HRSA Audit Risk and 340B Compliance Documentation for Infusion Groups

HRSA audits of covered entities test four areas set out in federal law, and infusion groups enrolled in 340B get examined on all four every time. The pattern in recent audit results shows these failures cluster in predictable places, mostly administrative rather than clinical, and infusion programs carry more of that risk than most other covered entity types because of how their drug volume and referral networks are built.

What HRSA audits of covered entities examine

A HRSA audit of a covered entity checks four things, and the statute is specific about each one. The first is eligibility: whether the entity meets the covered entity definition under section 340B(a)(4) of the Public Health Service Act. The third is duplicate discounts, governed by 42 U.S.C. 256b(a)(5)(A)(i): a 340B-priced drug cannot also generate a Medicaid rebate. The fourth is diversion, under 42 U.S.C. 256b(a)(5)(B): 340B drugs can only go to patients of the covered entity, not to anyone else.

HRSA states the consequences directly. Only one audit of a given covered entity runs at a time. When a manufacturer requests an audit, HRSA decides whether the government conducts it or the manufacturer does.

Audit scope reaches past the covered entity's main address. For infusion groups, which often run satellite locations and multiple pharmacy arrangements, this matters from the first page of the engagement letter: the audit is not just about the parent organization's books.

How HRSA selects covered entities for audit

HRSA does not pick audit targets at random. A 2013 HRSA notice sets out two audit types, risk-based and targeted, and the criteria behind each one point straight at features common to infusion programs.

Risk-based audits start with program types HRSA has judged higher risk, because of purchase volume, administrative complexity, or contract pharmacy use, and they move to lower-risk types after that. Findings from either track can get referred to a federal oversight or enforcement agency for further action.

Infusion programs tend to carry several of these risk factors at the same time. None of these factors is disqualifying on its own, but stacked together they raise the odds of selection.

About 90% of HRSA audits are risk-targeted, not random, so a program that already shows OPAIS anomalies, contract pharmacy complexity, or a prior adverse finding sits closer to the front of the line. But you can't guess who gets picked next, so you can't build audit-readiness that way. HRSA has not restated the 2013 selection criteria on its current program integrity pages, so the safer posture is to assume audit readiness has to hold regardless of whether a program believes itself likely to be chosen.

FY2025 audit findings and the administrative nature of program failure

HRSA's FY2025 audit results show nearly half of all audited covered entities came away with an adverse finding.

Among entities with adverse findings, incorrect OPAIS records appeared in three-quarters of them, the single most common finding by a wide margin. GPO violations were rare, present in only a small fraction of cases.

Look at where the weight sits. HRSA counts that as a compliance failure regardless of financial harm.

This finding distribution is consistent year over year. Entities that do get flagged face concrete consequences: 64% of entities with adverse findings in FY2025 faced at least one sanction, 50% were required to repay manufacturers, and 21% had sites terminated from the program.

Infusion programs and higher OPAIS, duplicate discount, and diversion risk

Infusion programs are exposed to more of the same three categories, for structural reasons tied to how infusion care is delivered.

Start with OPAIS. Each one of those events is a chance for the registry to drift from operational reality. And once it drifts, an inaccurate OPAIS record can make a transaction that was substantively fine look improper on paper, which can trigger a diversion finding layered on top of what started as a registry error.

Duplicate discounts follow a similar logic. Multi-site and multi-state infusion groups add another layer: carve-in versus carve-out status has to be tracked correctly by state and by site, and getting that wrong in one location doesn't stay contained to that location on an audit report.

Diversion risk in infusion settings often traces back to referrals. If a patient is referred by a provider who isn't employed or contracted by the covered entity, and whose practice site isn't a registered 340B location, the resulting claim carries diversion exposure regardless of how straightforward the patient's eligibility looks. And infusion programs built around recurring treatment for stable patients face a risk that's easy to overlook: eligibility confirmed at intake doesn't stay confirmed forever. HRSA wants you to determine eligibility at every visit, not assume it from enrollment history.

Auditor requests and reviews during field work

HRSA's audit process runs in five stages, and if you know the shape of each one, you can build the right documentation before anyone asks for it.

Stage one begins with an engagement letter. Stage two is the fieldwork itself, conducted onsite or remotely. Auditors review the entity's policies and procedures and check how they're actually carried out in practice. They verify eligibility, including GPO prohibition compliance, and they review auditable records, outpatient clinic eligibility, and the internal controls meant to prevent diversion and duplicate discounts. Remote audits use the same procedures, but through secure workspaces, secured email, and Zoom, which HRSA says is the preferred method for reviewing sample items and patient records.

Stage three produces the preliminary and final reports. Stage four is notice and hearing. Disagreement means a written objection with supporting documentation within 30 days, and no CAP gets filed until HRSA completes its review of that objection.

Stage five is CAP implementation and repayment. Once everything is finalized, the findings and sanctions get published on HRSA's website.

The document requests at the outset of an audit cover 340B compliance policies and procedures, eligibility documentation, patient definition and eligibility criteria, purchasing records, inventory tracking system details, Medicaid billing procedures, and sample claim or dispense-level data.

Why corrective action plans rarely solve the underlying problem

Most covered entities that got re-audited after an adverse finding were still found non-compliant. You file a CAP, HRSA signs off, and then the same problems come back. That gap between filing a plan and actually fixing the underlying process is the central fact to understand about how 340B compliance fails over time.

HRSA's six-month window for CAP implementation and manufacturer settlement is tight, and entities that can't meet it risk termination. But the timeline isn't really the obstacle. Most adverse findings, as the FY2025 numbers show, involve administrative and data maintenance work: OPAIS records, MEF accuracy, transaction documentation. You need ongoing operational discipline for this, not a single corrective sweep through old files.

Some programs that failed a re-audit had invested in compliance software after their first adverse finding. A tool only works as well as the discipline behind it gets applied.

Infusion programs feel this acutely, because recurring treatment keeps generating new 340B transactions all the time. If a CAP cleans up historical OPAIS entries or past MEF mismatches but doesn't change how new transactions get created and checked going forward, it will produce the same findings again within months. Compliance has to work prospectively, built into the daily workflow, not assembled after the fact in response to what an auditor already found.

Patient eligibility documentation across a recurring infusion treatment cycle

A patient's 340B eligibility can't be settled once at intake and left alone for the rest of a treatment course. Each infusion visit generates its own 340B transaction, and each one needs its own defensible eligibility record.

Auditors check whether a patient counts as inpatient or outpatient, and that determination has to be documented at the transaction level rather than inferred from however the patient was classified when they first enrolled. A referral from an unregistered site creates diversion exposure on the resulting claim no matter how clearly eligible the patient is.

The patients at greatest risk here are often the ones who look the safest: people who have been stable on the same therapy for months or years. If you're running multiple infusions a day, you need a record for every encounter, not a periodic spot-check.

OPAIS record maintenance as a continuous operational function, not an annual recertification task

OPAIS inaccuracy drives more adverse findings than any other category, and infusion programs that grow, by adding sites, satellite clinics, or contract pharmacy relationships, create update events faster than most administrative teams are built to track.

The error types that keep recurring across FY2025 findings follow a consistent list: terminated contract pharmacies never removed from registration, duplicate registrations, missing outpatient facilities or grant-associated sites, ineligible or incorrectly registered sites, incorrect Medicare cost report data covering filing dates, reporting periods, or DSH percentages, address and location errors from manual entry or outdated information, and incorrect EIN, entity classification, or contact details.

Each of these looks like a clerical matter on its own. HRSA uses OPAIS to validate eligibility in the first place, so when the registry doesn't match what's actually happening at a site, the program's compliance posture becomes unprovable even if every underlying drug transaction was legitimate.

The discipline this calls for is continuous. OPAIS needs updating within days of any operational change: a new infusion suite opening, a contract pharmacy relationship ending, a site address changing. Annual recertification gives covered entities a chance to step back and confirm they're still meeting program responsibilities, and HRSA frames it that way. It was never meant to substitute for keeping the registry current in real time. A program that only touches OPAIS at recertification will carry stale data for months at a stretch, and an auditor arriving in month eight of that stretch will find it.

Duplicate discount controls and Medicaid Exclusion File management across complex payer mixes

A duplicate discount happens when a 340B-priced drug also gets billed to Medicaid, so the manufacturer ends up giving both a discount and a rebate on the same drug. The statute prohibits that outright, and infusion programs with complex payer mixes have a harder time catching it before it happens.

The difficulty starts with Medicaid managed care. High-volume infusion programs bill many claims every week, so an MEF mismatch has more room to slip through than it would at a lower-volume practice.

Carve-in and carve-out status complicates this further. HRSA still treats an inaccurate exclusion file as a compliance failure, whether or not any money actually changed hands improperly.

A 100% transaction-level check, confirming MEF status on every claim instead of sampling a subset, is the only reliable way to catch the specific failure mode where an EMR doesn't flag a Medicaid managed care plan at the point of billing.

Contract pharmacy oversight documentation requirements for infusion groups

Contract pharmacies dispense 340B drugs outside the covered entity's own walls, and HRSA's audit scope reaches those arrangements directly, not just the entity's primary location. Documented oversight of every contract pharmacy relationship is part of what an audit tests, not an optional extra.

Pharmacy service agreements need to stay current, and they need to match what's actually in OPAIS. Multi-state infusion groups face an added layer here: state-level 340B contract pharmacy rules and reporting requirements sit on top of the federal framework, and each jurisdiction can bring its own documentation expectations.

Buy-and-bill billing workflows and 340B compliance documentation in infusion

In buy-and-bill infusion, you can't just resolve a 340B compliance failure as a paperwork problem on HRSA's timeline. It's a cash event, because the practice already bought the drug and administered it before any audit finding ever surfaces. A repayment obligation comes straight out of money already spent.

Under buy-and-bill, the practice acquires the drug at 340B-discounted cost and bills the payer for both the drug and its administration. On high-cost biologics, the kind infusion centers administer every day, one adverse finding covering even a modest sample window can produce a repayment obligation big enough to hurt operating margin for the year.

J-code billing accuracy ties directly into this. If the billed units don't match the documented administered dose, the transaction record contradicts itself, and auditors testing transaction records on a sample basis will catch that kind of internal inconsistency and read it as a documentation control failure. Billing units, dispensing records, and the 340B transaction all need to tell the same story.

Revenue cycle documentation and 340B compliance documentation have to stay aligned for this reason. The RCM system capturing J-code units, authorization amounts, administered doses, and payer identifiers at the claim level is, at the same time, generating the transaction record that a 340B auditor will test. If a general-purpose billing system doesn't capture that level of detail, you get a revenue risk and a compliance documentation gap at once.

Building compliance infrastructure that matches infusion's recurring, high-volume workflow rather than reacting to audit findings

The re-audit failure rate makes the structural point clear: compliance infrastructure has to match the pace infusion treatment actually runs at, recurring patients, continuous new transactions, multiple sites, high-value drugs, rather than get assembled piece by piece after an audit finding arrives.

The infrastructure an infusion program needs lines up with what HRSA tests. And every 340B dispensing event needs a transaction-level record that can hold up under full review, not a sampled one.

Mock HRSA audits, simulating what HRSA would actually test before a real auditor shows up, serve a specific purpose here: they test whether policies are being carried out in practice, not just whether they exist on paper. HRSA's self-disclosure process gives covered entities a formal path to find and correct issues on their own terms. Catching a problem and reporting it before a targeted audit finds it is a fundamentally different compliance posture than waiting to get caught.

The revenue cycle operation behind an infusion group participates in this whether it was designed for that purpose or not. For infusion practices weighing their revenue cycle and compliance functions together, the real question is whether the RCM in place today already produces the transaction-level documentation that a 340B audit will examine, and whether the people running it understand infusion well enough to flag the gaps before HRSA does.