From OPAIS Gaps to Mock Audit Pass: A 340B Program Integrity Engagement
Last updated: April 2026
A [covered entity type] with [number] registered child sites and [number] contract pharmacy arrangements engaged IHS after an internal review flagged potential OPAIS inconsistencies. Before HRSA selected the entity for audit, IHS completed a four-phase gap assessment, remediation, and mock audit engagement — identifying and resolving findings that would have produced adverse results under the Bizzell Group methodology.
The Situation
The [entity type] had participated in the 340B program for [number] years and had never been selected for an HRSA audit. The entity's 340B program was managed by [a dedicated 340B Director / pharmacy staff with shared responsibilities], supported by [TPA software platform] for transaction accumulation.
The engagement was triggered when [the entity's compliance officer / a new 340B Director / an internal audit function] conducted a preliminary OPAIS review and identified [several discrepancies / potential child site registration issues / questions about MEF accuracy]. Rather than wait for HRSA selection, the entity engaged IHS for a full gap assessment and mock audit.
The timing was significant: the entity had [recently expanded to new off-site locations / recently changed contract pharmacy arrangements / recently undergone a merger or acquisition], and the compliance implications of those changes had not been fully assessed in OPAIS or in the entity's Policies and Procedures manual.
What IHS Found — Phase 1 Gap Assessment
IHS conducted a forensic review of the entity's OPAIS registration, Medicare Cost Report cross-references, Medicaid Exclusion File declarations, and a sample of [number] recent 340B dispensations traced against EHR records. Key findings:
OPAIS Registration Findings
- [Number] child sites had shipping address discrepancies between OPAIS registration and current operational addresses
- [Number] contract pharmacy locations that had been closed or de-activated had not been formally terminated in OPAIS — a direct parallel to the administrative error category that accounted for 51% of FY2023 adverse findings nationally (Kodiak Solutions, 2025)
- Medicare Cost Report alignment gap: The entity's OPAIS records had not been updated to reflect the most recent MCR filing period, technically creating an eligibility gap for [number] child sites
- Authorizing Official contact information was outdated following a leadership transition [number] months prior
Medicaid Exclusion File Findings
- [Number] child sites showed carve-in/carve-out declarations in OPAIS that did not match actual Medicaid billing practices — the entity was billing Medicaid in a manner inconsistent with its MEF declarations at [number] locations
- Following a contract pharmacy operational change [timeframe] prior, the MEF had not been updated during the subsequent quarterly registration window — creating retroactive duplicate discount exposure for [number] months of Medicaid dispensations
Patient Eligibility Findings
- Dispensation sample review identified [a pattern / isolated instances] of prescriptions written by providers at [an off-site location / a recently acquired practice] that had not yet been registered as a child site in OPAIS — a diversion risk
- [Where applicable:] [Number] dispensations in the sample involved patients whose hospital status at the time of drug administration had crossed the outpatient-to-inpatient boundary — inpatient diversion exposure
Policies and Procedures Findings
- The entity's P&P manual had not been updated in [number] months / years and did not reflect [current contract pharmacy arrangements / the expanded list of child sites / current MEF carve-in/carve-out elections]
- Patient eligibility definitions in the written P&P did not match the parameters configured in the TPA software — a gap that HRSA auditors specifically look for as evidence of operational disconnect
- [Where applicable for DSH/PED/CAN:] GPO prohibition documentation was insufficient — the entity lacked written protocols separating GPO and 340B purchasing accounts at the NDC level
Remediation — Phases 2 and 3
OPAIS Remediation
IHS prepared and submitted [number] OPAIS corrections during the [quarter] registration window, including: formal termination of [number] closed contract pharmacies, address corrections for [number] child sites, MCR filing date alignment, and Authorizing Official contact updates. The entity's OPAIS registration was brought into full accuracy within [timeframe].
Medicaid Exclusion File Remediation
IHS worked with the entity's billing and pharmacy teams to reconcile actual Medicaid billing practice against MEF declarations. For [number] locations where practices had diverged, IHS prepared corrected MEF declarations and submitted them during the [quarter] registration window. For the period of MEF inaccuracy, IHS prepared documentation supporting a [self-disclosure assessment / retroactive correction memo] characterizing the nature and scope of the discrepancy for the entity's compliance record.
Policy and Procedure Overhaul
IHS developed a complete P&P manual revision covering all HRSA-required domains: covered entity eligibility and OPAIS database maintenance, patient definition and eligibility criteria (aligned to actual TPA software configuration), duplicate discount prevention and MEF update procedures, inventory management and virtual replenishment protocols, contract pharmacy operations and oversight requirements, noncompliance and material breach definitions and self-disclosure procedures, and program education and competency requirements. The revised P&P was reviewed and approved by the entity's [340B Director / compliance team / Authorizing Official] and verified against TPA software configuration for consistency.
Operational Remediation
IHS worked with [TPA software vendor] to correct [number] NDC crosswalk configurations that had generated transactions flagged in the dispensation sample review. EHR charting protocols for the inpatient/outpatient admission boundary were updated with [the clinical informatics team / the pharmacy leadership], with training provided to [number] staff members responsible for 340B accumulation oversight.
Mock HRSA Audit — Phase 4
Following remediation, IHS conducted a mock HRSA audit using the Bizzell Group's documented methodology. The mock audit included:
- Random NDC sampling across [number] dispensations from [time period], traced through the TPA software and EHR to verify eligible outpatient encounters with credentialed prescribers
- Full OPAIS record verification against current registration state
- P&P compliance assessment against HRSA interpretive guidance
- MEF accuracy verification against actual billing records
- Contract pharmacy oversight documentation review, including verification that the required independent annual external audit had been [conducted / scheduled]
Mock audit result: [No adverse findings / [Number] minor findings requiring documentation updates / No findings in the categories that had been identified during Phase 1]. All Phase 1 findings had been remediated. The written mock audit report produced by IHS was structured identically to HRSA's findings format — providing the entity's leadership with a defensible record of the compliance review and its outcomes.
Outcome
The entity [has not been selected for HRSA audit since the engagement completion / was subsequently selected for HRSA audit and received [no adverse findings / only minor administrative findings] / continues under IHS ongoing compliance maintenance retainer].
"[Quote from entity leadership or compliance officer about the value of the engagement — to be added when available.]"
— [Title], [Entity Type]
Key Takeaways
This engagement illustrates patterns that IHS observes consistently across 340B covered entity assessments:
OPAIS maintenance gaps are universal — not exceptional
The OPAIS errors found at this entity — closed contract pharmacies not terminated, MCR alignment gaps, outdated AO contact information — match the finding categories that accounted for 51% of FY2023 adverse findings nationally. These are not edge cases. They are the predictable result of OPAIS requiring active maintenance through quarterly registration windows while entity operations continue to change between those windows.
MEF inaccuracy often follows operational changes, not negligence
In most cases, MEF inaccuracies are not the result of bad faith — they result from operational changes (new contract pharmacy arrangements, billing system changes, carve-in/carve-out election revisions) that were not reflected in OPAIS at the next quarterly window. The solution is a systematic process for triggering MEF review whenever operational changes affecting Medicaid billing occur.
P&P-to-TPA configuration alignment is a specific HRSA scrutiny point
HRSA auditors specifically compare written P&P patient eligibility definitions against TPA software configuration parameters. Entities often update one without the other. Maintaining alignment requires a formal change control process that treats P&P updates and TPA configuration changes as a linked pair.
The 68% re-audit failure rate is a remediation quality problem
The national 68% re-audit failure rate (ADVI, 2025) suggests that most entities responding to adverse findings are submitting CAPs without executing genuine operational change. A corrective action plan that does not change the underlying process will produce the same finding in the next audit. IHS designs remediation to address root causes — not just the documented finding.
About This Case Study
Client identity is confidential. All bracketed elements ([entity type], [number of sites], etc.) will be populated with verified client data upon client approval for publication. Figures cited without brackets — the 51% OPAIS finding rate, 32% MEF finding rate, 63% adverse finding rate, 68% re-audit failure rate — are sourced from publicly available HRSA data and third-party analysis as cited throughout this site.
Don't Wait for HRSA to Tell You What's Wrong
63% of audited covered entities receive adverse findings. A gap assessment identifies your exposure before HRSA selects your entity — not after.
Contact IHS for a 340B Gap Assessment