When HRSA Finds a Documentation Gap
In 2024, HRSA auditors turned up a familiar issue at a Midwest FQHC: eligibility documentation that didn’t prove the patient was established with the health center at the time of service. The entity served the patient, prescribed the drug, and dispensed through a contract pharmacy, but the prescription was written by a provider credentialed after the encounter date. HRSA marked those as “ineligible” claims, triggering a mandatory payback and a corrective action plan. Same story, different ZIP code, because HRSA’s expectations around eligibility proof haven’t softened since the 2013 program notice.
When covered entities talk about “fixing” audit findings, they usually mean paying back manufacturers or tightening workflows. But correcting eligibility documentation errors goes deeper. HRSA’s 2022 audit protocol update made clear that each fix must be traceable and repeatable across future data pulls. You can’t just clean up one file for the audit response. The agency expects process-level reform, and if you can’t show it, your corrective action won’t pass muster.
Breaking Down HRSA’s Eligibility Standard
Most administrators can recite the three-part eligibility test: the patient must receive a service from the covered entity, the prescriber must be employed by or contracted with that entity, and the medical record must be maintained by the entity. HRSA first laid it out in the 1996 Federal Register notice, then reinforced it in the 2011 patient definition guidance that’s still unofficially in effect since the withdrawn 2015 draft. The agency’s interpretation is practical but expects airtight documentation. Without a clear link between encounter, prescriber, and covered entity scope, you’re exposed.
What’s evolving in 2025 isn’t the rule itself, it’s the evidence trail. HRSA now requests de‑identified samples from contract pharmacy claims and cross‑checks the EHR, provider rosters, and dispense data. Auditors expect timestamps showing when the encounter occurred relative to the prescription and whether the prescriber was “in network” under the 340B registration for that cost center. Discover an error, say, a provider’s start date entered a week late, and you can’t rewrite history unless you have contemporaneous proof. HRSA wants to see what existed on the date of dispense. Not a cleanup job completed later.
Reconstructing and Correcting After an Audit Finding
Once HRSA issues a preliminary report, you have 30 days to submit a corrective action plan. That clock moves fast. Step one: determine whether the eligibility errors were isolated or systemic. Pull 3-6 months of dispensing data tied to the same location and provider type. Even if HRSA sampled 50 claims, they expect you to quantify full exposure. If the root cause stems from missing encounter notes or provider mismatches, rerun the analysis to find everything tied to that same flawed logic. Otherwise, you’ll be patching holes instead of rebuilding the roof.
Document corrections must preserve the original record. HRSA, and sometimes OIG, will want to know exactly what existed pre‑correction. Always create an addendum instead of overwriting old entries. For example, if an EHR visit note tied to a non‑qualified site, append a clarifying entry identifying the correct service location, signed and dated after the finding. Never backdate. That’s how a compliance hiccup becomes a False Claims Act case, a line the DOJ has been paying close attention to since 2021.
Entities using split‑billing platforms like Macro Helix or VeritySource should update provider and location files immediately, but freeze new accumulations until HRSA signs off on the plan. Otherwise, you generate new ineligible claims while claiming remediation. FY2023 audit reports include multiple examples where entities kept dispensing during corrections, resulting in “repeat findings.” That typically doubles repayment exposure and stains your compliance record, ammunition manufacturers use when disputing future replenishment requests.
Coordinating with Contract Pharmacies and Manufacturers
Audit corrections don’t end inside your EHR. Contract pharmacies must ensure every dispense aligns with verified eligible encounters after your fixes. In 2023, HRSA flagged a DSH hospital in Texas because its contract pharmacy kept the old mapping logic even after the health system reclassified encounters. HRSA called that “ongoing diversion.” The remedy? Rerun accumulations using the corrected provider file and submit independent proofs through the third‑party administrator. That rerun lasted months, costing more in staff hours than the repayment itself.
Manufacturers reviewing payback letters will expect evidence of your internal validation. Since 2022, many repayment requests flow through Prime Vendor Program tools under Apexus. Expect Gilead, Merck, and Novo Nordisk to challenge weak documentation. If your corrective narrative doesn’t link directly to the HRSA finding, they may dispute your math or push to dispute resolution. HRSA’s Administrative Dispute Resolution rule from December 2020 hasn’t seen heavy use yet, but it’s ready. Avoid it with an airtight correction trail. Simple enough, but frequently ignored.
Entities that truly close the loop do three things: timestamp every corrective action, capture before‑and‑after screenshots of the record, and confirm contract pharmacies don’t resume accumulations until HRSA’s acceptance email arrives. Miss that last part and you’ll regret it later. Those emails may not be formal approvals, but they’re the only receipts that matter if the Office of Pharmacy Affairs circles back next cycle.
A Head Start on Preventing the Next Eligibility Error
The real leverage after an audit isn’t cleaning up the past, it’s redesigning how eligibility proof lives inside the workflow. Some entities now bake provider credentialing data into EHR headers so every encounter note carries the prescriber’s 340B status as metadata. Others link cost center, site ID, and enrollment type directly onto the form itself. When that metadata travels with the encounter, HRSA has less to question. And yes, it’s tedious to build, but once done, it saves more arguments than you’d believe.
One FQHC in California fixed recurrences by assigning a quality analyst to review 20% of 340B‑tagged encounters weekly. The cost: about $1,200 in FTE hours monthly. The payoff: roughly $200,000 in avoided diversions over two years. That’s easy math. HRSA’s team now runs analytics comparing entity data year over year. If your error rate doesn’t improve, they’ll notice. And once the “high‑risk” label lands, the next audit hits faster and harder. That’s when you stop talking about process reform and start living it.