By NorthArc Health, with Joshua Free, PharmD, MBA. Last updated 28 October 2026.
340B policies and procedures are the written rules a covered entity uses to govern its program: who oversees it, how claims qualify, how duplicate discounts are prevented, and how compliance is checked. They matter because HRSA audits the program against them. When the documents describe a program the team doesn’t actually run, the gap itself becomes a finding.
Key takeaways
- The most common audit gap is a 340B steering committee that the policy names but that has never met.
- Keep policy (governance) and procedure (daily steps) in separate documents, so a system change doesn’t break your policy.
- A TPA’s “yes” is not proof. Trace claims back to the EHR encounter.
- Audit the whole program every year, not only the contract pharmacy.
- Review your 340B policies and procedures whenever something changes how claims qualify, starting with any TPA conversion.
Joshua Free sees that gap every week. He is a pharmacist, PharmD, MBA, founder and president of Nelco Advisory and founder of RxFusion. He has worked in community retail and long-term care pharmacy, led a health system business unit that 340B reported into, and served as a chief pharmacy officer. Today most of his consulting work is annual independent audits.
On 340B Pulse, he put the problem in one example. “Policy references a 340B steering committee. That committee hasn’t met. Ever.”
This post covers the five places 340B policies and procedures most often drift from practice, what a real independent audit should cover, how to prove your TPA’s logic matches your policy, and what to build before the next wave of claims-level data arrives in 2027.
What are 340B policies and procedures?
340B policies and procedures are two different documents that work together. The policy sets governance and controls: what the entity intends to do and who is accountable. The procedure describes the day-to-day steps the team follows to carry it out.
Joshua’s advice is to keep them apart. “A lot of entities put the same procedure in the same document,” he said. A policy written at procedure level breaks every time a system changes.
- Policy: governance, oversight, eligibility positions, duplicate discount approach, audit commitments. Approved by a committee and changed rarely.
- Procedure: the working steps, screens and checks your analysts use. Updated by the team as tools and vendors change.
If your TPA updates its interface, or you adopt a new internal audit tool, a procedure-level policy is instantly out of date. “You’re just setting yourself up to operationally do something different than what that document says.”
Where do 340B policies and procedures drift from practice?
340B policies and procedures drift from practice in predictable places. In Joshua’s audits, the same five gaps come up again and again, and some matter far more than others.
| Gap | What the policy says | What the audit finds |
|---|---|---|
| 1. Steering committee | A 340B committee oversees the program | The committee has never met |
| 2. Training | Staff are trained to a set standard | Training is missing, or the standard can’t be met |
| 3. Medicaid status | Carve-in or carve-out as documented | The setup doesn’t match the policy |
| 4. Contract pharmacy | Arrangements handled as described | Practice differs from the document |
| 5. TPA logic | Claims qualify under the entity’s rules | Nobody at the entity can explain the settings |
1. A steering committee that never meets
This is the most common gap Joshua finds. The policy names a committee, and the committee exists only on paper. If the policy promises oversight, an auditor will ask for the minutes.
2. Training standards nobody meets
Policies either leave training out or set a standard the team isn’t meeting. Joshua’s view is that a policy should say who needs training and what kind, with room to scale it. A program analyst “needs lots of that training, maybe full 340B University every year,” while a CEO “maybe just needs one little module.”
3. Medicaid carve-in and carve-out status
Medicaid status is one of the more material mismatches, because it drives duplicate discount risk. When the policy says carve-out and the configuration says something else, the exposure is real. Our duplicate discount prevention playbook covers the controls in detail.
4. Contract pharmacy handling
How the entity treats its contract pharmacies is another frequent discrepancy. Arrangements change faster than 340B policies and procedures do.
5. TPA logic nobody can explain
The deepest gap sits inside the vendor’s system. Your 340B policies and procedures say how claims should qualify, but the qualification rules live in TPA settings that nobody at the entity has reviewed.
Why do programs that run fine still fail on policy?
Programs that run fine still fail on policy because operations and governance are different things. A program can avoid diversion and duplicate discounts and still have no 340B policies and procedures behind it.
“There are a lot of programs out there that are operationally fine,” Joshua said, “but the policy is non-existent or not being followed.” Some entities he works with don’t know they need an audit, and don’t have a policy at all. In those cases, he starts at the ground level, building the first layers of governance and accountability.
Asked which tells him more, the policy or the claims data, Joshua didn’t hesitate. “I think policy. I look at policy as the fundamental groundwork of your operation.” The data still matters, and an audit has to cover both. But a program without written controls can’t show what it intended to do.
Does every covered entity need an annual independent audit?
HRSA’s expectation of an annual independent audit is tied to covered entities that use contract pharmacies. Joshua’s view is that every entity should audit its whole program every year, whether it uses contract pharmacies or not.
His reasoning is practical. “If I’m going to come audit a contract pharmacy, I’ve got to look at your whole policy. I may as well look at the whole program.”
HRSA’s guidance leaves a lot open:
- What “independent” means. Joshua reads it as not yourself, not the contract pharmacy and, in his view, not your TPA.
- What to audit. The guidance doesn’t list the scope.
- How many claims to sample. It doesn’t say that either.
So Joshua built his own method from experience, from actual HRSA findings, and from how the program has shifted in recent years, including contract pharmacy restrictions and challenges to hospital child sites. You can review HRSA’s 340B program guidance and its program integrity and audit information for the published requirements.
Should a mock audit copy HRSA’s process?
A mock audit doesn’t have to copy HRSA’s process exactly. For a sophisticated, well-run program, Joshua may hold its feet to the fire and emulate HRSA more closely. But the real goal is to show where the entity sits on the spectrum of risk.
A few things in 340B are black and white. Many are judgment calls. Joshua’s example: if you count observation patients as outpatients, what happens when one is admitted five minutes later? Every entity has to pick a position on questions like that.
“Maybe just as important is, do you understand what you just chose?” he said. “And are you prepared to defend it if you’re choosing a riskier position?” Your 340B policies and procedures should record those positions, so the choice is documented and deliberate.
How do you prove TPA logic matches your 340B policies and procedures?
You prove TPA logic matches your 340B policies and procedures by tracing claims back to your own records, not by reading the TPA’s report. A TPA’s yes only shows how the TPA applied its own rules.
Joshua’s standard has three parts:
- Know every rule. Your 340B analyst should know every qualification rule and filter the TPA applies. “Every single one.” Not from memory, but knowing where to find each one.
- Trace the claim. Pull the encounter from the EHR. Confirm the prescriber, the eligible department and the visit where the prescription started. “That’s the level you really have to go to.”
- Press the vendor. If the settings aren’t visible, ask your account manager. If the account manager is a relationship manager without the technical answer, find the implementation coordinator who built the configuration.
The reason is simple. “An HRSA auditor doesn’t care if the TPA said it counts. That’s not good enough.” Your auditable record is the source of truth, and your 340B policies and procedures have to match it, not the vendor’s dashboard. Thomasyna Sweed makes the same case on 340B Pulse in what HRSA really means for your TPA.
How should internal audits be designed?
Internal audits should be designed around known weak spots, not run at the same volume everywhere. Joshua’s warning is that haphazard internal auditing wastes the chance to find real problems.
His approach:
- Shrink sampling where results are clean. “If we are auditing Contract Pharmacy A, and it’s always perfect, why am I doing 100 claims a month?” Drop to 10 and move the time elsewhere.
- Focus on known vulnerabilities. If the EHR doesn’t apply the TB modifier correctly in every case, audit that more heavily.
- Audit everything after a change. Took on a new contract pharmacy that requires its own TPA? Audit 100% of claims for the first 30, 60 or 90 days.
“Every entity has them,” he said of weak spots. The skill is knowing your settings well enough to find them, and writing that intent into your 340B policies and procedures so the internal audit plan is part of governance.
What should trigger a 340B policy review?
A 340B policy review should be triggered by any change that alters how claims qualify or how the program is governed. The single change Joshua named first was a TPA conversion.
“If you are going to go through that process of a conversion, which is not a small undertaking, you should review your policy at the same time,” he said. Rebuilding every setting with the new vendor is the best chance your analysts will get to check each one against your written 340B policies and procedures.
Other triggers come from how fast programs change. Sites open and close, prescribers move, pharmacy leadership turns over, and Medicaid settings change, often faster than an annual review cycle. Multi-entity systems carry extra risk, because the rules differ by entity type:
- Grantees work from their scope of grant and Form 5A, 5B, and 5C, which hospital teams rarely see.
- A rural referral center opening an infusion center faces the orphan drug exclusion.
- A DSH hospital that is also a sole community hospital has to decide which designation to use.
“All of these things become layers of detail to figure out what in the heck are we supposed to do here,” Joshua said. Each decision belongs in your 340B policies and procedures, with the risk understood.
What should covered entities build for the CMS Part D repository and the 2027 rebate pilot?
Covered entities should build visibility into every claims-level data submission their TPA makes for them. Joshua recorded this episode on 1 October 2026, the first day of voluntary submissions to the CMS Part D 340B claims repository. The 2027 rebate pilot adds another claims-level flow on top.
Both are still in flux. The earlier rebate model was struck down in 2025, and the revised 2027 pilot is being challenged in court. As of 21 October 2026, it remains scheduled for 1 January. Joshua’s advice is to prepare as though both will happen. For the cash flow side, see our guide to the 2027 340B rebate pilot.
What to build:
- Visibility into TPA submissions. “TPAs should be doing this. They hold the right information.” But you need a way to see what was sent, confirm the file transfer didn’t break, and check the claims make sense.
- A spot-check routine. The same logic already applies to state Medicaid data. If a qualified managed Medicaid claim should appear in the feed to the state and you can’t see it, you can’t show you followed the state’s duplicate discount policy.
- Automated submissions. Asked which 340B task he would automate tomorrow, Joshua named data submission: state reporting, managed Medicaid and the federal repository.
Your 340B policies and procedures should say who owns each submission and how it is checked.
Where can AI help with 340B policies and procedures?
AI can help with 340B policies and procedures by checking documents and claims at a scale people can’t, as long as a human stays in the loop. Without that, it becomes another black box.
Joshua uses AI in his own work. When he reviews a policy, he reads the whole document himself, then uses AI tools to test whether it is internally consistent. But he is direct about the risk. “It confidently gives you garbage sometimes, too. And that’s the frustrating part, is you believe it.”
Some vendors now use AI to review 100% of claims. That sounds better than sampling, but Joshua’s question is “how do we audit the auditor?” His answer is a human reviewing a targeted subset, aimed at the claims AI is most likely to misread, such as referral capture or closed-loop referrals.
Frequently asked questions
What should 340B policies and procedures include?
340B policies and procedures should cover program governance and oversight, eligibility positions, how duplicate discounts are prevented, contract pharmacy arrangements, staff training by role, and the internal and independent audit plan. Keep detailed operating steps in a separate procedure document.
How often should a covered entity review its 340B policies and procedures?
At least once a year, and again whenever something changes how claims qualify. A TPA conversion, a new contract pharmacy, a change in Medicaid status or a new site should each trigger a review.
Who can perform an independent 340B audit?
HRSA does not define “independent” closely. Joshua Free’s interpretation is an auditor who is not the covered entity itself, not the contract pharmacy and not the entity’s TPA.
Is a TPA’s report enough to prove a claim qualifies?
No. A TPA’s report shows how it applied its own logic. To prove a claim, trace it back to the encounter in the EHR and confirm the prescriber, the eligible department and the originating visit.
What one 340B control should be tested this quarter?
Duplicate discount prevention. Joshua Free calls it one of the harder things to get right and one of the easier things to test, and it is an area both HRSA and manufacturers examine closely.
Make your 340B policy describe the program you actually run
The covered entities that pass audits cleanly are not the ones with the longest documents. They are the ones whose 340B policies and procedures match what the claims show: a committee that meets, training people actually complete, TPA settings someone can explain, and an independent audit every year.
NorthArc Health is a 340B consulting and technology company that builds custom Agentic AI solutions for covered entities. We help teams compare their 340B policies and procedures with their claims, flag where TPA logic and the auditable record disagree, and keep a human reviewing the claims that matter most.
Talk to NorthArc about 340B compliance
Listen to the full conversation
Joshua Free’s full episode, 340B Policy vs Practice: Where Audits Find the Gaps, is on 340B Pulse. For more on preparing for an audit, listen to our episode on HRSA audit readiness.
