Experience the audit process before HRSA arrives.
Receiving notice of a HRSA audit should not be the first time your organization evaluates whether its records, policies, systems, and staff are prepared for detailed review.
Thrive340B conducts comprehensive mock audits designed to simulate the scope and pressure of an external 340B Program audit.
We evaluate the areas HRSA examines, identify potential vulnerabilities, test supporting documentation, interview key personnel, and help the covered entity correct concerns before an actual audit begins.
Know what an auditor may find before the auditor arrives.
Schedule a Mock Audit
Prepare for the Areas HRSA Reviews
HRSA’s covered entity oversight includes review of eligibility, duplicate discounts, diversion, and supporting program documentation. Covered entities must maintain accurate and auditable records demonstrating compliance. (HRSA)
Our mock audit may evaluate:
- Covered entity eligibility
- Parent and child-site eligibility
- 340B OPAIS accuracy
- Contract pharmacy registrations
- Patient eligibility
- Provider relationships
- Diversion controls
- Duplicate-discount controls
- Medicaid billing
- Purchasing and inventory
- Claims qualification
- Contract pharmacy activity
- Written policies and procedures
- Internal audit practices
- Corrective actions
- Self-disclosure processes
- Governance and oversight
A Structured Simulation of an External Audit
Thrive340B can organize the mock audit around a process similar to the one an organization may experience during an external review.
The engagement may include:
- Initial audit notification
- Audit scope confirmation
- Document request
- Document production review
- Program data analysis
- Transaction sampling
- Staff interviews
- Opening conference
- Eligibility testing
- Diversion testing
- Duplicate-discount testing
- Contract pharmacy testing
- Preliminary findings
- Leadership debrief
- Corrective-action planning
- Follow-up validation
The process gives staff experience responding to detailed requests while giving leadership a clearer understanding of program risk.
Audit Document Readiness
A covered entity may have compliant operations but still struggle during an audit because records are incomplete, inconsistent, disorganized, or difficult to retrieve.
Thrive340B helps prepare an organized audit file that may include:
- Eligibility documentation
- Grant documentation
- Medicare cost reports
- OPAIS records
- Parent and child-site listings
- Contract pharmacy agreements
- Provider agreements
- Provider rosters
- Organizational charts
- Policies and procedures
- Pharmacy records
- Wholesaler records
- Purchasing records
- Inventory records
- Medicaid billing data
- Internal audit reports
- Independent audit reports
- Corrective-action plans
- Training records
- Committee minutes
- Vendor reports
- Transaction-level data
Covered Entity Eligibility Review
We evaluate whether the organization’s current structure continues to support participation.
The review may include:
- Covered entity classification
- Grant status
- Hospital eligibility
- Ownership and control
- Cost-report information
- Parent and child-site relationships
- Outpatient facility status
- Service locations
- Terminated locations
- Organizational changes
- Annual recertification
- Supporting records
HRSA requires covered entities to recertify eligibility annually and report eligibility changes through 340B OPAIS. (HRSA)
OPAIS Validation
Inaccurate registration records can create avoidable findings.
We compare internal records with 340B OPAIS information involving:
- Covered entity name
- Addresses
- Parent and child sites
- Contract pharmacies
- Authorizing official
- Primary contact
- Medicaid billing information
- Effective dates
- Termination dates
- Duplicate registrations
- Inactive arrangements
- Recently added locations
HRSA’s published audit results continue to identify inaccurate or outdated OPAIS information among covered entity findings. (HRSA)
Patient Eligibility Testing
Our mock audit tests whether sampled prescriptions are supported by an appropriate patient relationship and qualifying clinical documentation.
Testing may include:
- Patient registration
- Medical records
- Encounter dates
- Prescribing provider
- Service location
- Covered entity responsibility for care
- Referral documentation
- Follow-up care
- Prescription date
- Refill activity
- Clinical record retention
- Consistency across systems
Provider Relationship Review
We evaluate whether providers associated with sampled activity have an appropriate and documented relationship with the covered entity.
The review may include:
- Employment agreements
- Professional service agreements
- Independent contractor agreements
- Credentialing records
- Provider start dates
- Termination dates
- Service locations
- Prescribing authority
- Medical record responsibilities
- Provider roster accuracy
- Vendor system configuration
Diversion Testing
The 340B statute prohibits the resale or transfer of 340B drugs to individuals who are not patients of the covered entity. HRSA audits examine diversion compliance as part of covered entity oversight. (HRSA)
Our testing may evaluate:
- Patient qualification
- Provider qualification
- Location qualification
- Prescription-to-encounter matching
- Referral prescriptions
- Refill qualification
- Manual overrides
- Data-matching logic
- Claims exclusions
- Exception reports
- Reversed claims
- Unmatched prescriptions
Duplicate-Discount Testing
Covered entities must maintain mechanisms designed to prevent duplicate discounts involving Medicaid drug rebates and 340B pricing. (HRSA)
Our mock audit may test:
- Medicaid Exclusion File information
- Carve-in or carve-out decisions
- Fee-for-service Medicaid claims
- Managed Medicaid claims
- Billing numbers
- National Provider Identifiers
- State Medicaid requirements
- Modifiers
- Contract pharmacy exclusions
- TPA settings
- Claims reversals
- Written procedures
Contract Pharmacy Review
HRSA audits covered entities’ contract pharmacy arrangements and places responsibility for compliance on the covered entity. HRSA recommends quarterly internal audits and annual independent audits of utilized contract pharmacies. (HRSA)
Our mock audit may review:
- Written agreements
- OPAIS registration
- Pharmacy locations
- TPA relationships
- Prescription capture
- Accumulator activity
- Replenishment
- Reversals
- Claims exclusions
- Medicaid safeguards
- Internal audits
- Independent audits
- Corrective actions
- Covered entity oversight
- Vendor reporting
Purchasing, Inventory, and Replenishment Review
Depending on the organization’s structure, testing may include:
- Wholesaler accounts
- 340B purchasing accounts
- Wholesale acquisition cost accounts
- Group purchasing organization accounts
- Split-billing configuration
- Purchase orders
- Inventory records
- Replenishment transactions
- Accumulator balances
- Negative balances
- Reversals
- Returns
- Credits
- Financial settlements
Policy and Procedure Review
Policies should be current, complete, and consistent with actual operations.
We assess whether policies adequately address:
- Eligibility
- Patient definition
- Provider relationships
- Diversion
- Duplicate discounts
- Medicaid billing
- Contract pharmacies
- Purchasing
- Inventory
- OPAIS maintenance
- Provider roster management
- Internal audits
- Independent audits
- Corrective actions
- Self-disclosures
- Record retention
- Staff responsibilities
- Vendor oversight
Staff Interview Preparation
Staff interviews can reveal whether written policies are understood and followed.
Thrive340B can conduct simulated interviews with:
- Authorizing officials
- Primary contacts
- Program directors
- Compliance officers
- Pharmacy leaders
- Finance staff
- Billing personnel
- Providers
- Clinical leaders
- Information technology staff
- Contract pharmacy contacts
- Vendor representatives
We help staff answer accurately, clearly, and within the scope of their responsibilities.
Findings and Risk Assessment
At the end of the mock audit, Thrive340B provides a written assessment that may categorize concerns as:
- Critical findings
- High-risk findings
- Moderate-risk findings
- Lower-risk findings
- Documentation deficiencies
- Operational weaknesses
- Policy gaps
- Training needs
- Improvement opportunities
- Effective controls
Each finding may include:
- The issue identified
- Supporting evidence
- Potential compliance implications
- Affected transactions or locations
- Recommended corrective action
- Responsible party
- Proposed completion date
- Follow-up testing
Corrective-Action Support
Thrive340B can help address identified concerns through:
- Root-cause analysis
- Transaction correction
- Provider roster updates
- OPAIS corrections
- Pharmacy configuration changes
- Medicaid corrections
- Policy revisions
- Staff retraining
- Expanded testing
- Vendor remediation
- Repayment analysis
- Self-disclosure evaluation
- Follow-up validation
Legal counsel should be involved when findings may require formal disclosure, repayment, or interpretation of legal obligations.
Support During an Actual HRSA Audit
When engaged separately, Thrive340B may assist during an actual audit with:
- Audit-notice review
- Internal response coordination
- Document collection
- Data validation
- Transaction review
- Interview preparation
- Daily audit support
- Issue tracking
- Preliminary-finding review
- Corrective-action planning
- Leadership communication
- Follow-up documentation
The covered entity remains responsible for all representations and submissions to HRSA.
Do Not Let the Audit Notice Become the Audit Plan
A mock audit gives your organization time to identify incomplete records, inaccurate registrations, weak controls, inconsistent policies, and unresolved transaction issues before they are reviewed externally.
Prepare the documents. Test the transactions. Train the staff. Correct the risks.
Prepare for Your Next Audit