Every HRSA audit I review has at least one finding that the covered entity could have prevented with basic operational discipline. These are not obscure regulatory traps. They are common mistakes that organizations make because nobody is paying close enough attention. Here are the five I see most often, and how to fix them before they cost you.
1. Orphan Registrations on OPAIS
Your OPAIS registration is your 340B license. Every child site, every associated pharmacy, and every contract pharmacy listed there must be current and accurate. Yet I routinely find organizations with sites listed on OPAIS that closed two years ago, contract pharmacies that terminated their agreements but were never removed, and pharmacy addresses that do not match the actual location.
HRSA cross-references your OPAIS registration against your actual operations. Every discrepancy is a finding. Run a quarterly review of your OPAIS registration against your current operations and update it within 30 days of any change. This is a 20-minute task that prevents a disproportionate number of audit findings.
2. Eligibility Without Documentation
Claiming a patient is 340B-eligible because your system flagged them is not enough. You need to be able to produce the documentation that supports that eligibility determination for every sampled claim. That means a medical record showing a qualifying visit with a provider at a registered site, within a reasonable timeframe of the dispense.
The most common gap is prescriptions generated from telehealth visits or referral encounters where the documentation trail is incomplete. If a prescription originates from a visit type that does not clearly establish the patient-entity relationship, do not claim it at 340B until you can document the connection.
3. Ignoring the GPO Prohibition
Certain covered entity types — primarily disproportionate share hospitals and their child sites — are prohibited from purchasing 340B drugs through a group purchasing organization. This prohibition is entity-type specific, and violations result in 340B repayment obligations plus potential program termination.
The mistake I see is not intentional GPO purchasing of 340B drugs. It is failing to properly segregate GPO and 340B purchasing in the pharmacy system. If your wholesaler account is set up to apply GPO pricing by default, you need a manual or automated check that prevents GPO pricing from being applied to any drug that will be dispensed as a 340B claim. This requires coordination between your pharmacy buyer and your 340B compliance officer.
4. Contract Pharmacy Oversight That Exists Only on Paper
Having a contract pharmacy agreement on file meets the minimum requirement. But HRSA expects active oversight — quarterly utilization reviews, anomaly investigation, and documented corrective actions. The covered entities that get findings are the ones where the agreement is in the filing cabinet, the TPA sends monthly reports, and nobody at the covered entity actually reviews them.
Assign a named individual to review contract pharmacy data quarterly. Document the review — date, reviewer, findings, actions taken. If the review finds nothing unusual, document that too. The auditor wants to see a pattern of oversight, not a single binder assembled the week before the audit.
5. No Written Policies or Outdated Ones
HRSA expects covered entities to maintain written policies and procedures for their 340B program. Not guidelines. Not informal practices. Written, dated, version-controlled documents that describe how the program operates — eligibility determination, purchasing, dispensing, contract pharmacy oversight, and compliance monitoring.
The mistake is not the absence of policies — most organizations have them. It is that the policies were written three years ago and no longer reflect how the program actually operates. If your policy says you use a replenishment model but you switched to accumulator 18 months ago, your policy is a liability, not a protection. Review and update your 340B policies annually, and date every revision.