340B compliance for RHCs and FQHCs: the 5 enforcement patterns that cost participants in 2024-2025
Eligibility math tells you what the 340B program is worth; compliance math tells you what it costs you to keep. Here\u2019s what HRSA is actually finding on audits, what the financial exposure looks like, and the 8-step operational program that keeps participants clean.
Frequently asked questions
What are the actual compliance risks in the 340B program?
Four categories that HRSA Office of Pharmacy Affairs (OPA) cited in 2024-2025 enforcement actions: (1) Diversion — providing 340B-priced drugs to patients who are not "patients of the covered entity" as defined in program guidance. (2) Duplicate discount — a patient receives a 340B-priced drug AND the drug manufacturer pays a Medicaid rebate on the same dispense. (3) GPO prohibition violations — disproportionate share hospitals (DSH), children's hospitals, and standalone cancer hospitals cannot use group purchasing organizations to buy covered outpatient drugs outside specific narrow exceptions. (4) Auditable records failures — inability to produce documentation tying each 340B-purchased unit to a qualified patient-encounter during a HRSA audit. The financial consequences: repayment of discount received, potential removal from the program, and public OPAIS audit findings that damage credibility with manufacturers and partners.
How does HRSA audit a 340B covered entity?
HRSA selects approximately 200 covered entities annually for audit, focusing on high-volume participants and entities with complaint histories. The audit process: (1) 60-90 day advance notice with a request for policies/procedures, a sample of prescriptions, and financial data. (2) On-site audit by HRSA contractor OR HRSA staff, typically 3-5 days. (3) Review of: patient-eligibility determination workflow, prescription sampling across clinics and contract pharmacies, duplicate-discount prevention controls, GPO-purchasing records (where applicable), inventory tracking. (4) Draft report with findings, typically 60-90 days post-audit. (5) Corrective action plan requested if findings identified. (6) Final report publicly posted on OPAIS if findings are non-trivial. HRSA OPAIS publishes all audit findings publicly, which means a finding becomes permanently visible to manufacturers and other partners.
What triggers a HRSA audit — is it random or targeted?
Mix of both. Risk-based triggers include: (1) high purchase-volume relative to eligible patient encounters (suggesting possible diversion); (2) disproportionate growth in contract-pharmacy arrangements; (3) complaint from a drug manufacturer (increasingly common in 2023-2025 as manufacturers push back on 340B program scope via audit requests); (4) self-disclosure of an issue (which, paradoxically, can trigger audit even though self-disclosure is the right thing to do); (5) findings in a prior audit that require follow-up verification. Random selection also occurs. Entities new to contract-pharmacy arrangements (i.e. shifted from in-house dispensing to multiple external pharmacies post-2020) are disproportionately audited because the diversion risk surface is larger.
What's the "patient of the covered entity" definition and why does it matter so much?
HRSA's longstanding definition — codified in the 1996 Notice — requires three criteria all be met: (1) the covered entity maintains records of the patient's healthcare; (2) the patient receives healthcare from a healthcare professional who is employed by the covered entity or provides care under contractual arrangement with the covered entity; (3) the patient receives a healthcare service or range of services from the covered entity which is consistent with the service or range of services for which grant funding or FQHC look-alike status has been provided to the covered entity. In plain terms: the patient must have an established care relationship with the covered entity, not just a one-off encounter or referral relationship. The 2023 Ranlett v HRSA decision and subsequent 3rd Circuit rulings have tightened manufacturer ability to narrow this definition, but the HRSA interpretation remains the operational standard. Diversion violations most commonly come from (a) dispensing to patients seen only once, (b) dispensing to patients of referring providers who aren't contracted with the covered entity, and (c) "in range of services" failures where the 340B drug was prescribed for a condition unrelated to the covered entity's funded scope.
How does contract-pharmacy arrangement compliance work?
Covered entities can contract with external retail pharmacies to dispense 340B drugs to their patients — a substantial source of program value since many rural clinics don't have in-house pharmacies. The compliance burden is: (1) the contract pharmacy must receive prescriptions only for covered-entity patients; (2) a mechanism must exist to verify eligibility at dispense time (typically a third-party administrator like Equiscript, Sentry, or Macro Helix); (3) inventory must be tracked so that non-patient prescriptions aren't dispensed from 340B-priced inventory; (4) audit trail must connect each dispensed unit back to a qualified patient encounter. 2020-2024 saw massive drug-manufacturer pushback against contract-pharmacy arrangements, with many manufacturers unilaterally restricting 340B discounts to a single contract pharmacy per covered entity. Resulting litigation is ongoing; practical operational guidance: maintain clean records, use reputable third-party administrators, monitor manufacturer-specific restrictions monthly.
What about the Medicaid duplicate discount issue?
Duplicate discount occurs when a manufacturer both (a) provides the 340B discount at point of purchase and (b) pays the state Medicaid program a rebate on the same drug. Federal law prohibits this — manufacturers aren't required to provide both discounts on the same unit. Prevention mechanisms: (1) the covered entity must "carve in" (use 340B pricing for Medicaid patients and self-reports to state so the state doesn't seek rebate) OR "carve out" (bill the drug to Medicaid at non-340B pricing and forgo the 340B discount on those units). (2) Carve-in/carve-out election is made per state and usually per drug category; cannot toggle frequently. (3) The covered entity's Medicaid Exclusion File (MEF) entry in HRSA's OPAIS identifies which pharmacies carve in vs out. (4) Contract pharmacy Medicaid billing: carve-out is the default; very few are configured to carve-in. Violations of the duplicate-discount prohibition are among the most serious audit findings — 2024 saw multiple repayment demands exceeding $500K from covered entities on this issue alone.
Do RHCs get audited the same way as FQHCs?
RHCs aren't directly eligible for 340B; RHC participation is indirect — through a hospital's grantee status or through an FQHC partnership. So the audit surface depends on which pathway. If the RHC is part of a disproportionate share hospital system, the hospital is audited and the RHC's dispensing is subsumed. If the RHC is affiliated with an FQHC (common arrangement post-2020), the FQHC is the audited entity and the RHC operates under the FQHC's 340B authorization. Rural hospitals that operate affiliated RHCs face the most complex audit — the RHC's patient-relationship verification can get tangled with the hospital's broader 340B operation, and diversion findings at the RHC flow up to the hospital's OPAIS audit record.
What's the deal with manufacturer 340B "restrictions" that started in 2020?
Starting July 2020, major drug manufacturers (Eli Lilly, Novartis, AstraZeneca, Sanofi, Merck, and others) unilaterally announced restrictions on 340B contract pharmacy arrangements — typically limiting each covered entity to a single contract pharmacy or imposing data-submission requirements to continue receiving discounts. HRSA took enforcement action; multiple courts ruled against HRSA in 2022-2024, effectively allowing manufacturers to continue restrictions. Current operational reality (2026): (1) Each manufacturer has its own restriction policy; there's no uniform standard. (2) Some restrictions can be lifted if the covered entity submits claims data via a manufacturer-designated intermediary (340B ESP). (3) Approximately 30-40% of drugs by volume are affected by manufacturer restrictions. (4) The financial impact on covered entities varies; some have lost 20-40% of expected 340B savings due to restrictions, others have been able to preserve most savings through data-submission arrangements. The litigation trajectory is still unfolding; expect further court rulings in 2026-2027.
What should an FQHC or affiliated RHC do TODAY to stay compliant?
Five concrete actions: (1) Run a patient-eligibility verification audit: sample 100 recent 340B-priced dispensings and verify each meets the three-part HRSA patient definition with documentation. (2) Review contract-pharmacy arrangements and confirm each has a functioning third-party eligibility verification at dispense. (3) Check the Medicaid Exclusion File entries and confirm carve-in/carve-out decisions are accurately reflected per pharmacy. (4) Pull the last 12 months of manufacturer restriction policies; verify your program is responding appropriately (submitting data where required, acknowledging restrictions where unavoidable). (5) Document all of the above in a written 340B compliance policy that's updated at least annually and available for HRSA inspection. Practices that can hand a HRSA auditor a binder with all five items are materially less likely to have findings.
What financial exposure does a finding carry?
Depends on the finding category. (1) Minor documentation findings: typically corrective action plan, no repayment. (2) Diversion findings: repayment of 340B discounts received on the diverted dispensings — this can range from thousands to hundreds of thousands depending on volume. (3) Duplicate discount findings: repayment of the duplicate discount amount plus potential state Medicaid action. (4) Systemic/repeat findings: potential removal from the 340B program (catastrophic for any entity that built operational margin around 340B savings). (5) OPAIS public posting: reputational impact with manufacturers and partners, which can affect future contract-pharmacy arrangements and manufacturer restriction responses. The highest-impact enforcement actions in 2024-2025 saw covered entities repay $500K-$2M+ on systemic diversion or duplicate-discount findings.