Where HRSA Is Looking Hardest in 2026
In early 2026, several FQHCs received HRSA audit notices that looked routine on paper but went deep into source documentation. Auditors wanted to see how each site verified 340B eligibility for every prescriber‑patient encounter and whether Medicaid prescriptions were clearly flagged in both the EHR and the pharmacy management system. HRSA’s Office of Pharmacy Affairs has said eligibility documentation and Medicaid billing practices remain the two most consistent failure points among community health centers.
That’s not surprising. FQHCs operate on razor‑thin margins, serving high‑Medicaid populations, and their 340B savings are critical. But HRSA’s 2026 audit protocols are no longer just about policy binders and sample logs, they trace prescriptions back to clinical notes and billing data. Any mismatch between a prescriber’s employment status, the clinic site’s HRSA registration, or the patient’s documented visit can be called a diversion. What passed as “reasonable” documentation a few years ago now collapses under current scrutiny. And it’s not theoretical, entities are losing eligibility findings for a single inconsistent record.
One Midwestern FQHC said HRSA auditors spent almost half a day requesting screenshots proving the prescriber was credentialed and physically located at a 340B‑registered site at the time of the encounter. The review team compared those timestamps against pharmacy fills to confirm no cross‑state Medicaid boundaries that might trigger a duplicate discount. One orphaned prescription, one finding. That fast.
Eligibility Documentation: Build a Record That Survives an Audit
Every compliance guide now centers on documentation that is both auditable and reproducible. “Auditable” means anyone outside your organization can reconstruct your eligibility logic from chart data and authorization lists. “Reproducible” means the rules hold across all clinical sites, even when data flows from different EHR instances or delegated service providers, a consistency HRSA is actively checking for in 2026.
For FQHCs, prescriber eligibility must tie to an active HRSA‑registered site, the encounter must reflect services from your covered entity, and the patient relationship must be clear in the visit record itself. HRSA is done accepting spreadsheets as proof. The smarter move: generate eligibility flags automatically within the EHR and push them through your dispensing feed to your 340B administrator’s matching software. That creates an electronic “paper trail” matching HRSA’s data request template without manual editing or post‑hoc fixes.
If your organization uses telehealth extension sites or rotates staff, make sure each site appears as an active child record in the HRSA database. More findings now stem from care delivered at unlisted telehealth or mobile units. HRSA treats those prescriptions as out‑of‑scope unless they are explicitly included in the covered entity’s registered profile. It’s a tedious administrative step, but skip it and your audit results will sting.
Medicaid Billing and the 340B Duplicate Discount Trap
Medicaid billing remains the murkiest pitfall because state carve‑in and carve‑out rules keep shifting. Some states have added 340B carve‑outs for managed Medicaid under Section 1927(k) interpretations that differ from HRSA’s own position. Covered entities still carry the compliance risk. HRSA auditors pull claim‑level data and match it against manufacturer rebate files, and when those datasets overlap, a duplicate‑discount allegation is almost guaranteed.
In 2026, HRSA’s stance is clear: marking “carve‑out” on your 340B database profile doesn’t clear you. You need documentation, state‑specific carve‑in authorizations or exemption letters, on file and current. A single missed update when a state changes policy can invalidate hundreds of claims. Many programs now maintain real‑time reconciliation tools that align HRSA’s Medicaid exclusion file, state MMIS billing logic, and the FQHC’s claim exports each quarter. It’s not optional housekeeping anymore; it’s survival.
Analysts writing in Health Affairs note that Medicaid spending keeps climbing in 2026, driven by higher premiums and dual‑eligible utilization cascades. State agencies want rebate revenue back, fast, and they’re enforcing aggressively. So FQHCs have to engineer billing logic that stops any unintentional 340B tagging if the state system defaults to carve‑in during backend processing. Look, if you’re still depending on manual override codes, it’s time to modernize.
Contract Pharmacy Inventory: When Data Meets Reality
The real shift for FQHCs in 2026 is HRSA’s revived attention to contract pharmacy inventory control. After explosive growth, the network has leveled off. The 2026 Drug Channels Institute review calls it “a maturing industry dominated by big chains and PBMs.” Fewer partners now, but greater scrutiny. HRSA auditors are cross‑referencing wholesaler purchase data with dispensing claims from contract pharmacies. Any gap in replenishment timing or NDC substitution without a clear match logic sets off alarms.
Most FQHCs with multiple contract pharmacies rely on virtual inventory managed by third‑party administrators. These systems reconcile 340B and non‑340B inventory after the fact, something HRSA isn’t comfortable with anymore. The 2026 audit teams want proof that your software generates real‑time reports linking purchased inventory to eligible dispenses, no human edits required. If it can’t, they’ll cite a material weakness even if actual diversion isn’t found.
One of the cleaner mitigation steps: sync replenishment data weekly instead of monthly and require contract pharmacy partners to produce “dispense‑level match” audits that align with your TPA logs. Never just take your vendor’s word that everything balances. Pull your own extracts. When a contract pharmacy changes wholesalers or enters a PBM network, verify that its purchasing structure still complies with 340B GPO prohibition rules. It’s an easy oversight, and one HRSA keeps flagging.
FQHCs with limited IT staff can rely on regional HRSA grantees or state primary care associations to periodically test contract pharmacy data. That matters most if manufacturer restrictions or ESP submission errors interrupt replenishment feeds. The worst audit outcomes this year aren’t about dispensing errors; they’re about missing data. HRSA tests whether you control your program, not whether you have good vendors. Big difference.
