When HRSA Shows Up, It’s Too Late to Fix Eligibility
Late last year, a federally qualified health center (FQHC) focused on women’s health in the Midwest went through a 340B audit that didn’t end well. HRSA found that nearly 12% of the clinic’s 340B claims were ineligible because the providers were “off roster”, temporary locums who hadn’t been linked to the clinic’s HRSA-registered site in the OPAIS database. The clinic hadn’t refreshed provider files since early 2025. The issue wasn’t intent; it was stale data. HRSA’s 2026 audit teams have been relentless about eligibility mapping, especially at grantees like Title X clinics and FQHC look-alikes, which depend heavily on contract providers and telehealth encounters.
This year, HRSA audits lean on what reviewers call “encounter tracing.” They verify that patient, provider, and location all match a covered entity record for a specific date and dispensing event. Women’s health clinics are under the microscope because care is episodic, prenatal check-ins, telehealth consults, offsite ultrasounds. Each encounter must stand alone to prove eligibility, even if it belongs to a single episode of care.
Prescription Origination Is the Weakest Link
Too many clinics still treat prescription origination as a binary check: did a covered entity provider write the prescription? HRSA’s 2026 model digs deeper. It asks whether the drug was prescribed as part of services delivered by the covered entity. If a nurse practitioner modifies a contraceptive plan during an outreach clinic but the patient’s ongoing care belongs to a private OB office, that claim fails the test.
Here’s where women’s health programs get tangled. A patient gets a Depo-Provera injection through a Family Planning grant, then fills oral contraceptives at a contract pharmacy two weeks later. Unless the follow-up prescription is documented as tied to that same clinic encounter or grant, HRSA sees it as ineligible. In early 2026 audits, reviewers went back through two months of encounter notes per patient to confirm the linkage, catching omissions that older TPAs had glossed over. Brutal, but accurate.
The cure isn’t fancy software, it’s disciplined documentation. Every provider delivering reproductive or prenatal care under a 340B grant needs encounter-level proof that the service and prescription belong together. Clinics still running policy language from before 2025 are skating on thin ice. HRSA has made it clear that historical definitions aren’t acceptable in a 2026 review.
Watch Contract Pharmacy Claims, They’re Still the Audit Trap
Contract pharmacy use remains the most volatile compliance risk for women’s health programs. HRSA keeps pressing the same point: can the entity prove it, not the pharmacy, determined eligibility? Many clinics rely on PBM or TPA data feeds that arrive incomplete or late. Combine that with the trend Drug Channels flagged in May 2026, major PBM-linked pharmacies tightening their networks under formulary and reimbursement stress, and your risk multiplies (Drug Channels News Roundup, Mid-May 2026).
When CVS Caremark, Express Scripts, and Optum Rx process most retail scripts, that means most of your 340B-eligible prescriptions flow through their systems, each with its own data rules and NDC substitutions. If a pharmacy auto-switches an NDC or sources from a warehouse outside your 340B inventory chain, your replenishment file is ruined. HRSA doesn’t accept “the pharmacy changed it” as a defense. Auditors want proactive review, dispense-level NDC checks, payer validation, and reversal timing reconciled before build-up files move through your splitter.
Too often, women’s health grantees hand off contract pharmacy oversight to a wholesaler or TPA without verifying how duplicate discount scrubbing actually works at the PBM level. HRSA flagged this in Q1 2026 as a recurring deficiency. When Medicaid managed care claims aren’t segregated properly by BIN/PCN, you’ve got duplicate discounts, plain and simple. HRSA has already required repayment of full savings, even when the error rate was under 1%. Harsh? Maybe. But predictable.
Building a Compliance Guide That Actually Works in 2026
Writing a compliance manual now isn’t box-checking. HRSA asks for the timestamp on every policy and who signed off. If a document cites “patient definition per 2015 guidance,” it’s a red flag before page two. A current women’s health 340B guide must distinguish between grant-funded services, offsite care models, and contract pharmacy operations. Each behaves differently under audit.
Here’s the backbone every clinic should have:
- Eligibility verification: Run monthly provider roster checks tied to active HRSA registrations and grant scopes.
- Prescription origination tracking: Link every covered prescription to a service encounter ID and service type reference.
- Contract pharmacy review: Sample dispense data quarterly for duplicate discount and NDC alignment risk.
- Audit readiness: Archive encounter, prescription, and dispensing proof for at least five years, organized, searchable, complete.
Perfect compliance isn’t the goal. Demonstrated self-correction is. HRSA consistently goes easier on programs that discover and fix issues before audit. That means your compliance guide must specify who runs internal reports and when. Not “the team.” Actual names, job titles, dates.
Women’s health entities juggling telehealth, pharmacy networks, and temp clinicians dominate HRSA’s 2026 audit queue. That’s reality. The current cycle is targeting any entity that grew its contract pharmacy footprint after 2022, a broad net. With independent pharmacies closing and PBMs still consolidating dispensing channels, anyone hoping for lighter oversight isn’t reading the room. Look, the best programs I’ve seen treat eligibility and claim origin as a joint ownership exercise, compliance, clinical, and IT speaking the same data language. That’s the only way this works.
