Common 340B Reporting Mistakes: What 171 HRSA Audits Show

A single wrong date in one database field cost covered entities more repayments last year than diversion did. In the 171 FY2025 audits HRSA has finalized, 70 entities were cited for an incorrect 340B OPAIS record, and 53 were ordered to repay manufacturers. None of those findings came from dispensing the wrong drug. They came from reporting data that no longer matched reality. Avoiding common 340B reporting mistakes is now a data accuracy job before it is a pharmacy job, and the clinics that treat it that way keep their savings.

This guide covers the reporting errors HRSA actually cited in FY2025, the exact submission formats that cause 340B ESP rejections, and the quarterly deadline most teams miss. For the wider eligibility and audit rules that sit behind these filings, read our 340B compliance guide.

Key Takeaways

• Incorrect 340B OPAIS records appeared in 70 of 171 finalized FY2025 audits, which is 74.5 percent of all entities with adverse findings.
• Repayment to manufacturers was required in 53 audits and termination of a pharmacy or site occurred in 20.
• Carve in and carve out changes must clear the 340B OPAIS snapshot at 12:01 a.m. Eastern Time on the 16th of the month before the quarter.
• The Medicaid Exclusion File applies to Medicaid fee for service only, so managed care needs a separate control.
• National Drug Codes must reach 340B ESP as 11 numeric digits, including up to four leading zeros.
• No single twice monthly 340B ESP deadline covers every manufacturer, so check each manufacturer’s policy.
• Reconcile third party administrator claims to wholesaler purchases twice monthly, not quarterly.
• Approved rebate plans under the 340B Rebate Model Pilot Program take effect on 1 January 2027.

What HRSA Found in 171 Finalized FY2025 340B Audits

The FY2025 covered entity audit results are the clearest picture available of what 340B reporting actually gets wrong. HRSA publishes every finalized result by entity name, finding, and sanction. We counted all 171 results posted as of 28 August 2026 and grouped them by finding type.

The pattern is consistent and it is not what most compliance training emphasizes. Recordkeeping and registration data, not clinical decisions, produce the majority of findings.

Read the middle rows together. Of the 94 entities with any adverse finding, 70 had an incorrect 340B OPAIS record, which is 74.5 percent. Registration data is the single largest source of audit exposure in the program, and it is also the cheapest to fix.

Incorrect 340B OPAIS Records Drive More Findings Than Any Other Error

The 340B OPAIS record is the federal government’s official statement of what your entity is, where it operates, and which pharmacies dispense on its behalf. HRSA audits compare that record against how the entity actually purchased and dispensed during the audit period. Any gap between the two is a finding, even when no drug moved incorrectly.

Three specific OPAIS errors accounted for most of the FY2025 citations. Each one has a different owner inside the organization, which is why they persist.

Medicare Cost Report Filing Dates and Cost Reporting Periods

The Medicare Cost Report filing date recorded in 340B OPAIS establishes the period HRSA uses to confirm hospital eligibility. Fourteen FY2025 audits cited an incorrect filing date, cost reporting period, or disproportionate share percentage. This field belongs to the reimbursement team, not the pharmacy team, and it changes whenever a cost report is amended or refiled.

Assign one named owner to update 340B OPAIS within thirty days of any cost report submission or amendment. Reliable accounting support for 340B covered entities keeps the filed cost report and the OPAIS entry reconciled as a standing monthly item rather than an annual scramble.

Offsite Outpatient Facilities That Never Reached 340B OPAIS

An offsite outpatient facility must appear on the entity’s Medicare Cost Report as a reimbursable line and be registered separately in 340B OPAIS before it can use 340B drugs. Fourteen FY2025 audits found offsite facilities that were operating but never listed. A further group was cited for the opposite error, meaning sites that had closed but remained registered.

Reconcile your registered site list against your active location list every quarter. Registration windows open only four times a year, so a site opened in month one of a quarter cannot purchase 340B drugs until the next window processes.

Contract Pharmacies Registered Without a Written Contract

Sixteen FY2025 audits cited contract pharmacies listed in 340B OPAIS with no written contract in place, and 20 audits ended in termination of a pharmacy or site from the program. This is the most severe category of reporting error because the sanction removes revenue permanently rather than requiring a repayment.

Match every pharmacy in your OPAIS record to a signed, currently effective contract and a termination date you control. Remove closed and duplicate registrations in the same pass.

The Medicaid Exclusion File Snapshot Deadline Most Clinics Miss

The Medicaid Exclusion File is the quarterly HRSA list of covered entity sites that have chosen to carve in Medicaid, published with at least one Medicaid provider number or National Provider Identifier for each. It exists so that a state does not claim a rebate on a drug already purchased at the 340B price. Forty seven FY2025 audits, or 27.5 percent, involved a Medicaid Exclusion File problem.

Two mechanics decide whether your entry is right, and both are frequently misunderstood.

The first is timing. HRSA states that the 340B OPAIS takes a snapshot of carve in and carve out decisions at 12:01 a.m. Eastern Time on the 16th day of the month prior to the start of each quarter, irrespective of weekends or holidays. A change requested after that moment does not take effect until the quarter after next. Entities that switch billing practice on the first of a quarter without clearing the snapshot create exactly the mismatch HRSA cites.

The second is scope, and it is the detail most guidance omits. HRSA states plainly that the Medicaid Exclusion File only applies to Medicaid fee for service. Managed care duplicate discounts are governed by state specific rules and are not solved by your Medicaid Exclusion File entry. A clinic can be perfectly listed and still generate a duplicate discount through a managed care plan.

Within the 47 findings, 32 involved inaccurate or incomplete Medicaid Exclusion File information and 21 involved billing Medicaid while not listed on the file at all. Some entities were cited for both.

340B ESP Claim Submission Errors and the Fix for Each One

340B ESP is the manufacturer facing platform where covered entities and their third party administrators submit contract pharmacy claim data to retain access to 340B pricing. Rejections are usually formatting failures, not eligibility failures, which means they are fully preventable. The platform documents nine required fields for pharmacy claims and 13 for medical claims.

The table below pairs each recurring submission error with the specific correction, using the field formats 340B ESP publishes.

One correction matters more than the format rules. There is no single universal twice monthly deadline that applies to every manufacturer. The 340B ESP guidance directs covered entities to submit claims data as soon as claims are qualified as 340B eligible, and to review individual manufacturer policies on the platform’s resources page for timing. Teams that build one calendar rule for all manufacturers miss the tighter ones.

How to Automate 340B TPA Data Reconciliation

340B TPA data reconciliation is the process of proving that the claims your third party administrator qualified match the purchases in your wholesaler account and the entries in your ledger. Manual reconciliation fails at scale because three systems change between the day you pull a report and the day you review it.

The reconciliation method that works is the same one used outside pharmacy. In a healthcare accounts receivable reconciliation for a six entity medical group, ad hoc portal downloads had left invoices billed in the practice management system missing from the books entirely, and voided invoices still carried as open receivables. The fix has four parts that transfer directly to 340B data.

• Standardize both extracts into one format with the same date, identifier, and amount conventions, then generate a unique identifier on every line in both systems.
• Match on that identifier rather than by eye, and produce four outputs: matched lines, items missing from the books, extra items in the books, and flagged duplicates.
• Move from ad hoc to a fixed cadence of twice monthly plus a pre close run, which removes the gap between the pull date and the review date.
• Run every related entity on the same cycle so intercompany and intersite balances cannot drift apart.

That group moved roughly 800,000 dollars of receivables to invoice by invoice reconciliation and delivered monthly financials by the tenth of the month. The same four steps applied to 340B accumulations turn a quarterly surprise into a twice monthly exception list.

Which Alerts Catch 340B Price Misalignment Early

340B price misalignment happens when the price you paid a wholesaler differs from the 340B ceiling price you were entitled to on that purchase date. Left unmonitored, the gap is only discovered at a quarterly true up, by which point the recovery window with the manufacturer may have closed.

Four alerts catch it while it is still recoverable, and each one should fire to a named person rather than a shared inbox.

• Purchase price variance against the published ceiling price on the date of purchase, flagged at any variance above zero rather than a tolerance band.
• Wholesaler account mismatch, where a 340B eligible order routes to the group purchasing or wholesale acquisition cost account.
• Accumulation without replenishment, where qualified claims build but no matching 340B order is placed within the expected cycle.
• Credit and rebill activity that changes an already submitted claim, because the original submission stays in the manufacturer’s record until corrected.

Missed savings recovery is a reporting output, not a pharmacy negotiation. Quantifying it monthly is one reason 340B financial reporting matters to the finance team and not only to the compliance officer.

Provider and Patient Data That Fails an Audit After Hours

Provider eligibility data fails most often at the edges of the schedule, because the records that establish an eligible relationship are created by people working outside the normal registration workflow. Thirty one FY2025 audits cited diversion, and the recurring cause was prescriptions written at sites or by providers that the entity’s own records did not support.

The weak points are predictable. Locums and rotating residents get dispensing rights before they reach the provider file. Terminated physicians stay on the file for a full quarter. Prescriptions written in an emergency department or at discharge carry a site code that never mapped to a registered outpatient location. Weekend and after hours fills route through a covering pharmacy with a different eligibility rule.

Fix the file, not the fill. Reconcile the active provider roster against the credentialing system every payroll cycle, since payroll already knows the exact day someone started or left. Map every dispensing location code in the electronic health record to a registered 340B site, and set unmapped codes to fail closed rather than default to eligible.

Building an Audit Evidence Chain for Every 340B Claim

An audit evidence chain is an unbroken documented path from the prescription to the purchase, assembled before an auditor asks rather than during the sampling window. HRSA requires auditable records for every 340B transaction, and the FY2025 results show that entities with accurate records still received findings when they could not evidence them quickly.

The structure is proven outside 340B. In an audit support engagement for a six entity specialty healthcare group with receivables between 800,000 and 980,000 dollars, every sampled item was traced through a fixed chain from explanation of benefits to payment receipt to bank deposit to ledger entry. Auditor selections stopped stalling because the chain was already assembled.

Translated to 340B, the equivalent chain has six links for every claim.

• Prescription record showing prescriber and the location where it was written.
• Confirmation that the prescriber was on the provider file on that date.
• Confirmation that the location was a registered site in 340B OPAIS on that date.
• Dispense record from the pharmacy or contract pharmacy.
• Medicaid billing status for that patient against the correct quarter’s Medicaid Exclusion File.
• Wholesaler order and invoice showing the replenishment purchase at the 340B price.

System boundaries are where chains break. A multi entity healthcare group running AllScripts alongside QuickBooks Online needed every difference between clinical service data and booked revenue explained item by item before its two year audit could close. Build that bridge as a monthly reconciliation and the audit becomes a retrieval exercise.

What Changed in 2026: The 340B Rebate Model Pilot Program

The 340B Rebate Model Pilot Program is a voluntary pathway, announced by HRSA on 31 July 2026, for qualifying manufacturers to deliver the 340B ceiling price through rebates after validating claims rather than through an upfront discount. Manufacturers had to submit rebate plans to HRSA by 24 August 2026, and approved plans take effect on 1 January 2027.

HRSA describes the pilot as a response to a program that grew from 53.7 billion dollars in 2022 to more than 100 billion dollars in 2025, and to a request for information that drew more than 2,400 public comments. The stated aim is transaction level verification of eligible 340B claims.

For reporting teams this is the most consequential change in years, because it moves 340B from a purchasing discount to a claims reimbursement. Under a rebate model the entity pays the higher price at purchase and recovers the difference only when its claim data validates. Three consequences follow directly.

• Cash flow moves before margin does. The gap between paying full price and receiving the rebate becomes a working capital line that has to be forecast, not a rounding difference.
• A rejected claim is no longer a compliance note. It is unrecovered cash, so submission accuracy converts directly into revenue.
• Accrual treatment matters. Recognizing the rebate when the claim is validated rather than when cash arrives is what keeps monthly results readable.

Entities that already reconcile claims to purchases twice monthly will absorb this. Entities reconciling quarterly will discover the shortfall a quarter late.

How 340B Reporting Scope Changes With Your Site Count

Reporting workload in the 340B program scales with structure rather than with prescription volume. The same rules apply to every covered entity, but the number of records that must stay synchronized changes sharply as sites and pharmacies are added. Match your process to your structure.

Single Site Clinics

A single site clinic maintains one 340B OPAIS record, one Medicaid Exclusion File decision, and one provider file. The realistic risk is staleness rather than complexity, because no one owns the record between annual recertifications. A quarterly fifteen minute review of the OPAIS entry against reality is usually sufficient.

Multi Site Health Systems With Child Sites

A multi site system must keep every offsite outpatient facility registered, cost report linked, and correctly opened or closed in 340B OPAIS. This is where the 14 unlisted facility findings and the closed site findings concentrate. The controlling document is the Medicare Cost Report, so the reporting calendar has to follow the reimbursement calendar rather than the pharmacy calendar.

Entities With Contract Pharmacy Networks

A contract pharmacy network adds a written contract, a 340B ESP submission stream, and a third party administrator data feed for every pharmacy. Sixteen FY2025 audits cited pharmacies registered without a written contract, and terminations were concentrated here. Contract status, OPAIS registration, and the claim feed must be reconciled together, because a pharmacy can be contractually live and administratively terminated at the same time.

Three 340B Reporting Scenarios From Real Clinic Work

The following scenarios show how reporting errors surface in practice. Each is drawn from published GATP Solutions engagements in healthcare and pharmacy accounting.

Specialty pharmacy and insurance settlement timing. A specialty rheumatology and immunotherapy pharmacy recorded drug purchases immediately but recognized revenue only when insurance settled, which took 30, 60, or 90 days. That created artificial loss periods followed by artificial profit spikes, and direct and indirect remuneration clawbacks arrived with no accrual behind them. Moving to accrual recognition at the point of fill made the economics of each dispense visible in the month it happened, which is the same discipline a rebate based 340B model will require.

Multi location practice and system boundaries. A multi entity group ran clinical data in one platform and financials in another, with no monthly mapping between service data and booked revenue. Every unexplained difference became an auditor query. Tracking revenue cycle management metrics against ledger entries each month closed the gap before the audit opened.

Finance leadership visibility. Clinics that report 340B savings only at year end cannot tell whether a fall reflects lower volume or unrecovered claims. Adding realized savings, rejected claim value, and price variance to the monthly healthcare financial reporting KPIs puts the number in front of leadership while it can still be acted on.

340B Reporting Mistakes to Avoid

These are the errors that produced findings in FY2025 and the ones most likely to repeat. Each is a recordkeeping failure rather than a clinical one.

• Updating 340B OPAIS only at recertification instead of within thirty days of any change.
• Requesting a Medicaid carve in or carve out change after the 12:01 a.m. Eastern Time snapshot on the 16th of the month before the quarter.
• Assuming the Medicaid Exclusion File covers managed care when it applies to fee for service only.
• Letting an export strip leading zeros from an 11 digit National Drug Code before a 340B ESP upload.
• Applying one submission deadline to every manufacturer instead of checking each manufacturer’s policy.
• Leaving closed sites, terminated pharmacies, and duplicate registrations live in 340B OPAIS.
• Registering a contract pharmacy before the written contract is signed and effective.
• Treating unmapped dispensing location codes as eligible by default.
• Reconciling third party administrator data quarterly rather than twice monthly.
• Missing the annual recertification window, which results in termination from the program.

Monthly and Quarterly 340B Reporting Checklist

Use this as a standing calendar rather than an audit response. The cadence matters more than the effort, because every item on it decays.

Twice monthly

• Reconcile third party administrator qualified claims to wholesaler 340B purchases and flag missing, extra, and duplicate lines.
• Clear all 340B ESP submission rejections and confirm resubmission.
• Review price variance alerts against the ceiling price on the purchase date.

Monthly

• Reconcile the active provider roster to the credentialing and payroll records.
• Confirm every dispensing location code maps to a registered 340B site.
• Report realized savings, rejected claim value, and price variance to finance leadership.

Quarterly, before the 16th of the month preceding the quarter

• Confirm the carve in or carve out decision for each state and submit any change before the snapshot.
• Verify every Medicaid provider number and National Provider Identifier on the Medicaid Exclusion File.
• Reconcile registered sites and contract pharmacies in 340B OPAIS against active locations and signed contracts.
• Confirm the Medicare Cost Report filing date and cost reporting period still match the filed report.

Annually

• Complete recertification within the published window, because failure to recertify results in termination from the 340B Program.
• Commission an independent review of contract pharmacy activity and documentation.

Our Compliance and On Time Delivery Guarantees

340B reporting errors carry repayment and termination consequences, so the work has to be right and it has to be on time. We stand behind both.

Regulatory Compliance Assurance. We ensure all tax filings, payroll, and financial reports meet compliance standards. If an error on our part results in a financial penalty, we will cover the cost.

On Time Delivery Guarantee. Monthly, quarterly, and annual reports are delivered without delays. If we miss a compliance deadline due to our fault, we pay a 50 percent fee.

How GATP Solutions Supports 340B Reporting Accuracy

We are an accounting and finance partner to covered entities, not a pharmacy consultancy or a software vendor. Our work sits on the reporting and reconciliation side, where most FY2025 findings originated. Clinics use us to keep the numbers defensible so their pharmacy team can concentrate on eligibility and dispensing.

• Claims to purchase reconciliation. We reconcile third party administrator claim data to wholesaler purchases and to your ledger on a fixed twice monthly cycle, and deliver an exception list rather than a report you have to interpret.
• Savings and leakage quantification. We measure realized 340B savings, rejected claim value, and price variance each month so unrecovered amounts surface while they can still be recovered.
• Audit evidence assembly. We build and maintain the documentation chain auditors sample, so a HRSA selection becomes a retrieval task instead of a reconstruction.
• Accrual and rebate readiness. We set the accrual treatment and cash flow forecasting needed if your manufacturers move to the rebate model in 2027.

Get Your 340B Reporting Reviewed Before Your Next Audit

We will review your last four quarters of 340B accumulations against your wholesaler purchases, your 340B OPAIS record against your active sites and contracts, and your Medicaid Exclusion File entries against your billing practice. You get back a written list of the specific mismatches, the repayment exposure each one carries, and which are recoverable. Thirty days, one clear answer, no obligation.

Book a free consultation.

Conclusion

The FY2025 audit results settle an old argument about where 340B risk actually sits. Diversion appeared in 31 of 171 finalized audits. Incorrect 340B OPAIS records appeared in 70, and 53 entities were ordered to repay manufacturers. The program’s biggest financial exposure is administrative data that stopped matching operational reality.

That is good news, because data problems respond to cadence. A quarterly OPAIS reconciliation, a carve in decision cleared before the snapshot, a twice monthly claims to purchase match, and a maintained evidence chain remove most of what HRSA cited last year.

The rebate pilot raises the stakes from 2027. When 340B value arrives as a validated rebate rather than an upfront discount, reporting accuracy stops being a compliance obligation and becomes the mechanism by which the savings arrive at all.

Frequently Asked Questions About 340B Reporting

What is 340B reporting?

340B reporting is the ongoing work of keeping your registration records, Medicaid billing status, and claim submissions accurate and consistent with how your entity actually purchases and dispenses. It covers the 340B OPAIS record, the Medicaid Exclusion File entry, 340B ESP claim submissions, and the reconciliation between qualified claims and wholesaler purchases.

What is the most common 340B audit finding?

An incorrect 340B OPAIS record is the most common finding, appearing in 70 of the 171 FY2025 audits HRSA has finalized. Typical causes are unlisted offsite outpatient facilities, wrong Medicare Cost Report filing dates, and contract pharmacies left registered after a contract ends.

When is the Medicaid Exclusion File deadline each quarter?

The 340B OPAIS takes its snapshot of carve in and carve out decisions at 12:01 a.m. Eastern Time on the 16th day of the month before each quarter starts, irrespective of weekends or holidays. A change approved after that time does not take effect until the following quarter, so submit well before the date to allow processing.

Does the Medicaid Exclusion File cover Medicaid managed care?

No, the Medicaid Exclusion File applies to Medicaid fee for service only. Managed care duplicate discount prevention depends on state specific billing rules, so a correct Medicaid Exclusion File entry alone does not protect you against a managed care duplicate discount.

How often must 340B ESP claims data be submitted?

There is no single deadline that applies to every manufacturer, so timing must be checked manufacturer by manufacturer. The 340B ESP guidance directs covered entities to submit claims data as soon as claims are qualified as 340B eligible and to review each manufacturer’s published policy for its own timing requirements.

Why do 340B ESP submissions get rejected?

Most rejections are formatting failures rather than eligibility problems. The frequent causes are National Drug Codes submitted without the full 11 digits and leading zeros, Service Provider IDs that are not exactly 10 digits, dates carrying an appended timestamp, and column mappings that do not match the platform’s submission screen.

What happens if a covered entity fails to recertify?

Failure to recertify during the scheduled window results in termination from the 340B Program. HRSA requires annual recertification in which the Authorizing Official confirms the entity’s information is accurate and that it complies with all 340B Program requirements.

How does the 340B Rebate Model Pilot Program change reporting?

It converts 340B value from an upfront purchase discount into a rebate paid after the manufacturer validates your claim data, for approved plans effective 1 January 2027. That makes submission accuracy a cash recovery issue and introduces a working capital gap between paying the higher price and receiving the rebate.

How often should 340B TPA data be reconciled?

Reconcile third party administrator claim data against wholesaler purchases twice monthly, with an additional run before each financial close. Quarterly reconciliation leaves too little time to recover a price variance or resubmit a rejected claim before the manufacturer’s window closes.

Who should own 340B reporting inside a clinic?

Split ownership by data source and name a single person for each field rather than assigning the whole program to pharmacy. Registration and cost report fields belong with reimbursement and finance, provider file accuracy belongs with credentialing and payroll, and claim submission belongs with the pharmacy or third party administrator, with one accountable owner reconciling across all three.