340B Program Compliance Checklist: What HRSA Auditors Actually Look For (2026)

By Vincent Couey, OmniRx founder. Source-cited from FDA, openFDA FAERS, DailyMed, NIH National Library of Medicine, and CMS data. Updated April 25, 2026.

HRSA conducted over 200 audits of 340B covered entities in fiscal year 2025, and findings were issued in roughly 40% of completed reviews. The most common problems are not exotic -- they are basic documentation gaps, inconsistent eligibility checks, and sloppy split-billing logic. We reviewed public audit letters, OIG reports, and HRSA guidance documents to build the compliance checklist that your 340B coordinator should be working from right now.

The 340B Drug Pricing Program, established under Section 340B of the Public Health Service Act (42 USC 256b), allows eligible covered entities to purchase outpatient drugs from manufacturers at significantly reduced prices. In practice, savings range from 25% to 50% off average wholesale price. For a community health center filling 10,000 prescriptions per year, that translates to hundreds of thousands of dollars reinvested in patient care.

But the program comes with strings. HRSA's Office of Pharmacy Affairs (OPA) enforces compliance through audits, and the consequences of non-compliance are real: corrective action plans, manufacturer repayment, or removal from the program entirely. The entities that survive audits cleanly are not necessarily the ones with the largest budgets. They are the ones with disciplined processes and documentation.

This checklist is organized by the categories HRSA auditors evaluate. For each category, we cover what auditors look for, what constitutes a finding, and what you should have in place before you get the notification letter.

1. Patient Eligibility Verification

This is the area where HRSA issues more findings than any other. The core rule: a 340B-priced drug can only be dispensed to a patient of the covered entity. That definition, per HRSA guidelines published in the Federal Register (61 FR 55156), requires three conditions to be met simultaneously.

• The individual receives healthcare services from a covered entity provider. The patient must have a relationship with the entity that goes beyond a single prescription. They must receive a "health care service" -- defined as a service consistent with the entity's scope of grant, project, or contract.
• The individual receives a service that triggers 340B eligibility. Not every encounter qualifies. A patient who visits the entity's dental clinic may not be eligible for 340B-priced medications prescribed by an outside specialist.
• The covered entity maintains records of the relationship. Auditors will pull patient records and cross-reference them against 340B claims. If you cannot demonstrate that the patient was an active patient of your entity at the time of the 340B purchase, the claim is a finding.

Eligibility Red Flags

• Patients with 340B claims but no encounter in your EHR within the past year
• Patients seen only by a referred specialist who is not a covered entity provider
• 340B claims for patients registered at a child site that is not listed on your HRSA OPAIS profile
• No written patient definition policy, or a policy that has not been updated since registration

2. Split Billing and Inventory Management

Covered entities must prevent 340B drugs from being used for non-340B-eligible patients and must prevent non-340B drugs from being billed as 340B. This is the split-billing requirement, and it is where operational complexity becomes a compliance hazard.

There are two accepted models for managing 340B inventory:

Physical Inventory (Separate Stock)

The entity maintains physically separated 340B and non-340B drug inventories. Each inventory has its own purchasing, storage, and dispensing records. This model is straightforward to audit but operationally expensive, especially for entities with limited pharmacy space.

Virtual Inventory (Replenishment Model)

The entity maintains a single physical inventory and uses software to retrospectively determine which prescriptions qualify for 340B pricing. Qualifying claims trigger a replenishment purchase at 340B prices from the wholesaler. This is the model most FQHCs and small hospitals use, and it is the model HRSA scrutinizes most carefully.

Under the virtual model, auditors will examine your replenishment logic in detail. They want to see that every 340B replenishment purchase corresponds to a verified eligible prescription, that replenishment quantities match dispensed quantities, and that timing between dispensing and replenishment is reasonable (typically within the same billing cycle).

Common Split-Billing Findings

3. Duplicate Discount Prevention (Medicaid)

Under 42 USC 256b(a)(5)(A), a covered entity cannot purchase a drug at the 340B price and also receive a Medicaid rebate on that same drug. This is the "duplicate discount" prohibition, and violating it means either the manufacturer or the state Medicaid program absorbs a discount they were not supposed to provide.

Compliance depends on where you operate and what model you use:

• Fee-for-service (FFS) Medicaid states: Covered entities must "carve in" Medicaid patients (use 340B drugs and bill Medicaid at 340B acquisition cost) or "carve out" (exclude Medicaid patients from 340B entirely so the manufacturer rebate applies). You cannot do both for the same drug.
• Managed care Medicaid: Different rules apply depending on state implementation. Entities must verify their Medicaid Exclusion File uploads via the HRSA Medicaid Exclusion File database and ensure their 340B claims system correctly identifies Medicaid managed care claims.