How Should an Independent Pharmacy Handle PBM Audits and Recoupments?

What state pharmacy audit laws limit: Florida, Minnesota, Oregon

The three statutes below were read in full for this guide, in their 2025 and 2026 editions. A pharmacy elsewhere should read its own state’s text.

• Florida, §624.491 (formerly §465.1885), for audits by a plan or anyone acting for it, including a PBM: at least 7 calendar days’ notice before an initial on-site audit; an audit period limited to “24 months after the date a claim is submitted to or adjudicated by the entity”; reimbursement of a claim retroactively denied for a clerical, typographical, scrivener’s or computer error “if the prescription was properly and correctly dispensed,” unless there is a pattern, alleged fraudulent billing or actual financial loss; and recoupment “based on actual overpayments and not according to the accounting practice of extrapolation.”
• Minnesota, §62W.09, for a PBM or anyone representing one: 14 days’ notice before an initial on-site audit; no more than 24 months back unless other law requires longer; no extrapolation unless law requires it; no dispensing fees in an overpayment except in listed cases; clerical errors not treated as fraud, “however such errors may be subject to recoupment”; no chargebacks for errors with “no actual financial harm to the patient or plan”; and no recoupment deducted from future remittances “until after the appeals process and both parties have received the results of the final audit.”
• Oregon, ORS 735.540 to 735.552, for PBMs, insurers, third party administrators, state agencies and their auditors: no audit of a claim more than 12 months after adjudication; at least 15 days’ written notice of an on-site audit; no more than one on-site audit in any 12 months; no more than 250 unique prescriptions on-site and 250 remotely in any 12 months, unless a PBM has a reasonable suspicion of fraud, waste or abuse backed by preliminary evidence it gives the pharmacy; at least 30 days to respond; no recoupment for clerical errors or errors that cause no financial harm; findings “based on identified transactions and not based on probability sampling, extrapolation”; and no charge for a disputed claim until the audit and the appeal are final.

Each law has exceptions. All three step aside for audits where fraud or willful misrepresentation is suspected or evidenced. Florida’s also excludes audits of claims paid by federally funded programs, and its Medicaid audits follow §465.188 instead, with a 1-calendar-year audit period and no extrapolation in penalties. Minnesota’s excludes audits by Minnesota health care programs, and Oregon’s excludes state audits for its medical assistance program. Which plans a state law reaches, such as a self-funded employer plan or Medicare Part D, is a question for the pharmacy’s attorney or its pharmacy services administrative organization (PSAO). This is statute text read plainly, not legal advice.

Which records to have ready before any audit

The state texts list what counts as proof, and that list doubles as a filing plan. For each item, know where it lives and who can pull it.

• The prescription, in the form it arrived. Minnesota accepts “any legal prescription,” including “faxes, e-prescriptions, or documented telephone calls from the prescriber or the prescriber’s agents.” A phone order is only as good as its note of who called and when.
• Proof of receipt. Oregon accepts a copy of a compliant prescription if the drug was picked up, delivered or mailed within 14 days of the dispensing date, point-of-sale register data showing the purchase, and “electronic beneficiary signature logs.”
• Prescriber records. Florida accepts “the written and verifiable records of a hospital, physician, or other authorized practitioner” to validate the pharmacy’s own.
• Purchase records: wholesaler and secondary-supplier invoices by NDC and date, kept at least as far back as the longest lookback the pharmacy faces. They answer an invoice audit, and they are the same proof a MAC appeal needs.
• The network contract and each version of the PBM’s provider manual, saved with its effective date. Minnesota requires a change to audit terms in a PBM contract to be disclosed at least 60 days before it takes effect.

Lookback is not retention. For Medicare Part D, 42 CFR 423.505(i) requires a plan sponsor’s contracts with its first tier, downstream and related entities (arrangements that, under §423.501, “continue down to the level of the ultimate provider” of services) to give HHS, the Comptroller General or their designees the right to audit related records for 10 years from the end of the contract period or the completion of any audit, whichever is later. How long this pharmacy keeps what is a question for its attorney or PSAO.

When an audit letter arrives: who does what, in order

One named person owns each audit from letter to final report, the owner or a lead technician, with the pharmacist reviewing anything that needs professional judgment.

• Day one: log it. PBM, plan, audit type, prescriptions listed, period covered, date received, due date and the required way of sending records.
• That week: check it against the state text and the contract, including the notice given, the date of the oldest claim, the number of prescriptions and any on-site date (all three texts bar an on-site audit in the first days of a month unless the pharmacy consents). Raise anything outside the rules with the PSAO or the attorney in writing; do not simply ignore the request.
• Pull the records claim by claim, one folder per prescription. The pharmacist checks quantity, days’ supply and directions against the prescription before anything goes out.
• Send what was asked, by the method named, before the due date, and keep a dated copy and proof of delivery. Change no record after the request arrives.
• Preliminary report: put its deadline on the calendar that day, and answer each finding on its own page with the document that answers it.
• Final report: appeal through the written process, then watch the remittances for the recoupment.

Some letters go to the attorney before anyone pulls a record: one that alleges fraud, since the state protections above step aside there; one that mentions removing the pharmacy from the network; and one whose proposed recoupment would put payroll or the next wholesaler payment at risk. An owner who would rather hand off the whole response can turn to a pharmacy attorney or an audit-assistance service, which are different jobs from an operations consultant.

How to appeal a recoupment, and on what clock

Contesting a recoupment starts at the preliminary report, while the findings can still change; the formal appeal routes and their clocks differ by state and by program:

• Florida, §624.491: the preliminary report within 120 days after the audit; 10 business days after it is delivered to produce documentation; the final report within 6 months after the pharmacy receives the preliminary one. The pharmacy may then appeal under §408.7057, the state’s provider and health plan claim dispute program, which does not review disputes about plans the state does not regulate and takes no dispute filed more than 12 months after a final determination. Florida’s Medicaid audits allow at least 10 days to produce documents and an agency appeal “without the necessity of obtaining legal counsel.”
• Minnesota, §62W.09: a written appeals process; the preliminary report within 60 days after the audit; at least 45 days to send documentation; the final report within 120 days after the preliminary report or the final appeal, whichever is later.
• Oregon, ORS 735.550: the preliminary report received within 45 days after the audit; at least 45 days to contest it; the right to resubmit a denied claim; and the final report within 60 days after the later of receipt or contest. Recoupment waits until the audit and appeal are final unless the parties agree otherwise, though future payments may be withheld when one audit’s discrepancy exceeds $40,000.

Count days the way each text does: Florida’s 10 are business days, and some clocks run from receipt of the report rather than the date printed on it. Beside each document, quote the state rule the finding runs into, such as clerical errors or dispensing fees. Where contract and statute seem to disagree, the attorney or PSAO decides.

Track recoupments by plan so the cash impact shows

A recoupment taken from a later payment arrives as a smaller deposit, and on the remittance it can sit at the payment level, among adjustments that belong to no single claim. Weekly claims reconciliation can match every claim and still miss it, so keep a recoupment log beside it, one row per recouped claim and no patient fields:

• PBM and plan (BIN, PCN and Group), the kind of plan where known, and the state law that governs the audit.
• Audit type, letter date, period covered and each deadline.
• NDC, fill date, amount paid, and the reason as the auditor wrote it.
• The amounts in the preliminary report, in the final report and after appeal.
• The remittance and date on which the money was taken, and whether that came before the appeal was final.

Each week, check open audits against their next deadline, and look for any recoupment on the week’s remittances that is not yet logged. Each month, total the log by plan: dollars paid, dollars recouped, recouped as a share of paid, and the two most frequent reasons. A deduction taken before the appeal is final, in a state whose text says it should wait, goes to the PSAO that week.

What the log shows: the plan, the drug and the reason

Illustrative example, one month. Plan A paid $60,000 and recouped $300 on three claims whose days’ supply did not match the prescription: 0.5 percent of what it paid. Plan B paid $25,000 and recouped $2,400 on four claims for one high-cost pen, each missing proof of pickup: 9.6 percent, all on one drug and one reason. Each reason points to a step upstream of the audit:

• Missing proof of pickup or delivery: the counter and the signature log.
• Days’ supply or quantity that does not match: data entry and the pharmacist’s check, including the days’ supply calculated for products dispensed by the package, such as pens, inhalers and insulin.
• Purchases short of the units billed: purchasing, and where supplier invoices are filed.
• A prescription missing a required element: intake, checked against the provider manual in force.

Put a plan’s recurring recoupments beside its below-cost claims and short-pays. Together they show what the plan paid for a drug once everything was taken back, and that page is what to bring to the PSAO before the contract renews.

When this needs no outside help, and where the Review fits

If every audit is logged, every preliminary report is answered in time, and recoupments are read by plan each month, there is nothing here to hire anyone for. An audit letter open right now belongs with the attorney, the PSAO or an audit-assistance service first.

Where the log cannot be built from the records at hand, or recoupments sit beside other money questions, the Revenue Review takes two weeks. Working from read-only, aggregate exports with no patient names, it counts recoupments by plan over twelve months beside claims paid below cost, short-pays, fees and refunds still owed, and ends in a written report the pharmacy keeps, with a ranked fix list and a 90-day plan. It does not defend audits, file appeals or give legal advice. If the numbers suggest it, the next step is a free 20-minute call, where a pharmacy that does not need the Review is told so.