HRSA audits can be stressful for 340B covered entities, especially when documentation, patient eligibility, or purchasing records are not well organized. The best approach to 340B drug pricing compliance is to treat audit readiness as an ongoing process rather than something to handle only after receiving an audit notice.

The Health Resources and Services Administration (HRSA) expects covered entities to maintain accurate records, follow 340B requirements, prevent diversion and duplicate discounts, and be prepared to demonstrate compliance during an audit.

What Does a HRSA 340B Audit Review?

A HRSA 340B audit is designed to determine whether a covered entity is following the requirements of the 340B Drug Pricing Program.

HRSA audits can examine several areas, including:

• Covered entity eligibility

• Patient eligibility and diversion

• Duplicate discounts

• 340B purchasing and dispensing records

• Medicaid billing practices

• Contract pharmacy oversight

• Policies, procedures, and internal controls

• Accuracy of information maintained in the 340B Office of Pharmacy Affairs Information System (OPAIS)

HRSA may conduct audits remotely or onsite. During the pre-audit stage, auditors can request documents related to policies, procedures, and internal controls. During the audit, they review selected 340B data and evaluate how the organization's processes actually operate.

This means having written policies is not enough. The organization must also be able to show that those policies are being followed.

Start With the Basic 340B Compliance Requirements

Strong 340B audit preparation begins with the fundamentals.

HRSA requires covered entities to keep their OPAIS information accurate and current, complete annual recertification, prevent diversion of 340B drugs to ineligible patients, prevent duplicate discounts, and maintain records that can demonstrate compliance.

A good internal review should ask:

Is our OPAIS information accurate?
Check covered entity information, registered outpatient facilities, and contract pharmacies.

Are we completing annual recertification correctly?
Make sure responsible staff understand the requirements and deadlines.

Can we prove patient eligibility?
Review the processes used to determine whether a patient qualifies under the 340B requirements.

Are we preventing duplicate discounts?
Review Medicaid billing processes and make sure the appropriate Medicaid Exclusion File information is maintained.

Can we produce supporting records?
An auditor should be able to trace transactions through the relevant purchasing, dispensing, billing, and patient records.

Review Your Policies and Procedures

One of the most useful steps in 340B audit readiness is reviewing written policies before HRSA does.

Policies should clearly explain who is responsible for different parts of the program. They should cover areas such as purchasing, inventory, patient eligibility, Medicaid billing, contract pharmacy oversight, diversion prevention, and duplicate discount prevention.

Do not stop at reviewing the document itself.

Ask whether staff members actually follow the documented process. A policy that says one thing while the organization's daily workflow does something else can create problems during a 340B program audit.

It is also useful to document changes when processes are updated. This creates a clearer record of how the organization manages compliance over time.

Check Patient Eligibility and Diversion Controls

Diversion is one of the key areas reviewed during HRSA audits. Covered entities must make sure 340B drugs are provided only to eligible patients under the applicable program requirements.

Organizations should regularly review how patient eligibility is determined and how that information moves between clinical, pharmacy, and billing systems.

For example, an internal review might trace a sample of 340B transactions from the patient record through dispensing and billing. The goal is to confirm that the transaction meets the organization's eligibility rules and that supporting records are available.

This type of testing can reveal process gaps before they become audit findings.

Pay Close Attention to Duplicate Discounts

Duplicate discounts occur when a covered entity receives a 340B discount on a drug while the manufacturer also provides a Medicaid rebate for the same drug.

Preventing this requires reliable Medicaid billing controls. HRSA specifically requires covered entities to report how they bill Medicaid fee-for-service drugs through the Medicaid Exclusion File.

As part of 340B compliance monitoring, organizations should review:

• Medicaid billing arrangements

• Medicaid Exclusion File information

• Claims and purchasing records

• Internal processes for identifying potential duplicate discounts

• Changes to payer or billing arrangements

The goal is to make sure the organization's billing process matches its documented 340B policy.

Do Not Overlook Contract Pharmacies

Contract pharmacies add another layer of oversight.

The covered entity remains responsible for ensuring that its contract pharmacy arrangements meet statutory requirements related to diversion and duplicate discounts. HRSA recommends quarterly internal audits and annual independent audits, or more frequent reviews when necessary.

A strong contract pharmacy review should include reconciliation of relevant dispensing, purchasing, and billing records. Organizations should also maintain written procedures explaining how contract pharmacy compliance is monitored.

This is particularly important because problems at a contract pharmacy can still create compliance issues for the covered entity.

Build a Regular 340B Audit Preparation Process

The best time to prepare for an HRSA audit is before an audit is announced.

Instead of conducting one large review every few years, create a regular 340B compliance monitoring schedule.

For example:

Monthly:
Review selected transactions, purchasing activity, billing exceptions, and unusual activity.

Quarterly:
Conduct deeper internal reviews of high-risk areas and contract pharmacy activity.

Annually:
Review policies, OPAIS information, recertification requirements, training, and overall program controls.

When processes change:
Reassess compliance when adding facilities, changing pharmacies, modifying billing processes, or implementing new technology.

Regular reviews make it easier to identify small problems before they become larger ones.

Organize Your Audit Documentation

Good documentation can make an HRSA audit much easier to manage.

Create a central location for important 340B records, including:

• Current policies and procedures

• OPAIS information

• Annual recertification records

• Purchasing records

• Dispensing records

• Patient eligibility documentation

• Medicaid billing records

• Contract pharmacy agreements and reviews

• Internal audit results

• Staff training records

• Corrective action documentation

The objective is simple: when auditors request evidence, your team should know where to find it.

Organizations looking to strengthen their processes can also work with experienced 340B program management professionals to identify gaps, improve controls, and build a more structured compliance process.

What If You Find a Compliance Problem?

Finding an issue during an internal review is not a reason to ignore it. It is an opportunity to correct the problem before it becomes a larger concern.

Start by determining what happened, how long the issue existed, which transactions may be affected, and whether the problem involves diversion, duplicate discounts, eligibility, or another requirement.

Document the investigation and corrective actions.

HRSA states that covered entities may need to make repayments to affected manufacturers when violations are identified. HRSA can also require a corrective action plan and additional documentation before an audit is closed.

A repeat finding can receive additional scrutiny. In certain circumstances, serious and repeated diversion findings can have significant consequences for a covered entity's participation in the program.

Common Questions About 340B Audit Readiness

How often should a 340B covered entity conduct an internal audit?

There is no single schedule that fits every organization. Regular monitoring should focus on the organization's size, risk areas, transaction volume, and program structure. HRSA specifically recommends quarterly internal audits and annual independent audits for utilized contract pharmacies.

What is the biggest mistake organizations make during 340B audits?

A common problem is assuming that having policies automatically means the organization is compliant. HRSA reviews how policies and procedures are actually operationalized, so organizations should test their controls and keep evidence of those reviews.

What should an organization do before receiving an HRSA audit notice?

Review OPAIS information, test patient eligibility controls, check for duplicate discounts, review contract pharmacy activity, organize documentation, and conduct an internal assessment of key 340B compliance requirements.

Make Audit Readiness Part of 340B Management

HRSA audit preparation should not be a last-minute exercise. A stronger approach is to build compliance into everyday 340B program management.

Regular monitoring, accurate records, clear policies, staff training, transaction testing, and timely corrective action can help organizations identify weaknesses early.

Most importantly, 340B covered entities should be able to explain how their program works and provide evidence that their controls are working as intended. That is what turns 340B audit readiness from a stressful event into a routine part of responsible program management.