Why 2025 Recertification Feels Different This Year
In 2024, HRSA terminated more than 60 covered entity parent sites and hundreds of child sites during recertification for incorrect parent IDs and expired authorizing official (AO) credentials. Most of those losses were avoidable with ten minutes of attention. HRSA wasn’t trying to punish anyone, it was enforcing the same rules it always has. The difference now is the tools: Apexus Connect and the 340B OPAIS interface are far less forgiving of bad data entry.
Recertification is HRSA’s annual “prove you still qualify” process for every covered entity. Each program must confirm its eligibility, contact information, and site details in the 340B OPAIS database. Hospitals go first, usually in late summer, followed by grantees such as FQHCs, Ryan White clinics, and hemophilia centers. HRSA uses the process to cleanse the public database. If any record fails to match perfectly across OPAIS, the authorizing official’s information, and supporting grant documentation, the 340B ID disappears overnight. No warning.
How to Recertify Without Losing Your IDs
Before the window opens, Apexus emails both the AO and the primary contact (PC). Only the AO can actually certify in OPAIS. Every year, programs lose eligibility because the AO left the organization or their contact information wasn’t updated. HRSA rejects generic addresses like compliance@clinic.org, it wants a named individual, spelled out in the 340B OPAIS Registration Instructions updated in December 2023.
When the window opens, the AO logs in to https://340bopais.hrsa.gov. If multi-factor authentication fails or the account has gone inactive, the fix requires an Apexus service ticket. Those take three to five business days, and if the window closes before the account is restored, termination is automatic. No extensions, no appeal.
Check every data field before you hit “Submit.” DUNS, address, grant number, DSH percentage, everything. HRSA cross-references each against SAM.gov and its internal grant systems. A one-character difference, even “Street” versus “St.,” counts as a mismatch. For hospitals, verify that your Disproportionate Share Adjustment Percentage (DSH%) still meets the threshold. If your latest Cost Report drops you below, HRSA will act on that data, not your assumptions. You don’t want to learn that midweek through an email notice.
After submission, OPAIS generates a confirmation number. Save it. HRSA occasionally asks for proof when its system fails to sync. I’ve seen that PDF save programs during termination appeals.
Common Data Errors That Still Trip Up Experienced Teams
I once helped a DSH hospital that lost three offsite child sites because the address on its state license renewal had a different suite number than the OPAIS listing. HRSA treated it as a “material change” under Policy Release 2019‑01. The pharmacy was the same, the patients were the same, but the result was six months without 340B pricing, roughly $280,000 lost on oncology drugs alone. HRSA’s process is mechanical: mismatched data is ineligible data.
Grantees tend to stumble in the Federal Grant Number field. HRSA expects the exact number active in its Electronic Handbooks (EHBs). When a project renews and the number changes, from H80CS12345 to H80CS24680, for instance, but OPAIS still shows the old one, termination follows fast. HRSA has eliminated entire FQHCs over this detail. The time to fix it is before recertification opens, not the day the email arrives.
Hospitals often get caught by corporate changes. If your Medicare Certification Number (CCN) changed because of a merger, your old 340B registration no longer exists under HRSA policy. The AO can’t recertify a terminated entity; it must re-register under the new CCN. HRSA made that point explicit in Policy Release 2017‑01. I’ve watched finance executives assume the tax ID controlled eligibility, it doesn’t. The CCN is king.
Before HRSA Opens the Portal: Your Prep Checklist
The strongest programs treat recertification as an internal compliance audit. By early summer, scrub every OPAIS record. Compare each data point to your pharmacy licenses, grant awards, and what appears on HRSA’s public site. Make sure AO and PC logins work. If you’ve changed pharmacies, split-billing vendors, or shipping addresses, handle it now. Once the portal opens, the record is locked until the window closes. No updates allowed mid-cycle.
Look closely at contract pharmacy details. Old NCPDP numbers or pharmacies removed due to manufacturer restrictions are land mines waiting to trigger terminations. HRSA won’t email for clarification, it will simply delete the pharmacy from your profile. With manufacturer restrictions from Lilly, Novo Nordisk, and AstraZeneca still in play, losing one contract pharmacy can cost a grantee hundreds of thousands of dollars. Clean now, relax later.
If your organization has multiple covered entities under one system, say, six child-site IDs under one parent, check each AO separately. HRSA requires one per parent entity. You can’t mass‑certify across IDs. Miss one and HRSA marks it as voluntarily terminated. It’s that binary.
Once Certified: Watching for Confirmation and Audit Triggers
After the window closes, HRSA runs its internal eligibility screen with outside data vendors. Entities that adjust core fields, child sites, grant numbers, CCNs, during recertification often show up on the next year’s audit list. Fair or not, that’s the new pattern. The process tightened after the 2023 OIG report criticized HRSA for weak verification.
Don’t vanish after clicking “Submit.” HRSA posts weekly lists of successfully recertified entities on the public database. Make sure your organization appears. If it doesn’t, contact Apexus Support within ten days. That’s the appeal window. Miss it, and you lose 340B access. Wholesalers will deny chargebacks automatically.
Auditors don’t ask who meant well, they ask who failed the process. Keep a simple internal checklist signed by the AO and PC and stored with audit documentation. HRSA doesn’t require it, but explaining a lost certification because of a password reset is not the conversation you want with your board. Look, no program is immune. Recertification isn’t complex, it’s just ruthless. Treat the numbers like audited financials. Every mismatch is a red flag waiting to become a termination letter. And that’s usually when my phone rings.