to make the same decisions on the use of 340B  drugs for FFS and managed care. For example, as shown in figure 2, a  state’s use of the MEF for managed care would likely result in a duplicate  discount if covered entities carve out 340B drugs for Medicaid FFS, but  carve in these drugs for managed care, as those entities would not be  listed on the MEF. Consequently, the state would not know to exclude  drugs provided by those entities from the managed care plans’ utilization  data that are used for requesting rebates. If covered entities did the  opposite—carved in for FFS and carved out for Medicaid managed  care—then the state would likely forgo Medicaid rebates as it would  exclude drugs from its rebate request that were not purchased through  the 340B Program.

Seven of the 13 states that used the MEF exclusively to identify and  exclude Medicaid managed care drugs from rebate requests for at least  one dispensing method did not require covered entities to make the same  carve-in decisions for both FFS and managed care. Additionally, while the  six remaining states required covered entities to make the same decision  regarding use of 340B drugs in FFS and managed care, that requirement  was not always clearly explained in the states’ policies. For example, an  official from Arkansas, which used the MEF for identifying and excluding  340B drugs from rebate requests, told us that covered entities are  required to make the same carve-in decisions for both Medicaid FFS and  managed care. However, it is unclear how covered entities would be  aware of that requirement, as it was not documented in the state’s policy  manuals at the time of our information request.

Finally, states that rely on the MEF or state-developed lists of providers  carving in 340B drugs for Medicaid beneficiaries may not be able to  identify instances where covered entities are unable to purchase drugs at  the 340B Program discounted price, and instead need to purchase drugs  outside of the 340B Program. For example, orphan drugs are excluded  from the discounted 340B Program price for some covered entities. In  these situations, states that rely on the MEF or other state-developed lists  of providers may be forgoing rebates. For example, if covered entities do  not have a separate provider number for billing Medicaid for these non- 340B drugs, the states would be excluding both 340B and non-340B  drugs from their rebate requests. State Medicaid officials in Oregon and  Pennsylvania acknowledged that their states were likely forgoing rebates  when covered entities listed on the MEF were unable to purchase drugs  at the 340B Program price. While these state officials indicated that they  did not consider the lost rebates financially significant, the loss of these  rebates would also increase federal Medicaid expenditures, since rebates  are shared between the state and the federal government.

Limitations in HHS Oversight Increase the Risk of Duplicate Discounts CMS Oversight of State Medicaid Programs’ Efforts to Prevent Duplicate Discounts Is Limited

CMS oversight of state Medicaid programs’ efforts to prevent duplicate  discounts is limited. States have the flexibility to select the procedures  used for identifying and excluding 340B drugs from rebate requests.  Although CMS collaborated with HRSA to establish the MEF as a tool for  identifying 340B drugs in Medicaid FFS, CMS does not require states to  use the MEF in their duplicate discount prevention efforts. Instead, CMS  has provided states with options of procedures they could consider for  identifying and excluding 340B drugs from rebate requests. For example,  CMS’s February 2016 final rule on covered outpatient drugs, which  detailed requirements for Medicaid reimbursement of covered outpatient  drugs, included in its preamble examples of procedures that states could  use to identify and exclude 340B drugs in FFS without prescribing any  specific required procedure. Additionally, as noted earlier, the final rule  CMS issued in May 2016 on Medicaid managed care included a provision  relating to duplicate discounts for Medicaid managed care drugs.  Specifically, it mandated that state Medicaid programs’ contracts with managed care plans that provide outpatient drugs require the plans to  establish procedures for excluding 340B drugs from utilization data  provided to states for use in seeking rebates, but did not specify what  procedures plans should use. Most recently, in January 2020, CMS  released a bulletin to state Medicaid programs on best practices for  preventing duplicate discounts.

CMS has some visibility into state Medicaid programs’ 340B-related  policies and procedures through its oversight activities, but these  activities are not intended to, and do not enable CMS to, assess  compliance with the duplicate discount prohibition. For example, CMS  has a system in place that reviews copies of states’ quarterly Medicaid  drug rebate requests; however, CMS officials told us that these requests  do not contain detailed, claim-level information that could be used to  determine if specific drugs purchased through the 340B Program were  incorrectly included. Additionally, CMS reviews states’ contracts with  Medicaid managed care plans to ensure that they include language  requiring the plans to have procedures to exclude 340B drugs from  Medicaid rebate data provided to states, but CMS officials told us that the  contract language does not have to specify or describe those  mechanisms, limiting the information available regarding duplicate  discount prevention efforts. CMS also required states to submit their  plans for reimbursing covered entities for 340B drugs provided under  Medicaid FFS to ensure that the states’ payment methodologies complied  with federal requirements, but these reviews were not focused on  ensuring that such drugs were excluded from rebate requests.

CMS officials told us that they do not track which procedures states use  to prevent duplicate discounts; review states’ policies or procedures for  identifying and excluding 340B drugs from rebate requests for  deficiencies or to ensure effectiveness; or audit states’ compliance with  the prohibition on duplicate discounts. This is problematic because, as  noted previously, we found that not all state Medicaid programs have  written policies and procedures that specify the extent to which covered  entities can use 340B drugs for Medicaid beneficiaries, or how they are to  identify these drugs so the state can exclude them from Medicaid rebate  requests. If states do not have written policies, covered entities may not  be aware of whether, or under what circumstances, they are permitted to  provide 340B drugs to Medicaid beneficiaries or how to properly inform  the state of their use, which could result in errors that lead to duplicate  discounts and forgone rebates. We found some evidence of confusion  from covered entities about state policies. For example, officials from  Apexus, which manages HRSA’s 340B Prime Vendor Program, told us  that Apexus’s call center, which fields questions from covered entities and  other stakeholders about the 340B Program, most frequently receives  questions related to clarifying states’ duplicate discount-related policies.  These inquiries about state requirements indicate that there is currently  confusion among covered entities.

CMS’s limited oversight of state Medicaid programs’ efforts to prevent  duplicate discounts is also problematic because we found that states’  policies and procedures were not always effective at preventing duplicate  discounts, or in line with federal guidance. For example, the MEF is only  intended to be used for Medicaid FFS. CMS officials told us that, while  the agency was not aware of any states using the MEF for Medicaid  managed care, such use would be concerning because it is not an  accurate tool for that purpose. However, as previously shown in table 2,  we found that eight states relied on the MEF to identify and exclude  Medicaid managed care drugs dispensed at in-house pharmacies from  rebate requests and 13 states used the MEF to identify and exclude  managed care drugs administered by providers.

The lack of CMS oversight of state Medicaid programs’ policies and  procedures related to duplicate discount prevention is inconsistent with  federal standards for internal control for information and communication,  which state that management should obtain relevant data from reliable  internal and external sources in a timely manner based on the identified  information requirements so that data can be used for effective monitoring. Without reviewing states’ policies and procedures, CMS  does not have the information needed to effectively oversee states’  compliance with the Medicaid drug rebate statute, which exempts 340B  drugs from Medicaid rebate requirements, and ensure that states have  effective policies and procedures for preventing duplicate discounts. The  lack of oversight of states’ policies and procedures also results in CMS  not having reasonable assurance that states are seeking rebates for all  eligible drugs, and since Medicaid rebates are shared by the states and  the federal government, forgoing rebates increases Medicaid costs for  both states and the federal government.

Oversight Weaknesses Impede HRSA’s Ability to Ensure That Duplicate Discounts Are Prevented or Remedied

We identified several areas of weaknesses in HRSA’s oversight  processes that impede its ability to ensure that duplicate discounts are  prevented or remedied:  Covered entities’ compliance with state policies and procedures is  not assessed. HRSA’s auditors are instructed to look for the potential for  duplicate discounts in Medicaid FFS by assessing whether the covered  entity’s information on the MEF is correct; whether the entity is following  its policies and procedures to prevent duplicate discounts; and whether a  sample of claims reveals any noncompliance. Auditors are also  instructed to use information provided by the covered entity to determine  if the covered entity is following state policies. However, HRSA officials  told us that its auditors are not expected to independently identify or verify  state Medicaid programs’ policies to determine whether the covered entity  is actually following what the state requires. Instead, HRSA officials  stated that it is a best practice for covered entities to include a description  of state Medicaid programs’ policies related to the 340B Program, such  as how relevant drugs are to be identified, in their policy and procedure  manuals. In addition, HRSA told us that its auditors interview covered  entity staff about the controls in place to prevent duplicate discounts, and  may discuss state requirements during these interviews. The auditor is  then required to use this information to determine whether the covered  entity is following state policy. For example, if the covered entity says that  the state requires a 340B claim identifier, the auditor is to look to see if  the covered entity used that identifier in the sample of claims that are  reviewed. However, the auditor is not expected to determine if the state  actually requires a claim identifier, or allows covered entities to use 340B  drugs.

The fact that HRSA does not assess whether covered entities are actually  following state policies and procedures regarding the use and  identification of 340B drugs for Medicaid beneficiaries is inconsistent with  federal standards for internal control related to information and  communication. Those standards state that management should obtain  relevant data from reliable internal and external sources in a timely  manner based on the identified information requirements and evaluate  both internal and external sources of data for reliability so that it can be  used for effective monitoring.

This lack of HRSA oversight is especially concerning because we found  that the covered entities we interviewed did not always have a correct  understanding of their states’ policies. For example, officials from two of  the four Pennsylvania covered entities we spoke with told us they were  dispensing 340B drugs to Medicaid managed care beneficiaries at  contract pharmacies, despite state officials telling us the state does not  allow that practice. As a result of this confusion, duplicate discounts may  have occurred as the state was not excluding drugs dispensed by  contract pharmacies from its Medicaid rebate requests. Additionally, of  the 13 covered entity policy and procedure manuals we reviewed, only  four had descriptions of their states’ policies and two of those descriptions  were incorrect. If HRSA were to audit the majority of those 13 covered  entities, its auditors would likely be unable to appropriately assess the  entities’ compliance with state requirements. Without fully assessing compliance with state policy, HRSA’s audits do not provide the agency  with reasonable assurance that covered entities are taking the necessary  steps to prevent duplicate discounts. As a result, drug manufacturers are  at risk of being required to erroneously provide duplicate discounts for  Medicaid drugs.

Not all identified duplicate discounts are repaid. HRSA officials told us  that covered entities’ obligations for preventing duplicate discounts are  the same for Medicaid FFS and managed care. However, as we reported  in 2018, HRSA audits do not assess for the potential for duplicate  discounts in Medicaid managed care despite the fact that the potential for  duplicate discounts related to Medicaid managed care has existed since  2010, when manufacturers were required to begin paying Medicaid  rebates under managed care in addition to FFS. As we noted in 2018,  HRSA indicated that it does not audit for duplicate discounts in managed  care because the agency has not issued guidance on how covered  entities should prevent this. As a result, we recommended that HRSA  issue guidance to covered entities on the prevention of duplicate  discounts under Medicaid managed care and incorporate into its audit  process an assessment of covered entities’ compliance with the  prohibition on duplicate discounts as it relates to Medicaid managed care  claims. HHS concurred with these recommendations and, as of October  2019, HRSA reported that it was working to determine next steps related  to these recommendations. However, HRSA has noted that the agency  lacks explicit general regulatory authority to issue regulations on most  aspects of the 340B Program, and also told us, in October 2019, that  guidance does not provide the agency with appropriate enforcement  capability. As a result, HRSA requested authority in the President’s  budget request for fiscal year 2020 to issue regulations on all aspects of  the 340B Program, as the agency believes that binding and enforceable  regulations would provide it with the ability to more clearly define and  enforce policy. In addition, the agency is not pursuing additional guidance  under the 340B Program at this time. We note, however, that the law  prohibits the payment of duplicate discounts and requires HRSA to issue  guidance to covered entities describing methodologies and options for  avoiding duplicate discounts. In the absence of federal guidance, HRSA  instructs covered entities to work with their states on duplicate discount  prevention.

HRSA requires covered entities to work with affected drug manufacturers  regarding the repayment of duplicate discounts in FFS that are identified  through HRSA or manufacturer audits. However, HRSA officials told us  that the agency does not require covered entities to take the same  actions to address duplicate discounts for managed care claims that  HRSA learns about through its audits or other means. For example,  HRSA officials told us that they did not follow up on a letter from a state  that confirmed a duplicate discount occurred on a Medicaid managed  care claim, because the agency did not yet have guidance for covered  entities related to Medicaid managed care claims. Additionally, HRSA  officials told us they would not require a covered entity to develop a  corrective action plan or make offers of repayment to a manufacturer if a  drug manufacturer’s audit of that covered entity identified a duplicate  discount in managed care. Although HRSA officials told us that they  expect covered entities to work in good faith with all parties involved to  resolve potential duplicate discounts in managed care, HRSA does not  require these actions if a duplicate discount is identified in managed care,  as it does in FFS. This is particularly problematic as the majority of  Medicaid enrollees, prescriptions, and spending for drugs are in managed  care, and the drug manufacturers we contacted believe that duplicate  discounts are more prevalent in Medicaid managed care than FFS.

HRSA expecting but not requiring covered entities to address identified  duplicate discounts related to Medicaid managed care is contrary to  federal law, which provides that covered entities are liable to drug  manufacturers for duplicate discounts that are identified through HRSA or  manufacturer audits. It is also inconsistent with federal internal control  standards related to monitoring, which state that management should  oversee the prompt remediation of deficiencies and the audit resolution  process, which begins when the results of an audit or other review are  reported to management, and is completed only after action has been  taken that corrects identified deficiencies. Without HRSA requiring  covered entities to address identified duplicate discounts in Medicaid  managed care as they would duplicate discounts in FFS, drug  manufacturers may erroneously provide both 340B discounts and  Medicaid rebates on the same drug claim.

The prevention of duplicate discounts in the 340B and Medicaid Drug  Rebate Programs requires extensive coordination between state  Medicaid programs and covered entities, and among agencies within  HHS. Similar levels of coordination are required to ensure that states are  not forgoing rebates on drugs not purchased at the 340B price, which  would result in increased costs for both state and federal governments.

Limitations in federal oversight impede CMS’s and HRSA’s ability to  ensure compliance with the prohibition on duplicate discounts. CMS does  not assess whether states have 340B policies and procedures and, if so,  whether they are documented, effective, and accessible to stakeholders.  As a result, it is unable to proactively identify and correct problematic  policies and procedures, and prevent duplicate discounts and forgone  rebates. Additionally, without knowing state Medicaid programs’ 340B  policies, HRSA is unable to perform a comprehensive review of whether  covered entities are taking the necessary actions to prevent duplicate  discounts. In addition, HRSA’s audits are not assessing compliance with  the prohibition against duplicate discounts in managed care because the  agency has yet to put forth guidance on this issue. While HRSA is not  currently pursuing 340B-related guidance, the agency continues to work  on determining next steps to respond to our 2018 recommendations on  the issue. In the meantime, however, HRSA still must ensure that covered  entities are complying with 340B Program requirements, including the  prohibition on duplicate discounts in managed care. Failure to do so not  only puts drug manufacturers at risk of providing duplicate discounts, but  also compromises the integrity of the 340B Program.

We are making a total of three recommendations, including one to CMS  and two to HRSA. Specifically:

The Administrator of CMS should ensure that state Medicaid  programs have written policies and procedures that specify the extent  to which covered entities can use 340B drugs for Medicaid  beneficiaries, are designed to effectively identify if 340B drugs were  used, and if so, how they should be excluded from Medicaid rebate  requests. The policies and procedures should be made publically  available and cover FFS, managed care, and all of the dispensing  methods for outpatient drugs. (Recommendation 1)

The Administrator of HRSA should incorporate assessments of  covered entities’ compliance with state Medicaid programs’ policies  and procedures regarding the use and identification of 340B drugs  into its audit process, working with CMS as needed to obtain states’  policies and procedures. (Recommendation 2)

The Administrator of HRSA should require covered entities to work  with affected drug manufacturers regarding repayment of identified  duplicate discounts in Medicaid managed care. (Recommendation 3)

HHS provided written comments, which are reproduced in app. IV, and  technical comments, which we have incorporated as appropriate. In its  written comments, HHS concurred with one of our three  recommendations and did not concur with the remaining two  recommendations.

HHS concurred with our recommendation that CMS ensure that state  Medicaid programs have written policies and procedures for identifying  340B drugs and excluding them from Medicaid rebate requests and  stated that it will work with states to strengthen policies and procedures  related to 340B drugs for Medicaid beneficiaries.

HHS did not concur with our recommendation that HRSA incorporate  assessments of covered entities’ compliance with state Medicaid  programs’ policies and procedures into its audit process. HHS stated that  HRSA does not have authority to determine whether state Medicaid  policies and procedures are “accurate and appropriate.” We agree that  HRSA is not the appropriate party for reviewing and assessing state  Medicaid programs’ policies and procedures, which is why we  recommended that CMS, not HRSA, strengthen its oversight of states’  340B-related policies and procedures, a recommendation with which HHS  concurred. We recommended that HRSA update its 340B Program audits  to include assessments of whether covered entities are following state  Medicaid programs’ policies and procedures regarding the use and  identification of 340B drugs. HHS stated that HRSA does not have  authority to enforce covered entities’ compliance with state Medicaid  programs’ policies and procedures and that doing so would be “beyond  the scope of the 340B Program” and would require additional training for  HRSA auditors, who currently “do not have this level of expertise.” While  we understand that HRSA does not have authority to enforce compliance  with state Medicaid programs’ policies and procedures, covered entities’  compliance with state Medicaid programs’ policies and procedures is  fundamental to preventing duplicate discounts and assessing compliance  with state policies and procedures is essential to ensuring covered  entities’ compliance with the 340B Program’s prohibition on duplicate  discounts.

Further, HRSA already audits for compliance with certain aspects of  states’ 340B-related Medicaid policies for preventing duplicate discounts.  Specifically, HHS states that covered entities are expected to include a  description of state policy in their policy and procedure manuals. If such  descriptions exist, HRSA auditors are required to review those  descriptions and determine if covered entities are following them. Thus,  HRSA auditors already interpret state Medicaid policies and procedures  when performing audits and the agency already enforces compliance with  state policies by issuing audit findings when covered entities are not  following them. However, as noted in our report, HRSA does not require  its auditors to review state Medicaid programs’ actual policies and  procedures. Instead, the auditors currently rely on covered entities’  descriptions of those policies and procedures, which we found were not  always accurate. Additionally, knowledge of state policies would allow  HRSA to incorporate an assessment of compliance into all audits as  opposed to only those of covered entities that have such descriptions in  their manuals. Finally, without considering states’ actual policies and  procedures and ensuring that covered entities are following them,  HRSA’s audits cannot effectively identify the potential for duplicate  discounts. For example, simply checking covered entities’ actions against  information on the MEF does not provide useful information if the covered  entities are in one of the many states that do not use the MEF and  instead direct entities to identify 340B drugs dispensed to Medicaid  beneficiaries via a different mechanism, such as 340B identifiers.

HHS states that implementing this recommendation would be  burdensome and difficult to operationalize because HRSA would need to  be notified of any changes to states’ policies and procedures. We  understand that the lack of knowledge of state Medicaid programs’  policies related to duplicate discount prevention at the federal level  complicates the ability of HRSA and its auditors to determine what state- level requirements exist and to apply them to audits. This is, in part, why  we recommended that CMS ensure that state Medicaid programs’  policies are publicly available—a recommendation that, as noted above,  HHS concurred with—and that HRSA work with CMS to obtain these  policies as needed. Though we understand that this creates an additional  step in HRSA’s audit process, we continue to believe that including an  assessment of covered entities’ compliance with state Medicaid  programs’ policies and procedures related to 340B drugs is necessary to  identify potential duplicate discounts and to ensure covered entities’  compliance with 340B Program requirements.

HHS also did not concur with our recommendation that HRSA should  require covered entities to work with affected drug manufacturers  regarding repayment of identified duplicate discounts in Medicaid  managed care. In its response, HHS noted that because HRSA does not  have guidance related to preventing duplicate discounts in Medicaid  managed care, “it is difficult to assess compliance in this area.” However,  our recommendation is not asking HRSA to assess compliance related to  duplicate discounts in Medicaid managed care; instead, we are  recommending that, when actual duplicate discounts have been  identified, HRSA require covered entities to remedy those duplicate  discounts. As noted in the report, actual duplicate discounts may be  identified and confirmed by state Medicaid agencies through audits or  other means. Given that HRSA officials told us that covered entities’  obligations for preventing duplicate discounts are the same for Medicaid  FFS and managed care, the steps for addressing identified  noncompliance should be similar, and thus, the agency should require  and not just “encourage” covered entities to work with manufacturers to  remedy any duplicate discounts related to managed care as they do for  those related to FFS.

Additionally, the potential for duplicate discounts related to Medicaid  managed care has existed since 2010, when manufacturers were  required to begin paying Medicaid rebates under managed care in  addition to FFS. Ten years later, HRSA still has not issued guidance on  how covered entities should prevent duplicate discounts in Medicaid  managed care and has indicated that it is not pursuing new guidance at  this time. This inaction continues to leave the 340B Program vulnerable to  noncompliance with federal law. HHS concurred with our 2018  recommendations that HRSA issue guidance to covered entities on the  prevention of duplicate discounts under Medicaid managed care and  incorporate into its audit process an assessment of covered entities'  compliance with the prohibition on duplicate discounts as it relates to  Medicaid managed care claims. Until these recommendations are  implemented, HRSA must, at a minimum, ensure that covered entities  work with manufacturers regarding any identified duplicate discounts in  managed care to help ensure compliance with 340B Program  requirements.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of HRSA, the Administrator of  CMS, and other interested parties. In addition, the report will be available  at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at DraperD@gao.gov. Contact points for our  Office of Congressional Relations and Office of Public Affairs can be  found on the last page of this report. Other major contributors to this  report are listed in appendix V.

Appendix I: Drug Manufacturers’ Efforts to Prevent and Detect Duplicate Discounts

Officials from all three drug manufacturers and the organizations that  work on their behalf that we contacted reported challenges preventing  and detecting duplicate discounts due to a lack of information. For  example, officials from drug manufacturers told us that state Medicaid  programs do not always provide data on the individual claims for which  they were requesting rebates. Specifically, to obtain rebates, states  submit requests to participating manufacturers for all drug purchases  made that quarter; these requests contain the total quarterly amount  owed for each of the manufacturers’ drugs, but not information detailing  each claim for which rebates are being sought. Although the Centers for  Medicare & Medicaid Services (CMS) encourages states to respond to  reasonable manufacturer requests for claim-level data, the provision of  such data is not required. Without this claim-level data, manufacturers  reported that it is difficult to determine if rebate requests include claims for  drugs purchased at the 340B discounted price. Additionally,  manufacturers lack complete information on the extent to which covered  entities use 340B drugs for Medicaid beneficiaries. This is because the  Medicaid Exclusion File (MEF), a list maintained by the Health Resources  and Services Administration (HRSA) to assist in the prevention of  duplicate discounts, is only required to reflect the provider numbers used  by covered entities that choose to use (carve in) 340B drugs provided  directly by the covered entity to Medicaid fee-for-service (FFS)  beneficiaries. The MEF does not include information on whether covered  entities are using 340B drugs for Medicaid managed care beneficiaries  and may not include information on contract pharmacies that are  dispensing these drugs to Medicaid beneficiaries on covered entities’  behalf.

Despite these limitations, the drug manufacturers we contacted reported  that when claim-level data is available they review that data to detect  potential duplicate discounts before they issue rebate payments. For  example, officials from one drug manufacturer told us that they compare  the provider numbers on the claim-level data obtained from states with  the information on the MEF and dispute rebate requests for any claims  from a provider number listed on the MEF. However, officials from some  drug manufacturers told us that this approach is ineffective for preventing  duplicate discounts for drugs dispensed at contract pharmacies because,  as noted above, the MEF may not include information on contract  pharmacies, and the claim-level data may only list the provider number  for the dispensing pharmacy, not the prescribing covered entity.

The drug manufacturers we contacted also reported trying to identify  duplicate discounts after rebates have been paid by looking at 340B  purchasing patterns. For example, officials from one drug manufacturer  told us they look at covered entities’ purchases and assess whether the  proportion of 340B purchases is consistent with their carve-in status.  Specifically, these officials explained that if a covered entity is not listed  on the MEF, then the entity should not be using 340B drugs for Medicaid  FFS patients. Therefore, if all or nearly all of the purchases made by that  covered entity were at the discounted price, it could indicate the presence  of duplicate discounts. While the MEF is only intended to indicate covered  entities that are using 340B drugs for Medicaid FFS beneficiaries, officials  reported that drug manufacturers also rely on the MEF as a proxy for  covered entities’ carve-in practices for Medicaid managed care since  there is no equivalent data source.

If there are concerns that duplicate discounts occurred, officials from the  drug manufacturers we contacted indicated that they may conduct what is  referred to as a “good faith inquiry,” in which the manufacturer, or a  consultant working on the manufacturer’s behalf, requests data from  covered entities on a specific set of drug claims for which they have paid  rebates to determine if those claims involved 340B drugs. If drug  manufacturers confirm that a duplicate discount did occur, officials  reported that they may work to negotiate a repayment from the state or  covered entity, depending on which party was responsible for the error.  Additionally, one official who works on behalf of manufacturers told us  that manufacturers also will work with covered entities to remedy the  cause of the duplicate discount to prevent future occurrences. Drug  manufacturers told us that it is not always clear whether states or covered  entities are responsible for duplicate discounts, and thus, which party  should be contacted regarding repayment. Additionally, drug  manufacturers reported that some states refer them directly to covered  entities to resolve all inquiries. Medicaid program officials in Michigan and  Texas, for example, said that their states refer manufacturers to the  covered entities because they believe that the covered entities would  most likely be responsible for any duplicate discounts that occurred due  to a failure to correctly apply the required claim identifiers.

If drug manufacturers need assistance resolving their concerns or  obtaining repayment for duplicate discounts, they can access options  made available by HRSA and CMS. Specifically, drug manufacturers can  request approval from HRSA to audit a covered entity to investigate  suspicions of duplicate discounts in both Medicaid FFS and managed  care. To receive approval from HRSA to conduct an audit, a drug  manufacturer must document reasonable cause and provide an audit  plan. In addition, HRSA requires the drug manufacturer to use an  independent auditor who follows government auditing standards.  According to HRSA, from October 2011 through August 2019, 45 audits  were requested by drug manufacturers and 26 requests were approved.  Of the 26 audits approved by HRSA, the agency received 13 final audit  reports, six of which had duplicate discount-related findings. However,  while audits can be a tool for identifying duplicate discounts and obtaining  repayment, some drug manufacturers we spoke with indicated that the  cost of audits may outweigh the benefits received in the form of  repayments. Additionally, as noted previously, HRSA does not require  covered entities to repay manufacturers for duplicate discounts that occur  in managed care. Drug manufacturers also may use the state hearing  process or pursue a dispute resolution in conjunction with states through  CMS if their issues with state Medicaid programs cannot be resolved  through inquires. According to CMS officials, through the dispute  resolution process, the agency provides drug manufacturers and states  with guidance to assist in determining responsibilities and identifying next  steps to work through conflicts. CMS officials said that, in general, they  have received five to 10 Medicaid drug rebate disputes per year, about  half of which are related to 340B duplicate discount issues.

Appendix II: State Medicaid Programs’ Policies on Covered Entities’ Use of 340B Drugs, by Dispensing Method

Appendix II: State Medicaid Programs’ Policies  on Covered Entities’ Use of 340B Drugs, by  Dispensing Method California allows covered entities to dispense 340B drugs at contract pharmacies if there is an  approved arrangement between the state, the covered entity, and the contract pharmacy. At the time  of our information request, California officials indicated that they only had approved arrangements for  certain hemophilia centers and had no approved arrangements with other types of covered entities.

New Hampshire allows covered entities to provide 340B drugs to Medicaid beneficiaries, but  generally does not allow them to bill Medicaid for these drugs. The one exception is that the state  does allow covered entities that are approved family planning clinics to bill Medicaid for 340B drugs  administered by providers to Medicaid beneficiaries.

The term 340B drugs refers to drugs purchased by covered entities at a discounted price through the  340B Program. Carve out means that the state did not allow covered entities to provide 340B drugs to  Medicaid beneficiaries. Carve in means that the state required covered entities to provide 340B drugs  to eligible Medicaid beneficiaries.

Managed care plans in this state do not cover outpatient drugs dispensed at pharmacies; they only  cover provider-administered drugs.

Appendix III: State Medicaid Programs’ Procedures for Identifying 340B Drugs, by Dispensing Method

Appendix III: State Medicaid Programs’  Procedures for Identifying 340B Drugs, by  Dispensing Method State does not allow covered entities to use 340B drugs for Medicaid fee-for-service beneficiaries for  this dispensing method, and thus does not need a procedure to identify these drugs.

Massachusetts requires contract pharmacies to include the covered entities’ National Provider  Identifier on claims using 340B drugs, which the state then uses to exclude those claims from its  rebate request.

New Hampshire allows covered entities to provide 340B drugs through this dispensing method, but  does not allow them to bill Medicaid for these drugs.

Rhode Island uses a 340B claim identifier to identify and exclude associated drugs administered by  providers at hospitals, but does not have any procedures to identify these drugs administered by  providers at other types of covered entities.

State does not allow covered entities to use 340B drugs for Medicaid managed care beneficiaries for  this dispensing method and thus does not need a procedure to identify these drugs.

Appendix IV: Comments from the Department of Health and Human Services

Appendix V: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Michelle Rosenberg (Assistant  Director), David Lichtenfeld (Analyst-in-Charge), Amanda Cherrin, and  Sarah Tempel made key contributions to this report. Also contributing  were Jennie Apter, Ethiene Salgado-Rodriguez, and Jennifer Whitworth.

If drug manufacturers want certain drugs covered by Medicaid, they must participate in both “340B” and Medicaid Drug Rebate programs. The 340B program allows certain hospitals and clinics to buy discounted drugs. The rebate program allows state Medicaid programs to request manufacturer rebates on certain drugs dispensed to their beneficiaries.

Drugs that hospitals and clinics buy through 340B can’t also qualify for Medicaid rebates—as that would create a duplicate discount.

We recommended that the Department of Health and Human Services improve oversight of these programs to prevent duplicate discounts.