03 Aug 340B Program Management Best Practices for Covered Entities
A 340B program rarely fails all at once. It drifts. A child site opens and nobody updates the registration record. A state changes how it handles Medicaid managed care and the carve decision goes stale. An EHR upgrade quietly changes how dispenses are captured. Each of those is small on the day it happens, and each becomes a finding two years later. Program management is the discipline that catches drift before an auditor does. Here is how we see it working inside the health systems that hold up best.
What Is 340B Management?
340B management is the ongoing work of proving, every day, that your program still meets the conditions it was approved under. Registration is a moment. Management is the rest of the year.
In practice it covers five things. You keep the entity and its child sites correctly registered and recertified. You keep the patient definition applied consistently at every site of care. You keep 340B purchases separated from any purchases that must stay outside the program. You keep the Medicaid billing decision current and reflected in the Medicaid Exclusion File. And you keep records that let an independent reviewer reconstruct any single dispense without asking you to explain it.
Everything else in a 340B program is downstream of those five. When we are brought into a program that is struggling, the failure almost never lives in the pharmacy. It lives in the handoff between departments that each assumed someone else was watching. Our 340B compliance monitoring service exists because that handoff is where programs lose the thread.
How Does the 340B Program Work?
Section 340B of the Public Health Service Act requires participating drug manufacturers to offer covered outpatient drugs to eligible covered entities at or below a statutory ceiling price. Manufacturers who want their drugs covered by Medicaid and Medicare Part B participate. Eligible entities register, are verified, and recertify.
Eligibility is category based rather than open. Disproportionate share hospitals, children’s hospitals, free standing cancer hospitals, rural referral centers, sole community hospitals, and critical access hospitals qualify on the hospital side. On the grantee side, federally qualified health centers and look alikes, Ryan White clinics, hemophilia treatment centers, black lung clinics, Title X family planning projects, sexually transmitted disease and tuberculosis clinics, and tribal and urban Indian organizations qualify. The category an entity falls into is not a formality. It drives which rules bind it. Group purchasing organization restrictions apply to some hospital types and not to others, and getting that wrong creates a purchasing problem that is difficult to unwind after the fact.
Two prohibitions sit at the center of the program. Drugs purchased at 340B pricing may only go to patients of the covered entity, which is the prohibition on diversion. And a drug may not generate both a 340B discount and a Medicaid rebate, which is the prohibition on duplicate discounts. Our walkthrough of how duplicate discounts actually happen covers the mechanics in more detail than most program teams have seen written down.
What Is the 340B Controversy?
There is no settled account of what the controversy even is, and the contradictions between the competing versions are themselves the useful signal. Manufacturers argue the program has grown well past what Congress intended and that contract pharmacy arrangements in particular stretch it. Covered entities argue that the savings fund exactly the care the statute was written to protect, and that the burden of proving it has shifted onto them. Policymakers, courts, and HRSA have all been active in the space, and the ground under contract pharmacy distribution and manufacturer data submission requirements has moved repeatedly.
We raise it here for one reason. Controversy translates directly into scrutiny, and scrutiny translates into documentation demands. A program that is managed loosely in a quiet period is a program that has no answer in a noisy one. If you want to understand how the environment shapes day to day obligations, our 2026 state of 340B compliance briefing is the place to start.
The Four Controls That Hold a Program Together
Eligibility and registration hygiene
Every location that dispenses 340B drugs has to be a registered site associated with the covered entity, and it has to belong on the entity’s most recent cost report where that applies. New clinics, relocations, service line changes, and acquisitions all move faster than registration records do. We recommend a standing review at every registration window, with a named owner who is accountable for reconciling the site list against what the organization actually operates. Our primer on 340B program eligibility is worth handing to anyone new to that responsibility.
Duplicate discount prevention
The Medicaid decision is not one decision. It is a decision per entity, per site, and increasingly per payer arrangement, and it has to match what is recorded in the Medicaid Exclusion File. Managed care adds a second layer that the file alone does not resolve, which is why state specific arrangements matter. The control that works is a written matrix showing, for each site, what the entity does for Medicaid fee for service and what it does for managed care, reviewed whenever a payer contract or a state policy changes.
Diversion prevention
Diversion controls live in the patient definition and in how it is applied at the point of dispense. The questions to answer are whether the entity has a record of the care that generated the prescription, whether the prescribing provider relationship qualifies, and whether the record supports that at the level of the individual claim. Where contract pharmacies are involved, the same questions apply at a distance, which is what makes contract pharmacy oversight harder rather than easier.
Records that survive review
An auditable record is one that a stranger can follow. That means purchase data, accumulation data, dispense data, and the patient eligibility evidence can be joined without manual reconstruction, and that the joining logic is documented rather than living in one analyst’s head. Programs fail this test far more often than they fail the underlying rules.
Building an Oversight Calendar
Most program management failures are calendar failures. The work is known. It just never gets scheduled.
A workable calendar has four rhythms. Monthly, you review accumulation and replenishment exceptions, self disqualified claims, and any new prescriber or site added since the last review. Quarterly, you run a sample based self audit across each site and each contract pharmacy relationship, and you write down what you found even when you found nothing. Annually, you complete recertification, refresh the policy set, and re-verify the Medicaid Exclusion File entries against actual billing practice. On change, meaning whenever a site opens, a payer contract shifts, a TPA configuration changes, or a manufacturer alters its distribution terms, you trigger a targeted review rather than waiting for the next scheduled one.
The change trigger is the one that gets skipped and the one that pays for itself. Manufacturer conditions on contract pharmacy distribution have been an area of active change, and a program that only reviews on a fixed cycle will be operating on last quarter’s assumptions.
Where Program Management Quietly Drifts
Four patterns account for most of what we find.
The first is orphaned ownership. A pharmacy director owns the program on paper, finance owns the savings reporting, compliance owns the policy, and no single person owns the reconciliation between them.
The second is TPA trust without TPA verification. A third party administrator is a tool, not a compliance function. The entity remains accountable for what the tool produces, which means someone inside the organization has to be able to explain the configuration. Our review of 340B TPA software considerations is written for exactly that conversation.
The third is policy documents that describe an older program. Policies written for a three site program do not govern a twelve site program, and auditors read what you wrote, not what you meant.
The fourth is self audit as a formality. A self audit that never produces a finding is not evidence of a clean program. It is evidence of a shallow sample.
Across the 148 HRSA 340B audits we have supported, the programs that came through cleanest were not the ones with the most sophisticated technology. They were the ones where a named person could answer a question about any given claim within a day, and had the records to back the answer up.
Frequently Asked Questions
What is a 340B program manager?
A 340B program manager is the person accountable for the operating discipline described above. The role is part pharmacy operations, part data stewardship, and part internal audit. In smaller entities it is a portion of a pharmacy director’s time. In larger health systems it is a dedicated role supported by analysts, and the distinguishing factor is not headcount but whether the person has the authority to require changes in departments they do not manage.
Strengthening Your 340B Program Management Strategy
If your program has grown faster than the structure around it, the fix is rarely a rebuild. It is usually assigning ownership, restoring the calendar, and closing the two or three documentation gaps that make everything else hard to prove. That is the work our team does with covered entities every week, and the first conversation usually shows which of the four controls needs attention soonest. Get 340B program management support.