340B Program self-monitoring: Diversion and duplicate discounts

Sarah Cole, CPA; Susan E. Brankin, R.Ph., 340B ACE; and Debbie M. Coronado
| 8/6/2021
340B Program self-monitoring: Diversion and duplicate discounts

Once a 340B Drug Pricing Program covered entity has demonstrated eligibility, the next areas of focus for self-monitoring are diversion and duplicate discounts. During a 340B Program integrity audit the Health Resources & Services Administration (HRSA) assesses compliance with diversion and duplicate discount expectations through transactional testing of a random and targeted sample selection of 340B drug administrations and prescriptions. HRSA audit findings in both categories have been trending downward since 2018, due in part to changes in HRSA’s audit methodology but largely as a result of increased self-monitoring efforts and improved operational structures for covered entities.

Sanctions rendered by HRSA for findings of diversion or duplicate discount are typically in the amount equivalent to the difference between the group purchasing organization (GPO) or wholesale acquisition cost (WAC) price and the 340B price. After identification of a finding, the covered entity is responsible for determining the full scope of noncompliance beyond findings noted by HRSA. All instances of noncompliance found are subject to the sanction, and entities must develop corrective action plans to prevent additional occurrences.

Self-monitoring to confirm prevention of diversion and duplicate discounts can take many forms. At a minimum, covered entities should be conducting transactional testing on a sample of 340B drug administrations and prescriptions on a routine basis. Advancements in technology and the increased use of data analytics are allowing covered entities to monitor more transactions at a greater frequency. Self-monitoring programs should be tailored to the covered entity with consideration given to transaction volumes, high-risk areas, and frequency with which monitoring efforts can occur.


Per Section 340B(a)(5)(B) of the Public Health Service Act, covered entities are prohibited from reselling or otherwise transferring a 340B covered outpatient drug to a person who is not a patient of the entity. Common examples of diversion include:

  • Dispensation of a 340B drug to an individual who is not an eligible patient of the covered entity
  • Dispensation of a 340B drug through administration or prescriptions in an area or location that is not eligible
  • Dispensation of a 340B drug that is not supported by the medical record

Assessment of the following at the time the drug was administered or prescribed is key in confirming prevention of diversion:

  • Location
  • Patient status
  • Healthcare professional
  • Responsibility of care
  • Project scope (nonhospital) for services received
  • Patient

The most common self-monitoring practice to assess compliance with diversion prevention is sample testing of 340B drug administrations and prescriptions. Recommended sample sizes range from 20 to 30 transactions monthly, per operational model, and can be narrowed each month to focus on different areas of risk. Variety in sample selection facilitates a comprehensive review of diversion prevention throughout the organization. Covered entities can optimize their self-monitoring efforts by including the following in their sample selection:

  • High-risk areas, including locations with manual documentation, billing on dispense, or clean-use areas
  • High-risk drugs, including medication given during codes, from multidose vials, or in unusual or suspect quantities
  • A variety of locations from across the organization
  • Referral prescriptions
  • Locations and drugs with the highest or lowest utilization volumes

Diversion extends beyond the patient healthcare encounter for a 340B virtual inventory. Managing the accumulation and replenishment process incorrectly could have diversion implications. The entire quantity of 340B drugs accumulated, including any drug waste, must be accounted for by auditable records demonstrating the drug was administered in its entirety to an eligible patient.

Diversion is a key area for using data analytics to complete a more comprehensive compliance review. Areas where 100% of 340B-eligible transactions can be assessed with data analytics include:

  • Location
  • Patient status
  • Responsible healthcare professional

Covered entities can confirm diversion compliance in the following ways through data analytics:

  • Compare the list of eligible healthcare professionals to the 340B-eligible transactions to confirm all drug administrations and prescriptions were the result of care provided by an eligible healthcare professional.
  • Compare the list of eligible locations to the location of the 340B-eligible transactions to confirm all locations of drug administrations and prescriptions were reimbursable to the covered entity.
  • Check patient status at the time of drug administration to confirm 340B medications were administered to outpatients.
  • Compare the quantity administered to the quantity accumulated in the 340B virtual inventory to confirm purchasing compliance.

Data analytics might not cover all components needed to prevent diversion but can provide greater insight into areas of risk or gaps in processes. In addition, data analytics can help identify systemic issues that might not be as apparent when completing a sample-based, transactional testing audit.

Sign up to receive updates on the latest healthcare industry trends, developments, and business needs.

Duplicate discounts

A duplicate discount occurs when a manufacturer provides both a 340B discount and a Medicaid rebate for the same drug.Covered entities are statutorily prohibited from causing duplicate discounts. Each state is tasked with establishing rules and guidelines for covered entities to follow in order to prevent duplicate discounts. In addition to adhering to state regulations, covered entities must accurately report on the federal Medicaid Exclusion File (MEF).

Upon enrollment in the 340B Program, covered entities must indicate for HRSA if they will use covered outpatient drugs purchased at a 340B discount for their Medicaid fee-for-service (FFS) patients (carve-in), or if drugs purchased for their Medicaid FFS population will be done through other mechanisms (carve-out). On the MEF, covered entities that carve in Medicaid FFS patients must report each Medicaid state it plans to bill and the corresponding billing number(s) that will be on the bill submitted to Medicaid. Information on the MEF applies to billing only Medicaid FFS patients, not Medicaid managed care organizations (MCO), and is applicable only for drugs administered at the covered entity and off-site locations.

Review of the MEF should occur annually, at a minimum. All billing numbers listed should be reviewed to confirm accuracy. In addition, covered entities should work with the billing department to confirm that all billing numbers, including Medicaid provider numbers (MPN) and National Provider Identifiers (NPI), used to bill Medicaid FFS (plus out-of-state Medicaid FFS) are reported on the MEF.

Evaluating the prevention of duplicate discounts can be incorporated into the sample testing for the prevention of diversion. Review of the payer at the time of the drug administration or prescription can help reveal a potential risk for duplicate discounts. Duplicate discount self-monitoring also may occur independently of diversion testing by including a sample of billing claims (UB-04s or CMS-1500s) from the covered entity and each off-site location, or a sample from each billing number, to confirm compliance with state billing requirements.

Data analytics can be used to complete a more comprehensive review of duplicate discount compliance. Areas that can be assessed on 100% of 340B-eligible transactions with data analytics include:

  • Accuracy of the billing numbers as listed on the MEF
  • Compliance with state Medicaid 340B billing rules, including modifiers and drug ingredient costs
  • Contract pharmacy payer data
  • Medicare 340B billing requirements

Many states have Medicaid FFS billing regulations that include modifiers or billing at actual acquisition cost. These same rules are extended to Medicaid MCOs in some states and should be included in the self-monitoring program. Compliance with Medicare 340B billing rules is currently not part of HRSA’s 340B Program integrity audits but is a component of 340B Program compliance that should not be overlooked.

It is important for covered entities to understand the Medicaid 340B billing requirements for any state in which they bill Medicaid for 340B drugs. Apexus, the 340B Program Prime Vendor responsible for providing educational and technical assistance to all 340B stakeholders, provides resources for state contacts and state Medicaid 340B billing requirements. Covered entities can also foster relationships with the state’s Medicaid governmental contracting department to stay up to date on the most recent Medicaid 340B regulations. Policy updates from state Medicaid agencies are typically done annually, and review of the Medicaid 340B regulations by covered entities should coincide with this timing.

Continuing the compliance journey to maintain 340B Program benefit

In conjunction with meeting eligibility criteria as outlined in the first part of this series, self-monitoring for diversion and duplicate discount prevention is a vital step on a covered entity’s compliance journey to continue providing critical healthcare services to those most in need. Covered entities should focus on building a self-monitoring plan that addresses high-risk areas and optimizes resources while attaining the best audit coverage possible. Whether through robust sample transaction testing or the use of data analytics, all covered entities must ensure they are compliant with prevention of diversion and duplicate discounts. The final article of the series will address inventory management and purchasing.


1 “Duplicate Discount Prohibition,” Health Resources & Services Administration, last reviewed July 2020, https://www.hrsa.gov/opa/program-requirements/medicaid-exclusion/index.html

Contact us

Learn more about how Crowe can provide industry-specific financial, regulatory, and technology expertise for your healthcare organization.
Sarah Cole
Sarah Cole
Healthcare Risk Consulting Leader, Office Managing Partner, St. Louis
Susan Brankin
Susan Brankin
Senior Manager, Consulting
Debbie Coronado