Preparing for a HRSA 340B Audit

July 2013 - Vol.10 No. 7 - Page #24
Category: 340B Software

Established as part of the Veterans Health Care Act of 1992, the 340B program enables safety net health care providers, known as covered entities (CEs), to purchase outpatient pharmaceuticals from manufacturers at discounts of approximately 20 to 50 percent below average wholesale price. The savings from this program enable the CEs to treat more at-risk patients and provide more comprehensive services than might otherwise be possible. 

To participate in 340B, qualified CEs must adhere to guidelines administered by the Health Resources and Services Administration (HRSA), which cover the purchase and distribution of pharmaceutical products. Adhering to 340B regulations is often a complex and challenging task, but doing so is essential for any institution that wishes to remain in the program and obtain significant cost savings. 

A 340B Audit
In February 2012, HRSA informed our institution, Denver Health, a level-one organization serving as Colorado’s primary safety net institution, that it had been selected for a 340B audit. Although HRSA, as well as pharmaceutical manufacturers, have had the right to audit 340B participants since the program’s inception, HRSA launched a new, more aggressive auditing initiative in 2012. Denver Health, a 477-bed disproportionate share hospital (DSH) with over 50 clinics spread throughout the Denver area, has participated in the 340B program for 21 years, enabling an average of $20 to $30 million in annual drug savings. The outcome of this audit would mean the difference between continued participation in the program, or, if noncompliance was found, possible mandated corrective measures or worse—repayment of certain 340B drug costs to pharmaceutical manufacturers and/or disenrollment from the program.

The timing of the HRSA notification gave us approximately one month to prepare for the audit. HRSA provided a list of required documents, including a Medicare cost report, a six-month backlog of electronic prescription and provider files, invoices for both 340B accounts and non-340B accounts, documents of 340B-related policies and procedures (P&Ps), and a list of the hospital’s 340B clinics. 

Primary responsibility for overseeing the audit fell to the pharmacy department and we designated four staff members to manage the process—myself, another pharmacist who helped navigate our facility’s EMR, our outpatient pharmacy director, and the director’s supervisor. We worked with our IT department to pull a six-month log of prescription data. While much of this requested data was not readily compiled in our system, we were able to pull together all of the data within the given timeframe. 

Although HRSA specified which materials they required for the audit, as one of the first institutions to be audited under the updated auditing initiative we were unsure of what to expect. We were pleased when the audit was completed in less than two days, even though HRSA originally requested that we set aside three days. Likewise, the auditor was professional and projected an attitude of wanting to learn about and assist our practice, rather than presenting a punitive or combative tone. After a tour of the hospital and one of our outpatient pharmacies, we set the auditor up in a conference room with dual computer projectors—one displaying our EMR interface and the other our pharmacy dispensing system interface. The auditor would request a specific prescription number from our records and we would look it up in the pharmacy system and match it to the encounter in the EMR to display all the proper documentation. There were no unexpected requirements or surprises and the audit requests did not exceed the data indicated on the initial list. Overall, we had a positive experience with our audit. Ultimately, our processes were confirmed by the audit with no adverse findings, which was a very gratifying result.

Factors That Influence the Likelihood of an Audit
At Denver Health, we have a robust set of 340B P&Ps and attendant due diligence in place at all times, which played a crucial role in achieving a positive audit outcome. Our due diligence includes continuous monitoring of 340B processes for any signs of anomalies: Are the accumulators in the split-billing software appropriate? Do staff 340B practices match the P&Ps? In the event of an anomaly, we immediately investigate the root cause of that issue; we prefer to address issues as they arise rather than retrospectively. For any 340B participant, robust P&Ps and continuous due diligence are critical in order to avoid a negative audit outcome. 

Although Denver Health was not specifically targeted, there are certain 340B program types that make a HRSA audit more likely. One of these is operating a 340B program in mixed-use settings, ie, areas that may offer both inpatient and outpatient services, such as the ED and ambulatory OR. Proper 340B management in a mixed-use setting often requires the use of split-billing software to isolate 340B medications from inpatient medications. Furthermore, mixed-use settings can increase the risk of a 340B drug being used for an inpatient treatment, which is a violation of the outpatient use mandate. A second factor that can trigger a HRSA 340B audit involves facilities that serve a large Medicaid population, as this can increase the risk of inadvertently billing Medicaid for 340B drugs, commonly referred to as duplicate discounting. A third factor is employing multiple contract pharmacies for the purchase and supply of 340B medications. While such practice is allowed, it can be a complex approach to acquiring 340B medications. Another factor, which may have contributed to Denver Health’s selection, is an institution’s high-volume use of 340B medications. In 2012, HRSA audited predominantly larger, high-volume facilities, although it has stated its intention to audit smaller volume and lower-risk programs as well. 

At this point, HRSA appears most interested in proper 340B compliance in mixed-use settings as well as in CEs that have multiple contract pharmacy relationships. Denver Health does not use contract pharmacies, and while we have considered this option in the past, we have maintained 340B drug purchasing within our internal pharmacies. 

Developing Robust P&Ps
The comprehensive nature of our 340B P&Ps are likely another reason our audit went so well. Denver Health has developed approximately 10 master P&Ps related to 340B program compliance, some of which are integrally focused on 340B while others are tangentially related. These P&Ps address various aspects of the process, including prescribing, dispensing, administering, delivery, storage, transfer, etc, but perhaps the most critical policy involves the institution’s understanding and adoption of the HRSA definition of what constitutes a 340B-eligible patient (see SIDEBAR). 

Staff Training
Denver Health’s pharmacy department has been our institution’s primary developer of 340B P&Ps over the past 20 years, occasionally turning to outside resources offered by Safety Net Hospitals for Pharmaceutical Access (SNHPA) and theApexus 340B Prime Vendor Program, both nonprofit organizations focused on 340B issues. For example, we use the Apexus help desk for everyday questions about recertification, diversion, and registration to make sure all processes are compliant before we implement them. We also occasionally seek technical assistance from SNHPA or Apexus for larger issues surrounding patient eligibility or referrals. 

Our current 340B P&Ps focus on providing Denver Health pharmacy staff with clear direction in addressing all issues involving 340B operation and compliance. Pharmacy staff review the P&Ps annually, consulting with the legal department as needed, to ensure they remain current to any regulatory changes or shifting needs at Denver Health, as well as changing demands in the health care system. This annual review provides a way of confirming that the actual practices in the hospital and clinics correspond with our governing policies.

We train all pharmacy employees on 340B P&Ps upon hire, and apprise them of any changes or updates to the program as they occur. We also designate a select group of pharmacy practitioners to receive more robust, comprehensive training on 340B intricacies, such as those with significant purchasing and distributive functions. Most of our pharmacy managers and directors have attended 340B University, an educational session managed by Apexus that provides comprehensive instruction in program compliance. All of this training has contributed to a far greater awareness of 340B regulations in our department than existed 10 years ago. 

Moving Beyond the Audit
Although we do not yet have a formalized internal 340B audit process in place, we are presently developing one that we aim to institute by the end of 2013. We are confident in our P&Ps, but we want to reinforce what we learned both in preparing for the audit and during the audit process to create a methodical system of oversight to ensure that our processes are efficient and 340B-compliant at all times. As a large, complex organization that administers health care in a wide variety of settings, ensuring our compliance with all aspects of the program is critical. 

For Denver Health, the HRSA audit affirmed our processes. Although we are a high-volume participant, we have always been conservative in our use of 340B. We have never adopted the position of trying to gain every possible dollar of revenue out of the program. Other institutions may take a more aggressive approach, but we prefer to use caution regarding the integrity of our program rather than try for 100% revenue capture. The 340B program is too important to our institution and to our patients to do otherwise.

The key takeaway from our audit experience highlights the importance of creating comprehensive P&Ps and establishing an efficient monitoring system as a matter of compliance rather than in response to an audit notification. Attempting to create a compliant 340B system in the weeks preceding an audit will do little to secure your practices. Rather, make use of the many tools available from SNHPA, Apexus, HRSA, and other organizations, as well as advice from your peers and outside consultants well in advance of an audit, or ideally when setting up a 340B program to begin with. Establishing a solid 340B management foundation will help to develop and strengthen your 340B processes, thus supporting your institution’s ability to continue providing greater care to patients in need.


  1. Health Resources and Services Administration. Notice Regarding Section 602 of the Veterans Health Care Act of 1992 Patient and Entity Eligibility. Federal Register. 1996;61(207):55156-55158.

Alex Mathews, RPh, MBA, is a clinical pharmacy specialist at Denver Health in Denver, Colorado, and has worked in various management capacities in long term care, managed care, and hospital environments. He received a BS in biology from Youngstown State University and a BS in pharmacy from the University of Toledo, as well as an MBA from the University of Colorado at Denver. The focus of Alex’s practice over much of the past decade has centered on procurement and reimbursement issues for both hospital and retail pharmacy environments.

HRSA Definition of a 340B-eligible Patient
An individual is a patient of a covered entity (with the exception of state-operated or funded AIDS drug purchasing assistance programs) only if:

  1. The covered entity has established a relationship with the individual, such that the covered entity maintains records of the individual’s health care; and
  2. The individual receives health care services from a health care professional who is either employed by the covered entity or provides health care under contractual or other arrangements (eg, referral for consultation) such that responsibility for the care provided remains with the covered entity; and
  3. The individual receives a health care service or range of services from the covered entity, which is consistent with the service or range of services for which grant funding or Federally qualified health center look-alike status has been provided to the entity. 
  4. Disproportionate share hospitals are exempt from this requirement.
  5. An individual will not be considered a patient of the entity for purposes of 340B if the only health care service received by the individual from the covered entity is the dispensing of a drug or drugs for subsequent self-administration or administration in the home setting. 

An individual registered in a state operated or funded AIDS drug purchasing assistance program receiving financial assistance under title XXVI of the PHS Act will be considered a patient of the covered entity for purposes of this definition if so registered as eligible by the State program.1


Recertification Responsibilities

  1. All information listed on the 340B Program database for that covered entity is complete, accurate, and correct
  2. All 340B Program eligibility requirements since being listed as eligible on the 340B database have been met
  3. Compliance with all requirements and restrictions of Section 340B of the Public Health Service Act and any accompanying regulations or guidelines including, but not limited to, the prohibition against diversion and duplicate discounts
  4. Maintenance of auditable records demonstrating compliance
  5. Systems/mechanisms are in place to reasonably ensure ongoing compliance with program requirements
  6. Office of Pharmacy Affairs is contacted as soon as possible if there is any material breach by the covered of any of the foregoing


Make Your 340B Program Audit Ready 
For more information on how to prepare for a 340B audit, visit , and click Download Webinar for Make Your 340B Program Audit Ready, a free presentation from a 340B expert panel which details the latest regulatory changes and presents the necessary steps to update 340B policies and procedures, and to conduct self-audits.


Like what you've read? Please log in or create a free account to enjoy more of what has to offer.

340B Software
For a full list of vendors offering 340B Software, go to:

Current Issue