340B Program FAQ: HRSA Audits and Compliance

What did HRSA's posted audit results show for FY2023 to FY2025?

HRSA posted results for 561 covered entity audits across FY2023, FY2024 and FY2025, and 353 of them carried at least one adverse finding. Incorrect 340B OPAIS records appeared in 247 of the posted results, duplicate discount findings in 126, diversion findings in 91 and group purchasing organization (GPO) findings in 7.

Fiscal year	Results posted	With adverse findings	No adverse findings	Incorrect OPAIS record	Duplicate discount	Diversion	GPO
FY2023	193	130	63	80	51	28	4
FY2024	192	125	67	95	35	29	1
FY2025	176	98	78	72	40	34	2
FY2023 to FY2025	561	353	208	247	126	91	7

This is an IHS tally of HRSA's posted covered-entity audit results for FY2023 to FY2025 as read October 6, 2026. Each count is the number of posted results that carry that finding category, and an entity can have more than one finding. FY2026 is partial and left out. HRSA states that each results chart includes audits whose findings are final and that remaining audits are still under review.

Frequently asked questions

What is the 340B Drug Pricing Program and who administers it?

The 340B Drug Pricing Program is a federal program created by Section 340B of the Public Health Service Act, 42 U.S.C. 256b, and run by HRSA through its Office of Pharmacy Affairs (OPA). HRSA describes it as a program under which manufacturers that participate in Medicaid agree to provide outpatient drugs to covered entities at significantly reduced prices. OPA handles registration, recertification and audits of covered entities. Sources: HRSA 340B program home, registration and program integrity pages, page opened October 6, 2026.

Who is eligible to be a 340B covered entity?

Section 340B(a)(4) of the Public Health Service Act lists the organizations that can participate. The list includes federally qualified health centers, Ryan White HIV/AIDS program grantees, black lung clinics, hemophilia treatment centers, Native Hawaiian Health Centers, urban Indian organizations, sexually transmitted disease and tuberculosis clinics, and the hospital categories in subparagraphs (L) through (O): disproportionate share hospitals, children's and free-standing cancer hospitals, critical access hospitals, and rural referral and sole community hospitals. Each hospital category has its own statutory conditions. A covered entity must recertify every year and must tell OPA in OPAIS immediately when its eligibility changes, and then stop purchasing at 340B prices. Your counsel confirms which category fits your registration. Sources: Section 340B of the PHS Act (HRSA PDF) and HRSA eligibility page, page opened October 6, 2026.

What duties does the 340B statute place on a covered entity?

A covered entity must not take duplicate discounts, must not resell drugs to people who are not its patients, and must permit audits. Section 340B(a)(5)(A) bars a Medicaid payment request for a drug that is subject to a state Medicaid rebate, subparagraph (B) says the entity "shall not resell or otherwise transfer the drug to a person who is not a patient of the entity," and subparagraph (C) lets the Secretary and the manufacturer audit the entity's records on those two duties. HRSA's requirements page adds that an entity must keep its OPAIS records accurate, register all outpatient facilities and contract pharmacies, recertify every year and keep auditable records. Sources: statute PDF and HRSA program requirements, page opened October 6, 2026.

What do OPAIS registration and annual recertification require?

A covered entity must keep its record in the 340B Office of Pharmacy Affairs Information System (OPAIS) accurate, register new outpatient facilities in set windows, and recertify its eligibility every year. HRSA's registration page sets four 15-day windows for new covered entities and added outpatient facilities: January 1 to 15, April 1 to 15, July 1 to 15 and October 1 to 15, with registrations starting on April 1, July 1, October 1 and January 1. For recertification, HRSA emails the Primary Contact and the Authorizing Official, the Authorizing Official verifies compliance with all program requirements and submits, and an entity that misses the scheduled time frame is terminated from the program. IHS drafts the record corrections and the recertification checklist, and your Authorizing Official submits. Sources: HRSA registration and recertification pages, page opened October 6, 2026.

What is the difference between a duplicate discount and diversion?

A duplicate discount is a second price benefit on the same drug, and diversion is giving a 340B drug to someone who is not the entity's patient. The statute prohibits both in section 340B(a)(5)(A) and (B). HRSA's requirements page says manufacturers must not provide a 340B price and a Medicaid rebate on the same drug and that covered entities report how they bill Medicaid fee-for-service drugs on the Medicaid Exclusion File. HRSA's audit procedures test the entity's controls for both, including how it decides whether a patient is inpatient or outpatient and the accuracy of its Medicaid Exclusion File designations. HRSA's 2013 audit notice points to its patient definition guidelines at 61 FR 55156, published October 24, 1996. Sources: program requirements, program integrity and the 2013 audit notice, page opened October 6, 2026.

How does HRSA select covered entities for audit?

HRSA's 2013 audit notice describes two kinds of audit, risk-based and targeted. Risk-based audits first draw entities at random from program types HRSA judged to carry higher risk because of purchase volume, complexity of program administration and use of contract pharmacies, and later audits draw from lower-risk types. Targeted audits can be triggered by allegations of violations, including those from whistleblowers, manufacturers or self-reporting by entities, and findings may be referred to the Office of Inspector General or the Department of Justice. The notice is HRSA's published strategy as of February 8, 2013 (Release No. 2012-1.1) and does not list every current selection factor. Only one audit of a covered entity is allowed at a time. Sources: the 2013 notice and program integrity page, page opened October 6, 2026.

What happens during an HRSA 340B audit?

Contracted auditors do the field work for OPA, onsite or remotely, in three stages. Before the audit, the entity receives an engagement letter and an introductory teleconference requests its policies, procedures and internal controls documents. During the audit, auditors review the policies and how they are put into practice, verify eligibility including the GPO prohibition and outpatient clinic eligibility, verify controls against diversion and duplicate discounts, review compliance at facilities and contract pharmacies, and test drug transaction records on a sample or judgmental basis. After the audit, auditors send a preliminary report to HRSA, and HRSA drafts the Final Report and requests a corrective action plan (CAP) if one applies. HRSA built a program-specific audit process, and the 340B statute does not require HRSA to use Generally Accepted Government Auditing Standards. Source: HRSA program integrity page, page opened October 6, 2026.

What happens after HRSA issues a Final Report with findings?

The entity has 30 calendar days to review the findings, and if it agrees it submits a CAP within 60 calendar days for HRSA's approval. If it disagrees, it notifies HRSA in writing within 30 calendar days with supporting documentation and waits for HRSA's review before submitting a CAP. HRSA expects full CAP implementation and settlement with affected manufacturers within six months of CAP approval unless HRSA approves otherwise, and the entity identifies and contacts those manufacturers about repayment. Failing to submit a CAP may lead to removal from the program, and HRSA summarizes findings and sanctions on its public website. A finding of diversion in two or more audits may be treated as systematic and egregious and can lead to removal. IHS drafts the CAP and the written response and tracks the work to closure, and your named contact submits to HRSA. Source: HRSA program integrity page, page opened October 6, 2026.

Which findings appear most often in HRSA's posted audit results?

Incorrect 340B OPAIS records appeared more often than any other category in the table above, in 247 of the 561 posted results for FY2023 to FY2025. Duplicate discount findings appeared in 126, diversion in 91 and GPO findings in 7, and 208 results had no adverse finding. These counts are an IHS tally of HRSA's posted results as read October 6, 2026, and an entity can carry more than one finding. Sources: HRSA audit results for FY2023, FY2024 and FY2025, page opened October 6, 2026.

What is a 340B self-disclosure and when should an entity use it?

A self-disclosure is a report to HRSA about a material breach of compliance, made while the entity moves to correct the issue. HRSA recommends that each covered entity establish and document criteria for when a breach is material. A comprehensive self-disclosure includes a letter with the 340B ID, a description of the violation, a CAP and a strategy for working with manufacturers, including any financial remedy. HRSA expects the CAP and any manufacturer settlements to finish within six months of the initial submission, and a self-disclosure made between receipt of an audit engagement letter and the end of the audit period may be folded into the audit review and Final Audit Report. IHS drafts the materiality criteria and the disclosure package for your counsel and Authorizing Official to review, and your organization decides whether to disclose and submits. Source: HRSA self-disclosures page, page opened October 6, 2026.

What are the GPO prohibition and the orphan drug exclusion?

The GPO prohibition bars certain hospitals from obtaining covered outpatient drugs through a group purchasing organization, and the orphan drug exclusion removes designated rare disease drugs from the covered outpatient drugs of certain hospital types. HRSA's requirements page applies the GPO prohibition to disproportionate share hospitals, free-standing cancer hospitals and children's hospitals. Under section 340B(e), the exclusion applies to entities described in subparagraph (M) other than a children's hospital, and to subparagraphs (N) and (O), meaning free-standing cancer hospitals, critical access hospitals, rural referral centers and sole community hospitals. The excluded drugs are those the Secretary designated under section 526 of the Federal Food, Drug, and Cosmetic Act for a rare disease or condition. Sources: statute PDF and HRSA program requirements, page opened October 6, 2026.

How is a mock review different from an HRSA audit?

A mock review is a voluntary, private review that IHS runs against HRSA's published audit approach and your own written policies, and an HRSA audit is an official federal audit with a Final Report, a CAP request and public posting of findings. IHS reviews your OPAIS record, your Medicaid Exclusion File designations and your policies, and samples drug transaction records, which are areas HRSA's published audit procedures list. The findings report goes to your organization in IHS's own format with each gap ranked. A mock review is not an HRSA audit, does not predict one and does not replicate the auditor's methodology or report format. Source: HRSA program integrity page, page opened October 6, 2026.

How much does 340B compliance consulting cost?

The cost has three parts that different parties set: consulting fees, your internal staff time, and any repayment owed to manufacturers if a violation is found. A government or manufacturer audit is conducted at the Secretary's or the manufacturer's expense under section 340B(a)(5)(C), and an entity found in violation after an audit, notice and hearing is liable to the manufacturer for the price reduction on the drug involved under subparagraph (D). IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and gap severity change the work. Source: statute PDF, page opened October 6, 2026.

Who is this not for?

This page and IHS's 340B service are not for an organization that wants someone to represent it before HRSA or a manufacturer, or that needs legal advice on a specific audit, dispute or repayment, because those need counsel. They also do not fit an organization that is not a registered covered entity. The answers here are general information from HRSA and the statute, and your counsel confirms how they apply to your registration.

What this is not

• IHS is not part of HRSA and does not conduct HRSA audits, select entities for audit or decide findings.
• IHS does not contact HRSA or submit to OPAIS for you. IHS drafts, and your Authorizing Official or named contact submits.
• These answers are general information and not legal advice, and a mock review is not an HRSA audit and does not guarantee an audit outcome.