General
What is 340B ESP™?
340B ESP™ supports manufacturers’ contract pharmacy and in-house policies by enabling covered entities to make contract pharmacy designations, apply for wholly owned contract pharmacy exemptions and submit 340B claims data.
How is 340B ESP™ different from Beacon?
340B ESP™ supports manufacturers’ contract pharmacy and in-house policies by enabling covered entities to make contract pharmacy designations, apply for wholly owned contract pharmacy exemptions and submit 340B claims data.
Beacon Rebate Model enables 340B covered entity access to 340B pricing through a direct discount payment made upon receipt of eligible claims data. Beacon MFP provides near real time visibility into MFP rebate status as well as access to good faith inquiry tools.
Has HRSA required 340B covered entities to submit 340B contract pharmacy claims data to 340B ESP™?
HRSA encourages 340B covered entities to work with pharmaceutical manufacturers in good faith to resolve issues of non-compliance in the 340B program. Although HRSA has not commented publicly on 340B ESP™, this platform enables 340B covered entities and pharmaceutical manufacturers to engage collaboratively and in good faith to address duplicate discounts.
Does submitting data to 340B ESP™ impact the 340B price at which covered entities purchase drugs dispensed through contract pharmacies or the reimbursement amount received from the payer?
The 340B price is provided to covered entities at the point of sale in a chargeback model, and the submission of claims data to 340B ESP™ occurs after 340B pricing has been provided. The reimbursement amount received by a 340B contract pharmacy is established by the commercial terms between the pharmacy and the payer and is distinct from the use of 340B. Use of 340B ESP™ does not change those commercial terms. Some manufacturers may require the submission of claims data for access to 340B pricing at certain pharmacies
My covered entity exclusively serves patients with no form of insurance such as Medicaid, Medicare Part D or commercial insurance. Does my covered entity need to register with 340B ESP™ and submit claims data?
Covered entities that exclusively serve uninsured patients should still register at www.340besp.com. During the registration process, you will have an opportunity to complete an attestation form indicating that your covered entity does not serve patients with any form of insurance such as Medicaid, Medicare Part D or commercial insurance. Upon completing the attestation, you will be notified as to whether you will be required to submit 340B claims data for any of the pharmaceutical manufacturers utilizing 340B ESP™.
My covered entity already ensures that duplicate Medicaid rebates do not occur. Does my covered entity still have to submit 340B claims data?
Covered entities that exclusively serve uninsured patients should still register at www.340besp.com.
340B ESP™ Account Creation
How does my covered entity register a 340B ESP™ account?
Covered entities can register a 340B ESP™ account by navigating to https://340besp.com/register. The registration process requires you provide your contact information, select your covered entity, and authorize your registration. Visit 340B ESP™ Support’s registration resources in the Help Desk to learn more.
Does 340B ESP™ enable access to multiple 340B covered entities from a single ESP account?
Each 340B covered entity must be registered in ESP. Once a covered entity is registered, the entity can be added to an account. Users on the account will then have access to the covered entity. An account can accommodate multiple covered entities. For security purposes, a covered entity can only be registered to a single account and registering users must undergo account verification before being approved to join the account.
Can multiple users be registered for a single account?
Once your covered entity is registered with 340B ESP, you can invite other individuals from the same covered entity to register under the account. The initial registered user is set up as the account administrator and subsequent users can be granted different levels of access. Visit ESP Support’s navigation resources in the Help Desk to learn more about inviting additional users.
Does 340B ESP™ enable deactivation of user accounts?
The account administrator can deactivate individual user accounts in the User module by selecting a user record and clicking “Deactivate Account”. You can also submit a request to [email protected] with a request to “Deactivate Account.”
What information is required to register my covered entity with ESP?
To register an ESP account, you will need to provide basic contact information including an email address associated with the covered entity being registered. Once authorized, you will be asked to agree to 340B ESP’s Terms of Use and Privacy Policy. After the account is verified, 340B ESP™ Support will send an email inviting you to create credentials to access the 340B ESP™ account.
Contract Pharmacy Management
How does my covered entity know if it is subject to a pharmaceutical manufacturer’s policy?
Covered entities and their affiliates are encouraged to review all available manufacturer policies from the Resources page. Any active contract pharmacies in HRSA may be subject to a manufacturer’s policy.
How does my covered entity designate a contract pharmacy on ESP?
Covered entities can designate a contract pharmacy by visiting the designations page at https://340besp.com/designations or through their Entity profile when logged in to 340B ESP.Why is my covered entity unable to see the contract pharmacy from the designations page or the Entity profile?
340B ESP’s contract pharmacy database is driven by HRSA. HRSA designations update on a quarterly basis. If your covered entity has just submitted a contract pharmacy to HRSA, it may not yet be active. ESP only displays active retail contract pharmacies for a covered entity to designate. Once the retail contract pharmacy is active in HRSA (this means the ‘Begin Date’ in HRSA is either today or in the past for the contract pharmacy), your covered entity will be able to designate this retail contract pharmacy in ESP.
When attempting a designation and a manufacturer’s policy is applying a 40-mile geo-restriction, contract pharmacies that fall outside of the 40-mile radius will not be available to select.If my covered entity changed the entity type, does my covered entity have to make any changes to the contract pharmacy designations or HINs?
If the covered entity type has changed, you will need to re-designate all contract pharmacy relationships. This can be done through the designations form or through the Entity profile. Similarly, your HINs will also need to reflect the change. HIN updates can be made through HIBCC. Utilize the 340B ESP™ Support resource on updating a HIN to learn more.If my covered entity is exempted from a policy, does my covered entity still have to designate?
Covered entities should review manufacturer policies to determine if designations are required. If your covered entity has lost access to pricing, but is exempted from the policy, you should consult with your wholesaler on pricing access.My covered entity just registered a contract pharmacy in HRSA, can my covered entity designate a contract pharmacy, submit a wholly owned application, and/or submit data?
340B ESP™ utilizes HRSA to determine if a contract pharmacy is active. Your covered entity is not able to designate, apply for a wholly owned exemption or submit data for a contract pharmacy prior to it becoming active. Once the contract pharmacy is active in HRSA, your covered entity will be able to perform a designation, submit an application, or upload claims data depending on the manufacturer policy.Can my covered entity upload data for some of my contract pharmacy arrangements but not others?
340B ESP™ supports the submission of data for individual contract pharmacy arrangements. This allows a 340B covered entity to submit data for certain contract pharmacies but not others. Manufacturers may adopt differing policies as to how they will manage 340B purchases for Bill To / Ship To arrangements for which a 340B covered entity is not providing data. These policies are communicated by the pharmaceutical manufacturer to 340B covered entities.
How are new contract pharmacy registrations managed through 340B ESP™?
New contract pharmacy registrations are identified on OPAIS and automatically associated with a 340B covered entity’s account in 340B ESP™. Once a registered contract pharmacy is listed as Active in HRSA OPAIS, it will populate for the covered entity in the Entity profile or the designations form. Existing contract pharmacy designations may undergo verification by the covered entity. through the 340B ESP platform depending on a manufacturer's policy.
Data Submissions
What data does my covered entity need to submit to 340B ESP™?
340B ESP™ supports the collection of 340B claims as dictated by the pharmaceutical manufacturer policy. Covered entities should review manufacturer policies on the Resources page to learn more about what data may be required.
How does a pharmaceutical manufacturer use the 340B claims data submitted to 340B ESP?
The 340B ESP™ platform supports manufacturers’ contract pharmacy policies and will continue to do so by enabling covered entities to make contract pharmacy designations, apply for wholly owned contract pharmacy exemptions and submit 340B claims data.
Data uploaded to 340B ESP™ may be used to identify duplicate Medicaid, Medicare, TriCare and commercial payer rebates that are not eligible for reimbursement. Additional information on use of 340B claims data can be found in the Terms of Use agreement available here.How frequently can my covered entity upload claims data to 340B ESP™?
Covered entities can submit 340B claims data to ESP as soon as claims are qualified as 340B eligible by the covered entity or its TPA. Covered entities should ensure that 340B qualified claims submitted to ESP are fully audited by their administrator and have been replenished against.
Covered entities should review manufacturer policies on the Resources page to ensure they submit claims data in a timely manner.Can a third-party contract pharmacy claims administrator submit data on my covered entity’s behalf?
340B ESP™ encourages 340B covered entities to discuss claims submissions with their 340B contract pharmacy claims administrators. 340B ESP™ enables direct submissions by a third-party on behalf of the covered entity through a software development kit (SDK). A third-party may first require 340B covered entities to complete an authorization that permits their covered entity to provide 340B claims to 340B ESP™. For more information on setting up an SDK, reach out to [email protected]Should my covered entity upload 340B claims data for all products?
340B ESP™ will only collect claims for the products that are subject to a pharmaceutical manufacturer’s policy. Claims provided for NDCs that are not subject to a manufacturer’s contract pharmacy policy are omitted automatically. Prior to uploading the 340B claims data, you can preview the specific records that will be included in the data submission. Please ensure each 340B ID and its affiliated dispensing contract pharmacy ID is present for each claim row.
Prior to attaching your data file, covered entities may also elect to limit their data file to only those NDCs in scope of a pharmaceutical manufacturer’s contract pharmacy policy. You can access a list of NDCs in the 340B ESP™ Help Desk here.
What file types does 340B ESP™ support?
340B ESP™ supports uploads of Microsoft Excel and CSV files.
How are claim reversals submitted and processed in 340B ESP™?
340B ESP™ supports the collection of claims that are initially designated as 340B but subsequently reversed. In the event that a previously submitted and validated claim must be reversed, covered entities should submit the same claim detail with a negative unit amount. Reversed claims should be included in your data submissions.
What claims data should my covered entity submit if my covered entity currently does not have access to 340B pricing at its contract pharmacies for a particular pharmaceutical manufacturer?
Covered entities may submit claims that have been qualified as 340B eligible even if a replenishment order has not yet been placed for those claims. Once 340B pricing is restored for a specific contract pharmacy, the covered entity may then place a replenishment order for those qualified claims that adhere to a pharmaceutical manufacturer's lookback policy.
If a covered entity is unable to submit 340B qualified claims due to limitations in a contract pharmacy administrator's software, the entity should submit the most recent 340B claims data available. 340B ESP™ will evaluate historical 340B claims data submissions according to the specifics of each pharmaceutical manufacturer's policy in determining whether the claims submission is sufficient for purposes of restoring access to 340B pricing.
What fields are collected as part of pharmacy claim submissions?
The below outlines the pharmacy fields collected in ESP. Any additional data elements included in a data file selected for upload will automatically be removed prior to data submission.
Field | Data Type | Description |
Contracted Entity ID* | Alpha numeric ID that may contain dashes-- starts with 2 or 3 letters | The 340B ID of the covered entity where the prescription originated. If the 340B ID contains a suffix, this must be included. |
Date of Service* | Standard Date Formats | The date the patient filled their prescription. Please include only the date, as time stamps will flag an error. |
Date Prescribed* | Standard Date Formats | The date the prescriber wrote the prescription. Please include only the date, as time stamps will flag an error |
NDC* | Numeric, 11 digits, may contain up to 4 leading zeros | The 11-digit National Drug Code which indicates the manufacturer, product, and commercial package size - note that this field must have 11 digits so please include zero padding. |
Prescriber ID** | Numeric, 10 digits, never starts with a leading zero | The unique public ID for the prescribing physician. Accepted IDs include the NPI and DEA ID. |
Prescriber ID Qualifier** | Numeric | Indicates the type of unique ID provided. A value of "01" indicates NPI, "12" indicates DEA. |
Quantity* | Numeric | The number of units in the prescription. |
Rx Number* | Numeric, may contain leading zeros | The native (unmodified) prescription number for the prescription as generated by the pharmacy. |
Service Provider ID* | Numeric, 10 digits, never starts with a leading zero | The unique public ID for the dispensing pharmacy. Accepted IDs include the NPI, DEA, NCPDP, and Medicaid ID. |
Service Provider ID Qualifier** | Numeric | The type of unique ID provider. "01" for NPI, "05" for Medicaid, "07" for NCPDP, and "12" for DEA. |
Wholesaler Invoice Number | Numeric | The invoice number assigned by the wholesaler for the replenishment order made by the 340B covered entity. If the claim relates to multiple wholesaler invoices, all invoice numbers should be reported, delimited by commas. |
Payer BIN** | Alpha numeric, may contain leading zeros | The bank identification number of the primary payer on the prescription. |
Payer PCN** | Alpha numeric, may contain leading zeros | Processor Control Number. Identifier used to determine which processor will handle a prescription drug claim. |
Ship to Date | Standard Date Formats | Date when the drug was shipped to the Ship To location. |
Ship to Location | Numeric | NPI, DEA, or NCPDP of the pharmacy where the drug was physically shipped. |
340B Account Number | Alpha numeric | Account number assigned by the wholesaler and used for the purchase. |
Product Serialization Number | Numeric | Unique ID assigned to the package shipped from the manufacturer to the wholesaler. |
Fill Number | Numeric | Indicates the number of times the prescription has been filled as of the current fill. For example, a value of 2 indicates that the prescription has been filled twice and the current fill is the second one. |
*Indicates a required field for all 340B ESP™ submissions regardless of NDC.
**Indicates a field that may be required depending on the manufacturer. Please review the manufacturer policies in the Resources page to learn more.
10. What fields are collected as part of medical claim submissions?
The below outlines the medical fields collected in ESP. Any additional data elements included in a data file selected for upload will automatically be removed prior to data submission.
Field | Data Type | Description |
340B ID* | Alpha/Numeric | The unique identification number provided by HRSA to the 340B covered entity. |
Claim Number* | Alpha/Numeric | The unique claim number identifying the claim. |
Claim Line Number* | Numeric | Identifies an individual line number on a claim. Line numbers distinguish distinct services that are submitted on the same claim. |
Date of Service* | Standard date formats | Date on which the medication was administered to the patient. |
HCPCS Code | Alpha/Numeric | The five digit HCPCS code corresponding to the medication administered. For drugs billed using a non-specific or miscellaneous HCPCS code (e.g., A9270, J3490), please leave this field blank. |
HCPCS Code Modifier | Alpha/Numeric | Modifier to the HCPCS code. Up to four modifier codes may be entered for the same claim line. |
Health Plan Name* | Alpha/Numeric | Name of the patient's primary health insurance plan. Examples include Medicare Part B, MediCal, Aetna POS, etc. If the patient is uninsured or a cash payer, mark “CASH” in this field. If no health plan information is recorded, mark “NONE” in this field. |
Health Plan ID* | Alpha/Numeric | The identifier code of the patient's primary health insurance plan. If the patient is uninsured or a cash payer, mark “CASH” in this field. If no health plan information is recorded, mark “NONE” in this field. |
NDC-11* | Numeric – 11 digits | The NDC-11 of the medication administered to the patient. |
Rendering Physician ID | Numeric – 10 digits | The NPI of the healthcare provider who rendered or supervised the care reported on the claim. |
Quantity* | Numeric | The quantity of medication administered to the patient. If a specific (non-miscellaneous) HCPCS code with CMS-defined billing units is reported, quantity must reflect the CMS-defined billable units for that HCPCS code. If no HCPCS code is reported, quantity must reflect standardized billing units as defined by NCPDP for the NDC-11. |
Unit of Measure | Alpha/Numeric | Either HCPCS code or UOM is required. If no specific (non-miscellaneous) HCPCS code is reported, UOM must be reported, and it must be consistent with standardized billing units as defined by NCPDP for the NDC-11. |
Service Provider ID* | Numeric – 10 digits | The NPI of the healthcare entity where the patient received the medication administration. For example, this could be the NPI of a hospital outpatient surgery center or the NPI of an outpatient infusion center. |
Wholesaler Invoice Number | Numeric | The invoice number assigned by the wholesaler for the replenishment order made by the 340B covered entity. |
*Indicates a required field
**Entities must provide either an HCPCS code or a Unit of Measure to submit; claims without either or contain both cannot be submitted
Data + Encounter Submissions
What are Data + Encounter submissions?
Data + Encounter submissions include the 340B qualified dispense or administration plus the associated healthcare encounter visit information.
What does Pharmacy Data + Encounter include?
A Pharmacy Data + Encounter claim is a prescription claim originating from a retail, mail-order or a specialty pharmacy dispense of a medication for subsequent self-administration by the patient, as well as data elements from the encounter between the patient and the physician.
What does Medical Data + Encounter include?
A Medical Data + Encounter claim is a healthcare claim originating from a physician’s administration of a medication directly to a patient in an outpatient setting, as well as data elements from the encounter between the patient and the physician.
Where does my covered entity submit this data?
340B ESP will be releasing an updated submission experience that allows covered entities and their Partners to submit claims data that includes encounter elements. When this functionality is live, covered entities will be submitting the dispense or administration data plus the associated encounter within a single claim submission. Stay tuned for trainings and webinars throughout the month of September to learn more about the updated submission experience.
What fields are collected as part of Pharmacy Data + Encounter?
Field | Data Type | Description |
Contracted Entity ID* | Alphanumeric ID that may contain dashes — starts with 2 or 3 letters | The 340B ID of the covered entity where the prescription originated. If the 340B ID contains a suffix, this must be included. |
Date of Service* | Standard Date Formats | The date the patient filled their prescription. Please include only the date, as time stamps will flag an error. |
Date Prescribed* | Standard Date Formats | The date the prescriber wrote the prescription. Please include only the date, as time stamps will flag an error |
NDC* | Numeric, 11 digits, may contain up to 4 leading zeros | The 11-digit National Drug Code which indicates the manufacturer, product, and commercial package size - note that this field must have 11 digits so please include zero padding. |
Quantity* | Numeric | The number of units in the prescription. |
Rx Number* | Numeric, may contain leading zeros | The native (unmodified) prescription number for the prescription as generated by the pharmacy. |
Service Provider ID* | Numeric, 10 digits, never starts with a leading zero | The unique public ID for the dispensing pharmacy. Accepted IDs include the NPI, DEA, NCPDP, and Medicaid ID. |
Prescriber ID | Numeric, 10 digits, never starts with a leading zero | The unique public ID for the prescribing physician. Accepted IDs include the NPI and DEA ID. |
Wholesaler Invoice Number | Numeric | The invoice number assigned by the wholesaler for the replenishment order made by the 340B covered entity. |
Payer BIN | Alphanumeric, may contain leading zeros | The bank identification number of the primary payer on the prescription. |
Payer PCN | Alphanumeric, may contain leading zeros | Processor Control Number. Identifier used to determine which processor will handle a prescription drug claim. |
Ship to Date | Standard Date Formats | Date when the drug was shipped to the Ship To location. |
Ship to Location | Numeric | NPI, DEA, or NCPDP of the pharmacy where the drug was physically shipped. |
340B Account Number | Alphanumeric | Account number assigned by the wholesaler and used for the purchase. |
Product Serialization Number | Numeric | Unique ID assigned to the package shipped from the manufacturer to the wholesaler. |
Fill Number | Numeric | Indicates the number of times the prescription has been filled as of the current fill. For example, a value of 2 indicates that the prescription has been filled twice and the current fill is the second one. |
Encounter Billing Service Provider ID* | Alphanumeric | A unique, public ID for the healthcare entity that billed for the patient's healthcare encounter. |
Encounter Date of Service* | Date | Date on which the patient was seen by a healthcare provider and received a healthcare service. |
Encounter Rendering Physician ID* | Alphanumeric | A unique, public ID for the physician that provided the healthcare service to the patient. |
Encounter HCPCS Code* | Alphanumeric | The five digit HCPCS code corresponding to the health service performed on the encounter claim. |
Encounter HCPCS Code Modifier(s) | Alphanumeric | Modifier to the HCPCS code. Up to four modifier codes may be entered for the same claim line. |
Primary Encounter Diagnosis Code* | Alphanumeric | ICD-10 diagnosis code assigned as the primary diagnosis for the healthcare encounter. Note ONLY ICD-10 codes are accepted in this field. |
Supplemental Encounter Diagnosis Code(s) | Alphanumeric | ICD-10 diagnosis code assigned as the supplemental diagnosis for the healthcare encounter. Note ONLY ICD-10 codes are accepted in this field. |
Encounter Place of Service Code* | Numeric | Two-digit code indicating the facility type where the healthcare encounter occurred. |
* Indicates a required field
6. What fields are collected as part of Medical Data + Encounter?
Field | Data Type | Description |
340B ID* | Alpha/Numeric | The unique identification number provided by HRSA to the 340B covered entity. |
Claim Number* | Alpha/Numeric | The unique claim number identifying the claim. |
Claim Line Number* | Numeric | Identifies an individual line number on a claim. Line numbers distinguish distinct services that are submitted on the same claim. |
Date of Service* | Standard date formats | Date on which the medication was administered to the patient. |
HCPCS Code | Alpha/Numeric | The five digit HCPCS code corresponding to the medication administered. For drugs billed using a non-specific or miscellaneous HCPCS code (e.g., A9270, J3490), please leave this field blank. |
HCPCS Code Modifier | Alpha/Numeric | Modifier to the HCPCS code. Up to four modifier codes may be entered for the same claim line. |
Health Plan Name* | Alpha/Numeric | Name of the patient's primary health insurance plan. Examples include Medicare Part B, MediCal, Aetna POS, etc. If the patient is uninsured or a cash payer, mark “CASH” in this field. If no health plan information is recorded, mark “NONE” in this field. |
Health Plan ID* | Alpha/Numeric | The identifier code of the patient's primary health insurance plan. If the patient is uninsured or a cash payer, mark “CASH” in this field. If no health plan information is recorded, mark “NONE” in this field. |
NDC-11* | Numeric – 11 digits | The NDC-11 of the medication administered to the patient. |
Rendering Physician ID | Numeric – 10 digits | The NPI of the healthcare provider who rendered or supervised the care reported on the claim. |
Quantity* | Numeric | The quantity of medication administered to the patient. If a specific (non-miscellaneous) HCPCS code with CMS-defined billing units is reported, quantity must reflect the CMS-defined billable units for that HCPCS code. If no HCPCS code is reported, quantity must reflect standardized billing units as defined by NCPDP for the NDC-11. |
Unit of Measure | Alphabetic | Either HCPCS code or UOM is required. If no specific (non-miscellaneous) HCPCS code is reported, UOM must be reported, and it must be consistent with standardized billing units as defined by NCPDP for the NDC-11. |
Service Provider ID* | Numeric – 10 digits | The NPI of the healthcare entity where the patient received the medication administration. For example, this could be the NPI of a hospital outpatient surgery center or the NPI of an outpatient infusion center. |
Wholesaler Invoice Number | Numeric | The invoice number assigned by the wholesaler for the replenishment order made by the 340B covered entity. |
Encounter Billing Service Provider ID* | Alphanumeric | A unique, public ID for the healthcare entity that billed for the patient's healthcare encounter. |
Encounter Date of Service* | Date | Date on which the patient was seen by a healthcare provider and received a healthcare service. |
Encounter Rendering Physician ID* | Alphanumeric | A unique, public ID for the physician that provided the healthcare service to the patient. |
Encounter HCPCS Code* | Alphanumeric | The five digit HCPCS code corresponding to the health service performed on the encounter claim. |
Encounter HCPCS Code Modifier(s) | Alphanumeric | Modifier to the HCPCS code. Up to four modifier codes may be entered for the same claim line. |
Primary Encounter Diagnosis Code* | Alphanumeric | ICD-10 diagnosis code assigned as the primary diagnosis for the healthcare encounter. Note ONLY ICD-10 codes are accepted in this field. |
Supplemental Encounter Diagnosis Code(s) | Alphanumeric | ICD-10 diagnosis code assigned as the supplemental diagnosis for the healthcare encounter. Note ONLY ICD-10 codes are accepted in this field. |
Encounter Place of Service Code* | Numeric | Two-digit code indicating the facility type where the healthcare encounter occurred. |
* Indicates a required field
Duplicate Medicaid Rebate Resolution
What happens when a pharmaceutical manufacturer identifies a duplicate Medicaid rebate using the 340B claims data we submitted?
Pharmaceutical manufacturers will work to resolve identified duplicate discounts with payers and/or the 340B covered entity. Typically, pharmaceutical manufacturers have attempted to withhold or recover duplicate rebates from the payer first.Can a 340B covered entity dispute the findings with a pharmaceutical manufacturer?
340B ESP™ identifies instances of duplicate rebates but does not determine the root cause of the duplicate rebate. In some instances, a third party such as a rebate claim administrator, PBM, or plan may have failed to pass along certain information to prevent a duplicate rebate request from being submitted to a pharmaceutical manufacturer. 340B covered entities and pharmaceutical manufacturers may work together in good faith to address these types of issues. Some manufacturers may have additional mechanisms to engage in good faith with covered entities.
Data Security and Technical Specifications
How does 340B ESP™ ensure the security of 340B claims data?
To keep claims data safe, 340B ESP™ is designed with multiple layers of protection, distributed across a scalable, secure infrastructure.
Protected health information (PHI) is hashed and de-identified with industry-standard, best-in-class secure hash algorithms. This takes place in your local browser on your device to de-identify the data before uploading to 340B ESP™ servers.
Data files at rest are encrypted using 256-bit Advanced Encryption Standard (AES) encryption, which is one of the strongest block ciphers available.340B ESP™ ™ uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between the 340B ESP™ web platform and our servers.
Two-factor authentication is available for all accounts, providing an extra layer of security at login.
How does 340B ESP™ ensure that only employees of the 340B covered entity can register an account with the entity?
340B ESP™ utilizes a multi-step process to verify and authorize all covered entity employee registrations. This includes verifying a unique phone number used for 2FA (two-factor authentication) and verifying an associated organization's email address.
To confirm and identify valid registrations, you must have access to the email address provided upon registration, this address must be owned and operated by the 340B covered entity. If we are unable to match your email with our internal records or automatically verify your registration you may be required to complete our manual verification steps.
What technology specifications are required to successfully upload data to 340B ESP™?
Users will need an internet connection and access to a supported browser to successfully upload data. 340B ESP™ is compatible with most internet browsers including Microsoft Edge, Google Chrome, Safari, and Firefox. However, we strongly recommend using Google Chrome for the best user experience.
HIPAA and Privacy
How does 340B ESP™ protect the privacy of my patients?
Data uploaded to 340B ESP™ meets the definition of a De-identified Data Set under HIPAA. This means no actual protected health information (PHI) is collected and the data cannot be combined with other data sets to reveal the identity of a patient.For more information, visit 340B ESP’s Terms of Use.
What data elements are deidentified in 340B ESP?
The Rx Number and Product Serialization number are de-identified through a HIPAA compliant hashing process known as SHA-3 hashing. An additional layer of security called a “salt” is applied prior to any data being uploaded to 340B ESP™. This process was granted an Expert Determination indicating that it meets the definition of a De-Identified Data Set under HIPAA and does not contain PHI. Additional information on this expert determination may be requested by contacting us.What if PHI is inadvertently mapped to a non-PHI data element?
Prior to data being uploaded to 340B ESP™, a machine learning algorithm is applied to the data to assess the integrity of the data mapping. Inaccurate mappings are identified, and the user is alerted to remap the impacted data element(s) prior to data submission. Uploaded data is further reviewed by the 340B ESP™ team and any identified PHI will be immediately destroyed and the covered entity will be notified.
My covered entity requires that we enter into a Business Associate Agreement (BAA) with Second Sight Solutions prior to submitting data. How does my covered entity initiate that process?
Second Sight Solutions does make a standard BAA available to 340B covered entities that require a BAA be in place prior to submitting data. To request a BAA you can email [email protected].
Need Help?
Live support is available through the 340B ESP support messenger Monday - Friday 9am to 6pm EST. Click the messenger bubble in the bottom right corner then Send Us a Message.

