340B Risk Management
Surface the 340B Program Risk CFOs Don't See Coming

Eligible 340B providers are defined under the 340B statute and include federally qualified health centers, disproportionate share hospitals, critical access hospitals, Ryan White grantees, state AIDS drug assistance programs, and other safety net organizations. The program enables covered entities to stretch scarce funding by purchasing drugs at discounted prices, with savings reinvested into patient care. Each entity type has distinct eligibility documentation requirements administered by HRSA, and maintaining current proof of eligibility throughout participation is a core compliance obligation.

The 340B ceiling price is calculated based on the average manufacturer price minus a unit rebate amount, and manufacturers are legally required to sell outpatient drugs at discounted prices to covered entities. HRSA administers and monitors program compliance, while manufacturers are obligated to provide drugs at reduced prices as a condition of Medicaid participation. Disputes over ceiling price calculations have increased as drug companies seek to restrict contract pharmacy access, making pricing documentation an active audit risk area.

The prime vendor program, administered by Apexus under HRSA contract, helps covered entities access drugs at or below the ceiling price through centralized purchasing. Participation is voluntary but provides meaningful cost advantages, particularly for smaller entities. While the program itself is not a compliance risk area, the purchasing data it generates must be accurately reconciled against dispensation records during an audit to avoid diversion or duplicate discount findings.

The program does not prescribe a specific use of savings, but its intent is to help covered entities expand patient care and services for vulnerable populations. When organizations reinvest savings into services beyond pharmacy, documenting that reinvestment supports program integrity and demonstrates alignment with the program's public health mission. Entities that cannot clearly account for how they use 340B resources may face heightened scrutiny during HRSA reviews focused on program intent.

HRSA audits evaluate whether covered entities meet core requirements, including patient eligibility determinations, provider eligibility documentation, duplicate discount controls, and diversion prevention. They also examine whether drugs were dispensed only to eligible patients, whether policies and procedures reflect actual operations, and whether split-billing systems are correctly configured and maintained. Entities are typically given limited time to produce documentation once selected, which is why audit-ready records must be maintained continuously.

PBMs affect compliance primarily through their role in processing claims at contract pharmacies, where the interaction between pharmacy benefit systems and 340B accumulation logic creates data integrity risk. When a PBM's claim adjudication does not correctly identify 340B-eligible transactions, entities may fail to capture eligible claims or generate duplicate discounts on Medicaid-reimbursed prescriptions. Entities should confirm that TPA and PBM configurations are aligned and that claim separation functions accurately at the transaction level.

The obligations differ fundamentally: 340B hospitals operate under mandatory requirements for patient eligibility, duplicate discount avoidance, and purchasing controls that do not apply to non-participating facilities. When health systems manage both under shared infrastructure, the separation of purchasing, dispensation, and billing becomes a critical control area, as errors can result in diversion findings or repayment obligations. Mixed environments require clearly documented workflows and verified system configurations across all dispensing locations.

Yes, through contract pharmacy arrangements, but this introduces additional requirements around patient eligibility verification, claim capture accuracy, and data integrity. Drug companies have increasingly restricted the number of contract pharmacy locations through which they will sell discounted drugs, creating a more complex environment. Entities should ensure all contract pharmacy arrangements are documented, actively monitored, and updated to reflect current manufacturer restrictions to avoid claim capture failures or repayment exposure.

ADAPs, including state programs and Ryan White grantees, are among the covered entity types eligible to access discounted drugs for their patient populations. These programs often serve patients with complex medication needs, requiring careful eligibility documentation and coordination across dispensing sites. Because their patient populations and funding structures differ from hospital-based entities, ADAP participants should ensure their compliance frameworks are reviewed independently and not modeled directly on hospital-based audit standards.