Last updated June 2020

Frequently Asked Questions

1. Registration & Account Management

How do I register an account?

When you are ready to register an account, simply select "Sign Up" in the menu bar or click "Don’t have an account?" from the Login page. The registration process includes a comprehensive onboarding module which guides new users through the entire account registration process. This process takes approximately 15 minutes.

I manage the 340B program for multiple 340B covered entities. Do I have to register each account individually?

The initial account registration process must be completed for each individual 340B covered entity because 340B contract pharmacy relationships can differ across entities. However, a user can request to submit data on behalf of multiple entities during the registration process. Following account verification, registered users can submit data for all covered entities for which they have been approved.

Can there be multiple users registered for a single account?

Yes. The initial user to register an account can invite other individuals from the same organization to register with the account. The initial registered user is set up as the account administrator and subsequent users can be granted different levels of access.

How do I deactivate a user account?

The account administrator can deactivate individual user accounts in the User module by selecting a user record and clicking "Deactivate Account". You can also submit a request to support@340besp.com with a request to "Deactivate Account."

2. Data Submission

What data do 340B covered entities submit to 340B ESP™?

340B covered entities utilize 340B ESP™ to upload 340B claims that originate from contract pharmacies. 340B covered entities may also use 340B ESP™ to upload 340B claims that originate from inhouse pharmacies such as a hospital outpatient pharmacy but these claims are not required

How will manufacturers use the data that we submit to 340B ESP™?

Data uploaded by 340B covered entities will be used exclusively to identify and resolve duplicate Medicaid and commercial rebates. Additional information on use of 340B claims data can be found in the Terms of Use agreement or downloaded here

How frequently do I upload 340B contract pharmacy claims data to 340B ESP™ and what period of claims should I upload?

340B claims data should be uploaded twice per month. To allow time for all covered entities to obtain and submit the required data, submissions should be made on or before the 1st and 16th days of each month for the prior period. For example, on or before October 1 all prescriptions identified as 340B since your last submission on September 16 should be submitted. If this is your first submission, please submit all claims from your most recent 340B report. Please note, your data submission should include all claims that were identified as 340B during this time period regardless of the date of service on the claim. Claims identified as 340B between September 1 and September 15 will likely include dates of service prior to September 1.

Email reminders are automatically generated from 340B ESP™ and covered entities can monitor claims submission status when logged in to the platform.

Can my third-party contract pharmacy claims administrator submit data on my behalf?

We encourage 340B covered entities to discuss this with their 340B contract pharmacy claims administrators. We are actively working with several TPAs to establish data submission protocols that will allow them to submit data on behalf of a covered entity. TPAs may require 340B covered entities to complete authorization forms permitting the TPA to provide 340B claims to 340B ESP™.

What claims data elements are required?

340B ESP™ utilizes Rx Number, prescribed date, fill date, NDC, quantity, pharmacy ID, prescriber ID, wholesaler invoice number and 340B covered entity ID. During the account setup process, 340B covered entities will map their data in the Data Submission tab to ensure only the required data is uploaded. Any additional data elements included in a data file selected for upload will automatically be removed prior to data submission.

Should I upload 340B claims data for all products?

340B ESP™ will automatically upload only those claims for drugs that are owned by the pharmaceutical manufacturers that utilize the platform. Prior to uploading the 340B claims data, a user can see the specific records that will be included in the data upload. Covered entities may also elect to limit their claims data files to only the relevant NDCs prior to uploading data to 340B ESP™. You can access a list of included NDCs by clicking here.

What file types can be uploaded?

340B ESP™ supports uploads of Microsoft Excel and CSV files.

How are claim reversals managed through 340B ESP™?

Claims that are initially designated as 340B but subsequently reversed by a 340B contract pharmacy or contract pharmacy administrator are collected and reversed in 340B ESP™. Reversed claims should be included in your data submissions.

3. Data Security and Technical Specifications

How does 340B ESP™ ensure the security of 340B claims data?

To keep claims data safe, 340B ESP™ is designed with multiple layers of protection, distributed across a scalable, secure infrastructure.

  • Protected health information (PHI) is hashed and de-identified with industry-standard, best-in-class secure hash algorithms. This all takes place locally in your browser (on your device) in order to de-identify the data before uploading to our servers.
  • Data files at rest are encrypted using 256-bit Advanced Encryption Standard (AES) encryption, which is one of the strongest block ciphers available.
  • 340B ESP™ uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between the 340B ESP™ web platform and our servers.
  • Two-factor authentication is available for all accounts, providing an extra layer of security at login.

The 340B ESP™ web platform is hosted in the Microsoft Azure Cloud, implementing all recommended best practices for enterprise security, access control, and data retention. To learn more about Microsoft Azure's security policies, please visit their website.

How does 340B ESP™ ensure that only employees of the 340B covered entity can register an account with the entity?

We've implemented a multi-step process to verify and authorize all covered entity employee registrations. This includes verifying a unique phone number used for 2FA (two-factor authentication) and verifying an associated organization's email address.

To confirm and identify valid registrations, you must have access to the email address provided upon registration, this address must be owned and operated by the 340B covered entity. If we are unable to match your email with our internal records or automatically verify your registration you may be required to complete our manual verification steps.

What technology specifications are required to successfully upload data to 340B ESP™?

Users will need an internet connection and access to a supported browser to successfully upload data. 340B ESP™ is compatible with most internet browsers including Microsoft Edge, Google Chrome, Safari, and Firefox. However, we strongly recommend using Google Chrome for the best user experience.

4. HIPAA and Privacy

How does 340B ESP™ protect the privacy of my patients?

Data uploaded to 340B ESP™ meets the definition of a De-identified Data Set under HIPAA. This means no actual protected health information (PHI) is collected and the data cannot be combined with other data sets to reveal the identity of a patient.

The required claims data elements include prescription number, prescribed date and date of service (fill date). Aren’t those data elements considered PHI?

The prescription number, prescribed date and date of service (or fill date) are de-identified through a HIPAA compliant hashing process known as SHA-3 hashing. An additional layer of security called a “salt” is applied prior to any data being uploaded to 340B ESP™. This process was granted an Expert Determination by Dr. Brad Malin of Privasense, LLC indicating that it meets the definition of a De-Identified Data Set under HIPAA and does not contain PHI. Additional information on this expert determination may be requested by contacting us.

What if PHI is inadvertently mapped to a non-PHI data element? For example, what if the patient name is inadvertently mapped to the Pharmacy ID field?

Prior to data being uploaded to 340B ESP™, a machine learning algorithm is applied to the data to assess the integrity of the data mapping. Inaccurate mappings are identified, and the user is alerted to remap the impacted data element(s) prior to data submission. Uploaded data is further reviewed by the 340B ESP™ team and any identified PHI will be immediately destroyed and the covered entity will be notified.

My covered entity requires that we enter into a Business Associate Agreement (BAA) with Second Sight Solutions prior to submitting data. How do I initiate that process?

Second Sight Solutions does make a standard BAA available to 340B covered entities that require a BAA be in place prior to submitting data. To request a BAA you can email baarequest@340besp.com or complete the BAA request form at https://340besp.com/baa

5. Contract Pharmacy Management

Can I submit data for some of my contract pharmacy arrangements but not others?

340B ESP™ supports the submission of data for individual contract pharmacy arrangements. This allows a 340B covered entity to submit data for certain contract pharmacies but not others. Manufacturers may adopt differing policies as to how they will manage 340B purchases for Bill To / Ship To arrangements for which a 340B covered entity is not providing data. These policies are communicated by the pharmaceutical manufacturer to 340B covered entities.

How are new contract pharmacy registrations managed through 340B ESP™?

New contract pharmacy registrations are identified on OPAIS and automatically associated with a 340B covered entity’s account in 340B ESP™. The account administrator will receive an email notification to specify whether the 340B covered entity will provide 340B claims data for that contract pharmacy arrangement.

6. Duplicate Medicaid Rebate Resolution

What happens when a pharmaceutical manufacturer identifies a duplicate Medicaid rebate using the 340B claims data we submitted?

Pharmaceutical manufacturers will work to resolve identified duplicate discounts with state Medicaid programs and/or the 340B covered entity. In general, pharmaceutical manufacturers attempt to recover duplicate Medicaid rebates from the state Medicaid programs first but some states may disallow this practice or dispute the withheld rebate with the pharmaceutical manufacturer. In these instances, pharmaceutical manufacturers may work to recover the duplicate Medicaid rebate from the 340B covered entity.

Can a 340B covered entity dispute the findings with a pharmaceutical manufacturer?

340B ESP™ identifies instances of duplicate Medicaid rebates but does not determine the root cause of the duplicate Medicaid rebate. In some instances, a third party such as a rebate claim administrator or managed Medicaid plan may have failed to pass along certain information to prevent a duplicate Medicaid rebate from being submitted to a pharmaceutical manufacturer. 340B covered entities and pharmaceutical manufacturers will need to work together in good faith to address these types of issues.

7. General

Has HRSA required 340B covered entities to submit 340B contract pharmacy claims data to 340B ESP™?

HRSA encourages 340B covered entities to work with pharmaceutical manufacturers in good faith to resolve issues of non-compliance in the 340B program. Although HRSA has not commented publicly on 340B ESP™, this platform enables 340B covered entities and pharmaceutical manufacturers to engage collaboratively and in good faith to address duplicate discounts.

Does submitting data to 340B ESP™ impact the 340B price at which covered entities purchase drugs dispensed through contract pharmacies or the reimbursement amount received from the payer?

Use of 340B ESP™ has no impact on the 340B price of any drug. Similarly, the reimbursement amount received by a 340B contract pharmacy is established by the commercial terms between the pharmacy and the payer. Use of 340B ESP™ does not change those commercial terms.

My covered entity exclusively serves patients with no form of insurance such as Medicaid, Medicare Part D or commercial insurance. Do I need to register with 340B ESP™ and submit claims data?

Covered entities that exclusively serve uninsured patients should still register at www.340besp.com. During the registration process, you will have an opportunity to complete an attestation form indicating that your covered entity does not serve patients with any form of insurance such as Medicaid, Medicare Part D or commercial insurance. Upon completing the attestation, you will be notified as to whether you will be required to submit 340B claims data for any of the pharmaceutical manufacturers utilizing 340B ESP™.

My covered entity already ensures that duplicate Medicaid rebates do not occur. Do I still have to submit 340B claims data?

Yes. 340B ESP™ is designed to address both duplicate Medicaid rebates as well Medicare Part D and commercial rebates that are ineligible due to 340B utilization. Duplicate Medicare Part D and commercial rebates occur when a 340B contract pharmacy does not notify a payer that a 340B purchased drug was dispensed to the patient. Pharmaceutical manufacturers utilizing the 340B ESP™ seek to address all types of duplicate discounts.