A 340B contract pharmacy arrangement lets a covered entity dispense 340B-priced drugs through an outside pharmacy instead of an in-house dispensary, and every claim that moves through it carries duplicate discount risk: a manufacturer chargeback on the 340B side and a Medicaid or commercial rebate on the same unit, from the same manufacturer, for the same drug. Federal law prohibits that outcome outright. When a HRSA compliance audit, a manufacturer audit, or a PBM's own claims review finds a duplicate discount or a diversion problem at a contract pharmacy, the covered entity carries the legal exposure, not the pharmacy alone. Repayment demands, a Corrective Action Plan, and program removal can follow.
How Duplicate Discount Findings Arise
Federal law, 42 U.S.C. § 256b(a)(5)(A)(i), bars a manufacturer from providing both a discounted 340B price and a Medicaid drug rebate for the same unit of the same drug. A wholesaler buys inventory from the manufacturer and, once a covered entity purchases at the 340B price, issues a chargeback to the manufacturer for the difference. A duplicate discount happens when a payer, a state Medicaid program or a commercial plan, later collects a rebate on that same dispensed unit from the same manufacturer. HRSA's Medicaid Exclusion File tracks which covered entity sites carve in 340B drugs for Medicaid fee-for-service billing, but it covers fee-for-service claims only, not Medicaid managed care, where a growing share of contract pharmacy findings now originate.
The Covered Entity's Coordination Duty
HRSA's guidance on contract pharmacy arrangements places the compliance burden on the covered entity, not the contract pharmacy. The covered entity remains responsible for ensuring that every contract pharmacy relationship guards against diversion and duplicate discounts, and HRSA expects fully auditable records proving that oversight. HRSA recommends quarterly internal audits and one annual independent audit of every contract pharmacy used, backed by written policies covering patient eligibility review and reconciliation of dispensing, purchasing, and billing records. When a covered entity finds a diversion or duplicate discount problem on its own, HRSA's Self-Disclosure process is the mechanism for reporting and correcting it. A contract pharmacy that cannot produce clean dispensing and billing data on demand puts the covered entity's standing in the program at risk.
HRSA Audits Versus Manufacturer and PBM Reviews
Three audits can reach the same contract pharmacy claim, each asking a different question. A HRSA audit tests the covered entity's statutory compliance: patient eligibility, site registration, and the duplicate discount and diversion safeguards described above. A manufacturer audit, run under HRSA's Section 602 manufacturer audit guidelines, targets a specific product or claims pattern the manufacturer suspects is generating duplicate discounts, and moves toward financial recovery through the chargeback system rather than a Corrective Action Plan. A PBM audit of the contract pharmacy is a third, separate track: the PBM reviews claim-level accuracy under its own network contract, including the codes that identify a fill as 340B, independent of whether HRSA or the manufacturer ever opens a file.
A PBM finding that ends in a recoupment demand or a network termination notice follows the same audit appeal procedure as any other PBM audit. CVS Caremark's deadlines are documented in CVS Caremark Audit Appeals: Deadlines and Procedural Defenses. Specialty drugs draw the heaviest scrutiny across all three tracks, and the PBM-side posture on one high-cost class is in GLP-1 PBM Audits in 2026: The Enforcement Playbook. For the mechanics of a PBM's own audit letter, see How to Respond to a PBM Audit Letter: A Step-by-Step Guide.
A HRSA compliance finding and a PBM recoupment demand are separate legal problems drawn from the same claim data. The covered entity has to answer both.
Why Early Legal Counsel Is Critical
It is critical that covered entities and their contract pharmacies promptly retain experienced healthcare defense counsel upon receiving a HRSA audit notice, a manufacturer audit request, or a PBM audit letter touching 340B claims. Early legal intervention can protect the covered entity's rights, ensure appropriate responses to each reviewing party, avoid inadvertent admissions, preserve the covered entity's Self-Disclosure options, and let counsel communicate with auditors on the entity's behalf. Delaying representation can significantly affect the outcome, particularly once a finding from one audit track surfaces facts that shape the other two.
How Health Law Alliance Can Help
Health Law Alliance defends covered entities and contract pharmacies against duplicate discount and diversion findings across all three audit tracks, HRSA compliance reviews, manufacturer audits, and PBM claims audits, as part of the firm's PBM audit defense practice. The firm coordinates the covered entity's response with the contract pharmacy's own audit posture so the same claim data does not produce inconsistent findings across HRSA, the manufacturer, and the PBM. If your covered entity or contract pharmacy has received a duplicate discount or diversion audit notice, contact us for a free, confidential consultation.
