Shortages, Substitutions, and a HRSA Audit That Got Ugly
This winter, HRSA auditors hit a disproportionate number of health centers over something most pharmacy teams assumed was harmless: switching National Drug Codes during shortages. In January 2026, one Midwest FQHC lost 340B eligibility for nearly six months after its contract pharmacy auto-substituted a different NDC of a cephalosporin antibiotic that was unavailable. Their split-billing software treated the dispense as if it were the same NDC, assuming therapeutic equivalence was acceptable. HRSA didn’t see it that way. The patient encounter qualified, but the replacement product didn’t match the NDC from the purchase order, so every dispensed prescription tied to that alternate NDC was flagged as diversion.
Drug shortages have always frustrated 340B operators, but what’s changed in 2026 is HRSA’s formalized focus on how entities handle substitutions, especially through contract pharmacy arrangements. HRSA added substitution validation checks to its auditor training materials in late 2025 after OIG reviews found hospitals and FQHCs documenting “shortage equivalents” with weak data trails. The new tone? Shortage doesn’t excuse noncompliance.
What HRSA Auditors Want to See in 2026
The 2025-2026 audit protocol now spells out NDC alignment for every 340B purchase, including substitutions. Covered entities must demonstrate that each 340B-dispensed unit matches the NDC from the purchase record. For contract pharmacies, that means your TPA system can’t rely on therapeutic mapping or equivalence logic. The NDC on the claim, the invoice, and the HRSA report have to match. No exceptions.
When a shortage is cited as justification for substitution, auditors now request five core data elements:
- Proof of an FDA-listed or wholesaler-confirmed shortage period
- Documented internal approval of the substitution process (policy excerpt or PIC memo)
- Purchase and invoice records identifying the actual NDCs received
- Claim-level transaction data showing both the intended and dispensed products
- TPA-produced reconciliation reports validating 340B replenishment matches
If even one piece is missing, HRSA tends to classify the substitution as diversion, no matter how equivalent the products seem clinically. The logic is simple: the statute ties 340B eligibility to the purchased NDC, not the therapeutic class. If the entity didn’t buy it, it can’t claim it.
The Trap of “Equivalent” NDCs in Contract Pharmacy Land
Trouble usually starts once the claim moves beyond the entity’s direct dispensing. Contract pharmacies juggle mixed inventories and rotating products, and wholesaler lines change constantly. Older TPA software can’t always identify which NDC was actually used, especially if POS data mapping isn’t airtight. If your vendor still uses “same GCN = same NDC” logic, you’re living dangerously. HRSA auditors are now cross-verifying claims through ESP submissions and wholesaler invoices, and mismatches appear instantly.
Manufacturers aren’t making this smoother. Companies like Lilly, Novartis, and AstraZeneca began verifying stricter NDC identification through the ESP portal in 2025. If a claim file contains imprecise or “equivalent” NDCs, expect rejection or replenishment delay. Those inaccuracies often resurface in HRSA audits months later, particularly where substitution templates don’t tie back to the actual NDC purchased.
One Georgia hospital learned the hard way in late 2025. Their contract pharmacy dispensed 250 mg ciprofloxacin tablets from one NDC but replenished with another manufacturer’s version. Same strength, both FDA-approved, both in shortage, yet HRSA flagged 312 of 1,570 scripts as diversion. The entity had to refund $41,000 for a product nobody could consistently source. Brutal example, but typical of this season.
How to Stay Clean Before HRSA Comes Calling
There’s no workaround for NDC-matching. Either you can prove it or you can’t. But you can head off most substitution findings with structure, tracking discipline, and a touch of stubborn consistency.
Start by hard-coding substitution oversight into your split-billing platform. Never let the TPA auto-map therapeutically equivalent NDCs without explicit logged approval. Flag any mid-quarter substitution during a shortage for manual review and audit trail creation. Then, require your contract pharmacies to send NDC-level dispensing data, not just drug name or GCN codes. If they can’t, your reconciliation won’t survive an audit.
Next, maintain contemporaneous documentation. HRSA won’t accept a retroactive “we couldn’t order it” note. Pull active FDA shortage records or wholesaler confirmation emails, attach them to substitution logs, label by date, and be done with it. The story you tell has to be linear: we couldn’t get NDC A, substituted B, verified it, and dispensed only what we documented.
And yes, train your staff regularly. Quarterly refreshers at least. Most audit findings start with good intentions and bad assumptions about billing logic. In 2026, assuming software will protect you is professional denial.
HRSA’s Stance Still Doesn’t Match Reality
Plenty of covered entities are exasperated, and honestly, I get it. HRSA still hasn’t released formal guidance on shortage-based substitutions beyond what auditors reference. There’s no statutory allowance, no temporary exception. Meanwhile, the FDA’s shortage list topped 130 products in early 2026. So, do you halt fills for clinically stable patients, or risk diversion findings? That’s the impossible setup we’re all operating in.
Industry associations are pressing HRSA to consider temporary exemptions modeled on FDA shortage protocols. The agency hasn’t commented, though several 340B insiders mentioned “internal review” of substitution documentation standards at the 2026 Winter Coalition meeting. Whether that becomes published guidance is uncertain. For now, auditors are applying strict NDC-by-NDC enforcement.
Until HRSA redefines how clinical equivalence intersects with NDC-specific pricing, substitution during shortage remains a compliance liability. Every contract pharmacy operating under 340B should assume it’s on borrowed time with those auto-mapped NDCs. Look, there’s doing the right thing for patients, and there’s surviving a 340B audit. Lately, those feel like very different jobs.