340B Compliance Guide for Covered Entities: Requirements, Checklist & Audit Readiness

The 340B Drug Pricing Program helps eligible healthcare organizations access discounted outpatient medications, supporting their ability to serve patients and communities with significant healthcare needs.

For participating hospitals, health centers, specialty clinics, and other covered entities, maintaining compliance requires coordination across pharmacy operations, patient eligibility, Medicaid billing, contract pharmacy arrangements, and regulatory oversight.

Changes in outpatient facility eligibility, inaccurate Medicaid billing designations, or unresolved pharmacy reconciliation issues can create compliance risks that extend beyond an individual transaction.

Effective 340B compliance depends on reliable operational controls, accurate documentation, and continuous oversight.

This guide explains the core 340B requirements, identifies eligible covered entities, and provides a practical checklist for strengthening compliance monitoring and audit readiness.

What Is 340B Compliance?

The 340B Drug Pricing Program is administered by the Health Resources and Services Administration (HRSA).

Under the program, participating pharmaceutical manufacturers must offer certain covered outpatient drugs to eligible healthcare organizations, known as covered entities, at prices that do not exceed the applicable 340B ceiling price.

The program helps qualifying safety-net providers stretch limited resources and maintain healthcare services for vulnerable and underserved populations.

However, participation comes with specific regulatory responsibilities.

Covered entities must maintain eligibility, prevent prohibited drug diversion and Medicaid duplicate discounts, keep registration information accurate, complete annual recertification, and preserve auditable records.

340B compliance extends beyond purchasing discounted medications. Organizations must demonstrate that their eligibility, pharmacy operations, billing arrangements, and documentation meet applicable program requirements.

Which Healthcare Organizations Are Eligible for the 340B Program?

The 340B Program is not limited to Federally Qualified Health Centers (FQHCs).

Federal law identifies several categories of healthcare organizations that may qualify as covered entities.

Each category has its own eligibility requirements.

For example, qualifying hospitals may need to meet conditions involving hospital classification, government ownership or contractual arrangements, and applicable Medicare disproportionate share thresholds.

Health centers and other non-hospital organizations generally qualify through specific program designations, grants, or statutory provisions.

Not every hospital, physician practice, or healthcare clinic automatically qualifies for 340B participation.

Organizations must meet applicable eligibility requirements, register in HRSA's 340B Office of Pharmacy Affairs Information System (OPAIS), and maintain eligibility throughout participation.

Six Essential 340B Compliance Requirements

Although covered entities operate in different healthcare environments, several core compliance responsibilities apply across the program.

1. Maintain Eligibility and Accurate OPAIS Registration

Covered entities must maintain accurate registration information in HRSA's 340B OPAIS.

This includes applicable organizational details, registered outpatient facilities, contact information, and contract pharmacy arrangements.

Changes in organizational structure, participating locations, or eligibility status may require registration updates.

For example, a hospital expanding its outpatient operations must determine whether a new location qualifies for participation and whether it needs separate registration.

Similarly, participating health centers should verify that registered service locations and organizational information accurately reflect their operations.

Regular eligibility reviews help organizations identify changes before they affect program participation.

2. Prevent Drug Diversion

Drug diversion occurs when 340B drugs are transferred or resold to individuals who do not qualify as patients of the covered entity under applicable program standards.

Preventing diversion requires documented eligibility procedures and appropriate transaction-level safeguards.

Depending on the organization, supporting documentation may include patient records, prescribing information, relevant provider relationships, dispensing data, and medication administration records.

A prescription's association with a participating pharmacy does not, by itself, establish patient eligibility.

Covered entities should periodically test whether they apply eligibility procedures consistently.

3. Prevent Medicaid Duplicate Discounts

The 340B statute prohibits manufacturers from requiring both a 340B discount and a Medicaid drug rebate for the same drug.

Covered entities must maintain safeguards that reflect their Medicaid billing arrangements.

For Medicaid fee-for-service, organizations generally designate whether they will:

• Carve in: Use 340B drugs for applicable Medicaid fee-for-service patients.
• Carve out: Exclude applicable Medicaid fee-for-service transactions from 340B purchasing.

Covered entities that carve in Medicaid fee-for-service must maintain accurate billing information in HRSA's Medicaid Exclusion File (MEF).

MEF changes follow quarterly effective-date rules, making coordination between pharmacy operations and billing teams essential.

The MEF does not apply to Medicaid managed-care claims. Organizations must establish separate safeguards for managed-care arrangements in accordance with applicable state and payer requirements.

4. Maintain Contract Pharmacy Oversight

Covered entities using contract pharmacies remain responsible for ensuring that these arrangements comply with applicable 340B requirements.

Oversight should address executed agreements, registration information, patient eligibility controls, dispensing activity, purchasing records, Medicaid billing, and reconciliation procedures.

HRSA's contract pharmacy guidance calls for annual independent audits, while its FAQs recommend quarterly internal audits.

Organizations should confirm current HRSA expectations and maintain an oversight program appropriate to their pharmacy arrangements.

Contract pharmacy Medicaid fee-for-service carve-in also requires specific state arrangements and HRSA approval.

Documented oversight helps organizations identify discrepancies and show how they investigate potential compliance issues.

5. Maintain Auditable Records

Covered entities must maintain records demonstrating compliance with applicable 340B requirements.

Depending on their operations, these may include patient eligibility documentation, purchasing information, dispensing records, Medicaid billing data, contract pharmacy reports, and supporting transaction histories.

Policies and procedures are important, but they do not replace underlying transaction evidence.

For example, an organization may have a documented patient eligibility policy, but an audit may examine whether sampled transactions followed that policy.

The objective is to demonstrate how compliance controls operated in practice.

6. Complete Annual Recertification

Covered entities must recertify their eligibility annually through HRSA's established process.

The organization's Authorizing Official must complete recertification.

Before the scheduled recertification period, organizations should review registration details, eligibility status, participating locations, and relevant contact information.

Failure to complete recertification within the required window can result in termination from the 340B Program.

Assigning ownership and monitoring recurring deadlines can help prevent avoidable administrative gaps.

Additional 340B Requirements for Certain Hospitals

Some participating hospitals face additional restrictions based on their statutory classifications.

For example, Disproportionate Share Hospitals, Children's Hospitals, and Free-Standing Cancer Hospitals are subject to the 340B group purchasing organization prohibition for covered outpatient drugs.

Certain hospital categories, including Critical Access Hospitals, Rural Referral Centers, Sole Community Hospitals, and Free-Standing Cancer Hospitals, also face applicable orphan-drug restrictions.

These requirements differ by hospital classification.

Organizations should confirm the provisions that apply to their specific covered entity type rather than assume every participating hospital follows the same purchasing rules.

Practical 340B Compliance Checklist

A structured checklist helps covered entities identify responsibilities, organize supporting evidence, and monitor unresolved compliance activities.

Responsibility assignments are illustrative. Each covered entity should define accountability according to its organizational structure.

The checklist should be supported by documented review schedules and procedures for addressing identified gaps.

How to Prepare for a 340B Audit

HRSA audits evaluate whether covered entities comply with applicable program requirements.

Audit activities may examine eligibility, diversion prevention, Medicaid duplicate-discount safeguards, contract pharmacy arrangements, hospital-specific restrictions, and supporting records.

A 340B audit is separate from an HRSA Health Center Program Operational Site Visit. The two processes evaluate different regulatory obligations.

Organize Audit Documentation

Covered entities should maintain accessible records supporting their policies, operational controls, and program activities.

Relevant documentation may include eligibility records, registration information, pharmacy agreements, Medicaid billing procedures, reconciliation reports, and prior compliance assessments.

Organize records so authorized personnel can retrieve the information needed to demonstrate compliance.

Conduct Risk-Based Transaction Testing

Internal testing helps organizations evaluate whether documented procedures are working as intended.

A practical review involves selecting a representative, risk-based sample of transactions and validating the applicable eligibility, prescribing, purchasing, dispensing, and billing information.

When contract pharmacies are involved, testing should also consider reconciliation records and relevant oversight activities.

Results should be documented, including identified exceptions and required follow-up.

Strong audit readiness depends on demonstrating how controls operated - not simply on having well-organized policy documents.

Recommended 340B Compliance Monitoring Schedule

340B compliance requires ongoing attention to eligibility, pharmacy operations, documentation, and regulatory obligations.

The following schedule provides a practical starting point.

This schedule is illustrative. Monthly reviews are an internal recommendation, not a universal HRSA requirement. Organizations should follow current program guidance and establish additional risk-based controls appropriate to their operations.

Managing 340B Compliance Findings and Corrective Actions

When a compliance review identifies a potential issue, the organization should determine its scope, preserve supporting evidence, and assign responsibility for investigation.

For example, a reconciliation review may reveal that Medicaid claims were processed differently than the organization's documented billing configuration.

Resolving the issue may require coordination among pharmacy operations, revenue cycle, compliance leadership, and external pharmacy partners.

Corrective actions should address both the immediate discrepancy and any underlying process weaknesses.

Potential remediation activities may include updating procedures, correcting system configurations, reviewing affected transactions, and documenting employee training.

When Is Self-Disclosure Necessary?

HRSA provides a self-disclosure process for covered entities that identify material compliance breaches.

HRSA recommends that covered entities establish documented criteria for determining materiality.

For material breaches, organizations should follow HRSA's self-disclosure guidance while implementing corrective actions.

Depending on the circumstances, remediation may involve manufacturer repayment or other financial remedies.

Qualified 340B compliance and legal personnel should be involved when evaluating significant findings.

The 340B Rebate Model Pilot: What Covered Entities Should Monitor

The 340B Program continues to evolve.

In July 2026, HRSA announced a revised 340B Rebate Model Pilot Program, with approved manufacturer plans scheduled to begin January 1, 2027.

The proposed model uses rebates rather than upfront 340B discounts for certain covered outpatient drugs included in approved manufacturer plans.

For affected transactions, participating covered entities may need to manage additional claims-data submission and rebate reconciliation activities.

However, implementation remains subject to program developments.

As of October 2026, the revised pilot faces ongoing litigation, and its scheduled implementation may change.

Covered entities should monitor HRSA's official announcements, approved manufacturer plans, affected drug lists, and any implementation updates before changing operational processes.

Regardless of the pilot's implementation status, the underlying requirements for eligibility, diversion prevention, duplicate-discount safeguards, and auditable records remain important.

How ComplAiance360 Supports 340B Compliance Oversight

Managing a 340B program requires coordination between pharmacy operations, financial controls, contract pharmacy oversight, compliance documentation, and corrective-action management.

While specialized pharmacy systems manage transaction-level activities, compliance teams also need visibility into the governance responsibilities surrounding those operations.

ComplAiance360 by SocialRoots.ai supports structured compliance documentation, monitoring, and corrective-action workflows.

The platform's currently published 340B capabilities are designed for FQHCs and FQHC Look-Alikes. The underlying governance needs are also relevant to other covered entity categories, although product support for those organizations should be confirmed directly with SocialRoots.ai.

Centralize Compliance Documentation

340B teams manage policies, pharmacy agreements, review reports, and supporting compliance records.

ComplAiance360 helps organize relevant documentation, providing teams with greater visibility into records and outstanding responsibilities.

Monitor Compliance Activities

Recurring obligations such as annual recertification, contract pharmacy oversight, and internal compliance reviews require coordinated scheduling.

ComplAiance360 supports monitoring of compliance-related activities, deadlines, and assigned responsibilities.

Track Findings and Corrective Actions

Internal reviews may identify issues that require investigation, documentation, and remediation.

ComplAiance360 provides structured corrective-action workflows that can help teams assign ownership, document follow-up, and monitor resolution.

Connect 340B Governance With Broader Compliance Operations

340B oversight often intersects with contract management, internal audits, financial controls, and organizational risk management.

Bringing these activities into coordinated compliance workflows can help teams maintain visibility across related responsibilities.

For example, when a contract pharmacy review identifies a discrepancy, compliance personnel may need to coordinate an investigation, documentation, remediation, and reporting to leadership.

A structured compliance management platform can support this administrative process while pharmacy-specific systems continue to manage transaction reconciliation and eligibility testing.

ComplAiance360 does not replace HRSA OPAIS, 340B split-billing systems, patient eligibility engines, or pharmacy reconciliation platforms.

Organizations should verify the platform's available capabilities, supported integrations, and regulatory coverage for their particular covered entity category.

Strengthen Your 340B Compliance Oversight

Effective 340B compliance requires more than tracking individual transactions. It also depends on organized documentation, clear responsibilities, timely reviews, and consistent corrective-action management.

Explore how ComplAiance360 supports compliance governance and how its available capabilities may fit your organization's oversight needs.

Key Takeaways

• Maintain eligibility: Keep covered entity registrations and OPAIS information accurate.
• Prevent drug diversion: Verify patient eligibility and maintain appropriate transaction controls.
• Avoid duplicate discounts: Align Medicaid fee-for-service billing with applicable MEF records and maintain separate managed-care safeguards.
• Oversee contract pharmacies: Review agreements, reconcile transactions, and maintain appropriate audit procedures.
• Prepare for audits: Preserve transaction-level evidence and conduct risk-based internal testing.
• Monitor corrective actions: Assign owners, establish deadlines, and document remediation.
• Track program changes: Monitor HRSA guidance and updates affecting 340B operations.
• Use software appropriately: ComplAiance360 supports compliance governance but does not replace transaction-level pharmacy systems or guarantee compliance.

Final Thoughts

The 340B Drug Pricing Program supports eligible healthcare organizations serving patients and communities with significant healthcare needs.

For participating hospitals, health centers, specialty clinics, and other covered entities, maintaining compliance requires coordinated operational controls, accurate records, and continuous oversight.

A structured compliance management approach can help organizations identify gaps, document corrective actions, and maintain clearer visibility into their program responsibilities.

By combining reliable pharmacy operations with effective governance and documentation practices, covered entities can strengthen 340B compliance and remain better prepared for regulatory review.

Official Resources

The following HRSA resources provide authoritative information about 340B requirements and program administration.

• HRSA 340B Eligibility and Registration: Covered entity classifications and participation requirements.
• HRSA 340B Program Requirements: Eligibility, diversion prevention, duplicate-discount safeguards, recertification, and auditable records.
• HRSA Medicaid Duplicate Discount Prohibition: Medicaid Exclusion File requirements and fee-for-service billing arrangements.
• HRSA Contract Pharmacy Services: Contract pharmacy registration, oversight, and audit guidance.
• HRSA Program Integrity and Self-Disclosures: Compliance audits, corrective actions, and reporting of material violations.
• HRSA 340B Rebate Model Pilot Program: Approved manufacturer plans, implementation guidance, and program updates.

This article is provided for informational and educational purposes only. It does not constitute legal or regulatory advice. Covered entities should consult current HRSA guidance and qualified professionals when evaluating specific compliance requirements.

Frequently Asked Questions