PBM audit letters are hitting mailboxes across the country, and if you have not started preparing, today is the day. We have helped pharmacies navigate hundreds of PBM audits, and the pharmacies that come out clean share one thing in common - they prepared before the letter arrived. Here is everything you need to know to get through audit season without writing a check back to a PBM.
Regulatory Update: FTC Continues PBM Transparency Push
The FTC has been turning up the heat on PBM practices, and the latest developments are worth watching. Following the 2024 interim report that highlighted concerns about PBM consolidation, pricing practices, and impacts on independent pharmacies, several states have introduced or passed legislation requiring greater PBM transparency and limiting spread pricing in Medicaid contracts.
While these changes will not help you during this audit cycle, they represent a shift in the regulatory landscape that could benefit pharmacies long-term. In the meantime, the best defense remains airtight documentation. If you can prove that every claim you submitted was dispensed as written, with valid prescriptions and proper documentation, recoupment demands become much harder for PBMs to sustain on appeal.
PBM Audit Prep: Your Complete Documentation Checklist
When a PBM audit letter arrives, you typically have 10 to 14 business days to gather and submit documentation. That is not much time if your records are scattered across multiple systems, filing cabinets, and shoebox archives. Here is what you need to have ready for every claim they review.
For each prescription: the original hardcopy or electronic prescription, the dispensing record from your pharmacy management system, the signature log showing pickup, any prior authorization documentation, and proof of delivery for mailed prescriptions.
For compound prescriptions, you also need the compounding log, ingredient invoices with lot numbers and NDCs, and your master formula record. Compound claims are audited at a much higher rate than finished dosage forms, and the documentation requirements are unforgiving.
For prescriptions where you performed a drug utilization review intervention - therapeutic substitution, generic substitution with prescriber approval, quantity adjustments - document the clinical rationale and the prescriber communication. "I called the doctor" is not documentation. A note in the patient profile with the date, time, person spoken to, and outcome is documentation.
Start pulling together a sample audit file this week, even if you have not received a letter yet. Pick 20 random claims from the last 90 days and see if you can produce complete documentation for each one. If you find gaps, fix the process now.
HIPAA Note: Sharing Records with PBM Auditors
A question that comes up during every PBM audit: can I share patient records with the PBM auditor without patient consent? The short answer is yes, but with limits. HIPAA permits disclosure of PHI for payment-related activities, which includes responding to a legitimate audit by a PBM with whom you have a contractual relationship.
However, you should only share the minimum necessary information to respond to the audit. If the auditor asks for 50 claims, do not send your entire patient file for those 50 patients. Send the prescription records, dispensing logs, and signature logs for the specific claims under review. Keep a log of exactly what you sent, when, and to whom. This protects you if there is ever a question about the scope of the disclosure.
Common Recoupment Triggers and How to Avoid Them
Based on the audits we have seen, here are the top reasons PBMs claw back money from pharmacies.
Missing or illegible prescriptions. If you cannot produce the original prescription (hardcopy or electronic), the PBM will recoup the claim. Period. Make sure your prescription image scanning is working and that images are legible. Check your scanner quality monthly.
Signature log gaps. If a patient or their representative did not sign for the prescription, many PBMs will treat it as undispensed and demand the money back. Train your staff to get a signature on every pickup, every time. For delivery prescriptions, use a delivery confirmation service that captures a signature or photo proof.
Dispensing quantity mismatches. If the claim says 90 tablets but your dispensing record shows 30, that is a recoupment. These usually result from data entry errors or refill-too-soon adjustments that were not properly documented.
DAW code errors. Dispensing a brand-name product with a DAW-0 code (no product selection indicated) when the prescriber did not specify brand is a common finding. Make sure your DAW codes accurately reflect what the prescriber ordered and what you dispensed.
Get ahead of these issues by running your own internal audit. Our PBM Audit Prep Guide walks you through the process step by step.
Quick Hits
- Pull 20 random claims and verify you can produce complete documentation for each
- Test your prescription scanner to ensure images are legible and properly archived
- Audit your signature logs for gaps - especially delivery and mail-order prescriptions
- Review compound prescription records for complete ingredient documentation
- Verify DAW codes match prescriber intent across recent dispensing records
- Create a PBM audit response folder template so you are ready when the letter arrives
Stay compliant. Stay ahead. - The Rxperts Team