When HRSA Shows Up With a Spreadsheet
In early 2024, HRSA auditors arrived at a Midwestern FQHC’s main site carrying a 200-line spreadsheet labeled “Contract Pharmacy 340B Sample.” It listed dispensing data from two Walgreens locations and one independent pharmacy. The auditor wanted EHR documentation proving that every patient encounter met the 1996 patient definition. About half did, prescribers employed by the FQHC. The other half? Written at nearby partner clinics. That FQHC assumed its written agreement covered those encounters. HRSA said otherwise: no formal contract, no access to visit notes for audit. The finding, diversion through ineligible patients, cost nearly $400,000 in repayments.
This is what 2024’s contract pharmacy environment looks like. HRSA hasn’t changed the law, 42 U.S.C. §256b is the same, but it’s enforcing documentation and oversight at a level most entities haven’t seen since the 2012 policy update. The OPAIS registration portal still accepts any pharmacy relationship a covered entity certifies, yet HRSA’s auditors now demand continuous proof of control: encounter-level validation, auditable reconciliation, and prescriber relationship mapping that actually holds up under review.
What HRSA’s 2024 Guidance Actually Said
In March 2024, HRSA released its “Contract Pharmacy Oversight and Audit Clarifications” FAQ, the first update since 2020. It restated the obvious but in sharper language: covered entities are fully responsible for every 340B dispense made at contract pharmacies, and they must maintain auditable records proving patient eligibility and compliance with the duplicate discount prohibition. Policy didn’t change, expectations did. HRSA now requires quarterly data reviews, retention of eligibility documentation for at least five years, and the ability to trace each 340B dispense to a specific encounter within the entity’s own medical record system. Those five words have upended hospital workflows connecting to outside clinics running eClinicalWorks or AthenaNet systems they can’t touch.
HRSA also emphasized that oversight means both retrospective and prospective controls. Retrospective: auditing dispense and replenishment data after the fact. Prospective: blocking ineligible prescriptions before they ever qualify for 340B purchase. The FAQ even warned against “black box” vendor algorithms. If a covered entity can’t explain how its vendor defines a “340B eligible Rx,” HRSA considers that noncompliant. This has rattled hospitals using third-party split-billing vendors that mask patient eligibility through proprietary logic. HRSA’s view: if you can’t show it, you can’t defend it. Simple as that.
Preventing Diversion Isn’t Just About Eligibility
Diversion under §256b(a)(5)(B) gets all the attention, but most problems start long before the dispense. Too many contract pharmacy agreements bury “program administration” in a TPA clause and skip the part about verifying eligibility. HRSA doesn’t care what the TPA promised, it cares what you can prove. Every 340B dispense must link to a patient record meeting the 1996 definition: an established relationship with the covered entity, a provider employed by or under contract with that entity, and care records maintained by the entity itself.
Hospitals routinely trip up on that second requirement. HRSA has never modernized the patient definition to fit today’s networked care models. So even if your community cardiologist rounds weekly and documents in Epic, without employment or a contractual tie to your DSH hospital, HRSA won’t count that patient. The Eleventh Circuit’s 2023 ruling in Genesis Healthcare v. HHS didn’t change that, it addressed duplicate discount enforcement only. Compliance officers are left balancing a 1996 rule against 2024 healthcare complexity. The safest move is still to confine 340B contract pharmacy claims to encounters involving an employed or formally affiliated provider. Anything else invites clawbacks.
Diversion prevention also depends on tight inventory control. Independent pharmacies still accidentally fill commercial claims from 340B stock because their TPA’s switch lags a few minutes. Still diversion. HRSA auditors now expect proof of true segregation, physical or virtual, and will dismiss any “proportionate replenishment” summary that lacks time stamps and matched pricing files. Covered entities should audit a random sample quarterly and verify dispense-level detail. HRSA made that expectation clear in its 2024 OPA webinar, showing that 63% of 2023 findings involved missing or incomplete audit trails.
Document Everything Like You’ll Be Audited Tomorrow
Patient eligibility documentation is once again center stage. HRSA’s 2024 FAQ says plainly that “the covered entity’s medical record must demonstrate care responsibility.” Screenshots from external EMRs don’t count unless they prove ownership of care records. For FQHCs and Ryan White clinics, that means ensuring external providers linked to the 340B program have data-sharing agreements that import or mirror their notes into your EHR. Hospitals need to secure the same through contracts with affiliated groups, those notes must land inside your system, not a separate one across the street. Otherwise, their prescriptions won’t qualify.
I watched one children’s hospital lose half its Walgreens volume almost overnight because its neonatologists billed under a faculty practice plan, not the covered entity. HRSA didn’t care that the revenue benefitted the hospital, it cared who employed the prescriber and who owned the chart. That hospital spent six figures rebuilding EHR interfaces and rewriting contracts to regain eligibility. CFOs rarely see that coming.
Oversight documentation is another minefield. HRSA wants proof of active management, meeting minutes, audit logs, TPA correspondence, corrective actions, not polished policy binders. When I prepare audit defense binders, I always include internal emails showing real review of pharmacy reports and questions raised in real time. Auditors notice that kind of engagement; they’re looking for evidence of a living compliance process, not paperwork thrown together the night before. You can survive weak spots if you can show ongoing course correction.
HRSA hasn’t announced whether future audits will pull data directly from contract pharmacies, but industry chatter points toward OIG testing that in 2025. Covered entities should assume pharmacy-level transparency will become mandatory. That means each pharmacy must show which claims filled as 340B, which did not, and the inventory that replenished each one. If a pharmacy refuses or can’t provide that, it’s a compliance liability, period.
Where Covered Entities Go From Here
The 340B contract pharmacy model in 2024 faces more scrutiny than ever. HRSA’s audits have toughened, manufacturers like Pfizer, AstraZeneca, and Sanofi still restrict eligible locations, and courts in Delaware and New Jersey continue wrestling with data access fights. Covered entities are navigating a compliance minefield. The ones staying clean treat oversight as an everyday duty, not a box to tick once a year. Continuous reconciliation. Live eligibility logs. Real collaboration between pharmacy, compliance, and medical staff.
The old motto, trust your TPA, no longer works. HRSA expects you to trust but verify, every time. Covered entities that can’t trace each 340B dispense straight back to a documented encounter inside their own records will keep losing repayments, and auditors’ trust along with it. HRSA didn’t raise the bar this year. It just stopped pretending the bar was optional.