What Is 340B Program Compliance? A Complete Guide for Covered Entities
By william smith 10-08-2026 12
The 340B Drug Pricing Program helps eligible healthcare organizations access certain outpatient drugs at discounted prices. For covered entities, however, participating in the program also means following specific rules around eligibility, patient use, drug purchasing, Medicaid billing, contract pharmacies, and recordkeeping.
So, what is 340B compliance? In simple terms, 340B program compliance means making sure an eligible organization uses 340B drugs only as allowed by federal requirements and maintains controls that prevent problems such as diversion and duplicate discounts.
For covered entities in the United States, understanding these requirements is important because compliance is an ongoing responsibility, not a one-time check.
How Does the 340B Program Work?
The 340B Program allows certain eligible healthcare organizations, known as covered entities, to purchase covered outpatient drugs at reduced prices from participating manufacturers.
The program is administered by the Health Resources and Services Administration (HRSA) through its Office of Pharmacy Affairs (OPA).
The basic process is straightforward:
- An eligible organization registers as a covered entity.
- The organization maintains its eligibility and required records.
- It purchases eligible outpatient drugs at 340B prices.
- The drugs are used or dispensed for eligible patients according to program requirements.
- The organization maintains controls to prevent diversion and duplicate discounts.
- HRSA and manufacturers can review compliance through authorized audits.
The goal is to make sure the benefits of the program are used according to the requirements established under Section 340B of the Public Health Service Act.
What Are the Main 340B Compliance Requirements?
340B compliance requirements cover several areas. A strong compliance program should address each one rather than focusing only on drug purchasing.
1. Maintain Eligibility
A covered entity must remain eligible for the 340B Program and keep its information accurate in HRSA's 340B Office of Pharmacy Affairs Information System (OPAIS).
HRSA requires participating entities to recertify their eligibility each year. Covered entities should also keep registration information, participating sites, and contract pharmacy information accurate and up to date.
Changes in ownership, locations, hospital classifications, or other important information may require additional review or updates.
2. Prevent Drug Diversion
Drug diversion is one of the central compliance concerns in the 340B Program.
In simple terms, diversion occurs when a 340B drug is provided to someone who does not meet the program's patient eligibility requirements or is otherwise used outside the permitted program rules.
HRSA's audit process specifically reviews covered entity controls designed to prevent diversion.
Covered entities should have clear processes for determining whether a patient qualifies for 340B treatment and should regularly review those processes.
3. Prevent Duplicate Discounts
A duplicate discount happens when a manufacturer provides a 340B discount on a drug and the same drug also generates a Medicaid rebate.
Federal law prohibits manufacturers from being required to provide both discounts for the same drug. Covered entities therefore need controls to prevent this from happening.
One important part of this process is the Medicaid Exclusion File (MEF). Covered entities must make sure their Medicaid billing information is accurate and reflects whether they carve in or carve out Medicaid fee-for-service utilization.
4. Keep Accurate and Auditable Records
Good documentation is a major part of 340B program compliance.
Covered entities should be able to show how their policies work in practice and how transactions are monitored. Records may include information related to purchasing, dispensing, patient eligibility, Medicaid billing, contract pharmacies, and internal controls.
HRSA states that covered entities must maintain auditable records documenting compliance with 340B requirements.
What Are 340B Eligibility Requirements?
340B eligibility requirements depend on the type of organization and its qualifying status under the program.
Covered entities can include certain hospitals, federally qualified health centers, Ryan White HIV/AIDS Program grantees, and other organizations specifically identified under federal law.
Eligibility is not permanent simply because an organization was accepted into the program. Covered entities must continue meeting the applicable requirements and complete annual recertification.
Hospital organizations may also need to provide supporting documentation for certain classifications during registration or recertification.
This makes eligibility monitoring an important part of an organization's overall compliance process.
What About 340B Contract Pharmacies?
Many covered entities use contract pharmacies to help dispense medications to eligible patients. These arrangements create another area that requires careful oversight.
The covered entity remains responsible for ensuring that its contract pharmacy arrangements meet 340B requirements, including controls against diversion and duplicate discounts.
HRSA recommends that covered entities perform quarterly internal audits and annual independent audits, or more frequent reviews when necessary, of their contract pharmacies. HRSA also recommends written policies that explain how contract pharmacy oversight is performed.
A useful review can compare dispensing, purchasing, and billing records to identify potential issues before they become larger compliance problems.
What Are 340B Audit Requirements?
340B audit requirements involve maintaining records and controls that allow compliance to be reviewed. HRSA and participating manufacturers have authority to audit covered entities under applicable federal requirements.
HRSA audits can review areas such as:
- Eligibility
- Patient eligibility
- Diversion
- Duplicate discounts
- GPO prohibition where applicable
- OPAIS information
- Medicaid Exclusion File information
- Contract pharmacy compliance
- Internal controls
- 340B transaction records
HRSA's audit process can include reviewing policies and procedures, testing internal controls, examining data, and reviewing sample transactions.
It is important to understand that an HRSA audit is not the same thing as an organization's routine internal compliance review. Internal monitoring helps a covered entity identify and correct problems before an external audit or other review.
How Can Covered Entities Prepare for 340B Compliance?
A practical compliance program should be ongoing and easy for staff to follow.
Review Policies Regularly
Policies should clearly explain responsibilities for purchasing, patient eligibility, Medicaid billing, contract pharmacies, recordkeeping, and issue escalation.
Monitor OPAIS Information
Organizations should regularly check their OPAIS records and make sure registration information remains accurate.
Review Medicaid Billing
Medicaid carve-in and carve-out decisions should match actual billing practices. The Medicaid Exclusion File should also be reviewed for accuracy.
Monitor Contract Pharmacies
Regular reviews can help identify discrepancies between dispensing, purchasing, and billing data.
Perform Internal Audits
Internal audits can help identify problems before they lead to repayment or corrective action. Reviews should be based on the organization's risk areas and the requirements that apply to its operations.
For organizations looking for a structured way to assess their current 340B processes, a 340B Program Health Check can be used as a reference when reviewing potential compliance gaps.
What Happens If a Covered Entity Is Not Compliant?
Non-compliance can lead to corrective action and, depending on the issue, repayment to affected manufacturers or other consequences.
HRSA's program integrity process allows covered entities to evaluate and correct certain compliance issues through self-disclosure. HRSA audit findings can also result in corrective action plans and repayment requirements.
The potential consequences make early detection valuable. Finding a problem during an internal review gives an organization an opportunity to investigate the cause, correct the process, and document the steps taken.
Why Is Ongoing 340B Compliance Important?
340B compliance is not simply about passing an audit. It is about building reliable processes that continue to work as an organization changes.
New locations, staff members, contract pharmacies, billing practices, software systems, and organizational structures can all create new compliance risks.
A strong approach combines:
- Clear written policies
- Defined staff responsibilities
- Accurate data
- Regular monitoring
- Internal audits
- Contract pharmacy oversight
- Staff training
- Documented corrective actions
This creates a more consistent compliance process and makes it easier to identify problems early.
Key Takeaways
340B program compliance means using the 340B Program correctly while maintaining controls that protect against diversion, duplicate discounts, and other compliance issues.
Covered entities should focus on five core areas:
- Maintain eligibility and accurate OPAIS information.
- Make sure 340B drugs are used only for eligible patients.
- Prevent duplicate discounts and maintain accurate Medicaid information.
- Keep complete and auditable records.
- Regularly monitor internal processes and contract pharmacy activity.
The most effective compliance programs are not built around an audit date. They are part of the organization's regular operations and are reviewed whenever policies, systems, or business relationships change.
FAQs About 340B Program Compliance
What is 340B compliance?
340B compliance is the process of following the federal requirements that apply to covered entities participating in the 340B Drug Pricing Program. It includes maintaining eligibility, preventing diversion and duplicate discounts, keeping accurate records, and following applicable purchasing and dispensing requirements.
Who is responsible for 340B compliance?
The covered entity is responsible for maintaining compliance with applicable 340B requirements. This responsibility can extend to areas involving contract pharmacies, where the covered entity must maintain appropriate oversight.
How often should a 340B program be reviewed?
There is no single review schedule that applies to every aspect of every covered entity's 340B operation. However, covered entities should conduct ongoing monitoring based on their risks. HRSA specifically recommends quarterly internal audits and annual independent audits of contract pharmacies.
What are the most common areas reviewed in a 340B audit?
HRSA audit procedures can review eligibility, diversion, duplicate discounts, Medicaid billing information, OPAIS records, contract pharmacies, internal controls, and 340B transaction records.
Can a covered entity correct a 340B compliance problem?
Yes. Covered entities can investigate potential issues and, where appropriate, use HRSA's self-disclosure process while taking steps to correct the problem.
Tags : 340B Compliance 340 340B Drug Pricing
