Background The 22 TCS programs covered by our review varied widely in total donations and number of scholarships awarded. For example, total donations during 2017 ranged from $854,326 in New Hampshire’s program to approximately $623 million in Florida’s largest program (see fig. 1 and app. I). Of the 17 states operating these programs, Arizona, Florida, and Pennsylvania operate the largest programs in terms of both dollars donated and number of scholarships awarded. These are also the only three states that operate multiple programs per state. Decisions about whether to develop and operate a TCS program—as well as how to structure requirements—are at the discretion of each state; there is no federal role in establishing these programs. For example, states sometimes choose to establish requirements that SGOs and schools must follow as a minimum condition for participation. Since scholarships are funded through donations rather than state appropriations, the financial impact to states from TCS programs primarily occurs through forgone revenue resulting from the associated tax credits. Various state agencies, SGOs, and participating private schools generally all play a role in administering state TCS programs, with the specific division of responsibilities varying by program. State agencies that are responsible for tax administration, education, or both, generally administer these programs. For example, in some programs, state agencies disseminate information to donors, scholarship students, or the public, and approve SGOs or private schools to participate in the program. SGOs are tax-exempt organizations that are generally responsible for managing some aspects of the donation process—such as collecting donations—as well as awarding scholarships to students. Participating private schools educate students receiving tax credit scholarships. They sometimes also facilitate donations or inform parents about TCS scholarship awards. Participating schools can vary in terms of characteristics such as their size, religious affiliation, and whether they focus on specific student populations, such as students with disabilities. In September 2018, we issued a report that described state TCS program requirements related to donations and student eligibility for programs operating at the beginning of 2018. In that report, we found that these programs offered tax credits to individuals, businesses, or both that ranged from 50 percent to 100 percent of the donation amount. We also found that most programs set limits on the amount of TCS program donations that could be made per year. In terms of eligibility, we found that TCS programs commonly determined student eligibility based on their household income, with income limits varying widely across programs. TCS Programs Generally Require Financial Audits or Reviews for Participating SGOs and Prohibit Them from Awarding Scholarships to Only One School States have established requirements that SGOs must follow as a condition of participation in their TCS programs. See figure 2 for key requirements that some states have chosen to put in place for SGOs. Financial Requirements All TCS programs have financial requirements that limit the percentage of donations that SGOs are permitted to use for non-scholarship expenses—such as staff salaries—and most also require SGOs to undergo annual financial audits or reviews. (See fig. 3.) The limit on the percentage of donated funds that SGOs are permitted to use on non-scholarship expenses ranges from 2 percent to 10 percent for 20 of the 22 programs. The other 2 programs—both in Pennsylvania— have a limit of 20 percent. About half (12) of programs also require SGOs to follow rules about how donated funds or related interest are managed and spent. For instance, South Dakota requires SGOs to spend all revenue from interest or investments on TCS scholarships. Most (19) programs require SGOs to undergo either an annual financial audit or review. Some of these programs require more extensive audits for SGOs that receive donations over a certain dollar threshold (e.g., over $1 million). Three programs require at least some SGOs to submit proof of fiscal soundness, such as a surety bond or letter of credit. For example, to insure against potential financial loss, Florida requires SGOs to submit a surety bond equal to the SGO’s unspent donations. Some programs require SGOs to take steps to guard against conflicts of interest. For example, four programs require SGOs to have a conflict of interest policy or a policy designed to prevent individual financial gain among SGO personnel. For instance, New Hampshire prohibits SGOs from awarding scholarships to children of any SGO employee or to children of any business owner whose business donates to the SGO. About a third (8) of programs prohibit SGOs and participating schools from sharing resources or personnel, while other programs do not include such prohibitions. For example, in Pennsylvania, schools are permitted to operate as SGOs and award scholarships directly to their students. In addition, TCS programs require SGOs to be recognized as tax-exempt organizations by the Internal Revenue Service (IRS), so they generally are also subject to applicable federal requirements for tax-exempt organizations, such as filing an annual information return or notice with the IRS. In addition, SGOs may be subject to applicable state laws for tax-exempt or non-profit organizations. Administrative Requirements Figure 4 shows the number of state TCS programs that had selected administrative requirements for SGOs. All programs require SGOs to register or receive state approval by, for example, submitting an application to the state or providing documentation showing the SGO is a tax-exempt organization. Slightly fewer than half (10) of programs require SGOs to follow rules about the qualifications of SGO leadership personnel. For instance, Nevada requires the SGO’s top board member to sign an affidavit stating that no member of the board of directors or SGO employee has ever been convicted of a felony, among other requirements. Nine of the programs have requirements related to marketing and fundraising practices. For instance, Louisiana requires SGOs to send the state any advertisements so state officials can review the materials. Almost all (21) programs require SGOs to report to the state the number or total dollar amount of scholarships they awarded. Also, 19 programs require SGOs to report information about the characteristics of scholarship students, such as household income or geographic location. These programs sometimes choose to require SGOs to report individual student-level information or aggregated information for all of their scholarship students combined. For example, Alabama requires SGOs to report identifying information and scholarship amounts for each student to the state. Alternatively, Georgia requires SGOs to report the number of families of scholarship recipients by income group. Scholarship Award Requirements Figure 5 shows how many programs had key requirements for SGOs related to scholarship awards. Almost all (20) programs prohibit SGOs from awarding scholarships to only one school. Some of these 20 programs require SGOs to allow students to use their scholarships at any qualified school whereas others allow SGOs to work with a subset of two or more schools. The majority of programs prohibit donors from recommending that scholarships go to specific students while fewer programs prohibit donors from directing funds to specific schools. More than half (16) of programs prohibit SGOs from allowing donors to recommend that scholarships go to specific individuals, such as students they know personally. About one-third (8) of programs prohibit SGOs from allowing donors to recommend that scholarship funds be used at a specific school. Most States with TCS Programs Require Schools to Teach Core Subjects and Meet Minimum Attendance Standards; Few Require Financial Audits or Reviews of Schools In addition to requirements for SGOs, states with TCS programs also have requirements for private schools. See figure 6 for key requirements that some states with TCS programs have chosen to put in place for schools. Some requirements were specific to schools participating in the TCS program and some requirements were for all private schools, regardless of TCS program participation. We counted programs as having a particular requirement as long as the requirement applied to at least some of the participating private schools. Academic Requirements Programs generally have one or more academic requirements for participating private schools. (See fig. 7.) About half (9) of the programs require private schools to register or be approved by the state TCS program before their students can receive TCS scholarships. For example, in Nevada private schools must register with the state by completing a form acknowledging that they will follow program requirements. Other programs, such as Georgia’s, require SGOs to determine if private schools meet program participation requirements. Separate from any requirements to register with the TCS program itself, over half (14) of the programs require participating private schools to be accredited by the state or another organization, such as a regional accreditation organization. For example, Pennsylvania requires participating private schools to be 1) licensed by the state, 2) accredited by an association approved by the state, or 3) operated by a religious institution. Private schools participating in most TCS programs are subject to requirements regarding minimum instructional time or student attendance and requirements related to curriculum content or core subjects, such as reading, mathematics, social studies, and science. These requirements may or may not be the same as requirements for all private schools in a state. For example, Nevada requires all private schools, including those participating in its TCS programs, to provide 180 days of academic instruction per year. South Carolina’s TCS program generally requires participating private schools to offer the courses required to receive a high school diploma in the state. Eleven programs require schools to give academic tests to TCS students. Of these programs, three require participating schools to administer the same test required of public school students and eight allow schools to select among multiple tests. For example, Louisiana requires participating private schools to give TCS students the same state tests in English and math that are used in public schools, whereas Florida allows participating private schools to choose from a state approved list of norm-referenced tests. These 11 programs also require schools to report TCS students’ test results to the state, parents, or other entities. For instance, one of Florida’s programs requires schools to report test results to a university selected by the state to analyze TCS students’ test scores. Administrative Requirements Participating schools are often required to ensure their teachers undergo background checks or meet minimum qualifications, and less frequently required to undergo site visits. (See fig. 8.) Most (18) programs require participating private schools to conduct background checks or fingerprinting of employees with direct, unsupervised contact with children. Additionally, 12 programs require schools to ensure teachers meet certain qualifications, such as holding a state-issued certificate or a college degree. For example, Alabama requires all private school teachers to hold teaching certificates issued by the state. Nine of the programs require private schools to permit state or other officials to conduct site visits. In the majority of these programs, site visits are a general requirement for private schools in the state or a component of state accreditation that some or all schools are required to obtain before participating in the TCS program. Across these programs, the frequency of the site visit varies. For instance, Indiana state officials are required to make random site visits to at least five percent of participating private schools each year, while Iowa requires a site visit for all private schools operating in the state at least once every five years. Financial Requirements Among the 22 programs, financial requirements for participating private schools are generally less common than academic and administrative requirements. (See fig. 9.) Most (19) programs have requirements related to student withdrawals, such as requiring schools to report or repay the scholarship when students withdraw from the school for which the scholarship was originally awarded. For example, Illinois requires schools and SGOs to prorate scholarships for students who transfer to another private school during the school year, while Louisiana requires schools to immediately notify the SGO and state if a scholarship student is no longer enrolled. Few (4) programs require schools to complete an annual financial audit or review. Among programs with such requirements, Florida requires schools that receive more than $250,000 in scholarship funds to submit the results of a financial audit to the SGO that awarded the majority of those funds. South Carolina requires all schools to include a copy of an audit or other financial review when they initially apply to participate in the program and annually afterwards. About one-fourth (5) of programs require schools to provide surety bonds or other evidence to demonstrate financial viability. For example, Louisiana requires schools that have operated for fewer than five years and will receive more than $50,000 in TCS funds to either provide a SGO with a surety bond equal to the amount of TCS funds they expect to receive during the school year or other information showing financial viability. Florida requires schools operating for fewer than three years to provide the state with a surety bond equal to the amount of scholarship funds for any quarter. States with the Largest TCS Programs Have SGOs Manage Key Program Features SGOs Manage Donations and Award Scholarships while State Agencies Administer Tax Credits in the Three States Donations and Tax Credits In the three states with the largest TCS programs—Arizona, Florida, and Pennsylvania—SGOs are generally responsible for recruiting donors while state agencies administer tax credits. (See fig. 10). SGOs generally recruit potential donors and sometimes help them apply for tax credits. SGO officials in all three states described ways they solicit donations, such as meeting with representatives from corporations to promote TCS programs or providing banners and pamphlets for private schools to display. In Arizona—where SGOs are permitted to allow donor recommendations for specific schools or students in certain programs— SGO and school officials described roles for schools or students and their families in soliciting donations. For example, family members of prospective scholarship students may encourage members of their community to donate and recommend their child or child’s school, according to officials from a SGO and a school we visited in Arizona. In addition, SGO officials we spoke with in all three states noted that they help donors navigate the process of obtaining tax credits. For example, officials from a SGO in Pennsylvania described how they can fill out the application for tax credit pre-approval as the donor’s delegate or review completed applications for errors before donors submit them to the state. State agencies administer state tax credits based on the rules of each TCS program. Specifically, five of the eight programs in the three states have a maximum total dollar limit on the amount of all scholarship tax credits that can be awarded in a year. In those five programs, the state requires donors to apply for pre-approval of the tax credits to ensure the limit has not been reached and tax credits are still available. In the Florida and Arizona programs that have such limits, state agencies consider all donor applications for tax credit pre-approval on a first come, first served basis. Pennsylvania considers returning donors for pre-approval before considering new donors (while tax credits remain). State officials in Pennsylvania and Florida described different methods for reviewing donors’ tax compliance before and after they file their taxes and claim the TCS tax credit. Specifically, the Pennsylvania Department of Revenue checks for any outstanding tax liability before approving tax credits for the TCS programs and reviews all tax returns that claim TCS credits to ensure the amount of tax credits claimed does not exceed the amount that was pre-approved. The Florida Department of Revenue reviews tax returns that claim a TCS credit to ensure the amount of tax credits used matches the approved amount that was allocated for the donor. Officials from the Arizona Department of Revenue said it does not have a separate tax compliance review process for its TCS credits. Scholarship Awards All three states established scholarship requirements while SGOs managed the scholarship awards process by determining which students are eligible for TCS scholarships, which eligible applicants will receive scholarships, and how much to allocate to scholarship recipients within program limits. In contrast, state agencies have a limited role—or no role at all—in determining the allocation of scholarships among eligible students, according to state and SGO officials in all three states. However, states may provide guidance documents to help SGOs navigate the state’s general policies for the awards process. The number of SGOs awarding scholarships varied across the three states, as did program policies for how those SGOs determine which eligible students receive scholarships. In fall 2017, Florida had two SGOs—one of which awarded 99 percent of scholarships. Meanwhile, Arizona’s four TCS programs had between 14 and 60 SGOs each and Pennsylvania’s two programs had approximately 190 and 260 SGOs each. In addition, as described in table 1, states varied in their requirements for how SGOs prioritize eligible students, the degree to which SGOs may work exclusively with a subset of schools, and whether SGOs may consider donors’ recommendations when deciding which students receive scholarships. Further, because each SGO is responsible for establishing its own procedures for awarding scholarships within program requirements, a TCS program with many SGOs could have substantial variation in how scholarships are awarded. Prioritizing eligible students: The three states provide varying levels of discretion to SGOs in how they prioritize eligible students when awarding scholarships. For example, Florida’s largest program requires SGOs to award scholarships on a first-come, first-served basis with first priority to students who previously received a scholarship, and then to students from lower-income households or who are in foster care; its other program requires SGOs to award scholarships to students on a first- come, first-served basis. Two programs in Arizona and one in Pennsylvania outline requirements for how SGOs must prioritize among eligible students, while the remaining programs do not. Further, in all four Arizona programs and both Pennsylvania programs, SGOs are permitted to set additional criteria for selecting scholarship recipients beyond requirements set by the state, as long as those criteria align with program rules and existing laws. For example, officials we spoke with at one SGO in Arizona noted that their selection committee considers written narratives from students and their parents about the student’s character and academic achievement when prioritizing eligible students, among other factors. Working with a subset of schools: State policies about partnerships between SGOs and schools can affect which students receive scholarship awards and where students can use those awards. SGOs in Florida award scholarships to students who can then use their scholarship award at any private school that qualifies to participate in the TCS program. In contrast, Arizona and Pennsylvania allow SGOs to partner with subsets of participating schools and award scholarships exclusively to students at those schools. For example, in Arizona and Pennsylvania, some SGO officials noted that the scholarships awarded through their SGO may only be used at partner schools that shared a religious affiliation with the SGO. Allowing donor recommendations: The TCS programs in the three states also had different rules on whether donors may recommend that scholarships be awarded to particular schools or students. Florida prohibits donors from making scholarship recommendations or designations for specific schools or students. In all Pennsylvania and Arizona programs, donors can recommend or designate donations for specific schools, but SGOs can take different approaches to distributing any such recommended funds. For example, one SGO in Pennsylvania sends recommended donation funds directly to the designated schools and the school decides how to distribute the scholarship funds among eligible students. In Arizona, one SGO tracks the amount of donations donors recommend for each of its partner schools and awards those funds to eligible students enrolled at those schools. Further, Arizona’s two TCS programs designed for individual donors (rather than businesses), allow donors to recommend that the funds they donate go to specific students. An official at one SGO we visited in Arizona said they provided its external scholarship award committee with information about students’ applications, including any student-specific recommendations, to inform the selection process. Pennsylvania programs do not expressly prohibit donor recommendations for specific students. In Pennsylvania, officials from one school that was also a SGO told us that they did not accept student-specific recommendations, while officials in a different SGO described how donors may not make student- specific recommendations, but may designate certain groups of students, such as children of first responders. In addition to establishing program policies regarding how eligible students are selected, the three states also have requirements regarding the amount of scholarship money that can be awarded per student, and SGO officials described different methods for determining the amount and frequency of scholarship awards for each student. Among the schools we visited the proportion of students who received TCS scholarships compared to students who did not receive TCS scholarships varied. For example, in one school in Florida, less than one percent of students received TCS scholarships and in a school in Arizona, school officials told us that about 80 percent of students receive TCS program scholarships. When awarding scholarships, officials at some SGOs we visited chose to issue a limited number of awards at the maximum allowable scholarship amount while others chose to issue scholarships to more students in smaller amounts—sometimes for shorter periods. In addition, students in Arizona and Pennsylvania may receive multiple concurrent scholarships from different SGOs, different TCS programs in the state, or both. This approach potentially increases the amount of funding students receive; however, it can also present logistical difficulties for the schools and families of scholarship recipients, according to SGO and school officials. For instance, officials at one school described wanting students to receive as much TCS funding as possible, but said it was also challenging to track the different SGO award cycles, incoming funds, and the projected impact on tuition balances for each student. As part of the scholarship award process, some SGOs we visited told us they collected information about tuition and fees at schools to ensure scholarship award amounts do not exceed school tuition, per program requirements. Costs for tuition ranged from approximately $6,000 per year to approximately $37,000 per year among the schools we visited. All Three States Require SGOs to Attest That They Will Follow Program Requirements, Submit Information on Their Operations, and Complete an Annual Financial Audit or Review To participate in TCS programs, all three states require SGOs to provide a description of some of their operating procedures and regularly report donation and scholarship information. The type of information states collect and how they determine whether SGOs are following applicable TCS program requirements varies. (See table 2.) All three states require SGOs to complete an application to participate in TCS programs, which involves signing a form attesting that the SGO will follow program requirements and providing other types of documentation. This documentation includes evidence that the SGO is recognized as tax- exempt by the IRS, descriptions of the SGO’s procedures for awarding scholarships, and other information, depending on the program. When reviewing SGO applications, state officials in all three states described how they check that all required information is included in accordance with program rules, but generally do not evaluate the content. For example, in Pennsylvania, a program official noted that the state agency checks that SGOs submit all required documents and relies on attestation statements signed by SGO officials as an essential step for certifying that SGOs will follow program requirements. In addition, state agencies also generally provide SGOs with some guidance on how to interpret program requirements in all three states. State agencies in both Arizona and Pennsylvania have developed guidance manuals for SGOs. Florida collaborates closely with SGOs to interpret program rules and develop guidance, according to SGO and state officials. In addition to application materials, all three states require SGOs to regularly submit information about donations received, scholarships awarded, and the results of financial audits or reviews. The extent to which these audits or reviews include an assessment of SGO compliance with program requirements varies. For example, in addition to financial audits, Florida also requires the state Auditor General to review SGO operations for compliance annually. According to SGO officials, the Florida Auditor General conducts file reviews and on-site visits during these compliance reviews. In Arizona, the SGO manual includes optional procedures financial auditors may use to determine if SGOs are following certain program requirements as part of their review. Pennsylvania does not require an assessment of SGOs’ compliance with program requirements as part of its annual financial audit. According to officials, states typically work with SGOs to resolve any compliance issues and state agencies rarely permanently revoke SGOs’ approval to participate in TCS programs. According to officials in Florida, no SGOs have been removed from the programs due to noncompliance. The officials said that once a SGO has been approved through the states’ initial application process it is very likely that they will be renewed each year unless a large compliance issue arises. Officials in Pennsylvania noted that they contact SGOs to clarify discrepancies in documentation and have temporarily revoked approval from a small proportion of SGOs that failed to submit required information. Officials in Arizona described one instance where a SGO was decertified due to noncompliance; officials stated that the SGO would be recertified if it resolved the compliance issues and reapplied to be a SGO. State and SGO Responsibilities for Monitoring Private Schools Varied in the Three States State officials in the three states described different approaches to overseeing participating private schools’ compliance with program requirements. Florida state officials described using a variety of monitoring activities to oversee participating private schools, while Arizona and Pennsylvania state agency officials said they do not conduct ongoing monitoring activities due to the parameters of their statutory authority. (See table 3.) Florida state officials described conducting site visits to schools during the initial application process and when they determine schools are at risk of noncompliance. They also noted their monitoring practices have led them to identify multiple issues of noncompliance at certain schools and, as a result, they have temporarily or permanently suspended those schools from receiving TCS program funds. They said the state also delegates certain monitoring activities to SGOs, such as reviewing financial audit results, following up with schools to resolve any issues resulting from those audits, and reporting those issues to the state. State and SGO officials said that SGOs in Florida may also be responsible for implementing any penalties to schools, such as adjusting scholarship payments to schools that do not meet certain reporting requirements. For all Arizona programs and one of two Pennsylvania programs, officials told us that they generally rely on SGOs to verify that schools receiving scholarship funds meet program requirements. For example, in Arizona, SGOs are responsible for determining if a school qualifies to participate in the state’s TCS programs. SGO officials we spoke to in Arizona noted they require schools to sign documents attesting that the school meets the requirements to be a qualified school. In Pennsylvania’s Educational Improvement Tax Credit Program, SGOs determine whether schools are qualified to participate and each SGO may approach this differently, according to state officials. For example, in addition to meeting the state’s criteria for participation in the program, one SGO we spoke with in Pennsylvania also required schools to be tax-exempt, have a board and budget, and share its religious affiliation. Another SGO we spoke with in Pennsylvania required that a school attest that it meets program requirements. In Pennsylvania’s other TCS program (the Opportunity Scholarship Tax Credit Program) state officials told us that they determine whether schools are qualified to participate and do not conduct subsequent monitoring activities. Agency Comments We provided a draft of this report to the Department of Education for review and comment. Education’s comments are reproduced in appendix III. Education also provided technical comments, which we incorporated as appropriate. We also provided relevant excerpts from the report to the appropriate state agencies in each state we reviewed and incorporated their technical changes as appropriate. Education did not comment on the report’s findings. Instead, it provided information about the administration’s tax credit proposal and made observations about how the scope of TCS programs covered in our report was both similar and different from educational programs that are addressed in the administration’s proposal. In its comments, Education further stated that given these scope differences, the GAO report may not fully inform the debate around the administration’s proposal. As stated in the draft report, promoting school choice options—both private and public—through a variety of spending and tax expenditure programs continues to be a topic of national debate. The purpose of this report was to examine state TCS programs that are used to fund scholarships that students can use to attend private elementary and secondary schools by describing: (1) key requirements state TCS programs have chosen to establish for SGOs, (2) key requirements for private schools participating in state TCS programs, and (3) how selected states implement TCS programs and how they assess whether SGOs and participating private schools are following key state requirements. Education stated that the draft report does not note that several TCS programs allow scholarships to be used for educational expenses beyond tuition. As stated in the draft report, some states use tax credit scholarship programs to fund preschool, career and technical education, or public school initiatives; the draft report further noted that these programs are outside the scope of this review. This report is the second of two GAO reports examining K-12 TCS programs. The prior report (GAO-18-679) discussed various ways students can use state K-12 TCS scholarships. Specifically, we reported that, as of SY 2017-2018, more than half of the programs (13 of 22) allowed students to use their scholarship money for costs like transportation and books in addition to tuition, whereas the remaining programs (9 of 22) required scholarship funds to be used for tuition only. Education asserted positive fiscal effects associated with state TCS programs and cited several studies to this end. As stated in the draft report, tax credits are a form of forgone revenue. Assessing the fiscal impact of these programs was not among the purposes of this report. Thus, we did not assess the reliability of these studies or the validity of their results. Education also commented on our decision to exclude Montana’s TCS program from the scope of this report. As noted in our report, we did not include Montana’s program because it was the subject of pending litigation at the time of our review. Finally, Education noted, as also stated in the draft report, that states and school districts have obligations under the Elementary and Secondary Education Act and the Individuals with Disabilities Education Act to make equitable services available to eligible private school students, including those who participate in TCS programs. We agree and have reported extensively on equitable services in the context of private schools in GAO-16-712 and GAO-18-94. In GAO-18-94, we recommended that Education review information provided by states related to changes in federal special education rights when a parent places a student with a disability in private school and work with the states to correct inaccurate or incorrect information. In that report, we identified some private school choice programs that were providing information that Education confirmed inaccurately described rights under the Individuals with Disabilities Education Act when a student with a disability is moved from a public to a private school. Education agreed with this recommendation – a recommendation GAO considers to be among the highest priority of recommendations we have made to the Department. However, Education has not yet fully implemented this recommendation and, as of September 2019, we found that some information Education confirmed to be inaccurate remains in several states’ private school choice program documents. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees, the Secretary of Education, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (617) 788-0580 or nowickij@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in Appendix IV. Appendix I: State Tax Credit Scholarship Program Scholarship and Donation Information of donors: businesses, individuals, or both) 1,957b (both) 15 (business) 795 (business) $1,856 88,109b (individual) $1,450 47,895b (individual) ——- (both) 286d (business) 23,411b (both) ——- (both) 6,768b,d (both) 3,054 (both) 153 (both) 79 (both) 69d (business) 71 (business) Number of students receiving of donors: businesses, individuals, or both) Average donation amount per donor ——- (both) 1,671 (business) 662 (business) 40 (business) 788d (both) ——- (business) 1,428 (both) Appendix II: Key Features of Largest Tax Credit Scholarship Programs in Arizona, Florida, and Pennsylvania The profiles in this appendix describe key features of the largest tax credit scholarship programs in Arizona, Florida, and Pennsylvania, as measured in terms of the scholarships awarded in 2017. Information in these profiles was obtained from interviews with state agency and selected scholarship granting organization (SGO) officials and state program documents, and was verified by state officials. GAO did not independently review state laws or regulations. Unless otherwise specified, program requirements are as of school year 2018-2019. Key Requirements for SGOs Financial • Limit non-scholarship spending to 10 percent of donations. Undergo annual audit or financial review depending on amount of donations received. donations. Administrative Receive state approval to operate. Ensure all promotional materials include required language. scholarship awards. Academic Follow guidelines for school curriculum or core subjects. Follow guidelines for minimum instructional time or attendance. Donations: Donors contributed over $68 million during calendar year 2017. The program is open to individual donors only (business donors may fingerprinting for staff. donate through other Arizona programs.) Financial Follow requirements if students withdraw (e.g., report or repay). Donations are eligible for 100 percent tax credits. The program does not limit annual program-wide donations. Individual donors (filing as single) were limited to $569 in tax credits during tax year 2019. Scholarship awards: 34,632 scholarships were awarded between July 1, 2017 and June 30, 2018. All K-12 students who live in Arizona and attend a private school are eligible for the program. SGOs are expected to consider financial need when prioritizing among eligible applicants. Students may receive more than one scholarship from this program and concurrently receive scholarships from other tax credit scholarship programs in the state, up to the full cost of tuition. SGOs may partner with a subset of qualified schools, such as schools with shared religious views or teaching methods. Donors may recommend that their donation fund scholarships at specific schools or be awarded to specific students (within certain parameters). 0 percent of donations in first 3 years and 3 percent afterwards. Provide a surety bond or line of credit. Maintain separate accounts for scholarship funds. Not share resources or personnel with private schools. Have a conflict of interest policy. Undergo annual financial audit. Report information about donations. Administrative Receive state approval to operate. Not have an owner or operator who recently filed for bankruptcy. Limit funds used for marketing. Report on scholarship awards. Academic Register with state. Follow guidelines for minimum instructional time or attendance. Donations: Donors contributed about $623 million during tax year 2017. The program is open to businesses (not individuals). Donations are eligible for 100 percent tax credits. Maximum allowable credit amounts per donor vary from 50 percent to Administer an approved academic test (not necessarily the test used in public schools). 100 percent of tax liability, depending on the type of business tax to which the tax credit is applied. Program-wide limit on tax credits was $698 million in state fiscal year 2017-2018. Administrative Hire teachers who meet minimum qualifications. Ensure background checks or fingerprinting for staff. Undergo state site visits. Scholarship awards: 108,098 scholarships were awarded during school year 2017-2018. Students are eligible for full scholarships if their household income level does not exceed 200 percent of the federal poverty level or if they are in foster care. Financial Undergo annual audit if receive a Students may only receive one tax credit scholarship at a time, up to $7,208 for tuition and fees, as of school year 2017-2018. given amount of scholarships. SGOs must allow students to use scholarships at any private school Provide a surety bond or line of participating in the program. credit if in operation for less than 3 years. Donors are prohibited from recommending that their donation fund scholarships at specific schools or for specific students. Follow requirements if students withdraw (e.g., report or repay). 20 percent of donations. Undergo annual audit or financial review. donations. Administrative Receive state approval to operate. Report information about scholarship awards. Academic Be accredited, licensed by the state, or a religious institution. Follow guidelines for minimum instructional time or attendance. Follow guidelines for core curriculum or academic subjects. Administrative Hire teachers who meet minimum qualifications. Ensure background checks or fingerprinting for staff. Donations: Donors contributed about $87 million during tax year 2017. The program is open to businesses, including “special purpose entities” Financial Follow requirements if students withdraw (e.g., report or repay). which allow individuals to donate to the program through the entity. Donors are eligible to receive tax credits for 75 percent of their donations if they donate for one year and tax credits for 90 percent of their donations if they donate for two consecutive years. The maximum allowable tax credit amount per donor is $750,000. The program-wide limit on tax credits was $135 million in fiscal year 2017. Donors must apply for pre-approval before claiming tax credits. Past donors may apply for credits before potential new donors apply for any remaining tax credits. Scholarship awards: 37,725 students received scholarships during school year 2017-2018. Students are eligible for scholarships if their household income level does not exceed $85,000, plus $15,608 per dependent in the household (higher for students with disabilities). Students may receive multiple tax credit scholarship at a time. Total scholarship award amount may not exceed the cost of tuition and fees. SGOs may partner with a subset of qualified schools, such as schools with shared religious views or teaching methods. Donors may recommend that their donation fund scholarships at specific schools. Donors are not prohibited from recommending scholarships to specific students. Appendix III: Comments from the Department of Education Appendix IV: Staff Acknowledgments GAO Contact: Staff Acknowledgments: In addition to the individual named above, Nagla’a El-Hodiri (Assistant Director), Barbara Steel (Analyst-in-Charge), Andrew Emmons, and Jessica L. Yutzy made key contributions to this report. Also contributing to this report were Isabella Anderson, Jeff Arkin, Deborah Bland, Lilia Chaidez, Sarah Cornetto, Caitlin Cusati, Charles Ford, Monika Gomez, Alison Grantham, Kirsten Lauber, Sheila R. McCoy, Mimi Nguyen, Corinna Nicolaou, and Michelle Philpott.


Background The 340B Program was created in 1992 following the creation of the Medicaid Drug Rebate Program and gives 340B covered entities—certain eligible hospitals, clinics, and other entities—discounts on covered outpatient drugs comparable to those made available to state Medicaid agencies. According to HRSA, which administers and oversees the 340B Program, the program’s purpose is to enable participating hospitals and other providers to stretch scarce federal resources to reach more eligible patients and provide more comprehensive services. In addition to realizing substantial savings through 340B Program price discounts— which HRSA estimates as 25 to 50 percent of the cost of drugs—covered entities can generate revenue through their participation in the 340B Program. For example, they can purchase covered outpatient drugs at the 340B Program price for all eligible patients regardless of the patients’ income or insurance status and generate revenue by receiving reimbursement from patients’ insurance that may exceed the 340B prices paid for the drugs. Covered Entities Entities are generally eligible for the 340B Program—that is, are covered entities—if they receive one of 10 federal grants or are one of six types of hospital. Hospitals must also meet additional requirements, such as being owned or operated by a state or local government, being formally granted governmental powers, or being nongovernmental. The 340B statute requires nongovernmental hospitals to be nonprofit and to have contracts with state or local governments to provide health care services to the 340B-specified low-income population. However, the requirement does not specify criteria for these contracts, such as the amount or type of services to be provided to these low-income individuals. Generally, hospitals must also meet other requirements to participate, such as treating a disproportionate number of low-income Medicare and Medicaid patients. Hospital participation in the 340B Program has more than tripled over the last decade, due, in part, to the enactment of the Patient Protection and Affordable Care Act in 2010, which expanded the types of hospitals that could qualify for the program. According to data from HRSA, in 2009, prior to the law’s enactment, there were more than 800 340B-participating hospitals, compared to more than 2,500 in 2019. The majority of participating hospitals are nongovernmental hospitals. Specifically, 1,690, or 67 percent, of the hospitals participating as of January 1, 2019 were nongovernmental hospitals. (See figure 1.) HRSA Oversight HRSA is responsible for verifying hospitals’ and other covered entities’ eligibility to participate in the 340B Program. HRSA reviews nongovernmental hospitals’ eligibility for the 340B Program at registration, recertification, and through audits. Registration. Prior to participation in the 340B Program, hospitals must register with HRSA, at which point they must self-attest to meeting the program’s eligibility requirements. Additionally, HRSA’s hospital registration instructions specify that, at the time of registration, a nongovernmental hospital must have documentation that shows it is nonprofit (such as copies of Internal Revenue Service documentation) and a copy of its contract with a state or local government to serve the 340B-specified low-income population. This documentation must be provided to HRSA upon request. During each quarterly registration period, HRSA conducts contract integrity checks for a random sample of 20 percent of newly registering nongovernmental hospitals. For the selected hospitals, HRSA requests a copy of the hospital’s contract with the state or local government, which it reviews to verify that the contract is signed by officials from both organizations, is in effect, and does not expire before program participation would begin. HRSA policy states that a hospital that cannot provide a state or local government contract when selected for a contract integrity check at registration will not be registered for the 340B Program. Recertification. To remain in the 340B Program, hospitals must annually recertify their eligibility. During recertification, hospitals are to ensure that their information (e.g. name, address, point of contact) is correct in HRSA’s internal 340B Program database and self-attest that the hospital still meets program requirements. HRSA collects documentation from the hospital if it reports changes to its name, classification (i.e., whether it is government owned or operated, delegated governmental powers, or nongovernmental), or nonprofit status. Audits. HRSA audits 200 covered entities—a combination of hospitals and federal grantees—per year. HRSA’s audits include covered entities (including hospitals) that are selected based on risk-based criteria (approximately 90 percent of the audits conducted each year), and entities that are targeted based on, for example, stakeholder allegations of noncompliance (10 percent of audits conducted). The criteria for risk- based audits include a covered entity’s changes in the volume of 340B Program drug purchases, time in the program, complexity of its program, and history of violations or allegations of noncompliance. Among other things, HRSA’s audits include assessments of each hospital’s 340B eligibility status. For a nongovernmental hospital, HRSA’s guidance indicates that auditors are expected to review the hospital’s contract with the state or local government to ensure that it is for serving the 340B-specified low-income population and is signed by both a hospital and state or local government official. Auditors are also expected to review the contract’s start and end dates to ensure that it is effective during a specific period of review. HRSA defines the audit’s period of review as the time frame beginning the first day of the audit’s sample period—a six-month period that predates and is not contiguous with the beginning of the onsite audit—and ending on the last day of the onsite audit. For example, a hospital with an onsite audit in March of 2017 may have a sample period from July 1, 2016 through December 31, 2016, which means that auditors should verify that the hospital’s contract was in effect from at least July 1, 2016 through the end of the March 2017 onsite audit. If HRSA identifies deficiencies in hospitals’ contracts, the agency may issue (1) findings of noncompliance, which are made public on HRSA’s website, or (2) areas for improvement, which are not made public. When an audit results in a finding of noncompliance, the hospital is required to submit a corrective action plan within 60 days of the audit report being finalized for HRSA’s approval. HRSA closes the audit once the hospital attests that the corrective action plan has been fully implemented, and any necessary repayments have been made to affected manufacturers. For example, if a nongovernmental hospital were unable to demonstrate that it had a contract with a state or local government when audited, HRSA policy states that the hospital would be issued a finding of noncompliance and may be subject to termination from the 340B Program for not meeting eligibility criteria. In addition, the hospital may be responsible for repayment to manufacturers for discounts it received during the period it lacked a contract. Contracts Reviewed Included Few Details on Nongovernmental Hospitals’ Obligations to Serve Low-Income Individuals Most of the contracts we reviewed between nongovernmental hospitals and state or local governments obligated the hospitals to provide health care services to low-income individuals, but they included few details about those obligations. The 340B statute requires participating nongovernmental hospitals to have state or local government contracts to provide health care services to the 340B-specified low-income population, but does not otherwise specify details for the content of these contracts. Of the 240 contracts we reviewed, 224 (93 percent) required the hospital to provide services to low-income individuals. Of these 224 contracts, 169 (75 percent) specifically mentioned providing services to the 340B-specified low-income population (low-income individuals not eligible for Medicaid or Medicare). 55 (25 percent) specified a more general obligation to provide services to individuals who are likely low-income, uninsured, or underinsured, such as enrollees in a county program for the medically indigent, inmates at a local detention center, or individuals receiving treatment through a county mental health program. Less than one-third of the contracts we reviewed defined “low-income” or included detailed requirements for the amount or type of services to be provided. Of the 224 contracts that contained an obligation to provide services to low-income individuals, 14 (6 percent) specified what was considered low income. Of these contracts, the specific income threshold varied, generally ranging from 100 percent to 400 percent of the federal poverty level. 71 (32 percent) specified the amount of services the hospitals were to provide to low-income individuals. The contracts generally defined the amount of services as a range in the cost of care the hospital was expected to provide; the amount varied by contract. For example, one contract specified that the hospital would provide $60,000 to $100,000 of services per year, while another included a range of $62 million to $85 million per year. Contracts that did not specify dollar amounts included, for example, provisions regarding the number of staff available to provide services or requirements to provide services at certain times. One such contract required a hospital to provide at least one full-time-equivalent behavioral health provider for specified sites, while another required a hospital to administer influenza vaccines at two clinics on two Fridays each year during influenza season. 53 (24 percent) identified specific types of services that hospitals were to provide, often specifying multiple categories of services. For example, one contract required a hospital, among other things, to provide inpatient and outpatient services, obstetrics, and cardiovascular surgery. Other contracts only identified a single category of service that the hospital was required to provide. For example, nine of the 53 contracts specified that the hospitals were required to provide emergency services, although hospitals that operate emergency departments are already required, as a condition of participating in Medicare, to screen, and if necessary stabilize patients who seek emergency care, regardless of their ability to pay. Additionally, four of the contracts reviewed required the provision of behavioral health services, two specified the provision of vaccinations, and one was for the evaluation and treatment of tuberculosis. 46 of the 224 contracts (21 percent) specified that state or local governments would pay hospitals for the services provided. In some cases, the contracts specified that the hospitals would be paid to provide care for low-income individuals at rates established under other programs–such as the state’s Medicaid program. Others established rates specifically for services provided to the population covered under the contract. Finally, approximately one-third of the contracts reviewed included provisions that would allow the state and local governments contracting with hospitals to ensure that the contractually required services are being provided. Specifically, 68 of the 224 contracts (30 percent) included provisions for reporting, monitoring or enforcement, as shown below in Figure 2; some contracts included more than one type of provision. Of the 68 contracts, 56 required hospitals to report information to the state or local government. Of these 56, 40 required reporting on the services provided under the contract, including types, dollar amounts, or number of services provided to certain populations, such as “medically indigent,” “uninsured persons,” and “underinsured persons.” For example, one contract required the hospital to provide the government with an annual report containing information about the value of free care provided to indigent persons, the total value of discounted care provided to uninsured patients, and the number of declined requests for free or discounted care. The remaining 16 contracts included more general reporting requirements, such as to provide copies of any reports requested by state or federal licensing, regulatory, or accrediting entities, to the state or local government. 29 contracts included provisions for governments to monitor the hospitals’ provision of care. Specifically, 10 contracts required regular reviews, with some of those at specific time intervals (e.g. annually, quarterly), while 19 contracts required that hospitals be available for periodic audits or to provide the government access, upon request, to medical records and documents which could be used to review or evaluate the services being provided under the contract. 34 contracts included enforcement mechanisms for the government to apply consequences if the hospital did not meet the terms of the agreement. For example, one contract allowed the state government to terminate the contract 90 days after providing notice of the state’s determination that the hospital was not providing sufficient services to low-income individuals. Contracts for eight hospitals provided for monetary fines or withholding of funds if hospitals were found to be in breach of the contract. HRSA’s Processes Do Not Provide Reasonable Assurance That Participating Nongovernmental Hospitals Meet 340B Program Eligibility Criteria HRSA uses self-reported data to determine whether hospitals are nonprofit without assessing whether the data are reliable for that purpose. Additionally, HRSA relies primarily on nongovernmental hospitals’ self- attestations to verify the existence of state or local government contracts, and weaknesses in the reviews of contracts it does conduct hamper the identification of potential eligibility issues. HRSA Uses Self-Reported Data That May Not Be Reliable to Assess Hospitals’ Nonprofit Status HRSA uses Medicare cost report data from CMS to determine whether hospitals are nonprofit, but these data may not be sufficiently reliable for this purpose. Specifically, HRSA relies on self-reported information from cost reports on whether hospitals operate as nonprofit, proprietary, or governmental organizations. HRSA reviews this information at registration to check that hospitals have indicated that they are nonprofit organizations. Additionally, in April 2019, HRSA began conducting quarterly checks of cost report data to identify hospitals that list themselves as proprietary for further review, as this designation could be used by for-profit, rather than nonprofit, hospitals, contrary to 340B Program eligibility requirements. HRSA officials told us that the agency has not independently evaluated the reliability of the cost report data for determining nonprofit status. Additionally, a CMS official responsible for oversight of Medicare cost reports told us that CMS does not have any formal processes to assess the reliability of the data on whether a hospital is nonprofit, proprietary, or governmental, because these data do not affect Medicare reimbursement. The official added that the question on the cost report used to collect these data was not intended to assess nonprofit status, is not clearly defined, and may not be reported accurately. For example, the cost report instructions do not include definitions of nonprofit and proprietary for providers to refer to when they are completing their cost reports. HRSA requires hospitals to maintain additional documentation, such as Internal Revenue Service forms for tax-exempt organizations or documents from the state, to demonstrate their nonprofit status, but does not collect or review this documentation if hospitals indicate that they are nonprofit on their cost reports. In August 2019, HRSA submitted a proposal to the Office of Management and Budget to require hospitals registering for the 340B Program to submit documentation supporting the hospital classification that they select during registration, which would include requiring nongovernmental hospitals to submit documentation of their nonprofit status. However, this requirement, if it goes into effect, would apply only to newly registering hospitals and would not affect the nearly 1,700 nongovernmental hospitals currently participating in the 340B Program. For those hospitals, HRSA would continue to rely on the Medicare cost report data. Relying on the self-reported data from Medicare cost reports is inconsistent with federal internal control standards related to information and communication, which state that management should use quality information to achieve the entity’s objectives, such as by obtaining relevant data, based on identified information requirements, that are reasonably free from error and bias, and that management should evaluate the data for reliability. Without ensuring that the information it uses on hospitals’ nonprofit status is reliable, HRSA cannot effectively determine if nongovernmental hospitals participating, or seeking to participate, in the 340B Program meet the statutory eligibility requirements, creating a risk that for-profit hospitals could receive discounted pricing for which they are not eligible. HRSA Primarily Relies on Hospitals’ Self-Attestations to Verify the Existence of Contracts with State or Local Governments HRSA primarily relies on self-attestations from nongovernmental hospitals to verify that they have contracts in place with state or local governments as required to participate in the 340B Program. Specifically, HRSA relies on the attestations that hospitals are required to make during registration and recertification that they meet the program’s eligibility requirements. Although HRSA requires nongovernmental hospitals to have copies of their contracts, and to provide them upon request, it does not require most hospitals to submit those contracts at either registration or recertification. Additionally, while HRSA previously required each nongovernmental hospital to submit a certification of contract form during registration that was signed by a government official and attested to the existence of a contract to serve the 340B-specified low-income population, officials said the agency stopped requiring submission of this form in July 2014. At that time, officials said HRSA initiated a process of contacting government officials directly through an online certification process to confirm that newly registering hospitals had contracts in place. However, that process was eliminated in September 2017, and HRSA no longer has a process that requires state and local government officials to confirm the existence of contracts with nongovernmental hospitals. HRSA does collect and review contracts with state or local governments for a sample of nongovernmental hospitals through its audit and contract integrity check processes, but these reviews are currently limited in number and scope. Specifically, in fiscal years 2017 and 2018, HRSA audited about 7 percent of nongovernmental hospitals per year (108 and 109 hospitals in fiscal years 2017 and 2018, respectively). Additionally, at the time of our review, HRSA conducted contract integrity checks for 20 percent of newly registering hospitals; this equated to 41 hospitals in calendar years 2017 and 2018 combined. HRSA’s August 2019 proposed information collection request, if approved, would require all newly registering nongovernmental hospitals to submit their state or local government contracts at registration. However, as previously mentioned, this new requirement would only affect newly registering hospitals and not those already participating. Consequently, for the large majority of nongovernmental hospitals already registered for the 340B Program, self-attestations made electronically at registration and recertification would remain HRSA’s sole method of verifying that hospitals have state or local government contracts as required by the 340B statute. Additionally, HRSA officials told us that when the agency does collect documents from nongovernmental hospitals through its audits or contract integrity checks, they do not review them to determine if they are contracts (i.e., mutually binding agreements to provide services or supplies in exchange for something of value). Based on our review of documentation submitted to HRSA from 258 hospitals, 18 hospitals submitted documents that did not appear to meet this common definition of a contract; examples included certification of contract forms without accompanying contracts, articles of incorporation, and descriptions of community programs. Nevertheless, these hospitals were permitted to participate in the 340B Program. HRSA’s reliance on hospitals to attest that the required contracts are in place is contrary to federal internal control standards related to information and communication, which state that management should use quality information to achieve the entity’s objectives, such as by obtaining relevant data from external sources in a timely manner based on the identified information requirements. Without a process to verify that all nongovernmental hospitals have contracts in place, HRSA does not have reasonable assurance that nongovernmental hospitals participating in, or seeking to participate in, the 340B Program have contracts with state and local governments. Consequently, this increases the risk that nongovernmental hospitals that do not have the statutorily required contracts and are thus ineligible may register for, and participate in, the program. Weaknesses in HRSA’s Contract Reviews Hamper the Identification of Potential Eligibility Issues In addition to not determining whether the documentation provided by nongovernmental hospitals during contract integrity checks and audits are contracts, weaknesses in HRSA’s reviews hamper its ability to identify and address issues that affect the hospitals’ eligibility for the 340B Program. Specifically, we identified three weaknesses: (1) contract integrity checks do not assess whether contracts require hospitals to serve the 340B-specified low-income population; (2) guidance for auditors’ review of contracts has not been consistently documented and lacks detail; and (3) HRSA allows hospitals to avoid audit findings by entering into new contracts with state and local governments while audits are being conducted. HRSA’s contract integrity checks for newly registering hospitals do not assess whether the contracts require the provision of services to the 340B-specified low-income population. HRSA’s contract integrity checks for newly registering nongovernmental hospitals are limited to verifying that contracts clearly list the names of the hospital and unit of government and have appropriate signatures and dates; procedures for conducting these checks do not instruct staff to review whether the contracts require hospitals to provide health care services to the 340B-specified low-income population, as required to participate in the 340B Program. Of the 38 contracts submitted to HRSA for contract integrity checks in 2017 and 2018, two (5 percent) did not appear to require the hospitals to serve the 340B-specified low-income population, yet HRSA allowed the hospitals to begin participating in the 340B Program. Specifically, one hospital submitted a contract with a state government that was limited to providing services to beneficiaries of the state’s Medicaid program, although nongovernmental hospitals are to have contracts to provide services to individuals who are not entitled to Medicaid benefits. The other hospital submitted an agreement with a nonprofit company for management services, including accounting and payroll services, for their hospital and nursing home facilities. To participate in the 340B Program, nongovernmental hospitals must have a contract with a state or local government to provide health care services to the 340B-specified low-income population. Thus, allowing hospitals to participate when the state or local government contracts they submitted for review do not require them to serve this population is inconsistent with HRSA’s responsibilities for oversight of the 340B Program, including ensuring that participating hospitals meet the statutory eligibility requirements. Without amending its contract integrity checks to include verifying that newly registering hospitals have contracts that meet statutory eligibility requirements, HRSA risks allowing hospitals that are not eligible, and which may not be providing services to the 340B- specified low-income population, to participate in the 340B Program. Guidance for contract reviews during audits has not been consistently documented over time and lacks detailed instructions. Although HRSA officials told us they have always expected auditors to look for a contract through which a nongovernmental hospital would be eligible for the 340B Program, we found that HRSA’s guidance for auditors has not clearly documented these expectations and lacks detailed instructions. HRSA did not document key elements to look for— signatures, dates, and a requirement to serve the 340B-specified low- income population—in its guidance for auditors until August 2018. Further, the agency has made frequent changes to its guidance and procedures. For example, between November 2017 and July 2019, HRSA modified its guidance for auditors at least six times. In addition, HRSA’s guidance states that auditors are expected to perform a “simple logic test” to determine whether contracts require the hospital to serve the 340B- specified low-income population, but HRSA has not provided any additional information about how auditors are expected to conduct such a test. The guidance also advises auditors not to “dive too deep” when reviewing contracts. Of the 202 contracts submitted by hospitals as part of HRSA’s audits that we reviewed, 11 contracts (5 percent) did not appear to require hospitals to provide care to the 340B-specified low- income population, yet HRSA allowed the hospitals to continue their participation in the program. One such contract was a consent order that stated that the state’s attorney general would defer enforcement action based on the hospital’s agreement to abide by certain medical debt collection practices, such as adopting a zero tolerance policy for abusive, harassing, oppressive, false, deceptive, or misleading language or collections conduct. Furthermore, HRSA’s procedures for audits do not require auditors to separately affirm and record their review of the dates, signatures, and services required in the contracts. Thus, HRSA has no way of knowing whether auditors have checked and verified each of these elements. In addition to the 11 contracts that did not appear to obligate the hospitals to provide health care services to the 340B-specified low-income population, our review of 202 contracts submitted to HRSA by audited hospitals found 16 contracts (8 percent) were missing one or both signatures; 15 contracts (7 percent) were missing effective dates or were expired; at least 8 contracts had dates that did not cover the audit’s period of review, which includes a 6-month sample period before the start of the audit. For at least some of these contracts, HRSA was unaware of the issues we identified; HRSA did not issue audit findings in response to any of these contracts. HRSA has taken steps to address expired contracts. Specifically, in May 2019, HRSA revised its procedures for hospital registration and contract integrity checks to include language specifying that a hospital should not be approved for registration unless a contract is currently in place and that the contract must not expire before the participation start date. In addition, HRSA officials told us that in January 2020 the agency plans to implement a quarterly check of its 340B database to identify hospitals with expired state or local government contracts. However, these efforts do not address other date-related issues such as missing effective dates, or the issues with signatures or contract service requirements. Federal internal control standards related to control activities and enforcing accountability state that agencies should (1) implement control activities through policies, such as by documenting policies in the appropriate level of detail to allow management to effectively monitor the control activity; and (2) evaluate performance and hold individuals accountable for their internal control responsibilities, such as by communicating with the service organizations contracted to perform roles about the agency’s objectives and related risks, assigned responsibilities and authorities, and the expectations of competence to enable the service organization to perform its responsibilities. Without more specific guidance for auditors’ review of contracts, and procedures requiring auditors to separately document their review of each contract element, HRSA lacks reasonable assurance that the audits are appropriately identifying deficiencies in nongovernmental hospitals’ contracts with state or local governments. As a result, some hospitals appear to be participating in the 340B Program based on contracts that are inconsistent with program requirements or HRSA’s guidance. HRSA allows audited hospitals to avoid audit findings by entering into new contracts with state and local governments while audits are being conducted. As previously noted, our review of contracts submitted to HRSA by audited hospitals found that eight hospitals provided contracts that did not appear to cover the audit’s period of review. Three of the eight hospitals entered into the contracts while the audit was ongoing. According to HRSA policy, a hospital that does not demonstrate that it had a contract for the entire audit period should be issued a finding of noncompliance and held responsible for repayment to manufacturers for any discounts received improperly during the period for which it did not have a contract. However, HRSA did not issue such findings or penalties for any of the hospitals we identified with contracts that did not cover the audit’s period of review. For example, in one case, officials said HRSA had included a finding in its draft audit report, but withdrew it when presented with a new contract with an effective date made retroactive to cover the audit’s entire period of review. in another case, a hospital that had been government-owned was sold to a private company in 2013, but did not switch its classification to nongovernmental until 2015, and did not sign a contract with a state or local government until it was audited in fiscal year 2018. The hospital’s contract, signed in 2018, included a retrospective attestation that the hospital had been providing care for the 340B-specified population since 2013. HRSA officials told us that they accept such retroactive documentation in conjunction with current, valid contracts on a case-by-case basis. As such, a hospital may avoid findings, and potential repayments to manufacturers, by asserting that it had been providing care even when a contract was not in place. To participate in the 340B Program, a nongovernmental hospital is required by statute and HRSA policy to have a contract with state or local government to serve the 340B-specified low-income population. Allowing hospitals to submit retroactive contracts after they have already begun participation in the program is inconsistent with HRSA’s responsibilities for oversight of the 340B Program, including ensuring that participating hospitals meet the statutory eligibility requirements. Further, allowing hospitals that are unable to demonstrate that they have contracts in place that cover the audit’s period of review to continue to participate in the 340B Program without consequence undermines the effectiveness of HRSA’s audit process and increases the risk that ineligible hospitals will receive discounts under the program. Conclusions The 340B Program allows hospitals and certain other providers to stretch federal resources to reach more eligible patients and provide more comprehensive services. Participation in the 340B Program also can be beneficial for hospitals and other covered entities as they can realize substantial savings on covered outpatient drugs and generate revenue on those drugs. Hospital participation in the 340B Program, and hospital purchases of discounted drugs through the 340B Program, has risen rapidly over time. However, HRSA’s current processes and procedures do not provide reasonable assurance that nongovernmental hospitals seeking to participate and benefit from the 340B Program meet the program’s eligibility requirements. Given the weaknesses in HRSA’s oversight, some hospitals that do not appear to meet the statutory requirements for program eligibility are participating in the 340B Program and receiving discounted prices for drugs for which they may not be eligible. Although HRSA has initiated some efforts to strengthen its processes for assessing hospitals’ eligibility, continued growth in the number of participating hospitals and 340B- purchased drugs highlights the need for HRSA to improve its oversight processes. This is critical to safeguarding the integrity of the 340B Program. Recommendations for Executive Action We are making the following six recommendations to HRSA: The Administrator of HRSA should ensure that the information it uses to verify nonprofit status for all nongovernmental hospitals that participate in the 340B Program is reliable—for example, by requiring and reviewing the submission of official documentation hospitals must already maintain or by ensuring the reliability of the data the agency uses. (Recommendation 1) The Administrator of HRSA should implement a process to verify that every nongovernmental hospital that participates in the 340B Program has a contract with a state or local government as required by statute. (Recommendation 2) The Administrator of HRSA should amend its contract integrity check procedures for the 340B Program to include a review of whether hospitals’ contracts with state and local governments require the provision of health care services to low-income individuals not eligible for Medicaid or Medicare as required by statute, and should provide guidance for staff to conduct these reviews. (Recommendation 3) The Administrator of HRSA should provide more specific guidance for 340B Program auditors on how to determine if nongovernmental hospitals’ contracts with state and local governments require the provision of health care services to low-income individuals not eligible for Medicaid or Medicare. (Recommendation 4) The Administrator of HRSA should revise its 340B Program audit procedures to require auditors to document their assessments of whether nongovernmental hospitals’ contracts with state and local governments are appropriately signed, cover the time periods under review, and require hospitals to serve low-income individuals not eligible for Medicaid or Medicare, such as by requiring auditors to separately affirm and record their review of each of these elements. (Recommendation 5) The Administrator of HRSA should require nongovernmental hospitals participating in the 340B Program to demonstrate that they have contracts with state or local governments in effect prior to the beginning of their audits’ periods of review and should apply consistent and appropriate consequences for hospitals that are unable to do so. (Recommendation 6) Agency Comments and Our Evaluation HHS provided written comments on a draft of this report, which are reproduced in appendix II, and technical comments, which we have incorporated as appropriate. In its written comments, HHS concurred with five of our six recommendations; it did not concur with one of them. In concurring with five of our recommendations, HHS stated that HRSA is evaluating its audit process and other program integrity efforts, and noted that HRSA has made improvements to strengthen its program integrity efforts that align with some of our recommendations. With respect to our recommendation to require auditors to document their assessments of the required elements of contracts, HHS concurred and noted that HRSA updated its audit procedures. Specifically, HRSA’s draft procedures for fiscal year 2020 audits require auditors to specify if the hospital provided a contract that includes the names and signatures for both the hospital and government agency, effective dates that cover the entire audit period, and that requires the provision of services to the 340B-specified low- income population. We are pleased that HRSA has already taken this step to implement our recommendation. To fully implement this recommendation, HRSA should incorporate these changes into its final audit procedures for fiscal year 2020. HHS also concurred with our recommendation to require nongovernmental hospitals to demonstrate that they have contracts in effect prior to the beginning of the audits’ periods of review, and to apply consistent and appropriate consequences if they do not. Also, as noted above, HRSA has updated its draft audit procedures to specify that auditors should look for effective dates that cover the entire audit period. While this is an important step, HRSA must also show that it has applied consistent and appropriate consequences when auditors find that nongovernmental hospitals did not have contracts in effect prior to the beginning of their audit periods. On a related issue, HHS expressed concern over and disagreed with our finding that HRSA allows hospitals to avoid audit findings by entering into new contracts while audits are being conducted, noting that HRSA assesses potential audit findings on a case-by-case basis to ensure that any necessary steps are taken to address issues. However, as we reported, HRSA officials have indicated that they accept retroactive contract documentation on a case-by-case basis; we continue to believe that this practice—accepting new contracts that are retroactive— effectively allows hospitals to avoid audit findings. In addition, while we agree that working with hospitals to address noncompliance is appropriate, we continue to believe that such efforts should be in addition to, not instead of, documenting noncompliance by issuing findings and applying appropriate consequences, in accordance with HRSA’s audit policies and procedures. To do otherwise undermines the integrity of HRSA’s audits, and increases the risk that ineligible hospitals will receive discounts under the program. HHS also concurred with our recommendation to ensure that the information HRSA uses to verify nonprofit status is reliable, but stated that HRSA believes that the information it uses from hospitals’ Medicare cost reports is reliable, because hospital administrators attest to the accuracy of their cost reports. However, as discussed in our report, neither HRSA nor CMS has evaluated the reliability of the cost report data for verifying nonprofit status, and a CMS official responsible for oversight of the cost reports told us that the question on the cost report is not clearly defined and may not be reported accurately. As such, we continue to believe that HRSA needs to assess the reliability of the Medicare cost report data should it continue to use those data for determining hospitals’ nonprofit status. Alternatively, HRSA could require hospitals to submit documentation of their nonprofit status, such as Internal Revenue Service documents, which HRSA acknowledged hospitals are required to maintain as part of their auditable records. HHS did not concur with our recommendation to implement a process to verify that every nongovernmental hospital that participates in the 340B Program has the statutorily required contract with a state or local government. HHS noted that it has requested authority to require hospitals registering for the 340B Program to submit documentation supporting the hospital classification that they select during registration. According to HHS, if approved, HRSA would begin collecting and reviewing contracts from all newly registering nongovernmental hospitals. However, HHS stated that HRSA does not have the resources to collect, review, and verify that every participating nongovernmental hospital has a contract with a state or local government. While we understand that verifying the existence of contracts for all participating nongovernmental hospitals would require additional effort on HRSA’s part, our review found that relying on hospitals’ attestations is not sufficient to ensure hospitals’ eligibility. Additionally, implementing a process to verify the existence of a contract does not necessarily require that HRSA collect and review contracts from every hospital. There are other potential options, such as obtaining confirmation from the state or local government that they indeed have a contract with the hospital to provide services to the 340B-specified low-income population. HHS also commented that implementing our recommendation would create a significant burden on covered entities. However, as we noted in our report, HRSA already requires hospitals to maintain copies of their state or local government contracts. Therefore, it is unclear how implementing a process to verify the existence of those contracts would represent a significant burden for nongovernmental hospitals already registered for the program. Ensuring the eligibility of covered entities that participate in the 340B Program is essential for program integrity. As such, we continue to believe that HRSA needs to take action, beyond relying on hospitals’ self-attestations, to verify that all participating nongovernmental hospitals have contracts with state or local governments that meet the statutory requirements of the program. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Administrator of HRSA, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or draperd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other major contributors to this report are listed in appendix III. Appendix I: Characteristics of the Contracts Reviewed Table 1 provides information about the 240 contracts between hospitals and state or local governments that were included in our review, including information about the type of hospital and the level of government that were parties to the contract. In at least two cases, the hospitals contracted with other health care providers who were themselves 340B Program participants, such as a community health center operated by a local health department. Officials signing on behalf of state and local governments included individuals with executive positions, such as the heads of state agencies, mayors, and county executives, but also included a city alderman, a vice-chancellor for finance at a state university health system, and a juvenile court judge. Appendix II: Comments from the Department of Health and Human Services Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Michelle Rosenberg, Assistant Director; Hannah Locke, Analyst-in-Charge; Jennie Apter; George Bogart; Kaitlin Farquharson; Matthew Green; Vikki Porter; Daniel Ries; Brienne Tierney; and William T. Woods made key contributions to this report.