What triggers a PBM audit, and what records do you need to survive one?

A PBM audit rarely starts with a tip. It starts with a claims file. Somewhere in the network, a pharmacy’s billing on a handful of measures drifts away from its peers, or a days supply stops matching a quantity, and the claim lands in a desk audit queue. The pharmacies that come out intact are not the ones with the biggest filing cabinets. They are the ones whose records answer the specific question the auditor is asking, and who know which rules protect them on which claims.

What actually triggers a PBM audit?

Most PBM audits are triggered by data screening: a pharmacy’s claims sit far outside the network norm on cost, volume or claim pattern, or a specific claim fails an internal edit after it paid. Random selection exists, and many contracts allow routine audits, but the pharmacies that get audited repeatedly are almost always outliers on a measurable dimension.

The billing patterns that flag a pharmacy

PBMs do not publish their selection models. The closest public equivalent is the screen the HHS Office of Inspector General used on Medicare Part D. In 2012 it flagged 2,637 retail pharmacies with questionable billing using eight measures, and in 2015 it flagged 1,432 retail pharmacies, about 2% nationwide, that billed $2.3 billion with extreme values. PBM analytics look at the same kinds of numbers:

• Average cost per beneficiary and per prescription, against pharmacies of similar size in the same market.
• Prescriptions per beneficiary and per prescriber, especially when a few prescribers account for most of the volume.
• Share of Schedule II and Schedule III claims.
• Share of brand claims where generics exist, which brings the DAW code into play.
• Share of refills, and refills that arrive before the prior days supply runs out.
• Excessive supply, which the OIG defined as more than 500 days of a drug inside 365 days for one patient.

Triggers you create at the counter

The second group of triggers comes from individual claims, and these are the ones a pharmacy controls:

• Days supply that does not match the quantity. Insulin pens, inhalers, eye drops and topicals are the usual cases, because the package rarely lines up with a 30-day fill.
• DAW codes without support. A DAW 1 claim needs the prescriber’s instruction on the prescription itself, not a note added at fill time.
• Billed NDCs your invoices cannot cover. A pharmacy that bills more of a high-cost NDC than it bought from a wholesaler is the clearest single audit signal there is.
• Copays not collected. Caremark’s 2026 provider manual treats failure to collect patient pay amounts as prima facie evidence of fraud, waste and abuse.
• Delivery volume. Under the same manual, a pharmacy delivering more than 20% of claims by common carrier is no longer treated as a retail pharmacy.
• Claims left open. OptumRx treats claims not reversed within 14 days as subject to audit.

What are the types of PBM audits?

There are four, and each asks for different records.

• Desk audit. A list of claims arrives by mail or portal and the pharmacy sends copies of the prescriptions, signature logs and supporting notes. This is the most common format.
• On-site audit. An auditor visits after written notice, pulls a sample of hard copies and checks the pharmacy against its contract.
• Invoice audit. The PBM compares what you bought against what you billed it for, drug by drug.
• Investigative audit. A fraud, waste and abuse referral, often with no notice, that can end in network termination rather than a recoupment.

A desk audit that turns up a pattern often becomes an on-site or invoice audit, so treat the first letter as the start of a sequence.

Which records do you need to survive a PBM audit?

The pharmacy audit checklist

A checklist that holds up is short and specific. For every claim in the sample, the auditor wants to see that a valid prescription existed, that the claim matched it, that the patient received the drug, and that you owned the drug you billed for.

1. The original prescription, complete. For controlled substances, 21 CFR 1306.05 requires the date, patient name and address, drug, strength, dosage form, quantity, directions, and the prescriber’s name, address and DEA number.
2. Prescriber clarifications, written on the prescription. A call to clarify as directed, a dose change or a DAW 1 instruction belongs on the hard copy or in the electronic record, with date and initials.
3. The days supply calculation. Write the math on anything that is not a simple tablet count: units per pen, units per day, priming, drops per mL.
4. Signature log or proof of delivery. Caremark requires a signature tied to each prescription number, the date and quantity received, and an insurance billing disclosure, kept for 10 years. Mail and delivery claims also need ship dates and tracking.
5. Purchase invoices. Wholesaler, manufacturer and pharmacy-to-pharmacy invoices for the full audit window, with NDCs that match the claims.
6. Copay collection records. Point-of-sale receipts, and statements for any balance carried on account.

In the Luxen claim audit, signature or delivery proof could not be produced for 9% of sampled pharmacy claims, which is the most avoidable finding on this list. Our medical coding reviewers check the same fields on the medical claims a pharmacy files, and the discipline is identical.

How long each record has to survive

Retention is set by the strictest rule that applies, not the shortest. The Caremark signature log, the Medicare Part D audit right and Medicaid managed care records each run 10 years, Caremark prescription records 6 years, Pennsylvania PACE records 4 years and DEA records 2 years.

The practical answer is to keep everything for 10 years. The DEA’s 2-year floor is the number pharmacies remember, and it is the wrong one to plan around once a single Part D or Medicaid plan is in the payer mix.

How does an invoice audit work?

An invoice audit adds up every unit of a drug the pharmacy bought during the audit window and subtracts every unit it billed to that PBM. If billed units exceed purchased units, the PBM recoups the difference. Two details make these audits expensive. On-hand inventory at the start of the window earns no credit, and Caremark invoice requests generally cover a 12-month period, so a large purchase made just before the window can look like a shortfall.

The other weak point is where the drug came from. Purchases from another pharmacy or a secondary source are often discounted or rejected unless the invoice is complete and the seller is licensed. We found invoice gaps tied to pharmacy-to-pharmacy purchases in 7 of 19 pharmacy billing reviews. Keep those invoices with the same care as primary wholesaler statements, and buy bulk ahead of an expected need only when the PBM has approved it.

Where do PBM recoupment dollars actually come from?

Across 19 pharmacy billing reviews, days supply errors drove 31% of recouped dollars, missing signature logs 22%, invoice shortfalls 19%, DAW and prescription documentation 14%, uncollected copays 8% and other findings 6%.

Days supply is the largest category because it is a calculation made at the counter, under time pressure, on packages that do not divide evenly. Insulin, inhalers and eye drops made up 58% of days supply findings in the Luxen claim audit.

A worked example: insulin pens at one pharmacy

Take Maple Street Pharmacy, an independent store filling about 4,500 claims a month. A patient’s prescription is one carton of insulin glargine pens, 5 pens of 3 mL at 100 units per mL, with directions of 30 units once daily. That carton holds 1,500 units. Add the 2-unit priming dose before each injection and the patient uses 32 units a day, so the carton lasts 46 days, not 30.

The claim went out as a 30-day supply and refilled every 30 days, so the patient received 12 cartons in a year when about 8 would have covered the therapy. At $412.50 a claim, the overage is 4 cartons, or $1,650. A PBM that recoups only the excess quantity takes $1,650. A PBM that recoups every affected claim in full takes all 12, or $4,950, for a patient who used every unit.

Now scale it. A desk audit samples 100 claims and finds 9 days supply errors averaging $290, a finding of $2,610. Extrapolated across the 2,400 insulin claims in a 24-month window, the same finding becomes a demand of $62,640. Florida, Minnesota, Texas, Georgia, Tennessee and Arkansas all bar extrapolation on audits their statutes cover, which is the difference between a bad week and a bad year.

What should you do in the first 14 days after an audit letter?

Pharmacy audit preparation, step by step

1. Log every deadline the day the letter arrives. Response dates in PBM letters are short, and a late response is usually treated as no response.
2. Identify the plan behind each claim. A fully insured commercial plan, a self-funded employer plan, Medicare Part D and Medicaid managed care each carry different protections.
3. Check your state’s audit statute. Notice periods, claim caps and blackout days decide whether the audit as scheduled is even valid.
4. Pull records for every claim in the sample before answering any of them. Patterns across claims are easier to explain than single claims.
5. Have a pharmacist review clinical findings. Days supply, DAW and as directed disputes are clinical judgment, and Minnesota requires a licensed pharmacist on the auditor’s side for audits that involve it.
6. Send a complete response once. Partial productions invite a second request and a wider sample.
7. Calendar the preliminary report and the appeal window. Most recoverable money is lost at this stage, not at the audit itself.

That last step is where pharmacies leave the most behind. Across all specialties, 19% of denied claims were never reworked or appealed, and pharmacy audit findings follow the same pattern. Pharmacies that appealed cut the preliminary recoupment by a median 41%. A denials and AR recovery queue that tracks appeal dates is the same tool whether the payer is a medical plan or a PBM.

Do state pharmacy audit laws protect you on every claim?

No. State pharmacy audit statutes reach the PBMs and plans the state can regulate, and two large groups of claims sit partly outside them.

The first is self-funded employer plans governed by ERISA. In Rutledge v. Pharmaceutical Care Management Association, decided December 10, 2020, the Supreme Court held 8-0 that Arkansas’s PBM reimbursement law was not preempted by ERISA, because it regulated cost without dictating plan choices. That opened the door to state PBM laws. In 2023 the Tenth Circuit then held in PCMA v. Mulready that ERISA preempts several provisions of Oklahoma’s PBM law, and that Medicare Part D preempts its any willing provider provision for Part D plans. The Supreme Court denied review on June 30, 2025. A state audit protection is strongest on fully insured commercial claims and weakest on self-funded and Part D claims.

The second is federal programs. For Part D, 42 CFR 423.505 gives HHS and the Comptroller General a right to audit downstream entities for 10 years from the end of the contract period, and Medicaid managed care carries a matching 10-year audit right. Those rights run alongside any state statute, which is one more reason to keep records for 10 years.

What are the most common PBM audit mistakes?

• Billing a carton of pens or a box of inhalers as a 30-day supply because that is what the plan allows, rather than what the package lasts.
• Writing DAW 1 on the claim without the prescriber’s instruction on the prescription.
• Waiving or deferring copays without a written collection policy.
• Buying from another pharmacy without keeping a complete invoice.
• Treating the DEA’s 2-year retention as the pharmacy’s retention policy.
• Answering a desk audit claim by claim without checking the state statute or the plan type first.
• Accepting a preliminary report without appealing findings the records support.

Several of these start at intake. Eligibility, plan type and benefit checks belong before the fill, which is the work our eligibility and prior authorization team does on the medical side.

Should audit work stay in house or go to a partner?

Most pharmacies handle desk audits in house, and that is the right call when one named pharmacist owns the response, the calendar and the appeal. Outside help splits three ways. Pharmacy audit attorneys handle investigative audits and any letter that mentions termination, because network termination can spread to other networks. Audit consultants run mock audits and prepare responses. Billing partners handle the claims that feed audits, such as the medical claims a pharmacy files beyond the PBM switch, and the rejects and appeals queue.

The cost comparison is straightforward. Fully loaded in-house billing cost 7.9% of collections for practices under $2M, against 3% to 6% of collections for outsourced billing. The real question is ownership: 42% of practice managers said nobody owns denial follow-up full time, and an audit appeal with no owner simply expires. Our pharmacy billing page covers the medical side of a pharmacy’s claims, and the pharmacy revenue cycle page covers authorizations, 340B and drug units. If you are weighing outside partners, our guide to medical billing companies lists the questions that separate them, or send us your rejects and AR report through a free billing review.

How do state pharmacy audit laws compare?

The rules differ more than most pharmacies expect: notice runs from one to two weeks, claim caps from 25 to 300, and the preliminary report deadline from 30 to 120 days. Check your own state before responding to anything.

Florida, Arkansas and Tennessee give the PBM 120 days to issue a preliminary report, Minnesota and Texas 60 days, and Georgia 30 days.

Two protections appear in most of these statutes and matter more than the deadlines: clerical errors on a properly dispensed prescription are not grounds for recouping the drug cost unless there was actual financial harm, and recoupment has to rest on the actual overpayment. Minnesota and Texas also bar paying the auditor a percentage of what it recovers.

Independent community pharmacies

Desk audits are routine here, and the findings cluster on days supply and signature logs because a small staff fills, bills and hands out the same prescription. The fix is mechanical: a signature log tied to the prescription number for every third-party claim, and the days supply math written on every pen, inhaler and drop bottle. Keep invoices from secondary sources with the same care as wholesaler statements, since invoice audits catch small stores that buy from a neighboring pharmacy during a shortage. Audit recoupments are one of several ways money leaves after payment, which our explainer on post-payment fees and true-ups on pharmacy remits sets out.

Specialty pharmacies

High-cost claims make every specialty pharmacy an outlier by default, so audits arrive on cost alone. The exposure is delivery: mail and courier claims need ship dates, tracking and a delivery confirmation, and Caremark stops treating a pharmacy as retail once more than 20% of claims ship by common carrier. Prior authorization records belong in the audit file too, because a lapsed approval on a refill reads as an unsupported claim.

Long-term care pharmacies

Facility delivery replaces the counter signature, so the delivery log becomes the proof of receipt. Prime Therapeutics requires a long-term care delivery log showing the delivery date and a signature. Short-cycle dispensing and census changes create return and reversal volume, and claims that should have been reversed after a resident left the facility are a common finding.

Oncology practices with in-office dispensing

Medically integrated dispensing puts a physician practice inside a PBM network contract, with the same audit rights as a retail store. Oral oncolytics carry high cost per claim, which flags the practice, and dose changes mid-cycle create days supply disputes. Keep the prescriber’s dose change on the prescription itself. Our oncology billing page covers the medical benefit side of the same patients.

Psychiatry and addiction treatment practices

Practices that dispense buprenorphine or other controlled substances face DEA rules alongside the PBM contract. Every prescription needs the full set of elements in 21 CFR 1306.05, Schedule III and IV prescriptions expire 6 months after issue with no more than 5 refills, and a high Schedule III share is itself a screening measure. See psychiatry billing for the visit side.

Urgent care and physician dispensing

Clinics that dispense starter packs or acute courses at discharge usually have thin documentation because the prescription and the dispense happen in one visit. Audits focus on whether a separate prescription record exists and whether the quantity matches the directions. A short dispensing log with the prescription number, quantity and patient signature closes most of the gap. See urgent care billing.