04 Sep 340B Audit Requirements and the Documents That Satisfy Them
Most audit-readiness material tells covered entities to be ready. It does not tell them what “ready” means in evidence. Below is the other version. For each thing HRSA reviews, the record that answers it, taken from HRSA’s published audit scope and process rather than from a checklist somebody wrote about them.
What HRSA Actually Audits
HRSA audits covered entities under section 340B(a)(5)(C) of the Public Health Service Act, and its Program Integrity page states the scope directly. Audits review compliance with eligibility requirements, the Group Purchasing Organization prohibition where it applies, duplicate discounts, and diversion. Only one audit of a covered entity runs at a time.
Four headings, and every document request you receive maps back to one of them. Read the engagement letter that way and the exercise stops feeling arbitrary.
The Requirements, and the Document That Satisfies Each One
Eligibility and registration records
HRSA verifies eligibility, and it says the verification includes the GPO prohibition, maintaining auditable records, outpatient clinic eligibility, and the accuracy of the covered entity’s 340B OPAIS record. That last item is the one entities under-prepare. Your OPAIS listing is not administrative housekeeping sitting to one side of the audit. It is an audit artifact, and a child site listed there that does not match your cost report or your service reality is a finding waiting to be written. We cover OPAIS record maintenance in a separate post later this month.
Patient definition evidence
Nothing in an audit turns on more records than whether the individual was your patient. HRSA verifies internal controls that prevent diversion, and it names the way the entity defines whether a patient is inpatient or outpatient as part of that review. The evidence is the health record, the prescriber relationship and the service that generated the prescription, and we set out the operational test in a separate post this month.
Duplicate discount and Medicaid exclusion records
Duplicate discounts sit in the statutory scope at 42 U.S.C. 256b(a)(5)(A), and HRSA’s verification explicitly covers HRSA Medicaid Exclusion File designations. The satisfying evidence is your Medicaid Exclusion File entries matched against your actual billing practice, plus whatever you do about managed Medicaid, which the file does not govern. Our explainer on Medicaid duplicate discounts covers where entities most often diverge from their own stated policy.
Contract pharmacy oversight
HRSA reviews 340B Program compliance at the covered entity, at outpatient or associated facilities, and at contract pharmacies. Contract pharmacy is not a separate compliance domain you can hold at arm’s length. The evidence is the contract itself, the arrangement as registered, and the reconciliation records showing what was dispensed to whom. Our contract pharmacy overview sets out how those arrangements are supposed to be documented.
The GPO prohibition, where it applies
For disproportionate share hospitals, children’s hospitals and free-standing cancer hospitals, the prohibition on using a group purchasing organization for covered outpatient drugs is a statutory condition of participation at section 340B(a)(4)(L)(iii), and HRSA names it inside what an audit verifies. The evidence is your purchasing account structure and the transaction records that show which account a drug was bought on, not a policy statement that you comply.
The failure is almost never deliberate. It is a drug bought on the wrong account during a shortage, or a new outpatient location set up by procurement using the default purchasing profile. Both are visible in transaction data and neither is visible in a policy.
Policies, procedures and self-audit history
HRSA’s audit procedures start with a review of relevant policies and procedures and how they are operationalized. Note the second half. A policy that describes a process nobody follows is worse evidence than no policy, because it establishes the standard you then failed.
Self-audit history is the record that shows the policy is live. It also does something an auditor notices, which is demonstrate that the entity looks for its own problems. HRSA runs a self-disclosure process precisely so that an entity which finds non-compliance has a route to report and correct it, and the 340B Prime Vendor Program publishes self-audit templates by entity type for exactly this work. An entity with two years of dated self-audits and a documented correction is in a different conversation from one whose first review of its own program is the audit itself.
How an Audit Runs, Start to Finish
HRSA publishes the sequence and it is worth knowing before you are in it. Selected entities receive an engagement letter. Auditors hold an introductory teleconference and request documents on policies, procedures and internal controls, then schedule a meeting with key management. During fieldwork, contracted auditors review data and internal controls and test 340B drug transaction records on a sample or judgmental basis. Remote audits follow the same procedures over secure channels.
One detail changes how you should behave in the room. HRSA states that auditors collect facts but are not authorized to summarize findings to the entity, and that any auditor statements made during the audit are not final and are subject to change. A reassuring remark from an auditor is not a result. Neither is an alarming one.
Two further points are worth knowing because they shape expectations. HRSA describes the audit as program-specific and notes that, unlike other statutorily authorized programs, the 340B statute does not require it to use Generally Accepted Government Auditing Standards. So the process is not a financial audit and staff who have been through one will find the frame unfamiliar. And where a manufacturer has requested the audit, HRSA decides whether the government or the manufacturer conducts it, which is a distinction the entity should establish at the engagement letter rather than assume.
The Clocks That Start When the Final Report Arrives
This is the part where preparation stops mattering and process takes over, and the dates are unforgiving.
Auditors send a preliminary report to HRSA. HRSA reviews it, drafts a Final Report and issues it to the entity with a request for a corrective action plan where applicable. From the date of that report the entity has 30 calendar days to review the findings. If you disagree, you must notify HRSA in writing inside those 30 days with supporting documentation, and you should not submit a corrective action plan until HRSA has completed its review of the disagreement. If you agree, the corrective action plan is due within 60 calendar days.
After approval, HRSA expects full implementation of the plan and settlement with manufacturers within six months of the approval date unless it agrees otherwise, and says entities unable to meet that expectation may be subject to termination from the program. Findings and any associated sanctions are summarized on HRSA’s public website. Entities are responsible for identifying and contacting every affected manufacturer about repayment.
Thirty days is not long to build a disagreement that has to carry supporting documentation, which is why entities in an audit bring us in at the Final Report rather than after the corrective action plan is due. See how our HRSA audit support works if that is where you are.
What Repeat Findings Do
A re-audit that identifies the same exact finding of non-compliance can lead to additional audits. HRSA states that a finding of non-compliance with the diversion prohibition in two or more audits may, depending on the nature of the violation, be considered systematic and egregious as well as knowing and intentional, which may result in removal from the program under section 340B(d)(2)(B)(v) of the Public Health Service Act, and may disqualify the entity from re-entry for a reasonable period.
That is the real argument for treating the first corrective action plan as the whole job rather than the paperwork that closes a file.
The Findings We See Most Often
Across the 148 HRSA 340B audits we have supported, the patterns that recur are not exotic. They are a policy that does not match the operation, an OPAIS record that drifted from reality after a service line moved, and a Medicaid billing practice that was decided by the revenue cycle team without the 340B team in the room. None of those is a knowledge problem. Each is a coordination problem, and each is visible months before an engagement letter arrives if somebody is looking.
We are deliberately not putting a percentage on any of that. We have audit outcome figures we can stand behind, and made-up frequency statistics are not among them.
Where to Start If Your Fiscal Year Closes September 30
Work backwards from the four scope headings and ask, for each one, which document you would hand over tomorrow. Where the answer is a person rather than a file, that is the gap.
Our independent external audits exist to make an entity answer that question before HRSA does, which is a different exercise from defending one already underway. For entities already in an audit, our HRSA audit support is the relevant service, and the outcome record behind it is published on our home page alongside the audit count above, including an 80 percent success rate in overturning 340B audit findings.
Talk to our audit team if the fiscal-year close is what is forcing the question.
FAQ
Who audits the 340B program?
HRSA’s Office of Pharmacy Affairs audits covered entities under section 340B(a)(5)(C), with the field work carried out by contracted auditors. HRSA also audits manufacturers, and manufacturers may request to audit a covered entity, in which case HRSA decides whether the government or the manufacturer conducts it.
What are audit requirements?
For 340B purposes they are the four areas HRSA reviews, which are eligibility, the GPO prohibition where applicable, duplicate discounts and diversion, together with the underlying obligation to maintain auditable records. Everything an auditor asks for exists to evidence one of those.
What are the requirements for 340B?
Participation requires that the organization is an eligible covered entity type under section 340B(a)(4), that it registers and is listed in 340B OPAIS, that it recertifies annually, and that it prevents diversion and duplicate discounts. Our program eligibility primer covers the entity-type question in full.
Who is responsible for 340B compliance?
The covered entity, without qualification. Responsibility does not transfer to a third-party administrator, a contract pharmacy or a consultant. HRSA reviews compliance at the entity, at its associated facilities and at its contract pharmacies, and the entity answers for all three.