How to Prepare for a HRSA 340B Audit: A 90-Day Readiness Plan

Most 340B programs don’t run into trouble during an audit because of some dramatic misconduct. They run into trouble because, on a tight deadline, nobody can find the one record that proves a specific transaction was clean. The patient was eligible, but the encounter note is buried in a system nobody on the call can access. The contract pharmacy agreement exists, but it still names a store location that closed eighteen months ago. The self audit happened, but no one wrote down which claims were actually tested.

That gap between what a program does and what it can prove is where most avoidable HRSA 340B audit findings come from. This guide walks through how to prepare for a HRSA 340B audit before the notice ever lands in your inbox: what the HRSA audit process looks like, what tends to trigger an audit, which documents auditors ask for, and a practical, phase-by-phase 90-day plan for building real 340B audit readiness.

Key Takeaways

If you only have two minutes, here’s what matters most about how to prepare for a HRSA 340B audit:

• HRSA auditors test transaction-level evidence, not just written policies. Your data has to support every dollar of 340B pricing you claimed.
• Audit selection is largely risk-based. Purchase volume, contract pharmacy complexity, and recent operational changes all deserve extra internal scrutiny.
• A defensible 340B self audit uses a documented, risk-based sampling method and logs every exception, including ones that were quickly fixed.
• Not every finding is a material breach, but every finding needs a documented root-cause analysis, a corrective action plan, and a repayment assessment where relevant.
• Retrieval speed matters. If you can’t produce a complete response to a sample request list in about two weeks, you aren’t audit-ready yet.

A quick, honest caveat before we start: no 90-day plan can guarantee a clean audit. Results depend on your actual transaction history and on what the auditor finds. What structured preparation does reliably reduce is the number of avoidable, paperwork-driven observations: findings that arise not because a rule was broken, but because the evidence of compliance was disorganized, incomplete, or impossible to retrieve in time.

What Is a HRSA 340B Audit?

A HRSA 340B audit is a compliance review conducted on behalf of the Health Resources and Services Administration’s Office of Pharmacy Affairs (OPA), usually carried out by a contracted audit firm. It tests whether a covered entity is meeting program requirements across three core areas:

• Eligibility: Is the entity, and each site using 340B drugs, eligible for the program and accurately registered in the 340B Office of Pharmacy Affairs Information System (OPAIS)?
• Diversion: Are 340B drugs going only to patients of the covered entity, as the program defines them?
• Duplicate discounts: Is the entity preventing the same drug unit from being discounted twice, once through 340B pricing and again through a Medicaid Drug Rebate Program rebate?

Here’s the part many teams underestimate: auditors test transactions, not binders. A beautifully written diversion policy won’t protect you if the purchasing, dispensing, and eligibility records underneath it tell a different story. True compliance readiness means your real data backs up the 340B pricing you claimed. If you need a refresher on the fundamentals, our guides on what 340B is and how 340B audits work cover the basics.

It’s also worth separating HRSA audits from manufacturer audits. Manufacturers can audit covered entities under HRSA’s 1996 manufacturer audit guidelines, but those follow a different process and generally require HRSA’s involvement. This article focuses on audits conducted by or on behalf of HRSA.

What Triggers a HRSA 340B Audit?

HRSA does not publish a scoring formula, so be cautious of anyone offering a definitive trigger list. What HRSA has said publicly is that it audits a significant number of covered entities each year, that most are selected on a risk basis, and that others are targeted for specific reasons. In practice, the following factors tend to raise an entity’s profile:

• High 340B purchase volume. Larger programs represent more program dollars, so they naturally draw more attention.
• A large contract pharmacy network. More pharmacies mean more locations where diversion or duplicate discounts could occur.
• Operational complexity. Many child sites, multiple entity types, or complicated split-billing arrangements create more points of failure.
• Manufacturer allegations. A manufacturer complaint referred to HRSA can lead to a targeted audit.
• Self-disclosure. An entity that reports its own compliance issue may be reviewed to confirm the corrective action worked.

Periods of change deserve special attention too. A merger, a new outpatient clinic, a contract pharmacy added or dropped, a switch in Medicaid carve-in or carve-out status, or a move to a new third-party administrator (TPA) all create moments where the registration record, the written policy, and the actual workflow can quietly drift apart.

None of these factors guarantees an audit. They simply tell you where to look first during your own internal review. For a broader view of what auditors examine, see our breakdown of the 25 areas HRSA examines in a 340B audit.

The HRSA Audit Process: What to Expect Step by Step

Understanding the HRSA audit process matters because each phase tests something different: registration accuracy, documented controls, and transaction-level proof. A strong readiness plan prepares for all three, not just the one that’s easiest to fix on paper.

1. Notification. HRSA contacts the Authorizing Official (AO) and Primary Contact (PC) listed in OPAIS. If those contacts are out of date, the notice can sit unread in a former employee’s inbox, which is one more reason to keep registration current.
2. Audit engagement letter and pre-audit call. The audit engagement letter outlines the scope, the review period, and the sites involved. A pre-audit call then covers logistics, contacts, and timing.
3. Data request and sample request list. You’ll receive a data request list, followed by a sample request list of specific transactions you must support with documentation. Turnaround windows are typically much tighter than most teams expect.
4. Fieldwork. Whether onsite or virtual, auditors review OPAIS accuracy, evaluate policies and procedures, and test sampled transactions against eligibility, purchasing, and dispensing records. This can extend to child sites and contract pharmacies. Anything an auditor says during fieldwork is preliminary; auditors gather facts, but OPA makes the compliance determination.
5. Final report. The auditor submits results to OPA, which reviews them and issues a final report to the covered entity.
6. Response and corrective action. If the report includes adverse findings, the entity can accept them or submit a written notice of disagreement with supporting evidence within the timeframe stated in the report. HRSA may request a corrective action plan (CAP).
7. Close-out. HRSA publishes summary audit results on its website. The audit closes once HRSA accepts the entity’s CAP implementation and related attestation.

What Documents Does HRSA Request in a 340B Audit?

The exact list depends on audit scope, entity type, and how your program is structured, but the same categories come up again and again. The table below shows what auditors typically want and the gaps that most often cause problems.

Not every audit requests every category. Your entity-specific documentation depends on entity type. A health system or critical access hospital will be asked for cost report support, while an FQHC or Ryan White grantee will typically show grant or designation documentation instead. Knowing which version applies to you saves wasted effort.

The 90-Day 340B Audit Readiness Plan

This plan assumes no audit notice has arrived yet. It’s a proactive sequence designed to build 340B audit readiness in a logical order, rather than a frantic sweep of the shared drive after the letter comes. If you’re wondering how to prepare for a HRSA 340B audit without disrupting daily operations, this is the sequence we recommend. Here’s the overview, followed by what each phase involves.

Days 1–15: Establish a Baseline and Assign Ownership

Start by naming who owns each part of the program: operations, compliance, IT and TPA administration, finance, pharmacy, and clinical leadership, down to the child-site level. Ambiguous ownership is one of the most common reasons documents go stale, and because the HRSA audit process begins by contacting the people listed in OPAIS, those names need to be right.

Then verify your OPAIS record line by line: addresses, AO, PC, hospital classification or grant information, and every child site and contract pharmacy listed. Collect all current policies and procedures, inventory your contract pharmacy relationships, and write down the weak spots your team already suspects. Finally, set up a single central repository with a logical folder structure. Even a well-organized shared drive is enough, as long as everyone uses it. If your registration needs cleanup, our HRSA registration and recertification support can help.

Days 16–30: Build Your Documentation File

With owners and structure in place, start filling the repository: registration records, policies, purchasing records, dispensing data, patient eligibility support, contract pharmacy agreements, and Medicaid records. If you’ve had prior HRSA or internal audits, pull those reports too, because past findings often hint at where a future auditor will dig.

The goal for this phase is simple: every document category should have an owner, a known storage location, and a last-updated date. When the audit engagement letter arrives, nothing should have to be recreated under pressure.

Days 31–45: Conduct a 340B Self Audit

This is the phase that shows whether your program works in practice or only on paper. A meaningful 340B self audit takes a sample of transactions and traces each one back to its supporting evidence. For every sampled claim, ask:

• Was the patient eligible at the time of the encounter, and is there a record to prove it?
• Did the prescriber have a qualifying relationship with the covered entity?
• Was the drug dispensed or administered at a properly registered site?
• Was the replenishment order placed on the correct purchasing account for that site?

Choose your sample using risk, not pure chance: focus on high-volume drugs, high-risk sites, and anything flagged during the baseline. Document your sampling methodology and the reasoning behind it. There’s no mandated sample size; what matters is that your approach is defensible and reproducible. Log every exception, even the ones you fix the same day. The pattern of exceptions is exactly what drives the next phase. If your TPA’s eligibility logic drives most of your qualification decisions, an independent TPA review is worth considering here.

Days 46–60: Test Your High-Risk Areas

Use your self-audit exceptions as a map, then dig deeper into the areas auditors most often focus on: child-site registration, contract pharmacy transactions, Medicaid duplicate-discount controls, diversion controls, inventory replenishment accuracy, and eligibility determinations.

Prioritize by volume multiplied by impact. A registration mismatch at a low-volume child site matters, but it’s not in the same league as a duplicate-discount pattern running across a high-volume Medicaid population. One nuance worth checking: the HRSA Medicaid Exclusion File applies to Medicaid fee-for-service, while managed care Medicaid duplicate-discount prevention usually depends on state-specific rules and your own claims processes. Our guides on preventing duplicate discounts and split billing and duplicate discount reviews go deeper, and contract pharmacy management covers oversight of pharmacy partners.

Days 61–75: Remediate What You Found

Classify every issue into one of three buckets: a documentation gap, a process gap, or actual noncompliance. Then resist the urge to just fix the individual transaction. Run a root-cause analysis instead. If one dispense was diverted, was it a one-off human error, or a flaw in how the eligibility check is configured?

Where diversion or duplicate discounts occurred, assess whether repayment to affected manufacturers is warranted. HRSA expects covered entities to identify affected manufacturers and work with them where appropriate, and to consider whether a problem rises to a material breach that should be disclosed to HRSA. Assign an owner and deadline to every remediation item and record what was done. That documentation becomes the backbone of a corrective action plan if HRSA ever asks for one. Updated procedures should be paired with staff training; our policy development and training services can support this.

Days 76–90: Complete a Final Readiness Review

Close out open items and have someone outside day-to-day program operations review the evidence file, whether that’s internal audit, compliance, or an external advisor. Re-check child-site data one more time, because registration information has a way of drifting between updates.

Then run a stress test. Imagine a sample request list arrived tomorrow with a two-week deadline, and time how long it really takes to assemble a complete response. Confirm who answers which questions if an auditor asks directly, and hold short mock interviews with the people who would actually be in the room. This is the point where 340B audit readiness shifts from “the documents exist” to “we can produce and explain them under pressure.” A structured 340B mock audit or our free audit readiness scorecard can make this phase faster.

What Makes a 340B Self Audit Defensible?

A 340B self audit only helps if it would stand up to an outside reviewer. In our experience, defensible self audits share four traits:

• A written methodology explaining how the sample was chosen and why.
• Risk-based selection that weights high-volume drugs, complex sites, and known problem areas.
• A complete trace from purchase to dispense to patient eligibility for every sampled transaction.
• An exception log that captures every deviation, its root cause, and how it was resolved, including issues fixed immediately.

Two Scenarios That Show Why Readiness Matters

The examples below are hypothetical, but they reflect the kinds of gaps that commonly surface during internal reviews.

Scenario 1: The Unregistered Child Site

A mid-sized hospital system is running its self audit during days 31 to 45. While testing dispenses at a recently opened outpatient clinic, the compliance team discovers the clinic has been using 340B-priced drugs for three months without being registered as a child site in OPAIS. Patient care was appropriate; the problem was registration timing. Because the team found it internally rather than an auditor finding it, the entity can correct the OPAIS record, review the affected transactions, and evaluate any repayment obligation on its own terms, well before it could become a formal finding.

Scenario 2: Contract Pharmacy Drift

During days 16 to 30, a Ryan White grantee reviews its contract pharmacy files and finds that the signed agreement still names a pharmacy location that has since closed. Dispensing and inventory processes had moved to the partner’s new location, but no updated agreement was executed. Operational controls were working, yet the paperwork didn’t reflect reality. A documentation-focused readiness review is designed to catch exactly this before it turns into an audit finding. Our overview of how contract pharmacy arrangements work explains why agreement currency matters.

340B Audit Preparation Checklist

Use this 340B audit preparation checklist as a quick self-check. If you can’t confidently confirm an item, add it to your 90-day plan.

Teams that revisit this 340B audit preparation checklist every quarter, rather than once a year, tend to keep their 340B audit readiness steady instead of rebuilding it before each recertification.

What Happens If You Fail a 340B Audit?

“Failing” is a slightly misleading word, because HRSA audits don’t produce a simple pass or fail. Outcomes depend on the nature, scope, and severity of what’s found. Broadly, an audit can end with no adverse findings, with adverse findings that require a corrective action plan, or, in serious cases, with consequences for continued program participation.

When HRSA 340B audit findings are adverse, the entity is generally asked to submit a corrective action plan that addresses the root cause, not just the specific transactions cited. Findings involving diversion or duplicate discounts often carry a repayment component, because they relate directly to the pricing benefit the entity received. HRSA has indicated that covered entities are responsible for working with affected manufacturers on repayment.

Not every finding is a material breach. A material breach generally refers to a serious or systemic compliance failure, and it carries more weight than a routine finding. The most severe outcomes, including removal from the program, are typically associated with loss of eligibility or failure to address findings, such as not submitting a requested corrective action plan within HRSA’s timeframe. Unresolved issues can also complicate annual recertification, when the Authorizing Official must attest to the entity’s compliance.

The takeaway: a finding isn’t the end of the world, but your response to it has to be timely, thorough, and documented.

How to Respond to HRSA 340B Audit Findings

When the final report arrives, a systematic response beats a reactive one. Work through these ten steps:

1. Understand the finding. Identify exactly which transactions, sites, or controls are involved.
2. Check the evidence. Pull the underlying records before agreeing or disagreeing.
3. Determine the root cause. Distinguish a one-time error from a systemic process failure.
4. Assess scope. Determine whether the issue is isolated or spans time periods or sites.
5. Design corrective action. Build a corrective action plan that fixes the cause, not just the example.
6. Evaluate repayment. For diversion or duplicate-discount findings, assess and document whether repayment to manufacturers is owed.
7. Document remediation. Record every change and the date it was made.
8. Add preventive controls. Update policy, training, or system configuration so the gap doesn’t recur.
9. Monitor implementation. Verify the fix is actually working in daily operations.
10. Preserve evidence. Keep records supporting your CAP attestation, since HRSA may follow up on implementation.

Common 340B Audit Preparation Mistakes to Avoid

Even teams that know how to prepare for a HRSA 340B audit in theory tend to slip in the same places:

• Starting after the notice arrives. Sample request turnaround windows are too short to build documentation from scratch.
• Testing policies instead of transactions. Auditors trace claims, so your self audit should too.
• Quietly fixing exceptions. Undocumented fixes erase the evidence that your controls caught the issue.
• Assuming the TPA has it covered. You remain responsible for compliance, even when software makes the eligibility decision.
• Letting registration drift. OPAIS should be checked whenever sites, contacts, or pharmacies change, not just at recertification.

Final Thoughts: Make Audit Readiness a Habit

Learning how to prepare for a HRSA 340B audit isn’t really about assembling a binder. It’s about building a program that can explain, reproduce, and defend its own 340B processes on demand, whether the request comes from an auditor, your internal compliance team, or HRSA during recertification. Documentation, self auditing, and remediation shouldn’t start with a notification letter; they should be part of everyday operations.

No plan eliminates risk entirely, and no 90-day effort can promise a specific audit outcome. What it can do is close the gap between what your program actually does and what it can prove, which is where most avoidable findings live. If you’d like an independent view of where your program stands, explore our 340B compliance services or contact our team to talk through your readiness.