When a 340B registration becomes a compliance trap
Each audit cycle, HRSA examiners keep seeing the same issue: an outpatient site dispensing 340B drugs that isn’t properly reflected in the hospital’s cost report. Hospitals often assume that ownership and staffing make the site eligible. HRSA doesn’t see it that way. What counts is whether that location was listed as a reimbursable department or clinic of the parent hospital before its registration date. Miss that, and routine billing turns into diversion, triggering potential paybacks and loss of 340B access at that site.
During their June 12, 2026, Drug Channels Institute webinar, “340B in 2026: Market Shifts, Policy Battles, and What They Mean for Stakeholders,” Dr. Adam Fein and Tyler Novotny noted how the program’s economic and compliance contours have outpaced federal oversight. That’s most visible with hospital-affiliated outpatient departments trying to register new child sites. The uneasy mix of healthcare expansion goals and HRSA’s rigid eligibility tests continues to drive audit risk across hospital networks.
How HRSA defines a 340B-eligible child site
For HRSA, everything still hinges on the Medicare cost report. A facility qualifies only if it’s listed as a reimbursable outpatient cost center of the covered entity, not merely owned by it. The agency uses that listing and date to confirm whether the site was part of the hospital’s operations when registered. If the cost center wasn’t yet recorded, the site isn’t eligible, even after later updates. That’s why administrators comb through Worksheet A before every quarterly registration window.
Off-campus outpatient departments fall under the same rule. Physical separation doesn’t matter; financial and operational integration on the cost report does. CMS’s 2026 proposed rule for the Hospital Outpatient Prospective Payment System underscores that off-campus departments remain tied to the parent’s cost reporting structure. Both systems overlap there, if a site fails CMS’s hospital-based test, it fails HRSA’s covered-entity test too.
Registration requirements and the timeline problem
Even when a site qualifies, 340B activity can’t begin until HRSA lists it as active in the Office of Pharmacy Affairs Information System (OPAIS). That creates real timing pressure when hospitals acquire or expand clinics midyear. Operations can start immediately, but 340B savings have to wait until registration is complete and publicly visible. When activity starts early, it usually ends with a self-disclosure once internal auditors spot the gap.
Details decide compliance. Hospitals must submit the exact address, name, and CMS certification that match the parent’s cost report and Medicare enrollment. HRSA expects crosswalks showing how each cost report line maps to a registered site. Without that, the agency can rule the registration invalid, even if the hospital genuinely operates and controls the location.
Auditable relationships and service reach
Registration isn’t the end of eligibility. HRSA wants each transaction linked from the patient encounter to the drug’s purchase and dispensation event. Auditors ask hospitals to show that the eligible patient received care from a provider employed or contracted under the covered entity at the registered site. That traceable relationship, provider, encounter, location, ties the 340B claim back to the cost-report line that earned eligibility. If the data point to a physician group outside that boundary, HRSA calls it ineligible.
These tracking chains are getting harder to manage as health systems sprawl across ambulatory networks. Data from the Drug Channels Institute’s 2026 review show how vertically integrated PBM and payer networks influence where prescriptions get filled. That rerouting can blur audit trails when prescriptions originate in hospital-owned clinics but flow through outside pharmacies under layered agreements. HRSA still expects ironclad documentation linking contracts, prescribers, and clinical records to the hospital’s 340B umbrella, even in fragmented care models.
Auditors often sample patients from multiple off-site clinics. If a hospital can’t produce encounter documentation within the cost-center limits of a child site, HRSA flags diversion. The agency doesn’t weigh diagnosis type or patient need, only whether the encounter satisfies the statutory and registration-based relationship tests. It’s a mechanical view, and hospitals must match it with equally precise records.
Practical steps to stay compliant in 2026
Hospitals now time their financial and compliance cycles so cost report filings, HRSA registrations, and pharmacy activations line up. Legal teams determine exactly when a new clinic crosses the HRSA eligibility line. Pharmacy directors hold off on 340B purchases until the site appears on OPAIS. Internal auditors continually map active providers to eligible sites to confirm encounters happen under the right cost centers.
As the 2026 Drug Channels session emphasized, operational precision has become strategic survival. With 340B tied deep into major PBM and retail pharmacy networks, errors in child-site registration can ripple across the system. The hospitals treating HRSA registration as a living document, not a one-time task, those are the ones positioned to get through the next audit. And that’s probably enough said.
Sources
- 340B in 2026: Market Shifts, Policy Battles, and What They Mean for Stakeholders (Drug Channels, 2026-06-12)
- Medicare Program: Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems (U.S. Federal Register / CMS, 2026-07-07)
