Why outpatient surgery centers are suddenly in the 340B spotlight
When HRSA released its 2026 audit summary this spring, most covered entities zeroed in on the new diversion and duplicate discount metrics. Buried in the appendix, though, was one short line: “Ambulatory surgical departments will be subject to expanded sampling.” That sentence flipped the script for hospital-based surgery centers. HRSA is no longer treating these departments as side clinics; they’re now being audited as standalone outpatient locations. That means separate data trails for patient eligibility, prescriber credentials, and replenishment logic, no shortcuts, no implied relationships.
I saw it play out in February during a Texas DSH hospital audit. The HRSA auditor spent three hours on cataract surgery fills alone. The issue wasn’t diversion, it was documentation. The ophthalmologist was legitimate staff, but his credential file hadn’t been updated, so he wasn’t on the hospital’s current 340B-eligible prescriber list. HRSA didn’t budge. The rule stands: every prescriber must be employed or contracted, and their services must be documented as outpatient hospital services. That small clerical lapse triggered $152,000 in repayments across just three NDCs. Costly lesson, and one that’s happening a lot right now.
Defining eligible use inside outpatient procedural departments
Under HRSA’s 2025 guidance, surgical departments qualify as “child sites” only if they appear on the hospital’s latest Medicare cost report and are reimbursed as outpatient cost centers. Documentation has to be airtight: every 340B-eligible encounter must generate an order or prescription from the cost-reported location, and the patient must have a documented clinical relationship with the entity. In 2026, auditors are requesting actual patient chart extracts, not summaries or attestations.
Outpatient surgery complicates those definitions. Orders for perioperative drugs, cefazolin, ophthalmic preps, local anesthetics, often straddle the pre- and post-op windows. That timing mismatch makes eligibility confusing. Covered entities have two defensible paths. One is a virtual inventory model that restricts 340B replenishment to documented, eligible encounters. The other is to exclude surgical meds entirely unless the EHR explicitly ties prescribing to the cost-report department. Either way, documentation must hold up on its own. HRSA won’t accept “clinic-level” attestations if traceability fails.
When your OR, pharmacy, and EPIC can’t agree
Inventory segmentation is where most surgery centers stumble. Hospital-owned ASCs share central pharmacies but draw from OmniCell or Pyxis machines servicing both 340B and non-340B patients. Split billing software only works if charge capture and NDC mapping are exact. Too often, perioperative drugs are billed by procedure code rather than NDC. In that case, program managers end up using cost-account averages, numbers HRSA will not accept as auditable proof. I’ve watched programs drift into diversion risk simply because anesthesia switched to a generic vial not mapped to the outpatient formulary.
The solution isn’t flashy. Reconcile EMR and split-billing data every week. Track each drug from OR to chart using NDC-level data and actual quantities. If you can’t trace it to a patient chart in the pharmacy system, don’t count it 340B. These centers generate staggering charge volume, yet it means nothing if your replenishment trace breaks under audit. The 2026 reports were blunt: untraceable replenishment equals noncompliance, period.
Also, don’t get lulled by wholesaler account segregation. Manufacturers like Johnson & Johnson and Novartis have been comparing ESP submissions from ASCs against purchase-level data. When “site ambiguity” pops up in ESP, smaller centers lose access first. And when your surgical kits depend on uninterrupted product flow, loss of access isn’t theoretical, it’s immediate.
Contract pharmacy integration: staying off the diversion radar
Contract pharmacies are another compliance tripwire for outpatient surgery centers. HRSA continues to allow entities to fill post-op and discharge scripts via contract pharmacy if there’s a valid relationship and proper record linkage. The 2025 OPA FAQ update clarified that those postoperative prescriptions remain 340B-eligible if tied to a covered outpatient department on the Medicare cost report. But manufacturer audits through ESP are now flagging “post-discharge” scripts aggressively.
Picture an ophthalmology ASC sending patients’ eye-drop scripts to a Walgreens contract pharmacy. If that prescriber’s NPI isn’t linked to the covered entity in HRSA’s database, or if the fill looks like a retail transaction detached from the ASC visit, it can trigger data restrictions. The real fix? Attribution. Each surgery order must be digitally tied to its originating visit. Macro Helix, Sentry, these integrators can do it. The problem is too many sites still rely on prescribing dates alone. HRSA’s 2026 audits are testing whether the data extract shows continuous clinical oversight, not just an isolated script.
Some ASCs have gone a different route: building small same-day discharge windows inside the main hospital pharmacy and skipping retail contracts entirely. Cleaner, yes, but it requires state board approval and additional 340B OPAIS registration. Even under a shared pharmacy license, HRSA expects each dispensing point listed. Skip that step, and you’re looking at an “unregistered dispensing site” finding. Happens more than most will admit.
In 2026, audits aren’t about errors, they’re about proof
HRSA’s 2026 audits have doubled encounter-level verifications compared to two years ago. Auditors are matching NDC queries against wholesalers and ESP data in real time. So a “compliance plan” can’t live in a binder, it needs to live in your systems: workflow maps, prescriber rosters, inventory transfer forms, ESP logs, self-audit checklists.
The era of “complex workflow” excuses is over. HRSA demands primary-source proof. If a coordinator can’t produce a patient chart, prescribing record, and charge detail for each drug in the 340B replenishment queue, that’s diversion. And yes, auditors are writing it that way. Look, building compliance in ASCs isn’t paperwork, it’s engineering. The ones that survive 2026 audits will treat 340B compliance the same way they treat surgery itself: precise, documented, verifiable, and never left to chance.