When a missed exclusion sets off an audit nightmare
HRSA auditors rarely arrive assuming bad intent. The usual spark is much simpler, paperwork that doesn’t line up. Differences between the 340B database, a state’s Medicaid carve‑in file, and actual drug claims can trigger a duplicate discount finding on their own. It’s not an abstract risk; duplicate discounts remain one of the hot spots that analysts such as Adam Fein at Drug Channels Institute continue to flag in the 340B space. Both manufacturers and state Medicaid agencies have reason to watch for them. If a manufacturer grants a 340B discount and the state also collects a Medicaid rebate on the same drug, federal law requires payback. HRSA’s role is to keep that double dip from happening in the first place.
By mid‑2026, compliance expectations have become more defined. HRSA treats duplicate‑discount prevention as a joint responsibility shared by covered entities and state Medicaid programs. Each entity’s declared carve‑in or carve‑out status for Medicaid fee‑for‑service prescriptions now anchors any audit defense. When that designation falls out of sync across systems, or when a contract pharmacy bills Medicaid under the wrong identifiers, HRSA tends to issue repayment orders fast.
HRSA’s view of Medicaid overlap
Under HRSA’s definition, a duplicate discount occurs whenever a manufacturer extends a 340B price while a Medicaid rebate is also claimed on that same drug. “Medicaid” stretches wide here, covering both fee‑for‑service claims and, in some states, managed care encounters. Covered entities have to identify how their 340B drugs are billed to Medicaid and list the proper identifiers. Carve‑out means none of the 340B claims are sent for rebates. Carve‑in means every billing number is registered with the state so that exclusion flags block rebate requests.
That setup doesn’t stay constant. Some states update claim formats midyear, and HRSA expects the Office of Pharmacy Affairs database to be adjusted in real time. During an audit, mismatched entries usually mean HRSA assumes an overlap occurred. In practice, intent matters less than whether the documentation lines up. And in a marketplace that Drug Channels Institute describes as data‑heavy and consolidated, where a handful of large pharmacy chains and PBMs handle most contract pharmacy claims, a configuration error in one master file can ripple through dozens of partner sites.
Internal records HRSA wants on hand
Each 340B site is required to keep records showing how its Medicaid status actually functions. Carved‑in sites must show prescription‑level data: the Medicaid payer flag, prescriber link supporting eligibility, and accumulation logic proving carve‑in use. Carved‑out sites need the reverse, proof that their system blocked any 340B drug from being billed to Medicaid. Auditors then test those records against clearinghouse data and the carve status listed in HRSA’s database.
HRSA doesn’t dictate a single record format but expects proof of control. Typical practice involves organizing by NPI or Medicaid BIN/PCN identifiers accepted by the state. When mistakes surface, entities are expected to self‑disclose and reverse the 340B pricing on those claims. Skipping that step risks long‑running repayment demands. The agency’s stricter stance reflects how the program’s scale and economics have drifted from its original intent. As the industry matured, the oversight gap became obvious, and HRSA tightened its expectations accordingly.
Contract pharmacies, PBMs, and the risk in between
Drug Channels’ ongoing reviews show that by 2026, about two‑thirds of U.S. pharmacies are tied to 340B contract arrangements, mostly through large chains and PBMs. That consolidation multiplies the number of billing identifiers and the chance for conflict with state programs. More intermediaries mean more overlap points. HRSA audits therefore look beyond the covered entity’s internal systems to examine how contractors manage their own controls. If Medicaid claims pass through multiple third‑party processors without clear exclusion logic, the risk of non‑compliance is almost guaranteed.
Entities embedded in these networks have begun re‑checking Medicaid exclusions every quarter, comparing internal accumulators with state rebate files. They also know manufacturers and PBMs monitor claims directly. A carve‑in claim missing a state indicator doesn’t just draw HRSA’s notice, it becomes evidence in arguments that 340B’s compliance framework can’t keep up with its size. In Drug Channels’ June 12, 2026, webinar, that concern stood front and center, with duplicate‑discount monitoring now seen as a key measure of whether the program earns policy credibility.
Compliance today
Preventing overlaps is no longer a yearly checkbox. It’s constant data upkeep. HRSA now expects covered entities to know exactly where each 340B claim lands within state rebate systems for both fee‑for‑service and managed care. Each must document routing, proof of updates to the HRSA database, and reconciliation steps. During audits, HRSA uses a “reasonable assurance” test: if a site’s process control looks consistent and the carve‑in data match, small errors get a pass. If anything’s missing, the agency assumes a duplicate discount until shown otherwise.
No software can stand in for policy documentation. Entities need three clear evidence layers: HRSA carve certification, internal claim logs, and confirmation that the state Medicaid agency was kept informed. The stakes are rising. As manufacturers and PBMs dominate 340B networks, even small overlap patterns can trigger repayment demands that reach across multiple partners. Whether a hospital is rural or part of a large system, the rule is identical, prove that a single drug never earned both a discount and a rebate. That’s the expectation now, and HRSA enforces it hard.
