A pharmacy that dispenses to Medicare Part D beneficiaries can receive two different kinds of audit letters, and the letterhead often does not say which one it is. One traces its authority to the Part D plan sponsor's contract with the Centers for Medicare & Medicaid Services (CMS) and the fraud, waste and abuse program that contract requires. The other traces its authority to a PBM's own network agreement and, outside Part D, to state pharmacy audit law. Which one applies decides who can demand the records, what appeal process the pharmacy gets, and whether a state audit-protection statute the pharmacy is counting on has any force at all.
Who Holds Audit Authority Under Part D
Federal regulation puts the burden on the sponsor, not the PBM. Under 42 CFR 423.505(i)(1), a Part D sponsor keeps ultimate responsibility for complying with its CMS contract no matter which vendor actually performs the audit. In practice, a Medicare Part D audit starts with the plan sponsor, or with the PBM the plan has delegated pharmacy audits to. The pharmacy may only ever deal with the PBM's audit department, but the authority behind the letter is the sponsor's CMS contract, and the sponsor cannot point to the PBM to escape that obligation.
Federal regulation does not let a Part D sponsor point to its PBM: under 42 CFR 423.505(i)(1), the sponsor keeps ultimate responsibility for its CMS contract regardless of any relationship with a first tier, downstream, or related entity.
The Sponsor's Fraud, Waste and Abuse Program
That responsibility runs through a specific federal mandate. CMS requires every Part D sponsor to run a compliance program with a fraud, waste and abuse component, and 42 CFR 423.504(b)(4)(vi)(F) requires internal monitoring and audits, and external audits where appropriate, to evaluate the sponsor's own compliance and that of its first tier entities, a category a PBM often falls into. The pharmacy audit a PBM runs on a Part D claim is, structurally, one output of that federally mandated program, not a freestanding business review. CMS separately retains its own national contractor, the Medicare Drug Integrity Contractor (MEDIC), to investigate suspected fraud, waste, and abuse across Part D plans, not to run the routine claim reviews the sponsor's compliance program already covers.
How This Differs From a Commercial PBM Audit
Outside Part D, a PBM audit falls under the pharmacy audit integrity and transparency laws that states such as Pennsylvania have enacted, covering notice periods, extrapolation limits, and appeal rights. Those protections end where Part D claims begin. Federal law supersedes state law for Part D plans, with only two exceptions, state licensing laws and laws on plan solvency, under the preemption provision at 42 U.S.C. 1395w-112(g). A pharmacy that assumes its state's audit-notice or appeal-timeline rules apply to a claim the PBM has flagged as a Part D claim is applying the wrong rulebook. The process that actually governs is the plan sponsor's own appeal process, approved by CMS, not the state statute.
Where CMS's Own Audit Authority Reaches
CMS also audits the sponsor directly, but not the pharmacy's dispensing records the way a PBM audit does. Under 42 CFR 423.504(d)(2)(iii), CMS can audit and inspect the sponsor's books, contracts, and records that bear on its first tier or downstream providers' ability to bear financial risk, or on services performed and amounts payable under the contract. The Secretary's separate statutory audit right, at 42 U.S.C. 1395w-115(f)(1)(B), reaches the cost information a sponsor reports to CMS, not the underlying pharmacy claim. The pharmacy's own exposure, a recoupment demand, an audit appeal, or network termination, runs through the sponsor's audit function and the sponsor's own appeal process, delegated to the PBM or not.
Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.
Why Early Legal Counsel Is Critical
It is critical that pharmacies promptly retain experienced healthcare defense counsel upon receiving a Part D audit notice, document request, or recoupment demand from a plan sponsor or its PBM delegate. Early legal intervention can help determine which rulebook actually governs the claim, help avoid admissions that narrow the pharmacy's defenses later, and help preserve the pharmacy's appeal rights within the sponsor's process. Delaying legal representation until after the response deadline passes can significantly narrow these options.
How Health Law Alliance Can Help
Health Law Alliance's PBM audit defense attorneys represent pharmacies nationwide in audits run by Part D plan sponsors and their PBM delegates, and in commercial PBM audits governed by state law. If a Part D claim is at the center of your pharmacy's audit, contact Health Law Alliance's PBM audit defense attorneys for a free, confidential consultation.
