340B Program Compliance in 2026: Requirements, HRSA Audits and the Accounting Behind Them

Compliance with the 340B program means meeting 5 HRSA requirements, and 55.7 percent of entities HRSA audited for fiscal year 2025 missed at least one. Those requirements let a covered entity keep buying outpatient drugs at the 340B ceiling price. Keep OPAIS records accurate and recertify every year. Never divert drugs to ineligible patients or take a duplicate discount with Medicaid. Keep records an auditor can trace.

That share comes from 176 finalized HRSA audits, 98 of which found at least one problem. Most of those problems are the same common 340B reporting mistakes clinics make every year. The usual culprits are a stale OPAIS record, an outdated Medicaid Exclusion File and a contract pharmacy with no signed agreement.

Who Is Responsible for 340B Compliance?

Responsibility for 340B compliance sits with the covered entity. It does not move to HRSA, the contract pharmacy or the third-party administrator (TPA), even when one of them causes the error. HRSA runs the program and audits it, but repayment lands on the entity. In fiscal year 2025 that happened in 56 of 176 finalized audits.

During annual 340B recertification, the Authorizing Official must verify that the entity meets every program requirement and submit that attestation to HRSA. The rest of the work spreads across 5 roles.

• Authorizing Official: signs the yearly recertification and owns the attestation.
• Program manager for 340B: keeps OPAIS current, writes policies and runs self-audits.
• Pharmacy director: controls dispensing, accumulators and replenishment orders.
• Compliance officer: runs internal audits and files self-disclosures when a problem appears.
• Chief financial officer and the finance team: book every purchase, fee and reimbursement, reconcile them, and record any repayment owed.

Finance is the role most 340B guides leave out. An auditor tests transactions, and every transaction ends in the ledger as a purchase, a fee or a payment. When the ledger and the TPA report disagree, the entity cannot prove what happened. That is why 340B financial reporting matters as much as the dispensing records themselves.

What Are the 340B Program Requirements?

The 340B program requirements are five duties HRSA places on every covered entity, plus a group purchasing ban for three hospital types. HRSA lists them on its 340B program requirements page. These 340B compliance requirements apply to every entity type, and any entity that breaks them may owe manufacturers a refund.

OPAIS Record Checklist for Covered Entities

The Office of Pharmacy Affairs Information System (OPAIS) is HRSA’s public 340B database. Wholesalers check it before they sell at 340B prices, and auditors check it first. Review these items at least every quarter.

• Every child site and offsite outpatient facility listed, with the correct address.
• Every contract pharmacy listed, with a signed written agreement on file.
• Ended pharmacy contracts and closed sites removed.
• Authorizing Official and Primary Contact names and emails current.
• Medicare Cost Report period and filing date entered correctly.
• Employer Identification Number matching tax records.
• Medicaid billing status matching how pharmacies actually bill.

Get Instant Access

Enter your details below and we will send the checklist straight to your inbox – no fluff, just the exact steps you need.

Send

Entities without a finance team that knows 340B usually get there through healthcare accounting services that already tie purchase, dispense and Medicaid records together.

What Are the Most Common HRSA 340B Audit Findings?

The most common HRSA 340B audit finding is an incorrect OPAIS record, found in 72 of 176 finalized fiscal year 2025 audits. We counted every row in HRSA’s FY25 covered entity audit results, updated September 24, 2026. HRSA publishes the rows but not the totals.

Many audits carry more than one finding, so the rows overlap. Of the 20 terminations, 16 removed a contract pharmacy and 4 removed an offsite facility or grant site. None of the 20 removed the whole entity.

Two early FY2026 OPAIS findings were a wrong Medicare Cost Report filing date and a wrong Employer Identification Number. The finance office owns both numbers. Fiscal year 2026 is still early. Only 38 audits were finalized as of July 29, 2026, so its totals are not yet comparable.

How Do I Prepare for a HRSA 340B Audit?

Preparing for a HRSA 340B audit means proving, one transaction at a time, that your written policy matches what your systems did. HRSA’s 340B program integrity page describes the 340B audit process it has run since 2012. Contracted auditors review policies and internal controls, then test drug transactions on a sample or judgmental basis, onsite or remotely.

Work through these 7 steps in order.

1. Name one audit contact. One person answers the engagement letter and the document request. Prevents conflicting answers from different departments.
2. Match policy to practice. Read each policy, then pull a live example of the process. Prevents a finding that controls exist on paper only.
3. Run a mock audit on a sample. Trace each claim from patient to encounter, prescription, dispense, claim and replenishment. Prevents surprise diversion findings.
4. Reconcile OPAIS to reality. Compare sites, pharmacies, the Medicare Cost Report and the EIN against current records. Prevents the most common finding of all.
5. Test Medicaid billing against the exclusion file. Pull Medicaid claims and check each against your carve-in or carve-out status. Prevents duplicate discount findings.
6. Tie the sample to the ledger. Every sampled claim should match a TPA line, a remittance, a bank deposit and a replenishment invoice. Prevents a repayment estimate you cannot defend.
7. Build one evidence folder per sample item. Store the full chain in one place. Prevents lost days during fieldwork.

340B Internal Audit and Self-Audit Cadence

A 340B internal audit is the entity’s own test of the same areas HRSA tests, run before HRSA does. For contract pharmacies, HRSA’s contract pharmacy audit FAQ recommends quarterly internal audits and annual independent audits of every pharmacy used.

The same FAQ asks entities to reconcile dispensing, purchasing and billing records. If a 340B self-audit finds diversion or a duplicate discount, the entity should file a self-disclosure with HRSA while it fixes the problem.

Corrective Action Plan Deadlines After the Final Report

A corrective action plan (CAP) is the written fix HRSA requests after a final audit report with findings. The clock is short:

The entity, not HRSA, must find and contact every affected manufacturer about repayment. HRSA may re-audit. A diversion finding in two or more audits may be treated as systematic and egregious. That can lead to removal and a ban on re-entry for a period.

How Do You Prevent 340B Duplicate Discounts With Medicaid?

A 340B duplicate discount happens when a manufacturer pays both a 340B discount and a Medicaid drug rebate on the same unit. The 340B statute forbids it. Two controls carry most of the load: the Medicaid Exclusion File for fee-for-service claims, and claim modifiers that flag 340B drugs to payers.

Medicaid Exclusion File (MEF) Quarterly Snapshot

The Medicaid Exclusion File (MEF) is HRSA’s list of entities that bill Medicaid fee-for-service for 340B drugs. Per HRSA’s Medicaid Exclusion File FAQ, three timing rules apply:

• The MEF covers Medicaid fee-for-service only. Managed care Medicaid sits outside it.
• OPAIS takes a snapshot of carve-in and carve-out decisions at 12:01 a.m. Eastern on the 16th day of the month before each quarter, even on weekends or holidays.
• Approved changes take effect on the first day of the next quarter, so billing should switch on that same day.

A carve-out decision made on the 17th of the month misses that quarter. If the pharmacy changes billing at once anyway, the claims and the file disagree for three months. That gap is a typical MEF finding.

TB Modifier Requirement for 340B Claims (Required Since 2025)

The TB modifier is the claim code that marks a drug as bought through the 340B program. CMS retired the older JG modifier for 340B claims with dates of service on or after January 1, 2025. The change came through its Medicare Part B inflation rebate guidance. TB is now the 340B code for those claims, and Medicaid rules differ by state.

Tennessee’s Medicaid program shows how this works in practice. Its TennCare 340B guidance update rejects JG on those claims and accepts TB, UD or UC. A claim line with no required modifier is disallowed. Entities that bill in several states should check three things.

• Which modifier each state Medicaid program accepts.
• Whether managed care plans use their own identifiers.
• Whether the pharmacy system and TPA apply the code on every line.

What Are the New Rules for the 340B Drug Pricing Program?

The biggest new rule is HRSA’s revised 340B Rebate Model Pilot, which takes effect on January 1, 2027 for selected drugs from 10 manufacturers. HRSA’s July 31, 2026 rebate pilot announcement says the program grew from $53.7 billion in 2022 to more than $100 billion in 2025.

340B Rebate Model Pilot: How the Rebate Works

Under the pilot, an entity buys a selected drug at wholesale acquisition cost (WAC) and claims the 340B discount back as a rebate. A first version was blocked by a federal court in Maine in December 2025 and vacated on February 10, 2026. The revised terms on HRSA’s 340B Rebate Model Pilot Program page are:

The pilot changes cash flow first. The entity now pays full WAC up front and waits for the rebate. HRSA also says it may use pilot data in routine 340B audits.

State 340B Reporting Laws: The Minnesota Example

State 340B reporting laws now ask covered entities for financial data HRSA never requested. Minnesota Statutes section 62J.461 requires every 340B entity in the state to report six items by April 1 for the prior calendar year.

• Total acquisition cost of 340B drugs.
• Total payments received for those drugs, by payer type.
• Pricing units dispensed or administered.
• Payments to contract pharmacies.
• Payments to any other outside party that manages the program, such as a TPA.
• Other direct internal costs of running the program.

Late data can draw a fine of up to $500 for each day past due. Every line on that list comes from the general ledger, so the chart of accounts has to separate them before year-end.

What Are the Biggest 340B Compliance Risks for FQHCs?

The biggest 340B compliance risks for FQHCs are patient eligibility tied to the scope of project and contract pharmacy oversight. Medicaid billing status and a newer grant condition on insulin and epinephrine pricing follow close behind.

FQHC 340B Compliance Risks Under the Grant Conditions

An FQHC qualifies for 340B through its Section 330 grant or look-alike status, so a patient’s care must sit inside the HRSA-approved scope of project. Contract pharmacies add risk because the health center does not run the pharmacy’s dispensing system.

Executive Order 14273 added a grant condition. Per HRSA’s Health Center Program compliance FAQs, health centers must offer insulin and injectable epinephrine at or below their 340B price. They may add a small administration fee.

The condition covers low-income patients at or below 200 percent of the Federal Poverty Guidelines who meet the order’s cost tests. The same FAQs confirm that Section 330 funds may still buy drugs included in the rebate pilot.

How Disproportionate Share and Critical Access Hospital Risks Differ

• Disproportionate share hospitals (DSH): eligibility rests on Medicare Cost Report data, so a wrong cost report date in OPAIS is a finding. The group purchasing ban applies, so a drug bought on a GPO account for outpatient use is a violation.
• Critical access hospitals (CAH): the group purchasing ban does not apply. Small pharmacy teams and heavy reliance on contract pharmacies make oversight and reconciliation the weak points.
• All hospitals: each offsite outpatient facility must be registered in OPAIS before its patients receive 340B drugs. Auditors check that listing against the Medicare Cost Report.

How Should 340B Savings and Contract Pharmacy Fees Be Recorded in the General Ledger?

Record 340B activity gross. Book reimbursement as revenue, 340B drugs at the price paid, and contract pharmacy and TPA fees in their own expense accounts. The net 340B benefit then comes from four ledger lines instead of hiding inside one net deposit.

Whether contract pharmacy revenue shows gross or net depends on the principal-versus-agent test in ASC 606 and on the contract terms. Decide it once, write it into the accounting policy, and apply it every month. Then build the accounts to match Minnesota’s statute. It asks for acquisition cost, payments received, contract pharmacy payments, TPA payments and internal costs.

340B Savings Recognition

The 340B savings figure is the gap between what a drug would cost at WAC and what the entity paid at the 340B price. That gap is not a transaction, so it never gets its own revenue entry. It belongs in a management report next to the ledger, not inside it.

The worked month below uses round, made-up numbers for one contract pharmacy channel. It shows why savings, net benefit and cash are three different figures.

Leadership often hears “$35,000 saved” and the board pack shows a $138,000 deposit. Neither is the program’s contribution. That figure is the $76,000 net benefit, and it is the one state reports and repayment estimates start from.

Contract Pharmacy and TPA Fee Accruals

Contract pharmacy and TPA fees should be accrued in the month the drug is dispensed, not the month the fee is netted from a remittance. In GAO report GAO-18-480, 29 of 30 contracts reviewed paid the pharmacy a flat fee per eligible prescription. Those fees ran from $6 to $15, and some contracts added a percentage of revenue.

Using the same month, the accrual entries look like this.

If a replenishment order has not been placed by month-end, accrue the unreplenished units as a liability at the 340B price. Otherwise one month shows a windfall and the next shows a loss.

We saw the same timing trap at a specialty pharmacy client. That client was not a 340B entity. Payers settled 30 to 90 days after dispense, and DIR fee clawbacks hit the bank months later. In that pharmacy accrual accounting engagement, the fix was to book each fee when the underlying claim was processed. Fees netted from late 340B remittances distort the month in the same way.

Rebate Receivables Under the Rebate Model Pilot

From January 1, 2027, pilot drugs create a receivable that the books must track. Say an entity buys 10 units of a pilot drug at a $500 WAC, or $5,000. The ceiling price on the date of dispense is $200 a unit. The rebate receivable is $3,000, or 10 units times the $300 difference.

Book that receivable at dispense, then age it against two clocks. The first is 45 days to submit the claim. The second is 10 days for the manufacturer to pay after a complete submission. A rebate still open on day 11 belongs on a dispute list, not in a general “other receivables” line.

How Do I Reconcile 340B TPA Reports to the General Ledger Each Month?

Reconciling 340B TPA reports to the general ledger means tying each monthly TPA report to four ledger balances. Those are the contract pharmacy receivable, 340B drug purchases, fee accruals and the replenishment liability. The steps below run in this order, and each prevents a named failure.

1. Fix the date basis. Pick date of dispense or date of adjudication and use it in both the TPA report and the ledger. Prevents a month that never ties.
2. Tie claims to cash. Match TPA claim totals to pharmacy remittances and bank deposits. Prevents short remittances going unnoticed.
3. Tie replenishment to invoices. Match TPA replenishment orders to the 340B wholesaler account invoices. Prevents purchases on the wrong account, which can trigger a GPO or diversion finding.
4. Test fees against contract rates. Multiply eligible claims by the contract fee and compare to the invoice. Prevents overbilled dispensing and TPA fees.
5. Book reversals and credits. Post reversed claims in the month the TPA reverses them. Prevents overstated revenue.
6. Value the accumulator. Price unreplenished units at the 340B price and accrue them. Prevents an unrecorded liability.
7. Check Medicaid lines. Compare Medicaid claims on the TPA report to the MEF status for that quarter. Prevents duplicate discounts reaching the books.
8. Sign off and file the evidence. Save the bridge, the reports and the approvals together. Prevents a CAP with no proof behind it.

Here is a bridge that ties, using the same illustrative month.

How Do 340B Program Solutions Streamline Audit Documentation and Workflows?

Software built for 340B programs streamlines audit documentation by running eligibility and duplicate-discount logic across every claim and logging each exception. It stops at the claim, though. 340B compliance software can show that a claim qualified. It cannot show that the money reached the right account.

• Software handles: claim qualification, split billing, accumulators, exception queues and the exception audit trail.
• Accounting handles: remittances, bank deposits, fee invoices, wholesaler invoices, accruals, month-end ties and repayment estimates.
• Both must agree on: the date basis, the claim count and the replenishment totals, or the evidence chain breaks.

The evidence chain is where audits are won. In one healthcare audit support engagement, a national audit firm tested the 2024 and 2025 books of a group of six-plus related healthcare entities. We had already built one package per sample item: remittance, payment receipt including split payments, bank deposit and invoice.

For 340B, the same chain runs from claim to TPA line, remittance, deposit, ledger entry and replenishment invoice.

Where Your Accountant Fits in 340B Compliance

Your accountant fits where 340B reports become money: the general ledger, the month-end close and the evidence an auditor uses to test repayment exposure. GATP Solutions is a CPA firm. Our CPAs handle the accounting side of 340B program management for covered entities, and that work is the part no pharmacy vendor or TPA covers.

The work has three core pieces, plus two that grow from them.

• Recognizing 340B savings: we set up the accounts, document the gross-versus-net policy and report savings, net benefit and cash as three separate figures.
• Accruing contract pharmacy and TPA fees: we accrue fees at dispense and test every invoice against claim counts and contract rates.
• Reconciling 340B reports to the ledger every month: we tie TPA reports, remittances, deposits and wholesaler invoices, and file the signed bridge as audit evidence.
• Rebate receivables from 2027: we book pilot rebates at dispense and age them against the 45-day and 10-day clocks.
• State reports and repayment estimates: we build state filings and repayment schedules straight from the reconciled ledger.

We do not decide patient eligibility, run split-billing software or act as an HRSA auditor. That accounting support runs through our outsourced accounting services, so your pharmacy and compliance teams are not carrying 340B reconciliations alone.

Conclusion: What 340B Compliance Takes in 2026

In 2026, 340B compliance means five HRSA requirements, a quarterly MEF snapshot, correct claim modifiers and, from January 1, 2027, rebate receivables for pilot drugs. Audits that end in repayment usually trace back to records that never tied. Common examples are an OPAIS entry, a Medicaid file or a ledger that disagrees with the TPA report.

Frequently Asked Questions About 340B Program Compliance

What Is 340B Compliance?

Compliance with the 340B program means following HRSA’s rules for buying outpatient drugs at the 340B ceiling price. A covered entity must keep its OPAIS record accurate and recertify every year. It must give 340B drugs only to eligible patients, avoid duplicate Medicaid discounts and keep auditable records. Breaking these rules can mean repayment to manufacturers or removal of sites from the program.

What Happens If a Covered Entity Misses 340B Recertification?

A covered entity that does not recertify during its scheduled window is terminated from the 340B program. It then loses access to 340B prices until it registers again. HRSA emails the Authorizing Official and Primary Contact about recertification, so out-of-date contact details in OPAIS are a common reason a window is missed.

How Often Should Covered Entities Audit 340B Contract Pharmacies?

HRSA recommends quarterly internal audits and annual independent audits of every contract pharmacy an entity uses, or more often if needed. Those reviews should test patient eligibility at the pharmacy and reconcile dispensing, purchasing and billing records. The entity stays liable for any diversion or duplicate discount there.

What Is a 340B Self-Disclosure?

A 340B self-disclosure is a report an entity sends HRSA when it finds diversion, a duplicate discount or another failure on its own. HRSA asks entities to submit it to 340bselfdisclosure@hrsa.gov while they correct the problem. The entity still has to work out repayment with the affected manufacturers.

Who Audits 340B Covered Entities?

HRSA audits covered entities through contracted auditors, and drug manufacturers may also request audits. Only one audit of an entity can run at a time. HRSA decides whether it or the manufacturer conducts a requested audit. Auditors review policies, OPAIS records, Medicaid Exclusion File designations and a sample of drug transactions.

Is the 340B Program Going Away?

No. The 340B program is still in effect, and HRSA says it grew to more than $100 billion in 2025. What is changing is how some discounts are paid. From January 1, 2027, 10 manufacturers will pay the discount on selected drugs as a rebate instead of an upfront price.

Can HRSA Terminate a Contract Pharmacy From the 340B Program?

Yes. HRSA can terminate a contract pharmacy registration as an audit sanction while the entity itself stays in the program. In the fiscal year 2025 results, 16 audits ended with a contract pharmacy terminated. The same results show 16 audits with a pharmacy registered and no written contract.

What Is 340B Pricing Compliance?

Pricing compliance in the 340B program is the manufacturer’s duty to sell covered outpatient drugs to registered entities at or below the 340B ceiling price. HRSA audits manufacturers for it. A manufacturer that overcharges may owe the entity a refund. Entities should compare invoice prices to ceiling prices, especially for pilot drugs bought at WAC.