340B audit guideline
Every 340B test turns on a date. The public records that answer it overwrite themselves.
Was this entity participating when the drug was sold? Was this pharmacy listed when the prescription was dispensed? Was the hospital's latest filed cost report above threshold at the time? Each is a question about a status on a date. HRSA's registry and CMS's cost-report files publish only their current state, so a question about last year is usually answered from this year's file.
This guideline sets out how to test 340B transactions against the record as it stood on the governing date, for manufacturers, covered entities and self-funded employer plans. It covers today's upfront-discount model and the 340B Rebate Model Pilot that begins January 1, 2027 for approved manufacturers' selected drugs.
This is a practice guideline, not legal or accounting advice. Statutory and regulatory references are cited; the rest is our method, and we label it that way.
A single unit carries many dates
| Date | Set by | What it governs |
|---|---|---|
| Date prescribed | Prescriber | Patient relationship |
| Date of service / dispense | Pharmacy or clinic | Site and pharmacy listing; Medicaid carve-in; under the pilot, the rebate amount |
| Qualification date | TPA software | When eligibility was judged, often long after dispense |
| Replenishment / purchase date | Covered entity | Entity eligibility under the upfront model |
| Invoice and chargeback dates | Wholesaler, manufacturer | The period, and government price reporting |
| Rebate submission and decision | Covered entity, manufacturer | Pilot payment terms: at least 45 days to submit, 10 days to pay or deny |
Under replenishment, the dispense and the discounted purchase can be days or months apart, and different conditions are tested at each. Collapsing them into one "transaction date" is the most common error in 340B review.
Which record governs which question
| Question | Governing record | Tested at |
|---|---|---|
| Was the entity participating? | OPAIS listing. A covered entity is one "registered and listed" in the 340B database (42 CFR 10.3) | Purchase date (upfront model); date of service (pilot) |
| Was the site or contract pharmacy authorized? | OPAIS site and contract pharmacy listings, under the rules in force that day | Date of service |
| Was the Medicaid claim carved in or out? | Medicaid Exclusion File (fee-for-service) | Date of service |
| Was the DSH percentage above threshold? | The latest filed cost report. HRSA treats a hospital as ineligible from the day a below-threshold report is filed | Purchase date |
| Was a GPO used for outpatient drugs? | Purchase records | Purchase date |
| Was the patient eligible? | The covered entity's own records | Prescription and service dates |
Public records settle entity-level eligibility. Patient-level eligibility needs the covered entity's records, through an agreement or a formal audit.
Tests under each model
Upfront discount with replenishment. A manufacturer sees purchases (chargebacks), not dispenses. It can test from its own data whether the entity was active, the ship-to authorized, the purchase outside a DSH ineligibility window, and the GPO prohibition respected, all as of the invoice date. Patient-level questions become screens for reasonable cause.
2027 rebate pilot. A manufacturer sees every dispense but not the purchase. Rebates must be paid or denied within 10 days, and the notice bars denials based on eligibility, diversion or Medicaid duplicate-discount concerns, or on a perceived lack of WAC purchases. Status tests still matter, but they lead to referral or audit, never to a withheld payment. Under the pilot, a contract-pharmacy dispense can earn a rebate with no entity purchase at all, which leaves the date of service as the only anchor for eligibility.
Every finding has one route
| Finding | Route |
|---|---|
| Entity eligibility (inactive, DSH window, GPO prohibition) | Referral to HRSA |
| Diversion (unlisted site or pharmacy, ineligible patient) | Good-faith inquiry, then an HRSA-approved audit, then dispute resolution |
| Medicaid duplicate discount | State invoice dispute; audit where there is a pattern |
| Pilot data or pricing defect | Documented denial or adjustment within 10 days |
Manufacturer audits of covered entities follow HRSA's 1996 guidelines: documented reasonable cause, at least 30 days of good-faith resolution, a work plan submitted to HRSA at least 45 days ahead, at least 15 days' notice to the entity, and an independent auditor working to government auditing standards.
Audit standard
We hold every 340B audit to the same ten requirements:
- Named assertions, not "review compliance."
- A complete population, reconciled to an outside total before sampling.
- Evidence the auditee does not control.
- Every item tested against the record in force on its governing date.
- Every registry fact cited to a dated, hashed capture, with its method version.
- The full population screened first; samples drawn from flags plus a random stratum.
- Units and dollars reconciled end to end.
- Every finding typed and routed.
- An independent auditor and a named standard.
- Unsettled questions reported with both dates, never resolved silently.
One claim, three audits
A manufacturer, a covered entity and a self-funded plan can each examine the same claim from a different end. The manufacturer asks whether the 340B price was owed. The covered entity asks whether it received the value it is owed, on eligible claims only. The plan asks whether 340B treatment cost it a rebate. Their questions differ, but the facts must not.
If a dispense occurred at a pharmacy not listed for the entity on the date of service, it is a diversion finding for the manufacturer, a claim that should not have qualified for the covered entity, and possibly a wrongly withheld rebate for the plan. Treating one unit as 340B for one party and not for another is a finding in itself.
The limits
- A capture shows what a source published on a date, not whether the source was right.
- HCRIS releases do not prove when a hospital filed.
- Public data does not reach patient-level eligibility.
- Where the record has a gap, the answer is reported as open, not assumed.