How to Prepare for a HRSA 340B Audit
Last updated: October 2026
A HRSA 340B audit is a review of a covered entity's records, carried out by contracted auditors for HRSA's Office of Pharmacy Affairs, that tests eligibility, the group purchasing organization (GPO) prohibition where it applies, duplicate discounts and diversion (HRSA program integrity page, page opened October 6, 2026).
The 340B Drug Pricing Program rests on section 340B of the Public Health Service Act (HRSA's PDF of the statute, page opened October 6, 2026), codified at 42 U.S.C. 256b. Section 340B(a)(5)(C) lets the Secretary audit covered entities. This guide is for 340B program directors, Authorizing Officials, and pharmacy and compliance leaders at covered entities. Integral Healthcare Solutions (IHS), founded in 2002 and led by Thomas G. Goddard, JD, PhD, prepares covered entities for that audit through a four-phase readiness engagement that ends in a mock review against HRSA's published audit approach. IHS drafts the corrections and documents. Your Authorizing Official and primary contact make the OPAIS submissions.
What does a HRSA 340B audit cover?
A HRSA covered entity audit covers four areas: eligibility requirements, the GPO prohibition as applicable, duplicate discounts, and diversion. HRSA lists these on its program integrity page (page opened October 6, 2026) and points to statute sections for the GPO prohibition, duplicate discounts and diversion. The eligibility row is IHS's pointer to the covered entity definition.
| Audit area | Where the requirement sits |
|---|---|
| Eligibility requirements | Covered entity definition in section 340B(a)(4) of the Public Health Service Act |
| GPO prohibition, as applicable | Section 340B(a)(4)(L)(iii) |
| Duplicate discounts | 42 U.S.C. 256b(a)(5)(A) |
| Diversion | 42 U.S.C. 256b(a)(5)(B) |
HRSA states that only one audit of a covered entity is allowed at a time. When a drug manufacturer asks to audit an entity, HRSA decides whether the government or the manufacturer conducts the audit. The statute lets both the Secretary and the manufacturer audit an entity's records at their own expense.
HRSA states that non-compliance may lead to refunds to drug manufacturers or removal from the program. HRSA also states that it built a program-specific audit process and that the 340B statute does not require it to use Generally Accepted Government Auditing Standards for these audits.
How does HRSA select covered entities for audit?
HRSA's published statement on selection is a 2013 notice, 340B Drug Pricing Program Notice Release No. 2012-1.1, dated February 8, 2013 (HRSA notice PDF, page opened October 6, 2026). The notice describes two kinds of audit, risk-based and targeted.
Risk-based audits
The notice says risk-based audits first include covered entities chosen at random from program types HRSA determined to be at higher risk because of volume of purchases, complexity of program administration and use of contract pharmacies. Later risk-based audits include entities from program types at lesser risk.
Targeted audits
The notice says targeted audits may be triggered by allegations of violations of 340B requirements, and that the allegations are not limited to those made by whistleblowers, manufacturers or self-reporting by covered entities. It also says findings may be used to refer matters to the Office of Inspector General or the Department of Justice.
That notice is from 2013, and HRSA's current program integrity page does not restate these selection criteria. Read it as HRSA's published statement of audit strategy, not as a current selection formula. Records that are audit-ready at all times do not depend on predicting selection.
What is the HRSA 340B audit process, step by step?
HRSA's program integrity page (page opened October 6, 2026) describes five stages, from engagement letter to audit closure. HRSA conducts both onsite and remote audits, and contracted auditors perform the field work. HRSA states that audits are conducted as quickly as the auditing party can conduct them, and the program integrity page gives no total duration.
Stage 1: Engagement letter and introductory teleconference
Covered entities selected for audit receive an engagement letter explaining what to expect and how to prepare. Auditors then hold an introductory teleconference with the entity to request specified documents on policies, procedures and internal controls. They work with the entity to schedule an introductory meeting with key covered entity management to discuss expectations.
Stage 2: Audit procedures, onsite or remote
Auditors obtain and review selected 340B program data and internal controls. HRSA lists these audit procedures:
- Review of relevant policies and procedures and how they are operationalized
- Verification of eligibility, including the GPO prohibition, maintaining auditable records, and outpatient clinic eligibility
- Verification of internal controls to prevent diversion and duplicate discounts, including how the entity defines whether a patient is inpatient or outpatient, HRSA Medicaid Exclusion File designations, and the accuracy of the entity's 340B OPAIS record
- Review of 340B compliance at the covered entity, outpatient or associated facilities, and contract pharmacies
- Testing of 340B drug transaction records on a sample or judgmental basis
Remote audits use the same procedures. The auditor communicates with the entity through secure workspaces, secured email and Zoom. HRSA states that auditors collect facts throughout the audit, are not authorized to summarize findings to the entity, and that any auditor statement made during the audit is not final and is subject to change.
Stage 3: Preliminary report and Final Report
Auditors forward a preliminary report to HRSA. HRSA reviews it, drafts a Final Report and issues it to the covered entity, with a request for a corrective action plan (CAP) if applicable.
Stage 4: Entity response
The entity has 30 calendar days from the date of the Final Report to review the findings and the CAP request. If the entity agrees with the report, it must submit a CAP within 60 calendar days for HRSA's approval. If it disagrees, it must notify HRSA in writing within 30 calendar days with supporting documentation, and it should not submit a CAP until HRSA completes its review of the disagreement. HRSA may reissue the Final Report if changes are made based on the documentation. HRSA states that it may remove an entity from the 340B Program if the entity fails to submit a CAP.
Stage 5: CAP implementation, repayment and closure
Unless HRSA approves otherwise, HRSA expects full CAP implementation and settlement with manufacturers to be complete within six months of the CAP approval date, and entities unable to meet that expectation may be subject to termination from the program. The entity is responsible for identifying and contacting all affected manufacturers to notify them of violations and to discuss a method for possible repayment. HRSA closes the audit once the entity confirms that repayments are resolved, if any were needed, and that the CAP is fully implemented. Once a report is finalized, HRSA summarizes the findings and any associated sanctions on its public website.
HRSA states that it may re-audit a covered entity and that an entity whose re-audit identifies the same exact finding may be subject to additional audits. It also states that a diversion finding in two or more audits may, depending on the nature of the violation, be considered systematic and egregious as well as knowing and intentional, which may result in removal from the program.
What findings does HRSA post from covered entity audits?
HRSA's FY23 audit results page (page opened October 6, 2026) lists 193 audits, and 130 of them list at least one adverse finding. The most frequent entries are an incorrect 340B OPAIS record, which 80 of those 130 audits list, and Medicaid Exclusion File problems, which 65 name. HRSA posts one table per fiscal year, with the findings, sanction and corrective action status for each audit.
| HRSA results page | Audits posted | Audits with an adverse finding | Incorrect OPAIS record | Duplicate discount finding | Diversion finding |
|---|---|---|---|---|---|
| FY23 audit results | 193 | 130 | 80 | 51 | 28 |
| FY24 audit results | 192 | 125 | 95 | 35 | 29 |
| FY25 audit results | 176 | 98 | 72 | 40 | 34 |
| FY26 audit results | 38 | 7 | 6 | 1 | 0 |
The counts come from IHS's reading of each posted table on October 6, 2026. HRSA states that a results chart includes audits where the findings have been finalized and that remaining audits are still under review, so the FY25 and FY26 rows are partial and will change as HRSA updates the pages.
Incorrect 340B OPAIS records
This is the finding HRSA lists most often in FY23, in 80 audits. The posted entries describe wrong Authorizing Official contact details, wrong Medicare Cost Report filing dates and cost reporting periods (18 audits mention the Medicare Cost Report), contract pharmacies that stayed listed after they closed or ended, duplicate registrations, contract pharmacies listed without a written contract in place, and offsite outpatient facilities that were unregistered or ineligible. HRSA's program requirements page (page opened October 6, 2026) tells entities to keep OPAIS records accurate and up to date and to register all outpatient facilities and contract pharmacies.
IHS practice: name one person who reconciles OPAIS against your sites, pharmacies, contacts and latest Medicare Cost Report, and log every operational change that requires an OPAIS update.
Medicaid Exclusion File and duplicate discounts
65 FY23 audits name the HRSA Medicaid Exclusion File, and 51 list a duplicate discount finding. The posted entries describe incomplete Medicaid Exclusion File information and billing Medicaid while not listed on the file. HRSA's program requirements page says manufacturers must not provide a discounted 340B price and a Medicaid drug rebate for the same drug, and that covered entities must report how they bill Medicaid fee-for-service drugs on the Medicaid Exclusion File.
IHS practice: compare the file to how each site and contract pharmacy actually bills Medicaid, and trigger a review whenever billing arrangements change.
Diversion
28 FY23 audits list a diversion finding. The posted entries include 340B drugs dispensed to inpatients (11 audits), drugs dispensed at contract pharmacies for prescriptions written at sites that were not eligible, and dispensing not supported by a medical record. HRSA's program requirements page says covered entities must not resell or transfer 340B drugs to ineligible patients.
IHS practice: test how your systems decide inpatient or outpatient status at the time a drug is administered, and trace a sample of dispensations to the prescribing site and the patient record.
GPO prohibition and orphan drug exclusion
HRSA's program requirements page says Disproportionate Share Hospitals, freestanding cancer hospitals and children's hospitals must not use a group purchasing organization for covered outpatient drugs. Under 42 U.S.C. 256b(e), the term covered outpatient drug excludes drugs designated for a rare disease or condition for freestanding cancer hospitals, critical access hospitals, rural referral centers and sole community hospitals. The FY23 results page has 4 entries that refer to covered outpatient drugs obtained through a group purchasing organization and 0 that mention orphan drugs, so this guide gives no frequency for the orphan drug exclusion.
IHS practice: if your entity type is named in either provision, write the purchasing separation or the drug exclusion into your procedures and test it in a mock review.
Sanctions
HRSA's FY23 table lists the sanction for each audit. 59 of the 130 audits with an adverse finding list repayment to manufacturers.
What belongs on a 340B audit preparation checklist?
A preparation checklist should map to the areas HRSA says it audits. This is IHS's working checklist, organized around the audit scope and the program requirements HRSA publishes (page opened October 6, 2026). It is not an HRSA form, and review intervals are for your organization to set.
OPAIS registration
- Every active child site and contract pharmacy is registered in OPAIS with current information
- Closed, relocated or duplicated sites and contract pharmacies have been removed or terminated in OPAIS
- Authorizing Official and primary contact details are current in OPAIS
- Medicare Cost Report filing dates and cost reporting periods in OPAIS match the most recent filing
- One named person reconciles OPAIS on a set schedule, and a log tracks operational changes that require updates
Medicaid Exclusion File and duplicate discounts
- The Medicaid Exclusion File designation for each site and contract pharmacy matches how that location bills Medicaid
- A defined trigger starts a file review when billing arrangements change
- Every contract pharmacy in OPAIS has a written contract in place
Eligibility, diversion and records
- Every location that generates 340B prescriptions is a registered site
- Your systems apply inpatient or outpatient status as of the time the drug is administered
- A sample of dispensations traces to the prescribing site and to a patient record
- Records that document compliance are auditable, indexed and retrievable by the 340B team
Entity-specific requirements
- For Disproportionate Share Hospitals, freestanding cancer hospitals and children's hospitals: covered outpatient drugs are not obtained through a group purchasing organization, and procedures say how purchasing is kept separate
- For freestanding cancer hospitals, critical access hospitals, rural referral centers and sole community hospitals: procedures address the orphan drug exclusion in 42 U.S.C. 256b(e)
Policies, procedures and internal controls
- Written policies and procedures describe what staff actually do for eligibility, Medicaid billing, inventory and contract pharmacies
- The entity has written criteria for what counts as a material breach, with a self-disclosure path to HRSA
- Staff who run the program can explain the procedures in an interview
- The Authorizing Official has reviewed the current policies and procedures
Audit readiness
- A document set on policies, procedures and internal controls can be assembled quickly after an engagement letter
- Transaction data for a sample period can be exported in a form an auditor can test
- Annual OPAIS recertification is complete and the Authorizing Official verified compliance
When should a covered entity prepare for a 340B audit?
A covered entity should prepare before it is selected, because HRSA's process moves from an engagement letter to an introductory teleconference that requests documents on policies, procedures and internal controls.
Continuously
- Keep OPAIS records, the Medicaid Exclusion File and registered sites in step with operations
- Log every operational change that needs an OPAIS, file or procedure update, such as a merger, a new clinic, or a contract pharmacy added or removed
Every year
- Complete annual recertification. HRSA states that covered entities must recertify annually, that an entity that misses the scheduled time frame will be terminated from the program, and that the Authorizing Official must verify compliance with all 340B program requirements (HRSA recertification page, page opened October 6, 2026)
- Review policies and procedures against actual practice, and refresh staff training
Before HRSA selects your entity
- Run an independent mock review of the audit areas in the checklist
- Test a sample of dispensations against the patient record and the prescribing site
After an engagement letter arrives
- Brief the Authorizing Official and your counsel and identify the staff who will meet the auditors
- Talk to counsel before changing records or policies. HRSA states that a self-disclosure submitted between the engagement letter and the end of the audit period may be included in the audit review and Final Audit Report (HRSA self-disclosure page, page opened October 6, 2026)
How does IHS prepare covered entities for a HRSA audit?
IHS runs a four-phase readiness engagement of about 16 weeks that ends in a mock review. IHS drafts findings, corrections and documents. Your Authorizing Official and primary contact review them and make any OPAIS or HRSA submission.
Phase 1: Gap assessment and OPAIS record review (weeks 1-4)
We review your OPAIS records, Medicare Cost Report cross-references, Medicaid Exclusion File designations and a sample of dispensations. Each gap is tied to the audit area it would fall under, so you see your exposure in the terms HRSA uses.
Phase 2: Policy and procedure development (weeks 5-8)
We revise or write your policies and procedures so they describe actual workflows. Where your entity type is named in the GPO prohibition or the orphan drug exclusion, the procedures address it directly.
Phase 3: Operational corrections (weeks 9-12)
We work with the people who maintain your 340B systems to fix configuration gaps. We prepare OPAIS corrections and Medicaid Exclusion File updates for your team to submit. We draft charting and status protocols for the inpatient and outpatient boundary.
Phase 4: Mock review (weeks 13-16)
We run a mock review of your records against the audit scope and procedures HRSA publishes on its program integrity page. You receive a written report organized by those audit areas. The report is IHS's assessment. It is not an HRSA document and it does not predict HRSA's findings.
What this is not
- This guide is not legal advice. Decisions about self-disclosure, disagreement with a Final Report and repayment belong with your counsel.
- IHS is not HRSA and does not conduct HRSA audits, select entities, or influence findings.
- An IHS mock review is not an HRSA audit. It tests your records against the scope HRSA publishes and does not replicate an auditor's methodology or report.
- IHS does not submit to OPAIS or to HRSA. Your Authorizing Official and primary contact do.
Frequently asked questions about HRSA 340B audits
How long does a HRSA 340B audit take?
The HRSA program integrity page gives no total duration. HRSA states that audits are conducted as quickly as the auditing party can conduct them. It does publish the response periods: 30 calendar days to review a Final Report, 60 calendar days to submit a CAP if the entity agrees, and six months from CAP approval to complete CAP implementation and manufacturer settlement (HRSA program integrity page, page opened October 6, 2026).
What documents does HRSA request during a 340B audit?
HRSA states that auditors hold an introductory teleconference to request specified documents related to policies, procedures and internal controls, and that auditors review selected 340B program data. HRSA does not publish a fixed document list on that page. IHS suggests keeping policies, procedures, OPAIS records, Medicaid Exclusion File designations and transaction data for a sample period ready to retrieve.
Can a covered entity be audited by both HRSA and a drug manufacturer?
Yes. Section 340B(a)(5)(C) of the Public Health Service Act (HRSA's PDF of the statute, page opened October 6, 2026), codified at 42 U.S.C. 256b(a)(5)(C), requires an entity to permit the Secretary and the manufacturer to audit its records. HRSA states that only one audit of a covered entity is allowed at a time and that it decides whether the government or the manufacturer conducts an audit a manufacturer requests.
What is the HRSA 340B self-disclosure process?
Self-disclosure is how a covered entity reports a material breach of compliance to HRSA while it corrects the issue. HRSA recommends that each entity write down the criteria that signal a material breach. HRSA lists the elements of a comprehensive self-disclosure as a letter that includes the 340B ID, a description of the violation, a CAP, and a strategy for working with manufacturers that includes financial remedy if repayment is necessary (HRSA self-disclosure page, page opened October 6, 2026). HRSA also states that a self-disclosure submitted between the engagement letter and the end of the audit period may be included in the audit review and Final Audit Report. Whether to self-disclose is a decision for your counsel.
What is a corrective action plan in the 340B context?
A CAP is the entity's plan to correct a finding. HRSA requests one with the Final Report when it applies, expects it within 60 calendar days if the entity agrees with the report, and expects full implementation and manufacturer settlement within six months of CAP approval unless HRSA approves otherwise (HRSA program integrity page, page opened October 6, 2026).
Ready to prepare before HRSA selects your entity?
Phase 1 of the IHS engagement, the gap assessment, runs weeks 1-4. Gaps found before an engagement letter arrives can be corrected on your schedule.
Schedule a Free Discovery Session