When HRSA showed up unannounced at a Midwest oncology infusion center this spring, the audit didn’t start with diversion or duplicate discounts. It opened with documentation, who administered what, when, and under which prescriber’s order. The first question was blunt: “Show me the note proving this drug was administered during a billable encounter.” That moment sums up the 2026 compliance climate for 340B oncology programs. HRSA’s focus is now squarely on documentation completeness, claim traceability, and contract pharmacy reconciliation, the connective tissue of compliance.
HRSA’s 2026 Audit Shifts: Administration Notes Are Ground Zero
Infusion centers have always lived under documentation pressure. But this year, those administration notes are the gatekeepers for 340B eligibility. HRSA’s 2026 auditors are using granular sampling, matching J-codes on the UB-04 to exact infusion times in the EHR. If the record doesn’t clearly tie to a qualified prescriber within the covered entity’s scope, it’s ineligible, even when the patient meets every other condition. One large DSH hospital in Ohio reported that almost 10% of its sampled claims were flagged because of incomplete timestamps and missing nurse signoffs. An unforced error. Not diversion. Just documentation gaps.
Any compliance guide for oncology infusion now needs a chapter devoted to documentation fidelity. Pharmacy staff must be able to retrieve an administration note showing drug, lot, date and time, administering RN, ordering provider, and linkage to the encounter. If the EHR’s medication administration record lives in a separate module from billing, that’s a compliance red flag. HRSA expects a direct and verifiable relationship between the charge, the chart, and the prescriber listed on the eligible location file, and they test for it aggressively.
Aligning Billing and EHR Data to Prevent Diversion Findings
The hardest audit findings this year haven’t come from diversion, but from billing misalignment. HRSA has invalidated claims where infusion work was logged under one cost center but billed under another. That alone can break the “eligible patient” connection under 340B rules. This scenario hits oncology programs that move infusion nurses between hospital- and provider-based sites, where the chargemaster setup can’t keep pace. One health system learned the lesson the hard way when HRSA tossed a dozen bevacizumab claims from 2026 because billing tagged them to a non-reimbursable satellite clinic that hadn’t been added to OPAIS in time.
A functional compliance program can’t treat this as a billing issue to fix later. It needs built-in crosswalks linking NDC-level charge data to encounter-level EHR metadata. If finance says, “We just pull J-codes,” that’s insufficient. The entity must show pharmacy and billing integration down to NDC, lot, and provider NPI, each matched to a billable visit. HRSA doesn’t dictate how to build that link, but they expect one to exist. In reality, it means pharmacy coordinators, compliance technicians, and billing analysts in a room every month reviewing reconciliation exceptions before HRSA ever sees them. The entities doing that routinely are the ones passing audits.
The Quiet 2026 Time Bomb: Contract Pharmacy Claim Matching
While infusion documentation is the visible challenge, contract pharmacy validation is the quiet threat no one wants to talk about. According to Drug Channels’ 2026 analysis of the 340B contract pharmacy market, national chains and PBMs now dominate dispensing, leaving smaller covered entities with limited access to claim-level data. That’s why oncology programs, even those with clean infusion records, keep taking hits during audits. Their oral oncolytics, supportive drugs, and refill cycles flow through PBM-owned networks with inconsistent identifiers, failing HRSA’s patient relationship standard when the encounter link isn’t airtight.
Auditors now spot a familiar scene: an oncologist writes lenalidomide under a 340B-eligible encounter, but the EHR wasn’t coded correctly, or the pharmacy data came back truncated. Without a full match between dispensing data and encounter notes showing care from an eligible prescriber, HRSA calls the claim ineligible. It’s not fraud. Just incomplete proof, and still a repayment liability.
Covered entities are countering with encounter-verification tools built around switch data and EMR scheduling feeds. It isn’t expensive technology. It’s data consistency and ownership. The contract pharmacy world may be “maturing,” as Drug Channels put it, but consolidation under PBM control has raised the documentation bar. Data sharing remains patchy, and HRSA isn’t cutting slack in 2026. If the patient relationship can’t be proven in the record, the benefit doesn’t apply. Simple as that. Harsh, but entirely predictable.
Building a Guide That Actually Survives an Audit
A usable compliance guide for oncology infusion centers in 2026 can’t just quote HRSA’s rulebook. It has to translate those expectations into real internal accountability. Every focus area needs an owner. Clinical staff own infusion note completeness. Billing owns cost center accuracy. Pharmacy owns NDC reconciliation. Compliance leads internal audits, and does them in HRSA’s sample format before the agency does.
One children’s hospital took that idea seriously and built an internal dashboard that mimics HRSA’s sampling: 15-20 encounter-level checks each quarter, comparing MAR timestamps, NDCs, and prescriber NPIs across infusion and contract pharmacy claims. When discrepancies pop up, they retrain fast, usually within a week. That responsiveness is what HRSA is rewarding now. It’s visible accountability, not just documentation hygiene.
Billing alignment matters because each invalidated claim erases real money. Oncology drugs cost thousands per vial, and losing even a handful to eligibility errors can wipe out margins for an entire quarter. HRSA knows that, too. They don’t care about how thick your policy binder is; they care about what shows up in your system of record. Contract pharmacy oversight, meanwhile, demands persistence more than technology. When the Drug Channels Institute said the market is PBM-dominated, that wasn’t theory, it’s the day-to-day landscape that covered entities now navigate blindfolded. Look, no compliance officer enjoys reconciling those data holes, but it’s the only defense HRSA recognizes.
If your documentation can’t withstand the same test HRSA will apply, down to prescriber linkage, timestamp, NDC, and encounter identifier, it’s not eligible. That’s the rule. Oncology infusion programs carry legitimate complexity, with multi-day regimens and shared prescribers, but HRSA’s 2026 audits have zero appetite for gray zones. The only strategy that survives is one built on verifiable data flow from administration through billing and replenishment. Build your guide around that truth, and the next audit becomes a demonstration, not a scramble.
