- Invoices were not sent directly from the wholesaler to the auditor
- Invoices were not from a wholesaler with National Association of Boards of Pharmacy (NABP) Drug Distributor Accreditation, formerly known as VAWD, for OptumRx
- Invoices for diabetic supplies were not purchased from an “authorized distributor” for Caremark or Express Scripts
- Invoices show product purchases were outside the audit timeframe
Another invoice audit pitfall that has become increasingly common (possibly due to the increasing number of online purchasing platforms such as RxeedTM or MatchRX) are shortages due to incomplete documentation for pharmacy-to-pharmacy purchases. While the Drug Supply Chain Security Act (DSCSA) allows such sales between pharmacies, DSCSA requires that these transactions include the pedigree (aka Transaction Statement, Transaction History, and Transaction Information or “3Ts”) if they are for general stock replenishment, but DSCSA exempts transactions that are for a specific patient need and does not require the pedigree to be communicated for those purchases.
However, be aware that Caremark’s Provider Manual section 8.05 states that if product is received from another pharmacy, the purchasing pharmacy must obtain and maintain the entire Transaction Statement, Transaction History, and Transaction Information.
Similarly, OptumRx’s 2025 Provider Manual, First Edition Version 1.1 Section B. Pharmacy audits (Audits) and Claim Reviews states “Any inter-pharmacy transfers or purchases made through intermediary third parties or marketplaces for the purpose of increasing or replenishing stock, and not made to fulfill a specific patient need for an identified patient, are subject to the requirement to obtain transaction history, transaction information, and a transaction statement for the product. If purchases were made to fulfill a specific patient need, supporting documentation must be available and provided, if requested.” It goes on to say, “A Network Pharmacy Provider may transfer inventory to alleviate a temporary shortage or for the sale, transfer, merger or consolidation of all or part of the business of a pharmacy from or with another pharmacy, whether accomplished as a purchase and sale of stock or business assets. The transfer or purchase of covered legend and non-legend products or medical supplies form another licensed pharmacy must be verified and documented as originating from a NABP Drug Distributor Accreditation and licensed drug wholesaler, to include DSCSA-compliant transaction history, information and statement.”
PAAS has seen Caremark and OptumRx auditors request copies of the transferring pharmacy’s license and original invoices (and/or pedigree information) from the transferring pharmacy’s wholesaler. While PAAS strongly opposes these policies and enforcement efforts, PBMs hold an upper hand in an audit situation and consider the Provider Manual an extension of the agreement.
For those pharmacies who choose to make pharmacy-to-pharmacy purchases (directly, or indirectly through an online platform), PAAS recommends reviewing Caremark’s documentation guidelines and using a tool to ensure all information regarding the acquisition is appropriately gathered. PAAS analysts have developed just the tool you may wish to use, the Inventory Transfer Log! This log was developed solely to help pharmacies meet the strict requirements of PBMs and PAAS analysts strongly encourage its use for those who still choose to make pharmacy-to-pharmacy purchases. Additionally, for PAAS National® FWA/HIPAA Compliance members, this new tool can be found in Appendix B of your Policy & Procedure Manual with an accompanying Policy and Procedure in Section 4.1.4
This resource guides pharmacies through elements to document regarding the seller, the product purchased, the reason for acquisition, payment information, and even product inspection. While utilization of this tool is optional, procurement without appropriate documentation will likely cause the invoice to be excluded from an auditor’s inventory count and may lead to product shortages, audit recoupment, and (potentially) contract termination.
PAAS Tips:
- Keep copies of all invoices and proof of purchases for 10 years as required by Medicare Part D retention requirements
- Refer to the July 2024 Newsline article, Diabetic Test Strip Authorized Distributors, for links to manufacturer authorized distributor lists for major diabetic test strips
- Review Section 8.05 of Caremark’s Provider Manual for more information on pharmacy-to-pharmacy transfers (available online in the Caremark pharmacy portal, log in required)
- Pharmacies should carefully weigh the pros and cons of purchasing inventory from other pharmacies (whether directly or indirectly)
- The November 2024 Newsline article, U.S. Government Alleges Counterfeit HIV Drugs Hiding in Pharmacy-to-Pharmacy Purchases, provides insight into the potential risks a pharmacy takes by obtaining medication outside of DSCSA “authorized Trading Partners”
When the Margins Are Thin, Self-Audit for the Win
It is no secret that margins on prescription medications have declined dramatically over the last few decades. Independent pharmacy owners are well aware of their less-than-favorable Pharmacy Benefit Manager (PBM) contracts, and their propensity to routinely audit. After working day in and day out to take care of the patients in your communities, auditors swoop in and use the smallest ambiguous detail on a prescription to recoup against a claim. It is easy to understand why many independent pharmacy owners, operators, and employees get a sour taste in their mouth at the sheer thought of PBMs and auditors.
To decrease the likelihood of an unfavorable audit, PAAS National® analysts recommend routinely performing self-audits. In fact, the 2024-2025 Self-Audit Newsline Series just wrapped up and all 12 articles can be used to help reduce your pharmacy’s risk.
What is a self-audit?
A self-audit is a process used to validate prescriptions, ensure claims are billed appropriately and confirm all applicable documentation is accounted for to substantiate the validity of a claim. Self-auditing and monitoring serve as effective tools for assessing adherence to pharmacy policies and procedures, along with ensuring compliance with external regulations. The primary objective of a pharmacy’s self-auditing program should be to prevent, detect and eliminate risks related to fraud, waste and abuse, while also mitigating PBM audit liability.
When should a self-audit be performed?
Self-audits should be performed on a routine basis, and the beauty of a self-audit is that it can be done at any time! It is a great activity for the less busy hours of a work week. The frequency can also be determined by the number of components you wish to audit. Some pharmacies will audit a small number of rotating items on a very regular basis while others may perform a larger self-audit of all elements they monitor on a less frequent schedule. Assigning an individual (or several) to perform these audits and creating a moderately flexible timeframe to complete this task is one way to ensure this important proactive measure does not fall by the wayside.
What items or components are worth the time to self-audit?
There are a wide range of components to consider auditing, which come down to the audit risks your pharmacy would face. Below is a table of high audit risk claims that are likely applicable to your pharmacy and may warrant a self-audit.
PAAS Tips:
Diabetic Test Strip Authorized Distributors – LifeScan Audits Continue!
Independent pharmacies continue to receive letters regarding the purchase of OneTouch® test strips, manufactured by LifeScan. We have seen two variations of these letters – one “warning” letter from LifeScan directly and a second letter demanding repayment for invoice shortages from a law firm acting on LifeScan’s behalf. Both letters contend that pharmacies submitted more claims for LifeScan’s OneTouch® diabetic test strip products to PBMs than are supported by purchase history from authorized distributors.
The warning letter is softer in tone and educates recipients about the existence of an authorized distributor network and requests that the pharmacy reviews their suppliers to confirm that they are purchasing from a secure supply chain. Letters point out that purchases made outside of the secure supply chain could mean dispensing products that are counterfeit, have been tampered with (gray market), or are not authorized for sale in the United States.
The law firm letters boldly accuse pharmacies of having an “invoice shortage” and provides spreadsheets with claims and rebate data to support their allegations. These letters threaten to harm pharmacies by withholding rebate dollars owed to PBMs and notify PBMs of the pharmacy’s “non-compliance” unless the pharmacy pays a large amount of money to make the issue “go away”.
While PAAS National® has only seen letters from LifeScan, the concept of an authorized distributor network applies to many manufacturers of OTC diabetic test strips (see list below).
Manufacturer authorized distributor lists for major diabetic test strips:
Because diabetic test strips are classified by the FDA as OTC medical devices, they fall outside of the Drug Supply Chain Security Act (DSCSA) and there is no requirement for a “pedigree” to ensure sourced product is legitimate and not stolen, counterfeit or previously dispensed (gray market). Pharmacies should take extra care when sourcing product that is advertised at a lower cost compared to primary wholesalers. Manufacturers have developed and maintained “lists” to aid supply chain partners like pharmacies.
It is also important to understand what each of the major PBMs have to say about sourcing diabetic test strips.
Finally, there are two states (California and New Jersey) that have regulations pertaining to the purchase and distribution of OTC diabetic test strips.
PAAS Tips:
Can Claims Under Audit Be Reversed?
You’re preparing for an upcoming desk audit, and while pulling the hard copies for a PAAS National® analyst to review, you notice a billing error. It’s a simple fix, like an incorrect days’ supply, so you try to reprocess the claim. However, now you’re hit with an unexpected rejection …
– the claim was too old to reprocess and is now stuck in your system as a reversed/unpaid claim! Without authorization or assistance from the insurance helpdesk, it can’t be re-billed. To avoid unnecessary stress, PAAS recommends leaving the identified billing errors as is, and discussing with your assigned PAAS analyst. Since each PBM has its own auditing processes and procedures, the steps to resolve a billing error vary.
You may be wondering, “Well, when is it okay to reverse a prescription if we’ve identified an error?” A prescription under audit should never be reversed, unless the PBM auditor has given explicit approval to do so. For claims not under audit, PAAS recommends sticking to a 30-day timeframe, as each PBM and/or Plan may have a unique billing window. If that claim is outside of 30 days, you’ll want to contact the insurance helpdesk and have them help you through the reversal and correction process.
Keep in mind that Prescription Validation Requests are an exception, as they often specifically indicate the allowance to reverse and correct a claim. You will want to be sure you are appropriately filling out the documentation provided by the PBM to indicate that the claim was reversed and rebilled.
PAAS Tips:
Proof of Patient Counseling Required!
Pharmacies are familiar with submitting copies of prescriptions, signature logs and proof of copay collection upon an audit request, but do you have documented proof of the offer to counsel? While the patient can accept or refuse counseling, it must be documented for Medicaid patients. PAAS National®® analysts often see pharmacies with these requests during Medicaid (Payment Error Rate Measurement) audits, and pharmacies must include this documentation along with their other audit materials. Additionally, proof of patient counseling, or the offer to counsel, may be required during the credentialing process for Medicaid Managed Care programs. This requirement stems from the Omnibus Budget Reconciliation Act of 1990 (OBRA ’90), as outlined in 42 CFR §456.705. OBRA ’90, along with CMS regulations, mandates that states establish patient counseling standards for Medicaid programs in order to receive federal funding. While OBRA ’90’s primary objective was to save the federal government money through improved therapeutic outcomes, it achieved this by requiring pharmacists to offer counseling, conduct prospective drug utilization reviews (ProDUR), and maintain thorough records.
PAAS Tips:
Template Forms Can Lead to Audit Problems
At a time when the workday seems to be growing ever more hectic, prescribers and pharmacies may find pre-printed prescription forms convenient; especially for medications which are frequently utilized by a prescriber for treatment. Unfortunately, many PBMs prohibit pre-printed prescription form use for various reasons.
Forms created by the pharmacy for the prescriber can be more problematic, as they may give the impression that the pharmacy is soliciting prescriptions or influencing the prescriber to choose one specific NDC over others. Cookie-cutter forms that contain only a small list of high AWP items, with each option featuring identical quantities, sig, and refills, are likely to attract PBM scrutiny.
Additionally, PAAS National® has seen pre-printed prescription forms recouped during audits when they have cascading or overly broad substitutions. For example, if a topical medication is not covered, and the form provides a blanket allowance for the pharmacy to substitute the next topical medication on the list until one is covered, it could raise concerns about the pharmacy’s [conflicted] influence in the prescribing process. These medications are often more costly than preferred alternatives and can raise red flags for audits if the pharmacy is observed submitting claims, reversing them, and quickly billing for a different product. Many PBM provider manuals have now added language explicitly requiring pharmacies to have a verbal conversation with the prescriber before making any substitutions, which would need to be proven with a clinical note documented on the prescription.
Here is a summary of the three big PBM positions:
PAAS Tips:
The Next Big Wave: Anticipating a Surge in HIPAA Compliance Audits
Desk audits, onsite audits, invoice audits…and HIPAA compliance audits?! Unfortunately every community pharmacy has some familiarity with third party payor audits, and PAAS National® audit analysts bring their expertise to guide members through the entire audit process, ensuring everything goes as smoothly as possible.
But what about HIPAA compliance audits? With a potential surge in these audits on the horizon, it is important for covered entities (i.e., pharmacies) to evaluate their HIPAA compliance policies and procedures to fortify their program.
You may ask, “Why are these audits being performed?”. The Health Information Technology for Economic and Clinical Health (HITECH) Act requires that the Department of Health and Human Services (HHS) conduct periodic HIPAA audits, submit an annual report to Congress on HIPAA compliance, and provide annual guidance on the most effective technical safeguards for meeting Security Rule requirements. The Office for Civil Rights (OCR), within HHS, is tasked with overseeing these responsibilities. To verify OCR was performing their respective duties, the Office of Inspector General (OIG) performed a review of OCR’s HIPAA compliance audit process.
According to the OIG November 2024 brief, “OCR fulfilled its requirement under the HITECH Act to perform periodic HIPAA audits. However:
OIG recommended OCR increase the volume and breadth of their audits to raise their assurance that covered entities (like pharmacies) and business associates have complied with the Security Rule. OIG stated these audits will also help OCR provide covered entities with more opportunities to strengthen their security over ePHI.
Additionally, on December 27, 2024, OCR issued a Notice of Proposed Rule Making (NPRM) to modify the HIPAA Security Rule to strengthen cybersecurity protections for ePHI. This is the first time since 2013 that OCR seeks to update the Security Rule. With the dramatic increase in cybersecurity threats, both malicious and unintentional, it seems that updates are more important now than ever. A fact sheet on the NPRM is available online.
Since HIPAA compliance audits may be in your future (along with Security Rule updates), now is a great time to evaluate your HIPAA compliance program to get a good handle on where your vulnerabilities are, what threats you have and the risk of those threats. If you’re not sure where to start, check out the PAAS FWA/HIPAA Compliance Program!
PAAS Tips:
Will Your Signature Logs Pass an Audit?
Since the beginning of the new year, PAAS National® has seen a 14% increase in audits from third-party payors (18% for onsite audits)! When collecting the requested documents for an audit, signature logs are commonplace. Invariably, the one patient who refuses to sign their name (or uses a smiley face instead) to confirm receipt of their prescriptions is selected for audit. To make matters worse, in February of 2024, OptumRx updated their Provider Manual, now stating that a missing signature is subject to full recoupment and no post audit documentation will be accepted. Consequently, questionable or missing signature logs can result in significant audit findings!
Many pharmacies have implemented a Point-of-Sale system (POS) in their pharmacies to ease the burden of storing paper signature logs and having easy access when asked to reproduce them. However, with the cost to implement and the extra costs in having an electronic system for deliveries, some pharmacies are still using both a POS system and paper signature logs for home/facility delivery. It is important that all elements are present on both the POS signature log as well as the delivery log.
PAAS Tips:
Audit Alert: Topical Nail Treatments
What do Jublia® (efinaconazole), ciclopirox (formerly Penlac®), and tavaborole (formerly Kerydin®) all have in common? Besides each being a topical solution for the treatment of onychomycosis (Jublia® and Kerydin® for toenails and Penlac® for fingernails and toenails), they also all require knowing the number of applications per bottle for calculating an accurate days’ supply. Unfortunately, manufacturers do not provide this information in the package insert, making these days’ supply calculations more difficult to ascertain.
Manufacturer guidelines for Jublia® indicate a patient should use one drop per toenail with the big toe requiring a second drop. A representative from the manufacturer responded to an inquiry from PAAS National® stating there are approximately 200 applications per 4 mL bottle. Confirm with the prescriber’s office how many nails are being treated (including if any big toes are affected), document with a clinical note, and update the patient’s label to include the clarification. If there is no indication of a big toe being treated, it will be assumed that it is not. Penlac® is similar to Jublia®; however, the manufacturer does not indicate how many applications are in each bottle. PAAS recommends using the same calculations as you would for Jublia®.
Jublia® example:
Penlac® example:
Kerydin® comes packaged in a 4 mL or 10 mL bottle. A representative from the manufacturer responded to an inquiry from PAAS stating each mL of the product contains 60 drops, therefore the 4 mL bottle has 240 drops and the 10 mL bottle has 600 drops. The representative went on to state patients should use 1-2 drops per treatment of the toe, with big toes requiring 3-4 drops per treatment. Kerydin® has the same clinical note documentation requirements as Jublia® and Penlac® regarding which toes are affected, and the clarification being added to the patient’s label.
Kerydin® example:
PAAS Tips:
Caremark Aberrant Practices and Trends – Enforcement Extends Beyond the Aberrant Product List
PAAS National® analysts have worked with numerous pharmacies who have received communications related to Caremark’s proprietary Aberrant Product List or other alleged Atypical Dispensing Patterns. These letters are driven by Caremark’s Provider Manual section 3.02.03 which was expanded in 2022 as discussed in the Newsline article, Caremark® Expands “Aberrant” Language & Restricts Bulk Purchases.
These letters fall into two different categories:
Atypical Dispensing Patterns
Communications labeled Atypical Dispensing Patterns point out pharmacy claims that are seemingly “abnormal” (relative to an unknown standard) and notify pharmacies that they are being watched. These letters are educational only with no direct call to action and should be interpreted as a warning letter to prevent future enforcement actions.
Notice of Breach
Communications labeled Notice of Breach include a list of specific claims in the previous month that have created a contract violation or “breach” that must be resolved. These letters have aggressive language and indicate that Caremark may terminate the pharmacy’s network participation unless the pharmacy cures the breach and develops/implements a written Corrective Action Plan (CAP).
Breach letters are issued almost exclusively due to the dispensing of NDCs included on Caremark’s Aberrant Product List and only when the pharmacy has crossed an arbitrary threshold of 25% (by claim count or dollar amount) within a one-month period. The NDCs on this list are generally products with a high AWP that have lower cost alternatives that could be dispensed in their place.
PAAS Tips:
The NEW Inventory Transfer Log and Why it Could Save You Big!
PAAS National® analysts have walked many pharmacies through the ins and outs of invoice audits. During our consultations with members who have their results back, the question of “Why would my invoice not be accepted?” comes up regularly. The answer to this question is multifaceted and can take some investigative work to identify the root cause. The following is a non-exhaustive list of potential issues leading to invoices not being accepted:
Another invoice audit pitfall that has become increasingly common (possibly due to the increasing number of online purchasing platforms such as RxeedTM or MatchRX) are shortages due to incomplete documentation for pharmacy-to-pharmacy purchases. While the Drug Supply Chain Security Act (DSCSA) allows such sales between pharmacies, DSCSA requires that these transactions include the pedigree (aka Transaction Statement, Transaction History, and Transaction Information or “3Ts”) if they are for general stock replenishment, but DSCSA exempts transactions that are for a specific patient need and does not require the pedigree to be communicated for those purchases.
However, be aware that Caremark’s Provider Manual section 8.05 states that if product is received from another pharmacy, the purchasing pharmacy must obtain and maintain the entire Transaction Statement, Transaction History, and Transaction Information.
Similarly, OptumRx’s 2025 Provider Manual, First Edition Version 1.1 Section B. Pharmacy audits (Audits) and Claim Reviews states “Any inter-pharmacy transfers or purchases made through intermediary third parties or marketplaces for the purpose of increasing or replenishing stock, and not made to fulfill a specific patient need for an identified patient, are subject to the requirement to obtain transaction history, transaction information, and a transaction statement for the product. If purchases were made to fulfill a specific patient need, supporting documentation must be available and provided, if requested.” It goes on to say, “A Network Pharmacy Provider may transfer inventory to alleviate a temporary shortage or for the sale, transfer, merger or consolidation of all or part of the business of a pharmacy from or with another pharmacy, whether accomplished as a purchase and sale of stock or business assets. The transfer or purchase of covered legend and non-legend products or medical supplies form another licensed pharmacy must be verified and documented as originating from a NABP Drug Distributor Accreditation and licensed drug wholesaler, to include DSCSA-compliant transaction history, information and statement.”
PAAS has seen Caremark and OptumRx auditors request copies of the transferring pharmacy’s license and original invoices (and/or pedigree information) from the transferring pharmacy’s wholesaler. While PAAS strongly opposes these policies and enforcement efforts, PBMs hold an upper hand in an audit situation and consider the Provider Manual an extension of the agreement.
For those pharmacies who choose to make pharmacy-to-pharmacy purchases (directly, or indirectly through an online platform), PAAS recommends reviewing Caremark’s documentation guidelines and using a tool to ensure all information regarding the acquisition is appropriately gathered. PAAS analysts have developed just the tool you may wish to use, the Inventory Transfer Log! This log was developed solely to help pharmacies meet the strict requirements of PBMs and PAAS analysts strongly encourage its use for those who still choose to make pharmacy-to-pharmacy purchases. Additionally, for PAAS National® FWA/HIPAA Compliance members, this new tool can be found in Appendix B of your Policy & Procedure Manual with an accompanying Policy and Procedure in Section 4.1.4
This resource guides pharmacies through elements to document regarding the seller, the product purchased, the reason for acquisition, payment information, and even product inspection. While utilization of this tool is optional, procurement without appropriate documentation will likely cause the invoice to be excluded from an auditor’s inventory count and may lead to product shortages, audit recoupment, and (potentially) contract termination.
PAAS Tips: