HRSA Approvals of Manufacturer Audits On the Rise
Manufacturer dispute resolution and audit guidelines with covered entities were established in 1996 but historically have rarely been invoked…until recently.
In the last few months, we at Rx|X have seen a sharp increase in HRSA approvals of manufacturer audits after decades of resolution in “good faith”.
When conducting an HRSA-approved 340B audit, manufacturers must:
Show reasonable cause, obtain HRSA approval, and stay within the defined scope.
Maintain transparency, fairness, and confidentiality.
Use qualified auditors and follow standard audit protocols.
Give the covered entity a chance to review and respond to findings.
Manufacturers and covered entities are supposed to have a minimum of 30 days of good faith to resolve concerns of diversion or duplicate discounts. The Office of Pharmacy Affairs (OPA) evaluates manufacturers’ audit work plans and reasonable cause, including demonstration that good faith efforts occurred. While good faith efforts are not defined in the guidelines, Rx|X was recently told that OPA looks for “at least one attempt of contacting the covered entity.” This begs several questions around what outreach is acceptable. One attempt? Does the covered entity even need to respond at all if one attempt is sufficient? Do communications from third-party vendors count or does it need to come directly from manufacturers? What if the entity cannot find any record of outreach?
The guidelines dictate the manufacturer’s auditor shall be an independent public accountant employed by the manufacturer to perform the audit. The auditor has an ethical and legal responsibility to perform a quality audit in accordance within Generally Accepted Government Auditing Standards (GAGAS). I recently found out that manufacturers are under no obligation to share their work plan with the entity, which eliminates any meaningful monitoring of compliance with GAGAS. OPA informed me that entities can submit a Freedom of Information Act (FOIA) for this documentation. While we recommend doing so, it will not be particularly helpful during the audit because responses to FOIA requests take at least 18 months.
Key Takeaways:
If a covered entity has not been contacted prior to receiving a notice of audit, they should reach out to OPA at 340Bpricing@hrsa.gov for OPA to review.
Covered entities need to run a conflict check with the accounting firm used by the manufacturer
Covered entities should request the approved work plan so they can assess adherence to GAGAS.
Covered entities should immediately submit a FOIA request for the workplan and documents submitted for HRSA approval.
Once the audit is approved, OPA will not intervene in the process so if there are concerns, they need to be included in the audit response.
For more of my thoughts on this, be on the lookout for my guest appearance on an upcoming episode of the fantastic podcast 340Banter with our friends at FQHC Compliance!