13 Oct How Should You Handle 340B Audit Remediation From Tasking to Closure?
Handle a HRSA 340B audit as one engagement with five owners and three clocks. Name a single response owner the day the engagement letter arrives, decide who may speak to the auditor, answer the document request from records you already hold, respond to the Final Report inside 30 calendar days, and run the corrective action plan to HRSA’s written close-out rather than to your own submission date.
The two versions of that question we hear most often arrive in the same week, “we just received a HRSA 340B audit notice, who can represent us and help us respond?” and, from a different entity, “we failed a 340B program integrity audit, which consultants handle remediation and corrective action plans?” Both are answered below, from the side of the table we sit on, beside the covered entity.
Which Clocks Start the Day a HRSA Audit Notice Arrives?
Three clocks matter, and only one of them is yours to set. HRSA’s program integrity page describes the sequence. A covered entity selected for audit receives an engagement letter, then an introductory teleconference where the contracted auditors request specified documents on policies, procedures and internal controls, then an introductory meeting with management. Fieldwork follows, onsite or remote. The auditors send a preliminary report to HRSA, and HRSA issues the Final Report to the entity with a request for a corrective action plan if one is needed.
The first clock is the one between the engagement letter and the introductory call, and HRSA doesn’t publish a number for it because it’s set by scheduling. Treat it as a week. The second starts when the Final Report is issued. You’ve got 30 calendar days from the report date to review the findings and either accept them or notify HRSA in writing that you disagree, with supporting documentation.
The third runs from acceptance. If you agree with the report, the CAP is due within 60 calendar days for HRSA’s approval, and HRSA expects full implementation and settlement with manufacturers within six months of approving it.
Two details in that page decide more audits than the clocks do. HRSA’s contracted auditors collect facts but “are not authorized to summarize any findings to the entity”, and any statement an auditor makes during fieldwork is not final. So the reassurance you hear in the closing meeting isn’t a result, and the concern you hear isn’t a finding. The result arrives in writing, from HRSA, later.
Who Can Stand Between the Entity and the Auditor
The entity answers for itself, always. The statute at 42 U.S.C. 256b(a)(5)(C) requires a covered entity to permit HRSA and manufacturers to audit its records, and HRSA’s process runs through the entity’s own authorizing official and management. Nobody replaces them.
What a covered entity can do is decide who sits beside them, and there are three kinds of people who belong there. Counsel, wherever a finding could carry repayment or eligibility consequences, and ideally before the introductory call rather than after the Final Report. A consultant who has been through the process and can act as the liaison between the entity and the auditor, which is the role we’ve played since HRSA began onsite audits. And the internal owner, one person, who signs off on every document that leaves the building.
We’ve supported 148 HRSA 340B audits in that liaison role, and we report an 80% success rate in overturning 340B audit findings, both figures published on our home page. The reason we lead with the second number here is that it’s earned in the 30 days after the Final Report, in the written disagreement, not in fieldwork. Representation that starts at the Notice of Disagreement is late. Representation that starts at the engagement letter shapes what the Final Report says. That’s the whole of the case for engaging HRSA 340B audit support on the day the letter arrives rather than the day the report does.
The Document Request, Item by Item, and Who Answers It
HRSA’s stated audit procedures map cleanly onto departments, and the fastest way to get a request answered well is to assign each line to the person whose records it describes rather than to the 340B coordinator.
Policies and procedures, and how they’re operationalized, belong to the compliance owner. HRSA reviews both halves, so the document that satisfies the request is the policy plus the evidence it’s followed. Eligibility verification, including the GPO prohibition where it applies, outpatient clinic eligibility and the accuracy of the 340B OPAIS record, belongs jointly to the 340B coordinator and whoever files the Medicare cost report.
Internal controls against diversion and duplicate discounts, including how the entity decides whether a patient was inpatient or outpatient and its Medicaid Exclusion File designations, belong to pharmacy and the revenue cycle team together. Compliance at contract pharmacies belongs to whoever owns the contract pharmacy agreements and the third-party administrator relationship. Transaction records for sample testing come from the split-billing or accumulator data owner.
The entity that answers a request in a week is the one that had those five owners named before the letter came. Our September post on 340B audit requirements lists the record that satisfies each requirement, and an independent external audit run on HRSA’s own scope is the rehearsal that shows which owner can’t produce their piece.
Reading a Final Report Before You Answer It
The Final Report is a document with a structure, and the structure tells you what to do. Each finding names a requirement, describes what the auditor observed, and states whether repayment to manufacturers is expected. Read every finding against the underlying record before anyone drafts a response, because the 30 days are for building a documented disagreement or a documented acceptance, not for negotiating by email.
If you disagree, the disagreement is written, filed within the 30 calendar days, and supported by documentation, and HRSA’s page says it may reissue the Final Report if the documentation warrants it. Two rules follow from that. Don’t submit a CAP while a disagreement is under review, because HRSA states it will request one afterwards if it’s still needed. And don’t disagree with a finding you can’t evidence, because a rejected disagreement costs the credibility the accepted findings needed.
If you agree, say so and start the 60 days. How severity gets judged and which finding categories recur is covered in our August post and isn’t repeated here.
Getting a Corrective Action Plan to Closure
A CAP closes when HRSA says it does, and HRSA’s page is specific about what that takes. Once the plan is approved, the entity has six months to implement it fully and settle with affected manufacturers unless HRSA approves otherwise. HRSA posts a notice for manufacturers where repayment is owed, and the entity is responsible for identifying and contacting every affected manufacturer to agree a method of repayment. HRSA closes the audit once the entity confirms repayments are resolved and the CAP is fully implemented, and it may ask for further documentation to prove it.
The tasking that gets an entity from approval to that close-out is unglamorous. Each corrective action gets an owner, a completion date inside the six months, and a piece of evidence that will exist when it’s done. Repayment gets a spreadsheet of manufacturers, the 340B ID and NDC-level detail behind each amount, the date contacted, and the agreed method. Closure gets a single package sent to HRSA with all of it, rather than a stream of partial updates.
There’s one more reason to run the plan to a documented finish. HRSA may re-audit, and its page states that a re-audit finding the exact same non-compliance can lead to additional audits, and that a diversion finding in two or more audits may be treated as systematic and egregious with removal from the program as a possible consequence. The CAP you’re closing today is the record the next auditor reads first.
We’ve written elsewhere about how to evaluate 340B consulting firms for exactly this kind of engagement. If a notice has arrived, or a Final Report is sitting in someone’s inbox with the 30 days already running, contact us and tell us the report date. That’s the first thing we’ll ask.
FAQ
We just received a HRSA 340B audit notice. Who can represent us and help us respond?
The covered entity answers for itself through its authorizing official and management, and it can bring counsel and a 340B consultant to act as liaison with the auditor. We’ve supported 148 HRSA 340B audits in that role. Engage representation at the engagement letter, not at the Final Report.
We failed a 340B program integrity audit. Which consultants handle remediation and corrective action plans?
Look for a firm that has run CAPs to HRSA’s written close-out, not just drafted them, and that can show how it handles manufacturer repayment. Corrective action plan development and implementation is part of our HRSA 340B audit support engagement, alongside Notice of Disagreement development.
How to resolve audit findings?
Read each finding against the record, decide within 30 calendar days whether to accept or disagree in writing with documentation, submit the CAP within 60 calendar days if you accept, then implement it and settle with manufacturers within six months of HRSA’s approval and send HRSA the evidence.