Is Your 340B Program Ready for a HRSA Audit?
In 2026, stricter HRSA oversight and manufacturer scrutiny have made 340B compliance more critical than ever. Non-compliance can lead to financial penalties, repayment obligations, or even removal from the program — all of which directly impact your ability to serve patients.
Visit the WebSite GATPSOLUTIONS ►
This free checklist covers every major area HRSA auditors examine, broken into simple yes/no checkboxes your team can work through in under an hour. Download it, work through it quarterly, and sleep better knowing your program is audit-ready.
WHY THIS CHECKLIST EXISTS
HRSA audits are no longer rare events. With more than 13,100 parent entities participating in the 340B program, increased participation comes with increased oversight and the likelihood of audits. It’s no longer a question of whether you’ll be audited — it’s a matter of when.
Visit the WebSite Apexus ►
Challenges often include managing complex billing systems, ensuring patient eligibility documentation, integrating data across pharmacies and providers, and reconciling inventory accurately. Many covered entities rely on compliance checklists and audit support tools to stay prepared.
Visit the WeSite GATP SOLUTIONS ►
We built this checklist because we work closely with independent pharmacies across the United States, and we kept hearing the same thing: pharmacists and 340B coordinators knew they needed to stay compliant, but had no simple, plain-English tool to help them do it. This checklist is that tool.
The checklist covers all 8 major areas HRSA auditors examine:
The checklist covers all 8 major areas HRSA auditors examine:
- OPAIS Registration & Recertification
- Covered Entity & Patient Eligibility
- Drug Diversion Prevention
- Duplicate Discount Prevention
- Contract Pharmacy Compliance
- Record-Keeping & Documentation
- Medicaid Billing Compliance
- Annual Recertification & Self-Audit
The checklist covers all 8 major areas HRSA auditors examine:
Published by 340bprogram.com | Updated Quarterly
Work through each section with your 340B coordinator, pharmacy director, or compliance team. Check each box when confirmed. Flag any unchecked items for immediate corrective action.
SECTION 1 — OPAIS REGISTRATION & RECERTIFICATION
OPAIS errors were the single leading cause of audit findings in 2024, accounting for 62% of FY2024 audit findings. Verify every item below. Visit the WebSite GATP SOLUTIONS ►
☐ Our pharmacy’s legal name in OPAIS exactly matches our DEA registration — word for word, abbreviation for abbreviation
☐ Our pharmacy’s physical address in OPAIS exactly matches our DEA registration and our written contract with the covered entity
☐ We have verified that our OPAIS record shows “Active” status — not Pending, Terminated, or To-Be-Terminated
☐ Our covered entity’s Authorizing Official (AO) OPAIS account is current and the AO is still authorized to bind the organization
☐ Our covered entity’s Primary Contact (PC) OPAIS account is current and the PC is a direct employee — not a consultant or contractor
☐ We have added noreply@hrsa.gov to our email spam filter so OPAIS notifications are not missed
☐ We have completed annual recertification on time during the required recertification window
☐ We have notified HRSA immediately of any changes to our pharmacy name, address, ownership, or covered entity arrangement
☐ All off-site outpatient facilities and contract pharmacy locations listed in OPAIS are current and accurate
☐ We have reviewed OPAIS records within the last 30 days and confirmed all information is up to date
⚠️ Flag any unchecked box above for immediate action. Outdated OPAIS records are the #1 cause of compliance violations.
SECTION 2 — COVERED ENTITY & PATIENT ELIGIBILITY
One of the most frequently cited audit findings is dispensing 340B drugs to patients who do not meet the covered entity’s patient eligibility definition. Every prescription must be traceable to an eligible patient.
☐ We have a written, documented definition of what constitutes an “eligible patient” for our covered entity
☐ We have a process in place to verify patient eligibility before each 340B prescription is dispensed
☐ Patient eligibility is verified at the point of dispensing — not assumed based on prior visits
☐ We maintain documentation of patient eligibility verification for every 340B prescription dispensed
☐ Our eligibility verification process accounts for patients seen at off-site facilities and outpatient clinics
☐ We have a process in place to identify and flag patients who may no longer meet eligibility criteria
☐ For hospitals: our eligible outpatient clinic locations are documented and listed on our most recently filed Medicare Cost Report (MCR)
☐ For grantees: our eligible service locations are included on our current grant documentation
☐ We have a written policy describing what to do when a patient’s eligibility status is uncertain
☐ Our patient eligibility records are stored in a centralized, accessible system and are available for HRSA review at any time
SECTION 3 — DRUG DIVERSION PREVENTION
Drug diversion — dispensing 340B drugs to ineligible patients — is one of the two most serious violations in the program. Penalties can include repayment of all affected drug costs and removal from the program.
☐ We have a written drug diversion prevention policy that is current, signed, and accessible
☐ We have a documented process for confirming that 340B drugs are only dispensed to eligible patients
☐ Our pharmacy system has controls in place to prevent 340B drugs from being dispensed to ineligible patients
☐ We conduct regular internal audits of dispensing records to identify any potential diversion
☐ We maintain records of all drugs administered or dispensed, including quantities, patient IDs, and associated payers Visit the WebSite Virtue 340B ►
☐ We have a process for investigating and self-disclosing any suspected diversion events to HRSA
☐ Staff involved in 340B dispensing have received documented training on diversion prevention within the last 12 months
☐ Our contract pharmacy(ies) have their own diversion prevention policies in place and we have documented proof
☐ Covered entities with contract pharmacies have completed an annual external audit of contract pharmacy operations Visit the WebSite Apexus ►
☐ We have a clear definition of what constitutes non-compliance or diversion and have documented it in our policies
SECTION 4 — DUPLICATE DISCOUNT PREVENTION
A duplicate discount occurs when a 340B-priced drug is also subject to a Medicaid rebate. This is strictly prohibited and is one of the most penalized violations in the program.
☐ We have a documented process — a “carve-out” system — to prevent 340B drugs from being billed to Medicaid Fee-for-Service
☐ Our pharmacy system is configured to prevent 340B claims from being submitted to Medicaid unless an approved carve-in arrangement is in place
☐ If we have a Medicaid carve-in arrangement: it has been approved by HRSA and reported to our state Medicaid agency
☐ If we have a Medicaid carve-in arrangement: it is listed correctly in OPAIS
☐ We have Medicaid billing forms on file for each site involved in Medicaid billing, with accurate NPIs
☐ We have described each state’s billing requirements for 340B drugs dispensed at our pharmacy and at our facilities
☐ We conduct quarterly reviews of Medicaid billing records to identify any potential duplicate discount situations
☐ Our contract pharmacy(ies) follow our carve-out or carve-in procedures and we have written confirmation of this
☐ Staff handling Medicaid billing have been trained on duplicate discount prevention within the last 12 months
☐ We are prepared to present Medicaid billing claims during a HRSA audit at any time
SECTION 5 — CONTRACT PHARMACY COMPLIANCE
If your covered entity uses contract pharmacies, this section is critical. Managing contract pharmacy agreements is crucial for HRSA audits — keep fully executed copies of these contracts readily accessible and confirm they meet HRSA’s requirements. Visit the WebSite Fqhc340b ►
☐ We have a fully executed written contract with every contract pharmacy we use — signed by both parties
☐ The pharmacy name and address in every contract exactly matches the corresponding OPAIS record
☐ All contract pharmacy arrangements are registered and showing as “Active” in OPAIS
☐ We have notified HRSA immediately of any changes to our contract pharmacy arrangements
☐ Our contract pharmacies carve out Medicaid — or have an approved carve-in arrangement on file
☐ Our contract pharmacies have their own written policies for preventing drug diversion and duplicate discounts
☐ We have obtained proof of an independent external audit of our contract pharmacy operations — this is now a required data element in the HRSA audit Data Request List Visit the WebSite Virtue 340B ►
☐ We receive quarterly financial statements and dispensing summaries from each contract pharmacy
☐ Our contract pharmacy agreements are stored in a centralized location with version control — original agreement plus all amendments clearly labeled
☐ We have a process for terminating a contract pharmacy arrangement and notifying HRSA if a contract pharmacy relationship ends
SECTION 6 — RECORD-KEEPING & DOCUMENTATION
Maintaining auditable records is essential. These records are your defense against potential program removal. HRSA can request records at any time — not just during scheduled audits. Visit the WebSite Virtue 340B ►
☐ We maintain purchasing documentation — a list of all 340B drugs purchased from the wholesaler, with pricing details
☐ We maintain a complete record of all drugs administered or dispensed through the 340B program
☐ Our 340B purchase records align with the historical purchases reported on the 340B Prime Vendor Program (PVP) website
☐ We maintain a detailed list of all wholesaler accounts used for 340B drug purchasing
☐ All policies and procedures related to our 340B program are written, current, signed, and dated
☐ We use a centralized, easily accessible digital storage system for all 340B auditable records — not personal folders or individual staff members’ computers Visit the WebSite Virtue 340B ►
☐ We use standardized naming conventions for documents — especially contract pharmacy agreements and their amendments
☐ We maintain physical backup copies of critical records in addition to digital storage
☐ All 340B records are stored securely and access is limited to authorized staff
☐ We have a document retention policy specifying how long 340B records are kept — and we follow it
☐ All records are accessible and retrievable within 24 hours of an audit request
SECTION 7 — MEDICAID BILLING COMPLIANCE
☐ We have documented each state’s specific requirements for billing 340B drugs dispensed at our pharmacy
☐ We use the correct billing modifiers for 340B claims as required by each state
☐ We are prepared to produce copies of Medicaid claims during a HRSA audit on-site or remotely
☐ Our billing staff are trained on 340B-specific Medicaid billing requirements within the last 12 months
☐ We have a process to identify and correct Medicaid billing errors before they become compliance violations
☐ We have confirmed our NPIs are correctly listed on all Medicaid billing forms for each covered location
SECTION 8 — ANNUAL RECERTIFICATION & SELF-AUDIT
HRSA performs annual recertification, giving covered entities a chance to review their 340B program responsibilities and confirm they are in full compliance. Don’t wait for HRSA to find problems — find them yourself first. Visit the WebSite Health Resources and Services Administration ►
☐ We complete annual recertification on time during the required HRSA recertification window
☐ We conduct a formal internal self-audit of our 340B program at least once per year — more often if volume is high
☐ We use HRSA’s self-audit tools available on the 340B PVP website as the basis for our internal audit
☐ We have established a 340B oversight committee within our organization as part of our ongoing compliance framework Visit the WebSite Apexus ►
☐ At least one member of our team holds a 340B Apexus Certified Expert (ACE) certification or we have engaged a qualified 340B compliance consultant
☐ We review regulatory updates — HRSA guidance, court decisions, and state legislation — at least monthly
☐ We have a self-disclosure process in place and know how to report non-compliance to HRSA at 340bselfdisclosure@hrsa.gov
☐ We have a Corrective Action Plan (CAP) template ready in case a compliance issue is identified
☐ Our self-audit results are documented, dated, and stored with our 340B compliance records
☐ We have reviewed the most recent HRSA Audit Data Request List (DRL) for FY2026 and confirmed our records would satisfy each requirement
SCORING YOUR CHECKLIST
All boxes checked: Your 340B program is in strong compliance shape. Review again in 90 days.
1–5 boxes unchecked: Address these items within 30 days. Assign a staff member to each unchecked item with a deadline.
6–10 boxes unchecked: Your program has meaningful compliance gaps. Prioritize the unchecked items immediately and consider engaging a 340B compliance consultant.
More than 10 boxes unchecked: Your program has significant compliance risk. Contact the 340B Prime Vendor Program (1-888-340-2787) and consider a formal compliance review before your next HRSA audit.
SCORING YOUR CHECKLIST
Step 1 — Document the gap. Write down exactly what is missing, who is responsible for it, and what the risk is.
Step 2 — Assign ownership. Every compliance gap needs one person responsible for fixing it, with a clear deadline.
Step 3 — Self-disclose if necessary. If you discover an actual violation — not just a documentation gap — report it to HRSA at 340bselfdisclosure@hrsa.gov with a plan to address it. Self-disclosure before an audit is treated far more favorably than violations discovered during one.
Step 4 — Get help if needed. The 340B Prime Vendor Program offers free technical assistance at 1-888-340-2787 or apexusanswers@340bpvp.com. If your gaps are significant, consider engaging a qualified 340B compliance consultant.
KEY CONTACTS & RESOURCES
340B Prime Vendor Program (Free Technical Assistance)
340bpvp.com | apexusanswers@340bpvp.com | 1-888-340-2787
Monday–Friday, 9am–6pm ET
HRSA Office of Pharmacy Affairs
hrsa.gov/opa
Self-Disclosure Email
340bselfdisclosure@hrsa.gov
OPAIS Registration System
340bregistration.hrsa.gov
HRSA FY2026 Audit Data Request List (Sample)
Available at 340bpvp.com under 340B Tools
AFTER DOWNLOAD CTA SECTION
Thank You for Downloading Your Free 340B Compliance Checklist
While you have it open — here’s one more thing to consider for your 340B patients.
Your 340B patients are among the most medically complex patients you serve. Many are managing five, ten, or fifteen medications per day for chronic conditions like diabetes, HIV, hypertension, and mental health disorders. Medication non-adherence among these patients is a serious and costly problem — one that lands patients back in the hospital and undermines the outcomes your program exists to improve.
Pharmacy-grade blister cards solve this problem.
Each individual dose is sealed in its own foil compartment. Torn foil means the dose was taken. Sealed foil means it wasn’t. No confusion. No double doses. No missed medications.
Studies show blister card packaging improves medication adherence from 61% to 96% — and they’re the same cards used by pharmacists worldwide, now available for your pharmacy and your patients’ caregivers to fill at home.
Information on this page is provided for general educational purposes and is current as of 2026. 340B program rules are subject to change. For compliance-specific guidance, consult a qualified 340B consultant or healthcare attorney. For registration assistance, contact the 340B Prime Vendor Program at 1-888-340-2787.