Practice / Pharmaceutical Software Audit
Audit 02
Pharmaceutical Software Audit
The pharmacy stack: the drug file, the dispensing and inventory systems, and the tooling that sits between them and the record.
Three files decide whether a drug is billed correctly and whether it is accumulated defensibly: the charge master, the pharmacy formulary, and the drug file the accumulation system reads. They are maintained by different teams, on different schedules, for different reasons. Nothing in most organizations forces them to agree, so they drift, quietly, and the drift is only discovered downstream in a denial or an audit finding.
This audit is the reconciliation nobody owns. It is led by Koomi Hendrix, who worked the pharmacy side of this chain before she consulted on it.
What the audit covers Drug file, dispensing, inventory, informatics
- Three-way file reconciliation. The charge master, the pharmacy formulary and the accumulator drug file, read against each other. Anything present in one and absent from another becomes an exception with a name attached.
- Units. Where dispense units and billing units are converted, whether the conversion is done by the system or in somebody's head, and what the outliers say about which one it is.
- Dispensing and inventory. Whether what was purchased, what was dispensed and what was documented as administered reconcile, and how waste is recorded when they do not.
- The informatics handoff. What pharmacy informatics passes to revenue integrity and to the record system, on what trigger, and what the receiving side assumes about it.
- Exception health. Drug file mismatches, unit outliers and late charges: open volume, age, and whether anyone is actually working them.
Why this sits next to the 340B work Same records, two committees
The pharmacy software stack produces the data the 340B program is judged on. The accumulation system does not read your intentions, it reads an extract, and it makes purchase decisions against a drug file that drifts steadily away from the charge master. That is a compliance event, not a preference, and it does not announce itself. It compounds.
Organizations that fix the software stack and the program separately usually optimize the claim and disqualify the drug. We run both against one model, with one set of owners, so a finding in one can be ranked against a finding in the other. The full stage-by-stage chain sits under the 340B audit.
The Deliverable Model
What you get, and in what order.
We audit the pharmacy side of the software. The drug file, the dispensing and inventory systems, and the informatics tooling that connects them to the record. When the drug file and the charge master drift apart, the cost lands twice, once in billing and once in the 340B accumulation, and usually months after the change that caused it. We reconcile the files against each other, put a named owner on every exception, and set a cadence for checking that holds after we leave.
What you get, in order
- 01Audit Results
The findings, written to evidence-file standard rather than to slide standard. Every one carries a severity, a named owner and a due date, so your compliance and internal audit teams can use it as evidence instead of filing it as opinion.
- 02Operational Changes
What gets fixed, where, and by whom. Your team owns the daily work. We name the change, the owner, and the threshold it has to hold to, and we say plainly what each fix is worth against what it costs to make.
- 03Ongoing Audits
Scheduled re-checks at month six and month twelve to confirm the fix held. Anything still open carries forward with its age attached, so nothing quietly ages out. If the numbers did not move, that finding is the deliverable.
- 04Ongoing Support
A standing accountability call on a cadence you set. We work the open items, look at what has drifted since the last audit, and pressure-test the changes you have coming before they get built rather than after.
The Other Three
Each one runs on its own, or alongside this one.
Compliance discipline. This work follows the same HIPAA-aware, BAA-ready discipline as the rest of the NoBullStrategy practice, with PHI handled on a minimum-necessary basis and de-identified or synthetic data used wherever the work allows. A Business Associate Agreement is executed before any protected health information is accessed. NoBullStrategy does not practice medicine and does not provide legal advice; compliance, coding, and legal determinations are confirmed with your counsel and your compliance officer.
Start a Conversation
Every organization is different. That's the whole reason to talk first.
One direct conversation. We'll tell you honestly which engagement fits where you are, what the work looks like, and whether the sequencing makes sense given what you're facing. No deck, no retainer pitch, no software to sell you.