More Drug Company Oversight Needed to Maintain 340B Compliance

There has been a lot of noise surrounding HRSA’s oversight of the 340B program with a disproportionate amount of attention on the gaps in the agency’s audits of covered entities. As someone who has witnessed the evolution of entity audits since the beginning, I can attest to the massive lift expected from an entity undergoing a HRSA audit. It is around 3-4 months of intense preparation, data collection, and time from the team whose day to day is seriously interrupted by this test. In summary, 340B Programs are designed around the possibility of a HRSA audit.

While the mere threat of an audit influences entities, we aren’t so sure how manufacturers are impacted. Recent analysis from the American Hospital Association (AHA) reveals a striking disparity in how HRSA audits 340B-covered entities versus drug manufacturers. There has never been any public discussion on HRSA’s methods for manufacturer audits or how it selects the 5 or so it audits per year, but my hunch is that they focus on smaller manufacturers with known errors in price calculations.

I personally have assisted some of the country's largest systems through HRSA audits but none of the big names in PhRMA being audited. I know the deep dive entities go through, but have no insights into the methods used to for these limited reviews. Is HRSA evaluating sales data to validate the pricing components that go into the 340B ceiling price calculation? Or, as I suspect, are the metrics accepted as fact and the math is just checked? How are recalculations reviewed? Manufacturers with smaller portfolios and smaller staff may not have the experience or expertise in government price calculations, so it follows that there would be findings. Where are the audits of seasoned manufacturers with frequent recalculations and 340B refunds? How does HRSA select their manufacturers to audit?

Key Audit Findings (FY 2018–2022)

• 340B hospitals: HRSA conducts around 160 audits annually (~6% of hospitals), with findings for duplicate discounts or diversion dropping dramatically—almost 62% combined reduction from 2018 levels (duplicate discounts fell from 30.8% to 13.2%; diversion from 39.7% to 10.7%).

  • Some professional observations from the field:

    • HRSA’s publication of audit findings provides no context.

      • A diversion finding doesn’t mean systemic issues. It could apply to one transaction. Diversion is also a moving target. Recent HRSA audit language includes rationales and terms that are not anywhere in statute or guidance. This deserves an entirely separate blog post.

      • The duplicate discount findings are even more unreliable because HRSA issues findings without confirmation from the State. Entities have to pursue confirmation from the State that duplicate discounts did not actually occur; yet, HRSA will maintain the finding remains. In these situations, there is no financial impact to the State or manufacturers, but the covered entity receives reputational harm.

• Drug manufacturers: Only ~5 audits per year (~0.6% of participating companies). Yet an astounding 60% of those are flagged for compliance issues, and 93% result in repayment to covered entities.

  • As stated, if HRSA, as I suspect, is auditing smaller entities with known issues, these numbers make perfect sense. My bigger question is why HRSA isn’t reviewing any manufacturer in the top 20.

  • Audits of manufacturers remain rare and often limited to smaller companies, leaving significant oversight gaps.

AHA’s Call to Action

The AHA urges HRSA and policymakers to:

• Expand audits of drug manufacturers, ensuring they don’t exploit pricing rules or overcharge covered entities.

• Reject drug company claims of widespread hospital abuses and oppose shifts toward a “rebate model” that would undermine program integrity.

I would love to see more public-facing information on how HRSA audits manufacturers and how it selects its sample each year. We know HRSA uses a mix of random and purposive criteria to select covered entities for review, but have no information on how it picks the manufacturers. For example, HRSA wants to ensure a geographic mix of entities, weights entities by the number of contract pharmacy arrangements, and “re-audits” entities that have findings.

Bottom Line

While HRSA rightly holds 340B hospitals to rigorous standards—and those hospitals have responded with robust compliance efforts—the limited scope of manufacturer audits has surfaced a troubling trend: Drug companies are audited far less, yet are found noncompliant at much higher rates, often overcharging entities. This truth also exists alongside the potential selection bias that HRSA may have for manufacturers.

To preserve the sustainability and fairness of the 340B program—vital for millions of vulnerable patients served by covered entities—HRSA must shift more oversight toward drug manufacturers, ensuring parity and program fidelity.