340B Drug Discount Program: Increased Oversight Needed to Ensure Nongovernmental Hospitals Meet Eligibility Requirements

The number of nongovernmental hospitals participating in the 340B Program has grown over time. HRSA requires participating hospitals to register and annually recertify their eligibility. HRSA also reviews hospitals' eligibility through audits of a small sample each year.

GAO was asked to provide information on 340B-participating hospitals' contracts with state and local governments. This report (1) describes any obligations in selected nongovernmental hospitals' contracts to serve low-income individuals, and (2) examines HRSA's processes to assess nongovernmental hospitals' eligibility. GAO examined contract documentation from all 258 nongovernmental hospitals HRSA reviewed in 2017 and 2018; and HRSA's policies, procedures, and guidance related to 340B hospital eligibility. GAO also interviewed HRSA officials.

Under the 340B Drug Pricing Program (340B Program), administered by the U.S. Department of Health and Human Services' (HHS) Health Resources and Services Administration (HRSA), drug manufacturers provide discounted prices on outpatient drugs to certain hospitals and other entities. About two-thirds of hospitals participating in the 340B Program (approximately 1,700) are nongovernmental hospitals (private, nonprofit hospitals), which qualify for the program, in part, based on having contracts with state or local governments to provide health care services to the 340B-specified low-income population—low-income individuals not eligible for Medicaid or Medicare. GAO's review of contract documentation for 258 nongovernmental hospitals found that most contracts obligated these hospitals to provide health care services to low-income individuals. However, few of the contracts reviewed included details about those obligations, such as the amount or type of care hospitals were required to provide. The statute does not require the contracts to contain such details.

GAO found that HRSA's processes do not provide reasonable assurance that participating nongovernmental hospitals meet eligibility requirements. For example, HRSA primarily relies on hospitals' self-attestations to verify the existence of contracts with state and local governments. The agency reviewed contract documentation for less than 10 percent of nongovernmental hospitals per year in 2017 and 2018. GAO also identified several weaknesses in HRSA's review of the nongovernmental hospital contracts:

HRSA does not conduct reviews to determine whether the documents submitted by nongovernmental hospitals are actual contracts, namely that they are mutually binding agreements to provide services or supplies in exchange for something of value. GAO found that 18 of the 258 hospitals reviewed submitted documents that did not appear to be contracts, such as descriptions of community programs, yet all of these hospitals were permitted to participate in the program.

When audits have identified hospitals that did not have contracts in place throughout the audits' periods of review, HRSA has allowed hospitals to avoid audit findings by, for example, entering into new contracts with retroactive start dates. This practice undermines the integrity of HRSA's audits.

HRSA's contract reviews do not always include assessments of whether contracts are consistent with the statutory requirement to provide health care services to the 340B-specified low-income population and HRSA's guidance for conducting such assessments, when required, lacks detailed instructions. As a result, GAO found that contracts for 13 hospitals reviewed did not appear to require hospitals to serve the 340B-specified low-income population. Despite this, these 13 hospitals were permitted to participate in the program.

Given these weaknesses, some nongovernmental hospitals that do not appear to meet the statutory requirements for program eligibility are participating in the 340B Program and receiving discounted prices for drugs for which they may not be eligible.

GAO is making six recommendations, including that HRSA implement a process to verify that all nongovernmental hospitals have contracts in place, including throughout hospitals' audit periods; amend its contract reviews to include an assessment of whether contracts meet statutory requirements; and provide better guidance on contract reviews. HHS concurred with all of the recommendations except the one to implement a process to verify that all nongovernmental hospitals have contracts. GAO continues to believe this action is needed to ensure that only eligible hospitals are allowed to participate in the 340B Program.

The 340B Drug Pricing Program (340B Program), named for its  authorizing provision in the Public Health Service Act (PHSA), requires  drug manufacturers to sell outpatient drugs at discounted prices to  covered entities—certain hospitals and recipients of certain federal  grants—in exchange for having their drugs covered by Medicaid. To be  eligible for the 340B Program, hospitals must meet certain requirements  intended to ensure that they perform a government function to provide  care to low-income, medically underserved individuals. Hospitals must be  (1) owned or operated by a unit of state or local government; (2) nonprofit  corporations that have been formally granted state or local governmental  powers; or (3) private, nonprofit hospitals that have contracts with state or  local governments to provide health care services to low-income  individuals who are not eligible for Medicaid or Medicare. (In this report,  we refer to low-income individuals not eligible for Medicaid or Medicare as  the “340B-specified low-income population”; we refer to private, nonprofit  hospitals that have contracts to serve the 340B-specified low-income  population as “nongovernmental hospitals.”)

To participate in the 340B Program, hospitals must register with, and be  approved by, the Health Resources and Services Administration (HRSA),  the agency within the Department of Health and Human Services (HHS)  responsible for administering and overseeing the 340B Program.  Hospitals also must recertify their eligibility annually to continue  participating in the program.

Hospital participation in the 340B Program has grown, more than tripling  since 2009. As of January 1, 2019, nongovernmental hospitals accounted  for more than two-thirds of the approximately 2,500 hospitals participating  in the 340B Program. In total, there were nearly 1,700 participating  nongovernmental hospitals. Drug purchases through the 340B Program  have also increased. In calendar year 2018, 340B drug purchases totaled  more than $24 billion; about $21 billion of those purchases (87 percent)  were made by hospitals. This compares to total 340B drug purchases of  about $4 billion in 2009.

In a September 2011 report, we found that HRSA lacked guidance  specifying the criteria under which hospitals that are not government  owned or operated can qualify for the program. We also found that HRSA  primarily relied on participant self-policing to ensure program compliance,  and we recommended ways for HRSA to improve oversight, including by  conducting audits and by issuing guidance on hospital eligibility. In a  May 2018 congressional hearing, we testified that HRSA had not  implemented our recommendation to issue guidance related to hospital  eligibility, although the agency began conducting annual audits of  participating providers in fiscal year 2012. Additionally, in 2017, HRSA  began to conduct quarterly “contract integrity checks,” in which the  agency collects and reviews contracts for a random sample of  nongovernmental hospitals registering for the program.

Given the rapid growth of the program, you asked us to review the  contracts that serve as the basis for nongovernmental hospitals’ eligibility  for the 340B Program. In this report, we  1.  describe any obligations to serve low-income individuals in the state  and local government contracts that selected nongovernmental  hospitals used to qualify for the 340B Program, and  2.  examine HRSA’s processes to assess nongovernmental hospitals’  eligibility to participate in the 340B Program.

To describe any obligations to serve low-income individuals in the state  and local government contracts that selected nongovernmental hospitals  used to qualify for the 340B Program, we requested and reviewed  contract documentation with state or local governments that HRSA  obtained from all 258 nongovernmental hospitals HRSA selected for its  contract integrity checks in 2017 and 2018, and audits in fiscal years  2017 and 2018. We looked at the documents from these 258 hospitals to  determine whether they appeared to be contracts—mutually binding  agreements to provide services or supplies in exchange for something of  value—and determined that the documents for 240 of the 258 appeared  to be contracts. We then reviewed the contracts for those 240 hospitals  to identify any obligations they contained to provide health care services  to either the 340B-specified low-income population or to low-income  individuals more generally, including the amount and type of health care  services to be provided. We also reviewed each contract for any  provisions to ensure that services were provided, namely requirements  for the hospital to report on the services provided, provisions for the  government to monitor the hospital’s provision of services, and  enforcement mechanisms for the government to apply consequences if  the hospital did not meet the terms of the contract. For further descriptive information about the contracts we reviewed, such as the level of  government (e.g., city, county, state) with which the hospital contracted,  see appendix I.

To examine HRSA’s processes to assess nongovernmental hospitals’  eligibility to participate in the 340B Program, we reviewed HRSA’s  policies, procedures, and guidance regarding both the eligibility  determination process and the information the agency uses for  registration, recertification, contract integrity checks, and audits. We  focused on the two eligibility requirements that distinguish  nongovernmental hospitals from other hospitals in the 340B Program: (1)  nonprofit status and (2) having contracts with state or local governments  to serve the 340B-specified low-income population. We also reviewed the  documentation HRSA collected for the 258 nongovernmental hospitals  previously mentioned for key items related to hospitals’ eligibility for the  340B Program and reviewed the audit results for these hospitals, which  were posted on HRSA’s website. We interviewed officials from HRSA  and the Centers for Medicare & Medicaid Services (CMS), which provides  data HRSA uses in determining eligibility, about HRSA’s eligibility  determination processes. Finally, we evaluated HRSA’s eligibility  processes against federal internal control standards related to control  activities, information and communication, monitoring, and enforcing  accountability.

We conducted this performance audit from October 2018 to December  2019 in accordance with generally acceptable government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The 340B Program was created in 1992 following the creation of the  Medicaid Drug Rebate Program and gives 340B covered entities—certain  eligible hospitals, clinics, and other entities—discounts on covered  outpatient drugs comparable to those made available to state Medicaid  agencies. According to HRSA, which administers and oversees the  340B Program, the program’s purpose is to enable participating hospitals  and other providers to stretch scarce federal resources to reach more  eligible patients and provide more comprehensive services. In addition  to realizing substantial savings through 340B Program price discounts— which HRSA estimates as 25 to 50 percent of the cost of drugs—covered  entities can generate revenue through their participation in the 340B  Program. For example, they can purchase covered outpatient drugs at  the 340B Program price for all eligible patients regardless of the patients’  income or insurance status and generate revenue by receiving  reimbursement from patients’ insurance that may exceed the 340B prices  paid for the drugs.

Entities are generally eligible for the 340B Program—that is, are covered  entities—if they receive one of 10 federal grants or are one of six types of  hospital. Hospitals must also meet additional requirements, such as  being owned or operated by a state or local government, being formally  granted governmental powers, or being nongovernmental. The 340B  statute requires nongovernmental hospitals to be nonprofit and to have  contracts with state or local governments to provide health care services  to the 340B-specified low-income population. However, the requirement  does not specify criteria for these contracts, such as the amount or type  of services to be provided to these low-income individuals. Generally,  hospitals must also meet other requirements to participate, such as  treating a disproportionate number of low-income Medicare and Medicaid  patients.

Hospital participation in the 340B Program has more than tripled over the  last decade, due, in part, to the enactment of the Patient Protection and  Affordable Care Act in 2010, which expanded the types of hospitals that  could qualify for the program. According to data from HRSA, in 2009,  prior to the law’s enactment, there were more than 800 340B-participating  hospitals, compared to more than 2,500 in 2019. The majority of  participating hospitals are nongovernmental hospitals. Specifically, 1,690,  or 67 percent, of the hospitals participating as of January 1, 2019 were  nongovernmental hospitals. (See figure 1.)

HRSA is responsible for verifying hospitals’ and other covered entities’  eligibility to participate in the 340B Program. HRSA reviews  nongovernmental hospitals’ eligibility for the 340B Program at registration,  recertification, and through audits.

Registration. Prior to participation in the 340B Program, hospitals must  register with HRSA, at which point they must self-attest to meeting the  program’s eligibility requirements. Additionally, HRSA’s hospital  registration instructions specify that, at the time of registration, a  nongovernmental hospital must have documentation that shows it is  nonprofit (such as copies of Internal Revenue Service documentation)  and a copy of its contract with a state or local government to serve the  340B-specified low-income population. This documentation must be  provided to HRSA upon request. During each quarterly registration  period, HRSA conducts contract integrity checks for a random sample of  20 percent of newly registering nongovernmental hospitals. For the  selected hospitals, HRSA requests a copy of the hospital’s contract with  the state or local government, which it reviews to verify that the contract is  signed by officials from both organizations, is in effect, and does not  expire before program participation would begin. HRSA policy states that  a hospital that cannot provide a state or local government contract when  selected for a contract integrity check at registration will not be registered  for the 340B Program.

Recertification. To remain in the 340B Program, hospitals must annually  recertify their eligibility. During recertification, hospitals are to ensure that  their information (e.g. name, address, point of contact) is correct in  HRSA’s internal 340B Program database and self-attest that the hospital  still meets program requirements. HRSA collects documentation from the  hospital if it reports changes to its name, classification (i.e., whether it is  government owned or operated, delegated governmental powers, or  nongovernmental), or nonprofit status.

Audits. HRSA audits 200 covered entities—a combination of hospitals  and federal grantees—per year. HRSA’s audits include covered entities  (including hospitals) that are selected based on risk-based criteria  (approximately 90 percent of the audits conducted each year), and  entities that are targeted based on, for example, stakeholder allegations  of noncompliance (10 percent of audits conducted). The criteria for risk- based audits include a covered entity’s changes in the volume of 340B  Program drug purchases, time in the program, complexity of its program,  and history of violations or allegations of noncompliance.

Among other things, HRSA’s audits include assessments of each  hospital’s 340B eligibility status. For a nongovernmental hospital, HRSA’s  guidance indicates that auditors are expected to review the hospital’s  contract with the state or local government to ensure that it is for serving  the 340B-specified low-income population and is signed by both a  hospital and state or local government official. Auditors are also  expected to review the contract’s start and end dates to ensure that it is  effective during a specific period of review. HRSA defines the audit’s  period of review as the time frame beginning the first day of the audit’s  sample period—a six-month period that predates and is not contiguous  with the beginning of the onsite audit—and ending on the last day of the  onsite audit. For example, a hospital with an onsite audit in March of 2017  may have a sample period from July 1, 2016 through December 31, 2016,  which means that auditors should verify that the hospital’s contract was in  effect from at least July 1, 2016 through the end of the March 2017 onsite  audit.

If HRSA identifies deficiencies in hospitals’ contracts, the agency may  issue (1) findings of noncompliance, which are made public on HRSA’s  website, or (2) areas for improvement, which are not made public. When  an audit results in a finding of noncompliance, the hospital is required to  submit a corrective action plan within 60 days of the audit report being  finalized for HRSA’s approval. HRSA closes the audit once the hospital  attests that the corrective action plan has been fully implemented, and  any necessary repayments have been made to affected manufacturers.  For example, if a nongovernmental hospital were unable to demonstrate  that it had a contract with a state or local government when audited,  HRSA policy states that the hospital would be issued a finding of  noncompliance and may be subject to termination from the 340B Program  for not meeting eligibility criteria. In addition, the hospital may be  responsible for repayment to manufacturers for discounts it received  during the period it lacked a contract.

Contracts Reviewed Included Few Details on Nongovernmental Hospitals’ Obligations to Serve Low-Income Individuals

Most of the contracts we reviewed between nongovernmental hospitals  and state or local governments obligated the hospitals to provide health  care services to low-income individuals, but they included few details  about those obligations. The 340B statute requires participating  nongovernmental hospitals to have state or local government contracts to  provide health care services to the 340B-specified low-income population,  but does not otherwise specify details for the content of these contracts.  Of the 240 contracts we reviewed, 224 (93 percent) required the hospital  to provide services to low-income individuals. Of these 224 contracts,

169 (75 percent) specifically mentioned providing services to the  340B-specified low-income population (low-income individuals not  eligible for Medicaid or Medicare).

55 (25 percent) specified a more general obligation to provide  services to individuals who are likely low-income, uninsured, or  underinsured, such as enrollees in a county program for the medically  indigent, inmates at a local detention center, or individuals receiving  treatment through a county mental health program.

Less than one-third of the contracts we reviewed defined “low-income” or  included detailed requirements for the amount or type of services to be  provided. Of the 224 contracts that contained an obligation to provide  services to low-income individuals,

14 (6 percent) specified what was considered low income. Of these  contracts, the specific income threshold varied, generally ranging from  100 percent to 400 percent of the federal poverty level.

71 (32 percent) specified the amount of services the hospitals were to  provide to low-income individuals. The contracts generally defined the  amount of services as a range in the cost of care the hospital was  expected to provide; the amount varied by contract. For example, one  contract specified that the hospital would provide $60,000 to $100,000  of services per year, while another included a range of $62 million to  $85 million per year. Contracts that did not specify dollar amounts  included, for example, provisions regarding the number of staff  available to provide services or requirements to provide services at  certain times. One such contract required a hospital to provide at least  one full-time-equivalent behavioral health provider for specified sites,  while another required a hospital to administer influenza vaccines at  two clinics on two Fridays each year during influenza season.

53 (24 percent) identified specific types of services that hospitals were  to provide, often specifying multiple categories of services. For  example, one contract required a hospital, among other things, to  provide inpatient and outpatient services, obstetrics, and  cardiovascular surgery. Other contracts only identified a single  category of service that the hospital was required to provide. For  example, nine of the 53 contracts specified that the hospitals were  required to provide emergency services, although hospitals that  operate emergency departments are already required, as a condition  of participating in Medicare, to screen, and if necessary stabilize  patients who seek emergency care, regardless of their ability to pay.  Additionally, four of the contracts reviewed required the provision of  behavioral health services, two specified the provision of vaccinations,  and one was for the evaluation and treatment of tuberculosis.

46 of the 224 contracts (21 percent) specified that state or local  governments would pay hospitals for the services provided. In some  cases, the contracts specified that the hospitals would be paid to  provide care for low-income individuals at rates established under  other programs–such as the state’s Medicaid program. Others  established rates specifically for services provided to the population  covered under the contract.

Finally, approximately one-third of the contracts reviewed included  provisions that would allow the state and local governments contracting  with hospitals to ensure that the contractually required services are being  provided. Specifically, 68 of the 224 contracts (30 percent) included  provisions for reporting, monitoring or enforcement, as shown below in  Figure 2; some contracts included more than one type of provision. Of the  68 contracts,

56 required hospitals to report information to the state or local  government. Of these 56, 40 required reporting on the services  provided under the contract, including types, dollar amounts, or  number of services provided to certain populations, such as  “medically indigent,” “uninsured persons,” and “underinsured  persons.” For example, one contract required the hospital to provide  the government with an annual report containing information about the  value of free care provided to indigent persons, the total value of  discounted care provided to uninsured patients, and the number of  declined requests for free or discounted care. The remaining 16  contracts included more general reporting requirements, such as to  provide copies of any reports requested by state or federal licensing,  regulatory, or accrediting entities, to the state or local government.

29 contracts included provisions for governments to monitor the  hospitals’ provision of care. Specifically, 10 contracts required regular  reviews, with some of those at specific time intervals (e.g. annually,  quarterly), while 19 contracts required that hospitals be available for  periodic audits or to provide the government access, upon request, to  medical records and documents which could be used to review or  evaluate the services being provided under the contract.

34 contracts included enforcement mechanisms for the government to  apply consequences if the hospital did not meet the terms of the  agreement. For example, one contract allowed the state government  to terminate the contract 90 days after providing notice of the state’s  determination that the hospital was not providing sufficient services to  low-income individuals. Contracts for eight hospitals provided for  monetary fines or withholding of funds if hospitals were found to be in  breach of the contract.

HRSA’s Processes Do Not Provide Reasonable Assurance That Participating Nongovernmental Hospitals Meet 340B Program Eligibility Criteria

HRSA uses self-reported data to determine whether hospitals are  nonprofit without assessing whether the data are reliable for that purpose.  Additionally, HRSA relies primarily on nongovernmental hospitals’ self- attestations to verify the existence of state or local government contracts,  and weaknesses in the reviews of contracts it does conduct hamper the  identification of potential eligibility issues.

HRSA Uses Self-Reported Data That May Not Be Reliable to Assess Hospitals’ Nonprofit Status

HRSA uses Medicare cost report data from CMS to determine whether  hospitals are nonprofit, but these data may not be sufficiently reliable for  this purpose. Specifically, HRSA relies on self-reported information from  cost reports on whether hospitals operate as nonprofit, proprietary, or  governmental organizations. HRSA reviews this information at registration  to check that hospitals have indicated that they are nonprofit  organizations. Additionally, in April 2019, HRSA began conducting  quarterly checks of cost report data to identify hospitals that list  themselves as proprietary for further review, as this designation could be  used by for-profit, rather than nonprofit, hospitals, contrary to 340B  Program eligibility requirements.

HRSA officials told us that the agency has not independently evaluated  the reliability of the cost report data for determining nonprofit status.  Additionally, a CMS official responsible for oversight of Medicare cost  reports told us that CMS does not have any formal processes to assess  the reliability of the data on whether a hospital is nonprofit, proprietary, or  governmental, because these data do not affect Medicare  reimbursement. The official added that the question on the cost report  used to collect these data was not intended to assess nonprofit status, is  not clearly defined, and may not be reported accurately. For example, the  cost report instructions do not include definitions of nonprofit and  proprietary for providers to refer to when they are completing their cost  reports.

HRSA requires hospitals to maintain additional documentation, such as  Internal Revenue Service forms for tax-exempt organizations or  documents from the state, to demonstrate their nonprofit status, but does  not collect or review this documentation if hospitals indicate that they are  nonprofit on their cost reports. In August 2019, HRSA submitted a  proposal to the Office of Management and Budget to require hospitals  registering for the 340B Program to submit documentation supporting the  hospital classification that they select during registration, which would  include requiring nongovernmental hospitals to submit documentation of  their nonprofit status. However, this requirement, if it goes into effect,  would apply only to newly registering hospitals and would not affect the  nearly 1,700 nongovernmental hospitals currently participating in the  340B Program. For those hospitals, HRSA would continue to rely on the  Medicare cost report data.

Relying on the self-reported data from Medicare cost reports is  inconsistent with federal internal control standards related to information  and communication, which state that management should use quality  information to achieve the entity’s objectives, such as by obtaining  relevant data, based on identified information requirements, that are  reasonably free from error and bias, and that management should  evaluate the data for reliability. Without ensuring that the information it  uses on hospitals’ nonprofit status is reliable, HRSA cannot effectively  determine if nongovernmental hospitals participating, or seeking to  participate, in the 340B Program meet the statutory eligibility  requirements, creating a risk that for-profit hospitals could receive  discounted pricing for which they are not eligible.

HRSA Primarily Relies on Hospitals’ Self-Attestations to Verify the Existence of Contracts with State or Local Governments

HRSA primarily relies on self-attestations from nongovernmental hospitals  to verify that they have contracts in place with state or local governments  as required to participate in the 340B Program. Specifically, HRSA relies  on the attestations that hospitals are required to make during registration  and recertification that they meet the program’s eligibility requirements.  Although HRSA requires nongovernmental hospitals to have copies of  their contracts, and to provide them upon request, it does not require  most hospitals to submit those contracts at either registration or  recertification. Additionally, while HRSA previously required each  nongovernmental hospital to submit a certification of contract form during  registration that was signed by a government official and attested to the  existence of a contract to serve the 340B-specified low-income  population, officials said the agency stopped requiring submission of this  form in July 2014. At that time, officials said HRSA initiated a process of  contacting government officials directly through an online certification  process to confirm that newly registering hospitals had contracts in place.  However, that process was eliminated in September 2017, and HRSA no  longer has a process that requires state and local government officials to  confirm the existence of contracts with nongovernmental hospitals.

HRSA does collect and review contracts with state or local governments  for a sample of nongovernmental hospitals through its audit and contract  integrity check processes, but these reviews are currently limited in  number and scope. Specifically, in fiscal years 2017 and 2018, HRSA  audited about 7 percent of nongovernmental hospitals per year (108 and  109 hospitals in fiscal years 2017 and 2018, respectively). Additionally, at  the time of our review, HRSA conducted contract integrity checks for 20  percent of newly registering hospitals; this equated to 41 hospitals in  calendar years 2017 and 2018 combined. HRSA’s August 2019 proposed  information collection request, if approved, would require all newly  registering nongovernmental hospitals to submit their state or local  government contracts at registration. However, as previously  mentioned, this new requirement would only affect newly registering  hospitals and not those already participating. Consequently, for the large  majority of nongovernmental hospitals already registered for the 340B  Program, self-attestations made electronically at registration and  recertification would remain HRSA’s sole method of verifying that  hospitals have state or local government contracts as required by the  340B statute.

Additionally, HRSA officials told us that when the agency does collect  documents from nongovernmental hospitals through its audits or contract  integrity checks, they do not review them to determine if they are  contracts (i.e., mutually binding agreements to provide services or  supplies in exchange for something of value). Based on our review of  documentation submitted to HRSA from 258 hospitals, 18 hospitals  submitted documents that did not appear to meet this common definition  of a contract; examples included certification of contract forms without  accompanying contracts, articles of incorporation, and descriptions of  community programs. Nevertheless, these hospitals were permitted to  participate in the 340B Program.

HRSA’s reliance on hospitals to attest that the required contracts are in  place is contrary to federal internal control standards related to  information and communication, which state that management should use  quality information to achieve the entity’s objectives, such as by obtaining  relevant data from external sources in a timely manner based on the  identified information requirements. Without a process to verify that all  nongovernmental hospitals have contracts in place, HRSA does not have  reasonable assurance that nongovernmental hospitals participating in, or  seeking to participate in, the 340B Program have contracts with state and  local governments. Consequently, this increases the risk that  nongovernmental hospitals that do not have the statutorily required  contracts and are thus ineligible may register for, and participate in, the  program.

Weaknesses in HRSA’s Contract Reviews Hamper the Identification of Potential Eligibility Issues

In addition to not determining whether the documentation provided by  nongovernmental hospitals during contract integrity checks and audits are  contracts, weaknesses in HRSA’s reviews hamper its ability to identify  and address issues that affect the hospitals’ eligibility for the 340B  Program. Specifically, we identified three weaknesses: (1) contract  integrity checks do not assess whether contracts require hospitals to  serve the 340B-specified low-income population; (2) guidance for  auditors’ review of contracts has not been consistently documented and  lacks detail; and (3) HRSA allows hospitals to avoid audit findings by  entering into new contracts with state and local governments while audits  are being conducted.

HRSA’s contract integrity checks for newly registering hospitals do  not assess whether the contracts require the provision of services  to the 340B-specified low-income population. HRSA’s contract  integrity checks for newly registering nongovernmental hospitals are  limited to verifying that contracts clearly list the names of the hospital and  unit of government and have appropriate signatures and dates;  procedures for conducting these checks do not instruct staff to review  whether the contracts require hospitals to provide health care services to  the 340B-specified low-income population, as required to participate in  the 340B Program. Of the 38 contracts submitted to HRSA for contract  integrity checks in 2017 and 2018, two (5 percent) did not appear to  require the hospitals to serve the 340B-specified low-income population,  yet HRSA allowed the hospitals to begin participating in the 340B  Program. Specifically, one hospital submitted a contract with a state  government that was limited to providing services to beneficiaries of the  state’s Medicaid program, although nongovernmental hospitals are to  have contracts to provide services to individuals who are not entitled to  Medicaid benefits. The other hospital submitted an agreement with a  nonprofit company for management services, including accounting and  payroll services, for their hospital and nursing home facilities. To  participate in the 340B Program, nongovernmental hospitals must have a  contract with a state or local government to provide health care services  to the 340B-specified low-income population. Thus, allowing hospitals to  participate when the state or local government contracts they submitted  for review do not require them to serve this population is inconsistent with  HRSA’s responsibilities for oversight of the 340B Program, including  ensuring that participating hospitals meet the statutory eligibility  requirements. Without amending its contract integrity checks to include  verifying that newly registering hospitals have contracts that meet statutory eligibility requirements, HRSA risks allowing hospitals that are  not eligible, and which may not be providing services to the 340B- specified low-income population, to participate in the 340B Program.

Guidance for contract reviews during audits has not been  consistently documented over time and lacks detailed instructions.  Although HRSA officials told us they have always expected auditors to  look for a contract through which a nongovernmental hospital would be  eligible for the 340B Program, we found that HRSA’s guidance for  auditors has not clearly documented these expectations and lacks  detailed instructions. HRSA did not document key elements to look for— signatures, dates, and a requirement to serve the 340B-specified low- income population—in its guidance for auditors until August 2018.  Further, the agency has made frequent changes to its guidance and  procedures. For example, between November 2017 and July 2019, HRSA  modified its guidance for auditors at least six times. In addition, HRSA’s  guidance states that auditors are expected to perform a “simple logic test”  to determine whether contracts require the hospital to serve the 340B- specified low-income population, but HRSA has not provided any  additional information about how auditors are expected to conduct such a  test. The guidance also advises auditors not to “dive too deep” when  reviewing contracts. Of the 202 contracts submitted by hospitals as part  of HRSA’s audits that we reviewed, 11 contracts (5 percent) did not  appear to require hospitals to provide care to the 340B-specified low- income population, yet HRSA allowed the hospitals to continue their  participation in the program. One such contract was a consent order that  stated that the state’s attorney general would defer enforcement action  based on the hospital’s agreement to abide by certain medical debt  collection practices, such as adopting a zero tolerance policy for abusive,  harassing, oppressive, false, deceptive, or misleading language or  collections conduct.

Furthermore, HRSA’s procedures for audits do not require auditors to  separately affirm and record their review of the dates, signatures, and  services required in the contracts. Thus, HRSA has no way of knowing  whether auditors have checked and verified each of these elements. In  addition to the 11 contracts that did not appear to obligate the hospitals to  provide health care services to the 340B-specified low-income population,  our review of 202 contracts submitted to HRSA by audited hospitals found

16 contracts (8 percent) were missing one or both signatures;

15 contracts (7 percent) were missing effective dates or were expired; at least 8 contracts had dates that did not cover the audit’s period of  review, which includes a 6-month sample period before the start of the  audit.

For at least some of these contracts, HRSA was unaware of the issues  we identified; HRSA did not issue audit findings in response to any of  these contracts.

HRSA has taken steps to address expired contracts. Specifically, in May  2019, HRSA revised its procedures for hospital registration and contract  integrity checks to include language specifying that a hospital should not  be approved for registration unless a contract is currently in place and  that the contract must not expire before the participation start date. In  addition, HRSA officials told us that in January 2020 the agency plans to  implement a quarterly check of its 340B database to identify hospitals  with expired state or local government contracts. However, these efforts  do not address other date-related issues such as missing effective dates,  or the issues with signatures or contract service requirements.

Federal internal control standards related to control activities and  enforcing accountability state that agencies should (1) implement control  activities through policies, such as by documenting policies in the  appropriate level of detail to allow management to effectively monitor the  control activity; and (2) evaluate performance and hold individuals  accountable for their internal control responsibilities, such as by  communicating with the service organizations contracted to perform roles  about the agency’s objectives and related risks, assigned responsibilities  and authorities, and the expectations of competence to enable the service  organization to perform its responsibilities. Without more specific  guidance for auditors’ review of contracts, and procedures requiring  auditors to separately document their review of each contract element,  HRSA lacks reasonable assurance that the audits are appropriately  identifying deficiencies in nongovernmental hospitals’ contracts with state  or local governments. As a result, some hospitals appear to be  participating in the 340B Program based on contracts that are  inconsistent with program requirements or HRSA’s guidance.

HRSA allows audited hospitals to avoid audit findings by entering  into new contracts with state and local governments while audits are  being conducted. As previously noted, our review of contracts submitted  to HRSA by audited hospitals found that eight hospitals provided  contracts that did not appear to cover the audit’s period of review. Three  of the eight hospitals entered into the contracts while the audit was  ongoing. According to HRSA policy, a hospital that does not  demonstrate that it had a contract for the entire audit period should be  issued a finding of noncompliance and held responsible for repayment to  manufacturers for any discounts received improperly during the period for  which it did not have a contract. However, HRSA did not issue such  findings or penalties for any of the hospitals we identified with contracts  that did not cover the audit’s period of review. For example,  in one case, officials said HRSA had included a finding in its draft  audit report, but withdrew it when presented with a new contract with  an effective date made retroactive to cover the audit’s entire period of  review.  in another case, a hospital that had been government-owned was sold  to a private company in 2013, but did not switch its classification to  nongovernmental until 2015, and did not sign a contract with a state  or local government until it was audited in fiscal year 2018. The  hospital’s contract, signed in 2018, included a retrospective attestation  that the hospital had been providing care for the 340B-specified  population since 2013.

HRSA officials told us that they accept such retroactive documentation in  conjunction with current, valid contracts on a case-by-case basis. As  such, a hospital may avoid findings, and potential repayments to  manufacturers, by asserting that it had been providing care even when a  contract was not in place.

To participate in the 340B Program, a nongovernmental hospital is  required by statute and HRSA policy to have a contract with state or local  government to serve the 340B-specified low-income population. Allowing  hospitals to submit retroactive contracts after they have already begun  participation in the program is inconsistent with HRSA’s responsibilities  for oversight of the 340B Program, including ensuring that participating  hospitals meet the statutory eligibility requirements. Further, allowing  hospitals that are unable to demonstrate that they have contracts in place  that cover the audit’s period of review to continue to participate in the  340B Program without consequence undermines the effectiveness of  HRSA’s audit process and increases the risk that ineligible hospitals will  receive discounts under the program.

The 340B Program allows hospitals and certain other providers to stretch  federal resources to reach more eligible patients and provide more  comprehensive services. Participation in the 340B Program also can be  beneficial for hospitals and other covered entities as they can realize  substantial savings on covered outpatient drugs and generate revenue on  those drugs. Hospital participation in the 340B Program, and hospital  purchases of discounted drugs through the 340B Program, has risen  rapidly over time. However, HRSA’s current processes and procedures  do not provide reasonable assurance that nongovernmental hospitals  seeking to participate and benefit from the 340B Program meet the  program’s eligibility requirements.

Given the weaknesses in HRSA’s oversight, some hospitals that do not  appear to meet the statutory requirements for program eligibility are  participating in the 340B Program and receiving discounted prices for  drugs for which they may not be eligible. Although HRSA has initiated  some efforts to strengthen its processes for assessing hospitals’ eligibility,  continued growth in the number of participating hospitals and 340B- purchased drugs highlights the need for HRSA to improve its oversight  processes. This is critical to safeguarding the integrity of the 340B  Program.

We are making the following six recommendations to HRSA:

The Administrator of HRSA should ensure that the information it uses  to verify nonprofit status for all nongovernmental hospitals that  participate in the 340B Program is reliable—for example, by requiring  and reviewing the submission of official documentation hospitals must  already maintain or by ensuring the reliability of the data the agency  uses. (Recommendation 1)

The Administrator of HRSA should implement a process to verify that  every nongovernmental hospital that participates in the 340B Program  has a contract with a state or local government as required by statute.  (Recommendation 2)

The Administrator of HRSA should amend its contract integrity check  procedures for the 340B Program to include a review of whether  hospitals’ contracts with state and local governments require the  provision of health care services to low-income individuals not eligible  for Medicaid or Medicare as required by statute, and should provide  guidance for staff to conduct these reviews. (Recommendation 3)

The Administrator of HRSA should provide more specific guidance for  340B Program auditors on how to determine if nongovernmental  hospitals’ contracts with state and local governments require the  provision of health care services to low-income individuals not eligible  for Medicaid or Medicare. (Recommendation 4)

The Administrator of HRSA should revise its 340B Program audit  procedures to require auditors to document their assessments of  whether nongovernmental hospitals’ contracts with state and local  governments are appropriately signed, cover the time periods under  review, and require hospitals to serve low-income individuals not  eligible for Medicaid or Medicare, such as by requiring auditors to  separately affirm and record their review of each of these elements.  (Recommendation 5)

The Administrator of HRSA should require nongovernmental hospitals  participating in the 340B Program to demonstrate that they have  contracts with state or local governments in effect prior to the  beginning of their audits’ periods of review and should apply  consistent and appropriate consequences for hospitals that are  unable to do so. (Recommendation 6)

HHS provided written comments on a draft of this report, which are  reproduced in appendix II, and technical comments, which we have  incorporated as appropriate. In its written comments, HHS concurred with  five of our six recommendations; it did not concur with one of them.

In concurring with five of our recommendations, HHS stated that HRSA is  evaluating its audit process and other program integrity efforts, and noted  that HRSA has made improvements to strengthen its program integrity  efforts that align with some of our recommendations. With respect to our  recommendation to require auditors to document their assessments of the  required elements of contracts, HHS concurred and noted that HRSA  updated its audit procedures. Specifically, HRSA’s draft procedures for  fiscal year 2020 audits require auditors to specify if the hospital provided  a contract that includes the names and signatures for both the hospital  and government agency, effective dates that cover the entire audit period,  and that requires the provision of services to the 340B-specified low- income population. We are pleased that HRSA has already taken this  step to implement our recommendation. To fully implement this  recommendation, HRSA should incorporate these changes into its final  audit procedures for fiscal year 2020.

HHS also concurred with our recommendation to require  nongovernmental hospitals to demonstrate that they have contracts in  effect prior to the beginning of the audits’ periods of review, and to apply  consistent and appropriate consequences if they do not. Also, as noted  above, HRSA has updated its draft audit procedures to specify that  auditors should look for effective dates that cover the entire audit period.  While this is an important step, HRSA must also show that it has applied  consistent and appropriate consequences when auditors find that  nongovernmental hospitals did not have contracts in effect prior to the  beginning of their audit periods.

On a related issue, HHS expressed concern over and disagreed with our  finding that HRSA allows hospitals to avoid audit findings by entering into  new contracts while audits are being conducted, noting that HRSA  assesses potential audit findings on a case-by-case basis to ensure that  any necessary steps are taken to address issues. However, as we  reported, HRSA officials have indicated that they accept retroactive  contract documentation on a case-by-case basis; we continue to believe  that this practice—accepting new contracts that are retroactive— effectively allows hospitals to avoid audit findings. In addition, while we  agree that working with hospitals to address noncompliance is  appropriate, we continue to believe that such efforts should be in addition  to, not instead of, documenting noncompliance by issuing findings and  applying appropriate consequences, in accordance with HRSA’s audit  policies and procedures. To do otherwise undermines the integrity of  HRSA’s audits, and increases the risk that ineligible hospitals will receive  discounts under the program.

HHS also concurred with our recommendation to ensure that the  information HRSA uses to verify nonprofit status is reliable, but stated that  HRSA believes that the information it uses from hospitals’ Medicare cost  reports is reliable, because hospital administrators attest to the accuracy  of their cost reports. However, as discussed in our report, neither HRSA  nor CMS has evaluated the reliability of the cost report data for verifying  nonprofit status, and a CMS official responsible for oversight of the cost  reports told us that the question on the cost report is not clearly defined  and may not be reported accurately. As such, we continue to believe that  HRSA needs to assess the reliability of the Medicare cost report data  should it continue to use those data for determining hospitals’ nonprofit  status. Alternatively, HRSA could require hospitals to submit  documentation of their nonprofit status, such as Internal Revenue Service  documents, which HRSA acknowledged hospitals are required to  maintain as part of their auditable records.

HHS did not concur with our recommendation to implement a process to  verify that every nongovernmental hospital that participates in the 340B  Program has the statutorily required contract with a state or local  government. HHS noted that it has requested authority to require  hospitals registering for the 340B Program to submit documentation  supporting the hospital classification that they select during registration.  According to HHS, if approved, HRSA would begin collecting and  reviewing contracts from all newly registering nongovernmental hospitals.  However, HHS stated that HRSA does not have the resources to collect,  review, and verify that every participating nongovernmental hospital has a  contract with a state or local government. While we understand that  verifying the existence of contracts for all participating nongovernmental  hospitals would require additional effort on HRSA’s part, our review found  that relying on hospitals’ attestations is not sufficient to ensure hospitals’  eligibility. Additionally, implementing a process to verify the existence of a  contract does not necessarily require that HRSA collect and review  contracts from every hospital. There are other potential options, such as  obtaining confirmation from the state or local government that they indeed  have a contract with the hospital to provide services to the 340B-specified  low-income population. HHS also commented that implementing our  recommendation would create a significant burden on covered entities.  However, as we noted in our report, HRSA already requires hospitals to  maintain copies of their state or local government contracts. Therefore, it  is unclear how implementing a process to verify the existence of those  contracts would represent a significant burden for nongovernmental  hospitals already registered for the program. Ensuring the eligibility of  covered entities that participate in the 340B Program is essential for  program integrity. As such, we continue to believe that HRSA needs to  take action, beyond relying on hospitals’ self-attestations, to verify that all  participating nongovernmental hospitals have contracts with state or local  governments that meet the statutory requirements of the program.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of HHS, the  Administrator of HRSA, and other interested parties. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or draperd@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. Other major contributors to this report are listed in  appendix III.

Appendix I: Characteristics of the Contracts Reviewed

Table 1 provides information about the 240 contracts between hospitals  and state or local governments that were included in our review, including  information about the type of hospital and the level of government that  were parties to the contract. In at least two cases, the hospitals  contracted with other health care providers who were themselves 340B  Program participants, such as a community health center operated by a  local health department. Officials signing on behalf of state and local  governments included individuals with executive positions, such as the  heads of state agencies, mayors, and county executives, but also  included a city alderman, a vice-chancellor for finance at a state university  health system, and a juvenile court judge.

Appendix II: Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Michelle Rosenberg, Assistant  Director; Hannah Locke, Analyst-in-Charge; Jennie Apter; George Bogart;  Kaitlin Farquharson; Matthew Green; Vikki Porter; Daniel Ries; Brienne  Tierney; and William T. Woods made key contributions to this report.

Certain hospitals can get discounted prescription drugs under the 340B Program. For example, nonprofit hospitals may qualify if they contract with state or local governments to provide services to low-income individuals who can’t get Medicaid or Medicare coverage.

We found weaknesses in the Health Resources and Services Administration’s (HRSA) oversight that may result in some hospitals receiving discounts for which they are not eligible.

We recommended ways for HRSA to increase its oversight to help ensure that hospitals participating in the 340B Program meet eligibility requirements.