340B Program Integrity & Audit Readiness
Last updated: April 2026
63% of audited 340B covered entities received adverse findings in FY2023. HRSA targets approximately 90% of its 200 annual audits using proprietary risk criteria — not random selection. IHS provides conflict-free mock audits, OPAIS remediation, and compliance maintenance for DSH hospitals, FQHCs, CAHs, and Ryan White clinics.
The 340B Compliance Problem Is Administrative, Not Clinical
The 340B Drug Pricing Program generated $81.4 billion in covered entity purchases in 2024 — a 23% year-over-year increase from $66.3 billion in 2023. That volume, and the $66.4 billion gap between WAC list prices and 340B discounted prices, makes program integrity enforcement a federal priority.
HRSA conducts approximately 200 audits per year through its contracted audit firm, The Bizzell Group. Of those, roughly 90% are risk-targeted based on proprietary HRSA criteria — meaning selection is not random. Entities with contract pharmacy arrangements, recent OPAIS changes, or specific entity types face elevated risk.
The good news: the two most common adverse findings are administrative. According to Kodiak Solutions' FY2023 analysis, 51% of adverse findings involved incorrect OPAIS records and 32% involved inaccurate Medicaid Exclusion File (MEF) declarations. Both are correctable through systematic review — if you have the internal capacity and expertise to conduct it.
The bad news: 68% of covered entities that were re-audited after prior violations were found continually non-compliant (ADVI, 2025). One-time fixes do not hold. 340B compliance is a continuous maintenance function, not a project.
What IHS Does for 340B Covered Entities
IHS provides end-to-end 340B program integrity services structured as a four-phase initial engagement followed by ongoing compliance maintenance.
Phase 1 — Gap Assessment & OPAIS Forensic Review (Weeks 1–4)
We begin with a forensic review of your OPAIS registration: every child site, every contract pharmacy, and every Medicare Cost Report cross-reference. We verify that your Authorizing Official contact information is current, that terminated contract pharmacies have been properly closed, and that your MCR filing dates align with OPAIS records. We also pull a large sample of recent 340B dispensations and trace them against EHR records to identify systemic diversion or eligibility gaps.
Phase 2 — Policy & Procedure Development (Weeks 5–8)
We conduct a full overhaul of your written Policies and Procedures manual. HRSA auditors expect your P&P to accurately reflect actual workflows — a gap between written policy and operational practice is itself an adverse finding. We update or draft from scratch policies covering: patient eligibility logic, Medicaid carve-in/carve-out workflows, contract pharmacy oversight protocols, inventory management (virtual replenishment vs. physical separation), GPO prohibition compliance (DSH, PED, CAN entities), and orphan drug exclusion rules (CAH, SCH, RRC entities).
Phase 3 — Operational Remediation (Weeks 9–12)
We work with your TPA software vendor to correct NDC crosswalk configurations and accumulation multipliers. We update your HRSA Medicaid Exclusion File with current carve-in/carve-out declarations. We formally terminate any non-compliant or closed contract pharmacies from OPAIS. Where EHR charting practices are creating inadvertent diversion risk — particularly at the inpatient/outpatient admission boundary — we provide structured remediation protocols for clinical staff.
Phase 4 — Mock HRSA Audit (Weeks 13–16)
We conduct a simulated HRSA audit using the Bizzell Group's documented methodology. This includes random NDC sampling traced through your TPA software and EHR to verify eligible outpatient encounters with credentialed prescribers, OPAIS record verification, P&P compliance assessment, and MEF accuracy review. You receive a written findings report structured identically to what HRSA would produce — including adverse finding designations where warranted — so you can remediate before a real audit occurs.
Phase 5 — Corrective Action & Continuous Maintenance (Ongoing)
Where mock audit findings require corrective action, we develop and execute the CAP. Following initial engagement completion, IHS offers retainer-based continuous maintenance: monthly prescription sampling, quarterly OPAIS reconciliation, support for HRSA's 15-day quarterly registration windows, annual recertification preparation, and immediate-response support if HRSA selects your entity for audit.
Entity-Type Differences Matter
340B compliance is not uniform. The rules that apply to a Disproportionate Share Hospital are materially different from those governing a Federally Qualified Health Center, a Critical Access Hospital, or a Ryan White HIV/AIDS clinic. IHS structures every engagement around your entity type.
- DSH Hospitals: GPO prohibition applies to covered outpatient drugs. Highest volume entity type ($64.13 billion, 78.7% of 2024 program purchases). Most complex contract pharmacy arrangements. State transparency mandate reporting requirements where applicable.
- FQHCs: No GPO prohibition. Patient definition challenges with mobile and satellite service delivery locations. Annual independent contract pharmacy audit requirement. $4.74 billion in 2024 purchases (5.8% of total).
- Critical Access Hospitals / SCH / RRC: Orphan drug exclusion applies — these entity types cannot purchase designated orphan drugs at 340B prices. This is a frequently missed compliance point.
- Ryan White Clinics: Patient definition is particularly strict — the prescriber-entity relationship and medical record maintenance requirements require careful operational protocols.
The 2025–2026 Regulatory Environment Increases Risk
Three regulatory developments are directly increasing 340B compliance complexity in 2025–2026:
- CMS CY 2026 OPPS Drug Acquisition Cost Survey: Beginning January 1, 2026, OPPS hospitals must submit NDC-level pricing data distinguishing 340B and non-340B acquisitions. Failure to maintain this granularity risks loss of drug packaging reimbursements.
- Medicare Part D Inflation Rebate Exclusion: Starting January 1, 2026, 340B units must be explicitly excluded from inflation rebate calculations — forcing end-to-end unit traceability that many TPA configurations do not currently support.
- Post-Loper Bright Manufacturer Restrictions: The Supreme Court's 2024 Loper Bright decision overturned Chevron deference, weakening HRSA's authority to compel manufacturer participation in contract pharmacy arrangements. Over 20 states have enacted or introduced laws protecting covered entities, but the federal enforcement landscape is actively contested. Covered entities need compliance strategies that account for manufacturer restriction risk.
Why Conflict-Free Independence Matters for 340B Compliance
The major 340B compliance consulting firms fall into three categories, each with a structural conflict of interest:
Drug Distributors (McKesson, Cardinal Health)
Both firms offer 340B consulting services. Both distribute the drugs your 340B program purchases. A distributor has an economic interest in your 340B purchase volume — an interest that is structurally incompatible with independent audit advice. McKesson claims over $400 million in verified client savings across 200+ IDNs. That is real value — but it is value generated through purchasing optimization, not audit defense.
TPA Software Vendors (340Best, CaptureRx, Sentry)
Some TPA vendors also offer compliance consulting. A firm that sells you software has an incentive to attribute compliance gaps to configuration issues requiring their continued involvement — and an incentive to minimize findings that might suggest their platform contributed to the problem. Independent verification of TPA configuration is not possible from the vendor who configured it.
IHS — Conflict-Free Regulatory Compliance Specialists
IHS is the only URAC-certified accreditation consulting firm in the United States. IHS does not distribute drugs. IHS does not sell TPA software. Our regulatory compliance expertise extends across URAC, HRSA, CMS, and state health agency standards — giving us context that pure 340B specialists lack. When we conduct a mock audit, we replicate HRSA's adversarial posture without any interest in the outcome other than your readiness. That independence is the foundation of credible audit preparation.
Engagement Timeline
A full IHS 340B Program Integrity engagement runs 16–20 weeks from kickoff to mock audit completion. Ongoing compliance maintenance continues by retainer.
Gap Assessment & OPAIS Forensic Review
OPAIS registration audit, MCR cross-reference, sample dispensation review, initial risk stratification by entity type and contract pharmacy volume.
Policy & Procedure Development
Complete P&P manual overhaul covering all HRSA-required domains. Written policies aligned to actual operational workflows.
Operational Remediation
TPA NDC crosswalk correction, MEF update, OPAIS terminations, EHR charting protocol remediation.
Mock HRSA Audit
Full Bizzell-methodology simulation with written findings report. Adverse findings designated where warranted so you can remediate before actual HRSA selection.
Continuous Compliance Maintenance
Monthly sampling, quarterly OPAIS reconciliation, annual recertification support, active audit response.
Frequently Asked Questions
What does 340B compliance consulting include?
340B compliance consulting covers OPAIS registration gap assessment, Policies and Procedures manual development, Medicaid Exclusion File review and remediation, contract pharmacy oversight audits, mock HRSA audits using Bizzell Group methodology, corrective action plan development, and ongoing retainer-based compliance maintenance. The scope varies by entity type — DSH hospitals, FQHCs, Critical Access Hospitals, and Ryan White clinics each face distinct compliance requirements.
Why do 63% of audited 340B covered entities receive adverse findings?
According to Kodiak Solutions' FY2023 HRSA 340B Audit Findings Summary, 63% of audited covered entities received adverse findings. The two most common causes are incorrect OPAIS records (51% of adverse findings) and inaccurate Medicaid Exclusion File declarations (32% of adverse findings). Both are administrative issues — correctable with systematic review — but they require ongoing maintenance that most entities under-resource.
How does HRSA select entities for 340B audits?
HRSA conducts approximately 200 audits per year through The Bizzell Group. Approximately 90% are risk-targeted based on HRSA's proprietary criteria — not random selection. Risk factors include tip submissions from stakeholders, data anomalies in OPAIS, contract pharmacy arrangement complexity, and prior adverse audit history. The 68% re-audit failure rate (ADVI, 2025) indicates that entities with prior findings face substantially elevated risk of re-selection.
How does IHS differ from 340B drug distributors and TPA software vendors offering compliance services?
IHS is conflict-free. We are not a drug distributor and we do not sell TPA software. Distributors have an economic interest in your purchasing volume; software vendors have an interest in renewing your license. IHS has a single interest: your audit readiness. That independence is particularly critical for mock audits, where a vendor-affiliated reviewer cannot credibly replicate HRSA's adversarial posture.
Does my 340B TPA software guarantee compliance?
No. TPA software (Sentry, Macro Helix, CaptureRx, Verity Solutions) automates the capture of 340B-eligible transactions — but software does not write your P&P manual, maintain your OPAIS registration, update your Medicaid Exclusion File, or verify that your patient eligibility logic matches actual prescriber-entity relationships. The 63% adverse findings rate in FY2023 occurred at entities that all had TPA software in place. Software is a compliance tool; compliance is an organizational function.
See the full 340B FAQ: 340B Compliance Frequently Asked Questions
Start with a 340B Gap Assessment
Most compliance gaps are correctable before HRSA selects your entity. A gap assessment identifies your risk exposure in four weeks — before you are notified of an audit, not after.
Contact IHS for a 340B Gap Assessment