340B Drug Pricing: HRSA-Proof Inventory Compliance

The 340B program is a brilliant policy mechanism with an inventory problem nobody wants to talk about

The 340B Drug Pricing Program is, in my considered opinion, one of the most elegant pieces of healthcare policy infrastructure the United States has produced. The basic deal is straightforward: pharmaceutical manufacturers who want their drugs covered by Medicaid and Medicare Part B must sell those same drugs at steep discounts (we are talking 25% to 50% off, sometimes more) to certain categories of healthcare providers who serve vulnerable populations. FQHCs, DSH hospitals, Ryan White clinics, children's hospitals, critical access hospitals, hemophilia treatment centers, and about a dozen other entity types qualify. Congress created this in 1992 under Section 340B of the Public Health Service Act, and the program now channels roughly $44 billion in discounted drug purchases annually. The intent is laudable: stretch scarce federal healthcare dollars so that safety-net providers can serve more uninsured and underinsured patients.

Here is the part that nobody puts in the brochure, though. The actual hard problem of 340B is not getting registered with HRSA's Office of Pharmacy Affairs, and it is not negotiating with your wholesaler for sub-WAC pricing. The hard problem is inventory compliance. Specifically, it is proving on a transaction-by-transaction basis that every single 340B-discounted drug you purchased ended up in the hands of a patient who actually qualifies under the program's patient definition, and that you never double-dipped by collecting both the 340B discount and a Medicaid rebate on the same claim. This sounds simple. It is, in practice, a nightmare of systems integration, data reconciliation, and operational discipline that trips up organizations ranging from tiny rural clinics to large academic medical centers. If you are a pharmacy director or compliance officer at a covered entity, inventory compliance is where your 340B program will succeed or fail, and it is almost certainly where you are most exposed to audit risk right now.

The two prohibitions that drive everything

Every 340B compliance requirement ultimately traces back to two statutory prohibitions, and understanding them deeply (not just being able to recite them) is the difference between a program that survives an HRSA audit and one that results in six-figure repayment obligations.

The first prohibition is against diversion. Diversion means dispensing a 340B-purchased drug to someone who is not a "patient" of your covered entity. The 1996 Patient Definition Guidance established a three-part test: the individual must have an established relationship with your entity such that you maintain records of their healthcare, one of your entity's healthcare professionals must have clinical responsibility for their care, and that same professional must have prescribed, ordered, or administered the drug in question. This sounds clear enough until you start examining edge cases, which is exactly what HRSA auditors do. Does a patient seen by a physician who has privileges at your hospital but maintains a separate private practice qualify? What about a referral patient who saw your specialist once for a consultation but receives ongoing care from their community physician? What about telemedicine encounters where the prescriber is employed by your entity but the patient has never physically set foot in your facility? HRSA has taken the position that overly broad interpretations of "patient" constitute diversion, and audit findings in this area are common, particularly when contract pharmacies are involved (more on that shortly).

The second prohibition is against duplicate discounts, and this one is more mechanically complex than most people appreciate. A duplicate discount occurs when your entity buys a drug at the 340B price and the manufacturer also pays a Medicaid rebate on that same drug. You cannot have it both ways. The manufacturer already gave you a discount; they should not also have to rebate the state Medicaid program for that same unit. This prohibition has applied to Medicaid fee-for-service since the program's inception, and since the 2010 Affordable Care Act (with further clarification in 2020 rulemaking), it extends to Medicaid managed care claims as well. Covered entities that have "carved in" to 340B for Medicaid (meaning they use 340B drugs for Medicaid patients and exclude those NDCs from the state rebate program via the Medicaid Exclusion File) must manage this process with surgical precision. Entities that have "carved out" (meaning they do not use 340B drugs for any Medicaid patients) must ensure their split billing systems correctly route every Medicaid prescription away from the 340B accumulation bucket. Either approach works. Either approach can fail catastrophically if your inventory tracking is not airtight.

Why the replenishment model is where programs go to die

Most covered entities use what is called a virtual inventory or replenishment model, and this is where the compliance story gets interesting. Under the physical separation model, you literally keep 340B drugs on separate shelves from your wholesale-purchased drugs and pull from the 340B shelf when filling prescriptions for eligible patients. This is conceptually simple and easy for auditors to verify, but it is operationally painful for any pharmacy filling more than a modest volume. You are maintaining duplicate inventories, you are dealing with expiration risk on the 340B side (because you cannot predict exactly which drugs eligible patients will need), and you need dedicated shelf space that many pharmacies simply do not have.

So most entities use replenishment. All drugs go into one pool. You dispense throughout the day without regard to funding source. After the fact, your 340B software analyzes each prescription to determine which ones were filled for eligible patients. Those eligible dispenses accumulate as credits. You then place a replenishment order with your wholesaler at the 340B price for the equivalent quantity of each NDC that was dispensed to eligible patients. In theory, this is elegant: you always have the right drugs on hand, you minimize waste, and you capture your 340B savings retrospectively. In practice, this model has more failure modes than a space shuttle, and HRSA audit findings confirm it.

The most common failure is what I would call the "aggregate replenishment" problem. An entity calculates their total eligible dispensing for the month, arrives at a dollar figure, and places a 340B order for roughly that amount. But they do not match at the NDC level. They dispensed 200 units of Drug A and 50 units of Drug B to eligible patients, but they ordered 150 units of Drug A and 100 units of Drug B because that is what they happened to need for general inventory. Now they have over-purchased Drug B on the 340B account (potential diversion) and under-purchased Drug A (lost savings). HRSA views NDC-level mismatches as a serious compliance failure, and they have required complete inventory reconciliations and manufacturer repayments in cases like this.

Timing is another failure mode. HRSA expects replenishment to happen on a reasonable schedule, generally interpreted as weekly or monthly. A Ryan White clinic that performed quarterly replenishment and failed to net out existing 340B inventory when placing orders ended up purchasing 340B drugs at quantities 40% higher than their eligible dispensing could support over an 18-month period. HRSA required repayment to manufacturers for every excess unit. Forty percent over-accumulation is not a rounding error; it is the kind of discrepancy that triggers uncomfortable conversations with your board of directors and potentially your legal counsel.

Split billing errors and the Medicaid managed care trap

Split billing is the mechanism by which your system decides, for each prescription dispensed, whether it belongs in the 340B accumulation bucket or the regular wholesale bucket. Get this wrong and you are either leaving savings on the table (routing eligible prescriptions away from 340B) or creating duplicate discounts (routing Medicaid prescriptions into 340B when you have carved in). The latter is the one that gets you in trouble with HRSA.

The Medicaid managed care dimension of this problem deserves special attention because it has generated a disproportionate number of audit findings. For years, many covered entities operated under the assumption that the duplicate discount prohibition applied only to Medicaid fee-for-service claims. This was arguably a reasonable reading of the pre-2010 statute, but it has been definitively wrong since the ACA extended the prohibition to Medicaid managed care. HRSA auditors have found FQHCs and DSH hospitals that were billing Medicaid managed care plans for 340B drugs and accumulating those same dispenses for 340B replenishment, creating duplicate discounts on every single one of those claims. The repayment calculations in these cases can be staggering, particularly for entities with large Medicaid managed care populations.

The operational challenge is that identifying Medicaid managed care patients at the point of dispense is harder than it sounds. These patients present with insurance cards that look like any other managed care plan. Your pharmacy management system needs to correctly flag the payer as a Medicaid managed care organization (not just "managed care"), and your 340B software needs to exclude those dispenses from accumulation if you have carved in, or route them correctly if you have carved out. Retroactive Medicaid eligibility determinations add another layer of complexity: a patient who was not Medicaid-eligible when they filled their prescription may become retroactively eligible, and your system needs to catch and reconcile that change.

The contract pharmacy problem is really an inventory tracking problem in disguise

Contract pharmacy arrangements allow covered entities to dispense 340B drugs through retail pharmacies that the entity does not own or operate. This dramatically extends the reach of 340B savings, but it also dramatically extends the surface area for compliance failures. The fundamental issue is that a contract pharmacy fills prescriptions for the general public, and only some of those prescriptions are for patients who meet the covered entity's patient definition. The contract pharmacy's systems need to correctly identify which prescriptions qualify, accumulate those for 340B replenishment, and prevent the rest from touching the 340B account.

In practice, contract pharmacy diversion findings are among the most common and most consequential HRSA audit results. A critical access hospital whose contract pharmacy arrangement captured all prescriptions written by the hospital's employed physicians, regardless of where the patient actually received care, discovered during an audit that prescriptions written at a physician's co-owned private clinic (which was not registered as a child site) constituted diversion. The prescribing physician was employed by the hospital, but the clinical encounter happened at an unregistered location, so the patient did not meet the patient definition for that prescription.

When a covered entity works with multiple contract pharmacies, there is an additional risk that HRSA takes very seriously: the possibility of a patient filling the same prescription at two different contract pharmacy locations, with both dispenses being accumulated for 340B replenishment. Whether this happens frequently in practice is debatable, but HRSA requires covered entities to demonstrate that they have centralized claim-level tracking across all contract pharmacy locations to prevent it. If you cannot show that control, you will get a finding.

The Medicaid Exclusion File adds yet another dimension to contract pharmacy complexity. If your entity uses the exclusion file to carve in for Medicaid (allowing you to dispense 340B drugs to Medicaid patients while excluding those NDCs from the state rebate program), you need to ensure that the exclusion file is current, that the state Medicaid system is actually honoring your exclusions, and that your contract pharmacies are correctly applying the carve-in logic for each NDC. Entities have been cited for assuming that submitting NDCs to the exclusion file was sufficient without verifying that state systems were processing those exclusions correctly. The disconnect between submission and implementation is exactly the kind of gap that generates duplicate discounts.

The financial stakes are not theoretical

I want to be direct about the consequences of 340B inventory compliance failures because I think many covered entities underestimate them. When HRSA issues audit findings, the remedies are real and immediate. Repayment obligations require the covered entity to calculate the 340B discount received on every non-compliant transaction and pay that amount back to the affected manufacturers. For an entity with a $10 million annual 340B program and a systemic split billing error affecting 15% of transactions, the repayment could easily reach seven figures. Corrective action plans require the entity to implement specific operational changes, often including new software systems, revised policies and procedures, additional staff training, and ongoing monitoring with regular reporting to HRSA. In egregious or repeated cases, HRSA can terminate an entity's participation in the 340B program entirely, which means losing access to discounts that may represent millions of dollars in annual savings and directly fund patient care programs.

The HRSA audit process itself is demanding. You will receive notification roughly 60 days before the audit, followed by a detailed document request covering policies, procedures, dispense data, purchase records, eligibility criteria, and audit trails from your inventory management systems. Auditors spend three to five days on-site, interviewing staff, observing pharmacy operations, reviewing patient records, and tracing individual prescriptions from the point of dispense through accumulation and replenishment. They will select samples and ask you to walk them through the complete lifecycle of specific 340B transactions. If you cannot produce an NDC-level, transaction-by-transaction audit trail that connects each 340B purchase to the specific eligible dispenses that justified it, you are going to have findings.

Batch-level tracking is the answer most entities have not yet implemented

The single most effective control for preventing 340B compliance failures is batch-level (or serial-number-level) inventory tracking, and the fact that many covered entities still have not implemented it is, frankly, puzzling given the stakes involved. Batch-level tracking means assigning a unique identifier to each drug package when it is received into inventory and following that specific package through dispensing. When a prescription is filled for an eligible patient, the system records exactly which batch was dispensed. Replenishment orders reference those specific dispenses, creating a one-to-one match between eligible dispensing and 340B purchasing at the NDC level.

This approach addresses virtually every common audit finding simultaneously. Replenishment matching becomes precise rather than approximate because you are tracking actual units dispensed, not aggregate dollar estimates. Duplicate discount prevention becomes automated because the system can flag any dispense billed to Medicaid and exclude it from 340B accumulation in real time. Diversion risk is minimized because the system can alert staff when accumulated eligible dispensing for a particular NDC exceeds what is supportable by current inventory, preventing over-purchasing before it happens. And when HRSA auditors arrive, you can hand them a complete, traceable audit trail that connects every 340B purchase to the specific eligible prescriptions that justified it, and every eligible prescription to the specific batch that was dispensed.

The implementation requires pharmacy management software or specialized 340B software capable of capturing batch and serial information at the point of dispense (barcode scanning makes this fast and accurate), integrated with your wholesaler ordering process so that replenishment purchases automatically reflect the correct quantities for each NDC. Without that integration, you are asking staff to manually reconcile between the tracking system and the ordering system, and manual reconciliation is where errors breed.

The compliance program that actually works

Organizations that consistently pass HRSA audits without significant findings tend to share a common characteristic: they treat 340B compliance as an ongoing operational discipline rather than a documentation exercise they scramble to assemble when the audit notification arrives. This means written policies that are actually followed (not just filed), regular self-audits using the same sampling methodology HRSA applies, exception reporting that flags anomalies like negative accumulation balances or unusually high replenishment ratios for investigation, and a designated 340B coordinator who reviews program metrics monthly and reports to leadership. It means training pharmacy staff not just on which buttons to click in the software but on why the patient definition matters and what diversion actually looks like in their daily workflow. And for entities with contract pharmacy arrangements, it means written agreements that specify compliance responsibilities, regular audits of the contract pharmacy's performance, and centralized tracking across all locations.

The 340B program represents an enormous financial resource for safety-net providers, often funding patient assistance programs, clinical services, and community health initiatives that would not exist without it. Losing access to that resource because of preventable inventory compliance failures is not just a financial problem; it is a mission problem. The good news is that the technology and operational frameworks to prevent those failures exist today and are well within reach of any covered entity willing to invest in them.

ShelfLifePro gives covered entities the batch-level inventory tracking and real-time compliance monitoring that 340B programs demand. If you are tired of cobbling together spreadsheets and hoping your replenishment math holds up under HRSA scrutiny, [see how it works for pharmacies](/pharmacy/).