When the Audit Letter Arrives
One email from HRSA can upend a covered entity’s entire year. The notice sounds polite but leaves no doubt: the organization has been chosen for a 340B program integrity audit. Within days, the agency will demand a sample of dispensed claims, followed by a virtual entry meeting. For administrators who still recall the last audit’s findings, this is the moment to double-check every patient eligibility record and contract pharmacy data feed, before HRSA does.
By 2026, the 340B Drug Pricing Program bears little resemblance to the focused policy Congress first created. The Drug Channels Institute calls today’s contract pharmacy sector a consolidated and mature marketplace, now dominated by large chains and PBMs. Five public corporations, Cigna, CVS Health, UnitedHealth Group, Walgreens, and Walmart, control roughly seventy-seven percent of all contract pharmacy arrangements. That concentration magnifies every compliance weakness, since HRSA investigators trace diversion risks through these shared corporate links, not individual stores.
How HRSA Verifies Drug Diversion
HRSA audit teams start with diversion, the transfer of a 340B-purchased drug to anyone who isn’t an eligible patient of the covered entity. Each dispense must be tied to a billable encounter with a qualified provider. That’s straightforward for an integrated hospital pharmacy tied directly to an EMR, but contract pharmacy claims need another validation step. The audit portal requires lists matching each 340B dispense to its corresponding encounter, diagnosis, and prescriber of record.
Auditors don’t assess intent, only process. If a refill lacks provider documentation or the prescriber isn’t credentialed under the covered entity, HRSA classifies it as diversion. Remedies are limited to repayment to the manufacturer or voluntary claim removal, non‑negotiable outcomes. Covered entities relying on third‑party administrators often find gaps here; automated logic sometimes marks a prescription as eligible even when required data points are missing.
Patient Eligibility and the Expanding Definition Problem
The boundaries of patient eligibility remain one of the program’s most contested issues. Adam Fein’s June 2026 Drug Channels analysis highlighted it as a central point of oversight tension. HRSA continues to require proof that the patient has an established relationship with the covered entity and that the health record is maintained there. What’s changed is HRSA’s expectation of live, system‑based proof instead of post‑hoc explanations. A loose affiliation with a contract provider no longer qualifies if the medical record and prescriptive authority sit outside the entity’s control.
During site reviews, auditors sample encounters across multiple service lines, primary care, behavioral health, specialty clinics, to test consistency. They then compare those lists with 340B‑eligible pharmacy claims. Any mismatch can trigger a finding. The programs that clear reviews usually have embedded eligibility logic within their dispensing workflows, backed by clear written policies that mirror HRSA’s current tests.
Following the Chain of Custody in Contract Pharmacy Relationships
Contract pharmacy oversight is now HRSA’s most resource‑heavy audit area. According to the 2026 Drug Channels Institute report, the sector’s slowed growth and consolidation have produced massive partner networks serving hundreds of covered entities. With these operations increasingly run by large chains and PBMs, auditors check whether replenishment records, accumulator balances, and reconciliation files can be traced from start to finish. Missing shipment proof or mismatched wholesaler invoices count as stewardship failures by the covered entity.
They examine more than paperwork. HRSA interview sessions often include pharmacy managers and IT staff handling daily data transmissions. A single mapping error in a virtual inventory can flip thousands of claims between 340B and non‑340B status. The audit team measures whether the oversight model can catch and correct those shifts without prompting. Covered entities skipping independent reviews or quarterly self‑audits often learn the consequences fast.
The enormous scale of the contract pharmacy market explains HRSA’s intensity. What began as an access tool has evolved, as Fein notes, into “an ever‑expanding profit pool for pharmacies and PBMs.” With nearly two‑thirds of U.S. pharmacies involved and a handful of corporations dominating, HRSA’s focus has turned pragmatic: who controls the money, and whether any of it still supports safety‑net care.
Keeping Control in a Consolidated Market
Success in site reviews now relies on evidence, not reciting statute text. Covered entities that withstand audit pressure maintain sound data systems, align eligibility logic with HRSA’s active interpretations, and test contract pharmacy output as carefully as their own dispensing. Records must show that each 340B unit connects directly to a qualifying encounter maintained by the entity. Anything less signals diversion risk.
The Drug Channels Institute’s continuing education series set for June 12, 2026, underscores how audit and compliance pressures shape today’s 340B landscape. The planned session with Adam Fein and Tyler Novotny will address growth trends, manufacturer policies, and HRSA‑CMS oversight dynamics that now guide audit priorities. For administrators heading into review season, the reality is clear: accountability has expanded dramatically. Clean findings depend entirely on the strength of the data link tying provider, patient, and prescription. And when that chain holds, everything else usually falls into place, or not.
Sources
- The 340B Contract Pharmacy Market in 2026: A Maturing Industry Dominated by Big Chains and PBMs (Drug Channels, 2026-06-02)
