What Happens in a HRSA Audit? A Step-by-Step Guide for 340B Clinics

If you’re a 340B-covered entity, the word “HRSA audit” can sound intimidating—but it doesn’t have to be. The truth is, Health Resources and Services Administration (HRSA) audits are a standard part of 340B program oversight. And with the right preparation and understanding of the process, your clinic can navigate them with confidence.

In this blog, we’ll walk you through what to expect in a HRSA audit, from the initial notification all the way to the final results—plus practical tips to help your clinic stay audit-ready year-round.

Why HRSA Conducts 340B Audits

HRSA audits are designed to ensure that covered entities are complying with 340B program requirements:

• Preventing duplicate discounts (Medicaid + 340B)
• Ensuring 340B drugs are dispensed only to eligible patients
• Maintaining accurate records and inventory

These audits help protect the integrity of the program and ensure savings are being used to expand patient care as intended.

Step 1: The Audit Notification

HRSA will notify your clinic of the audit via email - this typically comes from The Bizzell group. The notice will include:

• The name of the auditor
• An audit date (typically scheduled several weeks out)
• A pre-audit request list (also known as the Data Request List or DRL)
• They will schedule a Welcome Call (typically takes place within 7-14 days) - covering questions about your entities set up and will go over the DRL

Tip: Once you receive the notice, notify your internal team and any external partners (TPAs, contract pharmacies, consultants) immediately.

‍

Step 2: Document Collection

The pre-audit request list will require your clinic to provide:

• Policy and procedure documents related to 340B compliance
• Eligibility documentation (grants, contracts, etc.)
• Patient definition and eligibility criteria
• Purchasing records
• Inventory tracking system details
• Medicaid billing procedures
• Sample claim or dispense-level data for review

You’ll typically have about 2-4 weeks to submit this information.

Tip: Save time by keeping these files organized in a secure, shared drive year-round.

Step 3: Onsite or Virtual Audit

HRSA conducts both onsite and virtual audits. Either way, the auditor will:

• Interview your team members about 340B processes
• Review your documentation and data systems
• The bulk of the audit is reviewing an audit sample which is provided 2-3 business days before the audit
• Examine purchase-to-dispense records
• Assess how you prevent duplicate discounts and diversion
• Request additional data or clarifications

Tip: Assign one point person to communicate with the auditor and coordinate requests across your clinic.

Step 4: Findings & Final Report

Within about 60-90 days post-audit, HRSA will issue a preliminary report. You’ll have a chance to:

• Review the findings
• Submit clarifications or corrections
• Provide corrective action plans (CAPs) if needed

Once finalized, your report may be published publicly on HRSA’s website if there are findings.

Tip: Don’t panic if you receive findings—many clinics do. The key is showing that you understand the issue and are taking steps to resolve it.

Common HRSA Audit Findings

Some of the most frequent audit findings include:

• Ineligible patients receiving 340B drugs
• Incomplete or missing policies and procedures
• Inadequate inventory tracking
• Improper Medicaid billing processes
• Missing records of contract pharmacy oversight

Step 5: Corrective Action & Monitoring

If findings are issued, your clinic will need to implement corrective action plans and may be asked to:

• Submit a refund to manufacturers
• Update internal procedures
• Improve recordkeeping or staff training

HRSA may follow up to ensure corrective actions are implemented.

How to Stay Audit-Ready

You don’t need to scramble every time HRSA announces an audit. Here are ways to build a proactive audit-ready culture at your clinic:

✅ Review and update policies annually
✅ Run internal audits quarterly or semi-annually
✅ Train staff regularly on 340B compliance
✅ Use a TPA or consultant for inventory tracking and claim review
✅ Keep organized records and a compliance calendar

Audits Are a Process, Not a Punishment

While a HRSA audit can feel stressful, it’s really just a checkpoint to ensure your clinic is maximizing the value of the 340B program while following the rules. And if you approach it with preparation and transparency, you’ll come out stronger—and more compliant—on the other side.

Need help preparing for an audit or creating a compliance playbook? RxTrail is here to help. We’ve supported dozens of clinics through audits, policy development, and corrective action plans. Reach out to us to talk through your compliance strategy.

‍