Find what HRSA would find — while you can still fix it.
HRSA audits roughly 200 covered entities a year, and adverse findings have run between half and two-thirds of audits depending on the year. A mock audit tests the same areas against your real data, so the first time you see a finding is not in a formal letter.
At a glance
- 01Test areas
- 25
- 02Engagement length
- 5 weeks
- 03Findings delivered
- Live, not emailed
- 04Follow-up review
- Week 12
What a mock audit is, and what it is not
A mock audit is a structured test of your 340B program against the criteria HRSA applies in a formal audit. It is not a policy review, and it is not a checklist walkthrough. We work with your actual claims, your actual OPAIS record, your actual contract pharmacy agreements and your actual purchasing history.
The output is a set of findings, each carrying a severity rating, a root cause, the evidence reference that supports it, and the regulatory basis. Alongside it sits a remediation plan written so your compliance committee can assign owners and dates without reinterpreting anything.
When entities engage us
- A HRSA audit notice has arrived and there are weeks, not months
- Annual recertification is approaching and nobody has tested anything in a year
- A new pharmacy director has inherited a program with no documentation of its history
- Contract pharmacy count has grown faster than oversight capacity
- A board or compliance committee has asked a question nobody can answer with evidence
- An acquisition has merged two programs with different practices and one policy set
The compliance chain HRSA actually tests
Every finding traces back to a break somewhere in this chain. We test it start to finish, in order.
- 01
Eligibility
Entity and site qualify under the statute, with evidence to prove it.
- 02
OPAIS
The public HRSA record matches your actual registered sites and arrangements.
- 03
Patient definition
The written definition is tested against real encounters, not assumed.
- 04
Purchasing
340B-priced drugs are bought through the correct, non-GPO pathway where applicable.
- 05
Inventory
Virtual or physical inventory accumulation matches how the pharmacy actually dispenses.
- 06
Dispensing
Dispenses are correctly attributed to an eligible patient and provider.
- 07
Medicaid
Carve-in or carve-out status matches actual billing, preventing a duplicate discount.
- 08
Contract pharmacy
Agreements, ship-to bill-to structure and manufacturer restrictions are current.
- 09
Reconciliation
Discrepancies between purchasing, dispensing and replenishment are found and closed.
- 10
Documentation
Every step above has evidence an auditor can review, not just a practice that exists.
What changes when Juris is involved
- 01Untested assumptions
- 02Findings discovered by HRSA
- 03No remediation owner
- 04Repeat findings next cycle
- 01Tested against real data
- 02Findings found and fixed first
- 03Owners and dates assigned
- 04A monitoring plan going forward
The 25-Point 340B Compliance Review, grouped the way HRSA findings actually cluster
01Eligibility & registration
- Test areas
- OPAIS record accuracy, child site registration and cost report linkage, outpatient facility eligibility evidence, recertification history, change of ownership and acquisition handling
02Patient definition
- Test areas
- Written patient definition policy, provider relationship documentation, referral and prescription capture rules, discharge and transitional care handling, telehealth and remote encounter treatment
03Duplicate discount prevention
- Test areas
- Medicaid Exclusion File status accuracy, carve-in versus carve-out consistency across sites, Medicaid managed care handling by state, state-specific MCO billing rules, duplicate discount monitoring evidence
04Contract pharmacy
- Test areas
- Written agreement completeness and currency, ship-to bill-to compliance, reconciliation frequency and evidence, manufacturer restriction impact tracking, contract pharmacy oversight and self-audit records
05GPO prohibition & inventory
- Test areas
- GPO prohibition compliance for DSH, RRC and free-standing cancer hospitals, virtual inventory accumulator accuracy, orphan drug handling where applicable
06Program governance
- Test areas
- Policy and procedure currency, version control and approval evidence, internal self-audit cadence, documentation and corrective action tracking
Multi-entity systems are tested per entity type, because a critical access hospital and a disproportionate share hospital in the same system are not subject to the same rules.
Five weeks, defined week by week
Kick-off & data request
Week 1. Scope confirmation, named client owner, and a specific data request: policies, TPA reports, OPAIS record, child site list, contract pharmacy agreements and a claims sample.
Testing
Weeks 2–4. The 25 areas worked systematically, with evidence logged against each. Two to three clarification calls with your team as questions surface.
Findings & presentation
Week 5. Draft findings shared in advance, then presented live so your team can challenge, correct and understand each one before it is finalized.
Remediation & follow-up
Weeks 5–6 and week 12. Remediation plan with owners and dates, then a progress review at week 12 that is included in the engagement.
A deliverable set built to be used, not filed
Four artefacts, each aimed at a different reader. The findings report is for your 340B team. The executive summary is for your CFO. They are written separately because they are not the same document with different fonts.
- Findings report — every finding with severity, root cause, evidence reference and regulatory citation
- Remediation plan — prioritized actions with named owners and target dates, formatted for your compliance committee
- One-page executive summary — exposure and required investment, written for finance leadership
- Updated policy gap list — what your written policies say versus what your practice does
- Live findings presentation, delivered by the ACE-certified lead
- Week 12 follow-up review — progress against the remediation plan, at no additional cost
Straight answers before you commit to anything
01Can you guarantee we'll pass our HRSA audit?
No, and you should be cautious of anyone who says otherwise. HRSA audits examine your records, practices and history — no external party controls that outcome. What we can do is test the same areas HRSA tests and show you where you'd fail today, with time to close the gaps.
02How much does a 340B mock audit cost?
Single-site engagements are a fixed fee. Multi-site health systems are priced as a base fee plus a per-site increment, which scales fairly and is straightforward to defend in procurement. You receive a firm number before the engagement begins.
03How often should we run one?
Annually is the general expectation for a mature program, and HRSA looks for evidence of regular internal self-auditing regardless of who performs it. Entities with heavy contract pharmacy exposure, recent acquisitions or a change in 340B leadership often benefit from a more frequent cadence in the first year.
04We already have a TPA. Why would we need this?
A third-party administrator runs your split billing. It doesn't audit its own accuracy, rewrite your policies, or tell you what it's failing to capture. A mock audit sits alongside whichever TPA you use.
05We just received a HRSA audit notice. Can you help in time?
Often, yes — tell us on the first call so we can prioritize. An audit-response engagement is scoped differently from a routine mock audit: we focus first on the areas most likely to be examined and on assembling the evidence you will be asked to produce.
Marked up with FAQPage schema for search and AI-answer eligibility.
Next step
When did someone last test your program against real data?
If the answer is more than a year ago, or nobody is sure, that is usually the point at which a mock audit pays for itself.