HRSA’s 2026 Audit Shift: A Warning from the Medicaid Exclusion File
Covered entity administrators know that sinking feeling when a HRSA audit email hits their inbox. In 2026, those requests are longer and sharper, especially around the Medicaid Exclusion File. HRSA auditors now cross-reference state Medicaid billing data with 340B claim identifiers to see if entities are truly avoiding duplicate discounts. A few years ago, a mismatch between NPI or Medicaid billing numbers was treated as a technical glitch. Now it triggers a finding and often a refund order.
Community health centers sit directly in that spotlight. Many bill Medicaid under multiple NPIs, spanning states and managed care carve-ins, and HRSA wants proof that every billing setup matches what’s declared on the Exclusion File. The 2026 focus reflects a broader HHS effort to align drug discount programs with Medicaid spending integrity. With CMS taking tighter control over rural and community health funds, as KFF Health News recently detailed, 340B oversight issues are bleeding straight into Medicaid enforcement.
Duplicate Discounts: The Hardest Problem to “Explain Away”
Most 340B compliance teams can fix a recordkeeping lapse or contract pharmacy gap. Explaining a duplicate discount to HRSA and a state Medicaid office is different. The prohibition leaves no gray area. When a manufacturer shows that a 340B-eligible claim also received a Medicaid rebate, HRSA accepts the data. The result is usually a refund to the manufacturer and fresh scrutiny of the entity’s exclusion filings.
The problem usually starts in billing. A contract pharmacy might bill Medicaid under one NPI while the Exclusion File lists another. Once those claims hit the state rebate system, they’re flagged as rebate-eligible even though the drug was purchased at a 340B price. From there, the issue spirals, disputes with Medicaid, manufacturer outreach through data portals, and, eventually, HRSA asking how compliance controls failed.
Preventing this chain reaction means mapping every billing path. Centers must verify that carve-in or carve-out status is consistent across both fee-for-service and managed care. They need to reconcile TPAs’ Medicaid identifiers with the numbers HRSA displays in the 340B database. HRSA expects that review to be continuous, not just done at recertification.
Pharmacy Consolidation and the Strain on 340B Integrity
The 340B program doesn’t operate in isolation. As Drug Channels showed in its 2026 look at specialty and vertically integrated pharmacy networks, PBM-affiliated pharmacies now dominate dispensing. That dominance shapes how health centers manage compliance within contracted networks. When claims run through PBM-owned or health system-controlled pharmacies, entities lose visibility into which NPI was used for Medicaid billing. That is exactly what HRSA auditors are pressing this year: who billed Medicaid, which identifier was used, and whether it matches the Exclusion File.
Centers relying on large contract pharmacy networks face steep risk. If a PBM or chain quietly changes claim-level identifiers, exclusion filings can become inaccurate overnight. HRSA’s 2026 audit preps now ask how centers detect and correct those shifts. Covered entities need written checks to reconcile Exclusion File entries against current claims data every quarter, especially in integrated networks where ownership and identifiers keep changing.
Compliance Guides That Actually Work
The best 340B compliance plans aren’t binders, they live in the operations. A health center building one in 2026 must track data in real time. EHR prescriptions, pharmacy claim identifiers, and Medicaid billing numbers all have to connect. Changing a billing structure or carve-in status triggers an immediate review. HRSA looks for proof of proactive oversight, not after-the-fact cleanup.
Roles need clarity: who updates the Medicaid Exclusion File, who validates the TPA claim feed, who signs the attestation before recertification. Training the billing staff matters just as much. When claim edits or NPI changes happen without the compliance team, a single mistake can hit hundreds of Medicaid claims. HRSA labels that as a “control failure,” not a one-off.
One FQHC found in its own audit that a managed care plan was billing under a generic state-issued identifier not listed on the 340B Exclusion File. They caught and fixed it before HRSA noticed. That kind of documented correction likely spared them from a finding, and it’s how HRSA expects other centers to operate.
Writing a 2026 compliance guide means anticipating the next question: not “Was your file right?” but “How do you know it’s right now?” Entities that can show ongoing monitoring, monthly sampling, reconciliation reports, internal attestations, stand the best chance of avoiding findings. The 2026 audit cycle leaves no margin; accuracy in the Medicaid Exclusion File and strict duplicate discount prevention are baseline expectations.
Sources
- Backed by Threat of Clawbacks, Feds Wield Tight Grip on $50B Rural Health Fund (KFF Health News, 2026-06-16)
