340B Policies & Procedures October 12, 2017 340B Policies & Procedures

DISCLAIMER These materials have been prepared by the attorneys of Feldesman Tucker Leifer Fidell LLP. The opinions expressed in these materials are solely their views and not necessarily the views of Feldesman Tucker Leifer Fidell LLP or the Hemophilia Alliance. The materials are being issued with the understanding that the authors are not engaged in rendering legal or other professional services. If legal assistance or other expert assistance is required, the services of a competent professional should be sought.

Oversight of the 340B Program Oversight by HRSA’s Office of Pharmacy Affairs (OPA) CE, Manufacturer, and Contract Pharmacy enrollment required through OPA Information System (OPAIS) New OPAIS launched in September Other OPA Tools Medicaid Exclusion File Quarterly registration windows Annual recertification

Annual Recertification Covered entities must annually recertify their eligibility for the 340B Program Authorizing Official (AO) performs recertification for parent and child sites (including all clinical sites and sub-grantees), as well as all contract pharmacies AO must be fully authorized to legally bind the covered entity AO attests and certifies

AO attests and certifies: (1) all information listed on 340B Program database is complete, accurate, and correct; (2) the covered entity meets 340B Program eligibility requirements; (3) the covered entity will comply with all requirements of the 340B Program, including, but not limited to, the prohibition against duplicate discounts and diversion; (4) the covered entity maintains auditable records pertaining to compliance with the requirements; (5) if the covered entity uses contract pharmacy services, that the contract pharmacy arrangement meets OPA requirements and guidelines; (6) the covered entity acknowledges its responsibility to contact OPA as soon as possible if there is any change in 340B eligibility and/or [material] breach of 340B program requirements; and (7) the covered entity acknowledges that if there is a [material] breach of the requirements that the covered entity may be liable to the drug manufacturer, and, depending upon the circumstances, may be subject to removal from the list of eligible 340B entities.

Why does annual recertification matter? This is how OPA hooks covered entities!

Policies and Procedures Getting to the heart of the matter… Policies and Procedures

You cannot set it and forget it Bottom Line: You cannot set it and forget it

What makes a policy and/or procedure good? Comprehensive Practical Operationalized and accurate Updated regularly Responsible staff members identified by title

What if my institution has 340B Policies and Procedures? Does your institution require that the entire organization follow the same P&Ps? Do the 340B P&Ps work for the HTCs operations? Please note: distinctions between hospital and grantee compliance in 340B HTCs are not subject to GPO exclusion and do not use a cost report for 340B HOWEVER, cannot provide 340B scripts to non-HTC patients and must use program income in accordance with grant rules

What if my contract pharmacy/regional grantee/Apexus/ Hemophilia Alliance or some other external party provides me with sample 340B Policies and Procedures? DO NOT JUST INSERT YOUR HTC’S NAME!!!! Any sample P&P is only as good as it is tailored to your program and operations

What does OPA require be in my 340B policies and procedures? OPA does not specify… Policies and procedures should ensure compliance of 340B requirements: Diversion Duplicate discounts Auditable records Oversight of contract pharmacies Material breach and self-disclosure

How often should I update my 340B Policies and Procedures? It depends… no specific requirement Rule of thumb Option 1: anytime operations change, e.g.: Delivery site added Contract pharmacy arrangement added Prescriber arrives or leaves organization Option 2: any time turnover in staff Option 3: regular intervals (annually, bi-annually, every HTC grant application)

Risk Area – HRSA/OPA Registration 1. Policy on Annual OPA Recertification 2. Policy on Enrolling and Removing Delivery Sites 3. Policy on Updating HTC’s Information Posted on the OPA Database 4. Policy on Confirming 340B Eligibility of Sites at Which 340B Drugs are Prescribed Risk Area – Drug Diversion 1. Policy on Defining and Documenting Patient Eligibility for 340B Drugs 2. Policy on Defining and Documenting Provider Eligibility to Prescribe 340B Drugs 3. Policy on Filling Prescriptions Written by Providers Not Employed/Contracted by HTC 4. Policy on Documenting Referral Arrangements 5. Policy on Providing and Updating Patient and Provider Lists for Contract Pharmacies How will the CE define and document: Patient eligibility? Provider eligibility? On an ongoing basis, how will CE confirm 340B eligibility for: Patients? Delivery sites? How will CE enroll and remove delivery sites from OPA database? How will CE approach scripts written by providers not employed/contracted with CE? How will CE document referral arrangements? How will CE provide and update patient and provider lists for contract pharmacies?

Patient Identification Risk Area – Duplicate Discounts 1. Policy on Dispensing 340B Drugs to Medicaid Fee-for-Service Beneficiaries 2. Policy on Dispensing 340B Drugs to Medicaid MCO Beneficiaries 3. Policy on Medicaid Billing/Reimbursement 4. Policy on Posting and Updating Information on OPA website/Medicaid Exclusion File Risk Area – Contract Pharmacies 1. Policy on Utilization of Contract Pharmacies 2. Policy on Compliance Oversight of Contract Pharmacies 3. Policy on Utilization of 340B Administrative Service Vendors 4. Policy on Compliance Oversight of Administrative Service Vendors Duplicate discounts Will CE dispense 340B drugs to Medicaid FFS beneficiaries? Medicaid managed care beneficiaries? Will CE bill Medicaid FFS and/or Medicaid managed care for 340B drugs? How will CE update OPA website? Medicaid Exclusion File? How will CE keep up-to-date on state policies re: reimbursement for 340B drugs? Contract pharmacies Patient Identification How does the contract pharmacy identify the patient? Does the contract pharmacy keep track of location where services are provided? Does the contract pharmacy have a list of providers? Does the contract pharmacy cross-check the provider list with the location? Records Do prescriptions written as part of a referral and/or specialist visit get incorporated into patients’ medical file? How timely are medical records updated? Audits Do you have sufficient access to the contract pharmacy’s records to audit for compliance? Does your organization have a designated person to oversee contract pharmacy arrangements and conduct audits?

Risk Area – Written Compliance Policies 1. Policy on Covered Entity’s Commitment to Comply with all Requirements and Restrictions of Section 340B of the PHS Act and Accompanying Regulations and Guidelines 2. Policy on Use of Revenue Generated and/or Savings 3. Policy on Confirming 340B Eligibility of Sites at Which 340B Drugs are prescribed 4. Policy on Maintenance of Auditable Records Demonstrating Compliance with 340B Requirements 5. Policy on Procurement, Inventory Management, and Dispensing of 340B Drugs 6. Policy on Maintenance of Systems/Mechanisms and Internal Controls to Reasonably Ensure Compliance with all 340B Requirements 7. Policy on Adopting Internal 340B Compliance Plan as Part of Covered Entity’s Corporate Compliance Program 8. Policy on Conducting External Audits of 340B Program 9. Policy Regarding Corrective Action in the Event of a Breach of 340B Requirements 10. Policy Designating Staff Responsibilities for Covered Entity’s 340B Program, and Competency and Training Requirements 11. Policy on Periodic Self-Audit and Compliance Monitoring 12. Policy on Periodic Review, Update, and Approval of 340B Policies

Refresher on program requirements 340B Basics

Key Terms DIVERSION: 340B drugs may be dispensed only to a “patient” of a CE and may not be resold or transferred by CE DUPLICATE DISCOUNT: May not request a discount from a manufacturer on a 340B drug if that drug is subject to the payment of a rebate to a state Medicaid agency

Who Is a 340B Eligible Patient? CE has established a relationship with the individual, such that the CE maintains records of the individual’s health care; The individual receives health care services from a health care professional who is either employed by the CE or provides health care under contractual or other arrangements (e.g. referral for consultation) such that the responsibility for the care remains with the CE; and The individual receives a health care service or range of services from the CE which is consistent with the service or range of services for which grant funding or federally qualified health center look-alike status has been provided to the entity. 61 Fed. Reg. 55,156 (October 24, 1996)

Outside Scope of Grant? Rx Service or site not within scope of grant More challenging for CEs with narrower scope of grant Ryan White Clinics, Family Planning Clinics, Hemophilia Treatment Centers Rx Scope of Grant 340B

Medicaid and the 340B Statute “A covered entity shall not request payment under Medicaid for prescribed drugs with respect to a drug that is subject to 340B if the drug is subject to the payment of a rebate to the State. (emphasis added)” “The Secretary of DHHS shall establish a mechanism to ensure that covered entities comply… [with this provision] (emphasis added)” 42 USC 256b(a)(5)(A)(i)and(ii))

Contract Pharmacies

History of Contract Pharmacy Model 340B statute does not address contract pharmacies Many CEs did not have an in-house pharmacy, limiting benefit of 340B Program to CEs and patients In 1996, HRSA permitted CEs to contract with a commercial pharmacy to dispense 340B drugs to eligible patients but on a limited basis (61 Fed Reg. 43549 (August 23, 1996)) One contract pharmacy per delivery site No chain pharmacy arrangements No contract pharmacy if CE operated an in-house pharmacy

A Whole New World! HRSA issued revised guidance in 2010 (75 Fed. Reg. 10,272 (March 5, 2010)) Allows contracting with multiple pharmacies, pharmacy chains, and/or operating an in-house pharmacy Applies to all contract pharmacy arrangements Guidance replaces all prior guidance Substantial emphasis on compliance – in fact, not just on paper

What Happens in this New World? Operational Features “Ship to” “bill to” drug purchasing Separate inventories, but virtual “electronic” inventories permitted “Replenishment” model widely accepted Premium on record-keeping and documentation CE retains ultimate responsibility for compliance Emergence of numerous management vendors and so-called third party administrators (TPAs) HOWEVER covered entities cannot “outsource” compliance responsibility

HRSA on Contract Pharmacy Arrangements HRSA states that it will terminate contract pharmacy arrangements where the CE is not exercising adequate oversight HRSA expects CEs to: Conduct independent annual audits and/or adequate oversight mechanism Develop 340B Program policies and procedures Prevent diversion Prevent duplicate discounts by carving out Medicaid or establish alternative arrangement with state Medicaid agency Maintain accurate information in the HRSA 340B database Memorandum Report: Contract Pharmacy Arrangements in the 340B Program, OEI-05-13-00431 (Feb. 2014)

Due Diligence Pre-contract Execution Determine specific HTC experience Get references and follow up Get demo – preferably with your data on your systems Obtain financial/legal review of contract terms Post-contract Execution Review reports/financial results regularly and thoroughly Spot check – especially during initial period Audit - consider independent auditor

340B Audits

How Does OPA Decide Which Covered Entities to Audit? Randomized/Risk-based Complex program administration Number of child sites Volume of purchases Contract pharmacy arrangements Targeted Allegations of violations From HRSA Webinar on March 23, 2016

OPA Audit Process Authorized by statute (42 USC 256b(a)(5)(C)) Desk Audits No published protocol and not subject to other audit protocols NOTE! HRSA auditors are not authorized to discuss any potential findings and any statements made during the audit are subject to change Also perform “Desk Audits” Desk Audits Except for the on-site visit, normal 340B audit procedures are followed for a desk audit. In place of the on-site visit, the auditor communicates with the covered entity using Secure Workspaces, Secured Email, Adobe Connect, and teleconference.The auditor will ensure appropriate communications are encrypted and secure, and test those communications with the covered entity before beginning the desk audit. Abode Connect is the preferred method to review sample items and patient records.  Secure Workspaces and Secured Email could be used in the case of scanning paper documents.

Recent Developments In Audits New “sheriff” in town Audit protocol?

Common 340B Audit Findings

Common Database Findings Incorrect Authorizing Official Closed facility listed Incorrect facility address Incorrect facility name Incorrect grant number Facility/site not registered

Patient Eligibility Findings Ineligible provider Inadequate medical record documentation Service outside of scope of project/grant OTC drug without a prescription No auditable records

Contract Pharmacy Findings Registered without a contract Contracted/dispensing but not registered Dispensing without contract Missing locations/incorrect addresses Ineligible patients Ineligible providers Dispensing to Medicaid FFS patients Oversight of contract pharmacy

Other Legal Issues Audit protocol is unpublished Audit scope exceeds authority? Notice and Hearing? Statutorily required before HRSA can require repayment on findings of diversion or duplicate discounts 42 U.S.C. § 256b(a)(5)(D) “If the Secretary finds, after audit as described in subparagraph (c) and after notice and hearing, that a covered entity is in violation of a requirement described in subparagraphs (A) or (B), the covered entity shall be liable to the manufacturer of the covered outpatient drug that is the subject of the violation in an amount equal to the reduction in the price of the drug provided under the agreement between the entity and the manufacturer under this paragraph.

What if a breach happens? Authorizing Official attests that CE will contact HRSA if there is a “material breach” Not every breach is material CE defines “material breach” for their organization and establishes process for self- disclosure

Material Breach CE’s P&Ps should define materiality threshold and process for self-disclosure to HRSA Threshold examples: X% of total 340B purchases X% of audit sample X% of total 340B inventory Will no self-correct within X months TIP: include temporal restriction…or not…

Duplicate Discount Breach Does the breach meet CE’s materiality threshold? Did the State actually get rebates on the same claims? Did the duplicate discounts occur in managed care or FFS Medicaid? Did the State provide clear guidance as to reimbursement for 340B drugs in the applicable settings?

Ignorance Is Not Bliss AO certification Disclosure better than discovery

Self-Disclosure If breach is determined to be material, CEs are required to self-disclose to HRSA and manufacturers (Remember the AO’s attestation during annual recertification?!) Opportunity to explain problem and proposed corrective actions to HRSA and manufacturers Manufacturers may request repayment

Self-Disclosure Be clear; be comprehensive; and be constructive! Templates available online However, must be tailored and strongly suggest having external review prior to submitting to the government Describe: covered entity, issue of noncompliance, impacted parties, corrective action plan, and requested OPA action TIP: implement corrective actions before or while submitting self-disclosure

Elizabeth “Issie” Karan ekaran@ftlf.com