340B Program Integrity & Audit Readiness

What does the 340B statute require of a covered entity?

The statute sets two core duties for every covered entity and gives the government and manufacturers the right to audit them. The statute text is published by HRSA as Section 340B of the Public Health Service Act (page opened October 6, 2026) and is codified at 42 U.S.C. 256b.

• No duplicate discounts: a covered entity "shall not request payment under title XIX of the Social Security Act" for a drug that is also subject to a Medicaid rebate to the State (section 256b(a)(5)(A)).
• No resale: a covered entity "shall not resell or otherwise transfer the drug to a person who is not a patient of the entity" (section 256b(a)(5)(B)).
• Audit: a covered entity must permit the Secretary and the manufacturer to audit, at their expense, the records that directly pertain to compliance with those two duties (section 256b(a)(5)(C)).
• Liability: if the Secretary finds a violation after an audit, notice and a hearing, the entity is liable to the manufacturer for the amount of the price reduction on the drug involved (section 256b(a)(5)(D)).

Those duties are met in daily work: how a prescription is judged eligible, how Medicaid claims are handled, how contract pharmacies are used, and whether written policies match what staff do. That daily work is what a 340B program integrity review examines.

How do 340B requirements differ by entity type?

All covered entities share the duplicate discount, resale and audit provisions above. The statute adds conditions for some hospital types.

IHS builds each engagement around your entity type and the sites and contract pharmacies on your registration. State law and HRSA program guidance can add requirements, and your counsel confirms which apply to you.

What does IHS do in a 340B engagement?

IHS runs a five-phase engagement: four initial phases over 16 weeks, then ongoing maintenance. IHS drafts the program, policies and findings for your compliance, pharmacy and clinical leaders to review and approve.

Phase 1, gap assessment and OPAIS record review (weeks 1 to 4)

IHS reviews your OPAIS registration record against your own files: each child site, each contract pharmacy, the Authorizing Official and contact entries, and your Medicare Cost Report dates. IHS also pulls a sample of recent 340B dispensations and traces each one to the EHR record to find eligibility and diversion gaps.

Phase 2, policy and procedure development (weeks 5 to 8)

IHS drafts or revises your written Policies and Procedures manual so it matches how your staff work. Topics include patient eligibility logic, Medicaid carve-in and carve-out workflows, contract pharmacy oversight, inventory management (virtual replenishment or physical separation), group purchasing organization rules for the hospital types that carry them, and the orphan drug exclusion for the hospital types that carry it.

Phase 3, operational remediation (weeks 9 to 12)

IHS prepares the corrections and your team applies them: NDC crosswalk settings and accumulation multipliers with your TPA software vendor, your Medicaid Exclusion File declarations, and the closure of contract pharmacies you no longer use. IHS drafts the OPAIS change requests, and your Authorizing Official submits them. Where charting practice creates diversion risk, particularly at the inpatient and outpatient admission boundary, IHS drafts protocols for your clinicians to review and approve.

Phase 4, mock 340B audit review (weeks 13 to 16)

IHS runs a mock review of your records against the audit scope and procedures HRSA publishes on its program integrity page (page opened October 6, 2026), which cover eligibility, the group purchasing organization prohibition where it applies, duplicate discounts and diversion, and against your own written policies. The review samples NDCs, traces them through your TPA software and EHR to confirm an eligible patient and encounter, checks OPAIS records against your files, and checks your Medicaid Exclusion File declarations. You receive a written findings report in IHS's own format, with each gap ranked, so you can correct it before a real audit. The mock review is IHS's own work product. It is not an HRSA audit and does not predict one.

Phase 5, corrective action and ongoing maintenance

Where the mock review finds gaps, IHS drafts the corrective action plan and tracks it to closure with your team. After the initial engagement, IHS offers retainer-based maintenance: monthly prescription sampling, quarterly OPAIS record reconciliation, and drafting your response if your entity is notified of an audit, which your team reviews and submits.

How long does a 340B engagement take?

The initial engagement runs 16 weeks from kickoff to the written mock review findings. A large registration with many sites or contract pharmacies can run longer, and IHS sets the schedule at scoping.

What does 340B compliance consulting cost?

The cost has three parts: your organization's internal staff time, any vendor charges for TPA software or contract pharmacy services you already pay, and the consulting engagement. Your organization and your vendors set the first two. IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and gap severity change the work.

What this is not

• IHS is not HRSA, a manufacturer or a government auditor. A mock review does not predict or influence an HRSA or manufacturer audit.
• IHS does not sell TPA software, distribute drugs or administer contract pharmacy services.
• IHS does not contact HRSA for you or make OPAIS changes. IHS drafts, and your Authorizing Official acts.
• IHS does not give legal advice. Your counsel confirms which federal, state and program rules apply to your entity.