HRSA wants to audit your 340B program. Are you ready? Five best practices for operating a compliant 340B program.


Chad Gay

Director of Contract Compliance

It’s Friday afternoon and your hospital receives an email from the Health Resources and Services Administration (HRSA), notifying you that your hospital has been selected for a 340B program audit.

Are you ready?

As part of a team that has helped numerous hospitals prepare for HRSA audits, I can tell you that the single-most important thing any hospital can do to answer “yes” to that question is to develop a culture of 340B compliance that permeates the entire organization. Here are five best practices that the most 340B-compliant cultures almost always follow:

1. Develop a cross-functional 340B committee.

Many covered entities place full responsibility of managing their 340B program squarely on the pharmacy department. However, in order to operate an optimized and fully compliant 340B program, it’s critical to develop a cross-functional 340B committee to implement and monitor the program. The committee should ideally be comprised of a multi-disciplinary team from various departments, including Pharmacy, Materials Management, IT, Physician Credentialing, Finance/billing, Compliance, Legal, Medical Records and a Medicaid liaison. It should also have representation from the hospital’s leadership. The committee’s most important responsibility is to work together to develop and drive an effective 340B culture of compliance. Additional responsibilities of the team include:

  • Approval of 340B policies and procedures
  • Review, oversight and guidance of the 340B self-audit program (see below)
  • Establishment of a threshold for audit finding’s “materiality” for self-reporting any findings
  • Development of 340B education requirements for appropriate staff
  • Providing cost savings and compliance updates to hospital leadership

2. Dedicate the necessary, full-time 340B resources.

In addition to establishing a 340B committee, effective and fully compliant 340B programs usually dedicate at least one full-time employee (FTE) whose only responsibility is to maintain the program. Some programs require additional full-time staff – the number of FTEs a facility needs is dependent on the size and complexity of the program.

Responsibilities for a dedicated resource should include 340B purchasing or oversight, as well as day-to-day management of 340B technology. In addition, this resource should play an instrumental role in conducting, or assisting in, monthly audits (described below), as well as reporting audit findings to the 340B committee. The resource may also be responsible for making changes to the HRSA database, including adding or subtracting child sites, contact information or contract pharmacy information. With so many changes in the program, this resource often takes responsibility for staying current on the program and reporting 340B-related news to the 340B committee and hospital leadership, when necessary. He or she can help establish and maintain the organization’s 340B education program, which I’ll also discuss in more detail below.

3. Software maintenance.

Hospitals often mistakenly believe that 340B software can be implemented and then “left alone” to determine 340B drug purchasing decisions and maintain compliance.  That’s understandable – everyone is working with tight budgets and limited resources, and some of the technology solutions on the market heavily promote the degree of automation they offer.  Nevertheless, while some technologies reduce the amount of maintenance that’s needed, no technology is maintenance free

Daily maintenance of your 340B “split billing” software is critical to maintaining compliance, particularly when it comes to mapping National Drug Codes (NDCs) to charge codes, as well as managing data crosswalks in different systems and coding nomenclatures. With so many departments and hospital technology platforms providing direct or indirect input to the 340B technology, along with the disruptions in drug availability with which everyone struggles, the need for regular updates to the 340B software is unavoidable.

For example, the hospital pharmacy’s order entry software may use a specific drug dictionary, which may interface with billing technology that has its own, separate chargemaster.  To maintain compliance, it is critical that NDCs tie throughout all of the technologies that ultimately feed data into the 340B split billing software.  Incorrect NDCs can result in numerous issues, including the non-compliant accumulation of 340B drugs.  NDC numbers not appropriately interfaced through all systems can result in a mismatch of NDC dispensed and the NDC purchased, a violation of the 340B program.  This can occur in hospitals that have not fully integrated bedside scanning and billing upon administration, and in those that have fallen behind in manually updating the chargemasters on all systems.

4. Implement a self-audit program.

To develop and maintain the integrity of your 340B program and to demonstrate to HRSA that your organization is making a serious effort to provide oversight of the program, it’s important to implement a self-audit program.

Monthly: conduct self-audits of sample patient dispensations from outpatient areas, mixed-use settings, offsite clinics and contract pharmacies.  The sample size can vary, dependent on facility size and program complexity.  At a minimum, a total of 30 dispensations should be reviewed and self-audited per month.  The review should test patient eligibility, provider eligibility and Medicaid billing, if applicable.  If monthly frequency cannot be achieved, then quarterly is an option.  In fact, the proposed Omnibus Guidance indicates a minimum expectation of quarterly reviews.

Annually: conduct a thorough review of your HRSA database records, prior to your annual recertification as a 340B participant. During the database review, verify all eligibility documents, registered child sites and contract pharmacies, contact personnel, and ship-to / bill-to addresses. Remember – the authorizing official is attesting to the validity of all data during recertification, so it’s critical to do a thorough review for accuracy.

Also make sure that your self-audit program is included in your 340B policies and procedures, and that it defines how to establish a threshold for materiality for self-reporting any findings, and how to respond to findings.

5. Order an annual, independent audit.

While not mandated by legislation, HRSA recommends independent 340B program audits for all contract pharmacies.  However, as a best practice, covered entities should convene independent audits of their entire 340B program – and conduct the audit similarly to a HRSA audit.  (This is in addition to the annual self-audit of HRSA database record, recommended above). An independent audit allows the covered entity to get an objective opinion of the overall compliance of its 340B program.  Areas of weakness, vulnerability and opportunities for improvement (which internal audit resources may miss) can also be identified. Like any audit service, you’ll want to carefully evaluate the breadth and depth of experience (especially in regards to HRSA 340B audits and hospital pharmacy practices), knowledge, credentials and references of the firms considered for this work. You’ll also want to consider candidates’ scope of service and their ability to provide post-engagement support, should you need it.

340B implementation is not a destination, it’s a journey – and facilities that choose to take the 340B journey need to remain focused on continuous compliance, every step of the way. Dedicating the right resources, creating a 340B committee, and establishing appropriate self-audit and external-audit practices will drive continual compliance, and help ensure that your facility can always answer ‘yes!’ when asked if they’re ready for an HRSA audit.