Specialty replenishment caught in the 2026 audit net
In late 2025, HRSA’s Office of Pharmacy Affairs quietly expanded its 340B audit scope to include specialty pharmacies after a string of findings tied to incorrect replenishment cycles for high-cost injectables. One HRSA auditor recounted a cancer center that used an accumulation methodology that “materially overstated eligible mixed-use units” for drugs like daratumumab and ustekinumab. The split-billing vendor discovered the variance months later, but by then diversion had been confirmed. That’s now the focal point of 2026 audits, split-billing accuracy inside specialty workflows.
The 340B statute hasn’t changed, but enforcement expectations absolutely have. HRSA’s 2026 audit protocols include deeper data-tracing between accumulation logs, dispensing records, and contract pharmacy claims for specialty inventory. If your site dispenses oral oncolytics through a contract pharmacy, HRSA expects your audit trail to fully reconcile purchase-to-patient dispensing. A “report from vendor” isn’t enough. Entities unable to produce timestamped documentation for each accumulation event are getting cited.
Where split-billing gets dangerous
The most common failure still comes from split-billing interfaces across EMRs, dispensing cabinets, and purchase systems. Specialty drugs are typically billed under buy-and-bill claims, so replenishment depends on flawless clinical data flow. When providers chart after the fact, or when encounters stretch across days, your accumulation logic can double count. In 2026, HRSA auditors are calling that “systemic diversion,” not a data hiccup.
One DSH hospital I worked with, a 40-chair infusion center, was cited because infliximab accumulations included same‑day returns processed as waste credits. They argued the drug never left 340B control, but HRSA used its 2026 checklist requiring “demonstrated patient administration verification.” Every dose had to be tied to a patient encounter in the EMR attributed to an eligible provider. They couldn’t meet that test. Their corrective action plan involved repayments and a suspension of 340B purchases for four NDCs until retraining was complete. Tough lesson.
The takeaway? If your split‑billing system doesn’t capture physician order timestamps, administration documentation, and reconciliation against WAC purchases in one report, you’re exposed. HRSA now expects those logs on demand, not weeks later.
Contract pharmacy oversight under 2026 HRSA expectations
Manufacturer restrictions have made oversight harder. As of 2026, more than 25 manufacturers still limit 340B pricing at contract pharmacies unless covered entities submit 340B ESP data. HRSA hasn’t reversed its position that those limits violate the statute, but covered entities still operate under them. That tension shows up in audits. HRSA wants documentation of how you handle outpatient drugs dispensed through restricted pharmacies, even when pricing access is blocked. You have to show exactly how you prevent ineligible accumulations and avoid using 340B inventory for restricted NDC claims.
For specialty products routed through manufacturer hubs, think cystic fibrosis or gene therapy treatments, contract pharmacy oversight overlaps with patient assistance workflows. HRSA now asks whether your accumulations exclude manufacturer copay card transactions. If they don’t, and those claims feed your split‑billing engine, you can look like you benefited twice: once from the manufacturer, once from 340B. That’s a violation under 42 U.S.C. § 256b(a)(5)(A). Two entities already had to unwind contract pharmacy accumulations in 2026 after exactly that. Once those findings move from education letters to clawbacks, you know the tone has changed.
What programs should be doing differently
The 2026 bar for “reasonable oversight” is much higher. A spreadsheet of quarterly samples isn’t evidence anymore. HRSA wants transaction‑level validation tied to live feeds from your pharmacy and split‑billing engine. Covered entities need to show line‑level links between every 340B replenishment, dispense log, prescriber credential, and care location. HRSA calls it “direct and auditable linkage.” If your compliance narrative leans on vendor attestations, you’re under that line.
Another chronic weakness: contract pharmacy performance monitoring. Too many entities sign blanket attestations from chains without checking claim‑level eligibility reports. HRSA now confirms whether entities reviewed the chain’s exclusion reports and sampled data quarterly. When denied or transferred prescriptions slip through unmonitored, inventory replenishment skews, and auditors start asking how you can claim internal control exists at all.
Developing a usable specialty replenishment guide
A solid internal compliance guide for specialty replenishment shouldn’t read like a policy manual. It needs to describe exactly how your program defines a valid accumulation event, which reports are validated, and what documentation auditors can expect to see. Frame it as if HRSA’s sitting next to your 340B coordinator. What patient‑level proof can they hand over? How soon after infusion are encounters reconciled? Who revalidates accumulations, and how often?
Take a biologic like omalizumab. Your guide should spell out that accumulation only occurs after the administration and pharmacist verification are documented in the split‑billing queue. The coordinator should pull random samples weekly, five encounters minimum, checking that administered dose, charge code, and accumulation record align. Those data points demonstrate live oversight. HRSA’s latest reports call “documented routine oversight” a mitigating factor, so you can’t just declare compliance, you have to prove it.
Include manufacturer restriction logic too. Document how your site blocks accumulation for restricted NDCs at contract pharmacies, even when ESP submissions are pending. HRSA has told multiple entities in 2026 that ignoring manufacturer restriction files equals oversight failure. That’s new, and real. Your policy should reference the vendor’s restriction list or the manual exception report your staff reviews monthly. No guesswork.
What auditors are really testing
From the 2026 audits I’ve seen up close, three themes repeat: traceability of data, validation of patient qualification, and documentation of contract pharmacy oversight. If any one of those crumbles, the finding becomes “systemic failure.” That designation triggers a full corrective action plan and referral to OIG for follow‑up. And once you’re on that list, well, you’ll see another audit. Guaranteed.
Building a 340B compliance guide for specialty replenishment isn’t paperwork, it’s your defense plan. HRSA’s standards in 2026 are the highest they’ve ever been, and only the entities whose data reflect their written policy are staying clean in audits. The rest keep refunding money and chasing fixes long after the auditor’s gone.