When HRSA Shows Up and the NPI Doesn’t Match
Late in 2024, one large DSH hospital in the Midwest failed its HRSA audit because a cardiology clinic billed 340B drugs for Medicaid patients even though the clinic’s NPI wasn’t on the hospital’s most recent Medicare cost report. The clinic used the hospital’s NPI on claims but wasn’t separately registered as a 340B child site. HRSA called it diversion and duplicate discount risk. Result: $1.8 million repaid to state Medicaid. That sort of finding used to be unusual. In 2025, auditors will begin their reviews exactly there.
Hospitals have spent years trying to capture more 340B volume through off-campus provider-based sites. The Affordable Care Act’s expansion of eligible outpatient departments made it possible, but HRSA never clarified how off-campus sites fit into the child site registration rule. The March 2024 Program Notice ended the ambiguity. It stated plainly that any location without an active child site registration in the 340B OPA database can’t generate eligible encounters, even if it bills under the hospital’s NPI. Beginning fiscal year 2025, auditors will check that registration before allowing 340B pricing on any drug dispensed there. Simple as that.
Child Site Registration Goes Real-Time
For years, hospitals gamed timing: a new clinic opened in January, the cost report came out in July, they’d wait until October’s registration window and then retroactively tag it as 340B. HRSA let that slide if they could show the site would eventually appear on the cost report. That’s over. HRSA’s 2025 enforcement memo tells entities to align operational 340B activity with OPAIS registration in real time. If the child site isn’t on the public OPA database, those prescriptions aren’t 340B. Full stop.
This creates a real coordination challenge between finance and pharmacy. Historically, pharmacy leaders didn’t see cost report drafts until after CMS filing. Now that delay is a compliance risk. You can’t register the site until it’s shown as reimbursable on Worksheet A, so finance must project clinic lines earlier and tie them to the proper cost center. Otherwise, 340B savings are on hold until the next window opens. HRSA hasn’t offered any grace period. Auditors have also started asking hospitals to maintain internal mapping between cost report line, internal location code, and NPI, a new document request first seen in late 2024.
I worked with one children’s hospital that opened an off-campus behavioral health site staffed by employed psychiatrists. They treated Medicaid patients and dispensed psych meds through a contract pharmacy, assuming they were covered. They weren’t. The clinic’s NPI wasn’t linked to a registered child site. That quarter, they booked $280,000 in 340B margin. They’ll pay every dollar back unless they self-disclose. Finance assumed “main campus” coverage because the doctors were credentialed there; pharmacy assumed HRSA didn’t track behavioral health closely. Both assumptions failed impressively.
When Medicaid Carve-In Gets Teeth
The other half of HRSA’s 2025 enforcement targets Medicaid duplicate discount prevention. Covered entities once listed carve-in status at the parent level, with HRSA asking only for the hospital’s billing number. States pushed back, insisting HRSA require site-level alignment. HRSA agreed. Starting January 1, 2025, every child site record must include the NPIs or Medicaid billing identifiers used for that clinic. If a site buys 340B drugs for Medicaid patients, its identifiers must match on both HRSA’s exclusion file and the state’s file. No match, no carve-in.
The compliance lift is heavy. Some systems run 60-80 off-campus clinics, each with its own NPI. Pharmacy IT now has to maintain crosswalk tables ensuring that every 340B claim uses a correctly registered and carved-in NPI. Miss that link, and you’re looking at a duplicate discount finding. HRSA’s contractors, Bizzell and Myers and Stauffer, are now pulling state duplicate discount reports and comparing them to OPAIS data. They’ll issue findings even without a proven duplicate claim. The burden of proof has flipped from “show a violation” to “prove you prevented one.”
Hospital compliance teams aren’t thrilled, but state Medicaid programs demanded this after OIG’s 2023 report found mismatches between HRSA’s carve-in list and state identifiers in five states. Manufacturers seized on those gaps to argue the 340B program lacked control. HRSA had to tighten the screws. Expect auditors to require a year of claim-level matching proof per child site. Fail to produce it, and you’ll still get cited, even if your accumulation logic was otherwise tight. That’s how 2025 enforcement looks in practice.
What Covered Entities Should Actually Do
The successful 340B programs in 2025 treat site registration like credentialing, no clinic launches until it’s verified. Pharmacy, finance, and billing need standing meetings (monthly, minimum) to align new provider-based departments, crosswalk cost report lines, and confirm NPIs before any 340B prescription is filled. Waiting for the registration window costs months of savings; registering too soon risks a false attestation. There’s no perfect formula. But strong documentation and clear controls are the only real defense.
Carve-in compliance deserves the same rigor. Multi-state systems using shared Epic environments must route Medicaid accumulations using registered identifiers, not just encounter locations. HRSA doesn’t accept “our billing vendor couldn’t separate NPIs.” Their expectation is precise mapping that blocks duplicates before claims hit Medicaid.
One practical step: ask your pharmacy split-billing vendor to show its validation rules. Most systems still check only the parent 340B ID when flagging carve-in status. That won’t survive audit after January 2025. You need the software catching mismatches between child site carve status and Medicaid NPIs before accumulations occur. Because once those claims drop, you’re out of luck. HRSA seldom allows reclassification later.
And look, entities betting HRSA won’t enforce are repeating the 2012 mistake. Everyone ignored contract pharmacy diversion until the audits landed. This time, the red flags are undeniable. The 2025 verification process and Medicaid coordination checks are already embedded in HRSA’s audit scripts. Hospitals with big off-campus footprints, especially those under manufacturer restrictions, can’t afford sloppy data. HRSA’s tolerance is gone. They’ve heard every excuse.