HRSA quietly updated its 340B audit protocol in early 2026. If your last audit was more than two years ago, the process you remember is not the process you will face. Here are the changes that matter and how to prepare for them.
Expanded Scope on Patient Eligibility
The new protocol increases the sample size for patient eligibility review from 30 to 50 claims. More importantly, HRSA is now requiring covered entities to produce the underlying documentation — not just the claim data — for every sampled transaction. That means the actual medical record showing the qualifying encounter, not just an eligibility flag in the pharmacy system.
If your eligibility determination relies on a system flag that gets set at registration and never reverified, you have a problem. HRSA wants to see that the patient had a qualifying encounter with the covered entity within a reasonable timeframe of the 340B dispense. For FQHCs, that means a documented visit with a provider who has a relationship with the entity.
Contract Pharmacy Deep Dives
Previous audits reviewed contract pharmacy arrangements at a high level — checking that agreements were in place and that basic oversight existed. The new protocol goes deeper. Auditors are now examining the covered entity's quarterly utilization reviews, the specific oversight actions taken when anomalies are identified, and the data reconciliation process between the covered entity and its TPAs.
If your contract pharmacy oversight consists of receiving a monthly report and filing it, that will not pass muster. You need documented evidence that someone at the covered entity reviewed the data, identified any issues, and took corrective action. Meeting minutes, email correspondence, written findings — anything that shows active oversight, not passive receipt of information.
340B Database Registration Accuracy
HRSA is cross-referencing OPAIS registrations against actual operations more aggressively. If you have child sites registered that are no longer operational, pharmacies listed that have changed addresses, or contract pharmacy arrangements on file that have been terminated, clean it up before the auditor finds it. Registration inaccuracies are easy findings for auditors and they signal broader compliance issues.
The Corrective Action Timeline Shortened
Under the old protocol, covered entities had 90 days to respond to preliminary findings and implement corrective actions. The new timeline is 60 days. That is not a lot of time to redesign a workflow, retrain staff, and demonstrate that the fix is working. If you wait until you receive audit findings to start fixing problems, 60 days will feel very short.
How to Prepare
Run a self-audit now, using the new protocol parameters. Pull 50 random 340B claims from the past six months. For each one, verify that you can produce the patient eligibility documentation, the prescriber relationship to the entity, and the dispensing record. If you cannot produce clean documentation for more than 90 percent of the sample, you have work to do before HRSA does it for you.
The organizations that pass audits are not the ones with the best lawyers. They are the ones that run their programs cleanly every day and can prove it when asked.