AHLA March 2014 Volume 18 Issue 3 For the health and life sciences law community Transmitting PHI by Email (page 16) 340B Program Covered Entity Audits (page 24) FCA Cases Involving Swapping Schemes (page 42) OFFICIAL MAGAZINE OF AMERICAN HEALTH LAWYERS ASSOCIATION
Analysis 340B Program Covered Entity Audits: Early Experiences and Lessons Learned By William von Oehsen, Joel Hamme, and Jason Reddish, Powers Pyles Sutter & Verville PC, Washington, DC * The federal drug discount program established under section 340B of the Public Health Service Act, commonly known as the 340B Program, has come under significant scrutiny from the pharmaceutical industry and its allies in recent years after garnering little or no attention for two decades. The government has been conducting compliance audits of participating safety net providers for the last two years, but very little information is publicly available regarding the audit process and initial findings. In this article, we summarize our experiences from working with audited providers and the advocacy groups that represent them. Those experiences and lessons learned from them may benefit fellow practitioners working on similar issues. The article first provides background information on the 340B Program and then describes the audit process. Next, the article discusses how audit findings may be challenged. Finally, the article reviews some of the lessons learned from audit experiences to date. Background The 340B Program is overseen by the Office of Pharmacy Affairs (OPA) of the Health Resources and Services Administration (HRSA), an agency within the Department of Health and Human Services. The program was created through bipartisan legislation signed into law by President George H.W. Bush in 1992. 1 It is intended to allow certain categories of safety net providers, called covered entities in 340B parlance, to obtain prescription covered outpatient drugs 2 at below-retail prices so that they may stretch scarce federal resources as far as possible, reaching more eligible patients and providing more comprehensive services. 3 The 340B Program is controlled by the 340B statute as well as an amalgam of sub-regulatory standards including Federal Register notices, HRSA Policy Releases, and frequently asked question (FAQ) guidance that is published on the HRSA website. In addition, HRSA has relied upon technical assistance contractors to assist covered entities that have specific questions regarding 340B Program operational and compliance issues. 4 HRSA has indicated that it will be proposing a mega-regulation some time before June 2014 to provide formal rules on crucial aspects of the program. 5 The 340B statute imposes three major requirements on covered entities. First, a covered entity may only provide or dispense drugs purchased through the 340B program to its patients. 6 This is called the diversion prohibition. Second, each covered entity must ensure that its state is not seeking Medicaid drug rebates for drugs purchased through the 340B Program and billed to Medicaid for reimbursement. 7 This duplicate discount prohibition protects drug manufacturers from paying rebates as well as providing 340B discounts on the same drugs. Third, some types of hospitals may not obtain any covered outpatient drugs through a group purchasing organization (GPO) or other group purchasing arrangement. 8 This is called the GPO prohibition. HRSA has a statutory right to audit the safety net providers that participate in the 340B Program for compliance with its diversion and duplicate discount prohibitions. 9 Drug manufacturers may also audit covered entities, though they must have cause to believe that a violation has occurred, and they must obtain approval from HRSA prior to conducting an audit. 10 If an audit reveals any violations, HRSA may sanction covered entities that violate the diversion or duplicate discount prohibitions by requiring them to repay the 340B discounts on the affected drugs. 11 If HRSA determines that the violation was knowing and intentional, it may assess interest charges. 12 If the violation is also egregious and systematic, HRSA may remove the covered entity from the program for a period of time. 13 The GPO prohibition is among the prerequisites for hospitals participating in the 340B Program. If a GPO prohibition violation is discovered in the course of an audit, or if a covered entity self-reports a GPO prohibition violation, HRSA might ask the covered entity to remedy the violation by repaying the manufacturers the difference between the wholesaler acquisition cost (WAC) and the GPO price paid for the affected drugs. In more serious cases, HRSA might determine that the entity was not eligible for the 340B Program and ask the entity to disenroll and refund 340B discounts to drug manufacturers for the period in question. HRSA has also taken the position that maintenance of auditable records is a prerequisite for program participation, and that a covered entity with inauditable records is ineligible. HRSA first began auditing covered entities in early 2012. According to the Director of OPA, Commander Krista Pedley, HRSA conducted 51 audits of covered entities during fiscal year 2012, all but six of which were randomly selected; another 94 audits were conducted in fiscal year 2013. 14 HRSA has also revealed that, by December 2013, drug manufacturers had completed six of seven audits of 340B covered entities. 15 24 AHLA Connections March 2014
Audit Process HRSA notifies a covered entity that it has been selected for audit by sending it an engagement letter. The engagement letter tells the selected covered entity that the audit will review the entity s policies, procedures, and processes that pertain to 340B drugs; verification of internal controls in place to prevent diversion and duplicate discounts; and testing, on a sample basis, transactions that pertain to 340B drugs. The audit will look at not only the main covered entity site (the parent site ), but also its registered outpatient facilities and contract pharmacies, if applicable. 16 Next, a HRSA auditor (or, in some cases, audit team) contacts the covered entity to schedule an entrance conference by telephone. The auditor will schedule the onsite audit and also transmit a data request to the covered entity, asking it to produce a wide-ranging set of documents relating to its 340B usage during a six-month window in the year preceding the audit. The covered entity might have fewer than 30 days to prepare the requested materials and submit them to the auditor in a usable format. The data submission deadline is typically only a few days prior to the onsite audit. On the initial day of the audit, the audit team will tour the covered entity s facilities. The auditor(s) will review documented policies and procedures, verify Medicaid duplicate discount safeguards, and ensure that covered outpatient drugs are not being purchased through a GPO. Most critically, the auditor(s) will ask to see the records relating to a sample of 340B transactions. For each transaction, the auditor(s) will verify that the drug was administered or dispensed on an outpatient basis at an eligible site and to an eligible patient. Before leaving, the auditor(s) will conduct an exit interview with appropriate covered entity officials. 17 After the audit, the covered entity awaits a Preliminary Audit Report (PAR) from HRSA. If there are no adverse findings, a covered entity might receive its PAR within a few months of the audit. In more complicated cases, covered entities have received their PAR over a year after the audit. As described below, an entity with adverse findings then has an opportunity to dispute the PAR. HRSA issues a Final Audit Report (FAR) after any issues with the PAR are resolved. HRSA periodically updates a chart on its websites listing completed audits, but releases few details on the findings for each audited entity. Disputing Audit Findings A covered entity first receives formal feedback on its audit through the PAR. The PAR is mailed to the covered entity, along with a cover letter summarizing any findings. Within the PAR, each adverse finding is accompanied by a paragraph or two explaining, very generally, the circumstances surrounding the violation. Some minor deviations, such as deficient policies and procedures or inaccurate database entries, are termed The government has been conducting compliance audits of participating safety net providers for the last two years, but very little information is publicly available regarding the audit process and initial findings. areas for improvement. Others, such as allegations of diversion, perceived violations of the duplicate discount prohibition, and purported breaches of the GPO prohibition, could lead to sanctions. The cover letter accompanying the PAR asks the covered entity to provide a written response agreeing with or disagreeing with the findings within 30 days of the date of the letter. If the covered entity disagrees, the cover letter instructs it to provide evidence supporting its position. If the covered entity does not respond, the PAR is finalized. A few months later, HRSA sends the covered entity the FAR. The FAR might contain more detail than the PAR, depending on the nature of the preliminary findings and any response provided by the covered entity. The cover letter accompanying the FAR instructs the covered entity that it has 30 days to submit any notice of disagreement (Notice of Disagreement) with the FAR, or 60 days to submit a corrective action plan (CAP). HRSA has not yet established any formal requirements for either, so covered entities have some flexibility to tailor the documents to their particular situations. There are cases in which HRSA has reversed preliminary or final audit findings after reviewing written responses or Notices of Disagreement from covered entities. In general, this has occurred when the covered entities furnished meticulous documentation relating to the particular issue. So, for example, if the contested finding related to alleged diversion, it is useful to trace carefully the care provided by the covered entity and to correlate it in time and scope to the relevant prescriptions and the relationship of the prescriber with the entity. It is also helpful if the particular 340B drug usage can be buttressed by legal arguments making reference to past agency communications or pronouncements, such as FAQs or agency correspondence. healthlawyers.org 25
Analysis HRSA has also not yet publicized or communicated information as to other levels of administrative review. It might create such a mechanism should the need arise. In the absence of any additional administrative review, if HRSA does not agree with the covered entity s challenge to any audit findings, or if HRSA does not respond to any of the issues raised in the covered entity s Notice of Disagreement, the covered entity will decide whether to accept the findings or whether to seek judicial review. HRSA seems to evaluate CAPs on a case-by-case basis. We are aware of instances in which HRSA has rejected multiple CAPs submitted by a covered entity as insufficient. To date, HRSA has instructed a handful of covered entities to offer repayment to manufacturers, but has not yet had to exercise its sanctioning authority to compel repayment of 340B discounts or other remedial action because HRSA told a covered entity to take corrective action and the covered entity has failed or refused to do so. The major issues in crafting a CAP involve the time periods that must be covered by any repayments, the exact measures that the covered entity must undertake to ensure compliance and/or rectify any past irregularities, and whether the CAP is entirely prospective, solely retrospective, or a combination of the two. At present, covered entities appear to enjoy some flexibility in crafting their CAPs, as HRSA has not enumerated specific guidelines relating to their formulation. For example, HRSA has not established any bright-line rules for the time periods that must be covered by any repayments. Lessons Learned Covered entities did not know what to expect when HRSA began conducting audits. In late 2011, HRSA Administrator Mary Wakefield told Congress that HRSA would follow its 1996 manufacturer audit guidelines. 18 Since then, the agency has issued two Policy Releases (one superseding the other) and a one-page information sheet. 19 Although the 1996 manufacturer audit guidelines require adherence to the Government Accountability Office s Government Auditing Standards (GAS), the agency appears to be applying its own standards. 20 Thus, a covered entity that has been selected for an audit should ask the audit team during the entrance conference for the audit protocol that will be used. Through word-of-mouth exchanges and peer-to-peer networking, covered entities have gleaned information from each other. The Safety Net Hospitals for Pharmaceutical Access, the national advocacy group for 340B hospitals, has [A] covered entity that has been selected for an audit should ask the audit team during the entrance conference for the audit protocol that will be used. been an invaluable resource, collecting sample data requests to share with its member hospitals. HRSA s contractor, Apexus, has developed sample policies and procedures for some covered entity types. Though entities that were audited early in this process did not have these tools at their disposal, many have been extremely helpful in preparing other covered entities that have been selected for an audit. The audits have revealed that HRSA generally takes a narrow view of its historical guidance. Some adverse findings appear to conflict with prior agency statements. Due to the fluid nature of OPA s online FAQ guidance, two covered entities might have very different views of a program requirement depending on how diligently they follow the program. Further, many entities have expressed frustration that deficiencies are not necessarily communicated at the exit conference. Covered entities should not be surprised if the PAR contains adverse findings that the audit team did not highlight during the audit. Since the PAR might be the first notice a covered entity receives regarding any compliance shortcomings, the covered entity should be prepared to act quickly to mitigate any ongoing issues. Many of these program guidance issues might be addressed when HRSA promulgates its mega-regulation, though it is not clear at this juncture that this regulation will formalize HRSA s audit process. Early audit findings demonstrate the importance of uniformly applied rules, publicly available audit standards that are clear, and a level playing field for all covered entities. Until audit rules are published, covered entities and their counsel must carefully follow the audit process with the understanding that HRSA s views on 340B compliance enforcement are still evolving. 26 AHLA Connections March 2014
About the Authors William von Oehsen (william.vonoehsen@ ppsv.com) is a principal at Powers Pyles Sutter & Verville and the chair of the firm s drug pricing practice. Mr. von Oehsen has extensive experience in general health care law and legislation and policy, especially in the areas of pharmaceutical pricing, food and drug law, materials management, managed care, and third party reimbursement. Mr. von Oehsen played a key role in the passage of the law that created the 340B drug discount program, created and now represents the largest group advocating the interests of 340B hospitals, and is deeply involved in the implementation of the program. Joel Hamme (joel.hamme@ppsv.com) is a principal at Powers Pyles Sutter & Verville and Past President of AHLA. Mr. Hamme focuses on long term care facilities, Medicare and Medicaid reimbursement issues, provider licensure and certification matters, and litigation in these areas. In addition, Mr. Hamme advises clients on participation in the 340B drug discount program. His experience includes meeting provider-based requirements to extend the covered entity s 340B coverage; application of 340B to inmates in the correctional context; responses to 340B audits; and remedial plans in refund situations. Jason Reddish (jason.reddish@ppsv.com) is an associate at Powers Pyles Sutter & Verville. Mr. Reddish focuses on the federal 340B drug discount program and its myriad impacts on hospitals, pharmacies, managed care plans, private payers, government healthcare programs, and non-hospital safety net providers including Ryan White HIV/AIDS clinics, Hemophilia Treatment Centers, federally qualified health centers, and other federal grantees. Mr. Reddish assists clients with negotiating 340B-related contract pharmacy and administrator agreements, developing compliant policies and procedures for 340B covered entities and contract pharmacies, and disputing unfair or unjust audit findings. * The opinions expressed in this article are solely those of the authors and do not necessarily reflect the views of their clients or other 340B program stakeholders. Endnotes 1 Veterans Health Care Act of 1992, Pub. L. No. 102-585, 602, 106 Stat. 4943, 4967-71, codified at 42 U.S.C. 256b. 2 The 340B statute borrows the definition of covered outpatient drugs applicable to the Medicaid drug rebate program. The definition includes most prescription drugs, biologics, and insulin used on an outpatient basis. See 42 U.S.C. 1396r-8(k)(2). 3 H.R. Rep. No. 102-384(II), at 12 (1992). 4 Apexus, Inc. currently serves as OPA s technical assistance contractor. 5 HRSA, 340B Drug Program: Important Benefit, Significant Responsibility (Jan. 9, 2014). To date, HRSA has used notice and comment rulemaking for the 340B Program only as to the exclusion of orphan drugs from 340B pricing for certain hospitals. See 78 Fed. Reg. 44016 (July 23, 2013). 6 42 U.S.C. 256b(a)(5)(B). 7 Id. 256b(a)(5)(A). Drug manufacturers are required to sign a drug rebate agreement and a pharmaceutical pricing agreement with the Department of Health and Human Services if they wish for their drugs to be covered by Medicaid and Medicare Part B. See 42 U.S.C. 1396r-8(a)(1), (5). Under the drug rebate agreement, manufacturers agree to pay a portion of what Medicaid pays for covered outpatient drugs back to the state Medicaid agencies. Id. 1396r-8(a)(1). The pharmaceutical pricing agreement governs the 340B discount. Id. 1396r-8(a)(5). 8 Id. 256b(a)(4)(L)(iii). 9 See id. 256b(a)(5)(C). HRSA also has the authority to audit manufacturers and wholesalers to ensure their compliance with 340B requirements. Id. 256b(d)(1)(B)(v). HRSA announced in February 2014 that it is conducting its first audit of a manufacturer. Drug Discount Monitor, OPA Focusing on 340B Drug Pricing Transparency and Accuracy (Feb. 7, 2014). Congress also more than doubled HRSA s appropriation for fiscal year 2014, from $4.4 million to $10.2 million. Id. In March 2014, HRSA must tell Congress how it plans to use the additional funding to support 340B Program oversight. Id. 10 Id.; see also Manufacturer Audit Guidelines and Dispute Resolution Process, 61 Fed. Reg. 65406 (Dec. 12, 1996); HRSA 340B Drug Pricing Program Notice, Clarification of Manufacturer Audits of 340B Covered Entities, Release No. 2011-3 (Nov. 21, 2011). 11 42 U.S.C. 256b(a)(5)(D). 12 Id. 256b(d)(2)(v)(I). 13 Id. 256b(d)(2)(v)(II). 14 Statement by CDR Pedley at 9th 340B Coalition Winter Conference, San Francisco, CA (Jan. 24, 2013); Statement by CDR Pedley at American Society of Health-Systems Pharmacists Midyear Clinical Meeting, Orlando, FL (Dec. 9, 2013). 15 Statement by CDR Pedley at American Society of Health-Systems Pharmacists Clinical Meeting, supra note 14. 16 Covered entities are permitted to contract with one or more pharmacies to serve as their agent for ordering and dispensing 340B drugs. These pharmacies are called contract pharmacies. See Notice Regarding 340B Drug Pricing Program Contract Pharmacy Services, 75 Fed. Reg. 10272 (Mar. 5, 2010). 17 The boilerplate engagement letter instructs covered entities that [n]o formal conclusions or recommendations will be made during the onsite audit. 18 See Letter from Mary Wakefield, Administrator, HRSA, to Sen. Charles Grassley, attachment at 6 (Oct. 21, 2011) (stating that HRSA will specifically use the existing 340B audit guidelines as published in December 12, 1996 (61 Fed. Reg. 65,406) ). 19 HRSA 340B Drug Pricing Program Notice, Clarification of HRSA Audits of 340B Covered Entities, Release No. 2012-1 (Mar. 5, 2012), superseded by Release No. 2012-1.1 (Feb. 8, 2013). 20 61 Fed. Reg. at 65407 (discussing mandatory use of the Government Auditing Standards; General Accountability Office, Government Auditing Standards, GAO-12-331G (Dec. 2011)). healthlawyers.org 27