340B Audit Checklist: HRSA Audit Prep for FQHCs

A HRSA 340B audit is not a surprise visit. You get notice, you get a document request, and you get a window to prepare. Most FQHCs that fail an audit don't fail because of bad intent - they fail because their documentation doesn't match their program design. The good news: every item auditors look for is knowable in advance.

This checklist is what we use when we prep an FQHC for a HRSA audit. It's organized the way HRSA reviews the program - eligibility, then patient definition, then diversion, then duplicate discount, then documentation.

What a HRSA audit actually looks like

HRSA's Office of Pharmacy Affairs (OPA) contracts with a third-party auditor - currently Bizzell Group as of this article's last update - to conduct on-site and virtual audits of covered entities. Verify the current contractor in your own engagement letter. In the audits we have supported, the scope typically covers:

• The 12-month period preceding the audit notice
• All covered outpatient drugs dispensed under 340B
• A judgment-based sample of prescriptions (in our experience, often 50-75 per site)
• Contract pharmacy arrangements, if applicable
• Medicaid billing to check for duplicate discounts

The timings below are what we typically see rather than a published HRSA schedule, and they vary by audit. The auditor generally requests documents around 30 days in advance of the on-site visit. The on-site portion usually runs 2-3 days. A draft finding letter commonly follows within about 60 days, and entities are given 60 days after that to respond with a corrective action plan (CAP) if findings exist.

The eligibility checklist

HRSA confirms your entity is still eligible under the statute that originally qualified you. For FQHCs, that's Section 330 of the Public Health Service Act.

• Current HRSA grant award letter (or look-alike designation letter)
• 340B OPAIS database entry matches your legal name, EIN, and service sites exactly
• All registered child sites fall within the HRSA-approved scope of project (documented on your Notice of Award and Form 5B) and are registered in OPAIS
• Authorizing official and primary contact in OPAIS are current employees
• Re-certification completed in the most recent annual re-cert window

The eligibility finding we see most often at grantees is a child site that was registered in OPAIS but never added to the HRSA-approved scope of project. For a Section 330 grantee, the site has to be on the approved scope (Notice of Award and Form 5B) and registered in OPAIS before it can purchase or dispense at 340B pricing - and 340B dispensing from a site that does not meet both conditions is exposed as a finding. (Hospital covered entities are held to a different standard, where child-site eligibility turns on the site appearing as a reimbursable location on the hospital's Medicare cost report. Do not apply the hospital rule to a grantee, or the reverse.)

The patient definition checklist

The 340B patient definition is the HRSA guideline that creates the most audit findings. The three-part test:

1. The covered entity has an established relationship with the patient (records of care exist)
2. The patient receives healthcare services from a provider employed by or contracted with the covered entity
3. The service is consistent with the entity's federal grant scope

This three-part test comes from HRSA's 1996 patient definition guidance published in the Federal Register. It is sub-regulatory guidance rather than codified regulation, and HRSA's later attempts to replace it were withdrawn - but auditors apply it in practice, so build your documentation against it.

What to document:

• Written 340B patient definition policy that tracks HRSA's three-part test
• Provider credentialing files showing employment or contract status at the time of each dispense
• Referral protocols - if you refer a patient out for a service and continue the 340B-eligible prescription, you need a referral agreement on file
• A clear distinction between primary care visits within grant scope and services outside grant scope (cosmetic dermatology, for example, is typically outside scope)

The diversion checklist

Diversion means dispensing a 340B drug to a person who is not a 340B-eligible patient. Even a small diversion rate, compounded across a year of prescriptions, produces large repayment liabilities.

• A 340B software system that flags ineligible prescriptions before they dispense
• A prescription-level audit trail showing the eligibility decision for every 340B claim
• Contract pharmacy dispensing reports reconciled monthly against your eligibility file
• A current inventory of which manufacturers restrict 340B pricing at your contract pharmacies, plus documentation of how your accumulations and reconciliation account for those restrictions. Manufacturer-imposed contract pharmacy restrictions have reshaped access since 2020 and remain the subject of ongoing litigation and state legislation - the landscape changes frequently, so date the inventory and refresh it
• A written procedure for handling and documenting accumulator adjustments
• Evidence of internal diversion self-audits at least annually

The duplicate discount checklist

Duplicate discounts occur when a state Medicaid agency claims a rebate on a drug that was also purchased at 340B pricing. The statute prohibits this. HRSA checks by pulling your Medicaid Exclusion File (MEF) registration and comparing against your billing.

• MEF entry matches your current carve-in/carve-out status for Medicaid fee-for-service
• Written policy describing how you distinguish 340B-purchased drugs from non-340B inventory for Medicaid FFS billing
• Medicaid Managed Care Organization (MCO) contracts reviewed for billing instructions
• Claim-level documentation matching your state's 340B identification requirements if billing Medicaid for 340B drugs - requirements vary by state and commonly involve a UD modifier, an NDC submission requirement, or a state-specific indicator. Confirm the current expectation with your state Medicaid agency rather than assuming Medicare modifiers (such as the hospital OPPS JG modifier, which has been sunset) apply to Medicaid claims
• Reconciliation report showing no duplicate rebate claims in the audit period

The documentation checklist: 340B policies and procedures

If your P&P manual is weak, HRSA will find something to cite regardless of how well your program actually runs. Strong documentation is the highest-leverage preparation.

• 340B Policy and Procedure manual covering eligibility, patient definition, diversion prevention, duplicate discount prevention, and contract pharmacy oversight
• Annual self-audit report from the prior 12 months
• Training records showing staff completed 340B compliance training
• Software system documentation (vendor, configuration, audit logs)
• Contract pharmacy agreements covering the essential elements described in HRSA's contract pharmacy guidance - that guidance is recommended practice rather than codified regulation, but auditors look for the elements it describes
• Written risk assessment updated annually

The 30-day audit notice response plan

When you receive the audit notice, work backwards from the document submission deadline. Here is the schedule we run for FQHC clients:

Days 1-5: Assemble the core binder. Grant documents, OPAIS records, P&P manual, org chart, and licensing. If any of these are missing, you need to know immediately.

Days 6-14: Pull the prescription sample universe. Export every 340B prescription dispensed in the audit period. This is the dataset the auditor will sample from. Reconcile it against your eligibility file and your 340B software logs. Identify any anomalies now, not later.

Days 15-21: Run the three internal tests. Diversion test: sample 50 prescriptions and confirm patient eligibility for each. Duplicate discount test: pull Medicaid FFS claims for 340B drugs and check modifier use. Contract pharmacy test: reconcile one month of dispensing reports against your eligibility file.

Days 22-27: Correct anything correctable. If you find a potential diversion issue, scope it before you act on it - understand how far back it goes, which sites and drugs are involved, and what the exposure looks like. Self-disclosure is generally viewed more favorably than auditor discovery, but whether an issue is material, how it should be quantified, whether and when to notify HRSA or affected manufacturers, and how repayment is handled are decisions to make with qualified 340B counsel rather than unilaterally. Follow HRSA's current self-disclosure instructions for the mechanics.

Days 28-30: Package and submit. Deliver documents in the format HRSA requests (usually a secure portal). Confirm receipt.

Where FQHCs most often stumble

The pattern we see repeatedly at FQHCs that struggle with HRSA audits:

1. No dedicated 340B coordinator. When 340B compliance is a side duty for the pharmacy director, documentation gaps accumulate quietly until audit notice arrives.
2. Vendor dependence without vendor oversight. FQHCs trust their TPA or contract pharmacy to manage compliance and don't review the output. HRSA's finding goes to the covered entity regardless.
3. Outdated P&P manuals. If the manual references a HRSA guideline from 2018 that's been superseded, the auditor notices.
4. Annual self-audits not actually conducted. The policy says they happen; the records don't show evidence they did.

None of these are hard to fix. They just require someone accountable for 340B compliance with real authority and real time. If that role doesn't exist at your FQHC, create it - or contract it out - before your next audit window opens.