HRSA 340B Audit Prep: A Practical Checklist for FQHCs

A HRSA 340B audit is not a surprise visit. You get notice, you get a document request, and you get a window to prepare. Most FQHCs that fail an audit don't fail because of bad intent - they fail because their documentation doesn't match their program design. The good news: every item auditors look for is knowable in advance.

This checklist is what we use when we prep an FQHC for a HRSA audit. It's organized the way HRSA reviews the program - eligibility, then patient definition, then diversion, then duplicate discount, then documentation.

What a HRSA audit actually looks like

HRSA's Office of Pharmacy Affairs (OPA) contracts with a third-party auditor - currently Bizzell Group - to conduct on-site and virtual audits of covered entities. A typical audit covers:

• The 12-month period preceding the audit notice
• All covered outpatient drugs dispensed under 340B
• A statistically significant sample of prescriptions (usually 50-75 per site)
• Contract pharmacy arrangements, if applicable
• Medicaid billing to check for duplicate discounts

The auditor requests documents ~30 days in advance of the on-site visit. The on-site portion lasts 2-3 days. You receive a draft finding letter within ~60 days, and you have 60 days after that to respond with a corrective action plan (CAP) if findings exist.

The eligibility checklist

HRSA confirms your entity is still eligible under the statute that originally qualified you. For FQHCs, that's Section 330 of the Public Health Service Act.

• Current HRSA grant award letter (or look-alike designation letter)
• 340B OPAIS database entry matches your legal name, EIN, and service sites exactly
• All registered child sites appear on a cost report (Form 990 or Medicare cost report) as reimbursable locations
• Authorizing official and primary contact in OPAIS are current employees
• Re-certification completed in the most recent annual re-cert window

The single most common eligibility finding is a child site that was added to the program but never appears on the cost report. If a site isn't on the cost report, HRSA treats it as ineligible - every prescription dispensed under 340B from that site becomes a finding.

The patient definition checklist

The 340B patient definition is the HRSA guideline that creates the most audit findings. The three-part test:

1. The covered entity has an established relationship with the patient (records of care exist)
2. The patient receives healthcare services from a provider employed by or contracted with the covered entity
3. The service is consistent with the entity's federal grant scope

What to document:

• Written 340B patient definition policy that tracks HRSA's three-part test
• Provider credentialing files showing employment or contract status at the time of each dispense
• Referral protocols - if you refer a patient out for a service and continue the 340B-eligible prescription, you need a referral agreement on file
• A clear distinction between primary care visits within grant scope and services outside grant scope (cosmetic dermatology, for example, is typically outside scope)

The diversion checklist

Diversion means dispensing a 340B drug to a person who is not a 340B-eligible patient. Even a small diversion rate, compounded across a year of prescriptions, produces large repayment liabilities.

• A 340B software system that flags ineligible prescriptions before they dispense
• A prescription-level audit trail showing the eligibility decision for every 340B claim
• Contract pharmacy dispensing reports reconciled monthly against your eligibility file
• A written procedure for handling and documenting accumulator adjustments
• Evidence of internal diversion self-audits at least annually

The duplicate discount checklist

Duplicate discounts occur when a state Medicaid agency claims a rebate on a drug that was also purchased at 340B pricing. The statute prohibits this. HRSA checks by pulling your Medicaid Exclusion File (MEF) registration and comparing against your billing.

• MEF entry matches your current carve-in/carve-out status for Medicaid fee-for-service
• Written policy describing how you distinguish 340B-purchased drugs from non-340B inventory for Medicaid FFS billing
• Medicaid Managed Care Organization (MCO) contracts reviewed for billing instructions
• Claim-level modifier documentation (JG or UD, depending on state) if billing Medicaid for 340B drugs
• Reconciliation report showing no duplicate rebate claims in the audit period

The documentation checklist

If your P&P manual is weak, HRSA will find something to cite regardless of how well your program actually runs. Strong documentation is the highest-leverage preparation.

• 340B Policy and Procedure manual covering eligibility, patient definition, diversion prevention, duplicate discount prevention, and contract pharmacy oversight
• Annual self-audit report from the prior 12 months
• Training records showing staff completed 340B compliance training
• Software system documentation (vendor, configuration, audit logs)
• Contract pharmacy agreements with all required HRSA-recommended terms
• Written risk assessment updated annually

The 30-day audit notice response plan

When you receive the audit notice, work backwards from the document submission deadline. Here is the schedule we run for FQHC clients:

Days 1-5: Assemble the core binder. Grant documents, OPAIS records, P&P manual, org chart, and licensing. If any of these are missing, you need to know immediately.

Days 6-14: Pull the prescription sample universe. Export every 340B prescription dispensed in the audit period. This is the dataset the auditor will sample from. Reconcile it against your eligibility file and your 340B software logs. Identify any anomalies now, not later.

Days 15-21: Run the three internal tests. Diversion test: sample 50 prescriptions and confirm patient eligibility for each. Duplicate discount test: pull Medicaid FFS claims for 340B drugs and check modifier use. Contract pharmacy test: reconcile one month of dispensing reports against your eligibility file.

Days 22-27: Correct anything correctable. If you find a diversion issue, repay it before the audit. Self-disclosure is always viewed more favorably than auditor discovery. File a self-disclosure notice with HRSA through OPAIS if the amount is material.

Days 28-30: Package and submit. Deliver documents in the format HRSA requests (usually a secure portal). Confirm receipt.

The most common findings - and how to prevent each

Where FQHCs most often stumble

The pattern we see repeatedly at FQHCs that struggle with HRSA audits:

1. No dedicated 340B coordinator. When 340B compliance is a side duty for the pharmacy director, documentation gaps accumulate quietly until audit notice arrives.
2. Vendor dependence without vendor oversight. FQHCs trust their TPA or contract pharmacy to manage compliance and don't review the output. HRSA's finding goes to the covered entity regardless.
3. Outdated P&P manuals. If the manual references a HRSA guideline from 2018 that's been superseded, the auditor notices.
4. Annual self-audits not actually conducted. The policy says they happen; the records don't show evidence they did.

None of these are hard to fix. They just require someone accountable for 340B compliance with real authority and real time. If that role doesn't exist at your FQHC, create it - or contract it out - before your next audit window opens.

This article reflects HRSA guidance as of 2026. For audit-specific questions, consult HRSA's Office of Pharmacy Affairs or a qualified 340B consultant.